@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

package/dist/app/modules/database/repositories/key/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","validateEntityJoinColumns","applyQuery","redactFieldConditions","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","options","getRepository","repository","resolveOrCreate","realmId","use","entity","findOne","select","id","name","type","status","signatureAlgorithm","encryptionKey","decryptionKey","where","ACTIVE","order","priority","createdAt","afterLoad","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus  } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n    AsymmetricKey,\n    CryptoAsymmetricAlgorithm,\n    type EntityRepositoryFindManyResult,\n    type ISymmetricCipher,\n    type Logger,\n    createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { getRandomValues } from 'uncrypto';\nimport {\n    DatabaseConflictError,\n    KeyEntity,\n    RealmEntity,\n    UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n    REALM_CIPHER_BLOB_VERSION,\n    isWrappedKeyMaterial,\n    unwrapKeyMaterial,\n    wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n    /**\n     * Optional KEK (config secretsEncryptionKey) — when present, key\n     * material is persisted wrapped and unwrapped transparently on read.\n     */\n    secretsCipher?: ISymmetricCipher | null,\n    logger?: Logger,\n};\n\n/**\n * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryptionKey; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n    protected dataSource : DataSource;\n\n    protected secretsCipher : ISymmetricCipher | null;\n\n    protected realmRepository : IRealmRepository;\n\n    protected logger? : Logger;\n\n    constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n        this.dataSource = dataSource;\n        this.secretsCipher = options.secretsCipher ?? null;\n        this.logger = options.logger;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository() : Repository<KeyEntity> {\n        return this.dataSource.getRepository(KeyEntity);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyStore — material resolution (signer / verifier / realm cipher)\n    // ------------------------------------------------------------------\n\n    async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n        const { repository } = this;\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: {\n                realmId,\n                use,\n                status: KeyStatus.ACTIVE,\n            },\n            // createdAt + id break priority ties deterministically (e.g.\n            // duplicate mints from a concurrent zero-row backstop race —\n            // benign, both keys verify, but selection must be stable).\n            order: {\n                priority: 'DESC', \n                createdAt: 'DESC', \n                id: 'ASC', \n            },\n        });\n\n        if (entity) {\n            return this.afterLoad(repository, entity);\n        }\n\n        const total = await repository.countBy({ realmId, use });\n        if (total > 0) {\n            // an admin who disabled every key meant it — do not silently\n            // re-mint around the kill switch.\n            throw new AuthupError(\n                `No active ${use} key is available for realm ${realmId} ` +\n                `(${total} key(s) exist, none active).`,\n            );\n        }\n\n        if (use === JWKUse.ENCRYPTION) {\n            return this.createEncryptionKey(repository, realmId);\n        }\n\n        return this.createSignatureKey(repository, realmId);\n    }\n\n    async resolveById(id: string): Promise<Key | null> {\n        const { repository } = this;\n\n        // `id` reaches here from an attacker-controlled JWT `kid` header on the\n        // token-verification hot path. A non-UUID value binds against a\n        // postgres `uuid` column as a driver-level type error (500) instead of\n        // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n        // plain verification failure.\n        if (!isUUID(id)) {\n            return null;\n        }\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: { id },\n        });\n\n        if (!entity) {\n            return null;\n        }\n\n        return this.afterLoad(repository, entity);\n    }\n\n    protected async createSignatureKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n        const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n        const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n        const material = await privateKeyContainer.toBase64();\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.SIGNATURE),\n            type: JWKType.RSA,\n            use: JWKUse.SIGNATURE,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: await publicKeyContainer.toBase64(),\n            realmId,\n            signatureAlgorithm: `${JWTAlgorithm.RS256}`,\n        });\n\n        await repository.save(entity);\n\n        // hand the caller usable material regardless of the persisted form.\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected async createEncryptionKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const raw = new Uint8Array(32);\n        getRandomValues(raw);\n\n        const material = arrayBufferToBase64(raw.buffer);\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.ENCRYPTION),\n            type: JWKType.OCT,\n            use: JWKUse.ENCRYPTION,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: null,\n            realmId,\n            signatureAlgorithm: null,\n        });\n\n        await repository.save(entity);\n\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected generateName(use: `${JWKUse}`) : string {\n        return `${use}-${createNanoID(10)}`;\n    }\n\n    protected async afterLoad(\n        repository: Repository<KeyEntity>,\n        entity: KeyEntity,\n    ) : Promise<Key> {\n        if (!entity.decryptionKey) {\n            return entity;\n        }\n\n        if (isWrappedKeyMaterial(entity.decryptionKey)) {\n            entity.decryptionKey = await unwrapKeyMaterial(this.secretsCipher, entity.decryptionKey);\n            return entity;\n        }\n\n        if (this.secretsCipher) {\n            // lazy wrap-on-read: a KEK added to a running deployment\n            // hardens existing rows without a migration step. Best-effort —\n            // the material stays readable either way.\n            const material = entity.decryptionKey;\n            try {\n                await repository.update(entity.id, { decryptionKey: await wrapKeyMaterial(this.secretsCipher, material) });\n            } catch (e) {\n                // Best-effort — the material stays readable and the next read\n                // retries. Surface it though: a persistent failure (e.g. a\n                // read-only replica) means the row is never hardened at rest.\n                this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n            }\n            entity.decryptionKey = material;\n        }\n\n        return entity;\n    }\n\n    protected async protect(material: string) : Promise<string> {\n        if (!this.secretsCipher) {\n            return material;\n        }\n\n        return wrapKeyMaterial(this.secretsCipher, material);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyRepository — entity CRUD surface (key management API)\n    // ------------------------------------------------------------------\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Key>> {\n        const qb = this.repository.createQueryBuilder('keyEntity');\n        qb.groupBy('keyEntity.