@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.60

package/dist/core/entities/event/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_ACTOR_NAME_MAX_LENGTH","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, EVENT_ACTOR_NAME_MAX_LENGTH),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMgB,YAAY;AAElB,IAAaC,eAAb,cAAkCR,sBAAAA;CACpBS;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB,GAAGD,kBAAkBoC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdrC,kBAAkBsC;KAClBtC,kBAAkBuC;KAClBvC,kBAAkBoC;IACrB,EACL;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB5C,WAAAA;EACrB,OAAO4C,mBAAmBF,cACtBE,iBAAiB5C,WAAAA;EAGrB,IAAI,MAAM,KAAK+B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5B1B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQqC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBP,MAAMO,iBAAiB,KAAKtC,QAAQsC,iBAAAA;GAE1D,MAAMlC,SAAS,KAAKL,WAAWwC,OAAO;IAClC9B,IAAI5B,WAAAA;IACJoD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASM,SAAST,MAAMG,SAAS,EAAA;IACjCC,OAAOK,SAAST,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5B1B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BkC,WAAWD,SAAST,MAAMU,WAAAA,GAAWlD;IACrCmD,aAAaF,SAAST,MAAMW,aAAa,GAAA;IACzCC,eAAeH,SAAST,MAAMY,eAAe,EAAA;IAC7CC,kBAAkBJ,SAAST,MAAMa,kBAAkB,EAAA;IACnDC,kBAAkBL,SAAST,MAAMc,kBAAkB,GAAA;IACnDhC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAsC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgBzC,SAAAA,CAAAA,CAAYqD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKnD,WAAWoD,KAAK/C,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQmD,KAAK,6BAA6BrB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMqC,QACFC,OACAjD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMuD,SAAS,MAAM5D,YAAY2D,OAAO;GAAEE,QAAQ5D;GAAaS;EAAM,CAAA;EAErE,IAAIoD,aAAa;EACjB,IAAI;GACA,MAAMpD,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM5B,eAAe6B,WAAW,CAAA;EAClF,SAAS0C,GAAG;GACR,IAAI,CAACtD,MAAMC,UACP,MAAMqD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK1D,WAAW6D,SAASL,QAAQ;GACpC1B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMgD,WAAW,MAAMxD,MAAMS,oBAAoBgD,QAAQ,EAAE9C,MAAM5B,eAAe6B,WAAW,CAAA;EAC3F,IAAI4C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY3D,MAAMC,WACpBtB,IAAIC,GAAG,WAAWoB,MAAMC,SAASE,KAAKC,EAAE,GAAGxB,GAAG,aAAaoB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIsD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASvE,sBAAsB6D,QAAQS,aAAa9E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI2E,SAASE,YAAY,eAC5BE,SAASvE,sBACL6D,QACAS,YAAY7E,GAAG6E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKnE,WAAW6D,SAASK,QAAQ,EAAE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMsD,aAAa,MAAM,KAAK7C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM4D,UAAUC,SAAS,MAAM,KAAKtE,WAAW6D,SAASL,QAAQ;GACpE,GAAIvD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIsD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM3D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUgE,UAAU;GAC3B,IAAI,KAAKjE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM5B,eAAe6B;KACrBT,MAAMzB,iBAAiB;OAClBD,kBAAkBwF,aAAalE;MAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA6D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASjE,KAAKiE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOjE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW4E,YAAYlE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIxB,oBAAAA;EAGd,IAAI,CAAC,KAAKc,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM5B,eAAe6B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB;MAClBD,kBAAkBwF,aAAalE;KAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASoC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_ACTOR_NAME_MAX_LENGTH","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","sessionId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            sessionId: input.sessionId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                sessionId: input.sessionId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, EVENT_ACTOR_NAME_MAX_LENGTH),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMgB,YAAY;AAElB,IAAaC,eAAb,cAAkCR,sBAAAA;CACpBS;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB,GAAGD,kBAAkBoC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdrC,kBAAkBsC;KAClBtC,kBAAkBuC;KAClBvC,kBAAkBoC;IACrB,EACL;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB5C,WAAAA;EACrB,OAAO4C,mBAAmBF,cACtBE,iBAAiB5C,WAAAA;EAGrB,IAAI,MAAM,KAAK+B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5BC,WAAWN,MAAMM,aAAa;GAC9B3B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQsC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBR,MAAMQ,iBAAiB,KAAKvC,QAAQuC,iBAAAA;GAE1D,MAAMnC,SAAS,KAAKL,WAAWyC,OAAO;IAClC/B,IAAI5B,WAAAA;IACJoD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASO,SAASV,MAAMG,SAAS,EAAA;IACjCC,OAAOM,SAASV,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5BC,WAAWN,MAAMM,aAAa;IAC9B3B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BmC,WAAWD,SAASV,MAAMW,WAAAA,GAAWnD;IACrCoD,aAAaF,SAASV,MAAMY,aAAa,GAAA;IACzCC,eAAeH,SAASV,MAAMa,eAAe,EAAA;IAC7CC,kBAAkBJ,SAASV,MAAMc,kBAAkB,EAAA;IACnDC,kBAAkBL,SAASV,MAAMe,kBAAkB,GAAA;IACnDjC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAuC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgB1C,SAAAA,CAAAA,CAAYsD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKpD,WAAWqD,KAAKhD,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQoD,KAAK,6BAA6BtB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMsC,QACFC,OACAlD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMwD,SAAS,MAAM7D,YAAY4D,OAAO;GAAEE,QAAQ7D;GAAaS;EAAM,CAAA;EAErE,IAAIqD,aAAa;EACjB,IAAI;GACA,MAAMrD,MAAMS,oBAAoB6C,YAAY,EAAE3C,MAAM5B,eAAe6B,WAAW,CAAA;EAClF,SAAS2C,GAAG;GACR,IAAI,CAACvD,MAAMC,UACP,MAAMsD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK3D,WAAW8D,SAASL,QAAQ;GACpC3B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMiD,WAAW,MAAMzD,MAAMS,oBAAoBiD,QAAQ,EAAE/C,MAAM5B,eAAe6B,WAAW,CAAA;EAC3F,IAAI6C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY5D,MAAMC,WACpBtB,IAAIC,GAAG,WAAWoB,MAAMC,SAASE,KAAKC,EAAE,GAAGxB,GAAG,aAAaoB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIuD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASxE,sBAAsB8D,QAAQS,aAAa/E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI4E,SAASE,YAAY,eAC5BE,SAASxE,sBACL8D,QACAS,YAAY9E,GAAG8E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKpE,WAAW8D,SAASK,QAAQ,EAAE,GAAIlE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMuD,aAAa,MAAM,KAAK9C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM6D,UAAUC,SAAS,MAAM,KAAKvE,WAAW8D,SAASL,QAAQ;GACpE,GAAIxD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIuD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM5D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUiE,UAAU;GAC3B,IAAI,KAAKlE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM5B,eAAe6B;KACrBT,MAAMzB,iBAAiB;OAClBD,kBAAkByF,aAAanE;MAChC,GAAG,KAAKoE,mBAAmBpE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA8D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASlE,KAAKkE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOlE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW6E,YAAYnE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIxB,oBAAAA;EAGd,IAAI,CAAC,KAAKc,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB6C,YAAY,EAAE3C,MAAM5B,eAAe6B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB;MAClBD,kBAAkByF,aAAanE;KAChC,GAAG,KAAKoE,mBAAmBpE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASqC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}

