@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.60

package/dist/core/entities/trust-anchor/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","appendQueryConditions","decodeQuery","trustAnchorSchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    PermissionName,\n    TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type {\n    ITrustAnchorRepository, \n    ITrustAnchorService, \n    TrustAnchorServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { trustAnchorSchema } from './schema.ts';\n\nexport type TrustAnchorServiceContext = {\n    repository: ITrustAnchorRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n    protected repository: ITrustAnchorRepository;\n\n    protected validator: TrustAnchorValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: TrustAnchorServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new TrustAnchorValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: TrustAnchorServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        let parsed = await decodeQuery(query, { schema: trustAnchorSchema, actor });\n        if (options.realmId) {\n            parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n        }\n\n        // Compile the read permissions against the knowns (actor identity) into a\n        // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n        // pagination and totals stay exact. Non-expressible policies fall back to\n        // the per-row post-evaluation below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        if (compiled.verdict !== 'post') {\n            return { data: entities, meta };\n        }\n\n        const data: TrustAnchor[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        if (!validated.realmId && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        if (!validated.realmId) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        const chain = parseCertificateChain(validated.certificate as string);\n        if (!chain[0] || !chain[0].ca) {\n            throw new ValidationError('A trust anchor must contain a CA certificate.');\n        }\n\n        if (typeof validated.enabled !== 'boolean') {\n            validated.enabled = true;\n        }\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realmId: entity.realmId,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        entity = await this.repository.save(entity);\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        await this.recordEvent(EventName.DELETED, entity, actor);\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for trust-anchor lifecycle operations\n     * (issue #3269) — trust anchors have no entity subscriber, so the\n     * security-relevant mutations (an enabled CA anchor turns on mTLS client\n     * auth for a realm) are recorded explicitly. The payload never carries\n     * certificate bytes.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: TrustAnchor,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.TRUST_ANCHOR,\n            refId: entity.id,\n            realmId: entity.realmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                enabled: entity.enabled,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n        return {\n            name: entity.name,\n            enabled: entity.enabled,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAMkB,mBAAmB;CACrBX,eAAeY;CACfZ,eAAea;CACfb,eAAec;AAClB;AAED,IAAaC,qBAAb,cAAwCV,sBAAAA;CAC1BW;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIhB,qBAAAA;EACrB,KAAKiB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAyC,CAAC,GACU;EACpD,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAmBa;EAAM,CAAA;EACzE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQjC,GAAG,WAAW6B,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQhC,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAImC,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QACrB,OAAO;GAAEE,MAAMC;GAAUC;EAAK;EAGlC,MAAMF,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBgB,cAAc;IAC1Cd,MAAMhB;IACNwB,MAAMzC,iBAAiB;MAClBD,kBAAkBiD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAvB,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM6B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EACjE,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBgB,cAAc;GAC1Cd,MAAMhB;GACNwB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAZ,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAekD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAekD,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUrB,WAAWP,MAAMgC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBlC,KAAAA;GAC1C,IAAIiC,cACAL,UAAUrB,UAAU0B;EAE5B;EAEA,IAAI,CAACL,UAAUrB,SACX,MAAM,IAAI3B,gBAAgB,4BAAA;EAG9B,MAAM,KAAKa,WAAW0C,oBAAoBP,SAAAA;EAE1C,MAAM5B,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAekD;GACrBf,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKnC,WAAW4C,gBAAgBT,SAAAA;EAEtC,MAAMU,QAAQtD,sBAAsB4C,UAAUW,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAI5D,gBAAgB,+CAAA;EAG9B,IAAI,OAAOgD,UAAUa,YAAY,WAC7Bb,UAAUa,UAAU;EAGxB,IAAIxB,SAAS,KAAKxB,WAAWgC,OAAOG,SAAAA;EACpCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAM,KAAK0B,YAAYpE,UAAUqE,SAAS3B,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;CAEA,MAAM4B,OACFtB,UACAX,MACAZ,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAea,WAAW,CAAA;EAE9E,IAAI2B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EAC/D,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMiD,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAeiE,OAAO,CAAA;EAEhF,MAAM9C,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAea;GACrBsB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAa;KAC5B,GAAGF;KACH,GAAGW;IACP;IACA,GAAG,KAAKR,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIW,UAAUxB,QAAQwB,UAAUxB,SAASa,OAAOb,MAC5C,MAAM,KAAKX,WAAW4C,gBAAgB;GAClCjC,MAAMwB,UAAUxB;GAChBG,SAASU,OAAOV;EACpB,GAAGU,MAAAA;EAGP,MAAM8B,WAAW,KAAKC,gBAAgB/B,MAAAA;EAEtCA,SAAS,KAAKxB,WAAWwD,MAAMhC,QAAQW,SAAAA;EACvCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAMiC,OAAOnE,gBAAgB,KAAKiE,gBAAgB/B,MAAAA,GAAS8B,QAAAA;EAC3D,MAAM,KAAKJ,YAAYpE,UAAU4E,SAASlC,QAAQjB,OAAO,EAAE,GAAIoD,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOjC;CACX;CAEA,MAAMsC,OACFC,IACAxD,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAec,WAAW,CAAA;EAE9E,MAAM0B,SAAS,MAAM,KAAKxB,WAAWgE,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACvC,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAec;GACrBqB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEuC,IAAIE,aAAazC;EACzB,MAAM,KAAKxB,WAAWkE,OAAO1C,MAAAA;EAC7BA,OAAOuC,KAAKE;EAEZ,MAAM,KAAKf,YAAYpE,UAAUqF,SAAS3C,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;;;;;;;IAWA,MAAgB0B,YACZvC,MACAa,QACAjB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBiE,KAAAA;EAEJ,MAAM,KAAKlE,cAAcmE,OAAO;GAC5BC,OAAOvF,WAAWwF;GAClB5D;GACA6D,SAAS3F,WAAW4F;GACpBC,OAAOlD,OAAOuC;GACdjD,SAASU,OAAOV,WAAW;GAC3B6D,WAAWpE,MAAMgC,UAAUqC,QAAQ;GACnCC,SAAStE,MAAMgC,UAAUpB,KAAK4C,MAAM;GACpCe,WAAWvE,MAAMgC,UAAUpB,KAAKR,QAAQ;GACxCoE,aAAa5E,gBAAgB4E,eAAe;GAC5CC,eAAe7E,gBAAgB6E,iBAAiB;GAChDC,kBAAkB9E,gBAAgB8E,oBAAoB;GACtDC,kBAAkB/E,gBAAgB+E,oBAAoB;GACtD/D,MAAM;IACFR,MAAMa,OAAOb;IACbqC,SAASxB,OAAOwB;IAChB,GAAG7B;GACP;EACJ,CAAA;CACJ;CAEUoC,gBAAgB/B,QAA0C;EAChE,OAAO;GACHb,MAAMa,OAAOb;GACbqC,SAASxB,OAAOwB;EACpB;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","appendQueryConditions","decodeQuery","trustAnchorSchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    PermissionName,\n    TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type {\n    ITrustAnchorRepository, \n    ITrustAnchorService, \n    TrustAnchorServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { trustAnchorSchema } from './schema.ts';\n\nexport type TrustAnchorServiceContext = {\n    repository: ITrustAnchorRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n    protected repository: ITrustAnchorRepository;\n\n    protected validator: TrustAnchorValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: TrustAnchorServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new TrustAnchorValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: TrustAnchorServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        let parsed = await decodeQuery(query, { schema: trustAnchorSchema, actor });\n        if (options.realmId) {\n            parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n        }\n\n        // Compile the read permissions against the knowns (actor identity) into a\n        // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n        // pagination and totals stay exact. Non-expressible policies fall back to\n        // the per-row post-evaluation below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        if (compiled.verdict !== 'post') {\n            return { data: entities, meta };\n        }\n\n        const data: TrustAnchor[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        if (!validated.realmId && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        if (!validated.realmId) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        const chain = parseCertificateChain(validated.certificate as string);\n        if (!chain[0] || !chain[0].ca) {\n            throw new ValidationError('A trust anchor must contain a CA certificate.');\n        }\n\n        if (typeof validated.enabled !== 'boolean') {\n            validated.enabled = true;\n        }\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realmId: entity.realmId,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        entity = await this.repository.save(entity);\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        await this.recordEvent(EventName.DELETED, entity, actor);\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for trust-anchor lifecycle operations\n     * (issue #3269) — trust anchors have no entity subscriber, so the\n     * security-relevant mutations (an enabled CA anchor turns on mTLS client\n     * auth for a realm) are recorded explicitly. The payload never carries\n     * certificate bytes.