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'keyEntity');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Key | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Key | null> {\n        const where : FindOptionsWhere<KeyEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realmId = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Key[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Key | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Key>): Key {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Key, data: Partial<Key>): Key {\n        return this.repository.merge(entity as KeyEntity, data);\n    }\n\n    async save(entity: Key): Promise<Key> {\n        if (\n            entity.decryptionKey &&\n            this.secretsCipher &&\n            !isWrappedKeyMaterial(entity.decryptionKey)\n        ) {\n            const material = entity.decryptionKey;\n            entity.decryptionKey = await wrapKeyMaterial(this.secretsCipher, material);\n            const saved = await this.repository.save(entity as KeyEntity);\n            saved.decryptionKey = material;\n            return saved;\n        }\n\n        return this.repository.save(entity as KeyEntity);\n    }\n\n    async remove(entity: Key): Promise<void> {\n        await this.repository.remove(entity as KeyEntity);\n    }\n\n    async validateJoinColumns(data: Partial<Key>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async countBlobReferences(keyId: string): Promise<number> {\n        return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n    }\n\n    async findHighestPriority(realmId: string, use: string): Promise<number | null> {\n        return this.repository.maximum('priority', { realmId, use: use as `${JWKUse}` });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDA,IAAa4B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYH,YAAwBI,UAAuC,CAAC,GAAG;EAC3E,KAAKJ,aAAaA;EAClB,KAAKC,gBAAgBG,QAAQH,iBAAiB;EAC9C,KAAKE,SAASC,QAAQD;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWK,cAAchB,WAAAA,CAAAA;CAC/E;CAEA,IAAciB,aAAqC;EAC/C,OAAO,KAAKN,WAAWK,cAAcjB,SAAAA;CACzC;CAMA,MAAMmB,gBAAgBC,SAAiBC,KAAgC;EACnE,MAAM,EAAEH,eAAe;EAEvB,MAAMI,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO;IACHZ;IACAC;IACAO,QAAQ5C,UAAUiD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,WAAW;IACXX,IAAI;GACR;EACJ,CAAA;EAEA,IAAIH,QACA,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;EAGtC,MAAMgB,QAAQ,MAAMpB,WAAWqB,QAAQ;GAAEnB;GAASC;EAAI,CAAA;EACtD,IAAIiB,QAAQ,GAGR,MAAM,IAAIvD,YACN,aAAasC,IAAI,8BAA8BD,QAAQ,IACnDkB,MAAM,6BAA6B;EAI/C,IAAIjB,QAAQ7B,OAAOgD,YACf,OAAO,KAAKC,oBAAoBvB,YAAYE,OAAAA;EAGhD,OAAO,KAAKsB,mBAAmBxB,YAAYE,OAAAA;CAC/C;CAEA,MAAMuB,YAAYlB,IAAiC;EAC/C,MAAM,EAAEP,eAAe;EAOvB,IAAI,CAAC/B,OAAOsC,EAAAA,GACR,OAAO;EAGX,MAAMH,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO,EAAEP,GAAG;EAChB,CAAA;EAEA,IAAI,CAACH,QACD,OAAO;EAGX,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;CACtC;CAEA,MAAgBoB,mBACZxB,YACAE,SACa;EACb,MAAMwB,UAAU,MAAMtD,wBAAwB,EAAEoC,MAAMrC,0BAA0BwD,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAI1D,cAAcwD,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAI5D,cAAcwD,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAM7B,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa7D,OAAO8D,SAAS;GACxC3B,MAAMpC,QAAQgE;GACdlC,KAAK7B,OAAO8D;GACZ1B,QAAQ5C,UAAUiD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe,MAAMkB,mBAAmBG,SAAQ;GAChD/B;GACAS,oBAAoB,GAAGpC,aAAagE;EACxC,CAAA;EAEA,MAAMvC,WAAWwC,KAAKpC,MAAAA;EAGtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEA,MAAgBmB,oBACZvB,YACAE,SACa;EACb,MAAMuC,sBAAM,IAAIC,WAAW,EAAA;EAC3B9D,gBAAgB6D,GAAAA;EAEhB,MAAMT,WAAWjE,oBAAoB0E,IAAIE,MAAM;EAE/C,MAAMvC,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa7D,OAAOgD,UAAU;GACzCb,MAAMpC,QAAQuE;GACdzC,KAAK7B,OAAOgD;GACZZ,QAAQ5C,UAAUiD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe;GACfV;GACAS,oBAAoB;EACxB,CAAA;EAEA,MAAMX,WAAWwC,KAAKpC,MAAAA;EAEtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEU+B,aAAahC,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGnC,aAAa,EAAA;CAClC;CAEA,MAAgBmD,UACZnB,YACAI,QACa;EACb,IAAI,CAACA,OAAOS,eACR,OAAOT;EAGX,IAAIlB,qBAAqBkB,OAAOS,aAAa,GAAG;GAC5CT,OAAOS,gBAAgB,MAAM1B,kBAAkB,KAAKQ,eAAeS,OAAOS,aAAa;GACvF,OAAOT;EACX;EAEA,IAAI,KAAKT,eAAe;GAIpB,MAAMqC,WAAW5B,OAAOS;GACxB,IAAI;IACA,MAAMb,WAAW6C,OAAOzC,OAAOG,IAAI,EAAEM,eAAe,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA,EAAU,CAAA;GAC5G,SAASc,GAAG;IAIR,KAAKjD,QAAQkD,KAAK,+CAA+C3C,OAAOG,GAAG,IAAI,EAAEyC,OAAOF,EAAE,CAAA;GAC9F;GACA1C,OAAOS,gBAAgBmB;EAC3B;EAEA,OAAO5B;CACX;CAEA,MAAgBkC,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKrC,eACN,OAAOqC;EAGX,OAAO5C,gBAAgB,KAAKO,eAAeqC,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA6D;EACxE,MAAMC,KAAK,KAAKnD,WAAWoD,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAe5E,WAAWyE,IAAID,KAAAA;EAEtC7D,sBAAsB8D,IAAI,WAAA;EAE1B,MAAM,CAACI,UAAUnC,SAAS,MAAM+B,GAAGK,gBAAe;EAElD,OAAO;GACHC,MAAM9E,sBAAsBuE,OAAOK,QAAAA;GACnCG,MAAM;IACFtC;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMK,YAAYpD,IAAiC;EAC/C,OAAO,KAAKqD,UAAU,EAAErD,GAAG,CAAA;CAC/B;CAEA,MAAMsD,cAAcrD,MAAcsD,UAAwC;EACtE,MAAMhD,QAAsC,EAAEN,KAAK;EAEnD,IAAIsD,UAAU;GACV,MAAM5D,UAAU,MAAM,KAAKN,gBAAgBmE,UAAUD,QAAAA;GACrD,IAAI,CAAC5D,SACD,OAAO;GAGXY,MAAMZ,UAAUA;EACpB;EAEA,OAAO,KAAKF,WAAW4D,UAAU9C,KAAAA;CACrC;CAEA,MAAMkD,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAOjG,OAAOgG,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWrD,OAA4C;EACzD,OAAO,KAAKd,WAAWoE,OAAO7E,yBAAyBuB,KAAAA,CAAAA;CAC3D;CAEA,MAAM8C,UAAU9C,OAAiD;EAC7D,OAAO,KAAKd,WAAW4D,UAAUrE,yBAAyBuB,KAAAA,CAAAA;CAC9D;CAEAoB,OAAOuB,MAAyB;EAC5B,OAAO,KAAKzD,WAAWkC,OAAOuB,IAAAA;CAClC;CAEAY,MAAMjE,QAAaqD,MAAyB;EACxC,OAAO,KAAKzD,WAAWqE,MAAMjE,QAAqBqD,IAAAA;CACtD;CAEA,MAAMjB,KAAKpC,QAA2B;EAClC,IACIA,OAAOS,iBACP,KAAKlB,iBACL,CAACT,qBAAqBkB,OAAOS,aAAa,GAC5C;GACE,MAAMmB,WAAW5B,OAAOS;GACxBT,OAAOS,gBAAgB,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA;GACjE,MAAMsC,QAAQ,MAAM,KAAKtE,WAAWwC,KAAKpC,MAAAA;GACzCkE,MAAMzD,gBAAgBmB;GACtB,OAAOsC;EACX;EAEA,OAAO,KAAKtE,WAAWwC,KAAKpC,MAAAA;CAChC;CAEA,MAAMmE,OAAOnE,QAA4B;EACrC,MAAM,KAAKJ,WAAWuE,OAAOnE,MAAAA;CACjC;CAEA,MAAMoE,oBAAoBf,MAAmC;EACzD,MAAMhF,0BAA0BgF,MAAM;GAClC/D,YAAY,KAAKA;GACjB+E,cAAc3F;EAClB,CAAA;CACJ;CAEA,MAAM4F,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBtF,eAAe;GAClCI,YAAY,KAAKA;GACjB+E,cAAc3F;GACdsB,QAAQqD;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI9F,sBAAAA;CAElB;CAEA,MAAMiG,oBAAoBC,OAAgC;EACtD,OAAO,KAAKrF,WAAWK,cAAcf,uBAAAA,CAAAA,CAAyBqC,QAAQ,EAAE2D,QAAQxG,KAAK,MAAgCuG,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoB/E,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAWkF,QAAQ,YAAY;GAAEhF;GAAcC;EAAmB,CAAA;CAClF;AACJ"}
+{"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","validateEntityJoinColumns","applyQuery","redactFieldConditions","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","mints","Map","options","getRepository","repository","findActiveKey","realmId","use","findOne","select","id","name","type","status","signatureAlgorithm","encryptionKey","decryptionKey","where","ACTIVE","order","priority","createdAt","resolveOrCreate","entity","afterLoad","mintExclusive","cacheKey","inFlight","get","promise","mint","set","finally","delete","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus  } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n    AsymmetricKey,\n    CryptoAsymmetricAlgorithm,\n    type EntityRepositoryFindManyResult,\n    type ISymmetricCipher,\n    type Logger,\n    createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { getRandomValues } from 'uncrypto';\nimport {\n    DatabaseConflictError,\n    KeyEntity,\n    RealmEntity,\n    UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n    REALM_CIPHER_BLOB_VERSION,\n    isWrappedKeyMaterial,\n    unwrapKeyMaterial,\n    wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n    /**\n     * Optional KEK (config secretsEncryptionKey) — when present, key\n     * material is persisted wrapped and unwrapped transparently on read.\n     */\n    secretsCipher?: ISymmetricCipher | null,\n    logger?: Logger,\n};\n\n/**\n * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryptionKey; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n    protected dataSource : DataSource;\n\n    protected secretsCipher : ISymmetricCipher | null;\n\n    protected realmRepository : IRealmRepository;\n\n    protected logger? : Logger;\n\n    /**\n     * In-flight mints keyed `<realmId>:<use>` — see {@link mintExclusive}.