@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

package/dist/app/modules/identity/repositories/provider/link.d.ts

@@ -0,0 +1,9 @@
+import type { ICache } from '@authup/server-kit';
+import type { IIdentityProviderAccountLinkStore, IdentityProviderAccountLink } from '../../../../../core/index.ts';
+export declare class IdentityProviderAccountLinkStore implements IIdentityProviderAccountLinkStore {
+    protected cache: ICache;
+    constructor(cache: ICache);
+    save(data: IdentityProviderAccountLink): Promise<string>;
+    consume(handle: string): Promise<IdentityProviderAccountLink | null>;
+}
+//# sourceMappingURL=link.d.ts.map

package/dist/app/modules/identity/repositories/provider/link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/identity/repositories/provider/link.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EACR,iCAAiC,EACjC,2BAA2B,EAC9B,MAAM,8BAA8B,CAAC;AAItC,qBAAa,gCAAiC,YAAW,iCAAiC;IACtF,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAInB,IAAI,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;CAY7E"}

package/dist/app/modules/identity/repositories/provider/link.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IDENTITY_PROVIDER_ACCOUNT_LINK_TTL } from "../../../../../core/identity/provider/account/constants.mjs";
+import "../../../../../core/index.mjs";
+import { CacheIdentityPrefix } from "../constants.mjs";
+import { createNanoID } from "@authup/kit";
+import { buildCacheKey } from "@authup/server-kit";
+//#region src/app/modules/identity/repositories/provider/link.ts
+var IdentityProviderAccountLinkStore = class {
+	cache;
+	constructor(cache) {
+		this.cache = cache;
+	}
+	async save(data) {
+		const handle = createNanoID();
+		await this.cache.set(buildCacheKey({
+			prefix: CacheIdentityPrefix.PROVIDER_ACCOUNT_LINK,
+			key: handle
+		}), data, { ttl: IDENTITY_PROVIDER_ACCOUNT_LINK_TTL });
+		return handle;
+	}
+	async consume(handle) {
+		const key = buildCacheKey({
+			prefix: CacheIdentityPrefix.PROVIDER_ACCOUNT_LINK,
+			key: handle
+		});
+		return this.cache.pop(key);
+	}
+};
+//#endregion
+export { IdentityProviderAccountLinkStore };
+
+//# sourceMappingURL=link.mjs.map

package/dist/app/modules/identity/repositories/provider/link.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.mjs","names":["createNanoID","buildCacheKey","IDENTITY_PROVIDER_ACCOUNT_LINK_TTL","CacheIdentityPrefix","IdentityProviderAccountLinkStore","cache","save","data","handle","set","prefix","PROVIDER_ACCOUNT_LINK","key","ttl","consume","pop"],"sources":["../../../../../../src/app/modules/identity/repositories/provider/link.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type {\n    IIdentityProviderAccountLinkStore,\n    IdentityProviderAccountLink,\n} from '../../../../../core/index.ts';\nimport { IDENTITY_PROVIDER_ACCOUNT_LINK_TTL } from '../../../../../core/index.ts';\nimport { CacheIdentityPrefix } from '../constants.ts';\n\nexport class IdentityProviderAccountLinkStore implements IIdentityProviderAccountLinkStore {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    async save(data: IdentityProviderAccountLink): Promise<string> {\n        const handle = createNanoID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheIdentityPrefix.PROVIDER_ACCOUNT_LINK,\n                key: handle,\n            }),\n            data,\n            { ttl: IDENTITY_PROVIDER_ACCOUNT_LINK_TTL },\n        );\n\n        return handle;\n    }\n\n    async consume(handle: string): Promise<IdentityProviderAccountLink | null> {\n        const key = buildCacheKey({\n            prefix: CacheIdentityPrefix.PROVIDER_ACCOUNT_LINK,\n            key: handle,\n        });\n\n        // `pop` is the atomic read-and-drop (redis GETDEL, one tick on the\n        // memory adapter). A get followed by a drop is two round-trips, and\n        // two simultaneous redemptions of one handle would both read the\n        // payload before either drop landed.\n        return this.cache.pop<IdentityProviderAccountLink>(key);\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaI,mCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,KAAKC,MAAoD;EAC3D,MAAMC,SAASR,aAAAA;EAEf,MAAM,KAAKK,MAAMI,IACbR,cAAc;GACVS,QAAQP,oBAAoBQ;GAC5BC,KAAKJ;EACT,CAAA,GACAD,MACA,EAAEM,KAAKX,mCAAmC,CAAA;EAG9C,OAAOM;CACX;CAEA,MAAMM,QAAQN,QAA6D;EACvE,MAAMI,MAAMX,cAAc;GACtBS,QAAQP,oBAAoBQ;GAC5BC,KAAKJ;EACT,CAAA;EAMA,OAAO,KAAKH,MAAMU,IAAiCH,GAAAA;CACvD;AACJ"}