package/dist/core/entities/event/types.d.ts

@@ -52,6 +52,7 @@ export type EventRecordInput = {
     refType?: string | null;
     refId?: string | null;
     clientId?: string | null;
+    sessionId?: string | null;
     actorType?: `${IdentityType}` | null;
     actorId?: string | null;
     actorName?: string | null;
@@ -93,6 +94,7 @@ export type EventRequestContext = {
     actorType: `${IdentityType}` | null;
     actorId: string | null;
     actorName: string | null;
+    sessionId: string | null;
     requestPath: string | null;
     requestMethod: string | null;
     requestIpAddress: string | null;

package/dist/core/entities/event/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}

package/dist/core/entities/identity-provider/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAoBjC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDA8BjC,CAAC"}

package/dist/core/entities/identity-provider/schema.mjs

@@ -8,6 +8,16 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const identityProviderSchema = defineSchema({
 	name: EntityType.IDENTITY_PROVIDER,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["displayName"],
+		["protocol"],
+		["enabled"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"name",
@@ -19,21 +29,29 @@ const identityProviderSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"name",
-		"protocol",
-		"enabled",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"name",
+			"displayName",
+			"protocol",
+			"enabled",
+			"realmId",
+			"id"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/identity-provider/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","identityProviderSchema","name","IDENTITY_PROVIDER","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProvider } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const identityProviderSchema = defineSchema<IdentityProvider>({\n    name: EntityType.IDENTITY_PROVIDER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'displayName',\n            'protocol',\n            'preset',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['name', 'protocol', 'enabled', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,yBAAyBN,aAA+B;CACjEO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAQ;EAAY;EAAW;CAAU,EAAC;CAC/DC,WAAW;EAAED,SAAS,CAAC,OAAQ;EAAEE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","identityProviderSchema","name","IDENTITY_PROVIDER","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProvider } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const identityProviderSchema = defineSchema<IdentityProvider>({\n    name: EntityType.IDENTITY_PROVIDER,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['protocol'],\n        ['enabled'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'name',\n            'displayName',\n            'protocol',\n            'preset',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['name', 'displayName', 'protocol', 'enabled', 'realmId', 'id'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,yBAAyBN,aAA+B;CACjEO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,UAAW;EACZ,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAQ;GAAe;GAAY;GAAW;GAAW;EAAK;EAAEC,SAAS;CAAK;CACnGC,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CAClFc,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/identity-provider-account/error.d.ts

@@ -0,0 +1,7 @@
+import { ValidationError } from '@authup/errors';
+export declare const IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE: unique symbol;
+export declare class IdentityProviderAccountUnlinkBlockedError extends ValidationError {
+    constructor();
+}
+export declare function isIdentityProviderAccountUnlinkBlockedError(input: unknown): input is IdentityProviderAccountUnlinkBlockedError;
+//# sourceMappingURL=error.d.ts.map

package/dist/core/entities/identity-provider-account/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,eAAe,EAIlB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,uDAAuD,eAA8E,CAAC;AAEnJ,qBAAa,yCAA0C,SAAQ,eAAe;;CAQ7E;AAED,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yCAAyC,CAI9H"}

package/dist/core/entities/identity-provider-account/error.mjs

@@ -0,0 +1,24 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ErrorCode, ValidationError, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
+//#region src/core/entities/identity-provider-account/error.ts
+const IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE = Symbol.for("@authup/server-core/IdentityProviderAccountUnlinkBlockedError");
+var IdentityProviderAccountUnlinkBlockedError = class extends ValidationError {
+	constructor() {
+		super({
+			code: ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED,
+			message: "The last linked account of a user without a password can not be removed."
+		});
+		markInstanceof(this, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE);
+	}
+};
+function isIdentityProviderAccountUnlinkBlockedError(input) {
+	if (matchesInstanceof(input, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED;
+}
+//#endregion
+export { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/entities/identity-provider-account/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","isAuthupError","markInstanceof","matchesInstanceof","IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE","Symbol","for","IdentityProviderAccountUnlinkBlockedError","code","IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED","message","isIdentityProviderAccountUnlinkBlockedError","input"],"sources":["../../../../src/core/entities/identity-provider-account/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    ErrorCode, \n    ValidationError, \n    isAuthupError, \n    markInstanceof, \n    matchesInstanceof,\n} from '@authup/errors';\n\nexport const IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE = Symbol.for('@authup/server-core/IdentityProviderAccountUnlinkBlockedError');\n\nexport class IdentityProviderAccountUnlinkBlockedError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED,\n            message: 'The last linked account of a user without a password can not be removed.',\n        });\n        markInstanceof(this, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE);\n    }\n}\n\nexport function isIdentityProviderAccountUnlinkBlockedError(input: unknown): input is IdentityProviderAccountUnlinkBlockedError {\n    if (matchesInstanceof(input, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED;\n}\n"],"mappings":";;;;;AAeA,MAAaK,0DAA0DC,OAAOC,IAAI,+DAAA;AAElF,IAAaC,4CAAb,cAA+DP,gBAAAA;CAC3D,cAAc;EACV,MAAM;GACFQ,MAAMT,UAAUU;GAChBC,SAAS;EACb,CAAA;EACAR,eAAe,MAAME,uDAAAA;CACzB;AACJ;AAEA,SAAgBO,4CAA4CC,OAAc;CACtE,IAAIT,kBAAkBS,OAAOR,uDAAAA,GAA0D,OAAO;CAC9F,IAAI,CAACH,cAAcW,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMJ,SAAST,UAAUU;AACpC"}

package/dist/core/entities/identity-provider-account/index.d.ts

@@ -0,0 +1,5 @@
+export * from './error.ts';
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/identity-provider-account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/identity-provider-account/index.mjs