\n     */\n    protected mints : Map<string, Promise<Key>> = new Map();\n\n    constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n        this.dataSource = dataSource;\n        this.secretsCipher = options.secretsCipher ?? null;\n        this.logger = options.logger;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository() : Repository<KeyEntity> {\n        return this.dataSource.getRepository(KeyEntity);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyStore — material resolution (signer / verifier / realm cipher)\n    // ------------------------------------------------------------------\n\n    protected findActiveKey(realmId: string, use: `${JWKUse}`) : Promise<KeyEntity | null> {\n        return this.repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: {\n                realmId,\n                use,\n                status: KeyStatus.ACTIVE,\n            },\n            // createdAt + id break priority ties deterministically, so key\n            // selection stays stable whenever a realm holds several active\n            // keys (a rotation in progress, or a cross-process mint race).\n            order: {\n                priority: 'DESC',\n                createdAt: 'DESC',\n                id: 'ASC',\n            },\n        });\n    }\n\n    async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n        const entity = await this.findActiveKey(realmId, use);\n        if (entity) {\n            return this.afterLoad(this.repository, entity);\n        }\n\n        return this.mintExclusive(realmId, use);\n    }\n\n    /**\n     * Minting is check-then-act (read, count, insert), and the callers are\n     * hot paths — the token signer resolves a signature key for EVERY\n     * issuance, the realm cipher an encryption key for every MFA seed — so\n     * a freshly created realm routinely takes several simultaneous calls\n     * and each one would insert its own key. Concurrent mints for one\n     * (realm, use) therefore share a single in-flight promise.\n     *\n     * The map is per adapter instance, and the store is a DI singleton, so\n     * it is scoped to one application: two applications in one process\n     * (the test suite) never share mint state. Separate PROCESSES can still\n     * race, which is why the duplicate stays tolerable rather than fatal —\n     * both keys are published in JWKS and verify, and `findActiveKey`\n     * orders deterministically, so a duplicate costs a redundant row, not\n     * a broken token.\n     */\n    protected mintExclusive(realmId: string, use: `${JWKUse}`) : Promise<Key> {\n        const cacheKey = `${realmId}:${use}`;\n\n        const inFlight = this.mints.get(cacheKey);\n        if (inFlight) {\n            return inFlight;\n        }\n\n        const promise = this.mint(realmId, use);\n        this.mints.set(cacheKey, promise);\n\n        return promise.finally(() => {\n            this.mints.delete(cacheKey);\n        });\n    }\n\n    protected async mint(realmId: string, use: `${JWKUse}`) : Promise<Key> {\n        const { repository } = this;\n\n        // Re-read under the guard: the caller's lookup may predate a mint\n        // that has since completed and left the map, so the in-flight\n        // check alone would not see it.\n        const entity = await this.findActiveKey(realmId, use);\n        if (entity) {\n            return this.afterLoad(repository, entity);\n        }\n\n        const total = await repository.countBy({ realmId, use });\n        if (total > 0) {\n            // an admin who disabled every key meant it — do not silently\n            // re-mint around the kill switch.\n            throw new AuthupError(\n                `No active ${use} key is available for realm ${realmId} ` +\n                `(${total} key(s) exist, none active).`,\n            );\n        }\n\n        if (use === JWKUse.ENCRYPTION) {\n            return this.createEncryptionKey(repository, realmId);\n        }\n\n        return this.createSignatureKey(repository, realmId);\n    }\n\n    async resolveById(id: string): Promise<Key | null> {\n        const { repository } = this;\n\n        // `id` reaches here from an attacker-controlled JWT `kid` header on the\n        // token-verification hot path. A non-UUID value binds against a\n        // postgres `uuid` column as a driver-level type error (500) instead of\n        // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n        // plain verification failure.\n        if (!isUUID(id)) {\n            return null;\n        }\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: { id },\n        });\n\n        if (!entity) {\n            return null;\n        }\n\n        return this.afterLoad(repository, entity);\n    }\n\n    protected async createSignatureKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n        const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n        const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n        const material = await privateKeyContainer.toBase64();\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.SIGNATURE),\n            type: JWKType.RSA,\n            use: JWKUse.SIGNATURE,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: await publicKeyContainer.toBase64(),\n            realmId,\n            signatureAlgorithm: `${JWTAlgorithm.RS256}`,\n        });\n\n        await repository.save(entity);\n\n        // hand the caller usable material regardless of the persisted form.\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected async createEncryptionKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const raw = new Uint8Array(32);\n        getRandomValues(raw);\n\n        const material = arrayBufferToBase64(raw.buffer);\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.ENCRYPTION),\n            type: JWKType.OCT,\n            use: JWKUse.ENCRYPTION,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: null,\n            realmId,\n            signatureAlgorithm: null,\n        });\n\n        await repository.save(entity);\n\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected generateName(use: `${JWKUse}`) : string {\n        return `${use}-${createNanoID(10)}`;\n    }\n\n    protected async afterLoad(\n        repository: Repository<KeyEntity>,\n        entity: KeyEntity,\n    ) : Promise<Key> {\n        if (!entity.decryptionKey) {\n            return entity;\n        }\n\n        if (isWrappedKeyMaterial(entity.decryptionKey)) {\n            entity.decryptionKey = await unwrapKeyMaterial(this.secretsCipher, entity.decryptionKey);\n            return entity;\n        }\n\n        if (this.secretsCipher) {\n            // lazy wrap-on-read: a KEK added to a running deployment\n            // hardens existing rows without a migration step. Best-effort —\n            // the material stays readable either way.\n            const material = entity.decryptionKey;\n            try {\n                await repository.update(entity.id, { decryptionKey: await wrapKeyMaterial(this.secretsCipher, material) });\n            } catch (e) {\n                // Best-effort — the material stays readable and the next read\n                // retries. Surface it though: a persistent failure (e.g. a\n                // read-only replica) means the row is never hardened at rest.\n                this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n            }\n            entity.decryptionKey = material;\n        }\n\n        return entity;\n    }\n\n    protected async protect(material: string) : Promise<string> {\n        if (!this.secretsCipher) {\n            return material;\n        }\n\n        return wrapKeyMaterial(this.secretsCipher, material);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyRepository — entity CRUD surface (key management API)\n    // ------------------------------------------------------------------\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Key>> {\n        const qb = this.repository.createQueryBuilder('keyEntity');\n        qb.groupBy('keyEntity.