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: TrustAnchor,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.TRUST_ANCHOR,\n            refId: entity.id,\n            realmId: entity.realmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            sessionId: requestContext?.sessionId ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                enabled: entity.enabled,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n        return {\n            name: entity.name,\n            enabled: entity.enabled,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAMkB,mBAAmB;CACrBX,eAAeY;CACfZ,eAAea;CACfb,eAAec;AAClB;AAED,IAAaC,qBAAb,cAAwCV,sBAAAA;CAC1BW;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIhB,qBAAAA;EACrB,KAAKiB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAyC,CAAC,GACU;EACpD,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAmBa;EAAM,CAAA;EACzE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQjC,GAAG,WAAW6B,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQhC,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAImC,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QACrB,OAAO;GAAEE,MAAMC;GAAUC;EAAK;EAGlC,MAAMF,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBgB,cAAc;IAC1Cd,MAAMhB;IACNwB,MAAMzC,iBAAiB;MAClBD,kBAAkBiD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAvB,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM6B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EACjE,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBgB,cAAc;GAC1Cd,MAAMhB;GACNwB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAZ,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAekD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAekD,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUrB,WAAWP,MAAMgC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBlC,KAAAA;GAC1C,IAAIiC,cACAL,UAAUrB,UAAU0B;EAE5B;EAEA,IAAI,CAACL,UAAUrB,SACX,MAAM,IAAI3B,gBAAgB,4BAAA;EAG9B,MAAM,KAAKa,WAAW0C,oBAAoBP,SAAAA;EAE1C,MAAM5B,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAekD;GACrBf,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKnC,WAAW4C,gBAAgBT,SAAAA;EAEtC,MAAMU,QAAQtD,sBAAsB4C,UAAUW,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAI5D,gBAAgB,+CAAA;EAG9B,IAAI,OAAOgD,UAAUa,YAAY,WAC7Bb,UAAUa,UAAU;EAGxB,IAAIxB,SAAS,KAAKxB,WAAWgC,OAAOG,SAAAA;EACpCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAM,KAAK0B,YAAYpE,UAAUqE,SAAS3B,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;CAEA,MAAM4B,OACFtB,UACAX,MACAZ,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAea,WAAW,CAAA;EAE9E,IAAI2B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EAC/D,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMiD,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAeiE,OAAO,CAAA;EAEhF,MAAM9C,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAea;GACrBsB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAa;KAC5B,GAAGF;KACH,GAAGW;IACP;IACA,GAAG,KAAKR,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIW,UAAUxB,QAAQwB,UAAUxB,SAASa,OAAOb,MAC5C,MAAM,KAAKX,WAAW4C,gBAAgB;GAClCjC,MAAMwB,UAAUxB;GAChBG,SAASU,OAAOV;EACpB,GAAGU,MAAAA;EAGP,MAAM8B,WAAW,KAAKC,gBAAgB/B,MAAAA;EAEtCA,SAAS,KAAKxB,WAAWwD,MAAMhC,QAAQW,SAAAA;EACvCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAMiC,OAAOnE,gBAAgB,KAAKiE,gBAAgB/B,MAAAA,GAAS8B,QAAAA;EAC3D,MAAM,KAAKJ,YAAYpE,UAAU4E,SAASlC,QAAQjB,OAAO,EAAE,GAAIoD,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOjC;CACX;CAEA,MAAMsC,OACFC,IACAxD,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAec,WAAW,CAAA;EAE9E,MAAM0B,SAAS,MAAM,KAAKxB,WAAWgE,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACvC,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAec;GACrBqB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEuC,IAAIE,aAAazC;EACzB,MAAM,KAAKxB,WAAWkE,OAAO1C,MAAAA;EAC7BA,OAAOuC,KAAKE;EAEZ,MAAM,KAAKf,YAAYpE,UAAUqF,SAAS3C,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;;;;;;;IAWA,MAAgB0B,YACZvC,MACAa,QACAjB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBiE,KAAAA;EAEJ,MAAM,KAAKlE,cAAcmE,OAAO;GAC5BC,OAAOvF,WAAWwF;GAClB5D;GACA6D,SAAS3F,WAAW4F;GACpBC,OAAOlD,OAAOuC;GACdjD,SAASU,OAAOV,WAAW;GAC3B6D,WAAWpE,MAAMgC,UAAUqC,QAAQ;GACnCC,SAAStE,MAAMgC,UAAUpB,KAAK4C,MAAM;GACpCe,WAAWvE,MAAMgC,UAAUpB,KAAKR,QAAQ;GACxCoE,WAAW5E,gBAAgB4E,aAAa;GACxCC,aAAa7E,gBAAgB6E,eAAe;GAC5CC,eAAe9E,gBAAgB8E,iBAAiB;GAChDC,kBAAkB/E,gBAAgB+E,oBAAoB;GACtDC,kBAAkBhF,gBAAgBgF,oBAAoB;GACtDhE,MAAM;IACFR,MAAMa,OAAOb;IACbqC,SAASxB,OAAOwB;IAChB,GAAG7B;GACP;EACJ,CAAA;CACJ;CAEUoC,gBAAgB/B,QAA0C;EAChE,OAAO;GACHb,MAAMa,OAAOb;GACbqC,SAASxB,OAAOwB;EACpB;CACJ;AACJ"}

