@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

package/dist/core/entities/identity-provider-account/types.d.ts

@@ -0,0 +1,69 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DeepPartial } from 'typeorm';
+import type { IdentityProviderIdentity } from '../../identity/provider/types.ts';
+/**
+ * Filter keys an identity-provider-account list query may target.
+ */
+export declare const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS: readonly ["id", "userId", "providerId", "userRealmId", "providerUserId"];
+export type IdentityProviderAccountFindManyOptions = {
+    /**
+     * Force the result to a single user (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    userId?: string;
+    /**
+     * Restrict the result to a single owner realm (the nested
+     * `/realms/:realmId/identity-provider-accounts` mount). The owner
+     * realm of a row is `userRealmId`.
+     */
+    realmId?: string;
+};
+/**
+ * Unified port: the entity CRUD surface (management API) plus the
+ * account-manager methods the federated login and link flows consume.
+ * One adapter implements both concerns over the same table.
+ */
+export interface IIdentityProviderAccountRepository {
+    findMany(query: IQuery, options?: IdentityProviderAccountFindManyOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    findOneById(id: string): Promise<IdentityProviderAccount | null>;
+    remove(entity: IdentityProviderAccount): Promise<void>;
+    /**
+     * Atomically remove the account, refusing (returning `false`) when it
+     * is the user's LAST linked account and `userHasOtherLogin` is false —
+     * the unlink lockout guard. The count and the delete run in one
+     * transaction with the user's account rows locked (on drivers that
+     * support row locks), so two concurrent unlinks for the same user
+     * cannot both pass the guard and strand a password-less user with no
+     * login. Fires the entity subscriber like `remove`. Returns `true`
+     * when the row was removed.
+     */
+    removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean>;
+    /**
+     * Find identity account with user relation (federated login + link flow).
+     */
+    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
+    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
+}
+export type IdentityProviderAccountServiceReadOptions = {
+    realmId?: string;
+};
+export interface IIdentityProviderAccountService {
+    /**
+     * List linked accounts. An actor without
+     * `IDENTITY_PROVIDER_ACCOUNT_READ` is scoped to its own rows.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    /**
+     * Read a single linked account. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+    /**
+     * Unlink. Own rows need no permission. Refuses for EVERY caller when
+     * the row is the user's last linked account and the user has no
+     * password (lockout guard).
+     */
+    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/identity-provider-account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,qCAAqC,0EAMxC,CAAC;AAEX,MAAM,MAAM,sCAAsC,GAAG;IACjD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sCAAsC,GAAG,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE5I,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;OASG;IACH,aAAa,CAAC,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7F;;OAEG;IACH,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEvG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxF;AAED,MAAM,MAAM,yCAAyC,GAAG;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C;;;OAGG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,yCAAyC,GACpD,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEpE;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yCAAyC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE/H;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yCAAyC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAClI"}

package/dist/core/entities/identity-provider-account/types.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/identity-provider-account/types.ts
+/**
+* Filter keys an identity-provider-account list query may target.
+*/ const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS = [
+	"id",
+	"userId",
+	"providerId",
+	"userRealmId",
+	"providerUserId"
+];
+//#endregion
+export { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/entities/identity-provider-account/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS"],"sources":["../../../../src/core/entities/identity-provider-account/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DeepPartial } from 'typeorm';\nimport type { IdentityProviderIdentity } from '../../identity/provider/types.ts';\n\n/**\n * Filter keys an identity-provider-account list query may target.\n */\nexport const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS = [\n    'id',\n    'userId',\n    'providerId',\n    'userRealmId',\n    'providerUserId',\n] as const;\n\nexport type IdentityProviderAccountFindManyOptions = {\n    /**\n     * Force the result to a single user (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    userId?: string,\n    /**\n     * Restrict the result to a single owner realm (the nested\n     * `/realms/:realmId/identity-provider-accounts` mount). The owner\n     * realm of a row is `userRealmId`.\n     */\n    realmId?: string,\n};\n\n/**\n * Unified port: the entity CRUD surface (management API) plus the\n * account-manager methods the federated login and link flows consume.\n * One adapter implements both concerns over the same table.\n */\nexport interface IIdentityProviderAccountRepository {\n    findMany(query: IQuery, options?: IdentityProviderAccountFindManyOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;\n\n    findOneById(id: string): Promise<IdentityProviderAccount | null>;\n\n    remove(entity: IdentityProviderAccount): Promise<void>;\n\n    /**\n     * Atomically remove the account, refusing (returning `false`) when it\n     * is the user's LAST linked account and `userHasOtherLogin` is false —\n     * the unlink lockout guard. The count and the delete run in one\n     * transaction with the user's account rows locked (on drivers that\n     * support row locks), so two concurrent unlinks for the same user\n     * cannot both pass the guard and strand a password-less user with no\n     * login. Fires the entity subscriber like `remove`. Returns `true`\n     * when the row was removed.\n     */\n    removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean>;\n\n    /**\n     * Find identity account with user relation (federated login + link flow).\n     */\n    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;\n\n    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;\n}\n\nexport type IdentityProviderAccountServiceReadOptions = {\n    realmId?: string,\n};\n\nexport interface IIdentityProviderAccountService {\n    /**\n     * List linked accounts. An actor without\n     * `IDENTITY_PROVIDER_ACCOUNT_READ` is scoped to its own rows.\n     */\n    getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options?: IdentityProviderAccountServiceReadOptions\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;\n\n    /**\n     * Read a single linked account. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;\n\n    /**\n     * Unlink. Own rows need no permission. Refuses for EVERY caller when\n     * the row is the user's last linked account and the user has no\n     * password (lockout guard).\n     */\n    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;\n}\n"],"mappings":";;;;;;GAgBA,MAAaA,wCAAwC;CACjD;CACA;CACA;CACA;CACA;AACH"}

package/dist/core/entities/identity-provider-role-mapping/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,iCAAiC,gEAuB5C,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,iCAAiC,gEAgC5C,CAAC"}

package/dist/core/entities/identity-provider-role-mapping/schema.mjs

@@ -11,6 +11,15 @@ const schemaMapping = {
 };
 const identityProviderRoleMappingSchema = defineSchema({
 	name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,
+	indexes: [
+		["id"],
+		["providerId", "roleId"],
+		["roleId"],
+		["providerRealmId"],
+		["roleRealmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"name",
@@ -24,16 +33,28 @@ const identityProviderRoleMappingSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["roleId", "providerId"] },
+	filters: {
+		allowed: [
+			"roleId",
+			"providerId",
+			"id",
+			"providerRealmId",
+			"roleRealmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["role", "provider"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/identity-provider-role-mapping/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","provider","IDENTITY_PROVIDER","identityProviderRoleMappingSchema","name","IDENTITY_PROVIDER_ROLE_MAPPING","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderRoleMappingSchema = defineSchema<IdentityProviderRoleMapping>({\n    name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'valueIsRegex',\n            'synchronizationMode',\n            'providerId',\n            'providerRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'providerId'] },\n    relations: { allowed: ['role', 'provider'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,UAAUL,WAAWM;AAAkB;AAEtF,MAAaC,oCAAoCR,aAA0C;CACvFS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,YAAa,EAAC;CAC7CC,WAAW;EAAED,SAAS,CAAC,QAAQ,UAAW;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC7Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","provider","IDENTITY_PROVIDER","identityProviderRoleMappingSchema","name","IDENTITY_PROVIDER_ROLE_MAPPING","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderRoleMappingSchema = defineSchema<IdentityProviderRoleMapping>({\n    name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,\n    indexes: [\n        ['id'],\n        ['providerId', 'roleId'],\n        ['roleId'],\n        ['providerRealmId'],\n        ['roleRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'valueIsRegex',\n            'synchronizationMode',\n            'providerId',\n            'providerRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'providerId', 'id', 'providerRealmId', 'roleRealmId'], indexed: true },\n    relations: { allowed: ['role', 'provider'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,UAAUL,WAAWM;AAAkB;AAEtF,MAAaC,oCAAoCR,aAA0C;CACvFS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,cAAc,QAAS;EACxB,CAAC,QAAS;EACV,CAAC,iBAAkB;EACnB,CAAC,aAAc;EACf,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAU;GAAc;GAAM;GAAmB;EAAc;EAAEC,SAAS;CAAK;CACpGC,WAAW;EAAEF,SAAS,CAAC,QAAQ,UAAW;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC7FgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/index.d.ts

@@ -5,6 +5,7 @@ export * from './client-scope/index.ts';
 export * from './consent/index.ts';
 export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './identity-provider-account/index.ts';
 export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';
@@ -15,6 +16,7 @@ export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './scope/index.ts';
 export * from './session/index.ts';
+export * from './session-token/index.ts';
 export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';

package/dist/core/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/core/entities/index.mjs

