@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.60

package/dist/core/entities/user-role/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","role","ROLE","userRoleSchema","name","USER_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, role: EntityType.ROLE };\n\nexport const userRoleSchema = defineSchema<UserRole>({\n    name: EntityType.USER_ROLE,\n    // `default` pins an explicit root projection: an include= decodes the\n    // relation's fields, and the adapter's select-replace would otherwise\n    // drop every root column (incl. the id the DISTINCT wrapper needs).\n    fields: {\n        default: [\n            'id',\n            'roleId',\n            'roleRealmId',\n            'userId',\n            'userRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'userId'] },\n    relations: { allowed: ['user', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,MAAML,WAAWM;AAAK;AAErE,MAAaC,iBAAiBR,aAAuB;CACjDS,MAAMR,WAAWS;CAIjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,QAAS,EAAC;CACzCC,WAAW;EAAED,SAAS,CAAC,QAAQ,MAAO;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CACzFc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","role","ROLE","userRoleSchema","name","USER_ROLE","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, role: EntityType.ROLE };\n\nexport const userRoleSchema = defineSchema<UserRole>({\n    name: EntityType.USER_ROLE,\n    indexes: [\n        ['id'],\n        ['roleId', 'userId'],\n        ['userId'],\n        ['roleRealmId'],\n        ['userRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // `default` pins an explicit root projection: an include= decodes the\n    // relation's fields, and the adapter's select-replace would otherwise\n    // drop every root column (incl. the id the DISTINCT wrapper needs).\n    fields: {\n        default: [\n            'id',\n            'roleId',\n            'roleRealmId',\n            'userId',\n            'userRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'userId', 'id', 'roleRealmId', 'userRealmId'], indexed: true },\n    relations: { allowed: ['user', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,MAAML,WAAWM;AAAK;AAErE,MAAaC,iBAAiBR,aAAuB;CACjDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,UAAU,QAAS;EACpB,CAAC,QAAS;EACV,CAAC,aAAc;EACf,CAAC,aAAc;EACf,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAIDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAU;GAAU;GAAM;GAAe;EAAc;EAAEC,SAAS;CAAK;CAC5FC,WAAW;EAAEF,SAAS,CAAC,QAAQ,MAAO;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CACzFgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/identity/index.mjs

@@ -11,6 +11,7 @@ import { IdentityPermissionProvider } from "./permission/module.mjs";
 import "./permission/index.mjs";
 import { PolicyCheckerService } from "./policy/checker/service.mjs";
 import "./policy/index.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountAlreadyLinkedError } from "./provider/account/error.mjs";
 import { IdentityProviderMapperOperation } from "./provider/mapper/constants.mjs";
 import { IdentityProviderAccountBaseMapper } from "./provider/mapper/base.mjs";
 import { IdentityProviderAttributeMapper } from "./provider/mapper/attributes/module.mjs";
@@ -34,4 +35,4 @@ import "./registration/index.mjs";
 import { IdentityResolver } from "./resolver/module.mjs";
 import "./resolver/index.mjs";
 import { IdentityRoleProvider } from "./role/module.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, applyJunctionCreateGrant, buildJunctionUpdateData, createIdentityProviderOAuth2Authenticator, toIdentityPolicyData };
+export { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, applyJunctionCreateGrant, buildJunctionUpdateData, createIdentityProviderOAuth2Authenticator, isIdentityProviderAccountAlreadyLinkedError, toIdentityPolicyData };

package/dist/core/identity/provider/account/error.d.ts

@@ -0,0 +1,7 @@
+import { ValidationError } from '@authup/errors';
+export declare const IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE: unique symbol;
+export declare class IdentityProviderAccountAlreadyLinkedError extends ValidationError {
+    constructor();
+}
+export declare function isIdentityProviderAccountAlreadyLinkedError(input: unknown): input is IdentityProviderAccountAlreadyLinkedError;
+//# sourceMappingURL=error.d.ts.map

package/dist/core/identity/provider/account/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,eAAe,EAIlB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,uDAAuD,eAA8E,CAAC;AAEnJ,qBAAa,yCAA0C,SAAQ,eAAe;;CAQ7E;AAED,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yCAAyC,CAI9H"}

package/dist/core/identity/provider/account/error.mjs

@@ -0,0 +1,24 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ErrorCode, ValidationError, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
+//#region src/core/identity/provider/account/error.ts
+const IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE = Symbol.for("@authup/server-core/IdentityProviderAccountAlreadyLinkedError");
+var IdentityProviderAccountAlreadyLinkedError = class extends ValidationError {
+	constructor() {
+		super({
+			code: ErrorCode.IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED,
+			message: "The external account is already linked to another user."
+		});
+		markInstanceof(this, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE);
+	}
+};
+function isIdentityProviderAccountAlreadyLinkedError(input) {
+	if (matchesInstanceof(input, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED;
+}
+//#endregion
+export { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountAlreadyLinkedError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/identity/provider/account/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","isAuthupError","markInstanceof","matchesInstanceof","IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE","Symbol","for","IdentityProviderAccountAlreadyLinkedError","code","IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED","message","isIdentityProviderAccountAlreadyLinkedError","input"],"sources":["../../../../../src/core/identity/provider/account/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    ErrorCode,\n    ValidationError,\n    isAuthupError,\n    markInstanceof,\n    matchesInstanceof,\n} from '@authup/errors';\n\nexport const IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE = Symbol.for('@authup/server-core/IdentityProviderAccountAlreadyLinkedError');\n\nexport class IdentityProviderAccountAlreadyLinkedError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED,\n            message: 'The external account is already linked to another user.',\n        });\n        markInstanceof(this, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE);\n    }\n}\n\nexport function isIdentityProviderAccountAlreadyLinkedError(input: unknown): input is IdentityProviderAccountAlreadyLinkedError {\n    if (matchesInstanceof(input, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED;\n}\n"],"mappings":";;;;;AAeA,MAAaK,0DAA0DC,OAAOC,IAAI,+DAAA;AAElF,IAAaC,4CAAb,cAA+DP,gBAAAA;CAC3D,cAAc;EACV,MAAM;GACFQ,MAAMT,UAAUU;GAChBC,SAAS;EACb,CAAA;EACAR,eAAe,MAAME,uDAAAA;CACzB;AACJ;AAEA,SAAgBO,4CAA4CC,OAAc;CACtE,IAAIT,kBAAkBS,OAAOR,uDAAAA,GAA0D,OAAO;CAC9F,IAAI,CAACH,cAAcW,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMJ,SAAST,UAAUU;AACpC"}