package/dist/core/entities/user/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCA0BrB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAmCrB,CAAC"}

package/dist/core/entities/user/schema.mjs

@@ -8,6 +8,15 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const userSchema = defineSchema({
 	name: EntityType.USER,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["displayName"],
+		["realmId"],
+		["active"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: {
 		default: [
 			"id",
@@ -27,22 +36,30 @@ const userSchema = defineSchema({
 		],
 		allowed: ["email"]
 	},
-	filters: { allowed: [
-		"id",
-		"name",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"displayName",
+			"realmId",
+			"active"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"displayName",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"displayName",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/user/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n    name: EntityType.USER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'nameLocked',\n            'firstName',\n            'lastName',\n            'displayName',\n            'avatar',\n            'cover',\n            'active',\n            'status',\n            'statusMessage',\n            'createdAt',\n            'updatedAt',\n            'realmId',\n        ],\n        allowed: ['email'],\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,OAAQ;CACtB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAe;EAAa;CAAY,EAAC;CACzEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","indexes","fields","default","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n    name: EntityType.USER,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['realmId'],\n        ['active'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'name',\n            'nameLocked',\n            'firstName',\n            'lastName',\n            'displayName',\n            'avatar',\n            'cover',\n            'active',\n            'status',\n            'statusMessage',\n            'createdAt',\n            'updatedAt',\n            'realmId',\n        ],\n        allowed: ['email'],\n    },\n    filters: { allowed: ['id', 'name', 'displayName', 'realmId', 'active'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,OAAQ;CACtB;CACAC,SAAS;EAAED,SAAS;GAAC;GAAM;GAAQ;GAAe;GAAW;EAAS;EAAEE,SAAS;CAAK;CACtFC,WAAW;EAAEH,SAAS,CAAC,OAAQ;EAAEI,UAAUd,wBAAwBC,aAAAA;CAAe;CAClFc,OAAO;EAAEL,SAAS;GAAC;GAAM;GAAQ;GAAe;GAAa;EAAY;EAAEE,SAAS;CAAK;CACzFI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/user-attribute/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,eAAO,MAAM,mBAAmB,kDA4B9B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,eAAO,MAAM,mBAAmB,kDAqC9B,CAAC"}