package/dist/app/modules/index.mjs

@@ -24,6 +24,7 @@ import { ClientRoleRepositoryAdapter } from "./database/repositories/client-role
 import { ClientScopeRepositoryAdapter } from "./database/repositories/client-scope/repository.mjs";
 import { EventRepositoryAdapter } from "./database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./database/repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./database/repositories/identity-provider-account/repository.mjs";
 import { KeyRepositoryAdapter } from "./database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./database/repositories/permission-policy/repository.mjs";
@@ -54,10 +55,11 @@ import { PromAuthFlowMetrics } from "./metrics/prom.mjs";
 import "./metrics/index.mjs";
 import { OAuth2InjectionToken } from "./oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./identity/constants.mjs";
-import { IdentityProviderAccountRepository } from "./identity/repositories/provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./identity/repositories/provider/mapper/role.mjs";
+import { CacheIdentityPrefix } from "./identity/repositories/constants.mjs";
+import { IdentityProviderAccountLinkStore } from "./identity/repositories/provider/link.mjs";
 import { ClientIdentityRepository } from "./identity/repositories/client.mjs";
 import { UserIdentityRepository } from "./identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./ldap/constants.mjs";
@@ -81,4 +83,4 @@ import { ProvisionerModule } from "./provisioning/module.mjs";
 import "./provisioning/index.mjs";
 import { RuntimeModule } from "./runtime/module.mjs";
 import "./runtime/index.mjs";
-export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+export { AuthenticationInjectionKey, AuthenticationModule, CacheIdentityPrefix, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountLinkStore, IdentityProviderAccountRepositoryAdapter, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/logger/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/logger/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/logger/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAwBpD"}

package/dist/app/modules/logger/module.mjs

@@ -15,6 +15,7 @@ var LoggerModule = class {
 		this.dependencies = [ModuleName.CONFIG];
 	}
 	async setup(container) {
+		if (container.has(LoggerInjectionKey)) return;
 		const result = container.tryResolve(ConfigInjectionKey);
 		if (!result.success || !result.data.logger) {
 			container.register(LoggerInjectionKey, { useFactory: createNoopLogger });

package/dist/app/modules/logger/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createLogger","createNoopLogger","ModuleName","ConfigInjectionKey","LoggerInjectionKey","LoggerModule","name","dependencies","LOGGER","CONFIG","setup","container","result","tryResolve","success","data","logger","register","useFactory","env","directory","writableDirectoryPath"],"sources":["../../../../src/app/modules/logger/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createLogger, createNoopLogger } from '@authup/server-kit';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { LoggerInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class LoggerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.LOGGER;\n        this.dependencies = [ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const result = container.tryResolve(ConfigInjectionKey);\n        if (!result.success || !result.data.logger) {\n            container.register(LoggerInjectionKey, { useFactory: createNoopLogger });\n\n            return;\n        }\n\n        container.register(LoggerInjectionKey, {\n            useFactory: () => createLogger({\n                env: result.data.env,\n                directory: result.data.writableDirectoryPath,\n            }),\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaK,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe,CAACL,WAAWO,MAAO;CAC3C;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,WAAWV,kBAAAA;EACpC,IAAI,CAACS,OAAOE,WAAW,CAACF,OAAOG,KAAKC,QAAQ;GACxCL,UAAUM,SAASb,oBAAoB,EAAEc,YAAYjB,iBAAiB,CAAA;GAEtE;EACJ;EAEAU,UAAUM,SAASb,oBAAoB,EACnCc,kBAAkBlB,aAAa;GAC3BmB,KAAKP,OAAOG,KAAKI;GACjBC,WAAWR,OAAOG,KAAKM;EAC3B,CAAA,EACJ,CAAA;CACJ;AAGJ"}
+{"version":3,"file":"module.mjs","names":["createLogger","createNoopLogger","ModuleName","ConfigInjectionKey","LoggerInjectionKey","LoggerModule","name","dependencies","LOGGER","CONFIG","setup","container","has","result","tryResolve","success","data","logger","register","useFactory","env","directory","writableDirectoryPath"],"sources":["../../../../src/app/modules/logger/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createLogger, createNoopLogger } from '@authup/server-kit';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { LoggerInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class LoggerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.LOGGER;\n        this.dependencies = [ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        // A pre-registered logger wins (test injection, mirroring the\n        // MailInjectionKey / UIHttpClient pattern), so a fake can capture\n        // what the server writes.\n        if (container.has(LoggerInjectionKey)) {\n            return;\n        }\n\n        const result = container.tryResolve(ConfigInjectionKey);\n        if (!result.success || !result.data.logger) {\n            container.register(LoggerInjectionKey, { useFactory: createNoopLogger });\n\n            return;\n        }\n\n        container.register(LoggerInjectionKey, {\n            useFactory: () => createLogger({\n                env: result.data.env,\n                directory: result.data.writableDirectoryPath,\n            }),\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaK,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe,CAACL,WAAWO,MAAO;CAC3C;CAEA,MAAMC,MAAMC,WAAsC;EAI9C,IAAIA,UAAUC,IAAIR,kBAAAA,GACd;EAGJ,MAAMS,SAASF,UAAUG,WAAWX,kBAAAA;EACpC,IAAI,CAACU,OAAOE,WAAW,CAACF,OAAOG,KAAKC,QAAQ;GACxCN,UAAUO,SAASd,oBAAoB,EAAEe,YAAYlB,iBAAiB,CAAA;GAEtE;EACJ;EAEAU,UAAUO,SAASd,oBAAoB,EACnCe,kBAAkBnB,aAAa;GAC3BoB,KAAKP,OAAOG,KAAKI;GACjBC,WAAWR,OAAOG,KAAKM;EAC3B,CAAA,EACJ,CAAA;CACJ;AAGJ"}