package/dist/core/identity/provider/account/index.d.ts

@@ -1,3 +1,4 @@
+export * from './error.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/account/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/provider/account/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountAlreadyLinkedError } from "./error.mjs";
 import { IdentityProviderAccountManager } from "./module.mjs";
-export { IdentityProviderAccountManager };
+export { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountManager, isIdentityProviderAccountAlreadyLinkedError };

package/dist/core/identity/provider/account/module.d.ts

@@ -13,6 +13,8 @@ export declare class IdentityProviderAccountManager implements IIdentityProvider
     protected userValidator: UserValidator;
     constructor(ctx: IdentityProviderAccountManagerContext);
     save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount>;
+    link(identity: IdentityProviderIdentity, userId: string): Promise<IdentityProviderAccount>;
+    protected pickCandidate(identity: IdentityProviderIdentity, key: keyof User, maxLength: number): string | null;
     saveUser(identity: IdentityProviderIdentity, user?: User): Promise<User>;
     validateAttributes(entity: Record<string, any>, identity: IdentityProviderIdentity, attempts: number): Promise<User | null>;
     savePermissions(identity: IdentityProviderIdentity, user: User): Promise<void>;

package/dist/core/identity/provider/account/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACH,aAAa,EAGhB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE7I,qBAAa,8BAA+B,YAAW,+BAA+B;IAClF,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,UAAU,EAAG,uBAAuB,CAAC;IAE/C,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;IAE1D,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;gBAE5B,GAAG,EAAE,qCAAqC;IAUhD,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmC1E,QAAQ,CACV,QAAQ,EAAE,wBAAwB,EAClC,IAAI,CAAC,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IA0FV,kBAAkB,CACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+ElB,eAAe,CACjB,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;IAOR,SAAS,CACX,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;CAMjB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACH,aAAa,EAGhB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE7I,qBAAa,8BAA+B,YAAW,+BAA+B;IAClF,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,UAAU,EAAG,uBAAuB,CAAC;IAE/C,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;IAE1D,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;gBAE5B,GAAG,EAAE,qCAAqC;IAUhD,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmC1E,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAuChG,SAAS,CAAC,aAAa,CACnB,QAAQ,EAAE,wBAAwB,EAClC,GAAG,EAAE,MAAM,IAAI,EACf,SAAS,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI;IAWV,QAAQ,CACV,QAAQ,EAAE,wBAAwB,EAClC,IAAI,CAAC,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IA0FV,kBAAkB,CACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+ElB,eAAe,CACjB,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;IAOR,SAAS,CACX,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;CAMjB"}

package/dist/core/identity/provider/account/module.mjs

@@ -1,11 +1,13 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { IdentityProviderAccountAlreadyLinkedError } from "./error.mjs";
 import { IdentityProviderIdentityOperation } from "../constants.mjs";
 import { IdentityProviderMapperOperation } from "../mapper/constants.mjs";
 import "../mapper/index.mjs";
 import { ValidatorGroup, createNanoID, extendObject } from "@authup/kit";
 import { UserValidator, buildUserFakeEmail, isUserFakeEmail } from "@authup/core-kit";
+import { ValidationError } from "@authup/errors";
 import { isValidupError, stringifyPath } from "validup";
 //#region src/core/identity/provider/account/module.ts
 var IdentityProviderAccountManager = class {
@@ -48,6 +50,34 @@ var IdentityProviderAccountManager = class {
 		await this.savePermissions(identity, account.user);
 		return account;
 	}
+	async link(identity, userId) {
+		const user = await this.userRepository.findOneById(userId);
+		if (!user) throw new ValidationError("The linking user does not exist.");
+		if (identity.provider.realmId && user.realmId !== identity.provider.realmId) throw new ValidationError("The provider and user realm do not match.");
+		const providerUserName = this.pickCandidate(identity, "name", 256) ?? identity.id.slice(0, 256);
+		const providerUserEmail = this.pickCandidate(identity, "email", 512);
+		const existing = await this.repository.findOneByProviderIdentity(identity);
+		if (existing) {
+			if (existing.userId !== userId) throw new IdentityProviderAccountAlreadyLinkedError();
+			existing.providerUserName = providerUserName ?? existing.providerUserName;
+			existing.providerUserEmail = providerUserEmail ?? existing.providerUserEmail;
+			return this.repository.save(existing);
+		}
+		return this.repository.save({
+			providerId: identity.provider.id,
+			providerUserId: identity.id,
+			providerUserName,
+			providerUserEmail: providerUserEmail ?? void 0,
+			providerRealmId: identity.provider.realmId,
+			userId,
+			userRealmId: user.realmId ?? null
+		});
+	}
+	pickCandidate(identity, key, maxLength) {
+		const candidates = identity.attributeCandidates?.[key] || [];
+		for (const candidate of candidates) if (typeof candidate === "string" && candidate.length > 0) return candidate.slice(0, maxLength);
+		return null;
+	}
 	async saveUser(identity, user) {
 		const attributes = await this.attributesMapper.execute(identity);
 		const entity = {};