@@ -0,0 +1,8 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./types.mjs";
+import { identityProviderAccountSchema } from "./schema.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError } from "./error.mjs";
+import { IdentityProviderAccountService } from "./service.mjs";
+export { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, identityProviderAccountSchema, isIdentityProviderAccountUnlinkBlockedError };

package/dist/core/entities/identity-provider-account/schema.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+export declare const identityProviderAccountSchema: import("@rapiq/core").Schema<IdentityProviderAccount, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/identity-provider-account/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAShE,eAAO,MAAM,6BAA6B,4DAsCxC,CAAC"}

package/dist/core/entities/identity-provider-account/schema.mjs

@@ -0,0 +1,52 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./types.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/identity-provider-account/schema.ts
+const schemaMapping = { provider: EntityType.IDENTITY_PROVIDER };
+const identityProviderAccountSchema = defineSchema({
+	name: EntityType.IDENTITY_PROVIDER_ACCOUNT,
+	indexes: [
+		["id"],
+		["providerId", "userId"],
+		["userId"],
+		["userRealmId"],
+		["providerUserId", "providerId"],
+		["providerRealmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
+	fields: { default: [
+		"id",
+		"providerUserId",
+		"providerUserName",
+		"providerUserEmail",
+		"createdAt",
+		"updatedAt",
+		"userId",
+		"userRealmId",
+		"providerId",
+		"providerRealmId"
+	] },
+	filters: {
+		allowed: [...IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, "providerRealmId"],
+		indexed: true
+	},
+	relations: {
+		allowed: ["provider"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sorts: {
+		allowed: ["createdAt", "updatedAt"],
+		indexed: true
+	},
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { identityProviderAccountSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/identity-provider-account/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS","createRelationsReadGate","schemaMapping","provider","IDENTITY_PROVIDER","identityProviderAccountSchema","name","IDENTITY_PROVIDER_ACCOUNT","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-account/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\n// `provider` is a deliberately ungated include target: the provider list\n// is anonymous and the entity columns are benign (secrets live in EA).\nconst schemaMapping = { provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderAccountSchema = defineSchema<IdentityProviderAccount>({\n    name: EntityType.IDENTITY_PROVIDER_ACCOUNT,\n    indexes: [\n        ['id'],\n        ['providerId', 'userId'],\n        ['userId'],\n        ['userRealmId'],\n        ['providerUserId', 'providerId'],\n        ['providerRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        // `default` (not just `allowed`) so the adapter's plan-039\n        // force-select can dedupe against an explicit projection. The\n        // external-token columns (accessToken/refreshToken + their expiry\n        // metadata) are `select: false` on the entity, so they can never\n        // ride ANY read surface — the collection projection, an explicit\n        // `fields=accessToken`, or the un-projected single-record read —\n        // and are auto-exempt from the boot field-coverage assertion.\n        default: [\n            'id',\n            'providerUserId',\n            'providerUserName',\n            'providerUserEmail',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'userRealmId',\n            'providerId',\n            'providerRealmId',\n        ],\n    },\n    filters: { allowed: [...IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, 'providerRealmId'], indexed: true },\n    relations: { allowed: ['provider'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAeA,MAAMI,gBAAgB,EAAEC,UAAUJ,WAAWK,kBAAkB;AAE/D,MAAaC,gCAAgCP,aAAsC;CAC/EQ,MAAMP,WAAWQ;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,cAAc,QAAS;EACxB,CAAC,QAAS;EACV,CAAC,aAAc;EACf,CAAC,kBAAkB,YAAa;EAChC,CAAC,iBAAkB;EACnB,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EAQJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS,CAAIZ,GAAAA,uCAAuC,iBAAkB;EAAEa,SAAS;CAAK;CACjGC,WAAW;EAAEF,SAAS,CAAC,UAAW;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CACrFc,OAAO;EAAEJ,SAAS,CAAC,aAAa,WAAY;EAAEC,SAAS;CAAK;CAC5DI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/identity-provider-account/service.d.ts