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts

@@ -1,5 +1,7 @@
 import type { SessionToken } from '@authup/core-kit';
-import type { DataSource, Repository } from 'typeorm';
+import type { IQuery } from '@rapiq/core';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';
 import { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';
 import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenRef } from '../../../../../core/index.ts';
 export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepository {
@@ -12,6 +14,28 @@ export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepos
     hasConsumedChild(parentId: string): Promise<boolean>;
     revokeById(id: string, at: string): Promise<void>;
     revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    /**
+     * Join the session and pin the columns authorization reads.
+     *
+     * A token row carries no realm or subject, so `SessionTokenService`
+     * resolves both through `session`. The join is unconditional and the three
+     * columns are selected regardless of the client's `fields` projection, so
+     * a projection cannot neutralize the gate the way a stripped `realmId`
+     * once could on the entity repositories (plan 039).
+     */
+    protected joinSessionForGate(qb: SelectQueryBuilder<SessionTokenEntity>): void;
+    /**
+     * Always expose only a client SUMMARY (id / name / displayName) on the
+     * read paths — the consent-list shape. `client` is deliberately absent
+     * from the schema's relations allow-list, so a raw `?include=client`
+     * cannot force the full-column join (redirect patterns, grant types,
+     * secret storage flags, accessPolicyId), while a self-service reader
+     * without CLIENT_READ still gets the application name per token row.
+     */
+    protected joinClientSummary(qb: SelectQueryBuilder<SessionTokenEntity>): void;
+    findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>>;
+    findOneWithSessionById(id: string): Promise<SessionToken | null>;
+    findAllByQuery(query: IQuery): Promise<SessionToken[]>;
     deleteExpired(before: string): Promise<number>;
 }
 //# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyB7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB5E,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAGvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IA0C7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsBlF;;;;;;;;OAQG;IACH,SAAS,CAAC,kBAAkB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAavE;;;;;;;OAOG;IACH,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAShE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAmB9E,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUhE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAUtD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs

@@ -3,6 +3,11 @@ import "node:url";
 import.meta.url;
 import { SessionTokenEntity } from "../../../../../adapters/database/domains/session-token/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
+import { SessionTokenRelationMissingError } from "../../../../../core/oauth2/session-token/error.mjs";
+import "../../../../../core/index.mjs";
+import { applyQuery, redactFieldConditions } from "../../../database/repositories/query.mjs";
+import { isForeignKeyConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
+import "../../../../../adapters/database/errors/index.mjs";
 import { In, LessThan } from "typeorm";
 //#region src/app/modules/oauth2/repositories/session-token/repository.ts
 var SessionTokenRepositoryAdapter = class {
@@ -14,6 +19,7 @@ var SessionTokenRepositoryAdapter = class {
 		const entity = this.repository.create({
 			id: input.id,
 			sessionId: input.sessionId,
+			clientId: input.clientId ?? null,
 			kind: input.kind,
 			parentId: input.parentId ?? null,
 			refreshTokenId: input.refreshTokenId ?? null,
@@ -23,7 +29,12 @@ var SessionTokenRepositoryAdapter = class {
 			revokedAt: null,
 			expiresAt: input.expiresAt
 		});
-		await this.repository.insert(entity);
+		try {
+			await this.repository.insert(entity);
+		} catch (e) {
+			if (isForeignKeyConstraintDatabaseError(e)) throw new SessionTokenRelationMissingError();
+			throw e;
+		}
 		entity.createdAt = entity.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
 		return entity;
 	}
@@ -56,6 +67,64 @@ var SessionTokenRepositoryAdapter = class {
 		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revokedAt: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revokedAt IS NULL").execute();
 		return refs;
 	}
+	/**
+	* Join the session and pin the columns authorization reads.
+	*
+	* A token row carries no realm or subject, so `SessionTokenService`
+	* resolves both through `session`. The join is unconditional and the three
+	* columns are selected regardless of the client's `fields` projection, so
+	* a projection cannot neutralize the gate the way a stripped `realmId`
+	* once could on the entity repositories (plan 039).
+	*/ joinSessionForGate(qb) {
+		if (!qb.expressionMap.joinAttributes.some((join) => join.alias.name === "session")) qb.leftJoin("sessionToken.session", "session");
+		qb.addSelect([
+			"session.id",
+			"session.sub",
+			"session.subKind",
+			"session.realmId"
+		]);
+	}
+	/**
+	* Always expose only a client SUMMARY (id / name / displayName) on the
+	* read paths — the consent-list shape. `client` is deliberately absent
+	* from the schema's relations allow-list, so a raw `?include=client`
+	* cannot force the full-column join (redirect patterns, grant types,
+	* secret storage flags, accessPolicyId), while a self-service reader
+	* without CLIENT_READ still gets the application name per token row.
+	*/ joinClientSummary(qb) {
+		qb.leftJoin("sessionToken.client", "client");
+		qb.addSelect([
+			"client.id",
+			"client.name",
+			"client.displayName"
+		]);
+	}
+	async findMany(query) {
+		const qb = this.repository.createQueryBuilder("sessionToken");
+		const { pagination } = applyQuery(qb, query);
+		this.joinSessionForGate(qb);
+		this.joinClientSummary(qb);
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: redactFieldConditions(query, entities),
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneWithSessionById(id) {
+		const qb = this.repository.createQueryBuilder("sessionToken").where("sessionToken.id = :id", { id });
+		this.joinSessionForGate(qb);
+		this.joinClientSummary(qb);
+		return qb.getOne();
+	}
+	async findAllByQuery(query) {
+		const qb = this.repository.createQueryBuilder("sessionToken");
+		applyQuery(qb, query);
+		this.joinSessionForGate(qb);
+		return qb.getMany();
+	}
 	async deleteExpired(before) {
 		return (await this.repository.delete({ expiresAt: LessThan(before) })).affected ?? 0;
 	}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,MAAMJ,MAAMI;GACZC,UAAUL,MAAMK,YAAY;GAC5BC,gBAAgBN,MAAMM,kBAAkB;GACxCC,WAAWP,MAAMO;GACjBC,WAAWR,MAAMQ;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWX,MAAMW;EACrB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,YAAYZ,OAAOY,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBhB,WAA4C;EAC9D,OAAO,KAAKP,WAAWwB,KAAK,EAAEF,OAAO,EAAEf,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMkB,oBAAoBnB,IAAYoB,IAA8B;EAUhE,SAAQC,MATa,KAAK3B,WAAW4B,mBAAkB,CAAA,CAClDC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,gBAAgB,EAAEvB,MAAM,UAAU,CAAA,CAAA,CAC3CuB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBzB,UAAoC;EAMvD,OAAO0B,MALa,KAAKnC,WAAW4B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEb,SAAS,CAAA,CAAA,CACtDsB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAW/B,IAAYoB,IAA2B;EACpD,MAAM,KAAK1B,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkB/B,WAAmBmB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKvC,WAAWwB,KAAK;GACpCF,OAAO,EAAEf,UAAU;GACnBiC,QAAQ;IAAElC,IAAI;IAAMS,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC2B,KAAKC,SAAS;GAC/CrC,IAAIqC,IAAIrC;GACRS,WAAW4B,IAAI5B;EACnB,EAAA;EACA,IAAI0B,KAAKG,SAAS,GACd,MAAM,KAAK5C,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAEhB,IAAIV,GAAG6C,KAAKC,KAAKG,QAAQA,IAAIvC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1CyB,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOpB,MAFc,KAAK3B,WAAWgD,OAAO,EAAEjC,WAAWlB,SAASkD,MAAAA,EAAQ,CAAA,EAAA,CAE5Dd,YAAY;CAC9B;AACJ"}
+{"version":3,"file":"repository.mjs","names":["In","LessThan","applyQuery","redactFieldConditions","SessionTokenEntity","isForeignKeyConstraintDatabaseError","SessionTokenRelationMissingError","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","clientId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","e","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","joinSessionForGate","qb","expressionMap","joinAttributes","some","join","alias","name","leftJoin","addSelect","joinClientSummary","findMany","query","pagination","entities","total","getManyAndCount","data","meta","findOneWithSessionById","getOne","findAllByQuery","getMany","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isForeignKeyConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport { SessionTokenRelationMissingError } from '../../../../../core/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            clientId: input.clientId ?? null,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        try {\n            await this.repository.insert(entity);\n        } catch (e) {\n            // A rejection means one of the two parents was deleted between the\n            // caller resolving it and this write: the session (a concurrent\n            // replay reaction, logout, force-logout or sweep) or the client the\n            // token is attributed to. Both cascade onto this table, so either\n            // way the token rows are already gone and the caller's answer is the\n            // same, which is why the error names neither. Report that condition\n            // instead of letting a driver error escape as an unhandled internal\n            // error (issue #3435).