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'keyEntity');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Key | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Key | null> {\n        const where : FindOptionsWhere<KeyEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realmId = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Key[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Key | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Key>): Key {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Key, data: Partial<Key>): Key {\n        return this.repository.merge(entity as KeyEntity, data);\n    }\n\n    async save(entity: Key): Promise<Key> {\n        if (\n            entity.decryptionKey &&\n            this.secretsCipher &&\n            !isWrappedKeyMaterial(entity.decryptionKey)\n        ) {\n            const material = entity.decryptionKey;\n            entity.decryptionKey = await wrapKeyMaterial(this.secretsCipher, material);\n            const saved = await this.repository.save(entity as KeyEntity);\n            saved.decryptionKey = material;\n            return saved;\n        }\n\n        return this.repository.save(entity as KeyEntity);\n    }\n\n    async remove(entity: Key): Promise<void> {\n        await this.repository.remove(entity as KeyEntity);\n    }\n\n    async validateJoinColumns(data: Partial<Key>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async countBlobReferences(keyId: string): Promise<number> {\n        return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n    }\n\n    async findHighestPriority(realmId: string, use: string): Promise<number | null> {\n        return this.repository.maximum('priority', { realmId, use: use as `${JWKUse}` });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDA,IAAa4B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;;;IAKV,wBAA8C,IAAIE,IAAAA;CAElD,YAAYL,YAAwBM,UAAuC,CAAC,GAAG;EAC3E,KAAKN,aAAaA;EAClB,KAAKC,gBAAgBK,QAAQL,iBAAiB;EAC9C,KAAKE,SAASG,QAAQH;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWO,cAAclB,WAAAA,CAAAA;CAC/E;CAEA,IAAcmB,aAAqC;EAC/C,OAAO,KAAKR,WAAWO,cAAcnB,SAAAA;CACzC;CAMUqB,cAAcC,SAAiBC,KAA8C;EACnF,OAAO,KAAKH,WAAWI,QAAQ;GAC3BC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNL,KAAK;IACLM,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfV,SAAS;GACb;GACAW,OAAO;IACHX;IACAC;IACAM,QAAQ7C,UAAUkD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,WAAW;IACXX,IAAI;GACR;EACJ,CAAA;CACJ;CAEA,MAAMY,gBAAgBhB,SAAiBC,KAAgC;EACnE,MAAMgB,SAAS,MAAM,KAAKlB,cAAcC,SAASC,GAAAA;EACjD,IAAIgB,QACA,OAAO,KAAKC,UAAU,KAAKpB,YAAYmB,MAAAA;EAG3C,OAAO,KAAKE,cAAcnB,SAASC,GAAAA;CACvC;;;;;;;;;;;;;;;;IAkBA,cAAwBD,SAAiBC,KAAiC;EACtE,MAAMmB,WAAW,GAAGpB,QAAQ,GAAGC;EAE/B,MAAMoB,WAAW,KAAK3B,MAAM4B,IAAIF,QAAAA;EAChC,IAAIC,UACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,KAAKxB,SAASC,GAAAA;EACnC,KAAKP,MAAM+B,IAAIL,UAAUG,OAAAA;EAEzB,OAAOA,QAAQG,cAAQ;GACnB,KAAKhC,MAAMiC,OAAOP,QAAAA;EACtB,CAAA;CACJ;CAEA,MAAgBI,KAAKxB,SAAiBC,KAAiC;EACnE,MAAM,EAAEH,eAAe;EAKvB,MAAMmB,SAAS,MAAM,KAAKlB,cAAcC,SAASC,GAAAA;EACjD,IAAIgB,QACA,OAAO,KAAKC,UAAUpB,YAAYmB,MAAAA;EAGtC,MAAMW,QAAQ,MAAM9B,WAAW+B,QAAQ;GAAE7B;GAASC;EAAI,CAAA;EACtD,IAAI2B,QAAQ,GAGR,MAAM,IAAInE,YACN,aAAawC,IAAI,8BAA8BD,QAAQ,IACnD4B,MAAM,6BAA6B;EAI/C,IAAI3B,QAAQ/B,OAAO4D,YACf,OAAO,KAAKC,oBAAoBjC,YAAYE,OAAAA;EAGhD,OAAO,KAAKgC,mBAAmBlC,YAAYE,OAAAA;CAC/C;CAEA,MAAMiC,YAAY7B,IAAiC;EAC/C,MAAM,EAAEN,eAAe;EAOvB,IAAI,CAACjC,OAAOuC,EAAAA,GACR,OAAO;EAGX,MAAMa,SAAS,MAAMnB,WAAWI,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNL,KAAK;IACLM,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfV,SAAS;GACb;GACAW,OAAO,EAAEP,GAAG;EAChB,CAAA;EAEA,IAAI,CAACa,QACD,OAAO;EAGX,OAAO,KAAKC,UAAUpB,YAAYmB,MAAAA;CACtC;CAEA,MAAgBe,mBACZlC,YACAE,SACa;EACb,MAAMkC,UAAU,MAAMlE,wBAAwB,EAAEqC,MAAMtC,0BAA0BoE,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAItE,cAAcoE,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAIxE,cAAcoE,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAMxB,SAASnB,WAAW4C,OAAO;GAC7BrC,MAAM,KAAKsC,aAAazE,OAAO0E,SAAS;GACxCtC,MAAMrC,QAAQ4E;GACd5C,KAAK/B,OAAO0E;GACZrC,QAAQ7C,UAAUkD;GAClBF,eAAe,MAAM,KAAKoC,QAAQN,QAAAA;GAClC/B,eAAe,MAAM6B,mBAAmBG,SAAQ;GAChDzC;GACAQ,oBAAoB,GAAGrC,aAAa4E;EACxC,CAAA;EAEA,MAAMjD,WAAWkD,KAAK/B,MAAAA;EAGtBA,OAAOP,gBAAgB8B;EAEvB,OAAOvB;CACX;CAEA,MAAgBc,oBACZjC,YACAE,SACa;EACb,MAAMiD,sBAAM,IAAIC,WAAW,EAAA;EAC3B1E,gBAAgByE,GAAAA;EAEhB,MAAMT,WAAW7E,oBAAoBsF,IAAIE,MAAM;EAE/C,MAAMlC,SAASnB,WAAW4C,OAAO;GAC7BrC,MAAM,KAAKsC,aAAazE,OAAO4D,UAAU;GACzCxB,MAAMrC,QAAQmF;GACdnD,KAAK/B,OAAO4D;GACZvB,QAAQ7C,UAAUkD;GAClBF,eAAe,MAAM,KAAKoC,QAAQN,QAAAA;GAClC/B,eAAe;GACfT;GACAQ,oBAAoB;EACxB,CAAA;EAEA,MAAMV,WAAWkD,KAAK/B,MAAAA;EAEtBA,OAAOP,gBAAgB8B;EAEvB,OAAOvB;CACX;CAEU0B,aAAa1C,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGrC,aAAa,EAAA;CAClC;CAEA,MAAgBsD,UACZpB,YACAmB,QACa;EACb,IAAI,CAACA,OAAOP,eACR,OAAOO;EAGX,IAAInC,qBAAqBmC,OAAOP,aAAa,GAAG;GAC5CO,OAAOP,gBAAgB,MAAM3B,kBAAkB,KAAKQ,eAAe0B,OAAOP,aAAa;GACvF,OAAOO;EACX;EAEA,IAAI,KAAK1B,eAAe;GAIpB,MAAMiD,WAAWvB,OAAOP;GACxB,IAAI;IACA,MAAMZ,WAAWuD,OAAOpC,OAAOb,IAAI,EAAEM,eAAe,MAAM1B,gBAAgB,KAAKO,eAAeiD,QAAAA,EAAU,CAAA;GAC5G,SAASc,GAAG;IAIR,KAAK7D,QAAQ8D,KAAK,+CAA+CtC,OAAOb,GAAG,IAAI,EAAEoD,OAAOF,EAAE,CAAA;GAC9F;GACArC,OAAOP,gBAAgB8B;EAC3B;EAEA,OAAOvB;CACX;CAEA,MAAgB6B,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKjD,eACN,OAAOiD;EAGX,OAAOxD,gBAAgB,KAAKO,eAAeiD,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA6D;EACxE,MAAMC,KAAK,KAAK7D,WAAW8D,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAexF,WAAWqF,IAAID,KAAAA;EAEtCzE,sBAAsB0E,IAAI,WAAA;EAE1B,MAAM,CAACI,UAAUnC,SAAS,MAAM+B,GAAGK,gBAAe;EAElD,OAAO;GACHC,MAAM1F,sBAAsBmF,OAAOK,QAAAA;GACnCG,MAAM;IACFtC;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMK,YAAY/D,IAAiC;EAC/C,OAAO,KAAKgE,UAAU,EAAEhE,GAAG,CAAA;CAC/B;CAEA,MAAMiE,cAAchE,MAAciE,UAAwC;EACtE,MAAM3D,QAAsC,EAAEN,KAAK;EAEnD,IAAIiE,UAAU;GACV,MAAMtE,UAAU,MAAM,KAAKR,gBAAgB+E,UAAUD,QAAAA;GACrD,IAAI,CAACtE,SACD,OAAO;GAGXW,MAAMX,UAAUA;EACpB;EAEA,OAAO,KAAKF,WAAWsE,UAAUzD,KAAAA;CACrC;CAEA,MAAM6D,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAO7G,OAAO4G,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWhE,OAA4C;EACzD,OAAO,KAAKb,WAAW8E,OAAOzF,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMyD,UAAUzD,OAAiD;EAC7D,OAAO,KAAKb,WAAWsE,UAAUjF,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEA+B,OAAOuB,MAAyB;EAC5B,OAAO,KAAKnE,WAAW4C,OAAOuB,IAAAA;CAClC;CAEAY,MAAM5D,QAAagD,MAAyB;EACxC,OAAO,KAAKnE,WAAW+E,MAAM5D,QAAqBgD,IAAAA;CACtD;CAEA,MAAMjB,KAAK/B,QAA2B;EAClC,IACIA,OAAOP,iBACP,KAAKnB,iBACL,CAACT,qBAAqBmC,OAAOP,aAAa,GAC5C;GACE,MAAM8B,WAAWvB,OAAOP;GACxBO,OAAOP,gBAAgB,MAAM1B,gBAAgB,KAAKO,eAAeiD,QAAAA;GACjE,MAAMsC,QAAQ,MAAM,KAAKhF,WAAWkD,KAAK/B,MAAAA;GACzC6D,MAAMpE,gBAAgB8B;GACtB,OAAOsC;EACX;EAEA,OAAO,KAAKhF,WAAWkD,KAAK/B,MAAAA;CAChC;CAEA,MAAM8D,OAAO9D,QAA4B;EACrC,MAAM,KAAKnB,WAAWiF,OAAO9D,MAAAA;CACjC;CAEA,MAAM+D,oBAAoBf,MAAmC;EACzD,MAAM5F,0BAA0B4F,MAAM;GAClC3E,YAAY,KAAKA;GACjB2F,cAAcvG;EAClB,CAAA;CACJ;CAEA,MAAMwG,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBlG,eAAe;GAClCI,YAAY,KAAKA;GACjB2F,cAAcvG;GACduC,QAAQgD;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI1G,sBAAAA;CAElB;CAEA,MAAM6G,oBAAoBC,OAAgC;EACtD,OAAO,KAAKjG,WAAWO,cAAcjB,uBAAAA,CAAAA,CAAyBiD,QAAQ,EAAE2D,QAAQpH,KAAK,MAAgCmH,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoBzF,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAW4F,QAAQ,YAAY;GAAE1F;GAAcC;EAAmB,CAAA;CAClF;AACJ"}

package/dist/app/modules/database/repositories/schema-validation.d.ts

@@ -14,12 +14,20 @@ export declare function assertSchemaFieldsCoverEntity(name: string, schema: {
 }, metadata: EntityMetadata): void;
 /**
  * Validate every registered entity schema against its TypeORM
- * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
- * fields/sort defaults and the filters default condition tree must
- * reference existing columns/relations) and assert its field allow-list
- * covers every selectable column. Called by
- * `DatabaseModule.setup` once the DataSource is initialized —
- * schema/entity drift fails the boot, fail-fast.
+ * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`:
+ * allow-lists, fields/sort defaults and the filters default condition
+ * tree must reference existing columns/relations, AND every declared
+ * index must be a leftmost prefix of a real primary key, unique
+ * constraint or index) and assert its field allow-list covers every
+ * selectable column. Called by `DatabaseModule.setup` once the
+ * DataSource is initialized — schema/entity drift fails the boot,
+ * fail-fast.
+ *
+ * The index half was an authup-side assert until rapiq 2.1.0 folded it
+ * upstream (tada5hi/rapiq#902 closed #898); the local copy is gone,
+ * since the upstream check is the same leftmost-prefix rule over the
+ * same structures and additionally verifies the index keys are real
+ * columns.
  */
 export declare function validateEntitySchemas(dataSource: DataSource): void;
 //# sourceMappingURL=schema-validation.d.ts.map

package/dist/app/modules/database/repositories/schema-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAgB,MAAM,SAAS,CAAC;AA2ExE;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,cAAc,GACxB,IAAI,CAiBP;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAI,IAAI,CAQnE"}
+{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAgB,MAAM,SAAS,CAAC;AA+ExE;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,cAAc,GACxB,IAAI,CAiBP;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAI,IAAI,CAQnE"}

package/dist/app/modules/database/repositories/schema-validation.mjs

@@ -17,8 +17,10 @@ import { UserAttributeEntity } from "../../../../adapters/database/domains/user-
 import { ConsentEntity } from "../../../../adapters/database/domains/consent/entity.mjs";
 import { EventEntity } from "../../../../adapters/database/domains/event/entity.mjs";
 import { IdentityProviderEntity } from "../../../../adapters/database/domains/identity-provider/entity.mjs";
+import { IdentityProviderAccountEntity } from "../../../../adapters/database/domains/identity-provider-account/entity.mjs";
 import { IdentityProviderRoleMappingEntity } from "../../../../adapters/database/domains/identity-provider-role-mapping/entity.mjs";
 import { SessionEntity } from "../../../../adapters/database/domains/session/entity.mjs";
+import { SessionTokenEntity } from "../../../../adapters/database/domains/session-token/entity.mjs";
 import { TrustAnchorEntity } from "../../../../adapters/database/domains/trust-anchor/entity.mjs";
 import { PermissionPolicyEntity } from "../../../../adapters/database/domains/permission-policy/entity.mjs";
 import { RolePermissionEntity } from "../../../../adapters/database/domains/role-permission/entity.mjs";
@@ -43,6 +45,7 @@ import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 	[EntityType.CONSENT]: ConsentEntity,
 	[EntityType.EVENT]: EventEntity,
 	[EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,
+	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: IdentityProviderAccountEntity,
 	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,
 	[EntityType.KEY]: KeyEntity,
 	[EntityType.PERMISSION]: PermissionEntity,
@@ -54,6 +57,7 @@ import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 	[EntityType.ROLE_PERMISSION]: RolePermissionEntity,
 	[EntityType.SCOPE]: ScopeEntity,
 	[EntityType.SESSION]: SessionEntity,
+	[EntityType.SESSION_TOKEN]: SessionTokenEntity,
 	[EntityType.TRUST_ANCHOR]: TrustAnchorEntity,
 	[EntityType.USER]: UserEntity,
 	[EntityType.USER_ATTRIBUTE]: UserAttributeEntity,
@@ -81,12 +85,20 @@ import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 }
 /**
 * Validate every registered entity schema against its TypeORM
-* metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
-* fields/sort defaults and the filters default condition tree must
-* reference existing columns/relations) and assert its field allow-list
-* covers every selectable column. Called by
-* `DatabaseModule.setup` once the DataSource is initialized —
-* schema/entity drift fails the boot, fail-fast.
+* metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`:
+* allow-lists, fields/sort defaults and the filters default condition
+* tree must reference existing columns/relations, AND every declared
+* index must be a leftmost prefix of a real primary key, unique
+* constraint or index) and assert its field allow-list covers every
+* selectable column. Called by `DatabaseModule.setup` once the
+* DataSource is initialized — schema/entity drift fails the boot,
+* fail-fast.
+*
+* The index half was an authup-side assert until rapiq 2.1.0 folded it
+* upstream (tada5hi/rapiq#902 closed #898); the local copy is gone,
+* since the upstream check is the same leftmost-prefix rule over the
+* same structures and additionally verifies the index keys are real
+* columns.
 */ function validateEntitySchemas(dataSource) {
 	for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {
 		const schema = schemaRegistry.getOrFail(name);

package/dist/app/modules/database/repositories/schema-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.mjs","names":["assertSchemaMatchesEntity","EntityType","schemaRegistry","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","ConsentEntity","EventEntity","IdentityProviderEntity","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyEntity","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","SessionEntity","TrustAnchorEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRoleEntity","SCHEMA_ENTITY_TARGETS","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","PERMISSION","PERMISSION_POLICY","POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","SCHEMA_FIELD_EXCLUSIONS","assertSchemaFieldsCoverEntity","name","schema","metadata","declared","Set","fields","default","allowed","excluded","missing","columns","filter","column","isSelect","map","propertyName","has","length","Error","join","validateEntitySchemas","dataSource","target","Object","entries","getOrFail","getMetadata"],"sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@rapiq/core';\nimport { assertSchemaMatchesEntity } from '@rapiq/adapter-typeorm';\nimport type { DataSource, EntityMetadata, EntityTarget } from 'typeorm';\nimport { EntityType } from '@authup/core-kit';\nimport { schemaRegistry } from '../../../../core/index.ts';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    ConsentEntity,\n    EventEntity,\n    IdentityProviderEntity,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyEntity,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    SessionEntity,\n    TrustAnchorEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\n\n/**\n * Entity class per registered schema name — the iteration source for\n * the boot-time validation. A mapped name missing from the registry\n * fails via `getOrFail`, so a renamed/removed schema surfaces here too.\n */\nconst SCHEMA_ENTITY_TARGETS : Record<string, EntityTarget<ObjectLiteral>> = {\n    [EntityType.CLIENT]: ClientEntity,\n    [EntityType.CLIENT_PERMISSION]: ClientPermissionEntity,\n    [EntityType.CLIENT_ROLE]: ClientRoleEntity,\n    [EntityType.CLIENT_SCOPE]: ClientScopeEntity,\n    [EntityType.CONSENT]: ConsentEntity,\n    [EntityType.EVENT]: EventEntity,\n    [EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,\n    [EntityType.KEY]: KeyEntity,\n    [EntityType.PERMISSION]: PermissionEntity,\n    [EntityType.PERMISSION_POLICY]: PermissionPolicyEntity,\n    [EntityType.POLICY]: PolicyEntity,\n    [EntityType.REALM]: RealmEntity,\n    [EntityType.ROLE]: RoleEntity,\n    [EntityType.ROLE_ATTRIBUTE]: RoleAttributeEntity,\n    [EntityType.ROLE_PERMISSION]: RolePermissionEntity,\n    [EntityType.SCOPE]: ScopeEntity,\n    [EntityType.SESSION]: SessionEntity,\n    [EntityType.TRUST_ANCHOR]: TrustAnchorEntity,\n    [EntityType.USER]: UserEntity,\n    [EntityType.USER_ATTRIBUTE]: UserAttributeEntity,\n    [EntityType.USER_AUTHENTICATOR]: UserAuthenticatorEntity,\n    [EntityType.USER_PERMISSION]: UserPermissionEntity,\n    [EntityType.USER_ROLE]: UserRoleEntity,\n};\n\n/**\n * Selectable columns deliberately kept out of a schema's field\n * allow-list. `select: false` columns are skipped automatically (the\n * entity already declares them hidden); everything listed here is a\n * column that IS selectable but must never ride the API projection.