npm - @authup/server-core - Versions diffs - 1.0.0-beta.59 → 1.0.0-beta.61 - Mend

@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (434) hide show

package/dist/adapters/database/migrations/postgres/1786436332251-QueryIndexes.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1786436332251-QueryIndexes.mjs","names":["QueryIndexes1786436332251","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1786436332251-QueryIndexes.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Indexes for the query surface and the foreign-key graph.\n *\n * Query surface: backs the rapiq schema `indexes` declarations (rapiq\n * 2.0.0-beta.20 indexed filters/sort, tada5hi/rapiq#895) — every key in a\n * schema's filter/sort allow-list must LEAD a real database index, so the\n * parse-time index policy never rejects a query the allow-lists permit.\n *\n * Foreign-key graph: indexes every remaining FK scalar column (junction\n * *_realm_id and policy_id columns, client.access_policy_id, the EA and\n * identity-provider mapping tables). MySQL always keeps an implicit FK\n * index, so these matter on Postgres, where realm deletion\n * (crypto-shredding) and cascade deletes otherwise full-scan every\n * junction, and EA tree loads sit on the permission-evaluation hot path.\n *\n * display_name is indexed wherever the column exists, alongside name:\n * the console searches both at once (`or(contains(name), contains(\n * display_name))`), and anchor mode passes an OR only when EVERY branch\n * leads an index, so one missing index would reject the whole search.\n *\n * Compound access paths: (actor_name, request_ip_address, created_at) on\n * auth_events serves the login-throttle countRecent key and replaces the\n * redundant actor_name single; auth_session_tokens.parent_id serves the\n * grace-window hasConsumedChild lookup; auth_sessions gains its three FK\n * indexes; (provider_user_id, provider_id) serves the federated-login\n * account lookup.\n *\n * Cleanup: drops the three orphaned legacy tables no entity has described\n * since their reworks — auth_authorization_codes (codes moved to cache\n * blobs), auth_refresh_tokens (superseded by auth_session_tokens),\n * auth_identity_provider_roles (superseded by\n * auth_identity_provider_role_mappings). down() recreates them exactly as\n * the pre-existing chain leaves them, so older down() paths keep working.\n *\n * Generated with `migration generate`; derived IDX_<hash> names, generated\n * DDL untouched (hand-authored blocks are marked).\n */\n\nexport class QueryIndexes1786436332251 implements MigrationInterface {\n name = 'QueryIndexes1786436332251';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ce33c3f58b802bb3c7b2668adc\"\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_4a9118b99a30cfd3d0c49c3f4b\" ON \"auth_realms\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_75e631fcfae706212f5bd67a93\" ON \"auth_realms\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_711b1c0c94c1f50b72ee0bc5b2\" ON \"auth_realms\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_98610803836c2be19b55bc016b\" ON \"auth_realms\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7cdad1f4b4773508db1c7907e3\" ON \"auth_policies\" (\"type\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_14b3b3b9c0a1b3a1d2abecb6e7\" ON \"auth_policies\" (\"parent_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3bdf0256c69127d59bfd92a313\" ON \"auth_policies\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3f5906dabc9f129555d823408c\" ON \"auth_policies\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f4cdbb6a56eb93fa2598c8483d\" ON \"auth_policy_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_8b759199b8a0213a7a0f7b1986\" ON \"auth_policy_attributes\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7e7bca0ba30295b43b02a69051\" ON \"auth_clients\" (\"access_policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e9d2f1997f5bb2e3b25edc3ab6\" ON \"auth_clients\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_01ff3aa3d7f3ea41711fa3abd5\" ON \"auth_clients\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b628ffa1b2f5415598cfb1a72a\" ON \"auth_clients\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_4f168a45a40758502e4833bb85\" ON \"auth_users\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6597f3e492f4f8f3cc40772575\" ON \"auth_users\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_55c4ee639cdf45eb2453ee4fc7\" ON \"auth_users\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9a84db5a27d34b31644b54d910\" ON \"auth_user_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f50fe4004312e972a547c0e945\" ON \"auth_user_attributes\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_fa1bbd036543e4c4fda32b7ca6\" ON \"auth_user_attributes\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0d93685dd655ce6ee7c8255503\" ON \"auth_user_attributes\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a4a11809dcf8cdd5fcceec774e\" ON \"auth_sessions\" (\"expires_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b1d224a5ac76b109101ce07231\" ON \"auth_sessions\" (\"seen_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_46ab036699db960a12d34aad2b\" ON \"auth_sessions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_60c2b21c37d79572f92da3476d\" ON \"auth_sessions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_4b428fb760524b6ef45e7c2cbf\" ON \"auth_sessions\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_50ccaa6440288a06f0ba693ccc\" ON \"auth_sessions\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5a40fe23cbb002e73bf740715f\" ON \"auth_sessions\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_2cf41b241977b633ee7df5c8ae\" ON \"auth_keys\" (\"use\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_81ce3477ef39f7b5e0e009e81c\" ON \"auth_keys\" (\"status\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0a1114947c976bbe430d24b2c9\" ON \"auth_keys\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5fc18a2304a0cd7129cb8736ed\" ON \"auth_keys\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5d1a390d8b26eb227c3d2a8ca5\" ON \"auth_roles\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a7a399f06c259755d1b27b01ab\" ON \"auth_roles\" (\"target\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c66869156cbedfc95533f0df1\" ON \"auth_roles\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_414d5037e0b67b5dc3643ac8b8\" ON \"auth_roles\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_2ba00548c512fffe2e5bf4bb3f\" ON \"auth_role_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_cd014be6be330f64b8405d0c72\" ON \"auth_role_attributes\" (\"role_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b4ec5361a8a3f49267ccef575c\" ON \"auth_role_attributes\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_76b7c51aeeeff6d695c0b8e17f\" ON \"auth_role_attributes\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_dbcfb3a6d68ad40775ff55b0fd\" ON \"auth_client_roles\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f88e0dfb5f8c30fc66fef320f6\" ON \"auth_client_roles\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3a3a792dbd6d343c0dabe9900a\" ON \"auth_client_roles\" (\"client_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ff4c8615288f1f8ebbeeed7f85\" ON \"auth_client_roles\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_8a110d4e8e1f9be98cc8d41c1c\" ON \"auth_client_roles\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0979aabd6e00c278eb9ac1e0ca\" ON \"auth_permissions\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_798534b4e296f68e1bc658fbe3\" ON \"auth_permissions\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e97033638618a50676a1637ad6\" ON \"auth_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5690205a3d8b0ab370f18c0e4f\" ON \"auth_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_d677e1082c27aae4ede40db0e9\" ON \"auth_client_permissions\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b27b823c96287617e5bdf008ea\" ON \"auth_client_permissions\" (\"client_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_feb56f67d0c919e7626f1df836\" ON \"auth_client_permissions\" (\"permission_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0d08f64ff34cb0d19deff4b1fc\" ON \"auth_client_permissions\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ccc15bd289a1ee0ba1ff9f061a\" ON \"auth_client_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7a11a6fbab29ec59fc185d4f9e\" ON \"auth_client_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e41ae7308e97ec75440f973cd8\" ON \"auth_scopes\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a4d3545ecd5c7507c326f6ce0c\" ON \"auth_scopes\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c6dc9d6f6199967609c555ca07\" ON \"auth_scopes\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_800cdb9ca2821bc6a81b1eff34\" ON \"auth_client_scopes\" (\"default\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_410780c372c6b400e9c6cba743\" ON \"auth_client_scopes\" (\"client_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_471f3da9df80f92c382a586e9c\" ON \"auth_client_scopes\" (\"scope_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_81f39f6e4a90fc8b861cf12dbf\" ON \"auth_client_scopes\" (\"scope_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_88c5c368c6216d7d1f0eb26a97\" ON \"auth_consents\" (\"sub_kind\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_31d8afae3f42a07450dc54c2cb\" ON \"auth_consents\" (\"scope\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_eb128508302d046ee176ef89fd\" ON \"auth_consents\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6cff5665a42c31ebd8cdcfaad8\" ON \"auth_consents\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9486a670458a7377d1bd8f6245\" ON \"auth_events\" (\"scope\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_50f3b5dc6ae4eb17e736ca0a7d\" ON \"auth_events\" (\"ref_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_71c9adc2c466c149650c6c56e8\" ON \"auth_events\" (\"actor_type\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_37d01a405dc14c63738f1481b4\" ON \"auth_events\" (\"actor_name\", \"request_ip_address\", \"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_bac15f2c6806624e4f7223e5ed\" ON \"auth_identity_providers\" (\"protocol\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_213e1f3bdff969667e71206e9f\" ON \"auth_identity_providers\" (\"enabled\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6584e5587d2075fb11a8953bdc\" ON \"auth_identity_providers\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_246ce67900aa852582dae0a7d8\" ON \"auth_identity_providers\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5ac40c5ce92142639df65a33e5\" ON \"auth_identity_provider_attributes\" (\"provider_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_60411456c45c831be656fbf850\" ON \"auth_identity_provider_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9630da9b4e6c478189cc6062c5\" ON \"auth_identity_provider_accounts\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_430b7434c1f881ab776562e508\" ON \"auth_identity_provider_accounts\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b07582d2705a04c2e868e6c374\" ON \"auth_identity_provider_accounts\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c9432656798d6116dd47a896e4\" ON \"auth_identity_provider_accounts\" (\"user_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_209348829a22e0fb2715e937e4\" ON \"auth_identity_provider_accounts\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ccf3fd36253755bd9a5f43c516\" ON \"auth_identity_provider_accounts\" (\"provider_user_id\", \"provider_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_58a45697736646499b3dc7f0d0\" ON \"auth_identity_provider_attribute_mappings\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f59883e2400b294414a495002a\" ON \"auth_identity_provider_permission_mappings\" (\"permission_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_acce12b53121e9eb413f32c719\" ON \"auth_identity_provider_permission_mappings\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f2ea716aa0c8bd034b6f28e9eb\" ON \"auth_identity_provider_permission_mappings\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e84cd23669ae68b3bfd44ef986\" ON \"auth_identity_provider_role_mappings\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_d84c31eb147bde680370f00ea5\" ON \"auth_identity_provider_role_mappings\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0c89b2c523eee535a9a18422fd\" ON \"auth_identity_provider_role_mappings\" (\"role_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0c61ae237f6a87d65feed8bc45\" ON \"auth_identity_provider_role_mappings\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f8dfd31c9dc51e1fb8409c83d0\" ON \"auth_identity_provider_role_mappings\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_883cfabf7d5f7466a27625843d\" ON \"auth_session_tokens\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_8d823bc0f1c9fae725fe3c6c9e\" ON \"auth_session_tokens\" (\"parent_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9de8962dead711a91eb52badef\" ON \"auth_session_tokens\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_35eec422fb312f3d2d5d104da3\" ON \"auth_trust_anchors\" (\"enabled\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a788087fab74ba22302cc128eb\" ON \"auth_trust_anchors\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_16381ac607f6f4e37415a4879f\" ON \"auth_trust_anchors\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b4a3f78a50e369bfd2d1aa2445\" ON \"auth_permission_policies\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_85164349cdb62316ec19b88470\" ON \"auth_permission_policies\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_babb340dda101f2df8334eea5c\" ON \"auth_permission_policies\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f5225aa8083c99b1cd09f4390c\" ON \"auth_permission_policies\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a76f5f6a12317ea0e24a84c1a5\" ON \"auth_permission_policies\" (\"policy_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6b28c396d6f0c13165ae2d9abe\" ON \"auth_role_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_d1c82cf7a5659d0e6fce7aa481\" ON \"auth_role_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_cfa1834ece97297955f4a9539a\" ON \"auth_role_permissions\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3a6789765734cf5f3f555f2098\" ON \"auth_role_permissions\" (\"role_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3d29528c774bc47404659fad03\" ON \"auth_role_permissions\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f9ab8919ff5d5993816f688187\" ON \"auth_role_permissions\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c5ad558296a77525b1f52919bf\" ON \"auth_user_authenticators\" (\"confirmed\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7d3f50dac76afdc4f5a548eaf3\" ON \"auth_user_authenticators\" (\"last_used_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_fc331813cdc3b9c47a83c3be95\" ON \"auth_user_authenticators\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_eb9bd783394e3aedd35f855104\" ON \"auth_user_authenticators\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_db13de293f01ac8ab7bc0342c4\" ON \"auth_user_authenticators\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0a3a42400243fe3f9d969203a8\" ON \"auth_user_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_bc15924b6889713da243e883ca\" ON \"auth_user_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f15efcb7151cdd0d54ebafdd7f\" ON \"auth_user_permissions\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c1d4523b08aa27f07dff798f8d\" ON \"auth_user_permissions\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5bf6d1affe0575299c44bc58c0\" ON \"auth_user_permissions\" (\"user_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e2de70574303693fea386cc0ed\" ON \"auth_user_permissions\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_77fe9d38c984c640fc155503c4\" ON \"auth_user_roles\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a3a59104c9c9f2a2458972bc96\" ON \"auth_user_roles\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6161ccebf3af1c475758651de4\" ON \"auth_user_roles\" (\"user_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e0588e81b8ff3c640311b7ee39\" ON \"auth_user_roles\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_92ba9504d7698a5a3de297ac76\" ON \"auth_user_roles\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f8538b58d9fe496e4c7bc6c565\" ON \"auth_users\" (\"reset_hash\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b2003e5ab8c075dc0a11f33bca\" ON \"auth_users\" (\"activate_hash\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c861f8e8ea9fe35507b57fb88\" ON \"auth_policies\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c08d15bfcf413aad26ee3eda8\" ON \"auth_clients\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5015816deff1b14e7d669ed7cb\" ON \"auth_roles\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f2835b7434c506b81e48a48229\" ON \"auth_scopes\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5b1ba660790692f625c7a777d3\" ON \"auth_identity_providers\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6f92ed4d9d7499b1dff735133c\" ON \"auth_policies\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_dd5af3e4a6f6157685f64d2c80\" ON \"auth_clients\" (\"active\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b532f2eeaa9eb2b5c3ac65459b\" ON \"auth_clients\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_61132a880199e367d87d4f51b5\" ON \"auth_users\" (\"active\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_50bf2034bc55ce71102900f5ae\" ON \"auth_sessions\" (\"realm_id\", \"seen_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_1ab6178864ca0fd7d23efe6abf\" ON \"auth_sessions\" (\"user_id\", \"seen_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6ff3a9ac44beabcc3a9642f0f9\" ON \"auth_events\" (\"realm_id\", \"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_74d37f543d9f9476b4b232c00b\" ON \"auth_session_tokens\" (\"session_id\", \"created_at\")\n `);\n // Hand-authored: drop the three orphaned legacy tables. Each predates a\n // rework that replaced it and nothing has referenced them since:\n // auth_authorization_codes (codes moved to cache blobs),\n // auth_refresh_tokens (superseded by auth_session_tokens, refresh\n // rotation), auth_identity_provider_roles (superseded by\n // auth_identity_provider_role_mappings in the identity-provider\n // rework). No entity describes them, so the schema-drift gate never\n // compared them; rows are pre-rework leftovers and are destroyed.\n await queryRunner.query(`\n DROP TABLE \"auth_authorization_codes\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_refresh_tokens\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_identity_provider_roles\"\n `);\n }\n public async down(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_74d37f543d9f9476b4b232c00b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6ff3a9ac44beabcc3a9642f0f9\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_1ab6178864ca0fd7d23efe6abf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_50bf2034bc55ce71102900f5ae\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_61132a880199e367d87d4f51b5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b532f2eeaa9eb2b5c3ac65459b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_dd5af3e4a6f6157685f64d2c80\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6f92ed4d9d7499b1dff735133c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5b1ba660790692f625c7a777d3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f2835b7434c506b81e48a48229\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5015816deff1b14e7d669ed7cb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9c08d15bfcf413aad26ee3eda8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9c861f8e8ea9fe35507b57fb88\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b2003e5ab8c075dc0a11f33bca\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f8538b58d9fe496e4c7bc6c565\"\n `);\n // Hand-authored: recreate the dropped legacy tables exactly as the\n // pre-existing chain leaves them (constraint and index names\n // included, robot FKs excluded — RemoveRobots dropped those), so\n // the older migrations' down() paths keep working.\n await queryRunner.query(`\n CREATE TABLE \"auth_authorization_codes\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"content\" character varying(4096) NOT NULL,\n \"expires\" character varying(28) NOT NULL,\n \"scope\" character varying(512),\n \"redirect_uri\" character varying(2000),\n \"id_token\" character varying(1000),\n \"client_id\" uuid,\n \"user_id\" uuid,\n \"robot_id\" uuid,\n \"realm_id\" uuid NOT NULL,\n CONSTRAINT \"PK_c2ecb6968a63a751bd6fd2e2b6b\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_refresh_tokens\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"expires\" character varying(28) NOT NULL,\n \"scope\" character varying(512),\n \"access_token\" uuid,\n \"client_id\" uuid,\n \"user_id\" uuid,\n \"robot_id\" uuid,\n \"realm_id\" uuid NOT NULL,\n CONSTRAINT \"PK_df6893d2063a4ea7bbf1eda31e5\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_identity_provider_roles\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"external_id\" character varying(36) NOT NULL,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"role_id\" uuid