@@ -11,6 +11,8 @@ import { clientScopeSchema } from "./client-scope/schema.mjs";
 import { consentSchema } from "./consent/schema.mjs";
 import { eventSchema } from "./event/schema.mjs";
 import { identityProviderSchema } from "./identity-provider/schema.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./identity-provider-account/types.mjs";
+import { identityProviderAccountSchema } from "./identity-provider-account/schema.mjs";
 import { identityProviderRoleMappingSchema } from "./identity-provider-role-mapping/schema.mjs";
 import { keySchema } from "./key/schema.mjs";
 import { permissionSchema } from "./permission/schema.mjs";
@@ -22,6 +24,7 @@ import { roleAttributeSchema } from "./role-attribute/schema.mjs";
 import { rolePermissionSchema } from "./role-permission/schema.mjs";
 import { scopeSchema } from "./scope/schema.mjs";
 import { sessionSchema } from "./session/schema.mjs";
+import { sessionTokenSchema } from "./session-token/schema.mjs";
 import { trustAnchorSchema } from "./trust-anchor/schema.mjs";
 import { userSchema } from "./user/schema.mjs";
 import { userAttributeSchema } from "./user-attribute/schema.mjs";
@@ -45,6 +48,9 @@ import { sanitizeEventData } from "./event/sanitize.mjs";
 import { EventService } from "./event/service.mjs";
 import "./event/index.mjs";
 import "./identity-provider/index.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError } from "./identity-provider-account/error.mjs";
+import { IdentityProviderAccountService } from "./identity-provider-account/service.mjs";
+import "./identity-provider-account/index.mjs";
 import { KeyService } from "./key/service.mjs";
 import "./key/index.mjs";
 import { PermissionService } from "./permission/service.mjs";
@@ -65,6 +71,8 @@ import { ScopeService } from "./scope/service.mjs";
 import "./scope/index.mjs";
 import { SessionService } from "./session/service.mjs";
 import "./session/index.mjs";
+import { SESSION_TOKEN_FILTER_KEYS, SessionTokenService } from "./session-token/service.mjs";
+import "./session-token/index.mjs";
 import { TrustAnchorService } from "./trust-anchor/service.mjs";
 import "./trust-anchor/index.mjs";
 import { UserService } from "./user/service.mjs";
@@ -83,4 +91,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeService, SessionService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, buildEntityDiff, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };
+export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, SESSION_TOKEN_FILTER_KEYS, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeService, SessionService, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, buildEntityDiff, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountUnlinkBlockedError, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, sessionTokenSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };

package/dist/core/entities/key/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAM5C,eAAO,MAAM,SAAS,wCAyCpB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAM5C,eAAO,MAAM,SAAS,wCAuDpB,CAAC"}

package/dist/core/entities/key/schema.mjs

@@ -8,6 +8,21 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const keySchema = defineSchema({
 	name: EntityType.KEY,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["type"],
+		["use"],
+		["status"],
+		["realmId"],
+		[
+			"priority",
+			"realmId",
+			"type"
+		],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: {
 		default: [
 			"id",
@@ -23,27 +38,34 @@ const keySchema = defineSchema({
 		],
 		allowed: ["encryptionKey", "certificate"]
 	},
-	filters: { allowed: [
-		"id",
-		"name",
-		"type",
-		"use",
-		"status",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"type",
+			"use",
+			"status",
+			"realmId",
+			"priority"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"priority",
-		"use",
-		"status",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"priority",
+			"use",
+			"status",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/key/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","keySchema","name","KEY","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/key/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const keySchema = defineSchema<Key>({\n    name: EntityType.KEY,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'type',\n            'use',\n            'priority',\n            'status',\n            'signatureAlgorithm',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n        allowed: ['encryptionKey', 'certificate'],\n    },\n    filters: {\n        allowed: [\n            'id',\n            'name',\n            'type',\n            'use',\n            'status',\n            'realmId',\n        ], \n    },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'priority',\n            'use',\n            'status',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,YAAYN,aAAkB;CACvCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,iBAAiB,aAAc;CAC7C;CACAC,SAAS,EACLD,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EACFJ,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","keySchema","name","KEY","indexes","fields","default","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/key/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const keySchema = defineSchema<Key>({\n    name: EntityType.KEY,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['type'],\n        ['use'],\n        ['status'],\n        ['realmId'],\n        ['priority', 'realmId', 'type'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'name',\n            'type',\n            'use',\n            'priority',\n            'status',\n            'signatureAlgorithm',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n        allowed: ['encryptionKey', 'certificate'],\n    },\n    filters: {\n        allowed: [\n            'id',\n            'name',\n            'type',\n            'use',\n            'status',\n            'realmId',\n            'priority',\n        ],\n        indexed: true,\n    },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: {\n        allowed: [\n            'id',\n            'name',\n            'priority',\n            'use',\n            'status',\n            'createdAt',\n            'updatedAt',\n        ],\n        indexed: true,\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,YAAYN,aAAkB;CACvCO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,MAAO;EACR,CAAC,KAAM;EACP,CAAC,QAAS;EACV,CAAC,SAAU;EACX;GAAC;GAAY;GAAW;EAAO;EAC/B,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,iBAAiB,aAAc;CAC7C;CACAC,SAAS;EACLD,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDE,SAAS;CACb;CACAC,WAAW;EAAEH,SAAS,CAAC,OAAQ;EAAEI,UAAUd,wBAAwBC,aAAAA;CAAe;CAClFc,OAAO;EACHL,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDE,SAAS;CACb;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/key/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/service.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAEH,SAAS,EAGT,YAAY,EAEf,MAAM,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAA0C,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EACR,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,iBAAiB,GAAG;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,UAAW,SAAQ,qBAAsB,YAAW,WAAW;IACxE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC;IAErC,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC;IAElC,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,iBAAiB;IAQ5B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,qBAA0B,GACpC,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IA6DzC,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAsBT,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,GAAG,CAAC;IA6FT,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IA2CT,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,GAAG,CAAC;IA0Cf;;;;;OAKG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,GAAG,EACX,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA2BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;cAQ3C,gBAAgB,CAC5B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EACvB,GAAG,EAAE,GAAG,MAAM,EAAE,GAChB,OAAO,CAAC;QACR,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACnB,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;cA8Bc,cAAc,CAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EACvB,GAAG,EAAE,GAAG,MAAM,EAAE,GAChB,OAAO,CAAC;QACR,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACnB,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IA2FF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,GAAG,YAAY,EAAE;;;;;;;;;IAQ7D,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAI,MAAM;CAUtD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/service.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAEH,SAAS,EAGT,YAAY,EAEf,MAAM,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAA0C,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EACR,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,iBAAiB,GAAG;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,UAAW,SAAQ,qBAAsB,YAAW,WAAW;IACxE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC;IAErC,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC;IAElC,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,iBAAiB;IAQ5B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,qBAA0B,GACpC,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IA6DzC,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAsBT,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,GAAG,CAAC;IA6FT,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IA2CT,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,GAAG,CAAC;IA0Cf;;;;;OAKG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,GAAG,EACX,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA4BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;cAQ3C,gBAAgB,CAC5B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EACvB,GAAG,EAAE,GAAG,MAAM,EAAE,GAChB,OAAO,CAAC;QACR,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACnB,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;cA8Bc,cAAc,CAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EACvB,GAAG,EAAE,GAAG,MAAM,EAAE,GAChB,OAAO,CAAC;QACR,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACnB,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IA2FF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,GAAG,YAAY,EAAE;;;;;;;;;IAQ7D,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAI,MAAM;CAUtD"}

package/dist/core/entities/key/service.mjs

@@ -208,6 +208,7 @@ var KeyService = class extends AbstractEntityService {
 			actorType: actor.identity?.type ?? null,
 			actorId: actor.identity?.data.id ?? null,
 			actorName: actor.identity?.data.name ?? null,
+			sessionId: requestContext?.sessionId ?? null,
 			requestPath: requestContext?.requestPath ?? null,
 			requestMethod: requestContext?.requestMethod ?? null,
 			requestIpAddress: requestContext?.requestIpAddress ?? null,