package/dist/core/identity/provider/account/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","providerId","provider","id","providerUserId","providerUserName","name","providerRealmId","realmId","userId","userRealmId","attributes","execute","entity","attribute","key","value","active","nameLocked","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n    UserValidator,\n    buildUserFakeEmail,\n    isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n    protected attributesMapper : IIdentityProviderMapper;\n\n    protected permissionMapper : IIdentityProviderMapper;\n\n    protected roleMapper : IIdentityProviderMapper;\n\n    protected repository : IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected userValidator : UserValidator;\n\n    constructor(ctx: IdentityProviderAccountManagerContext) {\n        this.attributesMapper = ctx.attributeMapper;\n        this.permissionMapper = ctx.permissionMapper;\n        this.roleMapper = ctx.roleMapper;\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n\n        this.userValidator = new UserValidator();\n    }\n\n    async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n        let account = await this.repository.findOneByProviderIdentity(identity);\n        if (account) {\n            identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n            account.user = await this.saveUser(identity, account.user);\n\n            await this.repository.save(account);\n\n            await this.saveRoles(identity, account.user);\n            await this.savePermissions(identity, account.user);\n\n            return account;\n        }\n\n        identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n        const user = await this.saveUser(identity);\n\n        account = await this.repository.save({\n            providerId: identity.provider.id,\n            providerUserId: identity.id,\n            providerUserName: user.name, // todo: parse identity.name\n            providerRealmId: identity.provider.realmId,\n            user,\n            userId: user.id,\n            userRealmId: user.realmId,\n        });\n\n        await this.saveRoles(identity, account.user);\n        await this.savePermissions(identity, account.user);\n\n        return account;\n    }\n\n    async saveUser(\n        identity: IdentityProviderIdentity,\n        user?: User,\n    ): Promise<User> {\n        const attributes = await this.attributesMapper.execute(\n            identity,\n        );\n\n        const entity : Record<string, any> = {};\n        for (const attribute of attributes) {\n            if (\n                attribute.key &&\n                attribute.operation === IdentityProviderMapperOperation.CREATE\n            ) {\n                // attribute value might be object, array, ...\n                entity[attribute.key] = attribute.value;\n            }\n        }\n\n        if (!user) {\n            entity.realmId = identity.provider.realmId;\n            entity.active = true;\n            entity.nameLocked = true;\n            entity.clientId = identity.clientId || null;\n        }\n\n        const attributesSelf = await this.validateAttributes(entity, identity, 10);\n        if (!attributesSelf) {\n            // todo: better error name\n            throw new Error('Identity provider attributes could not be validated.');\n        }\n        const attributesSelfKeys = Object.keys(attributesSelf);\n\n        const attributesExtra : Record<string, any> = {};\n\n        const entityKeys = Object.keys(entity);\n        for (const entityKey of entityKeys) {\n            const index = attributesSelfKeys.indexOf(entityKey);\n            if (index !== -1) {\n                continue;\n            }\n\n            attributesExtra[entityKey] = entity[entityKey];\n        }\n\n        let output : User;\n        if (user) {\n            output = extendObject(user, attributesSelf);\n        } else {\n            output = attributesSelf;\n        }\n\n        if (typeof output.name === 'string') {\n            output.name = output.name.trim().toLowerCase();\n        }\n\n        let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);\n        while (attempts > 0) {\n            try {\n                // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n                return await this.userRepository.saveOneWithEA(output, attributesExtra);\n            } catch {\n                const names = identity.attributeCandidates?.name || [];\n                if (names.length > 0) {\n                    while (names.length > 0) {\n                        output.name = `${names.shift()}`.trim().toLowerCase();\n\n                        try {\n                            await this.userValidator.run(output, {\n                                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                                    ValidatorGroup.CREATE :\n                                    ValidatorGroup.UPDATE,\n                            });\n                            break;\n                        } catch {\n                            // todo: do nothing.\n                        }\n                    }\n                } else {\n                    output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n                }\n\n                if (isUserFakeEmail(output.email)) {\n                    output.email = buildUserFakeEmail(output.name);\n                }\n\n                attempts -= 1;\n            }\n        }\n\n        throw new Error('The user account could not be created due a conflict error.');\n    }\n\n    async validateAttributes(\n        entity: Record<string, any>,\n        identity: IdentityProviderIdentity,\n        attempts: number,\n    ) : Promise<User | null> {\n        attempts--;\n        if (attempts <= 0) {\n            return null;\n        }\n\n        try {\n            return await this.userValidator.run(entity, {\n                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                    ValidatorGroup.CREATE :\n                    ValidatorGroup.UPDATE,\n            });\n        } catch (e: any) {\n            if (!isValidupError(e)) {\n                return null;\n            }\n\n            let retry = false;\n            for (let i = 0; i < e.issues.length; i++) {\n                const child = e.issues[i];\n\n                const pathNormalized = stringifyPath(child.path);\n\n                if (\n                    Array.isArray(entity[pathNormalized]) &&\n                    entity[pathNormalized].length > 0\n                ) {\n                    const [first, ...rest] = entity[pathNormalized];\n                    entity[pathNormalized] = first;\n\n                    if (rest.length > 0) {\n                        if (!identity.attributeCandidates) {\n                            identity.attributeCandidates = {};\n                        }\n\n                        if (!identity.attributeCandidates[pathNormalized]) {\n                            identity.attributeCandidates[pathNormalized] = [];\n                        }\n\n                        identity.attributeCandidates[pathNormalized]!.push(...rest);\n                    }\n\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    identity.attributeCandidates &&\n                    identity.attributeCandidates[pathNormalized] &&\n                    identity.attributeCandidates[pathNormalized]!.length > 0\n                ) {\n                    entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    entity.name &&\n                    pathNormalized === 'email'\n                ) {\n                    entity[pathNormalized] = buildUserFakeEmail(entity.name);\n                    retry = true;\n                    break;\n                }\n\n                if (entity[pathNormalized]) {\n                    entity[pathNormalized] = null;\n                    break;\n                }\n            }\n\n            if (retry) {\n                return this.validateAttributes(entity, identity, attempts);\n            }\n\n            return null;\n        }\n    }\n\n    async savePermissions(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.permissionMapper.execute(identity);\n\n        await this.userRepository.savePermissions(user, entities);\n    }\n\n    async saveRoles(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.roleMapper.execute(identity);\n\n        await this.userRepository.saveRoles(user, entities);\n    }\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIhB,cAAAA;CAC7B;CAEA,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYf,kCAAkCgB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,YAAYV,SAASW,SAASC;GAC9BC,gBAAgBb,SAASY;GACzBE,kBAAkBT,KAAKU;GACvBC,iBAAiBhB,SAASW,SAASM;GACnCZ;GACAa,QAAQb,KAAKO;GACbO,aAAad,KAAKY;EACtB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,QAAAA;EAGJ,MAAMsB,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,QAGxDa,OAAOC,UAAUC,OAAOD,UAAUE;EAI1C,IAAI,CAACpB,MAAM;GACPiB,OAAOL,UAAUjB,SAASW,SAASM;GACnCK,OAAOI,SAAS;GAChBJ,OAAOK,aAAa;GACpBL,OAAOM,WAAW5B,SAAS4B,YAAY;EAC3C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBR,QAAQtB,UAAU,EAAA;EACvE,IAAI,CAAC6B,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKZ,MAAAA;EAC/B,KAAK,MAAMe,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAaf,OAAOe;EACxC;EAEA,IAAIG;EACJ,IAAInC,MACAmC,SAASvD,aAAaoB,MAAMwB,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAOzB,SAAS,UACvByB,OAAOzB,OAAOyB,OAAOzB,KAAK0B,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAK7C,SAAS8C,qBAAqB/B,MAAMgC,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOJ,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAKhD,eAAeqD,cAAcR,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMc,QAAQjD,SAAS8C,qBAAqB/B,QAAQ,CAAA;GACpD,IAAIkC,MAAMF,SAAS,GACf,OAAOE,MAAMF,SAAS,GAAG;IACrBP,OAAOzB,OAAO,GAAGkC,MAAMC,MAAK,IAAKT,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK9C,cAAcuD,IAAIX,QAAQ,EACjCY,OAAOpD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAoC,OAAOzB,OAAO/B,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgB0D,OAAOa,KAAK,GAC5Bb,OAAOa,QAAQxE,mBAAmB2D,OAAOzB,IAAI;GAGjD4B,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFR,QACAtB,UACA2C,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK/C,cAAcuD,IAAI7B,QAAQ,EACxC8B,OAAOpD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;EACJ,SAASkD,GAAQ;GACb,IAAI,CAACpE,eAAeoE,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBxE,cAAcuE,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQxC,OAAOqC,eAAe,KACpCrC,OAAOqC,eAAe,CAACZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQ1C,OAAOqC;KAChCrC,OAAOqC,kBAAkBI;KAEzB,IAAIC,KAAKjB,SAAS,GAAG;MACjB,IAAI,CAAC/C,SAAS8C,qBACV9C,SAAS8C,sBAAsB,CAAC;MAGpC,IAAI,CAAC9C,SAAS8C,oBAAoBa,iBAC9B3D,SAAS8C,oBAAoBa,kBAAkB,CAAA;MAGnD3D,SAAS8C,oBAAoBa,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIvD,SAAS8C,uBACT9C,SAAS8C,oBAAoBa,mBAC7B3D,SAAS8C,oBAAoBa,eAAe,CAAEZ,SAAS,GACzD;KACEzB,OAAOqC,kBAAkB3D,SAAS8C,oBAAoBa,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACIjC,OAAOP,QACP4C,mBAAmB,SACrB;KACErC,OAAOqC,kBAAkB9E,mBAAmByC,OAAOP,IAAI;KACvDwC,QAAQ;KACR;IACJ;IAEA,IAAIjC,OAAOqC,iBAAiB;KACxBrC,OAAOqC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKzB,mBAAmBR,QAAQtB,UAAU2C,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAMnC,gBACFR,UACAK,MACF;EACE,MAAM6D,WAAW,MAAM,KAAK1E,iBAAiB6B,QAAQrB,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAM6D,QAAAA;CACpD;CAEA,MAAM3D,UACFP,UACAK,MACF;EACE,MAAM6D,WAAW,MAAM,KAAKzE,WAAW4B,QAAQrB,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAM6D,QAAAA;CAC9C;AACJ"}
+{"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","ValidationError","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountAlreadyLinkedError","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","providerId","provider","id","providerUserId","providerUserName","name","providerRealmId","realmId","userId","userRealmId","link","findOneById","pickCandidate","slice","providerUserEmail","existing","undefined","key","maxLength","candidates","attributeCandidates","candidate","length","attributes","execute","entity","attribute","value","active","nameLocked","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n    UserValidator,\n    buildUserFakeEmail,\n    isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { ValidationError } from '@authup/errors';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport { IdentityProviderAccountAlreadyLinkedError } from './error.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n    protected attributesMapper : IIdentityProviderMapper;\n\n    protected permissionMapper : IIdentityProviderMapper;\n\n    protected roleMapper : IIdentityProviderMapper;\n\n    protected repository : IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected userValidator : UserValidator;\n\n    constructor(ctx: IdentityProviderAccountManagerContext) {\n        this.attributesMapper = ctx.attributeMapper;\n        this.permissionMapper = ctx.permissionMapper;\n        this.roleMapper = ctx.roleMapper;\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n\n        this.userValidator = new UserValidator();\n    }\n\n    async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n        let account = await this.repository.findOneByProviderIdentity(identity);\n        if (account) {\n            identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n            account.user = await this.saveUser(identity, account.user);\n\n            await this.repository.save(account);\n\n            await this.saveRoles(identity, account.user);\n            await this.savePermissions(identity, account.user);\n\n            return account;\n        }\n\n        identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n        const user = await this.saveUser(identity);\n\n        account = await this.repository.save({\n            providerId: identity.provider.id,\n            providerUserId: identity.id,\n            providerUserName: user.name, // todo: parse identity.name\n            providerRealmId: identity.provider.realmId,\n            user,\n            userId: user.id,\n            userRealmId: user.realmId,\n        });\n\n        await this.saveRoles(identity, account.user);\n        await this.savePermissions(identity, account.user);\n\n        return account;\n    }\n\n    async link(identity: IdentityProviderIdentity, userId: string): Promise<IdentityProviderAccount> {\n        const user = await this.userRepository.findOneById(userId);\n        if (!user) {\n            throw new ValidationError('The linking user does not exist.');\n        }\n\n        if (\n            identity.provider.realmId &&\n            user.realmId !== identity.provider.realmId\n        ) {\n            throw new ValidationError('The provider and user realm do not match.');\n        }\n\n        const providerUserName = this.pickCandidate(identity, 'name', 256) ?? identity.id.slice(0, 256);\n        const providerUserEmail = this.pickCandidate(identity, 'email', 512);\n\n        const existing = await this.repository.findOneByProviderIdentity(identity);\n        if (existing) {\n            if (existing.userId !== userId) {\n                throw new IdentityProviderAccountAlreadyLinkedError();\n            }\n\n            existing.providerUserName = providerUserName ?? existing.providerUserName;\n            existing.providerUserEmail = providerUserEmail ?? existing.providerUserEmail;\n\n            return this.repository.save(existing);\n        }\n\n        return this.repository.save({\n            providerId: identity.provider.id,\n            providerUserId: identity.id,\n            providerUserName,\n            providerUserEmail: providerUserEmail ?? undefined,\n            providerRealmId: identity.provider.realmId,\n            userId,\n            userRealmId: user.realmId ?? null,\n        });\n    }\n\n    protected pickCandidate(\n        identity: IdentityProviderIdentity,\n        key: keyof User,\n        maxLength: number,\n    ): string | null {\n        const candidates = identity.attributeCandidates?.[key] || [];\n        for (const candidate of candidates) {\n            if (typeof candidate === 'string' && candidate.length > 0) {\n                return candidate.slice(0, maxLength);\n            }\n        }\n\n        return null;\n    }\n\n    async saveUser(\n        identity: IdentityProviderIdentity,\n        user?: User,\n    ): Promise<User> {\n        const attributes = await this.attributesMapper.execute(\n            identity,\n        );\n\n        const entity : Record<string, any> = {};\n        for (const attribute of attributes) {\n            if (\n                attribute.key &&\n                attribute.operation === IdentityProviderMapperOperation.CREATE\n            ) {\n                // attribute value might be object, array, ...\n                entity[attribute.key] = attribute.value;\n            }\n        }\n\n        if (!user) {\n            entity.realmId = identity.provider.realmId;\n            entity.active = true;\n            entity.nameLocked = true;\n            entity.clientId = identity.clientId || null;\n        }\n\n        const attributesSelf = await this.validateAttributes(entity, identity, 10);\n        if (!attributesSelf) {\n            // todo: better error name\n            throw new Error('Identity provider attributes could not be validated.');\n        }\n        const attributesSelfKeys = Object.keys(attributesSelf);\n\n        const attributesExtra : Record<string, any> = {};\n\n        const entityKeys = Object.keys(entity);\n        for (const entityKey of entityKeys) {\n            const index = attributesSelfKeys.indexOf(entityKey);\n            if (index !