@@ -0,0 +1,24 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { IUserIdentityRepository } from '../../identity/entities/user/types.ts';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
+import type { IIdentityProviderAccountRepository, IIdentityProviderAccountService, IdentityProviderAccountServiceReadOptions } from './types.ts';
+export type IdentityProviderAccountServiceContext = {
+    repository: IIdentityProviderAccountRepository;
+    userRepository: IUserIdentityRepository;
+    eventService?: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+};
+export declare class IdentityProviderAccountService extends AbstractEntityService implements IIdentityProviderAccountService {
+    protected repository: IIdentityProviderAccountRepository;
+    protected userRepository: IUserIdentityRepository;
+    protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    constructor(ctx: IdentityProviderAccountServiceContext);
+    protected isOwnedBy(entity: IdentityProviderAccount, actor: ActorContext): boolean;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/identity-provider-account/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,KAAK,EACR,kCAAkC,EAClC,+BAA+B,EAC/B,yCAAyC,EAC5C,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,qCAAqC,GAAG;IAChD,UAAU,EAAE,kCAAkC,CAAC;IAC/C,cAAc,EAAE,uBAAuB,CAAC;IACxC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAEF,qBAAa,8BAA+B,SAAQ,qBAAsB,YAAW,+BAA+B;IAChH,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,qCAAqC;IAQtD,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM5E,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yCAA8C,GACxD,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAsD7D,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yCAA8C,GACxD,OAAO,CAAC,uBAAuB,CAAC;IAsB7B,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yCAA8C,GACxD,OAAO,CAAC,uBAAuB,CAAC;CA2DtC"}