package/dist/core/entities/key/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityConflictError","EntityNotFoundError","ValidationError","isError","isRawError","EntityType","EventName","EventScope","KeyStatus","KeyValidator","PermissionName","ValidatorGroup","arrayBufferToBase64","base64ToArrayBuffer","createNanoID","AbstractEntityService","AsymmetricKey","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","getRandomValues","buildEntityDiff","assertCertificateMatchesKey","isWrappedKeyMaterial","parseCertificateChain","appendQueryConditions","decodeQuery","keySchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","KeyService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","entity","decryptionKey","total","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","use","validateJoinColumns","identity","actorRealmId","getActorRealmId","evaluate","checkUniqueness","priority","highest","findHighestPriority","status","ACTIVE","certificate","SIGNATURE","material","importMaterial","generateMaterial","encryptionKey","chain","e","message","type","signatureAlgorithm","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","ENCRYPTION","force","references","countBlobReferences","entityId","remove","forcedCryptoShred","DELETED","undefined","record","scope","ENTITY","refType","KEY","refId","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","raw","Uint8Array","OCT","buffer","algorithm","RS256","buildAsymmetricOptions","keyPair","startsWith","EC","RSA","privateKey","toBase64","publicKey","trim","normalizeMaterial","byteLength","privateJwk","publicJwk","fromBase64","format","key","toJWK","components","mismatch","some","component","test","buildImportOptionsForJWTAlgorithm","value","includes","replace"],"sources":["../../../../src/core/entities/key/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport {\n    EntityConflictError,\n    EntityNotFoundError,\n    ValidationError,\n    isError as isRawError,\n} from '@authup/errors';\nimport type { Key } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    KeyStatus,\n    KeyValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport {\n    ValidatorGroup,\n    arrayBufferToBase64,\n    base64ToArrayBuffer,\n    createNanoID,\n} from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService, AsymmetricKey, createAsymmetricKeyPair } from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport { getRandomValues } from 'uncrypto';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { assertCertificateMatchesKey, isWrappedKeyMaterial, parseCertificateChain } from '../../key/index.ts';\nimport type {\n    IKeyRepository, \n    IKeyService, \n    KeyDeleteOptions, \n    KeyServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { keySchema } from './schema.ts';\n\nexport type KeyServiceContext = {\n    repository: IKeyRepository;\n    eventService?: IEventService;\n    requestContext?: () => EventRequestContext | undefined;\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class KeyService extends AbstractEntityService implements IKeyService {\n    protected repository: IKeyRepository;\n\n    protected validator: KeyValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: KeyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new KeyValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: KeyServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Key>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        let parsed = await decodeQuery(query, { schema: keySchema, actor });\n        if (options.realmId) {\n            parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n        }\n\n        // Compile the read permissions against the knowns (actor identity) into a\n        // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n        // pagination and totals stay exact. Non-expressible policies fall back to\n        // the per-row post-evaluation below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        if (compiled.verdict !== 'post') {\n            for (const entity of entities) {\n                // Belt-and-braces: the read projection never selects private\n                // material, but null it explicitly so no future adapter change\n                // can leak it onto a read surface (cf. authentik CVE-2024-42490).\n                entity.decryptionKey = null;\n            }\n\n            return { data: entities, meta };\n        }\n\n        const data: Key[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                entity.decryptionKey = null;\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        // Belt-and-braces null of private material (see getMany).\n        entity.decryptionKey = null;\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n        const { use } = validated;\n        if (!use) {\n            throw new ValidationError('A key use must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (!validated.realmId && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        // keys are realm-bound infrastructure — no global (null realm) keys\n        // via the API.\n        if (!validated.realmId) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        if (!validated.name) {\n            validated.name = `${use}-${createNanoID(10)}`;\n        }\n\n        await this.repository.checkUniqueness(validated);\n\n        if (typeof validated.priority !== 'number') {\n            const highest = await this.repository.findHighestPriority(validated.realmId, use);\n            // generate doubles as rotate: a new key outranks the current one.\n            validated.priority = typeof highest === 'number' ? highest + 1 : 0;\n        }\n\n        if (!validated.status) {\n            validated.status = KeyStatus.ACTIVE;\n        }\n\n        const certificate = typeof validated.certificate === 'string' ? validated.certificate : null;\n        if (certificate && (!validated.decryptionKey || use !== JWKUse.SIGNATURE)) {\n            throw new ValidationError('A certificate requires imported signature key material.');\n        }\n\n        const material = validated.decryptionKey ?\n            await this.importMaterial(validated, use) :\n            await this.generateMaterial(validated, use);\n\n        if (certificate) {\n            if (!material.encryptionKey) {\n                throw new ValidationError('A certificate requires imported signature key material.');\n            }\n\n            try {\n                const chain = parseCertificateChain(certificate);\n                assertCertificateMatchesKey(chain, material.encryptionKey);\n            } catch (e) {\n                throw new ValidationError(\n                    isRawError(e) ?\n                        e.message :\n                        'The certificate could not be matched against the imported key material.',\n                );\n            }\n        }\n\n        let entity = this.repository.create({\n            ...validated,\n            type: material.type,\n            signatureAlgorithm: material.signatureAlgorithm,\n            decryptionKey: material.decryptionKey,\n            encryptionKey: material.encryptionKey,\n        });\n\n        entity = await this.repository.save(entity);\n\n        // private material never leaves the server — the response carries\n        // metadata + public part only (authentik CVE-2024-42490).\n        entity.decryptionKey = null;\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // only name / priority / status are mounted for UPDATE — material,\n        // use, type and realm are immutable.\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realmId: entity.realmId,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        await this.repository.save(entity);\n\n        entity.decryptionKey = null;\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n        options: KeyDeleteOptions = {},\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (entity.use === JWKUse.ENCRYPTION && !options.force) {\n            const references = await this.repository.countBlobReferences(entity.id);\n            if (references > 0) {\n                throw new EntityConflictError({\n                    message: `The encryption key is still referenced by ${references} encrypted secret(s) — ` +\n                        'deleting it makes them unrecoverable. Repeat with force to crypto-shred them.',\n                    data: { references },\n                });\n            }\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n        entity.decryptionKey = null;\n\n        // force only carries crypto-shred semantics for encryption keys — a\n        // sig-key delete with a stray force flag must not read as a shred.\n        const forcedCryptoShred = entity.use === JWKUse.ENCRYPTION && !!options.force;\n        await this.recordEvent(EventName.DELETED, entity, actor, { ...(forcedCryptoShred ? { force: true } : {}) });\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for key lifecycle operations (issue #3269) —\n     * keys deliberately have no entity subscriber (private material must stay\n     * off the realtime/audit bus), so the security-relevant mutations are\n     * recorded explicitly. The payload never carries key material.