\n */\nconst SCHEMA_FIELD_EXCLUSIONS : Record<string, string[]> = {\n    // device-internal credential blob (TOTP config, WebAuthn public key +\n    // signature counter) — surfaced only through the challenge endpoint's\n    // trimmed view.\n    [EntityType.USER_AUTHENTICATOR]: ['parameters'],\n};\n\n/**\n * Every selectable column must appear in the schema's field allow-list:\n * rapiq derives the root projection from `fields` (`default` when\n * present, else `allowed`), so a column missing from BOTH silently\n * vanishes from every collection response — no error, just an absent\n * property (`role.builtIn` went missing this way).\n */\nexport function assertSchemaFieldsCoverEntity(\n    name: string,\n    schema: { fields?: { default?: string[], allowed?: string[] } },\n    metadata: EntityMetadata,\n) : void {\n    const declared = new Set([\n        ...(schema.fields?.default || []),\n        ...(schema.fields?.allowed || []),\n    ]);\n\n    const excluded = new Set(SCHEMA_FIELD_EXCLUSIONS[name] || []);\n    const missing = metadata.columns\n        .filter((column) => column.isSelect)\n        .map((column) => column.propertyName)\n        .filter((propertyName) => !declared.has(propertyName) && !excluded.has(propertyName));\n\n    if (missing.length > 0) {\n        throw new Error(\n            `The schema \"${name}\" does not declare the field(s): ${missing.join(', ')}.`,\n        );\n    }\n}\n\n/**\n * Validate every registered entity schema against its TypeORM\n * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,\n * fields/sort defaults and the filters default condition tree must\n * reference existing columns/relations) and assert its field allow-list\n * covers every selectable column. Called by\n * `DatabaseModule.setup` once the DataSource is initialized —\n * schema/entity drift fails the boot, fail-fast.\n */\nexport function validateEntitySchemas(dataSource: DataSource) : void {\n    for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {\n        const schema = schemaRegistry.getOrFail(name);\n        const metadata = dataSource.getMetadata(target);\n\n        assertSchemaMatchesEntity(schema, metadata);\n        assertSchemaFieldsCoverEntity(name, schema, metadata);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CA,MAAM2B,wBAAsE;EACvE1B,WAAW2B,SAASzB;EACpBF,WAAW4B,oBAAoBzB;EAC/BH,WAAW6B,cAAczB;EACzBJ,WAAW8B,eAAezB;EAC1BL,WAAW+B,UAAUzB;EACrBN,WAAWgC,QAAQzB;EACnBP,WAAWiC,oBAAoBzB;EAC/BR,WAAWkC,iCAAiCzB;EAC5CT,WAAWmC,MAAMzB;EACjBV,WAAWoC,aAAazB;EACxBX,WAAWqC,oBAAoBzB;EAC/BZ,WAAWsC,SAASzB;EACpBb,WAAWuC,QAAQzB;EACnBd,WAAWwC,OAAOxB;EAClBhB,WAAWyC,iBAAiB1B;EAC5Bf,WAAW0C,kBAAkBzB;EAC7BjB,WAAW2C,QAAQzB;EACnBlB,WAAW4C,UAAUzB;EACrBnB,WAAW6C,eAAezB;EAC1BpB,WAAW8C,OAAOvB;EAClBvB,WAAW+C,iBAAiB1B;EAC5BrB,WAAWgD,qBAAqB1B;EAChCtB,WAAWiD,kBAAkBzB;EAC7BxB,WAAWkD,YAAYzB;AAC5B;;;;;;GAQA,MAAM0B,0BAAqD,GAItDnD,WAAWgD,qBAAqB,CAAC,YAAa,EACnD;;;;;;;GASA,SAAgBI,8BACZC,MACAC,QACAC,UAAwB;CAExB,MAAMC,2BAAW,IAAIC,IAAI,CACjBH,GAAAA,OAAOI,QAAQC,WAAW,CAAA,GAC1BL,GAAAA,OAAOI,QAAQE,WAAW,CAAA,CACjC,CAAA;CAED,MAAMC,WAAW,IAAIJ,IAAIN,wBAAwBE,SAAS,CAAA,CAAE;CAC5D,MAAMS,UAAUP,SAASQ,QACpBC,QAAQC,WAAWA,OAAOC,QAAQ,CAAA,CAClCC,KAAKF,WAAWA,OAAOG,YAAY,CAAA,CACnCJ,QAAQI,iBAAiB,CAACZ,SAASa,IAAID,YAAAA,KAAiB,CAACP,SAASQ,IAAID,YAAAA,CAAAA;CAE3E,IAAIN,QAAQQ,SAAS,GACjB,MAAM,IAAIC,MACN,eAAelB,KAAK,mCAAmCS,QAAQU,KAAK,IAAA,EAAM,EAAE;AAGxF;;;;;;;;;GAWA,SAAgBC,sBAAsBC,YAAsB;CACxD,KAAK,MAAM,CAACrB,MAAMsB,WAAWC,OAAOC,QAAQnD,qBAAAA,GAAwB;EAChE,MAAM4B,SAASrD,eAAe6E,UAAUzB,IAAAA;EACxC,MAAME,WAAWmB,WAAWK,YAAYJ,MAAAA;EAExC5E,0BAA0BuD,QAAQC,QAAAA;EAClCH,8BAA8BC,MAAMC,QAAQC,QAAAA;CAChD;AACJ"}
+{"version":3,"file":"schema-validation.mjs","names":["assertSchemaMatchesEntity","EntityType","schemaRegistry","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","ConsentEntity","EventEntity","IdentityProviderAccountEntity","IdentityProviderEntity","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyEntity","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","SessionEntity","SessionTokenEntity","TrustAnchorEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRoleEntity","SCHEMA_ENTITY_TARGETS","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","PERMISSION","PERMISSION_POLICY","POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","SESSION_TOKEN","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","SCHEMA_FIELD_EXCLUSIONS","assertSchemaFieldsCoverEntity","name","schema","metadata","declared","Set","fields","default","allowed","excluded","missing","columns","filter","column","isSelect","map","propertyName","has","length","Error","join","validateEntitySchemas","dataSource","target","Object","entries","getOrFail","getMetadata"],"sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@rapiq/core';\nimport { assertSchemaMatchesEntity } from '@rapiq/adapter-typeorm';\nimport type { DataSource, EntityMetadata, EntityTarget } from 'typeorm';\nimport { EntityType } from '@authup/core-kit';\nimport { schemaRegistry } from '../../../../core/index.ts';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    ConsentEntity,\n    EventEntity,\n    IdentityProviderAccountEntity,\n    IdentityProviderEntity,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyEntity,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    SessionEntity,\n    SessionTokenEntity,\n    TrustAnchorEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\n\n/**\n * Entity class per registered schema name — the iteration source for\n * the boot-time validation. A mapped name missing from the registry\n * fails via `getOrFail`, so a renamed/removed schema surfaces here too.\n */\nconst SCHEMA_ENTITY_TARGETS : Record<string, EntityTarget<ObjectLiteral>> = {\n    [EntityType.CLIENT]: ClientEntity,\n    [EntityType.CLIENT_PERMISSION]: ClientPermissionEntity,\n    [EntityType.CLIENT_ROLE]: ClientRoleEntity,\n    [EntityType.CLIENT_SCOPE]: ClientScopeEntity,\n    [EntityType.CONSENT]: ConsentEntity,\n    [EntityType.EVENT]: EventEntity,\n    [EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: IdentityProviderAccountEntity,\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,\n    [EntityType.KEY]: KeyEntity,\n    [EntityType.PERMISSION]: PermissionEntity,\n    [EntityType.PERMISSION_POLICY]: PermissionPolicyEntity,\n    [EntityType.POLICY]: PolicyEntity,\n    [EntityType.REALM]: RealmEntity,\n    [EntityType.ROLE]: RoleEntity,\n    [EntityType.ROLE_ATTRIBUTE]: RoleAttributeEntity,\n    [EntityType.ROLE_PERMISSION]: RolePermissionEntity,\n    [EntityType.SCOPE]: ScopeEntity,\n    [EntityType.SESSION]: SessionEntity,\n    [EntityType.SESSION_TOKEN]: SessionTokenEntity,\n    [EntityType.TRUST_ANCHOR]: TrustAnchorEntity,\n    [EntityType.USER]: UserEntity,\n    [EntityType.USER_ATTRIBUTE]: UserAttributeEntity,\n    [EntityType.USER_AUTHENTICATOR]: UserAuthenticatorEntity,\n    [EntityType.USER_PERMISSION]: UserPermissionEntity,\n    [EntityType.USER_ROLE]: UserRoleEntity,\n};\n\n/**\n * Selectable columns deliberately kept out of a schema's field\n * allow-list. `select: false` columns are skipped automatically (the\n * entity already declares them hidden); everything listed here is a\n * column that IS selectable but must never ride the API projection.\n */\nconst SCHEMA_FIELD_EXCLUSIONS : Record<string, string[]> = {\n    // device-internal credential blob (TOTP config, WebAuthn public key +\n    // signature counter) — surfaced only through the challenge endpoint's\n    // trimmed view.\n    [EntityType.USER_AUTHENTICATOR]: ['parameters'],\n};\n\n/**\n * Every selectable column must appear in the schema's field allow-list:\n * rapiq derives the root projection from `fields` (`default` when\n * present, else `allowed`), so a column missing from BOTH silently\n * vanishes from every collection response — no error, just an absent\n * property (`role.builtIn` went missing this way).