package/dist/core/entities/identity-provider-account/service.mjs

@@ -0,0 +1,129 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { identityProviderAccountSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
+import { IdentityProviderAccountUnlinkBlockedError } from "./error.mjs";
+import { EventName, EventRefType, EventScope, IdentityType, PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+//#region src/core/entities/identity-provider-account/service.ts
+var IdentityProviderAccountService = class extends AbstractEntityService {
+	repository;
+	userRepository;
+	eventService;
+	requestContext;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.userRepository = ctx.userRepository;
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+	}
+	isOwnedBy(entity, actor) {
+		return !!actor.identity && actor.identity.type === IdentityType.USER && entity.userId === actor.identity.data.id;
+	}
+	async getMany(query, actor, options = {}) {
+		const parsed = await decodeQuery(query, {
+			schema: identityProviderAccountSchema,
+			actor
+		});
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });
+		} catch (e) {
+			if (!actor.identity || actor.identity.type !== IdentityType.USER) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(parsed, {
+			userId: actor.identity.data.id,
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const { data: entities, meta } = await this.repository.findMany(parsed, { ...options.realmId ? { realmId: options.realmId } : {} });
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						[BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.userRealmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					[BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.userRealmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					[BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null
+				})
+			});
+		}
+		const user = await this.userRepository.findOneById(entity.userId);
+		const userHasOtherLogin = !user || !!user.password;
+		const { id: entityId } = entity;
+		if (!await this.repository.removeGuarded(entity, userHasOtherLogin)) throw new IdentityProviderAccountUnlinkBlockedError();
+		entity.id = entityId;
+		const requestContext = this.requestContext ? this.requestContext() : void 0;
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.IDENTITY_PROVIDER_UNLINKED,
+			refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,
+			refId: entityId,
+			realmId: entity.userRealmId ?? null,
+			actorType: actor.identity?.type ?? null,
+			actorId: actor.identity?.data.id ?? null,
+			actorName: actor.identity?.data.name ?? null,
+			sessionId: requestContext?.sessionId ?? null,
+			requestPath: requestContext?.requestPath ?? null,
+			requestMethod: requestContext?.requestMethod ?? null,
+			requestIpAddress: requestContext?.requestIpAddress ?? null,
+			requestUserAgent: requestContext?.requestUserAgent ?? null,
+			data: { providerId: entity.providerId }
+		});
+		return entity;
+	}
+};
+//#endregion
+export { IdentityProviderAccountService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/identity-provider-account/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","EventName","EventRefType","EventScope","IdentityType","PermissionName","AbstractEntityService","decodeQuery","IdentityProviderAccountUnlinkBlockedError","identityProviderAccountSchema","IdentityProviderAccountService","repository","userRepository","eventService","requestContext","ctx","isOwnedBy","entity","actor","identity","type","USER","userId","data","id","getMany","query","options","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_ACCOUNT_READ","e","findMany","realmId","entities","meta","total","push","evaluate","ATTRIBUTES","REALM_MATCH","userRealmId","getOne","findOneById","delete","IDENTITY_PROVIDER_ACCOUNT_DELETE","user","userHasOtherLogin","password","entityId","removed","removeGuarded","undefined","record","scope","IDENTITY","IDENTITY_PROVIDER_UNLINKED","refType","IDENTITY_PROVIDER_ACCOUNT","refId","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","providerId"],"sources":["../../../../src/core/entities/identity-provider-account/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError } from '@authup/errors';\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport {\n    EventName, \n    EventRefType, \n    EventScope, \n    IdentityType, \n    PermissionName,\n} from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { decodeQuery } from '../../query/index.ts';\nimport type { IUserIdentityRepository } from '../../identity/entities/user/types.