NOT NULL,\n \"role_realm_id\" uuid,\n \"provider_id\" uuid NOT NULL,\n \"provider_realm_id\" uuid,\n CONSTRAINT \"PK_345f74231cf39250a3e572b84a7\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_42df2e30eee05e54c74bced78b\" ON \"auth_identity_provider_roles\" (\"provider_id\", \"external_id\")\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_fadb9ce4df580cc42e78b74b2f\" ON \"auth_identity_provider_roles\" (\"provider_id\", \"role_id\")\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_343b25488aef1b87f4771f8c7eb\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_5119ffb8f6b8ba853e52be2e417\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_ff6e597e9dd296da510efc06d28\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_8f611e7ff67a2b013c909f60d52\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_c1f59fdabbcf5dfd74d6af7f400\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_f795ad14f31838e3ddc663ee150\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_2c3139bd232ffde35b71d43018e\" FOREIGN KEY (\"role_realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_52a568200844cde16722b9bb95e\" FOREIGN KEY (\"provider_id\") REFERENCES \"auth_identity_providers\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_d49fb54b140869696a5a14285c7\" FOREIGN KEY (\"provider_realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_f32f792ca1aeacea0507ef80a11\" FOREIGN KEY (\"role_id\") REFERENCES \"auth_roles\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_92ba9504d7698a5a3de297ac76\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e0588e81b8ff3c640311b7ee39\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6161ccebf3af1c475758651de4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a3a59104c9c9f2a2458972bc96\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_77fe9d38c984c640fc155503c4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e2de70574303693fea386cc0ed\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5bf6d1affe0575299c44bc58c0\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c1d4523b08aa27f07dff798f8d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f15efcb7151cdd0d54ebafdd7f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_bc15924b6889713da243e883ca\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0a3a42400243fe3f9d969203a8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_db13de293f01ac8ab7bc0342c4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_eb9bd783394e3aedd35f855104\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_fc331813cdc3b9c47a83c3be95\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7d3f50dac76afdc4f5a548eaf3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c5ad558296a77525b1f52919bf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f9ab8919ff5d5993816f688187\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3d29528c774bc47404659fad03\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3a6789765734cf5f3f555f2098\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_cfa1834ece97297955f4a9539a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_d1c82cf7a5659d0e6fce7aa481\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6b28c396d6f0c13165ae2d9abe\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a76f5f6a12317ea0e24a84c1a5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f5225aa8083c99b1cd09f4390c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_babb340dda101f2df8334eea5c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_85164349cdb62316ec19b88470\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b4a3f78a50e369bfd2d1aa2445\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_16381ac607f6f4e37415a4879f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a788087fab74ba22302cc128eb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_35eec422fb312f3d2d5d104da3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9de8962dead711a91eb52badef\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_8d823bc0f1c9fae725fe3c6c9e\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_883cfabf7d5f7466a27625843d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f8dfd31c9dc51e1fb8409c83d0\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0c61ae237f6a87d65feed8bc45\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0c89b2c523eee535a9a18422fd\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_d84c31eb147bde680370f00ea5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e84cd23669ae68b3bfd44ef986\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f2ea716aa0c8bd034b6f28e9eb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_acce12b53121e9eb413f32c719\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f59883e2400b294414a495002a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_58a45697736646499b3dc7f0d0\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ccf3fd36253755bd9a5f43c516\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_209348829a22e0fb2715e937e4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c9432656798d6116dd47a896e4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b07582d2705a04c2e868e6c374\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_430b7434c1f881ab776562e508\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9630da9b4e6c478189cc6062c5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_60411456c45c831be656fbf850\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5ac40c5ce92142639df65a33e5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_246ce67900aa852582dae0a7d8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6584e5587d2075fb11a8953bdc\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_213e1f3bdff969667e71206e9f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_bac15f2c6806624e4f7223e5ed\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_37d01a405dc14c63738f1481b4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_71c9adc2c466c149650c6c56e8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_50f3b5dc6ae4eb17e736ca0a7d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9486a670458a7377d1bd8f6245\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6cff5665a42c31ebd8cdcfaad8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_eb128508302d046ee176ef89fd\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_31d8afae3f42a07450dc54c2cb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_88c5c368c6216d7d1f0eb26a97\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_81f39f6e4a90fc8b861cf12dbf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_471f3da9df80f92c382a586e9c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_410780c372c6b400e9c6cba743\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_800cdb9ca2821bc6a81b1eff34\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c6dc9d6f6199967609c555ca07\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a4d3545ecd5c7507c326f6ce0c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e41ae7308e97ec75440f973cd8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7a11a6fbab29ec59fc185d4f9e\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ccc15bd289a1ee0ba1ff9f061a