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: Key,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.KEY,\n            refId: entity.id,\n            realmId: entity.realmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                use: entity.use,\n                status: entity.status,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: Key): Record<string, any> {\n        return {\n            name: entity.name,\n            priority: entity.priority,\n            status: entity.status,\n        };\n    }\n\n    protected async generateMaterial(\n        validated: Partial<Key>,\n        use: `${JWKUse}`,\n    ) : Promise<{\n        type: `${JWKType}`,\n        signatureAlgorithm: `${JWTAlgorithm}` | null,\n        decryptionKey: string,\n        encryptionKey: string | null,\n    }> {\n        if (use === JWKUse.ENCRYPTION) {\n            if (validated.signatureAlgorithm) {\n                throw new ValidationError('An encryption key can not carry a signature algorithm.');\n            }\n\n            const raw = new Uint8Array(32);\n            getRandomValues(raw);\n\n            return {\n                type: JWKType.OCT,\n                signatureAlgorithm: null,\n                decryptionKey: arrayBufferToBase64(raw.buffer),\n                encryptionKey: null,\n            };\n        }\n\n        const algorithm = validated.signatureAlgorithm ?? JWTAlgorithm.RS256;\n        const options = this.buildAsymmetricOptions(algorithm);\n\n        const keyPair = await createAsymmetricKeyPair(options);\n\n        return {\n            type: algorithm.startsWith('ES') ? JWKType.EC : JWKType.RSA,\n            signatureAlgorithm: algorithm,\n            decryptionKey: await new AsymmetricKey(keyPair.privateKey).toBase64(),\n            encryptionKey: await new AsymmetricKey(keyPair.publicKey).toBase64(),\n        };\n    }\n\n    protected async importMaterial(\n        validated: Partial<Key>,\n        use: `${JWKUse}`,\n    ) : Promise<{\n        type: `${JWKType}`,\n        signatureAlgorithm: `${JWTAlgorithm}` | null,\n        decryptionKey: string,\n        encryptionKey: string | null,\n    }> {\n        if (!validated.decryptionKey) {\n            throw new ValidationError('Importing key material requires its private part (decryptionKey).');\n        }\n\n        // Reject material masquerading as an at-rest KEK-wrapped blob — it\n        // would be treated as wrapped on the next read (and, with a KEK,\n        // fail GCM authentication).\n        if (isWrappedKeyMaterial(validated.decryptionKey.trim())) {\n            throw new ValidationError('The imported key material is not valid.');\n        }\n\n        const decryptionKey = this.normalizeMaterial(validated.decryptionKey);\n\n        if (use === JWKUse.ENCRYPTION) {\n            if (validated.signatureAlgorithm) {\n                throw new ValidationError('An encryption key can not carry a signature algorithm.');\n            }\n\n            if (validated.encryptionKey) {\n                throw new ValidationError('An encryption key holds no public part.');\n            }\n\n            let byteLength : number;\n            try {\n                byteLength = base64ToArrayBuffer(decryptionKey).byteLength;\n            } catch {\n                throw new ValidationError('The key material is not valid base64.');\n            }\n\n            if (byteLength !== 32) {\n                throw new ValidationError('The key material must be 32 base64-encoded bytes.');\n            }\n\n            return {\n                type: JWKType.OCT,\n                signatureAlgorithm: null,\n                decryptionKey,\n                encryptionKey: null,\n            };\n        }\n\n        if (!validated.encryptionKey) {\n            throw new ValidationError('Importing a signature key requires its public part (encryptionKey, SPKI).');\n        }\n\n        const encryptionKey = this.normalizeMaterial(validated.encryptionKey);\n        const algorithm = validated.signatureAlgorithm ?? JWTAlgorithm.RS256;\n        const options = this.buildAsymmetricOptions(algorithm);\n\n        let privateJwk : JsonWebKey;\n        let publicJwk : JsonWebKey;\n\n        try {\n            const privateKey = await AsymmetricKey.fromBase64({\n                format: 'pkcs8',\n                key: decryptionKey,\n                options,\n            });\n            const publicKey = await AsymmetricKey.fromBase64({\n                format: 'spki',\n                key: encryptionKey,\n                options,\n            });\n\n            privateJwk = await privateKey.toJWK();\n            publicJwk = await publicKey.toJWK();\n        } catch {\n            throw new ValidationError(`The key material could not be imported for ${algorithm}.`);\n        }\n\n        // the public components (RSA: n/e, EC: crv/x/y) must agree — a\n        // private key paired with a foreign public part would publish a\n        // wrong JWKS entry and break verification of every token it signs.\n        const components : (keyof JsonWebKey)[] = ['kty', 'n', 'e', 'crv', 'x', 'y'];\n        const mismatch = components.some(\n            (component) => publicJwk[component] !== undefined &&\n                publicJwk[component] !== privateJwk[component],\n        );\n        if (mismatch) {\n            throw new ValidationError('The private and public key material do not form a pair.');\n        }\n\n        return {\n            type: algorithm.startsWith('ES') ? JWKType.EC : JWKType.RSA,\n            signatureAlgorithm: algorithm,\n            decryptionKey,\n            encryptionKey,\n        };\n    }\n\n    protected buildAsymmetricOptions(algorithm: `${JWTAlgorithm}`) {\n        if (!/^(RS|ES)(256|384|512)$/.test(algorithm)) {\n            throw new ValidationError(`The signature algorithm ${algorithm} is not supported for stored keys.`);\n        }\n\n        return AsymmetricKey.buildImportOptionsForJWTAlgorithm(algorithm);\n    }\n\n    protected normalizeMaterial(value: string) : string {\n        if (value.includes('-----BEGIN')) {\n            // PEM body IS base64 DER — strip armor + whitespace.\n            return value\n                .replace(/-----(BEGIN|END)[^-]+-----/g, '')\n                .replace(/\\s+/g, '');\n        }\n\n        return value.trim();\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoDA,MAAMiC,mBAAmB;CACrBnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;AAClB;AAED,IAAaC,aAAb,cAAgClB,sBAAAA;CAClBmB;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwB;EAChC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAI1B,aAAAA;EACrB,KAAK2B,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAiC,CAAC,GACU;EAC5C,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAWa;EAAM,CAAA;EACjE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQhD,GAAG,WAAW4C,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQ/C,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAIkD,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QAAQ;GAC7B,KAAK,MAAMM,UAAUH,UAIjBG,OAAOC,gBAAgB;GAG3B,OAAO;IAAEL,MAAMC;IAAUC;GAAK;EAClC;EAEA,MAAMF,OAAc,CAAA;EACpB,IAAI,EAAEM,UAAUJ;EAEhB,KAAK,MAAME,UAAUH,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBiB,cAAc;IAC1Cf,MAAMhB;IACNwB,MAAMxD,iBAAiB;MAClBD,kBAAkBiE,aAAaJ;KAChC,GAAG,KAAKK,mBAAmBL,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAA,OAAOC,gBAAgB;GACvBL,KAAKU,KAAKN,MAAAA;EACd,QAAQ;GACJE,SAAS;EACb;EAGJ,OAAO;GACHN;GACAE,MAAM;IACF,GAAGA;IACHI;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,UACAxB,OACAO,SACY;EACZ,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM4B,SAAS,MAAM,KAAKvB,WAAWgC,kBAAkBD,UAAUjB,OAAAA;EACjE,IAAI,CAACS,QACD,MAAM,IAAIxD,oBAAAA;EAGd,MAAMwC,MAAME,oBAAoBiB,cAAc;GAC1Cf,MAAMhB;GACNwB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAaJ;IAChC,GAAG,KAAKK,mBAAmBL,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAGAA,OAAOC,gBAAgB;EAEvB,OAAOD;CACX;CAEA,MAAMU,OACFd,MACAZ,OACY;EACZ,MAAMA,MAAME,oBAAoByB,YAAY,EAAEvB,MAAMnC,eAAe2D,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEmB,OAAO7D,eAAe8D,OAAO,CAAA;EAChF,MAAM,EAAEC,QAAQJ;EAChB,IAAI,CAACI,KACD,MAAM,IAAIxE,gBAAgB,8BAAA;EAG9B,MAAM,KAAKgC,WAAWyC,oBAAoBL,SAAAA;EAE1C,IAAI,CAACA,UAAUtB,WAAWP,MAAMmC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBrC,KAAAA;GAC1C,IAAIoC,cACAP,UAAUtB,UAAU6B;EAE5B;EAIA,IAAI,CAACP,UAAUtB,SACX,MAAM,IAAI9C,gBAAgB,4BAAA;EAG9B,MAAMuC,MAAME,oBAAoBoC,SAAS;GACrClC,MAAMnC,eAAe2D;GACrBhB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAI,CAACA,UAAUzB,MACXyB,UAAUzB,OAAO,GAAG6B,IAAI,GAAG5D,aAAa,EAAA;EAG5C,MAAM,KAAKoB,WAAW8C,gBAAgBV,SAAAA;EAEtC,IAAI,OAAOA,UAAUW,aAAa,UAAU;GACxC,MAAMC,UAAU,MAAM,KAAKhD,WAAWiD,oBAAoBb,UAAUtB,SAAS0B,GAAAA;GAE7EJ,UAAUW,WAAW,OAAOC,YAAY,WAAWA,UAAU,IAAI;EACrE;EAEA,IAAI,CAACZ,UAAUc,QACXd,UAAUc,SAAS5E,UAAU6E;EAGjC,MAAMC,cAAc,OAAOhB,UAAUgB,gBAAgB,WAAWhB,UAAUgB,cAAc;EACxF,IAAIA,gBAAgB,CAAChB,UAAUZ,iBAAiBgB,QAAQvD,OAAOoE,YAC3D,MAAM,IAAIrF,gBAAgB,yDAAA;EAG9B,MAAMsF,WAAWlB,UAAUZ,gBACvB,MAAM,KAAK+B,eAAenB,WAAWI,GAAAA,IACrC,MAAM,KAAKgB,iBAAiBpB,WAAWI,GAAAA;EAE3C,IAAIY,aAAa;GACb,IAAI,CAACE,SAASG,eACV,MAAM,IAAIzF,gBAAgB,yDAAA;GAG9B,IAAI;IACA,MAAM0F,QAAQnE,sBAAsB6D,WAAAA;IACpC/D,4BAA4BqE,OAAOJ,SAASG,aAAa;GAC7D,SAASE,GAAG;IACR,MAAM,IAAI3F,gBACNE,QAAWyF,CAAAA,IACPA,EAAEC,UACF,yEAAA;GAEZ;EACJ;EAEA,IAAIrC,SAAS,KAAKvB,WAAWiC,OAAO;GAChC,GAAGG;GACHyB,MAAMP,SAASO;GACfC,oBAAoBR,SAASQ;GAC7BtC,eAAe8B,SAAS9B;GACxBiC,eAAeH,SAASG;EAC5B,CAAA;EAEAlC,SAAS,MAAM,KAAKvB,WAAW+D,KAAKxC,MAAAA;EAIpCA,OAAOC,gBAAgB;EAEvB,MAAM,KAAKwC,YAAY5F,UAAU6F,SAAS1C,QAAQhB,KAAAA;EAElD,OAAOgB;CACX;CAEA,MAAM2C,OACFnC,UACAZ,MACAZ,OACAO,SACY;EACZ,MAAMP,MAAME,oBAAoByB,YAAY,EAAEvB,MAAMnC,eAAeqB,WAAW,CAAA;EAE9E,IAAI0B,SAAS