npm - @authup/server-core - Versions diffs - 1.0.0-beta.61 → 1.0.0-beta.63 - Mend

@authup/server-core 1.0.0-beta.61 → 1.0.0-beta.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (216) hide show

package/dist/app/modules/oauth2/constants.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.mjs","names":["TypedToken","OAuth2InjectionToken","ClientRepository","ScopeRepository","AuthorizationCodeIssuer","AuthorizationCodeRepository","AuthorizationCodeVerifier","AuthorizationStateManager","AuthorizationCodeRequestVerifier","AuthorizationStateRepository","KeyStore","AccessTokenIssuer","MfaTokenIssuer","OpenIDTokenIssuer","RefreshTokenIssuer","TokenRepository","SessionTokenRepository","ConsentRepository","TokenRevoker","TokenSigner","TokenVerifier"],"sources":["../../../../src/app/modules/oauth2/constants.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { TypedToken } from 'eldin';\nimport type {\n IConsentRepository,\n IKeyRepository,\n IKeyStore,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRepository,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationCodeVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2AuthorizeStateRepository,\n IOAuth2ClientRepository,\n IOAuth2OpenIDTokenIssuer,\n IOAuth2ScopeRepository,\n IOAuth2TokenIssuer,\n IOAuth2TokenRepository,\n IOAuth2TokenRevoker,\n IOAuth2TokenSigner,\n IOAuth2TokenVerifier,\n ISessionTokenRepository,\n} from '../../../core/index.ts';\n\nexport const OAuth2InjectionToken = {\n ClientRepository: new TypedToken<IOAuth2ClientRepository>('ClientRepository'),\n ScopeRepository: new TypedToken<IOAuth2ScopeRepository>('ScopeRepository'),\n\n AuthorizationCodeIssuer: new TypedToken<IOAuth2AuthorizationCodeIssuer>('AuthorizationCodeIssuer'),\n AuthorizationCodeRepository: new TypedToken<IOAuth2AuthorizationCodeRepository>('AuthorizationCodeRepository'),\n AuthorizationCodeVerifier: new TypedToken<IOAuth2AuthorizationCodeVerifier>('AuthorizationCodeVerifier'),\n AuthorizationStateManager: new TypedToken<IOAuth2AuthorizationStateManager>('AuthorizationStateManager'),\n AuthorizationCodeRequestVerifier: new TypedToken<IOAuth2AuthorizationCodeRequestVerifier>('AuthorizationCodeRequestVerifier'),\n\n AuthorizationStateRepository: new TypedToken<IOAuth2AuthorizeStateRepository>('AuthorizationStateRepository'),\n\n /\n One adapter instance serving both key ports: the material-resolving\n * store (signer / verifier / realm cipher) and the entity CRUD surface\n * (key management API).\n */\n KeyStore: new TypedToken<IKeyStore & IKeyRepository>('KeyStore'),\n\n AccessTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('AccessTokenIssuer'),\n MfaTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('MfaTokenIssuer'),\n OpenIDTokenIssuer: new TypedToken<IOAuth2OpenIDTokenIssuer>('OpenIDTokenIssuer'),\n RefreshTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('RefreshTokenIssuer'),\n\n TokenRepository: new TypedToken<IOAuth2TokenRepository>('TokenRepository'),\n SessionTokenRepository: new TypedToken<ISessionTokenRepository>('SessionTokenRepository'),\n ConsentRepository: new TypedToken<IConsentRepository>('OAuth2ConsentRepository'),\n TokenRevoker: new TypedToken<IOAuth2TokenRevoker>('TokenRevoker'),\n TokenSigner: new TypedToken<IOAuth2TokenSigner>('TokenSigner'),\n TokenVerifier: new TypedToken<IOAuth2TokenVerifier>('TokenVerifier'),\n} as const;\n"],"mappings":";;;;;~~AA6BA~~,MAAaC,uBAAuB;CAChCC,kBAAkB,IAAIF,WAAoC,kBAAA;CAC1DG,iBAAiB,IAAIH,WAAmC,iBAAA;CAExDI,yBAAyB,IAAIJ,WAA2C,yBAAA;CACxEK,6BAA6B,IAAIL,WAA+C,6BAAA;CAChFM,2BAA2B,IAAIN,WAA6C,2BAAA;CAC5EO,2BAA2B,IAAIP,WAA6C,2BAAA;CAC5EQ,kCAAkC,IAAIR,WAAoD,kCAAA;CAE1FS,8BAA8B,IAAIT,WAA4C,8BAAA;;;;;~~IAO9EU~~,UAAU,~~IAAIV~~,WAAuC,UAAA;~~CAErDW~~,mBAAmB,~~IAAIX~~,WAA+B,mBAAA;~~CACtDY~~,gBAAgB,~~IAAIZ~~,WAA+B,gBAAA;~~CACnDa~~,mBAAmB,~~IAAIb~~,WAAqC,mBAAA;~~CAC5Dc~~,oBAAoB,~~IAAId~~,WAA+B,oBAAA;~~CAEvDe~~,iBAAiB,~~IAAIf~~,WAAmC,iBAAA;~~CACxDgB~~,wBAAwB,~~IAAIhB~~,WAAoC,wBAAA;~~CAChEiB~~,mBAAmB,~~IAAIjB~~,WAA+B,yBAAA;~~CACtDkB~~,cAAc,~~IAAIlB~~,WAAgC,cAAA;~~CAClDmB~~,aAAa,~~IAAInB~~,WAA+B,aAAA;~~CAChDoB~~,eAAe,~~IAAIpB~~,WAAiC,eAAA;AACxD"}
