@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

package/dist/core/entities/session/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'authMethod',\n            'mfaAt',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS,CAAIT,GAAAA,mBAAoB,EAAC;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;CAAY,EAAC;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","user","USER","client","CLIENT","sessionSchema","name","SESSION","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = {\n    realm: EntityType.REALM,\n    user: EntityType.USER,\n    client: EntityType.CLIENT,\n};\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    indexes: [\n        ['id'],\n        ['sub'],\n        ['subKind'],\n        ['userId'],\n        ['clientId'],\n        ['realmId'],\n        ['seenAt'],\n        ['expiresAt'],\n        ['userId', 'seenAt'],\n        ['realmId', 'seenAt'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'authMethod',\n            'mfaAt',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS, 'expiresAt', 'seenAt'], indexed: true },\n    relations: { allowed: ['realm', 'user', 'client'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB;CAClBC,OAAOJ,WAAWK;CAClBC,MAAMN,WAAWO;CACjBC,QAAQR,WAAWS;AACvB;AAEA,MAAaC,gBAAgBX,aAAsB;CAC/CY,MAAMX,WAAWY;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,KAAM;EACP,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,UAAW;EACZ,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,WAAY;EACb,CAAC,UAAU,QAAS;EACpB,CAAC,WAAW,QAAS;EACrB,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAId,GAAAA;GAAqB;GAAa;EAAS;EAAEgB,SAAS;CAAK;CACnFC,WAAW;EAAEH,SAAS;GAAC;GAAS;GAAQ;EAAS;EAAEI,UAAUjB,wBAAwBC,aAAAA;CAAe;CACpGiB,OAAO;EAAEL,SAAS;GAAC;GAAU;GAAa;GAAa;EAAY;EAAEE,SAAS;CAAK;CACnFI,YAAY,EAAEC,UAAU,GAAG;CAC3BnB;AACJ,CAAA"}

package/dist/core/entities/session-token/index.d.ts

@@ -0,0 +1,4 @@
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/session-token/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sessionTokenSchema } from "./schema.mjs";
+import { SESSION_TOKEN_FILTER_KEYS, SessionTokenService } from "./service.mjs";
+export { SESSION_TOKEN_FILTER_KEYS, SessionTokenService, sessionTokenSchema };

package/dist/core/entities/session-token/schema.d.ts

@@ -0,0 +1,12 @@
+import type { SessionToken } from '@authup/core-kit';
+/**
+ * The token inventory as a query surface.
+ *
+ * The rows carry no realm or subject of their own, so both the ownership
+ * check and the realm gate resolve through `session`. The repository joins it
+ * unconditionally for that reason: a projection must never be able to strip
+ * the columns the gate reads (the plan-039 discipline, applied through a
+ * relation instead of a column).
+ */
+export declare const sessionTokenSchema: import("@rapiq/core").Schema<SessionToken, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/session-token/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session-token/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,iDAoD7B,CAAC"}