,MAAM,KAAKvB,WAAWgC,kBAAkBD,UAAUjB,OAAAA;EAC/D,IAAI,CAACS,QACD,MAAM,IAAIxD,oBAAAA;EAKd,MAAMqE,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEmB,OAAO7D,eAAe0F,OAAO,CAAA;EAEhF,MAAM5D,MAAME,oBAAoBoC,SAAS;GACrClC,MAAMnC,eAAeqB;GACrBsB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAa;KAC5B,GAAGJ;KACH,GAAGa;IACP;IACA,GAAG,KAAKR,mBAAmBL,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIa,UAAUzB,QAAQyB,UAAUzB,SAASY,OAAOZ,MAC5C,MAAM,KAAKX,WAAW8C,gBAAgB;GAClCnC,MAAMyB,UAAUzB;GAChBG,SAASS,OAAOT;EACpB,GAAGS,MAAAA;EAGP,MAAM6C,WAAW,KAAKC,gBAAgB9C,MAAAA;EAEtCA,SAAS,KAAKvB,WAAWsE,MAAM/C,QAAQa,SAAAA;EACvC,MAAM,KAAKpC,WAAW+D,KAAKxC,MAAAA;EAE3BA,OAAOC,gBAAgB;EAEvB,MAAM+C,OAAOnF,gBAAgB,KAAKiF,gBAAgB9C,MAAAA,GAAS6C,QAAAA;EAC3D,MAAM,KAAKJ,YAAY5F,UAAUoG,SAASjD,QAAQhB,OAAO,EAAE,GAAIkE,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOhD;CACX;CAEA,MAAMqD,OACFC,IACAtE,OACAC,UAA4B,CAAC,GACjB;EACZ,MAAMD,MAAME,oBAAoByB,YAAY,EAAEvB,MAAMnC,eAAesB,WAAW,CAAA;EAE9E,MAAMyB,SAAS,MAAM,KAAKvB,WAAW8E,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACtD,QACD,MAAM,IAAIxD,oBAAAA;EAGd,MAAMwC,MAAME,oBAAoBoC,SAAS;GACrClC,MAAMnC,eAAesB;GACrBqB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAaJ;IAChC,GAAG,KAAKK,mBAAmBL,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIA,OAAOiB,QAAQvD,OAAO8F,cAAc,CAACvE,QAAQwE,OAAO;GACpD,MAAMC,aAAa,MAAM,KAAKjF,WAAWkF,oBAAoB3D,OAAOsD,EAAE;GACtE,IAAII,aAAa,GACb,MAAM,IAAInH,oBAAoB;IAC1B8F,SAAS,6CAA6CqB,WAAW;IAEjE9D,MAAM,EAAE8D,WAAW;GACvB,CAAA;EAER;EAEA,MAAM,EAAEJ,IAAIM,aAAa5D;EACzB,MAAM,KAAKvB,WAAWoF,OAAO7D,MAAAA;EAC7BA,OAAOsD,KAAKM;EACZ5D,OAAOC,gBAAgB;EAIvB,MAAM6D,oBAAoB9D,OAAOiB,QAAQvD,OAAO8F,cAAc,CAAC,CAACvE,QAAQwE;EACxE,MAAM,KAAKhB,YAAY5F,UAAUkH,SAAS/D,QAAQhB,OAAO,EAAE,GAAI8E,oBAAoB,EAAEL,OAAO,KAAK,IAAI,CAAC,EAAG,CAAA;EAEzG,OAAOzD;CACX;;;;;;IAUA,MAAgByC,YACZrD,MACAY,QACAhB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBoF,KAAAA;EAEJ,MAAM,KAAKrF,cAAcsF,OAAO;GAC5BC,OAAOpH,WAAWqH;GAClB/E;GACAgF,SAASxH,WAAWyH;GACpBC,OAAOtE,OAAOsD;GACd/D,SAASS,OAAOT,WAAW;GAC3BgF,WAAWvF,MAAMmC,UAAUmB,QAAQ;GACnCkC,SAASxF,MAAMmC,UAAUvB,KAAK0D,MAAM;GACpCmB,WAAWzF,MAAMmC,UAAUvB,KAAKR,QAAQ;GACxCsF,aAAa9F,gBAAgB8F,eAAe;GAC5CC,eAAe/F,gBAAgB+F,iBAAiB;GAChDC,kBAAkBhG,gBAAgBgG,oBAAoB;GACtDC,kBAAkBjG,gBAAgBiG,oBAAoB;GACtDjF,MAAM;IACFR,MAAMY,OAAOZ;IACb6B,KAAKjB,OAAOiB;IACZU,QAAQ3B,OAAO2B;IACf,GAAG/B;GACP;EACJ,CAAA;CACJ;CAEUkD,gBAAgB9C,QAAkC;EACxD,OAAO;GACHZ,MAAMY,OAAOZ;GACboC,UAAUxB,OAAOwB;GACjBG,QAAQ3B,OAAO2B;EACnB;CACJ;CAEA,MAAgBM,iBACZpB,WACAI,KAMD;EACC,IAAIA,QAAQvD,OAAO8F,YAAY;GAC3B,IAAI3C,UAAU0B,oBACV,MAAM,IAAI9F,gBAAgB,wDAAA;GAG9B,MAAMqI,sBAAM,IAAIC,WAAW,EAAA;GAC3BnH,gBAAgBkH,GAAAA;GAEhB,OAAO;IACHxC,MAAM7E,QAAQuH;IACdzC,oBAAoB;IACpBtC,eAAe9C,oBAAoB2H,IAAIG,MAAM;IAC7C/C,eAAe;GACnB;EACJ;EAEA,MAAMgD,YAAYrE,UAAU0B,sBAAsB5E,aAAawH;EAC/D,MAAMlG,UAAU,KAAKmG,uBAAuBF,SAAAA;EAE5C,MAAMG,UAAU,MAAM7H,wBAAwByB,OAAAA;EAE9C,OAAO;GACHqD,MAAM4C,UAAUI,WAAW,IAAA,IAAQ7H,QAAQ8H,KAAK9H,QAAQ+H;GACxDjD,oBAAoB2C;GACpBjF,eAAe,MAAM,IAAI1C,cAAc8H,QAAQI,UAAU,CAAA,CAAEC,SAAQ;GACnExD,eAAe,MAAM,IAAI3E,cAAc8H,QAAQM,SAAS,CAAA,CAAED,SAAQ;EACtE;CACJ;CAEA,MAAgB1D,eACZnB,WACAI,KAMD;EACC,IAAI,CAACJ,UAAUZ,eACX,MAAM,IAAIxD,gBAAgB,mEAAA;EAM9B,IAAIsB,qBAAqB8C,UAAUZ,cAAc2F,KAAI,CAAA,GACjD,MAAM,IAAInJ,gBAAgB,yCAAA;EAG9B,MAAMwD,gBAAgB,KAAK4F,kBAAkBhF,UAAUZ,aAAa;EAEpE,IAAIgB,QAAQvD,OAAO8F,YAAY;GAC3B,IAAI3C,UAAU0B,oBACV,MAAM,IAAI9F,gBAAgB,wDAAA;GAG9B,IAAIoE,UAAUqB,eACV,MAAM,IAAIzF,gBAAgB,yCAAA;GAG9B,IAAIqJ;GACJ,IAAI;IACAA,aAAa1I,oBAAoB6C,aAAAA,CAAAA,CAAe6F;GACpD,QAAQ;IACJ,MAAM,IAAIrJ,gBAAgB,uCAAA;GAC9B;GAEA,IAAIqJ,eAAe,IACf,MAAM,IAAIrJ,gBAAgB,mDAAA;GAG9B,OAAO;IACH6F,MAAM7E,QAAQuH;IACdzC,oBAAoB;IACpBtC;IACAiC,eAAe;GACnB;EACJ;EAEA,IAAI,CAACrB,UAAUqB,eACX,MAAM,IAAIzF,gBAAgB,2EAAA;EAG9B,MAAMyF,gBAAgB,KAAK2D,kBAAkBhF,UAAUqB,aAAa;EACpE,MAAMgD,YAAYrE,UAAU0B,sBAAsB5E,aAAawH;EAC/D,MAAMlG,UAAU,KAAKmG,uBAAuBF,SAAAA;EAE5C,IAAIa;EACJ,IAAIC;EAEJ,IAAI;GACA,MAAMP,aAAa,MAAMlI,cAAc0I,WAAW;IAC9CC,QAAQ;IACRC,KAAKlG;IACLhB;GACJ,CAAA;GACA,MAAM0G,YAAY,MAAMpI,cAAc0I,WAAW;IAC7CC,QAAQ;IACRC,KAAKjE;IACLjD;GACJ,CAAA;GAEA8G,aAAa,MAAMN,WAAWW,MAAK;GACnCJ,YAAY,MAAML,UAAUS,MAAK;EACrC,QAAQ;GACJ,MAAM,IAAI3J,gBAAgB,8CAA8CyI,UAAU,EAAE;EACxF;EAUA,IAJiBmB;GAD0B;GAAO;GAAK;GAAK;GAAO;GAAK;EACvDA,CAAAA,CAAWE,MACvBC,cAAcR,UAAUQ,eAAexC,KAAAA,KACpCgC,UAAUQ,eAAeT,WAAWS,UAExCF,GACA,MAAM,IAAI7J,gBAAgB,yDAAA;EAG9B,OAAO;GACH6F,MAAM4C,UAAUI,WAAW,IAAA,IAAQ7H,QAAQ8H,KAAK9H,QAAQ+H;GACxDjD,oBAAoB2C;GACpBjF;GACAiC;EACJ;CACJ;CAEUkD,uBAAuBF,WAA8B;EAC3D,IAAI,CAAC,yBAAyBuB,KAAKvB,SAAAA,GAC/B,MAAM,IAAIzI,gBAAgB,2BAA2ByI,UAAU,mCAAmC;EAGtG,OAAO3H,cAAcmJ,kCAAkCxB,SAAAA;CAC3D;CAEUW,kBAAkBc,OAAwB;EAChD,IAAIA,MAAMC,SAAS,YAAA,GAEf,OAAOD,MACFE,QAAQ,+BAA+B,EAAA,CAAA,CACvCA,QAAQ,QAAQ,EAAA;EAGzB,OAAOF,MAAMf,KAAI;CACrB;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityConflictError","EntityNotFoundError","ValidationError","isError","isRawError","EntityType","EventName","EventScope","KeyStatus","KeyValidator","PermissionName","ValidatorGroup","arrayBufferToBase64","base64ToArrayBuffer","createNanoID","AbstractEntityService","AsymmetricKey","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","getRandomValues","buildEntityDiff","assertCertificateMatchesKey","isWrappedKeyMaterial","parseCertificateChain","appendQueryConditions","decodeQuery","keySchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","KeyService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","entity","decryptionKey","total","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","use","validateJoinColumns","identity","actorRealmId","getActorRealmId","evaluate","checkUniqueness","priority","highest","findHighestPriority","status","ACTIVE","certificate","SIGNATURE","material","importMaterial","generateMaterial","encryptionKey","chain","e","message","type","signatureAlgorithm","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","ENCRYPTION","force","references","countBlobReferences","entityId","remove","forcedCryptoShred","DELETED","undefined","record","scope","ENTITY","refType","KEY","refId","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","raw","Uint8Array","OCT","buffer","algorithm","RS256","buildAsymmetricOptions","keyPair","startsWith","EC","RSA","privateKey","toBase64","publicKey","trim","normalizeMaterial","byteLength","privateJwk","publicJwk","fromBase64","format","key","toJWK","components","mismatch","some","component","test","buildImportOptionsForJWTAlgorithm","value","includes","replace"],"sources":["../../../../src/core/entities/key/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport {\n    EntityConflictError,\n    EntityNotFoundError,\n    ValidationError,\n    isError as isRawError,\n} from '@authup/errors';\nimport type { Key } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    KeyStatus,\n    KeyValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport {\n    ValidatorGroup,\n    arrayBufferToBase64,\n    base64ToArrayBuffer,\n    createNanoID,\n} from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService, AsymmetricKey, createAsymmetricKeyPair } from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport { getRandomValues } from 'uncrypto';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { assertCertificateMatchesKey, isWrappedKeyMaterial, parseCertificateChain } from '../../key/index.ts';\nimport type {\n    IKeyRepository, \n    IKeyService, \n    KeyDeleteOptions, \n    KeyServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { keySchema } from './schema.ts';\n\nexport type KeyServiceContext = {\n    repository: IKeyRepository;\n    eventService?: IEventService;\n    requestContext?: () => EventRequestContext | undefined;\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class KeyService extends AbstractEntityService implements IKeyService {\n    protected repository: IKeyRepository;\n\n    protected validator: KeyValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: KeyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new KeyValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: KeyServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Key>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        let parsed = await decodeQuery(query, { schema: keySchema, actor });\n        if (options.realmId) {\n            parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n        }\n\n        // Compile the read permissions against the knowns (actor identity) into a\n        // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n        // pagination and totals stay exact. Non-expressible policies fall back to\n        // the per-row post-evaluation below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        if (compiled.verdict !== 'post') {\n            for (const entity of entities) {\n                // Belt-and-braces: the read projection never selects private\n                // material, but null it explicitly so no future adapter change\n                // can leak it onto a read surface (cf. authentik CVE-2024-42490).\n                entity.decryptionKey = null;\n            }\n\n            return { data: entities, meta };\n        }\n\n        const data: Key[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                entity.decryptionKey = null;\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        // Belt-and-braces null of private material (see getMany).