\n            if (isForeignKeyConstraintDatabaseError(e)) {\n                throw new SessionTokenRelationMissingError();\n            }\n\n            throw e;\n        }\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    /**\n     * Join the session and pin the columns authorization reads.\n     *\n     * A token row carries no realm or subject, so `SessionTokenService`\n     * resolves both through `session`. The join is unconditional and the three\n     * columns are selected regardless of the client's `fields` projection, so\n     * a projection cannot neutralize the gate the way a stripped `realmId`\n     * once could on the entity repositories (plan 039).\n     */\n    protected joinSessionForGate(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        if (!qb.expressionMap.joinAttributes.some((join) => join.alias.name === 'session')) {\n            qb.leftJoin('sessionToken.session', 'session');\n        }\n\n        qb.addSelect([\n            'session.id',\n            'session.sub',\n            'session.subKind',\n            'session.realmId',\n        ]);\n    }\n\n    /**\n     * Always expose only a client SUMMARY (id / name / displayName) on the\n     * read paths — the consent-list shape. `client` is deliberately absent\n     * from the schema's relations allow-list, so a raw `?include=client`\n     * cannot force the full-column join (redirect patterns, grant types,\n     * secret storage flags, accessPolicyId), while a self-service reader\n     * without CLIENT_READ still gets the application name per token row.\n     */\n    protected joinClientSummary(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        qb.leftJoin('sessionToken.client', 'client');\n        qb.addSelect([\n            'client.id',\n            'client.name',\n            'client.displayName',\n        ]);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        const { pagination } = applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneWithSessionById(id: string): Promise<SessionToken | null> {\n        const qb = this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.id = :id', { id });\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        return qb.getOne();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<SessionToken[]> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n\n        return qb.getMany();\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaO,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,kBAAAA;CAC/C;CAEA,MAAMO,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,UAAUJ,MAAMI,YAAY;GAC5BC,MAAML,MAAMK;GACZC,UAAUN,MAAMM,YAAY;GAC5BC,gBAAgBP,MAAMO,kBAAkB;GACxCC,WAAWR,MAAMQ;GACjBC,WAAWT,MAAMS;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWZ,MAAMY;EACrB,CAAA;EAEA,IAAI;GACA,MAAM,KAAKhB,WAAWiB,OAAOZ,MAAAA;EACjC,SAASa,GAAG;GASR,IAAIrB,oCAAoCqB,CAAAA,GACpC,MAAM,IAAIpB,iCAAAA;GAGd,MAAMoB;EACV;EAMAb,OAAOc,YAAYd,OAAOc,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOhB;CACX;CAEA,MAAMiB,YAAYhB,IAA0C;EACxD,OAAO,KAAKN,WAAWuB,QAAQ,EAAEC,OAAO,EAAElB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMmB,gBAAgBlB,WAA4C;EAC9D,OAAO,KAAKP,WAAW0B,KAAK,EAAEF,OAAO,EAAEjB,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMoB,oBAAoBrB,IAAYsB,IAA8B;EAUhE,SAAQC,MATa,KAAK7B,WAAW8B,mBAAkB,CAAA,CAClDC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAElB,YAAYc,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiB1B,UAAoC;EAMvD,OAAO2B,MALa,KAAKrC,WAAW8B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEd,SAAS,CAAA,CAAA,CACtDuB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYsB,IAA2B;EACpD,MAAM,KAAK5B,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkBjC,WAAmBqB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKzC,WAAW0B,KAAK;GACpCF,OAAO,EAAEjB,UAAU;GACnBmC,QAAQ;IAAEpC,IAAI;IAAMU,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC4B,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRU,WAAW6B,IAAI7B;EACnB,EAAA;EACA,IAAI2B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAElB,IAAId,GAAGmD,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C2B,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;;;;;;;;;IAWA,mBAA6BM,IAA4C;EACrE,IAAI,CAACA,GAAGC,cAAcC,eAAeC,MAAMC,SAASA,KAAKC,MAAMC,SAAS,SAAA,GACpEN,GAAGO,SAAS,wBAAwB,SAAA;EAGxCP,GAAGQ,UAAU;GACT;GACA;GACA;GACA;EACH,CAAA;CACL;;;;;;;;IAUA,kBAA4BR,IAA4C;EACpEA,GAAGO,SAAS,uBAAuB,QAAA;EACnCP,GAAGQ,UAAU;GACT;GACA;GACA;EACH,CAAA;CACL;CAEA,MAAME,SAASC,OAAsE;EACjF,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9C,MAAM,EAAE+B,eAAenE,WAAWuD,IAAIW,KAAAA;EAEtC,KAAKZ,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,MAAM,CAACa,UAAUC,SAAS,MAAMd,GAAGe,gBAAe;EAElD,OAAO;GACHC,MAAMtE,sBAAsBiE,OAAOE,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,uBAAuB7D,IAA0C;EACnE,MAAM2C,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA,CAAA,CACzCN,MAAM,yBAAyB,EAAElB,GAAG,CAAA;EAEzC,KAAK0C,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,OAAOA,GAAGmB,OAAM;CACpB;CAEA,MAAMC,eAAeT,OAAwC;EACzD,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9CpC,WAAWuD,IAAIW,KAAAA;EAEf,KAAKZ,mBAAmBC,EAAAA;EAExB,OAAOA,GAAGqB,QAAO;CACrB;CAEA,MAAMC,cAAcC,QAAiC;EAGjD,QAAO3C,MAFc,KAAK7B,WAAWyE,OAAO,EAAEzD,WAAWvB,SAAS+E,MAAAA,EAAQ,CAAA,EAAA,CAE5DrC,YAAY;CAC9B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+MjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAarC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAyNjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -56,6 +56,7 @@ import { DatabaseInjectionKey } from "../database/constants.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import "../database/index.mjs";
+import { OAuth2InjectionToken } from "../oauth2/constants.mjs";
 import { ProvisioningInjectionKey } from "./constants.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
@@ -169,8 +170,9 @@ var ProvisionerModule = class {
 			appOrigins: getAppOrigins(config),
 			logger: container.resolve(LoggerInjectionKey)
 		});
+		const keyStore = container.has(OAuth2InjectionToken.KeyStore) ? container.resolve(OAuth2InjectionToken.KeyStore) : new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null });
 		const keyProvisioner = new KeyProvisioner({
-			keyStore: new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null }),
+			keyStore,
 			logger: container.resolve(LoggerInjectionKey)
 		});
 		let wildcardProvisioner;