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0d08f64ff34cb0d19deff4b1fc\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_feb56f67d0c919e7626f1df836\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b27b823c96287617e5bdf008ea\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_d677e1082c27aae4ede40db0e9\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5690205a3d8b0ab370f18c0e4f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e97033638618a50676a1637ad6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_798534b4e296f68e1bc658fbe3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0979aabd6e00c278eb9ac1e0ca\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_8a110d4e8e1f9be98cc8d41c1c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ff4c8615288f1f8ebbeeed7f85\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3a3a792dbd6d343c0dabe9900a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f88e0dfb5f8c30fc66fef320f6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_dbcfb3a6d68ad40775ff55b0fd\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_76b7c51aeeeff6d695c0b8e17f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b4ec5361a8a3f49267ccef575c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_cd014be6be330f64b8405d0c72\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_2ba00548c512fffe2e5bf4bb3f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_414d5037e0b67b5dc3643ac8b8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9c66869156cbedfc95533f0df1\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a7a399f06c259755d1b27b01ab\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5d1a390d8b26eb227c3d2a8ca5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5fc18a2304a0cd7129cb8736ed\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0a1114947c976bbe430d24b2c9\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_81ce3477ef39f7b5e0e009e81c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_2cf41b241977b633ee7df5c8ae\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5a40fe23cbb002e73bf740715f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_50ccaa6440288a06f0ba693ccc\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_4b428fb760524b6ef45e7c2cbf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_60c2b21c37d79572f92da3476d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_46ab036699db960a12d34aad2b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b1d224a5ac76b109101ce07231\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a4a11809dcf8cdd5fcceec774e\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0d93685dd655ce6ee7c8255503\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_fa1bbd036543e4c4fda32b7ca6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f50fe4004312e972a547c0e945\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9a84db5a27d34b31644b54d910\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_55c4ee639cdf45eb2453ee4fc7\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6597f3e492f4f8f3cc40772575\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_4f168a45a40758502e4833bb85\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b628ffa1b2f5415598cfb1a72a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_01ff3aa3d7f3ea41711fa3abd5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e9d2f1997f5bb2e3b25edc3ab6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7e7bca0ba30295b43b02a69051\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_8b759199b8a0213a7a0f7b1986\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f4cdbb6a56eb93fa2598c8483d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3f5906dabc9f129555d823408c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3bdf0256c69127d59bfd92a313\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_14b3b3b9c0a1b3a1d2abecb6e7\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7cdad1f4b4773508db1c7907e3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_98610803836c2be19b55bc016b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_711b1c0c94c1f50b72ee0bc5b2\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_75e631fcfae706212f5bd67a93\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_4a9118b99a30cfd3d0c49c3f4b\"\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ce33c3f58b802bb3c7b2668adc\" ON \"auth_events\" USING btree (\"actor_name\")\n `);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCA,IAAaA,4BAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EASD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CACA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAKD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;SAcvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts CHANGED Viewed

@@ -1,20 +1,23 @@
 import type { IAppEvent } from 'routup';
-import type { IdentityProvider } from '@authup/core-kit';
-import type { EntityCollectionResponse, EntityRecordResponse, IdentityProviderCreatePayload, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
+import type { IdentityProvider, IdentityProviderAccount } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { EntityCollectionResponse, EntityRecordResponse, IdentityProviderCreatePayload, IdentityProviderLinkConfirmPayload, IdentityProviderLinkRequestResponse, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
+import type { IEventService, IIdentityProviderAccountLinkStore, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IRealmRepository } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
     protected options: IdentityProviderControllerOptions;
     protected repository: IIdentityProviderRepository;
     protected realmRepository: IRealmRepository;
-    protected clientRepository: IOAuth2ClientRepository;
     protected accountManager: IIdentityProviderAccountManager;
+    protected linkStore: IIdentityProviderAccountLinkStore;
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected codeRequestValidator: OAuth2AuthorizationCodeRequestValidator;
     protected stateManager: IOAuth2AuthorizationStateManager;
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
     protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected eventService?: IEventService;
+    protected logger?: Logger;
     constructor(ctx: IdentityProviderControllerContext);
     getProviders(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProvider>>;
     getProvider(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
@@ -23,10 +26,25 @@ export declare class IdentityProviderController {
     dropProvider(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
     addProvider(user: IdentityProviderCreatePayload, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
+    linkRequest(_id: string, event: IAppEvent): Promise<IdentityProviderLinkRequestResponse>;
     authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
     private write;
+    /**
+     * Callback half of the account-linking round-trip (plan 091): the
+     * external identity is bound to the state-referenced user instead of
+     * running the login path. No auth code and no session is minted; the
+     * browser lands back on the account console with a marker param.