package/dist/core/entities/session-token/schema.mjs

@@ -0,0 +1,66 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/session-token/schema.ts
+const schemaMapping = { session: EntityType.SESSION };
+/**
+* The token inventory as a query surface.
+*
+* The rows carry no realm or subject of their own, so both the ownership
+* check and the realm gate resolve through `session`. The repository joins it
+* unconditionally for that reason: a projection must never be able to strip
+* the columns the gate reads (the plan-039 discipline, applied through a
+* relation instead of a column).
+*/ const sessionTokenSchema = defineSchema({
+	name: EntityType.SESSION_TOKEN,
+	indexes: [
+		["id"],
+		["sessionId"],
+		["clientId"],
+		["kind"],
+		["expiresAt"],
+		["sessionId", "createdAt"],
+		["createdAt"]
+	],
+	fields: { allowed: [
+		"id",
+		"sessionId",
+		"clientId",
+		"kind",
+		"parentId",
+		"refreshTokenId",
+		"ipAddress",
+		"userAgent",
+		"consumedAt",
+		"revokedAt",
+		"expiresAt",
+		"createdAt"
+	] },
+	filters: {
+		allowed: [
+			"id",
+			"sessionId",
+			"clientId",
+			"kind",
+			"expiresAt"
+		],
+		indexed: true
+	},
+	relations: {
+		allowed: ["session"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sorts: {
+		allowed: ["createdAt", "expiresAt"],
+		indexed: true
+	},
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { sessionTokenSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/session-token/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","session","SESSION","sessionTokenSchema","name","SESSION_TOKEN","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/session-token/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { SessionToken } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { session: EntityType.SESSION };\n\n/**\n * The token inventory as a query surface.\n *\n * The rows carry no realm or subject of their own, so both the ownership\n * check and the realm gate resolve through `session`. The repository joins it\n * unconditionally for that reason: a projection must never be able to strip\n * the columns the gate reads (the plan-039 discipline, applied through a\n * relation instead of a column).\n */\nexport const sessionTokenSchema = defineSchema<SessionToken>({\n    name: EntityType.SESSION_TOKEN,\n    indexes: [\n        ['id'],\n        ['sessionId'],\n        ['clientId'],\n        ['kind'],\n        ['expiresAt'],\n        ['sessionId', 'createdAt'],\n        ['createdAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'sessionId',\n            'clientId',\n            'kind',\n            'parentId',\n            'refreshTokenId',\n            'ipAddress',\n            'userAgent',\n            'consumedAt',\n            'revokedAt',\n            'expiresAt',\n            'createdAt',\n        ],\n    },\n    // Plain columns only. Ownership and realm are NOT client-supplied filters:\n    // the service resolves them from the joined session per row, so a caller\n    // cannot widen its own reach by filtering. These four cover the use cases:\n    // `clientId` answers \"which sessions did this application serve\",\n    // `sessionId` answers \"which applications rode this session\" (the\n    // back-channel logout audience), and the pair scopes a per-application\n    // revoke to one session.\n    filters: {\n        allowed: [\n            'id',\n            'sessionId',\n            'clientId',\n            'kind',\n            'expiresAt',\n        ],\n        indexed: true,\n    },\n    // `client` is deliberately absent: the repository always joins a client\n    // SUMMARY (id / name / displayName — the consent-list shape), so a raw\n    // `?include=client` cannot force the full-column join and a self-service\n    // reader still gets application names without CLIENT_READ.\n    relations: { allowed: ['session'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'expiresAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,SAASH,WAAWI,QAAQ;;;;;;;;;GAWpD,MAAaC,qBAAqBN,aAA2B;CACzDO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,WAAY;EACb,CAAC,UAAW;EACZ,CAAC,MAAO;EACR,CAAC,WAAY;EACb,CAAC,aAAa,WAAY;EAC1B,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CAQAC,SAAS;EACLD,SAAS;GACL;GACA;GACA;GACA;GACA;EACH;EACDE,SAAS;CACb;CAKAC,WAAW;EAAEH,SAAS,CAAC,SAAU;EAAEI,UAAUb,wBAAwBC,aAAAA;CAAe;CACpFa,OAAO;EAAEL,SAAS,CAAC,aAAa,WAAY;EAAEE,SAAS;CAAK;CAC5DI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/session-token/service.d.ts

@@ -0,0 +1,70 @@
+import type { ICondition } from '@rapiq/core';
+import { PermissionName } from '@authup/core-kit';
+import type { SessionToken } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { IOAuth2TokenRepository, ISessionTokenRepository } from '../../oauth2/index.ts';
+import type { ISessionTokenService, SessionTokenDeleteManyResult } from './types.ts';
+/**
+ * Filter keys that make a bulk revoke a TARGETED one. A query carrying none of
+ * them is rejected rather than treated as "everything": unlike the session
+ * bulk revoke, there is no meaningful self-service fallback here, so an
+ * unrecognized filter must fail loudly instead of silently widening.
+ */
+export declare const SESSION_TOKEN_FILTER_KEYS: readonly ["id", "sessionId", "clientId"];
+export type SessionTokenServiceContext = {
+    repository: ISessionTokenRepository;
+    tokenRepository?: IOAuth2TokenRepository;
+};
+export declare class SessionTokenService extends AbstractEntityService implements ISessionTokenService {
+    protected repository: ISessionTokenRepository;
+    protected tokenRepository?: IOAuth2TokenRepository;
+    constructor(ctx: SessionTokenServiceContext);
+    /**
+     * A token row carries no subject of its own, so ownership resolves through
+     * the joined session. A row whose session did not load fails closed.
+     */
+    protected isOwnedBy(entity: SessionToken, actor: ActorContext): boolean;
+    /**
+     * The realm the row belongs to, taken from its session. Absent when the
+     * session did not load, which leaves the realm factor neutral, so the
+     * per-row permission check below is what denies.
+     */
+    protected tokenRealmMatch(entity: SessionToken): Record<string, any>;
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<SessionToken>>;
+    getOne(id: string, actor: ActorContext): Promise<SessionToken>;
+    delete(id: string, actor: ActorContext): Promise<SessionToken>;
+    deleteMany(query: Record<string, any>, actor: ActorContext): Promise<SessionTokenDeleteManyResult>;
+    protected loadOneForActor(id: string, actor: ActorContext, permission: `${PermissionName}`): Promise<SessionToken>;
+    /**
+     * Revoke, not delete. The row is stamped and the jti is blocklisted with a
+     * TTL pinned to the token's real expiry, so an in-flight access token stops
+     * introspecting as active instead of surviving to its own `exp`.
+     */
+    protected revoke(entity: SessionToken): Promise<void>;
+    protected hasTargetFilter(query?: Record<string, any>): boolean;
+    /**
+     * Whether the condition BOUNDS the query to a target scope.
+     *
+     * The question is not "does a target key appear somewhere" but "is the
+     * result set constrained by one". Those differ, and the difference is a
+     * mass revoke:
+     *
+     * - `and` is bounded when ANY conjunct is: the others can only narrow it.
+     * - `or` is bounded only when EVERY branch is. `or(eq(id,x), eq(kind,access))`
+     *   names a target key and still selects every access token.
+     * - `not` is never a scope. A negation of a scoped predicate is its
+     *   complement, which is nearly everything.
+     *
+     * The expression dialect is what makes the last two reachable: rapiq
+     * collapses `not(eq(...))` into an `ne` leaf, but `not(and(...))` stays a
+     * compound node, and `or(...)` has no bracket-dialect spelling at all.
+     */
+    protected hasTargetCondition(condition: ICondition): boolean;
+    /**
+     * Schemaless decode — dialect detection only. The allow-list is enforced
+     * downstream by the schema-bound decode.
+     */
+    protected static queryCodec: import("@rapiq/codec-url").URLCodec;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/session-token/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session-token/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAS9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAG,MAAM,uBAAuB,CAAC;AAG9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,0CAI5B,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG;IACrC,UAAU,EAAE,uBAAuB,CAAC;IACpC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,qBAAsB,YAAW,oBAAoB;IAC1F,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAE9C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,0BAA0B;IAM3C;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IASvE;;;;OAIG;IACH,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,YAAY;IASxC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;IA6DlD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAM9D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ9D,UAAU,CACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,4BAA4B,CAAC;cA4DxB,eAAe,CAC3B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,GAAG,cAAc,EAAE,GAChC,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;OAIG;cACa,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB3D,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAmB/D;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO;IA6C5D;;;OAGG;IACH,SAAS,CAAC,MAAM,CAAC,UAAU,sCAAoB;CAClD"}