== -1) {\n                continue;\n            }\n\n            attributesExtra[entityKey] = entity[entityKey];\n        }\n\n        let output : User;\n        if (user) {\n            output = extendObject(user, attributesSelf);\n        } else {\n            output = attributesSelf;\n        }\n\n        if (typeof output.name === 'string') {\n            output.name = output.name.trim().toLowerCase();\n        }\n\n        let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);\n        while (attempts > 0) {\n            try {\n                // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n                return await this.userRepository.saveOneWithEA(output, attributesExtra);\n            } catch {\n                const names = identity.attributeCandidates?.name || [];\n                if (names.length > 0) {\n                    while (names.length > 0) {\n                        output.name = `${names.shift()}`.trim().toLowerCase();\n\n                        try {\n                            await this.userValidator.run(output, {\n                                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                                    ValidatorGroup.CREATE :\n                                    ValidatorGroup.UPDATE,\n                            });\n                            break;\n                        } catch {\n                            // todo: do nothing.\n                        }\n                    }\n                } else {\n                    output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n                }\n\n                if (isUserFakeEmail(output.email)) {\n                    output.email = buildUserFakeEmail(output.name);\n                }\n\n                attempts -= 1;\n            }\n        }\n\n        throw new Error('The user account could not be created due a conflict error.');\n    }\n\n    async validateAttributes(\n        entity: Record<string, any>,\n        identity: IdentityProviderIdentity,\n        attempts: number,\n    ) : Promise<User | null> {\n        attempts--;\n        if (attempts <= 0) {\n            return null;\n        }\n\n        try {\n            return await this.userValidator.run(entity, {\n                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                    ValidatorGroup.CREATE :\n                    ValidatorGroup.UPDATE,\n            });\n        } catch (e: any) {\n            if (!isValidupError(e)) {\n                return null;\n            }\n\n            let retry = false;\n            for (let i = 0; i < e.issues.length; i++) {\n                const child = e.issues[i];\n\n                const pathNormalized = stringifyPath(child.path);\n\n                if (\n                    Array.isArray(entity[pathNormalized]) &&\n                    entity[pathNormalized].length > 0\n                ) {\n                    const [first, ...rest] = entity[pathNormalized];\n                    entity[pathNormalized] = first;\n\n                    if (rest.length > 0) {\n                        if (!identity.attributeCandidates) {\n                            identity.attributeCandidates = {};\n                        }\n\n                        if (!identity.attributeCandidates[pathNormalized]) {\n                            identity.attributeCandidates[pathNormalized] = [];\n                        }\n\n                        identity.attributeCandidates[pathNormalized]!.push(...rest);\n                    }\n\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    identity.attributeCandidates &&\n                    identity.attributeCandidates[pathNormalized] &&\n                    identity.attributeCandidates[pathNormalized]!.length > 0\n                ) {\n                    entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    entity.name &&\n                    pathNormalized === 'email'\n                ) {\n                    entity[pathNormalized] = buildUserFakeEmail(entity.name);\n                    retry = true;\n                    break;\n                }\n\n                if (entity[pathNormalized]) {\n                    entity[pathNormalized] = null;\n                    break;\n                }\n            }\n\n            if (retry) {\n                return this.validateAttributes(entity, identity, attempts);\n            }\n\n            return null;\n        }\n    }\n\n    async savePermissions(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.permissionMapper.execute(identity);\n\n        await this.userRepository.savePermissions(user, entities);\n    }\n\n    async saveRoles(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.roleMapper.execute(identity);\n\n        await this.userRepository.saveRoles(user, entities);\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaY,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIlB,cAAAA;CAC7B;CAEA,MAAMqB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYhB,kCAAkCiB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYhB,kCAAkCsB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,YAAYV,SAASW,SAASC;GAC9BC,gBAAgBb,SAASY;GACzBE,kBAAkBT,KAAKU;GACvBC,iBAAiBhB,SAASW,SAASM;GACnCZ;GACAa,QAAQb,KAAKO;GACbO,aAAad,KAAKY;EACtB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMmB,KAAKpB,UAAoCkB,QAAkD;EAC7F,MAAMb,OAAO,MAAM,KAAKV,eAAe0B,YAAYH,MAAAA;EACnD,IAAI,CAACb,MACD,MAAM,IAAIrB,gBAAgB,kCAAA;EAG9B,IACIgB,SAASW,SAASM,WAClBZ,KAAKY,YAAYjB,SAASW,SAASM,SAEnC,MAAM,IAAIjC,gBAAgB,2CAAA;EAG9B,MAAM8B,mBAAmB,KAAKQ,cAActB,UAAU,QAAQ,GAAA,KAAQA,SAASY,GAAGW,MAAM,GAAG,GAAA;EAC3F,MAAMC,oBAAoB,KAAKF,cAActB,UAAU,SAAS,GAAA;EAEhE,MAAMyB,WAAW,MAAM,KAAK/B,WAAWQ,0BAA0BF,QAAAA;EACjE,IAAIyB,UAAU;GACV,IAAIA,SAASP,WAAWA,QACpB,MAAM,IAAI7B,0CAAAA;GAGdoC,SAASX,mBAAmBA,oBAAoBW,SAASX;GACzDW,SAASD,oBAAoBA,qBAAqBC,SAASD;GAE3D,OAAO,KAAK9B,WAAWK,KAAK0B,QAAAA;EAChC;EAEA,OAAO,KAAK/B,WAAWK,KAAK;GACxBW,YAAYV,SAASW,SAASC;GAC9BC,gBAAgBb,SAASY;GACzBE;GACAU,mBAAmBA,qBAAqBE,KAAAA;GACxCV,iBAAiBhB,SAASW,SAASM;GACnCC;GACAC,aAAad,KAAKY,WAAW;EACjC,CAAA;CACJ;CAEUK,cACNtB,UACA2B,KACAC,WACa;EACb,MAAMC,aAAa7B,SAAS8B,sBAAsBH,QAAQ,CAAA;EAC1D,KAAK,MAAMI,aAAaF,YACpB,IAAI,OAAOE,cAAc,YAAYA,UAAUC,SAAS,GACpD,OAAOD,UAAUR,MAAM,GAAGK,SAAAA;EAIlC,OAAO;CACX;CAEA,MAAMtB,SACFN,UACAK,MACa;EACb,MAAM4B,aAAa,MAAM,KAAK1C,iBAAiB2C,QAC3ClC,QAAAA;EAGJ,MAAMmC,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUT,OACVS,UAAUjC,cAAcf,gCAAgCqB,QAGxD0B,OAAOC,UAAUT,OAAOS,UAAUC;EAI1C,IAAI,CAAChC,MAAM;GACP8B,OAAOlB,UAAUjB,SAASW,SAASM;GACnCkB,OAAOG,SAAS;GAChBH,OAAOI,aAAa;GACpBJ,OAAOK,WAAWxC,SAASwC,YAAY;EAC3C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBP,QAAQnC,UAAU,EAAA;EACvE,IAAI,CAACyC,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKX,MAAAA;EAC/B,KAAK,MAAMc,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAad,OAAOc;EACxC;EAEA,IAAIG;EACJ,IAAI/C,MACA+C,SAASrE,aAAasB,MAAMoC,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAOrC,SAAS,UACvBqC,OAAOrC,OAAOqC,OAAOrC,KAAKsC,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAKzD,SAAS8B,qBAAqBf,MAAMiB,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOuB,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAK5D,eAAe+D,cAAcN,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMY,QAAQ3D,SAAS8B,qBAAqBf,QAAQ,CAAA;GACpD,IAAI4C,MAAM3B,SAAS,GACf,OAAO2B,MAAM3B,SAAS,GAAG;IACrBoB,OAAOrC,OAAO,GAAG4C,MAAMC,MAAK,IAAKP,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK1D,cAAciE,IAAIT,QAAQ,EACjCU,OAAO9D,SAASG,cAAchB,kCAAkCsB,SAC5D5B,eAAe4B,SACf5B,eAAeuB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAgD,OAAOrC,OAAOjC,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgBwE,OAAOW,KAAK,GAC5BX,OAAOW,QAAQpF,mBAAmByE,OAAOrC,IAAI;GAGjDwC,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFP,QACAnC,UACAuD,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK3D,cAAciE,IAAI1B,QAAQ,EACxC2B,OAAO9D,SAASG,cAAchB,kCAAkCsB,SAC5D5B,eAAe4B,SACf5B,eAAeuB,OACvB,CAAA;EACJ,SAAS4D,GAAQ;GACb,IAAI,CAAC/E,eAAe+E,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOnC,QAAQkC,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBnF,cAAckF,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQrC,OAAOkC,eAAe,KACpClC,OAAOkC,eAAe,CAACrC,SAAS,GAClC;KACE,MAAM,CAACyC,OAAO,GAAGC,QAAQvC,OAAOkC;KAChClC,OAAOkC,kBAAkBI;KAEzB,IAAIC,KAAK1C,SAAS,GAAG;MACjB,IAAI,CAAChC,SAAS8B,qBACV9B,SAAS8B,sBAAsB,CAAC;MAGpC,IAAI,CAAC9B,SAAS8B,oBAAoBuC,iBAC9BrE,SAAS8B,oBAAoBuC,kBAAkB,CAAA;MAGnDrE,SAAS8B,oBAAoBuC,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIjE,SAAS8B,uBACT9B,SAAS8B,oBAAoBuC,mBAC7BrE,SAAS8B,oBAAoBuC,eAAe,CAAErC,SAAS,GACzD;KACEG,OAAOkC,kBAAkBrE,SAAS8B,oBAAoBuC,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACI9B,OAAOpB,QACPsD,mBAAmB,SACrB;KACElC,OAAOkC,kBAAkB1F,mBAAmBwD,OAAOpB,IAAI;KACvDkD,QAAQ;KACR;IACJ;IAEA,IAAI9B,OAAOkC,iBAAiB;KACxBlC,OAAOkC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKvB,mBAAmBP,QAAQnC,UAAUuD,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAM/C,gBACFR,UACAK,MACF;EACE,MAAMuE,WAAW,MAAM,KAAKpF,iBAAiB0C,QAAQlC,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAMuE,QAAAA;CACpD;CAEA,MAAMrE,UACFP,UACAK,MACF;EACE,MAAMuE,WAAW,MAAM,KAAKnF,WAAWyC,QAAQlC,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAMuE,QAAAA;CAC9C;AACJ"}