package/dist/core/entities/user-attribute/schema.mjs

@@ -11,6 +11,14 @@ const schemaMapping = {
 };
 const userAttributeSchema = defineSchema({
 	name: EntityType.USER_ATTRIBUTE,
+	indexes: [
+		["id"],
+		["name", "userId"],
+		["userId"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"name",
@@ -20,24 +28,30 @@ const userAttributeSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"name",
-		"userId",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"userId",
+			"realmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["user", "realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"userId",
-		"realmId",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"userId",
+			"realmId",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/user-attribute/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAttributeSchema","name","USER_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAttributeSchema = defineSchema<UserAttribute>({\n    name: EntityType.USER_ATTRIBUTE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAttributeSchema","name","USER_ATTRIBUTE","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAttributeSchema = defineSchema<UserAttribute>({\n    name: EntityType.USER_ATTRIBUTE,\n    indexes: [\n        ['id'],\n        ['name', 'userId'],\n        ['userId'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'userId', 'realmId'], indexed: true },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: {\n        allowed: [\n            'id',\n            'name',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n        indexed: true,\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,QAAS;EAClB,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAM;GAAQ;GAAU;EAAU;EAAEC,SAAS;CAAK;CACvEC,WAAW;EAAEF,SAAS,CAAC,QAAQ,OAAQ;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC1FgB,OAAO;EACHJ,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS;CACb;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/user-authenticator/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAM1D,eAAO,MAAM,uBAAuB,sDAoBlC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAM1D,eAAO,MAAM,uBAAuB,sDA8BlC,CAAC"}

package/dist/core/entities/user-authenticator/schema.mjs

@@ -11,6 +11,16 @@ const schemaMapping = {
 };
 const userAuthenticatorSchema = defineSchema({
 	name: EntityType.USER_AUTHENTICATOR,
+	indexes: [
+		["id"],
+		["kind"],
+		["confirmed"],
+		["userId"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"],
+		["lastUsedAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"kind",
@@ -22,22 +32,29 @@ const userAuthenticatorSchema = defineSchema({
 		"userId",
 		"realmId"
 	] },
-	filters: { allowed: [
-		"id",
-		"kind",
-		"confirmed",
-		"userId",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"kind",
+			"confirmed",
+			"userId",
+			"realmId",
+			"lastUsedAt"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["user", "realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"createdAt",
-		"updatedAt",
-		"lastUsedAt"
-	] },
+	sorts: {
+		allowed: [
+			"createdAt",
+			"updatedAt",
+			"lastUsedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/user-authenticator/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAuthenticatorSchema","name","USER_AUTHENTICATOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAuthenticatorSchema = defineSchema<UserAuthenticator>({\n    name: EntityType.USER_AUTHENTICATOR,\n    fields: {\n        allowed: [\n            'id',\n            'kind',\n            'name',\n            'confirmed',\n            'lastUsedAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: ['id', 'kind', 'confirmed', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'lastUsedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,0BAA0BR,aAAgC;CACnES,MAAMR,WAAWS;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAa;EAAU;CAAU,EAAC;CACrEE,WAAW;EAAEF,SAAS,CAAC,QAAQ,OAAQ;EAAEG,UAAUb,wBAAwBC,aAAAA;CAAe;CAC1Fa,MAAM,EAAEJ,SAAS;EAAC;EAAa;EAAa;CAAa,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAuthenticatorSchema","name","USER_AUTHENTICATOR","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAuthenticatorSchema = defineSchema<UserAuthenticator>({\n    name: EntityType.USER_AUTHENTICATOR,\n    indexes: [\n        ['id'],\n        ['kind'],\n        ['confirmed'],\n        ['userId'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n        ['lastUsedAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'kind',\n            'name',\n            'confirmed',\n            'lastUsedAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: ['id', 'kind', 'confirmed', 'userId', 'realmId', 'lastUsedAt'], indexed: true },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'updatedAt', 'lastUsedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,0BAA0BR,aAAgC;CACnES,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,MAAO;EACR,CAAC,WAAY;EACb,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;EACb,CAAC,YAAa;CACjB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAC;GAAM;GAAQ;GAAa;GAAU;GAAW;EAAa;EAAEE,SAAS;CAAK;CAClGC,WAAW;EAAEH,SAAS,CAAC,QAAQ,OAAQ;EAAEI,UAAUf,wBAAwBC,aAAAA;CAAe;CAC1Fe,OAAO;EAAEL,SAAS;GAAC;GAAa;GAAa;EAAa;EAAEE,SAAS;CAAK;CAC1EI,YAAY,EAAEC,UAAU,GAAG;CAC3BjB;AACJ,CAAA"}