package/dist/core/entities/session-token/service.mjs

@@ -0,0 +1,216 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sessionTokenSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
+import { isObject } from "@authup/kit";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { AuthupError, EntityNotFoundError, ErrorCode } from "@authup/errors";
+import { FilterCompoundOperator, FilterFieldOperator, and, eq, isFilter, isFilters } from "@rapiq/core";
+import { createURLCodec } from "@rapiq/codec-url";
+//#region src/core/entities/session-token/service.ts
+/**
+* Filter keys that make a bulk revoke a TARGETED one. A query carrying none of
+* them is rejected rather than treated as "everything": unlike the session
+* bulk revoke, there is no meaningful self-service fallback here, so an
+* unrecognized filter must fail loudly instead of silently widening.
+*/ const SESSION_TOKEN_FILTER_KEYS = [
+	"id",
+	"sessionId",
+	"clientId"
+];
+var SessionTokenService = class SessionTokenService extends AbstractEntityService {
+	repository;
+	tokenRepository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.tokenRepository = ctx.tokenRepository;
+	}
+	/**
+	* A token row carries no subject of its own, so ownership resolves through
+	* the joined session. A row whose session did not load fails closed.
+	*/ isOwnedBy(entity, actor) {
+		const session = entity.session;
+		return !!actor.identity && !!session && session.sub === actor.identity.data.id && session.subKind === actor.identity.type;
+	}
+	/**
+	* The realm the row belongs to, taken from its session. Absent when the
+	* session did not load, which leaves the realm factor neutral, so the
+	* per-row permission check below is what denies.
+	*/ tokenRealmMatch(entity) {
+		const session = entity.session;
+		if (!session) return {};
+		return this.resourceRealmMatch({ realmId: session.realmId });
+	}
+	async getMany(query, actor) {
+		const parsed = await decodeQuery(query, {
+			schema: sessionTokenSchema,
+			actor
+		});
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) {
+			const scoped = appendQueryConditions(parsed, and(eq("session.sub", actor.identity.data.id), eq("session.subKind", actor.identity.type)));
+			return this.repository.findMany(scoped);
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.tokenRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor) {
+		return await this.loadOneForActor(id, actor, PermissionName.SESSION_READ);
+	}
+	async delete(id, actor) {
+		const entity = await this.loadOneForActor(id, actor, PermissionName.SESSION_DELETE);
+		await this.revoke(entity);
+		return entity;
+	}
+	async deleteMany(query, actor) {
+		if (!actor.identity) throw new AuthupError({
+			code: ErrorCode.IDENTITY_UNAUTHORIZED,
+			message: "Authentication required."
+		});
+		if (!this.hasTargetFilter(query)) throw new AuthupError({
+			code: ErrorCode.BAD_REQUEST,
+			message: "A bulk revoke must be scoped by id, sessionId or clientId."
+		});
+		const parsed = await decodeQuery(query, {
+			schema: sessionTokenSchema,
+			parameters: ["filters"],
+			actor
+		});
+		let canDeleteAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+		} catch {
+			canDeleteAll = false;
+		}
+		const scoped = canDeleteAll ? parsed : appendQueryConditions(parsed, and(eq("session.sub", actor.identity.data.id), eq("session.subKind", actor.identity.type)));
+		const entities = await this.repository.findAllByQuery(scoped);
+		let count = 0;
+		for (const entity of entities) {
+			if (!this.isOwnedBy(entity, actor)) try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_DELETE,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.tokenRealmMatch(entity)
+					})
+				});
+			} catch {
+				continue;
+			}
+			await this.revoke(entity);
+			count += 1;
+		}
+		return { count };
+	}
+	async loadOneForActor(id, actor, permission) {
+		const entity = await this.repository.findOneWithSessionById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: permission });
+			await actor.permissionEvaluator.evaluate({
+				name: permission,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.tokenRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	/**
+	* Revoke, not delete. The row is stamped and the jti is blocklisted with a
+	* TTL pinned to the token's real expiry, so an in-flight access token stops
+	* introspecting as active instead of surviving to its own `exp`.
+	*/ async revoke(entity) {
+		const at = (/* @__PURE__ */ new Date()).toISOString();