\n        entity.decryptionKey = null;\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n        const { use } = validated;\n        if (!use) {\n            throw new ValidationError('A key use must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (!validated.realmId && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        // keys are realm-bound infrastructure — no global (null realm) keys\n        // via the API.\n        if (!validated.realmId) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        if (!validated.name) {\n            validated.name = `${use}-${createNanoID(10)}`;\n        }\n\n        await this.repository.checkUniqueness(validated);\n\n        if (typeof validated.priority !== 'number') {\n            const highest = await this.repository.findHighestPriority(validated.realmId, use);\n            // generate doubles as rotate: a new key outranks the current one.\n            validated.priority = typeof highest === 'number' ? highest + 1 : 0;\n        }\n\n        if (!validated.status) {\n            validated.status = KeyStatus.ACTIVE;\n        }\n\n        const certificate = typeof validated.certificate === 'string' ? validated.certificate : null;\n        if (certificate && (!validated.decryptionKey || use !== JWKUse.SIGNATURE)) {\n            throw new ValidationError('A certificate requires imported signature key material.');\n        }\n\n        const material = validated.decryptionKey ?\n            await this.importMaterial(validated, use) :\n            await this.generateMaterial(validated, use);\n\n        if (certificate) {\n            if (!material.encryptionKey) {\n                throw new ValidationError('A certificate requires imported signature key material.');\n            }\n\n            try {\n                const chain = parseCertificateChain(certificate);\n                assertCertificateMatchesKey(chain, material.encryptionKey);\n            } catch (e) {\n                throw new ValidationError(\n                    isRawError(e) ?\n                        e.message :\n                        'The certificate could not be matched against the imported key material.',\n                );\n            }\n        }\n\n        let entity = this.repository.create({\n            ...validated,\n            type: material.type,\n            signatureAlgorithm: material.signatureAlgorithm,\n            decryptionKey: material.decryptionKey,\n            encryptionKey: material.encryptionKey,\n        });\n\n        entity = await this.repository.save(entity);\n\n        // private material never leaves the server — the response carries\n        // metadata + public part only (authentik CVE-2024-42490).\n        entity.decryptionKey = null;\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // only name / priority / status are mounted for UPDATE — material,\n        // use, type and realm are immutable.\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realmId: entity.realmId,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        await this.repository.save(entity);\n\n        entity.decryptionKey = null;\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n        options: KeyDeleteOptions = {},\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (entity.use === JWKUse.ENCRYPTION && !options.force) {\n            const references = await this.repository.countBlobReferences(entity.id);\n            if (references > 0) {\n                throw new EntityConflictError({\n                    message: `The encryption key is still referenced by ${references} encrypted secret(s) — ` +\n                        'deleting it makes them unrecoverable. Repeat with force to crypto-shred them.',\n                    data: { references },\n                });\n            }\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n        entity.decryptionKey = null;\n\n        // force only carries crypto-shred semantics for encryption keys — a\n        // sig-key delete with a stray force flag must not read as a shred.\n        const forcedCryptoShred = entity.use === JWKUse.ENCRYPTION && !!options.force;\n        await this.recordEvent(EventName.DELETED, entity, actor, { ...(forcedCryptoShred ? { force: true } : {}) });\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for key lifecycle operations (issue #3269) —\n     * keys deliberately have no entity subscriber (private material must stay\n     * off the realtime/audit bus), so the security-relevant mutations are\n     * recorded explicitly. The payload never carries key material.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: Key,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.KEY,\n            refId: entity.id,\n            realmId: entity.realmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            sessionId: requestContext?.sessionId ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                use: entity.use,\n                status: entity.status,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: Key): Record<string, any> {\n        return {\n            name: entity.name,\n            priority: entity.priority,\n            status: entity.status,\n        };\n    }\n\n    protected async generateMaterial(\n        validated: Partial<Key>,\n        use: `${JWKUse}`,\n    ) : Promise<{\n        type: `${JWKType}`,\n        signatureAlgorithm: `${JWTAlgorithm}` | null,\n        decryptionKey: string,\n        encryptionKey: string | null,\n    }> {\n        if (use === JWKUse.ENCRYPTION) {\n            if (validated.signatureAlgorithm) {\n                throw new ValidationError('An encryption key can not carry a signature algorithm.');\n            }\n\n            const raw = new Uint8Array(32);\n            getRandomValues(raw);\n\n            return {\n                type: JWKType.OCT,\n                signatureAlgorithm: null,\n                decryptionKey: arrayBufferToBase64(raw.buffer),\n                encryptionKey: null,\n            };\n        }\n\n        const algorithm = validated.signatureAlgorithm ?? JWTAlgorithm.RS256;\n        const options = this.buildAsymmetricOptions(algorithm);\n\n        const keyPair = await createAsymmetricKeyPair(options);\n\n        return {\n            type: algorithm.startsWith('ES') ? JWKType.EC : JWKType.RSA,\n            signatureAlgorithm: algorithm,\n            decryptionKey: await new AsymmetricKey(keyPair.privateKey).toBase64(),\n            encryptionKey: await new AsymmetricKey(keyPair.publicKey).toBase64(),\n        };\n    }\n\n    protected async importMaterial(\n        validated: Partial<Key>,\n        use: `${JWKUse}`,\n    ) : Promise<{\n        type: `${JWKType}`,\n        signatureAlgorithm: `${JWTAlgorithm}` | null,\n        decryptionKey: string,\n        encryptionKey: string | null,\n    }> {\n        if (!validated.decryptionKey) {\n            throw new ValidationError('Importing key material requires its private part (decryptionKey).');\n        }\n\n        // Reject material masquerading as an at-rest KEK-wrapped blob — it\n        // would be treated as wrapped on the next read (and, with a KEK,\n        // fail GCM authentication).\n        if (isWrappedKeyMaterial(validated.decryptionKey.trim())) {\n            throw new ValidationError('The imported key material is not valid.');\n        }\n\n        const decryptionKey = this.normalizeMaterial(validated.decryptionKey);\n\n        if (use === JWKUse.ENCRYPTION) {\n            if (validated.signatureAlgorithm) {\n                throw new ValidationError('An encryption key can not carry a signature algorithm.');\n            }\n\n            if (validated.encryptionKey) {\n                throw new ValidationError('An encryption key holds no public part.');\n            }\n\n            let byteLength : number;\n            try {\n                byteLength = base64ToArrayBuffer(decryptionKey).byteLength;\n            } catch {\n                throw new ValidationError('The key material is not valid base64.');\n            }\n\n            if (byteLength !== 32) {\n                throw new ValidationError('The key material must be 32 base64-encoded bytes.');\n            }\n\n            return {\n                type: JWKType.OCT,\n                signatureAlgorithm: null,\n                decryptionKey,\n                encryptionKey: null,\n            };\n        }\n\n        if (!validated.encryptionKey) {\n            throw new ValidationError('Importing a signature key requires its public part (encryptionKey, SPKI).');\n        }\n\n        const encryptionKey = this.normalizeMaterial(validated.encryptionKey);\n        const algorithm = validated.signatureAlgorithm ?? JWTAlgorithm.RS256;\n        const options = this.buildAsymmetricOptions(algorithm);\n\n        let privateJwk : JsonWebKey;\n        let publicJwk : JsonWebKey;\n\n        try {\n            const privateKey = await AsymmetricKey.fromBase64({\n                format: 'pkcs8',\n                key: decryptionKey,\n                options,\n            });\n            const publicKey = await AsymmetricKey.fromBase64({\n                format: 'spki',\n                key: encryptionKey,\n                options,\n            });\n\n            privateJwk = await privateKey.toJWK();\n            publicJwk = await publicKey.toJWK();\n        } catch {\n            throw new ValidationError(`The key material could not be imported for ${algorithm}.`);\n        }\n\n        // the public components (RSA: n/e, EC: crv/x/y) must agree — a\n        // private key paired with a foreign public part would publish a\n        // wrong JWKS entry and break verification of every token it signs.