1	+ {"version":3,"file":"constants.mjs","names":["TypedToken","OAuth2InjectionToken","ClientRepository","ScopeRepository","AuthorizationCodeIssuer","AuthorizationCodeRepository","AuthorizationCodeVerifier","AuthorizationStateManager","AuthorizationCodeRequestVerifier","AuthorizationStateRepository","FederatedLoginStore","KeyStore","AccessTokenIssuer","MfaTokenIssuer","OpenIDTokenIssuer","RefreshTokenIssuer","TokenRepository","SessionTokenRepository","ConsentRepository","TokenRevoker","TokenSigner","TokenVerifier"],"sources":["../../../../src/app/modules/oauth2/constants.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { TypedToken } from 'eldin';\nimport type {\n IConsentRepository,\n IKeyRepository,\n IKeyStore,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRepository,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationCodeVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2AuthorizeStateRepository,\n IOAuth2ClientRepository,\n IOAuth2FederatedLoginStore,\n IOAuth2OpenIDTokenIssuer,\n IOAuth2ScopeRepository,\n IOAuth2TokenIssuer,\n IOAuth2TokenRepository,\n IOAuth2TokenRevoker,\n IOAuth2TokenSigner,\n IOAuth2TokenVerifier,\n ISessionTokenRepository,\n} from '../../../core/index.ts';\n\nexport const OAuth2InjectionToken = {\n ClientRepository: new TypedToken<IOAuth2ClientRepository>('ClientRepository'),\n ScopeRepository: new TypedToken<IOAuth2ScopeRepository>('ScopeRepository'),\n\n AuthorizationCodeIssuer: new TypedToken<IOAuth2AuthorizationCodeIssuer>('AuthorizationCodeIssuer'),\n AuthorizationCodeRepository: new TypedToken<IOAuth2AuthorizationCodeRepository>('AuthorizationCodeRepository'),\n AuthorizationCodeVerifier: new TypedToken<IOAuth2AuthorizationCodeVerifier>('AuthorizationCodeVerifier'),\n AuthorizationStateManager: new TypedToken<IOAuth2AuthorizationStateManager>('AuthorizationStateManager'),\n AuthorizationCodeRequestVerifier: new TypedToken<IOAuth2AuthorizationCodeRequestVerifier>('AuthorizationCodeRequestVerifier'),\n\n AuthorizationStateRepository: new TypedToken<IOAuth2AuthorizeStateRepository>('AuthorizationStateRepository'),\n\n FederatedLoginStore: new TypedToken<IOAuth2FederatedLoginStore>('FederatedLoginStore'),\n\n /\n One adapter instance serving both key ports: the material-resolving\n * store (signer / verifier / realm cipher) and the entity CRUD surface\n * (key management API).\n */\n KeyStore: new TypedToken<IKeyStore & IKeyRepository>('KeyStore'),\n\n AccessTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('AccessTokenIssuer'),\n MfaTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('MfaTokenIssuer'),\n OpenIDTokenIssuer: new TypedToken<IOAuth2OpenIDTokenIssuer>('OpenIDTokenIssuer'),\n RefreshTokenIssuer: new TypedToken<IOAuth2TokenIssuer>('RefreshTokenIssuer'),\n\n TokenRepository: new TypedToken<IOAuth2TokenRepository>('TokenRepository'),\n SessionTokenRepository: new TypedToken<ISessionTokenRepository>('SessionTokenRepository'),\n ConsentRepository: new TypedToken<IConsentRepository>('OAuth2ConsentRepository'),\n TokenRevoker: new TypedToken<IOAuth2TokenRevoker>('TokenRevoker'),\n TokenSigner: new TypedToken<IOAuth2TokenSigner>('TokenSigner'),\n TokenVerifier: new TypedToken<IOAuth2TokenVerifier>('TokenVerifier'),\n} as const;\n"],"mappings":";;;;;AA8BA,MAAaC,uBAAuB;CAChCC,kBAAkB,IAAIF,WAAoC,kBAAA;CAC1DG,iBAAiB,IAAIH,WAAmC,iBAAA;CAExDI,yBAAyB,IAAIJ,WAA2C,yBAAA;CACxEK,6BAA6B,IAAIL,WAA+C,6BAAA;CAChFM,2BAA2B,IAAIN,WAA6C,2BAAA;CAC5EO,2BAA2B,IAAIP,WAA6C,2BAAA;CAC5EQ,kCAAkC,IAAIR,WAAoD,kCAAA;CAE1FS,8BAA8B,IAAIT,WAA4C,8BAAA;CAE9EU,qBAAqB,IAAIV,WAAuC,qBAAA;;;;;IAOhEW,UAAU,IAAIX,WAAuC,UAAA;CAErDY,mBAAmB,IAAIZ,WAA+B,mBAAA;CACtDa,gBAAgB,IAAIb,WAA+B,gBAAA;CACnDc,mBAAmB,IAAId,WAAqC,mBAAA;CAC5De,oBAAoB,IAAIf,WAA+B,oBAAA;CAEvDgB,iBAAiB,IAAIhB,WAAmC,iBAAA;CACxDiB,wBAAwB,IAAIjB,WAAoC,wBAAA;CAChEkB,mBAAmB,IAAIlB,WAA+B,yBAAA;CACtDmB,cAAc,IAAInB,WAAgC,cAAA;CAClDoB,aAAa,IAAIpB,WAA+B,aAAA;CAChDqB,eAAe,IAAIrB,WAAiC,eAAA;AACxD"}

package/dist/app/modules/oauth2/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;~~AAiCrC~~,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC;~~CA2NrD~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/oauth2/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAkCrC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC;CAmOrD"}

package/dist/app/modules/oauth2/module.mjs CHANGED Viewed

@@ -32,6 +32,7 @@ import { OAuth2AuthorizationCodeRepository } from "./repositories/authorize/code
 import { OAuth2AuthorizationStateRepository } from "./repositories/authorize/state/repository.mjs";