+		await this.repository.revokeById(entity.id, at);
+		entity.revokedAt = at;
+		if (this.tokenRepository) await this.tokenRepository.setInactive(entity.id, Math.floor(new Date(entity.expiresAt).getTime() / 1e3));
+	}
+	hasTargetFilter(query) {
+		if (!isObject(query)) return false;
+		let parsed;
+		try {
+			parsed = SessionTokenService.queryCodec.decode(query);
+		} catch {
+			return false;
+		}
+		if (!parsed) return false;
+		return this.hasTargetCondition(parsed.filters);
+	}
+	/**
+	* Whether the condition BOUNDS the query to a target scope.
+	*
+	* The question is not "does a target key appear somewhere" but "is the
+	* result set constrained by one". Those differ, and the difference is a
+	* mass revoke:
+	*
+	* - `and` is bounded when ANY conjunct is: the others can only narrow it.
+	* - `or` is bounded only when EVERY branch is. `or(eq(id,x), eq(kind,access))`
+	*   names a target key and still selects every access token.
+	* - `not` is never a scope. A negation of a scoped predicate is its
+	*   complement, which is nearly everything.
+	*
+	* The expression dialect is what makes the last two reachable: rapiq
+	* collapses `not(eq(...))` into an `ne` leaf, but `not(and(...))` stays a
+	* compound node, and `or(...)` has no bracket-dialect spelling at all.
+	*/ hasTargetCondition(condition) {
+		if (isFilters(condition)) {
+			if (condition.operator === FilterCompoundOperator.NOT) return false;
+			if (condition.operator === FilterCompoundOperator.OR) return condition.value.length > 0 && condition.value.every((child) => this.hasTargetCondition(child));
+			return condition.value.some((child) => this.hasTargetCondition(child));
+		}
+		if (isFilter(condition)) {
+			if (!SESSION_TOKEN_FILTER_KEYS.includes(condition.field)) return false;
+			if (condition.operator === FilterFieldOperator.EQUAL) return condition.value !== "" && condition.value !== null && typeof condition.value !== "undefined";
+			if (condition.operator === FilterFieldOperator.IN) return Array.isArray(condition.value) && condition.value.length > 0;
+			return false;
+		}
+		return false;
+	}
+	/**
+	* Schemaless decode — dialect detection only. The allow-list is enforced
+	* downstream by the schema-bound decode.
+	*/ static queryCodec = createURLCodec();
+};
+//#endregion
+export { SESSION_TOKEN_FILTER_KEYS, SessionTokenService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/session-token/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","createURLCodec","FilterCompoundOperator","FilterFieldOperator","and","eq","isFilter","isFilters","PermissionName","AbstractEntityService","appendQueryConditions","decodeQuery","sessionTokenSchema","SESSION_TOKEN_FILTER_KEYS","SessionTokenService","repository","tokenRepository","ctx","isOwnedBy","entity","actor","session","identity","sub","data","id","subKind","type","tokenRealmMatch","resourceRealmMatch","realmId","getMany","query","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","scoped","findMany","entities","meta","total","push","evaluate","ATTRIBUTES","getOne","loadOneForActor","delete","SESSION_DELETE","revoke","deleteMany","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","BAD_REQUEST","parameters","canDeleteAll","findAllByQuery","count","permission","findOneWithSessionById","at","Date","toISOString","revokeById","revokedAt","setInactive","Math","floor","expiresAt","getTime","queryCodec","decode","hasTargetCondition","filters","condition","operator","NOT","OR","value","length","every","child","some","includes","field","EQUAL","IN","Array","isArray"],"sources":["../../../../src/core/entities/session-token/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type { ICondition } from '@rapiq/core';\nimport {\n    FilterCompoundOperator,\n    FilterFieldOperator,\n    and,\n    eq,\n    isFilter,\n    isFilters,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session, SessionToken } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IOAuth2TokenRepository, ISessionTokenRepository  } from '../../oauth2/index.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { sessionTokenSchema } from './schema.ts';\nimport type { ISessionTokenService, SessionTokenDeleteManyResult } from './types.ts';\n\n/**\n * Filter keys that make a bulk revoke a TARGETED one. A query carrying none of\n * them is rejected rather than treated as \"everything\": unlike the session\n * bulk revoke, there is no meaningful self-service fallback here, so an\n * unrecognized filter must fail loudly instead of silently widening.