+     */
+    private completeLink;
+    /**
+     * The bearer-authenticated half of the link (issue #3439): the account
+     * row is written here, for the AUTHENTICATED user, never in the callback.
+     */
+    confirmLink(_id: string, _data: IdentityProviderLinkConfirmPayload, event: IAppEvent): Promise<EntityRecordResponse<IdentityProviderAccount>>;
+    private pickIdentityCandidate;
     private buildHostedAuthorizeURL;
     private resolve;
+    private buildProviderAuthenticator;
     private saveAuthorizationState;
     private verifyAuthorizationState;
 }

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"~~AAoBA~~,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,~~EAAE~~,gBAAgB,~~EAAkC~~,MAAM,kBAAkB,CAAC;~~AAiBzF~~,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,~~uBAAuB,EACvB,~~gBAAgB,~~EAEnB~~,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAO1C,MAAM,8BAA8B,CAAC;~~AAYtC~~,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,~~gBAAgB~~,EAAE,~~uBAAuB,~~CAAC;~~IAEpD~~,SAAS,CAAC,~~cAAc~~,EAAE~~,+BAA+B~~,CAAC;~~IAE1D~~,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;~~gBAIpD~~,GAAG,EAAE,iCAAiC;~~IAgB5C~~,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;~~IAgD1B~~,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;~~YAyGlB~~,KAAK;IA+FnB,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;~~YAYP~~,sBAAsB;YAWtB,wBAAwB;CAWzC"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EAI1B,MAAM,kBAAkB,CAAC;AAc1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,aAAa,EACb,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAInB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAO1C,MAAM,8BAA8B,CAAC;AAatC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,SAAS,EAAE,iCAAiC,CAAC;IAEvD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,iCAAiC;IAkB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IA0C1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,mCAAmC,CAAC;IA6B1C,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA4KlB,KAAK;IA+FnB;;;;;OAKG;YACW,YAAY;IAyE1B;;;OAGG;IAEG,WAAW,CACA,GAAG,EAAE,MAAM,EACf,KAAK,EAAE,kCAAkC,EACtC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IA2E1D,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;IAYrB,OAAO,CAAC,0BAA0B;YAepB,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs CHANGED Viewed

@@ -14,15 +14,17 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import { getBodyRealmID } from "../../../request/helpers/body-realm-id.mjs";
 import { getRequestParamID, useRequestParamID } from "../../../request/helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import { useRequestEventContext } from "../../../request/event-context.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import { describeError } from "../../../../../utils/error.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
-import { ValidatorGroup, base64URLDecode, isUUID } from "@authup/kit";
-import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
+import { ValidatorGroup, base64URLDecode, isObject, isUUID } from "@authup/kit";
+import { EventName, EventRefType, EventScope, IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { BadRequestError, EntityInactiveError, EntityNotFoundError } from "@authup/errors";
 import { OAuth2ErrorCode, OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
 import { getRequestHeader, getRequestIP, sendRedirect } from "routup";
@@ -48,24 +50,28 @@ var IdentityProviderController = class {
 	options;
 	repository;
 	realmRepository;
-	clientRepository;
 	accountManager;
+	linkStore;
 	codeRequestVerifier;
 	codeRequestValidator;
 	stateManager;
 	codeIssuer;
 	accessPolicyEvaluator;
+	eventService;
+	logger;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
-		this.clientRepository = ctx.clientRepository;
 		this.accountManager = ctx.accountManager;
+		this.linkStore = ctx.linkStore;
 		this.codeIssuer = ctx.codeIssuer;
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.stateManager = ctx.stateManager;
 		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
+		this.eventService = ctx.eventService;
+		this.logger = ctx.logger;
 	}
 	async getProviders(event) {
 		const { data, meta } = await this.repository.findMany(await decodeQuery(useRequestQuery(event), {
@@ -146,12 +152,7 @@ var IdentityProviderController = class {
 		const id = useRequestParamID(event);
 		const entity = await this.resolve(id);
 		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new BadRequestError("Only an identity-provider based on the oauth protocol supports authorize redirect.");
-		const authenticator = createIdentityProviderOAuth2Authenticator({
-			accountManager: this.accountManager,
-			provider: entity,
-			options: { baseURL: this.options.baseURL }
-		});
-		const parameters = {};
+		const authenticator = this.buildProviderAuthenticator(entity);
 		let codeRequest;
 		const query = useRequestQuery(event);
 		if (typeof query.codeRequest === "string") {
@@ -166,59 +167,86 @@ var IdentityProviderController = class {
 			if (data.client.realmId && entity.realmId && entity.realmId !== data.client.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
 			codeRequest = data.data;
 		}
-		parameters.state = await this.saveAuthorizationState(event, codeRequest);
-		return sendRedirect(event, authenticator.buildRedirectURL(parameters));
+		const state = await this.saveAuthorizationState(event, { codeRequest });
+		return sendRedirect(event, authenticator.buildRedirectURL({ state }));
+	}