 import { OAuth2ClientRepository } from "./repositories/client/repository.mjs";
 import { ConsentRepositoryAdapter } from "./repositories/consent/repository.mjs";
+import { OAuth2FederatedLoginStore } from "./repositories/federated-login/store.mjs";
 import { OAuth2ScopeRepository } from "./repositories/scope/repository.mjs";
 import { SessionTokenRepositoryAdapter } from "./repositories/session-token/repository.mjs";
 import { OAuth2TokenRepository } from "./repositories/token/repository.mjs";
@@ -107,6 +108,10 @@ var OAuth2Module = class {
 			const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);
 			return new OAuth2AuthorizationStateManager(stateRepository);
 		} });
+		container.register(OAuth2InjectionToken.FederatedLoginStore, { useFactory: (c) => {
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2FederatedLoginStore(cache);
+		} });
 		container.register(OAuth2InjectionToken.TokenRevoker, { useFactory: (c) => {
 			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
 			const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);

package/dist/app/modules/oauth2/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n ConsentRepositoryAdapter,\n OAuth2AuthorizationCodeRepository,\n OAuth2AuthorizationStateRepository,\n OAuth2ClientRepository,\n OAuth2ScopeRepository,\n OAuth2TokenRepository,\n SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n OAuth2AccessTokenIssuer,\n OAuth2AuthorizationCodeIssuer,\n OAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeVerifier,\n OAuth2AuthorizationStateManager,\n OAuth2MfaTokenIssuer,\n OAuth2OpenIDTokenIssuer,\n OAuth2RefreshTokenIssuer,\n OAuth2TokenRevoker,\n OAuth2TokenSigner,\n OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n constructor() {\n this.name = ModuleName.OAUTH2;\n this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n }\n\n async setup(container: IContainer) : Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n container.register(OAuth2InjectionToken.ClientRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n return new OAuth2ClientRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.ScopeRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n return new OAuth2ScopeRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationCodeRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationStateRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.TokenRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2TokenRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.SessionTokenRepository, {\n useFactory: (c) => new SessionTokenRepositoryAdapter(\n c.resolve(DatabaseInjectionKey.DataSource),\n ),\n });\n\n container.register(OAuth2InjectionToken.ConsentRepository, {\n useFactory: (c) => new ConsentRepositoryAdapter(\n c.resolve(DatabaseInjectionKey.DataSource),\n ),\n });\n\n container.register(OAuth2InjectionToken.KeyStore, {\n // todo: cache use here\n useFactory: (c) => {\n const config = c.resolve(ConfigInjectionKey);\n\n let secretsCipher : SymmetricCipher \| null = null;\n if (config.secretsEncryptionKey) {\n secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n } else if (config.env === 'production') {\n // parity posture without a KEK (Keycloak/authentik store key\n // material plaintext too) — but say so once, loudly.\n const logger = c.resolve(LoggerInjectionKey);\n logger.warn(\n 'The realm key store persists key material unwrapped; ' +\n 'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n );\n }\n\n return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n },\n });\n\n container.register(OAuth2InjectionToken.TokenSigner, {\n useFactory: (c) => {\n const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n return new OAuth2TokenSigner(keyStore);\n },\n });\n\n // authorization code issuer\n container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeIssuer(\n codeRepository,\n {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n },\n );\n },\n });\n container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeVerifier(codeRepository);\n },\n });\n\n // authorization code request verifier\n container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n useFactory: (c) => {\n const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n return new OAuth2AuthorizationCodeRequestVerifier({\n clientRepository,\n scopeRepository: clientScopeRepository,\n });\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n useFactory: (c) => {\n const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n return new OAuth2AuthorizationStateManager(stateRepository);\n },\n });\n\n // token revoker\n container.register(OAuth2InjectionToken.TokenRevoker, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n },\n });\n\n // token verifier\n container.register(OAuth2InjectionToken.TokenVerifier, {\n useFactory: (c) => {\n const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n return new OAuth2TokenVerifier(keyStore, tokenRepository);\n },\n });\n\n // access token issuer\n container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n return new OAuth2AccessTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n identityRoleProvider,\n sessionTokenRepository,\n );\n },\n });\n\n // mfa login-ticket issuer\n container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n return new OAuth2MfaTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.mfaTicketMaxAge,\n issuer: config.publicUrl,\n },\n );\n },\n });\n\n // refresh token issuer\n container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n return new OAuth2RefreshTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenRefreshMaxAge,\n issuer: config.publicUrl,\n },\n sessionTokenRepository,\n );\n },\n });\n\n // open-id token issuer\n container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n useFactory: (c) => {\n const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n return new OAuth2OpenIDTokenIssuer({\n repository,\n signer,\n\n identityResolver,\n\n options: {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n });\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAkCf,YAAAA;GACvD,OAAO,IAAIlB,uBAAuBsC,UAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAuCd,iBAAAA;GAC5D,OAAO,IAAIlB,sBAAsBqC,UAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAII,kCAAkC2C,KAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAIK,mCAAmC0C,KAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAIQ,sBAAsBuC,KAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,OAAO,IAAIjC,kBAAkBwC,QAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIlC,8BACPkD,gBACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIhC,gCAAgCgD,cAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GACT,MAAMwB,mBAAmBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAAgB;GACxE,MAAM2B,wBAAwBzB,EAAEJ,QAAQjB,qBAAqBuB,eAAe;GAE5E,OAAO,IAAIhC,uCAAuC;IAC9CsD;IACAE,iBAAiBD;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GACT,MAAM4B,kBAAkB5B,EAAEJ,QAAQjB,qBAAqB0B,4BAA4B;GAEnF,OAAO,IAAIjC,gCAAgCwD,eAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMyB,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAI/B,mBAAmBsD,iBAAiBC,sBAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,MAAMoB,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GAEtE,OAAO,IAAI5B,oBAAoBuC,UAAUa,eAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAE9D,OAAO,IAAI3C,qBACPyD,iBACAI,aACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACjE,MAAMsC,SAAS5C,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GACzD,MAAM6B,mBAAmB7C,EAAEJ,QAAQhB,qBAAqBkE,QAAQ;GAEhE,OAAO,IAAIxE,wBAAwB;IAC/B2B;IACA2C;IAEAC;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2FederatedLoginStore","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","FederatedLoginStore","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n ConsentRepositoryAdapter,\n OAuth2AuthorizationCodeRepository,\n OAuth2AuthorizationStateRepository,\n OAuth2ClientRepository,\n OAuth2FederatedLoginStore,\n OAuth2ScopeRepository,\n OAuth2TokenRepository,\n SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n OAuth2AccessTokenIssuer,\n OAuth2AuthorizationCodeIssuer,\n OAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeVerifier,\n OAuth2AuthorizationStateManager,\n OAuth2MfaTokenIssuer,\n OAuth2OpenIDTokenIssuer,\n OAuth2RefreshTokenIssuer,\n OAuth2TokenRevoker,\n OAuth2TokenSigner,\n OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n constructor() {\n this.name = ModuleName.OAUTH2;\n this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n }\n\n async setup(container: IContainer) : Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n container.register(OAuth2InjectionToken.ClientRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n