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { IdentityProviderAccountUnlinkBlockedError } from './error.ts';\nimport { identityProviderAccountSchema } from './schema.ts';\nimport type {\n    IIdentityProviderAccountRepository,\n    IIdentityProviderAccountService,\n    IdentityProviderAccountServiceReadOptions,\n} from './types.ts';\n\nexport type IdentityProviderAccountServiceContext = {\n    repository: IIdentityProviderAccountRepository,\n    userRepository: IUserIdentityRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nexport class IdentityProviderAccountService extends AbstractEntityService implements IIdentityProviderAccountService {\n    protected repository: IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: IdentityProviderAccountServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    protected isOwnedBy(entity: IdentityProviderAccount, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            actor.identity.type === IdentityType.USER &&\n            entity.userId === actor.identity.data.id;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: IdentityProviderAccountServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>> {\n        const parsed = await decodeQuery(query, { schema: identityProviderAccountSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });\n        } catch (e) {\n            // Rows are always user-owned, so only a user identity has a\n            // self-service scope to fall back to.\n            if (!actor.identity || actor.identity.type !== IdentityType.USER) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            return this.repository.findMany(parsed, {\n                userId: actor.identity!.data.id,\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // No compile() WHERE-pushdown here: the compiled realm-reach\n        // condition binds the row's `realmId` column and this entity\n        // carries none (the owner realm is `userRealmId`), so the per-row\n        // evaluation below is the sound path.\n        const { data: entities, meta } = await this.repository.findMany(parsed, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n        const data: IdentityProviderAccount[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        [BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null,\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return { data, meta: { ...meta, total } };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n        options: IdentityProviderAccountServiceReadOptions = {},\n    ): Promise<IdentityProviderAccount> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.userRealmId !== options.realmId)) {\n            // A realm mismatch on the nested mount fails as not-found (no\n            // cross-realm existence oracle).\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    [BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null,\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n        options: IdentityProviderAccountServiceReadOptions = {},\n    ): Promise<IdentityProviderAccount> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.userRealmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    [BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null,\n                }),\n            });\n        }\n\n        // Lockout guard, enforced for EVERY caller (admin included): the\n        // last linked account of a user with no alternative login (no\n        // password) is their only way in. An admin sets a password first.