package/dist/core/identity/provider/account/types.d.ts

@@ -1,17 +1,9 @@
 import type { IdentityProviderAccount } from '@authup/core-kit';
-import type { DeepPartial } from 'typeorm';
 import type { IUserIdentityRepository } from '../../entities/index.ts';
 import type { IIdentityProviderMapper } from '../mapper/index.ts';
 import type { IdentityProviderIdentity } from '../types.ts';
-export interface IIdentityProviderAccountRepository {
-    /**
-     * Find identity account with user relation.
-     *
-     * @param identity
-     */
-    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
-    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
-}
+import type { IIdentityProviderAccountRepository } from '../../../entities/identity-provider-account/types.ts';
+export type { IIdentityProviderAccountRepository } from '../../../entities/identity-provider-account/types.ts';
 export type IdentityProviderAccountManagerContext = {
     attributeMapper: IIdentityProviderMapper;
     permissionMapper: IIdentityProviderMapper;
@@ -26,5 +18,15 @@ export interface IIdentityProviderAccountManager {
      * @param identity
      */
     save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount>;
+    /**
+     * Explicitly link the external identity to an EXISTING user (plan
+     * 091): creates or refreshes the account row only. Never mutates the
+     * user, never runs attribute/role/permission mappers, never creates
+     * a user.
+     *
+     * @param identity
+     * @param userId
+     */
+    link(identity: IdentityProviderIdentity, userId: string): Promise<IdentityProviderAccount>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/account/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,WAAW,kCAAkC;IAC/C;;;;OAIG;IACH,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAExG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,qCAAqC,GAAG;IAChD,eAAe,EAAE,uBAAuB,CAAC;IACzC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,UAAU,EAAE,uBAAuB,CAAC;IAEpC,UAAU,EAAE,kCAAkC,CAAC;IAC/C,cAAc,EAAE,uBAAuB,CAAA;CAC1C,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C;;;;OAIG;IACH,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAE/G,YAAY,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAE/G,MAAM,MAAM,qCAAqC,GAAG;IAChD,eAAe,EAAE,uBAAuB,CAAC;IACzC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,UAAU,EAAE,uBAAuB,CAAC;IAEpC,UAAU,EAAE,kCAAkC,CAAC;IAC/C,cAAc,EAAE,uBAAuB,CAAA;CAC1C,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C;;;;OAIG;IACH,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE5E;;;;;;;;OAQG;IACH,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/F"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.d.ts