\n */\nexport const SESSION_TOKEN_FILTER_KEYS = [\n    'id',\n    'sessionId',\n    'clientId',\n] as const;\n\nexport type SessionTokenServiceContext = {\n    repository: ISessionTokenRepository,\n    tokenRepository?: IOAuth2TokenRepository,\n};\n\nexport class SessionTokenService extends AbstractEntityService implements ISessionTokenService {\n    protected repository: ISessionTokenRepository;\n\n    protected tokenRepository?: IOAuth2TokenRepository;\n\n    constructor(ctx: SessionTokenServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.tokenRepository = ctx.tokenRepository;\n    }\n\n    /**\n     * A token row carries no subject of its own, so ownership resolves through\n     * the joined session. A row whose session did not load fails closed.\n     */\n    protected isOwnedBy(entity: SessionToken, actor: ActorContext): boolean {\n        const session = entity.session as Session | undefined;\n\n        return !!actor.identity &&\n            !!session &&\n            session.sub === actor.identity.data.id &&\n            session.subKind === actor.identity.type;\n    }\n\n    /**\n     * The realm the row belongs to, taken from its session. Absent when the\n     * session did not load, which leaves the realm factor neutral, so the\n     * per-row permission check below is what denies.\n     */\n    protected tokenRealmMatch(entity: SessionToken) {\n        const session = entity.session as Session | undefined;\n        if (!session) {\n            return {};\n        }\n\n        return this.resourceRealmMatch({ realmId: session.realmId });\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<SessionToken>> {\n        const parsed = await decodeQuery(query, { schema: sessionTokenSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // Self-service: mandatory ownership scope through the session,\n            // AND-injected so a client filter cannot displace it.\n            const scoped = appendQueryConditions(\n                parsed,\n                and(\n                    eq('session.sub', actor.identity!.data.id),\n                    eq('session.subKind', actor.identity!.type),\n                ),\n            );\n\n            return this.repository.findMany(scoped);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        const data: SessionToken[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.tokenRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<SessionToken> {\n        const entity = await this.loadOneForActor(id, actor, PermissionName.SESSION_READ);\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<SessionToken> {\n        const entity = await this.loadOneForActor(id, actor, PermissionName.SESSION_DELETE);\n\n        await this.revoke(entity);\n\n        return entity;\n    }\n\n    async deleteMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<SessionTokenDeleteManyResult> {\n        if (!actor.identity) {\n            throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n        }\n\n        if (!this.hasTargetFilter(query)) {\n            throw new AuthupError({\n                code: ErrorCode.BAD_REQUEST,\n                message: 'A bulk revoke must be scoped by id, sessionId or clientId.',\n            });\n        }\n\n        const parsed = await decodeQuery(query, {\n            schema: sessionTokenSchema,\n            parameters: ['filters'],\n            actor,\n        });\n\n        let canDeleteAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n        } catch {\n            canDeleteAll = false;\n        }\n\n        const scoped = canDeleteAll ? parsed : appendQueryConditions(\n            parsed,\n            and(\n                eq('session.sub', actor.identity.data.id),\n                eq('session.subKind', actor.identity.type),\n            ),\n        );\n\n        const entities = await this.repository.findAllByQuery(scoped);\n\n        let count = 0;\n        for (const entity of entities) {\n            if (!this.isOwnedBy(entity, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: entity,\n                            ...this.tokenRealmMatch(entity),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.revoke(entity);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    // -----------------------------------------------------\n\n    protected async loadOneForActor(\n        id: string,\n        actor: ActorContext,\n        permission: `${PermissionName}`,\n    ): Promise<SessionToken> {\n        const entity = await this.repository.findOneWithSessionById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: permission });\n            await actor.permissionEvaluator.evaluate({\n                name: permission,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.tokenRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    /**\n     * Revoke, not delete. The row is stamped and the jti is blocklisted with a\n     * TTL pinned to the token's real expiry, so an in-flight access token stops\n     * introspecting as active instead of surviving to its own `exp`.