\n        const components : (keyof JsonWebKey)[] = ['kty', 'n', 'e', 'crv', 'x', 'y'];\n        const mismatch = components.some(\n            (component) => publicJwk[component] !== undefined &&\n                publicJwk[component] !== privateJwk[component],\n        );\n        if (mismatch) {\n            throw new ValidationError('The private and public key material do not form a pair.');\n        }\n\n        return {\n            type: algorithm.startsWith('ES') ? JWKType.EC : JWKType.RSA,\n            signatureAlgorithm: algorithm,\n            decryptionKey,\n            encryptionKey,\n        };\n    }\n\n    protected buildAsymmetricOptions(algorithm: `${JWTAlgorithm}`) {\n        if (!/^(RS|ES)(256|384|512)$/.test(algorithm)) {\n            throw new ValidationError(`The signature algorithm ${algorithm} is not supported for stored keys.`);\n        }\n\n        return AsymmetricKey.buildImportOptionsForJWTAlgorithm(algorithm);\n    }\n\n    protected normalizeMaterial(value: string) : string {\n        if (value.includes('-----BEGIN')) {\n            // PEM body IS base64 DER — strip armor + whitespace.\n            return value\n                .replace(/-----(BEGIN|END)[^-]+-----/g, '')\n                .replace(/\\s+/g, '');\n        }\n\n        return value.trim();\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoDA,MAAMiC,mBAAmB;CACrBnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;AAClB;AAED,IAAaC,aAAb,cAAgClB,sBAAAA;CAClBmB;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwB;EAChC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAI1B,aAAAA;EACrB,KAAK2B,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAiC,CAAC,GACU;EAC5C,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAWa;EAAM,CAAA;EACjE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQhD,GAAG,WAAW4C,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQ/C,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAIkD,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QAAQ;GAC7B,KAAK,MAAMM,UAAUH,UAIjBG,OAAOC,gBAAgB;GAG3B,OAAO;IAAEL,MAAMC;IAAUC;GAAK;EAClC;EAEA,MAAMF,OAAc,CAAA;EACpB,IAAI,EAAEM,UAAUJ;EAEhB,KAAK,MAAME,UAAUH,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBiB,cAAc;IAC1Cf,MAAMhB;IACNwB,MAAMxD,iBAAiB;MAClBD,kBAAkBiE,aAAaJ;KAChC,GAAG,KAAKK,mBAAmBL,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAA,OAAOC,gBAAgB;GACvBL,KAAKU,KAAKN,MAAAA;EACd,QAAQ;GACJE,SAAS;EACb;EAGJ,OAAO;GACHN;GACAE,MAAM;IACF,GAAGA;IACHI;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,UACAxB,OACAO,SACY;EACZ,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM4B,SAAS,MAAM,KAAKvB,WAAWgC,kBAAkBD,UAAUjB,OAAAA;EACjE,IAAI,CAACS,QACD,MAAM,IAAIxD,oBAAAA;EAGd,MAAMwC,MAAME,oBAAoBiB,cAAc;GAC1Cf,MAAMhB;GACNwB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAaJ;IAChC,GAAG,KAAKK,mBAAmBL,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAGAA,OAAOC,gBAAgB;EAEvB,OAAOD;CACX;CAEA,MAAMU,OACFd,MACAZ,OACY;EACZ,MAAMA,MAAME,oBAAoByB,YAAY,EAAEvB,MAAMnC,eAAe2D,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEmB,OAAO7D,eAAe8D,OAAO,CAAA;EAChF,MAAM,EAAEC,QAAQJ;EAChB,IAAI,CAACI,KACD,MAAM,IAAIxE,gBAAgB,8BAAA;EAG9B,MAAM,KAAKgC,WAAWyC,oBAAoBL,SAAAA;EAE1C,IAAI,CAACA,UAAUtB,WAAWP,MAAMmC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBrC,KAAAA;GAC1C,IAAIoC,cACAP,UAAUtB,UAAU6B;EAE5B;EAIA,IAAI,CAACP,UAAUtB,SACX,MAAM,IAAI9C,gBAAgB,4BAAA;EAG9B,MAAMuC,MAAME,oBAAoBoC,SAAS;GACrClC,MAAMnC,eAAe2D;GACrBhB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAI,CAACA,UAAUzB,MACXyB,UAAUzB,OAAO,GAAG6B,IAAI,GAAG5D,aAAa,EAAA;EAG5C,MAAM,KAAKoB,WAAW8C,gBAAgBV,SAAAA;EAEtC,IAAI,OAAOA,UAAUW,aAAa,UAAU;GACxC,MAAMC,UAAU,MAAM,KAAKhD,WAAWiD,oBAAoBb,UAAUtB,SAAS0B,GAAAA;GAE7EJ,UAAUW,WAAW,OAAOC,YAAY,WAAWA,UAAU,IAAI;EACrE;EAEA,IAAI,CAACZ,UAAUc,QACXd,UAAUc,SAAS5E,UAAU6E;EAGjC,MAAMC,cAAc,OAAOhB,UAAUgB,gBAAgB,WAAWhB,UAAUgB,cAAc;EACxF,IAAIA,gBAAgB,CAAChB,UAAUZ,iBAAiBgB,QAAQvD,OAAOoE,YAC3D,MAAM,IAAIrF,gBAAgB,yDAAA;EAG9B,MAAMsF,WAAWlB,UAAUZ,gBACvB,MAAM,KAAK+B,eAAenB,WAAWI,GAAAA,IACrC,MAAM,KAAKgB,iBAAiBpB,WAAWI,GAAAA;EAE3C,IAAIY,aAAa;GACb,IAAI,CAACE,SAASG,eACV,MAAM,IAAIzF,gBAAgB,yDAAA;GAG9B,IAAI;IACA,MAAM0F,QAAQnE,sBAAsB6D,WAAAA;IACpC/D,4BAA4BqE,OAAOJ,SAASG,aAAa;GAC7D,SAASE,GAAG;IACR,MAAM,IAAI3F,gBACNE,QAAWyF,CAAAA,IACPA,EAAEC,UACF,yEAAA;GAEZ;EACJ;EAEA,IAAIrC,SAAS,KAAKvB,WAAWiC,OAAO;GAChC,GAAGG;GACHyB,MAAMP,SAASO;GACfC,oBAAoBR,SAASQ;GAC7BtC,eAAe8B,SAAS9B;GACxBiC,eAAeH,SAASG;EAC5B,CAAA;EAEAlC,SAAS,MAAM,KAAKvB,WAAW+D,KAAKxC,MAAAA;EAIpCA,OAAOC,gBAAgB;EAEvB,MAAM,KAAKwC,YAAY5F,UAAU6F,SAAS1C,QAAQhB,KAAAA;EAElD,OAAOgB;CACX;CAEA,MAAM2C,OACFnC,UACAZ,MACAZ,OACAO,SACY;EACZ,MAAMP,MAAME,oBAAoByB,YAAY,EAAEvB,MAAMnC,eAAeqB,WAAW,CAAA;EAE9E,IAAI0B,SAAS,MAAM,KAAKvB,WAAWgC,kBAAkBD,UAAUjB,OAAAA;EAC/D,IAAI,CAACS,QACD,MAAM,IAAIxD,oBAAAA;EAKd,MAAMqE,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEmB,OAAO7D,eAAe0F,OAAO,CAAA;EAEhF,MAAM5D,MAAME,oBAAoBoC,SAAS;GACrClC,MAAMnC,eAAeqB;GACrBsB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAa;KAC5B,GAAGJ;KACH,GAAGa;IACP;IACA,GAAG,KAAKR,mBAAmBL,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIa,UAAUzB,QAAQyB,UAAUzB,SAASY,OAAOZ,MAC5C,MAAM,KAAKX,WAAW8C,gBAAgB;GAClCnC,MAAMyB,UAAUzB;GAChBG,SAASS,OAAOT;EACpB,GAAGS,MAAAA;EAGP,MAAM6C,WAAW,KAAKC,gBAAgB9C,MAAAA;EAEtCA,SAAS,KAAKvB,WAAWsE,MAAM/C,QAAQa,SAAAA;EACvC,MAAM,KAAKpC,WAAW+D,KAAKxC,MAAAA;EAE3BA,OAAOC,gBAAgB;EAEvB,MAAM+C,OAAOnF,gBAAgB,KAAKiF,gBAAgB9C,MAAAA,GAAS6C,QAAAA;EAC3D,MAAM,KAAKJ,YAAY5F,UAAUoG,SAASjD,QAAQhB,OAAO,EAAE,GAAIkE,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOhD;CACX;CAEA,MAAMqD,OACFC,IACAtE,OACAC,UAA4B,CAAC,GACjB;EACZ,MAAMD,MAAME,oBAAoByB,YAAY,EAAEvB,MAAMnC,eAAesB,WAAW,CAAA;EAE9E,MAAMyB,SAAS,MAAM,KAAKvB,WAAW8E,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACtD,QACD,MAAM,IAAIxD,oBAAAA;EAGd,MAAMwC,MAAME,oBAAoBoC,SAAS;GACrClC,MAAMnC,eAAesB;GACrBqB,MAAMxD,iBAAiB;KAClBD,kBAAkBiE,aAAaJ;IAChC,GAAG,KAAKK,mBAAmBL,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIA,OAAOiB,QAAQvD,OAAO8F,cAAc,CAACvE,QAAQwE,OAAO;GACpD,MAAMC,aAAa,MAAM,KAAKjF,WAAWkF,oBAAoB3D,OAAOsD,EAAE;GACtE,IAAII,aAAa,GACb,MAAM,IAAInH,oBAAoB;IAC1B8F,SAAS,6CAA6CqB,WAAW;IAEjE9D,MAAM,EAAE8D,WAAW;GACvB,CAAA;EAER;EAEA,MAAM,EAAEJ,IAAIM,aAAa5D;EACzB,MAAM,KAAKvB,WAAWoF,OAAO7D,MAAAA;EAC7BA,OAAOsD,KAAKM;EACZ5D,OAAOC,gBAAgB;EAIvB,MAAM6D,oBAAoB9D,OAAOiB,QAAQvD,OAAO8F,cAAc,CAAC,CAACvE,QAAQwE;EACxE,MAAM,KAAKhB,YAAY5F,UAAUkH,SAAS/D,QAAQhB,OAAO,EAAE,GAAI8E,oBAAoB,EAAEL,OAAO,KAAK,IAAI,CAAC,EAAG,CAAA;EAEzG,OAAOzD;CACX;;;;;;IAUA,MAAgByC,YACZrD,MACAY,QACAhB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBoF,KAAAA;EAEJ,MAAM,KAAKrF,cAAcsF,OAAO;GAC5BC,OAAOpH,WAAWqH;GAClB/E;GACAgF,SAASxH,WAAWyH;GACpBC,OAAOtE,OAAOsD;GACd/D,SAASS,OAAOT,WAAW;GAC3BgF,WAAWvF,MAAMmC,UAAUmB,QAAQ;GACnCkC,SAASxF,MAAMmC,UAAUvB,KAAK0D,MAAM;GACpCmB,WAAWzF,MAAMmC,UAAUvB,KAAKR,QAAQ;GACxCsF,WAAW9F,gBAAgB8F,aAAa;GACxCC,aAAa/F,gBAAgB+F,eAAe;GAC5CC,eAAehG,gBAAgBgG,iBAAiB;GAChDC,kBAAkBjG,gBAAgBiG,oBAAoB;GACtDC,kBAAkBlG,gBAAgBkG,oBAAoB;GACtDlF,MAAM;IACFR,MAAMY,OAAOZ;IACb6B,KAAKjB,OAAOiB;IACZU,QAAQ3B,OAAO2B;IACf,GAAG/B;GACP;EACJ,CAAA;CACJ;CAEUkD,gBAAgB9C,QAAkC;EACxD,OAAO;GACHZ,MAAMY,OAAOZ;GACboC,UAAUxB,OAAOwB;GACjBG,QAAQ3B,OAAO2B;EACnB;CACJ;CAEA,MAAgBM,iBACZpB,WACAI,KAMD;EACC,IAAIA,QAAQvD,OAAO8F,YAAY;GAC3B,IAAI3C,UAAU0B,oBACV,MAAM,IAAI9F,gBAAgB,wDAAA;GAG9B,MAAMsI,sBAAM,IAAIC,WAAW,EAAA;GAC3BpH,gBAAgBmH,GAAAA;GAEhB,OAAO;IACHzC,MAAM7E,QAAQwH;IACd1C,oBAAoB;IACpBtC,eAAe9C,oBAAoB4H,IAAIG,MAAM;IAC7ChD,eAAe;GACnB;EACJ;EAEA,MAAMiD,YAAYtE,UAAU0B,sBAAsB5E,aAAayH;EAC/D,MAAMnG,UAAU,KAAKoG,uBAAuBF,SAAAA;EAE5C,MAAMG,UAAU,MAAM9H,wBAAwByB,OAAAA;EAE9C,OAAO;GACHqD,MAAM6C,UAAUI,WAAW,IAAA,IAAQ9H,QAAQ+H,KAAK/H,QAAQgI;GACxDlD,oBAAoB4C;GACpBlF,eAAe,MAAM,IAAI1C,cAAc+H,QAAQI,UAAU,CAAA,CAAEC,SAAQ;GACnEzD,eAAe,MAAM,IAAI3E,cAAc+H,QAAQM,SAAS,CAAA,CAAED,SAAQ;EACtE;CACJ;CAEA,MAAgB3D,eACZnB,WACAI,KAMD;EACC,IAAI,CAACJ,UAAUZ,eACX,MAAM,IAAIxD,gBAAgB,mEAAA;EAM9B,IAAIsB,qBAAqB8C,UAAUZ,cAAc4F,KAAI,CAAA,GACjD,MAAM,IAAIpJ,gBAAgB,yCAAA;EAG9B,MAAMwD,gBAAgB,KAAK6F,kBAAkBjF,UAAUZ,aAAa;EAEpE,IAAIgB,QAAQvD,OAAO8F,YAAY;GAC3B,IAAI3C,UAAU0B,oBACV,MAAM,IAAI9F,gBAAgB,wDAAA;GAG9B,IAAIoE,UAAUqB,eACV,MAAM,IAAIzF,gBAAgB,yCAAA;GAG9B,IAAIsJ;GACJ,IAAI;IACAA,aAAa3I,oBAAoB6C,aAAAA,CAAAA,CAAe8F;GACpD,QAAQ;IACJ,MAAM,IAAItJ,gBAAgB,uCAAA;GAC9B;GAEA,IAAIsJ,eAAe,IACf,MAAM,IAAItJ,gBAAgB,mDAAA;GAG9B,OAAO;IACH6F,MAAM7E,QAAQwH;IACd1C,oBAAoB;IACpBtC;IACAiC,eAAe;GACnB;EACJ;EAEA,IAAI,CAACrB,UAAUqB,eACX,MAAM,IAAIzF,gBAAgB,2EAAA;EAG9B,MAAMyF,gBAAgB,KAAK4D,kBAAkBjF,UAAUqB,aAAa;EACpE,MAAMiD,YAAYtE,UAAU0B,sBAAsB5E,aAAayH;EAC/D,MAAMnG,UAAU,KAAKoG,uBAAuBF,SAAAA;EAE5C,IAAIa;EACJ,IAAIC;EAEJ,IAAI;GACA,MAAMP,aAAa,MAAMnI,cAAc2I,WAAW;IAC9CC,QAAQ;IACRC,KAAKnG;IACLhB;GACJ,CAAA;GACA,MAAM2G,YAAY,MAAMrI,cAAc2I,WAAW;IAC7CC,QAAQ;IACRC,KAAKlE;IACLjD;GACJ,CAAA;GAEA+G,aAAa,MAAMN,WAAWW,MAAK;GACnCJ,YAAY,MAAML,UAAUS,MAAK;EACrC,QAAQ;GACJ,MAAM,IAAI5J,gBAAgB,8CAA8C0I,UAAU,EAAE;EACxF;EAUA,IAJiBmB;GAD0B;GAAO;GAAK;GAAK;GAAO;GAAK;EACvDA,CAAAA,CAAWE,MACvBC,cAAcR,UAAUQ,eAAezC,KAAAA,KACpCiC,UAAUQ,eAAeT,WAAWS,UAExCF,GACA,MAAM,IAAI9J,gBAAgB,yDAAA;EAG9B,OAAO;GACH6F,MAAM6C,UAAUI,WAAW,IAAA,IAAQ9H,QAAQ+H,KAAK/H,QAAQgI;GACxDlD,oBAAoB4C;GACpBlF;GACAiC;EACJ;CACJ;CAEUmD,uBAAuBF,WAA8B;EAC3D,IAAI,CAAC,yBAAyBuB,KAAKvB,SAAAA,GAC/B,MAAM,IAAI1I,gBAAgB,2BAA2B0I,UAAU,mCAAmC;EAGtG,OAAO5H,cAAcoJ,kCAAkCxB,SAAAA;CAC3D;CAEUW,kBAAkBc,OAAwB;EAChD,IAAIA,MAAMC,SAAS,YAAA,GAEf,OAAOD,MACFE,QAAQ,+BAA+B,EAAA,CAAA,CACvCA,QAAQ,QAAQ,EAAA;EAGzB,OAAOF,MAAMf,KAAI;CACrB;AACJ"}