+	async linkRequest(_id, event) {
+		const id = useRequestParamID(event);
+		const entity = await this.resolve(id);
+		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new BadRequestError("Only an identity-provider based on the oauth protocol supports account linking.");
+		if (!entity.enabled) throw new BadRequestError("The identity provider is not enabled.");
+		const identity = useRequestIdentityOrFail(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only a user can link an identity provider account.");
+		if (entity.realmId && entity.realmId !== identity.realmId) throw new BadRequestError("The identity provider does not belong to the user realm.");
+		const authenticator = this.buildProviderAuthenticator(entity);
+		const state = await this.saveAuthorizationState(event, { link: {
+			userId: identity.id,
+			providerId: entity.id
+		} });
+		return { url: authenticator.buildRedirectURL({ state }) };
 	}
 	async authorizeIn(_id, event) {
 		const id = useRequestParamID(event);
 		const entity = await this.resolve(id);
 		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new Error(`The provider protocol ${entity.protocol} is not valid.`);
 		const data = await this.verifyAuthorizationState(event);
+		const { link } = data;
+		if (link) return this.completeLink(event, entity, data, link);
 		if (entity.realmId && data.codeRequest && data.codeRequest.realm_id && data.codeRequest.realm_id !== entity.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
 		const { code } = useRequestQuery(event);
-		const user = await createIdentityProviderOAuth2Authenticator({
-			accountManager: this.accountManager,
-			provider: entity,
-			options: {
-				baseURL: this.options.baseURL,
-				clientId: data.codeRequest?.client_id
-			}
-		}).authenticate(code);
+		if (typeof code !== "string" || code.length === 0) throw new BadRequestError("The authorization code is missing.");
+		const verified = data.codeRequest ? await this.codeRequestVerifier.verify(data.codeRequest) : void 0;
+		if (!entity.enabled) throw new BadRequestError("The identity provider is not enabled.");
+		const user = await this.buildProviderAuthenticator(entity, { clientId: verified?.data.client_id }).authenticate({ code });
+		if (!user.active) throw new EntityInactiveError({ entity: "user" });
 		const realm = await this.realmRepository.resolve(entity.realmId, true);
-		if (data.codeRequest?.client_id) {
-			const client = await this.clientRepository.findOneByIdOrName(data.codeRequest.client_id, data.codeRequest.realm_id);
-			if (client?.accessPolicyId) {
-				let allowed = false;
-				const subject = toIdentityPolicyData({
-					type: IdentityType.USER,
-					data: {
-						...user,
-						realm
-					}
-				});
-				if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(client.accessPolicyId, subject);
-				if (!allowed) {
-					const url = this.buildHostedAuthorizeURL(data.codeRequest);
-					url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
-					return sendRedirect(event, url.href);
+		if (verified?.client.accessPolicyId) {
+			let allowed = false;
+			const subject = toIdentityPolicyData({
+				type: IdentityType.USER,
+				data: {
+					...user,
+					realm
 				}
+			});
+			if (this.accessPolicyEvaluator && subject) allowed = await this.accessPolicyEvaluator.evaluate(verified.client.accessPolicyId, subject);
+			if (!allowed) {
+				const url = this.buildHostedAuthorizeURL(verified.data);
+				url.searchParams.set("error", OAuth2ErrorCode.ACCESS_DENIED);
+				return sendRedirect(event, url.href);
 			}
 		}
-		const authorizationCode = await this.codeIssuer.issue({
-			response_type: "code",
-			client_id: data.codeRequest?.client_id,
-			redirect_uri: data.codeRequest?.redirect_uri,
-			scope: data.codeRequest?.scope
-		}, {
+		const authorizationCode = await this.codeIssuer.issue(verified?.data ?? { response_type: "code" }, {
 			type: IdentityType.USER,
 			data: {
 				...user,
 				realm
 			}
 		}, { authMethod: SessionAuthMethod.EXTERNAL });
-		if (data.codeRequest) {
-			const url = this.buildHostedAuthorizeURL(data.codeRequest);
+		await this.eventService?.record({
+			scope: EventScope.OAUTH2,
+			name: EventName.AUTHORIZE,
+			refType: EventRefType.CLIENT,
+			refId: verified?.data.client_id ?? null,
+			clientId: verified?.data.client_id ?? null,
+			sessionId: null,
+			actorType: IdentityType.USER,
+			actorId: user.id,
+			actorName: user.name,
+			realmId: verified?.data.realm_id ?? realm.id,
+			requestIpAddress: getRequestIP(event) ?? null,
+			requestUserAgent: getRequestHeader(event, "user-agent") ?? null,
+			data: {
+				reason: "federated",
+				providerId: entity.id,
+				providerName: entity.name,
+				...verified?.data.scope ? { scope: verified.data.scope } : {}
+			}
+		});
+		if (verified?.redirectUriVerified && verified.data.redirect_uri) {
+			const url = new URL(verified.data.redirect_uri);
 			url.searchParams.set("code", authorizationCode.id);
+			if (verified.data.state) url.searchParams.set("state", verified.data.state);
 			return sendRedirect(event, url.href);
 		}
 		const url = new URL(this.options.baseURL);
@@ -289,6 +317,89 @@ var IdentityProviderController = class {
 			meta: {}
 		};
 	}
+	/**
+	* Callback half of the account-linking round-trip (plan 091): the
+	* external identity is bound to the state-referenced user instead of
+	* running the login path. No auth code and no session is minted; the
+	* browser lands back on the account console with a marker param.