\n */\nexport function assertSchemaFieldsCoverEntity(\n    name: string,\n    schema: { fields?: { default?: string[], allowed?: string[] } },\n    metadata: EntityMetadata,\n) : void {\n    const declared = new Set([\n        ...(schema.fields?.default || []),\n        ...(schema.fields?.allowed || []),\n    ]);\n\n    const excluded = new Set(SCHEMA_FIELD_EXCLUSIONS[name] || []);\n    const missing = metadata.columns\n        .filter((column) => column.isSelect)\n        .map((column) => column.propertyName)\n        .filter((propertyName) => !declared.has(propertyName) && !excluded.has(propertyName));\n\n    if (missing.length > 0) {\n        throw new Error(\n            `The schema \"${name}\" does not declare the field(s): ${missing.join(', ')}.`,\n        );\n    }\n}\n\n/**\n * Validate every registered entity schema against its TypeORM\n * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`:\n * allow-lists, fields/sort defaults and the filters default condition\n * tree must reference existing columns/relations, AND every declared\n * index must be a leftmost prefix of a real primary key, unique\n * constraint or index) and assert its field allow-list covers every\n * selectable column. Called by `DatabaseModule.setup` once the\n * DataSource is initialized — schema/entity drift fails the boot,\n * fail-fast.\n *\n * The index half was an authup-side assert until rapiq 2.1.0 folded it\n * upstream (tada5hi/rapiq#902 closed #898); the local copy is gone,\n * since the upstream check is the same leftmost-prefix rule over the\n * same structures and additionally verifies the index keys are real\n * columns.\n */\nexport function validateEntitySchemas(dataSource: DataSource) : void {\n    for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {\n        const schema = schemaRegistry.getOrFail(name);\n        const metadata = dataSource.getMetadata(target);\n\n        assertSchemaMatchesEntity(schema, metadata);\n        assertSchemaFieldsCoverEntity(name, schema, metadata);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CA,MAAM6B,wBAAsE;EACvE5B,WAAW6B,SAAS3B;EACpBF,WAAW8B,oBAAoB3B;EAC/BH,WAAW+B,cAAc3B;EACzBJ,WAAWgC,eAAe3B;EAC1BL,WAAWiC,UAAU3B;EACrBN,WAAWkC,QAAQ3B;EACnBP,WAAWmC,oBAAoB1B;EAC/BT,WAAWoC,4BAA4B5B;EACvCR,WAAWqC,iCAAiC3B;EAC5CV,WAAWsC,MAAM3B;EACjBX,WAAWuC,aAAa3B;EACxBZ,WAAWwC,oBAAoB3B;EAC/Bb,WAAWyC,SAAS3B;EACpBd,WAAW0C,QAAQ3B;EACnBf,WAAW2C,OAAO1B;EAClBjB,WAAW4C,iBAAiB5B;EAC5BhB,WAAW6C,kBAAkB3B;EAC7BlB,WAAW8C,QAAQ3B;EACnBnB,WAAW+C,UAAU3B;EACrBpB,WAAWgD,gBAAgB3B;EAC3BrB,WAAWiD,eAAe3B;EAC1BtB,WAAWkD,OAAOzB;EAClBzB,WAAWmD,iBAAiB5B;EAC5BvB,WAAWoD,qBAAqB5B;EAChCxB,WAAWqD,kBAAkB3B;EAC7B1B,WAAWsD,YAAY3B;AAC5B;;;;;;GAQA,MAAM4B,0BAAqD,GAItDvD,WAAWoD,qBAAqB,CAAC,YAAa,EACnD;;;;;;;GASA,SAAgBI,8BACZC,MACAC,QACAC,UAAwB;CAExB,MAAMC,2BAAW,IAAIC,IAAI,CACjBH,GAAAA,OAAOI,QAAQC,WAAW,CAAA,GAC1BL,GAAAA,OAAOI,QAAQE,WAAW,CAAA,CACjC,CAAA;CAED,MAAMC,WAAW,IAAIJ,IAAIN,wBAAwBE,SAAS,CAAA,CAAE;CAC5D,MAAMS,UAAUP,SAASQ,QACpBC,QAAQC,WAAWA,OAAOC,QAAQ,CAAA,CAClCC,KAAKF,WAAWA,OAAOG,YAAY,CAAA,CACnCJ,QAAQI,iBAAiB,CAACZ,SAASa,IAAID,YAAAA,KAAiB,CAACP,SAASQ,IAAID,YAAAA,CAAAA;CAE3E,IAAIN,QAAQQ,SAAS,GACjB,MAAM,IAAIC,MACN,eAAelB,KAAK,mCAAmCS,QAAQU,KAAK,IAAA,EAAM,EAAE;AAGxF;;;;;;;;;;;;;;;;;GAmBA,SAAgBC,sBAAsBC,YAAsB;CACxD,KAAK,MAAM,CAACrB,MAAMsB,WAAWC,OAAOC,QAAQrD,qBAAAA,GAAwB;EAChE,MAAM8B,SAASzD,eAAeiF,UAAUzB,IAAAA;EACxC,MAAME,WAAWmB,WAAWK,YAAYJ,MAAAA;EAExChF,0BAA0B2D,QAAQC,QAAAA;EAClCH,8BAA8BC,MAAMC,QAAQC,QAAAA;CAChD;AACJ"}

package/dist/app/modules/http/modules/controller.d.ts

@@ -1,5 +1,5 @@
 import type { App } from 'routup';
-import { ClientController, ClientPermissionController, ClientRoleController, ClientScopeController, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyController, RealmController, RoleAttributeController, RoleController, RolePermissionController, ScopeController, SessionController, TrustAnchorController, UserAttributeController, UserAuthenticatorController, UserController, UserPermissionController, UserRoleController } from '../../../../adapters/http/index.ts';
+import { ClientController, ClientPermissionController, ClientRoleController, ClientScopeController, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyController, RealmController, RoleAttributeController, RoleController, RolePermissionController, ScopeController, SessionController, SessionTokenController, TrustAnchorController, UserAttributeController, UserAuthenticatorController, UserController, UserPermissionController, UserRoleController } from '../../../../adapters/http/index.ts';
 import { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController } from '../../../../adapters/http/controllers/index.ts';
 import type { IContainer } from 'eldin';
 import { ConsentService, OAuth2AccessPolicyEvaluator, OAuth2MfaLoginService, PasswordRecoveryService, RegistrationService, UserAuthenticatorService, UserService } from '../../../../core/index.ts';
@@ -35,9 +35,11 @@ export declare class HTTPControllerModule {
     createScopeController(container: IContainer): ScopeController;
     createKeyController(container: IContainer): KeyController;
     createTrustAnchorController(container: IContainer): TrustAnchorController;
+    createSessionTokenController(container: IContainer): SessionTokenController;
     createSessionController(container: IContainer): SessionController;
     protected createConsentService(container: IContainer): ConsentService;
     createConsentController(container: IContainer): ConsentController;
+    createIdentityProviderAccountController(container: IContainer): IdentityProviderAccountController;
     private accessPolicyEvaluator?;
     protected resolveAccessPolicyEvaluator(container: IContainer): OAuth2AccessPolicyEvaluator;
     private userAuthenticatorService?;

package/dist/app/modules/http/modules/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAmElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAMd,2BAA2B,EAG3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAUnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwE9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAY7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IASxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAoC5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAsD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAoElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iCAAiC,EACjC,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAOd,2BAA2B,EAG3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAWnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4E9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAY7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IASxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsC5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,4BAA4B,CAAC,SAAS,EAAE,UAAU;IAOlD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,uCAAuC,CAAC,SAAS,EAAE,UAAU;IAe7D,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAuD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}

package/dist/app/modules/http/modules/controller.mjs

@@ -34,6 +34,7 @@ import { ClientPermissionService } from "../../../../core/entities/client-permis
 import { ClientRoleService } from "../../../../core/entities/client-role/service.mjs";
 import { ClientScopeService } from "../../../../core/entities/client-scope/service.mjs";
 import { ConsentService } from "../../../../core/entities/consent/service.mjs";
+import { IdentityProviderAccountService } from "../../../../core/entities/identity-provider-account/service.mjs";
 import { KeyProvisioner } from "../../../../core/key/provisioner.mjs";
 import { RealmCipher } from "../../../../core/key/realm-cipher.mjs";
 import { KeyService } from "../../../../core/entities/key/service.mjs";