\n     */\n    protected async revoke(entity: SessionToken): Promise<void> {\n        const at = new Date().toISOString();\n\n        await this.repository.revokeById(entity.id, at);\n\n        // Stamp the in-memory row too: `delete()` returns this object as the\n        // response body, and without it a just-revoked token reports\n        // `revokedAt: null` until the client reads it again.\n        entity.revokedAt = at;\n\n        if (this.tokenRepository) {\n            await this.tokenRepository.setInactive(\n                entity.id,\n                Math.floor(new Date(entity.expiresAt).getTime() / 1000),\n            );\n        }\n    }\n\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        if (!isObject(query)) {\n            return false;\n        }\n\n        let parsed;\n        try {\n            parsed = SessionTokenService.queryCodec.decode(query);\n        } catch {\n            return false;\n        }\n\n        if (!parsed) {\n            return false;\n        }\n\n        return this.hasTargetCondition(parsed.filters);\n    }\n\n    /**\n     * Whether the condition BOUNDS the query to a target scope.\n     *\n     * The question is not \"does a target key appear somewhere\" but \"is the\n     * result set constrained by one\". Those differ, and the difference is a\n     * mass revoke:\n     *\n     * - `and` is bounded when ANY conjunct is: the others can only narrow it.\n     * - `or` is bounded only when EVERY branch is. `or(eq(id,x), eq(kind,access))`\n     *   names a target key and still selects every access token.\n     * - `not` is never a scope. A negation of a scoped predicate is its\n     *   complement, which is nearly everything.\n     *\n     * The expression dialect is what makes the last two reachable: rapiq\n     * collapses `not(eq(...))` into an `ne` leaf, but `not(and(...))` stays a\n     * compound node, and `or(...)` has no bracket-dialect spelling at all.\n     */\n    protected hasTargetCondition(condition: ICondition): boolean {\n        if (isFilters(condition)) {\n            if (condition.operator === FilterCompoundOperator.NOT) {\n                return false;\n            }\n\n            if (condition.operator === FilterCompoundOperator.OR) {\n                return condition.value.length > 0 &&\n                    condition.value.every((child) => this.hasTargetCondition(child));\n            }\n\n            return condition.value.some((child) => this.hasTargetCondition(child));\n        }\n\n        if (isFilter(condition)) {\n            if (!(SESSION_TOKEN_FILTER_KEYS as readonly string[]).includes(condition.field)) {\n                return false;\n            }\n\n            // The OPERATOR decides, not just the field. A negation or a range\n            // names a target key while selecting nearly every row.\n            //\n            // Note this guard is inverted relative to the session bulk revoke,\n            // which was the model for it: there, failing the check falls back\n            // to the SELF-service path, so a permissive check is the safe\n            // direction. Here, passing it IS the destructive path.\n            if (condition.operator === FilterFieldOperator.EQUAL) {\n                return condition.value !== '' &&\n                    condition.value !== null &&\n                    typeof condition.value !== 'undefined';\n            }\n\n            if (condition.operator === FilterFieldOperator.IN) {\n                // An empty membership set is not a scope: it decodes to a\n                // predicate nothing satisfies, but it would still authorize the\n                // admin path alongside whatever else the query carries.\n                return Array.isArray(condition.value) && condition.value.length > 0;\n            }\n\n            return false;\n        }\n\n        return false;\n    }\n\n    /**\n     * Schemaless decode — dialect detection only. The allow-list is enforced\n     * downstream by the schema-bound decode.