+	*/ async completeLink(event, provider, state, link) {
+		const url = new URL(resolveURL(this.options.baseURL, "account/connected-accounts"));
+		const { code } = useRequestQuery(event);
+		try {
+			if (link.providerId !== provider.id || !provider.enabled) throw new BadRequestError("The identity provider is not available for account linking.");
+			if (typeof code !== "string" || code.length === 0) throw new BadRequestError("The authorization code is missing.");
+			const identity = await this.buildProviderAuthenticator(provider).resolveIdentity({ code });
+			if (!identity.id) throw new BadRequestError("The identity provider returned no subject.");
+			const handle = await this.linkStore.save({
+				providerId: provider.id,
+				userId: link.userId,
+				providerUserId: identity.id,
+				providerUserName: this.pickIdentityCandidate(identity, "name"),
+				providerUserEmail: this.pickIdentityCandidate(identity, "email")
+			});
+			url.searchParams.set("linkHandle", handle);
+			url.searchParams.set("provider", provider.id);
+		} catch (e) {
+			this.logger?.error(describeError(e, "The identity-provider account link failed."));
+			url.searchParams.set("linkError", "link_failed");
+		}
+		return sendRedirect(event, url.href);
+	}
+	/**
+	* The bearer-authenticated half of the link (issue #3439): the account
+	* row is written here, for the AUTHENTICATED user, never in the callback.
+	*/ async confirmLink(_id, _data, event) {
+		const id = useRequestParamID(event);
+		const provider = await this.resolve(id);
+		if (!isOAuth2IdentityProvider(provider) && !isOpenIDIdentityProvider(provider)) throw new BadRequestError("Only an identity-provider based on the oauth protocol supports account linking.");
+		if (!provider.enabled) throw new BadRequestError("The identity provider is not enabled.");
+		const identity = useRequestIdentityOrFail(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only a user can link an identity provider account.");
+		const body = await readRequestBody(event);
+		const handle = isObject(body) ? body.handle : void 0;
+		if (typeof handle !== "string" || handle.length === 0) throw new BadRequestError("The account link handle is missing.");
+		const link = await this.linkStore.consume(handle);
+		if (!link) throw new BadRequestError("The account link request is unknown or expired.");
+		if (link.userId !== identity.id || link.providerId !== provider.id) throw new BadRequestError("The account link request does not belong to the authenticated user.");
+		const account = await this.accountManager.link({
+			id: link.providerUserId,
+			attributeCandidates: {
+				name: [link.providerUserName],
+				email: [link.providerUserEmail]
+			},
+			data: {},
+			provider
+		}, identity.id);
+		const requestContext = useRequestEventContext();
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.IDENTITY_PROVIDER_LINKED,
+			refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,
+			refId: account.id,
+			realmId: account.userRealmId ?? provider.realmId ?? null,
+			actorType: IdentityType.USER,
+			actorId: account.userId,
+			actorName: identity.data.name ?? null,
+			sessionId: requestContext?.sessionId ?? null,
+			requestPath: requestContext?.requestPath ?? null,
+			requestMethod: requestContext?.requestMethod ?? null,
+			requestIpAddress: requestContext?.requestIpAddress ?? getRequestIP(event) ?? null,
+			requestUserAgent: requestContext?.requestUserAgent ?? getRequestHeader(event, "user-agent") ?? null,
+			data: {
+				providerId: provider.id,
+				providerName: provider.name
+			}
+		});
+		return {
+			data: account,
+			meta: {}
+		};
+	}
+	pickIdentityCandidate(identity, key) {
+		const candidates = identity.attributeCandidates?.[key] || [];
+		for (const candidate of candidates) if (typeof candidate === "string" && candidate.length > 0) return candidate;
+		return null;
+	}
 	buildHostedAuthorizeURL(codeRequest) {
 		const url = new URL(resolveURL(this.options.baseURL, "authorize"));
 		const codeRequestKeys = Object.keys(codeRequest);
@@ -304,9 +415,20 @@ var IdentityProviderController = class {
 		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
-	async saveAuthorizationState(event, codeRequest) {
+	buildProviderAuthenticator(provider, options = {}) {
+		return createIdentityProviderOAuth2Authenticator({
+			accountManager: this.accountManager,
+			provider,
+			logger: this.logger,
+			options: {
+				baseURL: this.options.baseURL,
+				clientId: options.clientId
+			}
+		});
+	}
+	async saveAuthorizationState(event, data = {}) {
 		return this.stateManager.save({
-			codeRequest,
+			...data,
 			ip: getRequestIP(event) ?? "",
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
@@ -385,6 +507,14 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "authorizeOut", null);
+_ts_decorate([
+	DPost("/:id/link-request", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderController.prototype, "linkRequest", null);
 _ts_decorate([
 	DGet("/:id/authorize-in", []),
 	_ts_param(0, DPath("id")),
@@ -393,6 +523,19 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "authorizeIn", null);
+_ts_decorate([
+	DPost("/:id/link-confirm", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DBody()),
+	_ts_param(2, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [
+		String,
+		typeof IdentityProviderLinkConfirmPayload === "undefined" ? Object : IdentityProviderLinkConfirmPayload,
+		typeof IAppEvent === "undefined" ? Object : IAppEvent
+	]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderController.prototype, "confirmLink", null);
 IdentityProviderController = _ts_decorate([
 	DTags("identity"),
 	DController(["/identity-providers", "/realms/:realmId/identity-providers"]),