package/dist/core/entities/permission/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,eAAO,MAAM,gBAAgB,+CAuB3B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,eAAO,MAAM,gBAAgB,+CAiC3B,CAAC"}

package/dist/core/entities/permission/schema.mjs

@@ -6,6 +6,20 @@ import { defineSchema } from "@rapiq/core";
 //#region src/core/entities/permission/schema.ts
 const permissionSchema = defineSchema({
 	name: EntityType.PERMISSION,
+	indexes: [
+		["id"],
+		[
+			"name",
+			"clientId",
+			"realmId"
+		],
+		["displayName"],
+		["builtIn"],
+		["realmId"],
+		["clientId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"builtIn",
@@ -18,20 +32,27 @@ const permissionSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"displayName",
-		"name",
-		"builtIn",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"displayName",
+			"name",
+			"builtIn",
+			"realmId",
+			"clientId"
+		],
+		indexed: true
+	},
 	relations: { allowed: [] },
-	sort: { allowed: [
-		"id",
-		"name",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 }
 });
 //#endregion

package/dist/core/entities/permission/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","permissionSchema","name","PERMISSION","fields","allowed","filters","relations","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Permission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const permissionSchema = defineSchema<Permission>({\n    name: EntityType.PERMISSION,\n    // explicit root projection so an include=permission decodes columns\n    // (a schema without fields selects all as a query root but nothing as\n    // an include child — see client-permission/user-role schema comments)\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'decisionStrategy',\n            'clientId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'displayName', 'name', 'builtIn', 'realmId'] },\n    relations: { allowed: [] },\n    sort: { allowed: ['id', 'name', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,mBAAmBF,aAAyB;CACrDG,MAAMF,WAAWG;CAIjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAe;EAAQ;EAAW;CAAU,EAAC;CACxEE,WAAW,EAAEF,SAAS,CAAA,EAAG;CACzBG,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DI,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","permissionSchema","name","PERMISSION","indexes","fields","allowed","filters","indexed","relations","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Permission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const permissionSchema = defineSchema<Permission>({\n    name: EntityType.PERMISSION,\n    indexes: [\n        ['id'],\n        ['name', 'clientId', 'realmId'],\n        ['displayName'],\n        ['builtIn'],\n        ['realmId'],\n        ['clientId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // explicit root projection so an include=permission decodes columns\n    // (a schema without fields selects all as a query root but nothing as\n    // an include child — see client-permission/user-role schema comments)\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'decisionStrategy',\n            'clientId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'displayName', 'name', 'builtIn', 'realmId', 'clientId'], indexed: true },\n    relations: { allowed: [] },\n    sorts: { allowed: ['id', 'name', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,mBAAmBF,aAAyB;CACrDG,MAAMF,WAAWG;CACjBC,SAAS;EACL,CAAC,IAAK;EACN;GAAC;GAAQ;GAAY;EAAU;EAC/B,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,UAAW;EACZ,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAIDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAC;GAAM;GAAe;GAAQ;GAAW;GAAW;EAAW;EAAEE,SAAS;CAAK;CACnGC,WAAW,EAAEH,SAAS,CAAA,EAAG;CACzBI,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAQ;GAAa;EAAY;EAAEE,SAAS;CAAK;CAC1EG,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}