\n     */\n    protected static queryCodec = createURLCodec();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAmCA,MAAakB,4BAA4B;CACrC;CACA;CACA;AACH;AAOD,IAAaC,sBAAb,MAAaA,4BAA4BL,sBAAAA;CAC3BM;CAEAC;CAEV,YAAYC,KAAiC;EACzC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,UAAoBG,QAAsBC,OAA8B;EACpE,MAAMC,UAAUF,OAAOE;EAEvB,OAAO,CAAC,CAACD,MAAME,YACX,CAAC,CAACD,WACFA,QAAQE,QAAQH,MAAME,SAASE,KAAKC,MACpCJ,QAAQK,YAAYN,MAAME,SAASK;CAC3C;;;;;IAOA,gBAA0BR,QAAsB;EAC5C,MAAME,UAAUF,OAAOE;EACvB,IAAI,CAACA,SACD,OAAO,CAAC;EAGZ,OAAO,KAAKQ,mBAAmB,EAAEC,SAAST,QAAQS,QAAQ,CAAA;CAC9D;CAEA,MAAMC,QACFC,OACAZ,OACqD;EACrD,MAAMa,SAAS,MAAMtB,YAAYqB,OAAO;GAAEE,QAAQtB;GAAoBQ;EAAM,CAAA;EAE5E,IAAIe,aAAa;EACjB,IAAI;GACA,MAAMf,MAAMgB,oBAAoBC,YAAY,EAAEC,MAAM9B,eAAe+B,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACpB,MAAME,UACP,MAAMkB;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAAY;GAGb,MAAMM,SAAS/B,sBACXuB,QACA7B,IACIC,GAAG,eAAee,MAAME,SAAUE,KAAKC,EAAE,GACzCpB,GAAG,mBAAmBe,MAAME,SAAUK,IAAI,CAAA,CAAA;GAIlD,OAAO,KAAKZ,WAAW2B,SAASD,MAAAA;EACpC;EAEA,MAAM,EAAEjB,MAAMmB,UAAUC,SAAS,MAAM,KAAK7B,WAAW2B,SAAST,MAAAA;EAEhE,MAAMT,OAAuB,CAAA;EAC7B,IAAI,EAAEqB,UAAUD;EAEhB,KAAK,MAAMzB,UAAUwB,UAAU;GAC3B,IAAI,KAAKzB,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BI,KAAKsB,KAAK3B,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMgB,oBAAoBW,SAAS;KACrCT,MAAM9B,eAAe+B;KACrBf,MAAM5B,iBAAiB;OAClBD,kBAAkBqD,aAAa7B;MAChC,GAAG,KAAKS,gBAAgBT,MAAAA;KAC5B,CAAA;IACJ,CAAA;IACAK,KAAKsB,KAAK3B,MAAAA;GACd,QAAQ;IACJ0B,SAAS;GACb;EACJ;EAEA,OAAO;GACHrB;GACAoB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMI,OAAOxB,IAAYL,OAA4C;EAGjE,OAAOD,MAFc,KAAK+B,gBAAgBzB,IAAIL,OAAOZ,eAAe+B,YAAY;CAGpF;CAEA,MAAMY,OAAO1B,IAAYL,OAA4C;EACjE,MAAMD,SAAS,MAAM,KAAK+B,gBAAgBzB,IAAIL,OAAOZ,eAAe4C,cAAc;EAElF,MAAM,KAAKC,OAAOlC,MAAAA;EAElB,OAAOA;CACX;CAEA,MAAMmC,WACFtB,OACAZ,OACqC;EACrC,IAAI,CAACA,MAAME,UACP,MAAM,IAAIzB,YAAY;GAAE0D,MAAMxD,UAAUyD;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,CAAC,KAAKC,gBAAgB1B,KAAAA,GACtB,MAAM,IAAInC,YAAY;GAClB0D,MAAMxD,UAAU4D;GAChBF,SAAS;EACb,CAAA;EAGJ,MAAMxB,SAAS,MAAMtB,YAAYqB,OAAO;GACpCE,QAAQtB;GACRgD,YAAY,CAAC,SAAU;GACvBxC;EACJ,CAAA;EAEA,IAAIyC,eAAe;EACnB,IAAI;GACA,MAAMzC,MAAMgB,oBAAoBC,YAAY,EAAEC,MAAM9B,eAAe4C,eAAe,CAAA;EACtF,QAAQ;GACJS,eAAe;EACnB;EAEA,MAAMpB,SAASoB,eAAe5B,SAASvB,sBACnCuB,QACA7B,IACIC,GAAG,eAAee,MAAME,SAASE,KAAKC,EAAE,GACxCpB,GAAG,mBAAmBe,MAAME,SAASK,IAAI,CAAA,CAAA;EAIjD,MAAMgB,WAAW,MAAM,KAAK5B,WAAW+C,eAAerB,MAAAA;EAEtD,IAAIsB,QAAQ;EACZ,KAAK,MAAM5C,UAAUwB,UAAU;GAC3B,IAAI,CAAC,KAAKzB,UAAUC,QAAQC,KAAAA,GACxB,IAAI;IACA,MAAMA,MAAMgB,oBAAoBW,SAAS;KACrCT,MAAM9B,eAAe4C;KACrB5B,MAAM5B,iBAAiB;OAClBD,kBAAkBqD,aAAa7B;MAChC,GAAG,KAAKS,gBAAgBT,MAAAA;KAC5B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKkC,OAAOlC,MAAAA;GAClB4C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAIA,MAAgBb,gBACZzB,IACAL,OACA4C,YACqB;EACrB,MAAM7C,SAAS,MAAM,KAAKJ,WAAWkD,uBAAuBxC,EAAAA;EAE5D,IAAI,CAACN,QACD,MAAM,IAAIrB,oBAAAA;EAGd,IAAI,CAAC,KAAKoB,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMgB,oBAAoBC,YAAY,EAAEC,MAAM0B,WAAW,CAAA;GAC/D,MAAM5C,MAAMgB,oBAAoBW,SAAS;IACrCT,MAAM0B;IACNxC,MAAM5B,iBAAiB;MAClBD,kBAAkBqD,aAAa7B;KAChC,GAAG,KAAKS,gBAAgBT,MAAAA;IAC5B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;;;;;IAOA,MAAgBkC,OAAOlC,QAAqC;EACxD,MAAM+C,sBAAK,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAEjC,MAAM,KAAKrD,WAAWsD,WAAWlD,OAAOM,IAAIyC,EAAAA;EAK5C/C,OAAOmD,YAAYJ;EAEnB,IAAI,KAAKlD,iBACL,MAAM,KAAKA,gBAAgBuD,YACvBpD,OAAOM,IACP+C,KAAKC,MAAM,IAAIN,KAAKhD,OAAOuD,SAAS,CAAA,CAAEC,QAAO,IAAK,GAAA,CAAA;CAG9D;CAEUjB,gBAAgB1B,OAAsC;EAC5D,IAAI,CAAChC,SAASgC,KAAAA,GACV,OAAO;EAGX,IAAIC;EACJ,IAAI;GACAA,SAASnB,oBAAoB8D,WAAWC,OAAO7C,KAAAA;EACnD,QAAQ;GACJ,OAAO;EACX;EAEA,IAAI,CAACC,QACD,OAAO;EAGX,OAAO,KAAK6C,mBAAmB7C,OAAO8C,OAAO;CACjD;;;;;;;;;;;;;;;;;IAmBA,mBAA6BC,WAAgC;EACzD,IAAIzE,UAAUyE,SAAAA,GAAY;GACtB,IAAIA,UAAUC,aAAa/E,uBAAuBgF,KAC9C,OAAO;GAGX,IAAIF,UAAUC,aAAa/E,uBAAuBiF,IAC9C,OAAOH,UAAUI,MAAMC,SAAS,KAC5BL,UAAUI,MAAME,OAAOC,UAAU,KAAKT,mBAAmBS,KAAAA,CAAAA;GAGjE,OAAOP,UAAUI,MAAMI,MAAMD,UAAU,KAAKT,mBAAmBS,KAAAA,CAAAA;EACnE;EAEA,IAAIjF,SAAS0E,SAAAA,GAAY;GACrB,IAAI,CAAC,0BAAiDS,SAAST,UAAUU,KAAK,GAC1E,OAAO;GAUX,IAAIV,UAAUC,aAAa9E,oBAAoBwF,OAC3C,OAAOX,UAAUI,UAAU,MACvBJ,UAAUI,UAAU,QACpB,OAAOJ,UAAUI,UAAU;GAGnC,IAAIJ,UAAUC,aAAa9E,oBAAoByF,IAI3C,OAAOC,MAAMC,QAAQd,UAAUI,KAAK,KAAKJ,UAAUI,MAAMC,SAAS;GAGtE,OAAO;EACX;EAEA,OAAO;CACX;;;;IAMA,OAAiBT,aAAa3E,eAAAA;AAClC"}