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","wildcardProvisioner","has","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n    WildcardRealmProvisioner,\n    expandWildcardRealmEntry,\n    extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        // ---------------------------------------------------------------\n        // Wildcard realm entry (plan 082): split the `name: \"*\"` entry out\n        // of `data.realms` and deep-merge it UNDER every explicit realm\n        // entry (explicit wins per attribute, relation lists union) so the\n        // graph sync below covers declared realms in one pass. Realms\n        // without an explicit entry get the wildcard applied by the\n        // backfill loop; runtime-created realms via the DI-registered\n        // provisioner (RealmService hook).\n        // ---------------------------------------------------------------\n        const wildcardEntry = extractWildcardRealmEntry(data);\n        let wildcardVariants : Map<string, RealmProvisioningRelations> | undefined;\n        if (wildcardEntry) {\n            wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm system clients (web, admin-console, account-console).\n        // Single provisioning mechanism: list every realm (incl.\n        // pre-existing) and upsert its clients.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const systemClientProvisioner = new SystemClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Wildcard realm provisioning (plan 082): one shared instance for\n        // the boot backfill below AND the runtime realm-create hook (the\n        // realm controller factory resolves the DI key lazily), so the two\n        // paths cannot drift. Registered only when a wildcard entry was\n        // declared.\n        let wildcardProvisioner : WildcardRealmProvisioner | undefined;\n        if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n        }\n        if (wildcardEntry) {\n            wildcardProvisioner = new WildcardRealmProvisioner({\n                relations: wildcardEntry.relations ?? {},\n                relationsByRealmName: wildcardVariants,\n                synchronizer: realmSynchronizer,\n                logger: container.resolve(LoggerInjectionKey),\n            });\n            container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n        }\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await systemClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n            // Realms with an explicit entry were already covered by the\n            // wildcard expansion inside the graph sync above.\n            if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n                await wildcardProvisioner.ensureForRealm(realm);\n            }\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAasD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAWlC,MAAMa,gBAAgBlD,0BAA0BgD,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBpD,yBAAyBmD,eAAeF,IAAAA;EAG/D,MAAMI,aAAaf,UAAUE,QAAQtB,qBAAqBoC,UAAU;EACpE,MAAMC,kBAAkBjB,UAAUE,QAA2B3D,WAAAA;EAE7D,MAAM2E,uBAAuB,IAAI/C,4BAA4B;GACzDgD,YAAYnB,UAAUE,QAAsC5D,gBAAAA;GAC5D2E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIhD,wBAAwB;GACjD+C,YAAY,IAAIpE,iBAAiBgE,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAInD,kCACnC8B,UAAUE,QAAsCpD,sBAAAA,CAAAA;EAGpD,MAAMwE,qBAAqB,IAAIlE,+BAA+B;GAC1D+D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIhD,sBAAsB;GAC7C4C,YAAYnB,UAAUE,QAA0B1D,UAAAA;GAChDyE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAI1D,wBAAwB;GACjDqD,YAAYnB,UAAUE,QAA4BhE,YAAAA;GAClD+E;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIjD,uBAAuB;GAC/C2C,YAAYnB,UAAUE,QAA2BxD,WAAAA;GACjDuE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAI1D,6BAC9BgC,UAAUE,QAAiC7D,iBAAAA,CAAAA;EAG/C,MAAMsF,yBAAyB,IAAIxE,mCAAmC;GAClEgE,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAItE,6BAA6B;GACtD6D,YAAYI;GACZL;GACAW,0BAA0B,IAAIvD,gCAC1B0B,UAAUE,QAAoCzD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMqF,qBAAqB,IAAI7E,+BAA+B;GAC1DuE;GACAO,sBAAsB,IAAIhE,4BACtBiC,UAAUE,QAAgC9D,gBAAAA,CAAAA;GAE9C4F,4BAA4B,IAAInE,kCAC5BmC,UAAUE,QAAsC/D,sBAAAA,CAAAA;GAEpDuF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIzE,6BAA6B;GACtD0E,gBAAgB,IAAIxD,sBAAsB;IACtCyC,YAAY,IAAInE,eAAe+D,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIxD,0BACpBqB,UAAUE,QAA8BtD,cAAAA,CAAAA;GAE5CwF,0BAA0B,IAAI3D,gCAC1BuB,UAAUE,QAAoCvD,oBAAAA,CAAAA;GAGlD6E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI9E,8BAA8B,EAAE4D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIjF,8BAA8B;GACxD8D,YAAY,IAAI9C,uBAAuB4C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBrF,8BAA8B;GACvDoE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAIrD,wBAAwB;GACxDoC;GACAC;GACAC;GACAgB,YAAYzD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMwD,iBAAiB,IAAItD,eAAe;GACtCuD,UAAU,IAAI3E,qBAAqB8C,YAAY,EAC3C8B,eAAe5C,OAAO6C,uBAClB,IAAI5D,gBAAgBe,OAAO6C,oBAAoB,IAC/C,KACR,CAAA;GACArC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAOA,IAAI4D;EACJ,IAAI/C,UAAUgD,IAAIpF,yBAAyBH,wBAAwB,GAC/DuC,UAAUiD,WAAWrF,yBAAyBH,wBAAwB;EAE1E,IAAIoD,eAAe;GACfkC,sBAAsB,IAAItF,yBAAyB;IAC/CyF,WAAWrC,cAAcqC,aAAa,CAAC;IACvCC,sBAAsBrC;IACtBsC,cAAcd;IACd7B,QAAQT,UAAUE,QAAQf,kBAAAA;GAC9B,CAAA;GACAa,UAAUqD,SAASzF,yBAAyBH,0BAA0B,EAAE6F,UAAUP,oBAAoB,CAAA;EAC1G;EAEA,MAAMQ,SAAS,MAAMtC,gBAAgBuC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMd,wBAAwBiB,eAAeD,KAAAA;GAC7C,MAAMd,eAAee,eAAeD,KAAAA;GAGpC,IAAIV,uBAAuB,CAACA,oBAAoBY,iBAAiBF,KAAAA,GAC7D,MAAMV,oBAAoBW,eAAeD,KAAAA;EAEjD;EAEA,IAAIxD,OAAO2D,oCACP,MAAM,KAAKC,oBAAoB9C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgByC,oBACZ9C,YACAK,kBACa;EACb,MAAM0C,gBAAgB,MAAM1C,iBAAiB2C,cAAclH,iBAAiBmH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBlD,WAAWmD,cAAc5H,gBAAAA;EAChD,MAAM6H,eAAepD,WAAWmD,cAAcpH,sBAAAA;EAE9C,MAAMsH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","OAuth2InjectionToken","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyStore","has","KeyStore","secretsCipher","secretsEncryptionKey","keyProvisioner","wildcardProvisioner","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n    WildcardRealmProvisioner,\n    expandWildcardRealmEntry,\n    extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport type { IKeyStore } from '../../../core/key/index.ts';\nimport { OAuth2InjectionToken } from '../oauth2/constants.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        // ---------------------------------------------------------------\n        // Wildcard realm entry (plan 082): split the `name: \"*\"` entry out\n        // of `data.realms` and deep-merge it UNDER every explicit realm\n        // entry (explicit wins per attribute, relation lists union) so the\n        // graph sync below covers declared realms in one pass. Realms\n        // without an explicit entry get the wildcard applied by the\n        // backfill loop; runtime-created realms via the DI-registered\n        // provisioner (RealmService hook).