@@ -46,6 +47,7 @@ import { RoleAttributeService } from "../../../../core/entities/role-attribute/s
 import { RolePermissionService } from "../../../../core/entities/role-permission/service.mjs";
 import { ScopeService } from "../../../../core/entities/scope/service.mjs";
 import { SessionService } from "../../../../core/entities/session/service.mjs";
+import { SessionTokenService } from "../../../../core/entities/session-token/service.mjs";
 import { TrustAnchorService } from "../../../../core/entities/trust-anchor/service.mjs";
 import { UserService } from "../../../../core/entities/user/service.mjs";
 import { UserAttributeService } from "../../../../core/entities/user-attribute/service.mjs";
@@ -75,6 +77,7 @@ import { ClientPermissionRepositoryAdapter } from "../../database/repositories/c
 import { ClientRoleRepositoryAdapter } from "../../database/repositories/client-role/repository.mjs";
 import { ClientScopeRepositoryAdapter } from "../../database/repositories/client-scope/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "../../database/repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "../../database/repositories/identity-provider-account/repository.mjs";
 import { PermissionRepositoryAdapter } from "../../database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "../../database/repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "../../database/repositories/permission-provider/module.mjs";
@@ -103,6 +106,7 @@ import { ClientScopeController } from "../../../../adapters/http/controllers/ent
 import { ConsentController } from "../../../../adapters/http/controllers/entities/consent/module.mjs";
 import { EventController } from "../../../../adapters/http/controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "../../../../adapters/http/controllers/entities/identity-provider/module.mjs";
+import { IdentityProviderAccountController } from "../../../../adapters/http/controllers/entities/identity-provider-account/module.mjs";
 import { IdentityProviderRoleMappingController } from "../../../../adapters/http/controllers/entities/identity-provide-role/module.mjs";
 import { KeyController } from "../../../../adapters/http/controllers/entities/key/module.mjs";
 import { PermissionController } from "../../../../adapters/http/controllers/entities/permission/module.mjs";
@@ -127,6 +131,7 @@ import { RolePermissionController } from "../../../../adapters/http/controllers/
 import { PolicyController } from "../../../../adapters/http/controllers/entities/policy/module.mjs";
 import { ScopeController } from "../../../../adapters/http/controllers/entities/scope/module.mjs";
 import { SessionController } from "../../../../adapters/http/controllers/entities/session/module.mjs";
+import { SessionTokenController } from "../../../../adapters/http/controllers/entities/session-token/module.mjs";
 import { TrustAnchorController } from "../../../../adapters/http/controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "../../../../adapters/http/controllers/entities/user/module.mjs";
 import { UserAttributeController } from "../../../../adapters/http/controllers/entities/user-attribute/module.mjs";
@@ -137,6 +142,7 @@ import "../../../../adapters/http/controllers/index.mjs";
 import "../../../../adapters/http/index.mjs";
 import { OAuth2InjectionToken } from "../../oauth2/constants.mjs";
 import { IdentityInjectionKey } from "../../identity/constants.mjs";
+import { UserIdentityRepository } from "../../identity/repositories/user.mjs";
 import "../../identity/index.mjs";
 import "../../oauth2/index.mjs";
 import { LazyWildcardRealmProvisioner } from "../../provisioning/lazy-wildcard.mjs";
@@ -161,7 +167,9 @@ var HTTPControllerModule = class {
 		const keyController = this.createKeyController(container);
 		const trustAnchorController = this.createTrustAnchorController(container);
 		const sessionController = this.createSessionController(container);
+		const sessionTokenController = this.createSessionTokenController(container);
 		const consentController = this.createConsentController(container);
+		const identityProviderAccountController = this.createIdentityProviderAccountController(container);
 		const userController = this.createUserController(container);
 		const userAttributeController = this.createUserAttributeController(container);
 		const userAuthenticatorController = this.createUserAuthenticatorController(container);
@@ -189,6 +197,7 @@ var HTTPControllerModule = class {
 			clientScopeController,
 			consentController,
 			eventController,
+			identityProviderAccountController,
 			identityProviderRoleController,
 			this.createIdentityProvider(container),
 			keyController,
@@ -202,6 +211,7 @@ var HTTPControllerModule = class {
 			rolePermissionController,
 			scopeController,
 			sessionController,
+			sessionTokenController,
 			userController,
 			userAttributeController,
 			userAuthenticatorController,
@@ -428,6 +438,7 @@ var HTTPControllerModule = class {
 		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const accountManager = container.resolve(IdentityInjectionKey.ProviderAccountManager);
+		const linkStore = container.resolve(IdentityInjectionKey.ProviderAccountLinkStore);
 		const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);
 		const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);
 		const stateManager = container.resolve(OAuth2InjectionToken.AuthorizationStateManager);
@@ -440,12 +451,14 @@ var HTTPControllerModule = class {
 			options: { baseURL: config.publicUrl },
 			repository,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
-			clientRepository: container.resolve(OAuth2InjectionToken.ClientRepository),
 			accountManager,
+			linkStore,
 			codeIssuer,
 			codeRequestVerifier,
 			stateManager,
-			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container)
+			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			logger: container.resolve(LoggerInjectionKey)
 		});
 	}
 	createClientController(container) {
@@ -607,6 +620,15 @@ var HTTPControllerModule = class {
 		});
 		return new TrustAnchorController({ service });
 	}
+	createSessionTokenController(container) {
+		const repository = container.resolve(OAuth2InjectionToken.SessionTokenRepository);
+		const tokenRepository = container.resolve(OAuth2InjectionToken.TokenRepository);
+		const service = new SessionTokenService({
+			repository,
+			tokenRepository
+		});
+		return new SessionTokenController({ service });
+	}
 	createSessionController(container) {
 		const repository = container.resolve(AuthenticationInjectionKey.SessionRepository);
 		const service = new SessionService({ repository });
@@ -619,6 +641,20 @@ var HTTPControllerModule = class {
 	createConsentController(container) {
 		return new ConsentController({ service: this.createConsentService(container) });
 	}
+	createIdentityProviderAccountController(container) {
+		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
+		const service = new IdentityProviderAccountService({
+			repository: new IdentityProviderAccountRepositoryAdapter(dataSource),
+			userRepository: new UserIdentityRepository({
+				repository: new UserRepository(dataSource),
+				userPermissionRepository: container.resolve(UserPermissionEntity),
+				userRoleRepository: container.resolve(UserRoleEntity)
+			}),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			requestContext: useRequestEventContext
+		});
+		return new IdentityProviderAccountController({ service });
+	}
 	accessPolicyEvaluator;
 	resolveAccessPolicyEvaluator(container) {
 		if (this.accessPolicyEvaluator) return this.accessPolicyEvaluator;
@@ -660,6 +696,7 @@ var HTTPControllerModule = class {
 			cache: container.resolve(CacheInjectionKey),
 			cipher: new RealmCipher({ keyStore: container.resolve(OAuth2InjectionToken.KeyStore) }),
 			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			requestContext: useRequestEventContext,
 			mailClient: container.resolve(MailInjectionKey),
 			mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),
 			options: {