package/dist/core/entities/session-token/types.d.ts

@@ -0,0 +1,37 @@
+import type { SessionToken } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionTokenDeleteManyResult = {
+    count: number;
+};
+export interface ISessionTokenService {
+    /**
+     * List issued tokens. An actor without `SESSION_READ` is scoped to the
+     * tokens of its own sessions; an actor with it sees what its realm reach
+     * permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<SessionToken>>;
+    /**
+     * Read one token row by its jti. Own tokens need no permission.
+     */
+    getOne(id: string, actor: ActorContext): Promise<SessionToken>;
+    /**
+     * REVOKE one token. Own tokens need no permission.
+     *
+     * Revoke, not delete: the row is stamped `revokedAt` and the jti is
+     * blocklisted in cache. Dropping the row would block refresh (the row is
+     * the authority for refresh validity since plan 016) while leaving an
+     * already-issued access token verifying against a stateless JWKS adapter
+     * until its own expiry.
+     */
+    delete(id: string, actor: ActorContext): Promise<SessionToken>;
+    /**
+     * Revoke every token matching a query. This is what "sign out of this
+     * application" needs: scoped to one client it leaves the session alive, so
+     * the other applications riding it stay signed in.
+     *
+     * Requires a recognized target filter, so it can never degenerate into an
+     * unscoped mass revoke.
+     */
+    deleteMany(query: Record<string, any>, actor: ActorContext): Promise<SessionTokenDeleteManyResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/session-token/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAEhH;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE/D;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE/D;;;;;;;OAOG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CACtG"}

package/dist/core/entities/session-token/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/trust-anchor/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAkB5B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDA0B5B,CAAC"}

package/dist/core/entities/trust-anchor/schema.mjs

@@ -8,6 +8,14 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const trustAnchorSchema = defineSchema({
 	name: EntityType.TRUST_ANCHOR,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["enabled"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"name",
@@ -17,23 +25,29 @@ const trustAnchorSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"name",
-		"enabled",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"enabled",
+			"realmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"enabled",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"enabled",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/trust-anchor/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","trustAnchorSchema","name","TRUST_ANCHOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const trustAnchorSchema = defineSchema<TrustAnchor>({\n    name: EntityType.TRUST_ANCHOR,\n    fields: {\n        allowed: [\n            'id',\n            'name',\n            'certificate',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'enabled', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'enabled', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,oBAAoBN,aAA0B;CACvDO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAW;CAAU,EAAC;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAW;EAAa;CAAY,EAAC;CACrEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","trustAnchorSchema","name","TRUST_ANCHOR","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const trustAnchorSchema = defineSchema<TrustAnchor>({\n    name: EntityType.TRUST_ANCHOR,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['enabled'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'name',\n            'certificate',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'enabled', 'realmId'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'name', 'enabled', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,oBAAoBN,aAA0B;CACvDO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAC;GAAM;GAAQ;GAAW;EAAU;EAAEE,SAAS;CAAK;CACxEC,WAAW;EAAEH,SAAS,CAAC,OAAQ;EAAEI,UAAUb,wBAAwBC,aAAAA;CAAe;CAClFa,OAAO;EAAEL,SAAS;GAAC;GAAM;GAAQ;GAAW;GAAa;EAAY;EAAEE,SAAS;CAAK;CACrFI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/trust-anchor/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EACR,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAChC,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,6BAAkC,GAC5C,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAqDjD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EACR,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAChC,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,6BAAkC,GAC5C,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAqDjD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA2BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}

package/dist/core/entities/trust-anchor/service.mjs

@@ -167,6 +167,7 @@ var TrustAnchorService = class extends AbstractEntityService {
 			actorType: actor.identity?.type ?? null,
 			actorId: actor.identity?.data.id ?? null,
 			actorName: actor.identity?.data.name ?? null,
+			sessionId: requestContext?.sessionId ?? null,
 			requestPath: requestContext?.requestPath ?? null,
 			requestMethod: requestContext?.requestMethod ?? null,
 			requestIpAddress: requestContext?.requestIpAddress ?? null,