\n        // ---------------------------------------------------------------\n        const wildcardEntry = extractWildcardRealmEntry(data);\n        let wildcardVariants : Map<string, RealmProvisioningRelations> | undefined;\n        if (wildcardEntry) {\n            wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm system clients (web, admin-console, account-console).\n        // Single provisioning mechanism: list every realm (incl.\n        // pre-existing) and upsert its clients.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const systemClientProvisioner = new SystemClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use.\n        //\n        // The oauth2 module's registration is PREFERRED but optional, so\n        // provisioning stays runnable in minimal module graphs (test setup,\n        // CLI) where oauth2 never registered one; the locally constructed\n        // fallback handles the KEK identically. Sharing the instance when\n        // it exists matters because mint de-duplication is per adapter\n        // (see KeyRepositoryAdapter.mintExclusive): a second adapter has\n        // its own in-flight map, so this backfill and a concurrent\n        // realm-create request would each mint their own key.\n        const keyStore = container.has(OAuth2InjectionToken.KeyStore) ?\n            container.resolve<IKeyStore>(OAuth2InjectionToken.KeyStore) :\n            new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            });\n\n        const keyProvisioner = new KeyProvisioner({\n            keyStore,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Wildcard realm provisioning (plan 082): one shared instance for\n        // the boot backfill below AND the runtime realm-create hook (the\n        // realm controller factory resolves the DI key lazily), so the two\n        // paths cannot drift. Registered only when a wildcard entry was\n        // declared.\n        let wildcardProvisioner : WildcardRealmProvisioner | undefined;\n        if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n        }\n        if (wildcardEntry) {\n            wildcardProvisioner = new WildcardRealmProvisioner({\n                relations: wildcardEntry.relations ?? {},\n                relationsByRealmName: wildcardVariants,\n                synchronizer: realmSynchronizer,\n                logger: container.resolve(LoggerInjectionKey),\n            });\n            container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n        }\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await systemClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n            // Realms with an explicit entry were already covered by the\n            // wildcard expansion inside the graph sync above.\n            if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n                await wildcardProvisioner.ensureForRealm(realm);\n            }\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,IAAauD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOb,WAAWgB;EACvB,KAAKF,eAAe,CAACd,WAAWiB,QAAQjB,WAAWkB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQnB,kBAAAA;EACjC,MAAMoB,kBAAkBrB,KAAKsB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIxB,GAAGyB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMyB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAWlC,MAAMa,gBAAgBnD,0BAA0BiD,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBrD,yBAAyBoD,eAAeF,IAAAA;EAG/D,MAAMI,aAAaf,UAAUE,QAAQvB,qBAAqBqC,UAAU;EACpE,MAAMC,kBAAkBjB,UAAUE,QAA2B5D,WAAAA;EAE7D,MAAM4E,uBAAuB,IAAIhD,4BAA4B;GACzDiD,YAAYnB,UAAUE,QAAsC7D,gBAAAA;GAC5D4E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIjD,wBAAwB;GACjDgD,YAAY,IAAIrE,iBAAiBiE,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIpD,kCACnC+B,UAAUE,QAAsCrD,sBAAAA,CAAAA;EAGpD,MAAMyE,qBAAqB,IAAInE,+BAA+B;GAC1DgE,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIjD,sBAAsB;GAC7C6C,YAAYnB,UAAUE,QAA0B3D,UAAAA;GAChD0E;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAI3D,wBAAwB;GACjDsD,YAAYnB,UAAUE,QAA4BjE,YAAAA;GAClDgF;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIlD,uBAAuB;GAC/C4C,YAAYnB,UAAUE,QAA2BzD,WAAAA;GACjDwE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAI3D,6BAC9BiC,UAAUE,QAAiC9D,iBAAAA,CAAAA;EAG/C,MAAMuF,yBAAyB,IAAIzE,mCAAmC;GAClEiE,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIvE,6BAA6B;GACtD8D,YAAYI;GACZL;GACAW,0BAA0B,IAAIxD,gCAC1B2B,UAAUE,QAAoC1D,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMsF,qBAAqB,IAAI9E,+BAA+B;GAC1DwE;GACAO,sBAAsB,IAAIjE,4BACtBkC,UAAUE,QAAgC/D,gBAAAA,CAAAA;GAE9C6F,4BAA4B,IAAIpE,kCAC5BoC,UAAUE,QAAsChE,sBAAAA,CAAAA;GAEpDwF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI1E,6BAA6B;GACtD2E,gBAAgB,IAAIzD,sBAAsB;IACtC0C,YAAY,IAAIpE,eAAegE,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIzD,0BACpBsB,UAAUE,QAA8BvD,cAAAA,CAAAA;GAE5CyF,0BAA0B,IAAI5D,gCAC1BwB,UAAUE,QAAoCxD,oBAAAA,CAAAA;GAGlD8E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI/E,8BAA8B,EAAE6D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIlF,8BAA8B;GACxD+D,YAAY,IAAI/C,uBAAuB6C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBtF,8BAA8B;GACvDqE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAItD,wBAAwB;GACxDqC;GACAC;GACAC;GACAgB,YAAY1D,cAAciB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAcA,MAAMyD,WAAW3C,UAAU4C,IAAIvD,qBAAqBwD,QAAQ,IACxD7C,UAAUE,QAAmBb,qBAAqBwD,QAAQ,IAC1D,IAAI7E,qBAAqB+C,YAAY,EACjC+B,eAAe7C,OAAO8C,uBAClB,IAAI9D,gBAAgBgB,OAAO8C,oBAAoB,IAC/C,KACR,CAAA;EAEJ,MAAMC,iBAAiB,IAAI5D,eAAe;GACtCuD;GACAlC,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAOA,IAAI+D;EACJ,IAAIjD,UAAU4C,IAAIjF,yBAAyBH,wBAAwB,GAC/DwC,UAAUkD,WAAWvF,yBAAyBH,wBAAwB;EAE1E,IAAIqD,eAAe;GACfoC,sBAAsB,IAAIzF,yBAAyB;IAC/C2F,WAAWtC,cAAcsC,aAAa,CAAC;IACvCC,sBAAsBtC;IACtBuC,cAAcf;IACd7B,QAAQT,UAAUE,QAAQhB,kBAAAA;GAC9B,CAAA;GACAc,UAAUsD,SAAS3F,yBAAyBH,0BAA0B,EAAE+F,UAAUN,oBAAoB,CAAA;EAC1G;EAEA,MAAMO,SAAS,MAAMvC,gBAAgBwC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMf,wBAAwBkB,eAAeD,KAAAA;GAC7C,MAAMV,eAAeW,eAAeD,KAAAA;GAGpC,IAAIT,uBAAuB,CAACA,oBAAoBW,iBAAiBF,KAAAA,GAC7D,MAAMT,oBAAoBU,eAAeD,KAAAA;EAEjD;EAEA,IAAIzD,OAAO4D,oCACP,MAAM,KAAKC,oBAAoB/C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB0C,oBACZ/C,YACAK,kBACa;EACb,MAAM2C,gBAAgB,MAAM3C,iBAAiB4C,cAAcpH,iBAAiBqH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBnD,WAAWoD,cAAc9H,gBAAAA;EAChD,MAAM+H,eAAerD,WAAWoD,cAActH,sBAAAA;EAE9C,MAAMwH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAwEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAyEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -143,6 +143,7 @@ var DefaultProvisioningSource = class {
 					PermissionName.IDENTITY_PROVIDER_CREATE,
 					PermissionName.IDENTITY_PROVIDER_UPDATE,
 					PermissionName.IDENTITY_PROVIDER_DELETE,
+					PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,
 					PermissionName.KEY_CREATE,
 					PermissionName.KEY_UPDATE,
 					PermissionName.KEY_DELETE,