package/dist/core/entities/user-authenticator/service.d.ts

@@ -3,7 +3,7 @@ import type { User, UserAuthenticator } from '@authup/core-kit';
 import { AbstractEntityService } from '@authup/server-kit';
 import type { ActorContext, EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
 import type { IRealmCipher } from '../../key/index.ts';
-import type { IEventService } from '../event/index.ts';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/index.ts';
 import type { IUserRepository } from '../user/index.ts';
 import type { IUserAuthenticatorRepository, IUserAuthenticatorService, UserAuthenticatorChallengeStatus, UserAuthenticatorEnrollResult, UserAuthenticatorSendContext, UserAuthenticatorServiceContext, UserAuthenticatorServiceOptions, UserAuthenticatorVerifyContext, UserAuthenticatorVerifyInput, UserAuthenticatorWebauthnParameters } from './types.ts';
@@ -24,6 +24,7 @@ export declare class UserAuthenticatorService extends AbstractEntityService impl
     protected cache: ICache;
     protected cipher: IRealmCipher;
     protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
     protected mailClient?: IMailClient;
     protected mailTemplateRenderer?: IMailTemplateRenderer;
     protected options: UserAuthenticatorServiceOptions;

package/dist/core/entities/user-authenticator/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/service.ts"],"names":[],"mappings":"AAWA,OAAO,EACH,SAAS,EAKT,qBAAqB,EACrB,0BAA0B,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAUhE,OAAO,EACH,qBAAqB,EAIxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACR,YAAY,EACZ,8BAA8B,EAC9B,MAAM,EACT,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA8BxD,OAAO,KAAK,EACR,4BAA4B,EAC5B,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAE7B,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAE/B,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACtC,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAcrD,KAAK,UAAU,GAAG;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GAAG;IACA,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;CAClC,CAAC;AAEF,KAAK,eAAe,GAAG;IACnB,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,yBAAyB;IACpG,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAEnD,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;IAE/B,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAEnC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;gBAEpC,GAAG,EAAE,+BAA+B;IAchD,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM5E;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB;IAU1D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;IAiFvD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;cAiBb,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAa7E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA4CpF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA+CvF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA6CpF,iBAAiB,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC;cA8BA,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cAuCnF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;IA0CjG,OAAO,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;cAoDb,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2ClG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;IAyBvB,MAAM,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,EACnC,GAAG,GAAE,8BAAmC,GACzC,OAAO,CAAC,OAAO,CAAC;cAqHH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAwDtE,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBzF,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,mCAAmC,GAAG,IAAI;cAWxF,oBAAoB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;cAmCT,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE,aAAa,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,qBAAqB,EAAE,EAChC,GAAG,GAAE,4BAAiC,GACvC,OAAO,CAAC,IAAI,CAAC;IAwEV,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,SAAS,CACX,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,gCAAgC,CAAC;IAsD5C,SAAS,CAAC,aAAa,IAAI,IAAI;IAS/B,SAAS,CAAC,UAAU,IAAI,IAAI;IAS5B,SAAS,CAAC,cAAc,IAAI,eAAe;IAa3C,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOtD,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOvD,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOxD,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOxD,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIvE,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;cAOzC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYnE,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe;cAsCzD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAQ5D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAYjD,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAYxD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cA2B3C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAS5C,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;cAaA,oBAAoB,CAChC,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,8BAA8B,EACnC,MAAM,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,IAAI,CAAC;CAenB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/service.ts"],"names":[],"mappings":"AAWA,OAAO,EACH,SAAS,EAKT,qBAAqB,EACrB,0BAA0B,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAUhE,OAAO,EACH,qBAAqB,EAIxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACR,YAAY,EACZ,8BAA8B,EAC9B,MAAM,EACT,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA8BxD,OAAO,KAAK,EACR,4BAA4B,EAC5B,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAE7B,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAE/B,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACtC,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAcrD,KAAK,UAAU,GAAG;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GAAG;IACA,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;CAClC,CAAC;AAEF,KAAK,eAAe,GAAG;IACnB,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,yBAAyB;IACpG,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAEnD,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;IAE/B,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAEjE,SAAS,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAEnC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;gBAEpC,GAAG,EAAE,+BAA+B;IAehD,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM5E;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB;IAU1D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;IAiFvD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;cAiBb,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAa7E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA4CpF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA+CvF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA6CpF,iBAAiB,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC;cA8BA,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cAuCnF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;IA0CjG,OAAO,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;cAoDb,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2ClG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;IAyBvB,MAAM,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,EACnC,GAAG,GAAE,8BAAmC,GACzC,OAAO,CAAC,OAAO,CAAC;cAqHH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAwDtE,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBzF,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,mCAAmC,GAAG,IAAI;cAWxF,oBAAoB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;cAmCT,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE,aAAa,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,qBAAqB,EAAE,EAChC,GAAG,GAAE,4BAAiC,GACvC,OAAO,CAAC,IAAI,CAAC;IAwEV,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,SAAS,CACX,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,gCAAgC,CAAC;IAsD5C,SAAS,CAAC,aAAa,IAAI,IAAI;IAS/B,SAAS,CAAC,UAAU,IAAI,IAAI;IAS5B,SAAS,CAAC,cAAc,IAAI,eAAe;IAa3C,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOtD,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOvD,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOxD,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOxD,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIvE,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;cAOzC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYnE,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe;cAsCzD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAQ5D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAYjD,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAYxD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cA2B3C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAS5C,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;cAgBA,oBAAoB,CAChC,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,8BAA8B,EACnC,MAAM,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,IAAI,CAAC;CAgBnB"}

package/dist/core/entities/user-authenticator/service.mjs

@@ -27,6 +27,7 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 	cache;
 	cipher;
 	eventService;
+	requestContext;
 	mailClient;
 	mailTemplateRenderer;
 	options;
@@ -38,6 +39,7 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 		this.cache = ctx.cache;
 		this.cipher = ctx.cipher;
 		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
 		this.mailClient = ctx.mailClient;
 		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 		this.options = ctx.options ?? {};
@@ -698,6 +700,7 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 		await this.cache.dropMany([this.buildAttemptCacheKey(userId), this.buildThrottleCacheKey(userId)]);
 	}
 	async recordEvent(name, entity) {
+		const requestContext = this.requestContext ? this.requestContext() : void 0;
 		await this.eventService?.record({
 			scope: EventScope.IDENTITY,
 			name,
@@ -706,6 +709,7 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 			actorType: IdentityType.USER,
 			actorId: entity.userId,
 			realmId: entity.realmId,
+			sessionId: requestContext?.sessionId ?? null,
 			data: { kind: entity.kind }
 		});
 	}
@@ -719,6 +723,7 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 			actorId: userId,
 			clientId: ctx.clientId ?? null,
 			realmId: entity?.realmId ?? null,
+			sessionId: ctx.sessionId ?? null,
 			requestIpAddress: ctx.ipAddress ?? null,
 			requestUserAgent: ctx.userAgent ?? null,
 			data: { kind }