\n        // The count and the delete run atomically in the repository (one\n        // transaction, the user's rows locked), so two concurrent unlinks\n        // cannot both pass the guard and strand the account. `password` is\n        // immutable on this path, so reading it here (outside the\n        // transaction) is safe: a concurrent password set can only make the\n        // guard more permissive, never less.\n        const user = await this.userRepository.findOneById(entity.userId);\n        const userHasOtherLogin = !user || !!user.password;\n\n        const { id: entityId } = entity;\n        const removed = await this.repository.removeGuarded(entity, userHasOtherLogin);\n        if (!removed) {\n            throw new IdentityProviderAccountUnlinkBlockedError();\n        }\n        entity.id = entityId;\n\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.IDENTITY_PROVIDER_UNLINKED,\n            refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,\n            refId: entityId,\n            realmId: entity.userRealmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            sessionId: requestContext?.sessionId ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: { providerId: entity.providerId },\n        });\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAqCA,IAAaY,iCAAb,cAAoDJ,sBAAAA;CACtCK;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEUE,UAAUC,QAAiCC,OAA8B;EAC/E,OAAO,CAAC,CAACA,MAAMC,YACXD,MAAMC,SAASC,SAAShB,aAAaiB,QACrCJ,OAAOK,WAAWJ,MAAMC,SAASI,KAAKC;CAC9C;CAEA,MAAMC,QACFC,OACAR,OACAS,UAAqD,CAAC,GACU;EAChE,MAAMC,SAAS,MAAMrB,YAAYmB,OAAO;GAAEG,QAAQpB;GAA+BS;EAAM,CAAA;EAEvF,IAAIY,aAAa;EACjB,IAAI;GACA,MAAMZ,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5B,eAAe6B,+BAA+B,CAAA;EACtG,SAASC,GAAG;GAGR,IAAI,CAACjB,MAAMC,YAAYD,MAAMC,SAASC,SAAShB,aAAaiB,MACxD,MAAMc;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YACD,OAAO,KAAKnB,WAAWyB,SAASR,QAAQ;GACpCN,QAAQJ,MAAMC,SAAUI,KAAKC;GAC7B,GAAIG,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAOJ,MAAM,EAAEd,MAAMe,UAAUC,SAAS,MAAM,KAAK5B,WAAWyB,SAASR,QAAQ,EAAE,GAAID,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC,EAAG,CAAA;EAEnI,MAAMd,OAAkC,CAAA;EACxC,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAMtB,UAAUqB,UAAU;GAC3B,IAAI,KAAKtB,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BK,KAAKkB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMa,oBAAoBW,SAAS;KACrCT,MAAM5B,eAAe6B;KACrBX,MAAMxB,iBAAiB;OAClBD,kBAAkB6C,aAAa1B;OAC/BnB,kBAAkB8C,cAAc3B,OAAO4B,eAAe;KAC3D,CAAA;IACJ,CAAA;IACAtB,KAAKkB,KAAKxB,MAAAA;GACd,QAAQ;IACJuB,SAAS;GACb;EACJ;EAEA,OAAO;GAAEjB;GAAMgB,MAAM;IAAE,GAAGA;IAAMC;GAAM;EAAE;CAC5C;CAEA,MAAMM,OACFtB,IACAN,OACAS,UAAqD,CAAC,GACtB;EAChC,MAAMV,SAAS,MAAM,KAAKN,WAAWoC,YAAYvB,EAAAA;EACjD,IAAI,CAACP,UAAWU,QAAQU,WAAWpB,OAAO4B,gBAAgBlB,QAAQU,SAG9D,MAAM,IAAIrC,oBAAAA;EAGd,IAAI,CAAC,KAAKgB,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5B,eAAe6B,+BAA+B,CAAA;GAClG,MAAMhB,MAAMa,oBAAoBW,SAAS;IACrCT,MAAM5B,eAAe6B;IACrBX,MAAMxB,iBAAiB;MAClBD,kBAAkB6C,aAAa1B;MAC/BnB,kBAAkB8C,cAAc3B,OAAO4B,eAAe;IAC3D,CAAA;GACJ,CAAA;EACJ;EAEA,OAAO5B;CACX;CAEA,MAAM+B,OACFxB,IACAN,OACAS,UAAqD,CAAC,GACtB;EAChC,MAAMV,SAAS,MAAM,KAAKN,WAAWoC,YAAYvB,EAAAA;EACjD,IAAI,CAACP,UAAWU,QAAQU,WAAWpB,OAAO4B,gBAAgBlB,QAAQU,SAC9D,MAAM,IAAIrC,oBAAAA;EAGd,IAAI,CAAC,KAAKgB,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5B,eAAe4C,iCAAiC,CAAA;GACpG,MAAM/B,MAAMa,oBAAoBW,SAAS;IACrCT,MAAM5B,eAAe4C;IACrB1B,MAAMxB,iBAAiB;MAClBD,kBAAkB6C,aAAa1B;MAC/BnB,kBAAkB8C,cAAc3B,OAAO4B,eAAe;IAC3D,CAAA;GACJ,CAAA;EACJ;EAWA,MAAMK,OAAO,MAAM,KAAKtC,eAAemC,YAAY9B,OAAOK,MAAM;EAChE,MAAM6B,oBAAoB,CAACD,QAAQ,CAAC,CAACA,KAAKE;EAE1C,MAAM,EAAE5B,IAAI6B,aAAapC;EAEzB,IAAI,CAACqC,MADiB,KAAK3C,WAAW4C,cAActC,QAAQkC,iBAAAA,GAExD,MAAM,IAAI3C,0CAAAA;EAEdS,OAAOO,KAAK6B;EAEZ,MAAMvC,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnB0C,KAAAA;EAEJ,MAAM,KAAK3C,cAAc4C,OAAO;GAC5BC,OAAOvD,WAAWwD;GAClB1B,MAAMhC,UAAU2D;GAChBC,SAAS3D,aAAa4D;GACtBC,OAAOV;GACPhB,SAASpB,OAAO4B,eAAe;GAC/BmB,WAAW9C,MAAMC,UAAUC,QAAQ;GACnC6C,SAAS/C,MAAMC,UAAUI,KAAKC,MAAM;GACpC0C,WAAWhD,MAAMC,UAAUI,KAAKU,QAAQ;GACxCkC,WAAWrD,gBAAgBqD,aAAa;GACxCC,aAAatD,gBAAgBsD,eAAe;GAC5CC,eAAevD,gBAAgBuD,iBAAiB;GAChDC,kBAAkBxD,gBAAgBwD,oBAAoB;GACtDC,kBAAkBzD,gBAAgByD,oBAAoB;GACtDhD,MAAM,EAAEiD,YAAYvD,OAAOuD,WAAW;EAC1C,CAAA;EAEA,OAAOvD;CACX;AACJ"}