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C5C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM0C,yBAAyB,IAAI5E,uBAAAA;EAEnC,IAAI6E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXrE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAU6C,QAAQ,CAC1B;GACIhD,UAAU8C;GACVxE,YAAY;IACRC,MAAM;IACN0E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOrF,mBAAmB,OAAA;IAC1BsF,QAAQV,OAAOW;GACnB;GACAnD,WAAW,EAAEoD,aAAa,CAAC3F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM4F,2BAA2B,IAAIxF,yBAAAA;EAErC,IAAIyF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAmF,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAUwD,UAAU,CAC5B;GACI3D,UAAUyD;GACVnF,YAAY;IACRK,SAAS;IACTiF,YAAYpG,iBAAiBqG;IAC7BC,oBAAoBrG,yBAAyBsG;IAC7CxF,MAAM;IACNyF,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAhE,WAAW,EAAEoD,aAAa,CAAC3F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACgF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BkG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKpE,YAAW;GACxBqE,OAAO,KAAKpE,WAAU;GACtBqE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","IDENTITY_PROVIDER_ACCOUNT_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C7C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM2C,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAU8C,QAAQ,CAC1B;GACIjD,UAAU+C;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOtF,mBAAmB,OAAA;IAC1BuF,QAAQV,OAAOW;GACnB;GACApD,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM6F,2BAA2B,IAAIzF,yBAAAA;EAErC,IAAI0F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAUyD,UAAU,CAC5B;GACI5D,UAAU0D;GACVpF,YAAY;IACRK,SAAS;IACTkF,YAAYrG,iBAAiBsG;IAC7BC,oBAAoBtG,yBAAyBuG;IAC7CzF,MAAM;IACN0F,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAjE,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACiF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BmG,aAAa,KAAKhF,iBAAgB;GAClCiF,QAAQ,KAAKrE,YAAW;GACxBsE,OAAO,KAAKrE,WAAU;GACtBsE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/core/entities/client/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CAiCvB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CA2CvB,CAAC"}