@@ -12,6 +12,7 @@ export declare class IdentityProviderOAuth2Authenticator implements IOAuth2Authe
     protected provider: OAuth2IdentityProvider | OpenIDIdentityProvider;
     constructor(ctx: IdentityProviderOAuth2AuthenticatorContext);
     buildRedirectURL(parameters?: Partial<AuthorizeParameters>): string;
+    resolveIdentity(params: OAuth2AuthorizationCodeGrantPayload): Promise<IdentityProviderIdentity>;
     authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User>;
     safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>>;
     protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;

package/dist/core/identity/provider/authentication/protocols/oauth2/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAEpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;gBAIzD,GAAG,EAAE,0CAA0C;IAoB3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IAYlE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAiB1E,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiBrH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAEpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;gBAIzD,GAAG,EAAE,0CAA0C;IAoB3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IAYlE,eAAe,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAW/F,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAiB1E,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiBrH"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -32,10 +32,14 @@ var IdentityProviderOAuth2Authenticator = class {
 			throw new ValidationError("The identity provider is misconfigured and has an invalid or missing authorize URL.");
 		}
 	}
-	async authenticate(params) {
+	async resolveIdentity(params) {
 		const token = await this.client.token.createWithAuthorizationCode(params);
 		const identity = await this.buildIdentityWithTokenGrantResponse(token);
 		if (this.options.clientId) identity.clientId = this.options.clientId;
+		return identity;
+	}
+	async authenticate(params) {
+		const identity = await this.resolveIdentity(params);
 		return (await this.accountManager.save(identity)).user;
 	}
 	async safeAuthenticate(params) {

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","ValidationError","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","clientSecret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorizeUrl","tokenEndpoint","tokenUrl","userinfoEndpoint","userInfoUrl","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.clientId,\n                clientSecret: ctx.provider.clientSecret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorizeUrl,\n                tokenEndpoint: ctx.provider.tokenUrl,\n                userinfoEndpoint: ctx.provider.userInfoUrl || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new ValidationError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaI,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASE;GACvBC,cAAcF,IAAID,SAASG;GAC3BC,aAAa,GAAGH,IAAIH,QAAQO,UAAUb,2CAA2CS,IAAID,SAASM,EAAE;GAChGC,OAAON,IAAID,SAASO,SAASC,KAAAA;GAC7BC,uBAAuBR,IAAID,SAASU;GACpCC,eAAeV,IAAID,SAASY;GAC5BC,kBAAkBZ,IAAID,SAASc,eAAeN,KAAAA;EAClD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKnB,OAAOoB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIvB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM0B,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAKxB,OAAOwB,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKvB,QAAQI,UACbqB,SAASrB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOuB,MAFe,KAAK1B,eAAe2B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAUxC,oBAAoBuC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GACX;IACDG,OAAO,CACHL,QAAQK,KACX;GACL;GACAV,MAAMK;GACNlC,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","ValidationError","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","clientSecret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorizeUrl","tokenEndpoint","tokenUrl","userinfoEndpoint","userInfoUrl","buildRedirectURL","parameters","authorize","buildURL","resolveIdentity","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","authenticate","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.clientId,\n                clientSecret: ctx.provider.clientSecret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorizeUrl,\n                tokenEndpoint: ctx.provider.tokenUrl,\n                userinfoEndpoint: ctx.provider.userInfoUrl || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new ValidationError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async resolveIdentity(params: OAuth2AuthorizationCodeGrantPayload): Promise<IdentityProviderIdentity> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        return identity;\n    }\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const identity = await this.resolveIdentity(params);\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaI,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASE;GACvBC,cAAcF,IAAID,SAASG;GAC3BC,aAAa,GAAGH,IAAIH,QAAQO,UAAUb,2CAA2CS,IAAID,SAASM,EAAE;GAChGC,OAAON,IAAID,SAASO,SAASC,KAAAA;GAC7BC,uBAAuBR,IAAID,SAASU;GACpCC,eAAeV,IAAID,SAASY;GAC5BC,kBAAkBZ,IAAID,SAASc,eAAeN,KAAAA;EAClD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKnB,OAAOoB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIvB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM0B,gBAAgBC,QAAgF;EAClG,MAAMC,QAAQ,MAAM,KAAKxB,OAAOwB,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKvB,QAAQI,UACbqB,SAASrB,WAAW,KAAKJ,QAAQI;EAGrC,OAAOqB;CACX;CAEA,MAAME,aAAaL,QAA4D;EAC3E,MAAMG,WAAW,MAAM,KAAKJ,gBAAgBC,MAAAA;EAI5C,QAAOM,MAFe,KAAK3B,eAAe4B,KAAKJ,QAAAA,EAAAA,CAEhCK;CACnB;CAEA,MAAMC,iBAAiBT,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHW,SAAS;IACTD,MAAAA,MAHe,KAAKL,aAAaL,MAAAA;GAIrC;EACJ,SAASY,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBR,oCAAoCU,OAA+D;EAC/G,MAAMC,UAAUzC,oBAAoBwC,MAAME,YAAY;EAEtD,OAAO;GACH9B,IAAI6B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GACX;IACDG,OAAO,CACHL,QAAQK,KACX;GACL;GACAV,MAAMK;GACNnC,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/oauth2/types.d.ts

@@ -2,6 +2,7 @@ import type { OAuth2IdentityProvider, OpenIDIdentityProvider } from '@authup/cor
 import type { ObjectLiteral, Result } from '@authup/kit';
 import type { AuthorizeParameters } from '@hapic/oauth2';
 import type { IIdentityProviderAccountManager } from '../../../account/index.ts';
+import type { IdentityProviderIdentity } from '../../../types.ts';
 export type OAuth2AuthorizationCodeGrantPayload = {
     code: string;
     code_verifier?: string;
@@ -9,6 +10,12 @@ export type OAuth2AuthorizationCodeGrantPayload = {
 export interface IOAuth2Authenticator<T extends ObjectLiteral = ObjectLiteral> {
     authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<T>;
     safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<T>>;
+    /**
+     * Exchange the code and build the external identity WITHOUT touching
+     * the account store. The account-linking path decides what to do
+     * with the identity.
+     */
+    resolveIdentity(params: OAuth2AuthorizationCodeGrantPayload): Promise<IdentityProviderIdentity>;
     buildRedirectURL(parameters?: Partial<AuthorizeParameters>): string;
 }
 export type IdentityProviderOAuth2AuthenticatorOptions = {

package/dist/core/identity/provider/authentication/protocols/oauth2/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,MAAM,MAAM,mCAAmC,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;CACzB,CAAC;AAEF,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACzE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,gBAAgB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC;CACvE;AAED,MAAM,MAAM,0CAA0C,GAAG;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACpB,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACrD,OAAO,EAAE,0CAA0C,CAAC;IACpD,cAAc,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;CAC7D,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,MAAM,mCAAmC,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;CACzB,CAAC;AAEF,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACzE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE,mCAAmC,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAEjG,gBAAgB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC;CACvE;AAED,MAAM,MAAM,0CAA0C,GAAG;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACpB,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACrD,OAAO,EAAE,0CAA0C,CAAC;IACpD,cAAc,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;CAC7D,CAAC"}