package/dist/core/entities/identity-provider-account/types.d.ts

@@ -0,0 +1,69 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DeepPartial } from 'typeorm';
+import type { IdentityProviderIdentity } from '../../identity/provider/types.ts';
+/**
+ * Filter keys an identity-provider-account list query may target.
+ */
+export declare const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS: readonly ["id", "userId", "providerId", "userRealmId", "providerUserId"];
+export type IdentityProviderAccountFindManyOptions = {
+    /**
+     * Force the result to a single user (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    userId?: string;
+    /**
+     * Restrict the result to a single owner realm (the nested
+     * `/realms/:realmId/identity-provider-accounts` mount). The owner
+     * realm of a row is `userRealmId`.
+     */
+    realmId?: string;
+};
+/**
+ * Unified port: the entity CRUD surface (management API) plus the
+ * account-manager methods the federated login and link flows consume.
+ * One adapter implements both concerns over the same table.
+ */
+export interface IIdentityProviderAccountRepository {
+    findMany(query: IQuery, options?: IdentityProviderAccountFindManyOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    findOneById(id: string): Promise<IdentityProviderAccount | null>;
+    remove(entity: IdentityProviderAccount): Promise<void>;
+    /**
+     * Atomically remove the account, refusing (returning `false`) when it
+     * is the user's LAST linked account and `userHasOtherLogin` is false —
+     * the unlink lockout guard. The count and the delete run in one
+     * transaction with the user's account rows locked (on drivers that
+     * support row locks), so two concurrent unlinks for the same user
+     * cannot both pass the guard and strand a password-less user with no
+     * login. Fires the entity subscriber like `remove`. Returns `true`
+     * when the row was removed.
+     */
+    removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean>;
+    /**
+     * Find identity account with user relation (federated login + link flow).
+     */
+    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
+    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
+}
+export type IdentityProviderAccountServiceReadOptions = {
+    realmId?: string;
+};
+export interface IIdentityProviderAccountService {
+    /**
+     * List linked accounts. An actor without
+     * `IDENTITY_PROVIDER_ACCOUNT_READ` is scoped to its own rows.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    /**
+     * Read a single linked account. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+    /**
+     * Unlink. Own rows need no permission. Refuses for EVERY caller when
+     * the row is the user's last linked account and the user has no
+     * password (lockout guard).
+     */
+    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/identity-provider-account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,qCAAqC,0EAMxC,CAAC;AAEX,MAAM,MAAM,sCAAsC,GAAG;IACjD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sCAAsC,GAAG,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE5I,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;OASG;IACH,aAAa,CAAC,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7F;;OAEG;IACH,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEvG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxF;AAED,MAAM,MAAM,yCAAyC,GAAG;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C;;;OAGG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,yCAAyC,GACpD,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEpE;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yCAAyC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE/H;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yCAAyC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAClI"}

package/dist/core/entities/identity-provider-account/types.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/identity-provider-account/types.ts
+/**
+* Filter keys an identity-provider-account list query may target.
+*/ const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS = [
+	"id",
+	"userId",
+	"providerId",
+	"userRealmId",
+	"providerUserId"
+];
+//#endregion
+export { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS };
+
+//# sourceMappingURL=types.mjs.map