package/dist/core/identity/provider/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountAlreadyLinkedError } from "./account/error.mjs";
 import { IdentityProviderMapperOperation } from "./mapper/constants.mjs";
 import { IdentityProviderAccountBaseMapper } from "./mapper/base.mjs";
 import { IdentityProviderAttributeMapper } from "./mapper/attributes/module.mjs";
@@ -21,4 +22,4 @@ import { IdentityProviderPaypalAuthenticator } from "./authentication/presets/pa
 import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./authentication/constants.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "./authentication/factory.mjs";
 import "./authentication/index.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, createIdentityProviderOAuth2Authenticator };
+export { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, createIdentityProviderOAuth2Authenticator, isIdentityProviderAccountAlreadyLinkedError };

package/dist/core/index.mjs

@@ -25,6 +25,8 @@ import { clientScopeSchema } from "./entities/client-scope/schema.mjs";
 import { consentSchema } from "./entities/consent/schema.mjs";
 import { eventSchema } from "./entities/event/schema.mjs";
 import { identityProviderSchema } from "./entities/identity-provider/schema.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./entities/identity-provider-account/types.mjs";
+import { identityProviderAccountSchema } from "./entities/identity-provider-account/schema.mjs";
 import { identityProviderRoleMappingSchema } from "./entities/identity-provider-role-mapping/schema.mjs";
 import { keySchema } from "./entities/key/schema.mjs";
 import { permissionSchema } from "./entities/permission/schema.mjs";
@@ -36,13 +38,14 @@ import { roleAttributeSchema } from "./entities/role-attribute/schema.mjs";
 import { rolePermissionSchema } from "./entities/role-permission/schema.mjs";
 import { scopeSchema } from "./entities/scope/schema.mjs";
 import { sessionSchema } from "./entities/session/schema.mjs";
+import { sessionTokenSchema } from "./entities/session-token/schema.mjs";
 import { trustAnchorSchema } from "./entities/trust-anchor/schema.mjs";
 import { userSchema } from "./entities/user/schema.mjs";
 import { userAttributeSchema } from "./entities/user-attribute/schema.mjs";
 import { userAuthenticatorSchema } from "./entities/user-authenticator/schema.mjs";
 import { userPermissionSchema } from "./entities/user-permission/schema.mjs";
 import { userRoleSchema } from "./entities/user-role/schema.mjs";
-import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./query/module.mjs";
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry, schemas } from "./query/module.mjs";
 import "./query/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./entities/client/system-clients.mjs";
@@ -55,6 +58,8 @@ import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDi
 import { EntityEventHandler } from "./entities/event/entity-event-handler.mjs";
 import { sanitizeEventData } from "./entities/event/sanitize.mjs";
 import { EventService } from "./entities/event/service.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError } from "./entities/identity-provider-account/error.mjs";
+import { IdentityProviderAccountService } from "./entities/identity-provider-account/service.mjs";
 import { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError } from "./key/error.mjs";
 import { isRealmCipherBlobError } from "./key/check.mjs";
 import { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError } from "./key/certificate-error.mjs";
@@ -74,6 +79,7 @@ import { RoleAttributeService } from "./entities/role-attribute/service.mjs";
 import { RolePermissionService } from "./entities/role-permission/service.mjs";
 import { ScopeService } from "./entities/scope/service.mjs";
 import { SessionService } from "./entities/session/service.mjs";
+import { SESSION_TOKEN_FILTER_KEYS, SessionTokenService } from "./entities/session-token/service.mjs";
 import { TrustAnchorService } from "./entities/trust-anchor/service.mjs";
 import { UserService } from "./entities/user/service.mjs";
 import { UserAttributeService } from "./entities/user-attribute/service.mjs";
@@ -112,6 +118,7 @@ import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
+import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./oauth2/session-token/error.mjs";
 import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
 import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
@@ -129,6 +136,7 @@ import { PasswordRecoveryService } from "./identity/password-recovery/service.mj
 import { PermissionCheckerService } from "./identity/permission/checker/service.mjs";
 import { IdentityPermissionProvider } from "./identity/permission/module.mjs";
 import { PolicyCheckerService } from "./identity/policy/checker/service.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountAlreadyLinkedError } from "./identity/provider/account/error.mjs";
 import { IdentityProviderMapperOperation } from "./identity/provider/mapper/constants.mjs";
 import { IdentityProviderAccountBaseMapper } from "./identity/provider/mapper/base.mjs";
 import { IdentityProviderAttributeMapper } from "./identity/provider/mapper/attributes/module.mjs";
@@ -179,4 +187,4 @@ import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/m
 import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./provisioning/wildcard/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED_ERROR_INSTANCE, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountAlreadyLinkedError, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SESSION_TOKEN_FILTER_KEYS, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SessionTokenRelationMissingError, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountAlreadyLinkedError, isIdentityProviderAccountUnlinkBlockedError, isRealmCipherBlobError, isSessionTokenRelationMissingError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, schemas, scopeSchema, sessionSchema, sessionTokenSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/oauth2/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAiDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA4KzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EAER,8BAA8B,EAEjC,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,KAAK,EACR,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,OAAO,CAAC,EAAG,gBAAgB,CAAC;IAEtC,SAAS,CAAC,iBAAiB,EAAG,MAAM,CAAC;IAErC,SAAS,CAAC,kBAAkB,EAAG,MAAM,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAG,mCAAmC,CAAC;IAEtE,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;gBAEpD,GAAG,EAAE,iCAAiC;IAWlD;;;;;;OAMG;IACG,SAAS,CACX,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;cAmDtB,cAAc,CAC1B,IAAI,EAAE,8BAA8B,EACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,0BAA+B,GACxC,OAAO,CAAC,yBAAyB,CAAC;CA4KzC"}

package/dist/core/oauth2/authorization/module.mjs

@@ -42,6 +42,7 @@ var OAuth2Authorization = class {
 				refType: EventRefType.CLIENT,
 				refId: options.client?.id ?? data.client_id ?? null,
 				clientId: options.client?.id ?? data.client_id ?? null,
+				sessionId: options.sessionId ?? null,
 				actorType: identity.type,
 				actorId: identity.data.id,
 				actorName: identity.data.name,
@@ -61,6 +62,7 @@ var OAuth2Authorization = class {
 					refType: EventRefType.CLIENT,
 					refId: options.client?.id ?? data.client_id ?? null,
 					clientId: options.client?.id ?? data.client_id ?? null,
+					sessionId: options.sessionId ?? null,
 					actorType: identity.type,
 					actorId: identity.data.id,
 					actorName: identity.data.name,