return new OAuth2ClientRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.ScopeRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n return new OAuth2ScopeRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationCodeRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationStateRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.TokenRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2TokenRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.SessionTokenRepository, {\n useFactory: (c) => new SessionTokenRepositoryAdapter(\n c.resolve(DatabaseInjectionKey.DataSource),\n ),\n });\n\n container.register(OAuth2InjectionToken.ConsentRepository, {\n useFactory: (c) => new ConsentRepositoryAdapter(\n c.resolve(DatabaseInjectionKey.DataSource),\n ),\n });\n\n container.register(OAuth2InjectionToken.KeyStore, {\n // todo: cache use here\n useFactory: (c) => {\n const config = c.resolve(ConfigInjectionKey);\n\n let secretsCipher : SymmetricCipher \| null = null;\n if (config.secretsEncryptionKey) {\n secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n } else if (config.env === 'production') {\n // parity posture without a KEK (Keycloak/authentik store key\n // material plaintext too) — but say so once, loudly.\n const logger = c.resolve(LoggerInjectionKey);\n logger.warn(\n 'The realm key store persists key material unwrapped; ' +\n 'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n );\n }\n\n return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n },\n });\n\n container.register(OAuth2InjectionToken.TokenSigner, {\n useFactory: (c) => {\n const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n return new OAuth2TokenSigner(keyStore);\n },\n });\n\n // authorization code issuer\n container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeIssuer(\n codeRepository,\n {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n },\n );\n },\n });\n container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeVerifier(codeRepository);\n },\n });\n\n // authorization code request verifier\n container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n useFactory: (c) => {\n const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n return new OAuth2AuthorizationCodeRequestVerifier({\n clientRepository,\n scopeRepository: clientScopeRepository,\n });\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n useFactory: (c) => {\n const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n return new OAuth2AuthorizationStateManager(stateRepository);\n },\n });\n\n container.register(OAuth2InjectionToken.FederatedLoginStore, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n\n return new OAuth2FederatedLoginStore(cache);\n },\n });\n\n // token revoker\n container.register(OAuth2InjectionToken.TokenRevoker, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n },\n });\n\n // token verifier\n container.register(OAuth2InjectionToken.TokenVerifier, {\n useFactory: (c) => {\n const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n return new OAuth2TokenVerifier(keyStore, tokenRepository);\n },\n });\n\n // access token issuer\n container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n return new OAuth2AccessTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n identityRoleProvider,\n sessionTokenRepository,\n );\n },\n });\n\n // mfa login-ticket issuer\n container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n return new OAuth2MfaTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.mfaTicketMaxAge,\n issuer: config.publicUrl,\n },\n );\n },\n });\n\n // refresh token issuer\n container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n return new OAuth2RefreshTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenRefreshMaxAge,\n issuer: config.publicUrl,\n },\n sessionTokenRepository,\n );\n },\n });\n\n // open-id token issuer\n container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n useFactory: (c) => {\n const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n return new OAuth2OpenIDTokenIssuer({\n repository,\n signer,\n\n identityResolver,\n\n options: {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n });\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAa8B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO7B,WAAW+B;EACvB,KAAKD,eAAe;GAAC9B,WAAWgC;GAAUhC,WAAWiC;GAAOjC,WAAWkC;GAAQlC,WAAWmC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAkCf,YAAAA;GACvD,OAAO,IAAInB,uBAAuBuC,UAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAuCd,iBAAAA;GAC5D,OAAO,IAAIlB,sBAAsBqC,UAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQxC,iBAAAA;GACxB,OAAO,IAAII,kCAAkC4C,KAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQxC,iBAAAA;GACxB,OAAO,IAAIK,mCAAmC2C,KAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQxC,iBAAAA;GACxB,OAAO,IAAIS,sBAAsBuC,KAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIzC,yBACnByC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIxD,gBAAgBwC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQtC,kBACzBwD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,OAAO,IAAIjC,kBAAkBwC,QAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIlC,8BACPkD,gBACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIhC,gCAAgCgD,cAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GACT,MAAMwB,mBAAmBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAAgB;GACxE,MAAM2B,wBAAwBzB,EAAEJ,QAAQjB,qBAAqBuB,eAAe;GAE5E,OAAO,IAAIhC,uCAAuC;IAC9CsD;IACAE,iBAAiBD;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GACT,MAAM4B,kBAAkB5B,EAAEJ,QAAQjB,qBAAqB0B,4BAA4B;GAEnF,OAAO,IAAIjC,gCAAgCwD,eAAAA;EAC/C,EACJ,CAAA;EAEAlC,UAAUG,SAASlB,qBAAqBkD,qBAAqB,EACzD9B,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQxC,iBAAAA;GAExB,OAAO,IAAIO,0BAA0ByC,KAAAA;EACzC,EACJ,CAAA;EAGAV,UAAUG,SAASlB,qBAAqBmD,cAAc,EAClD/B,aAAaC,MAAAA;GACT,MAAM+B,kBAAkB/B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM0B,yBAAyBhC,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAI/B,mBAAmBuD,iBAAiBC,sBAAAA;EACnD,EACJ,CAAA;EAGAtC,UAAUG,SAASlB,qBAAqBsD,eAAe,EACnDlC,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,MAAMqB,kBAAkB/B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GAEtE,OAAO,IAAI5B,oBAAoBuC,UAAUc,eAAAA;EAC7C,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBuD,mBAAmB,EACvDnC,aAAaC,MAAAA;GACT,MAAM+B,kBAAkB/B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM6B,cAAcnC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMoB,uBAAuBpC,EAAEJ,QAAQhB,qBAAqByD,YAAY;GACxE,MAAML,yBAAyBhC,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP+D,iBACAI,aACA;IACIf,QAAQzB,OAAO0B;IACfiB,QAAQ3C,OAAO4C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGAtC,UAAUG,SAASlB,qBAAqB6D,gBAAgB,EACpDzC,aAAaC,MAAAA;GACT,MAAM+B,kBAAkB/B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM6B,cAAcnC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAE9D,OAAO,IAAI3C,qBACP0D,iBACAI,aACA;IACIf,QAAQzB,OAAO8C;IACfH,QAAQ3C,OAAO4C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA7C,UAAUG,SAASlB,qBAAqB+D,oBAAoB,EACxD3C,aAAaC,MAAAA;GACT,MAAM+B,kBAAkB/B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM6B,cAAcnC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMgB,yBAAyBhC,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPwD,iBACAI,aACA;IACIf,QAAQzB,OAAOgD;IACfL,QAAQ3C,OAAO4C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGAtC,UAAUG,SAASlB,qBAAqBiE,mBAAmB,EACvD7C,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACjE,MAAMuC,SAAS7C,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GACzD,MAAM8B,mBAAmB9C,EAAEJ,QAAQhB,qBAAqBmE,QAAQ;GAEhE,OAAO,IAAIzE,wBAAwB;IAC/B2B;IACA4C;IAEAC;IAEAE,SAAS;KAEL5B,QAAQzB,OAAO0B;KACfiB,QAAQ3C,OAAO4C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/authorize/state/repository.d.ts CHANGED Viewed

@@ -3,8 +3,7 @@ import type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '
 export declare class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {
     protected cache: ICache;
     constructor(cache: ICache);
-    findOneById(key: string): Promise<OAuth2AuthorizationState | null>;
-    remove(key: string): Promise<void>;
     insert(data: OAuth2AuthorizationState): Promise<string>;
+    popOneById(key: string): Promise<OAuth2AuthorizationState | null>;
 }
 //# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/authorize/state/repository.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGjH,qBAAa,kCAAmC,YAAW,+BAA+B;IACtF,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAInB,~~WAAW~~,CAAC,~~GAAG~~,EAAE,~~MAAM~~,GAAG,OAAO,CAAC,~~wBAAwB~~,~~GAAG,IAAI,~~CAAC;~~IAalE~~,~~MAAM~~,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,~~IAAI,CAAC;IASlC,MAAM,CAAC,IAAI,EAAE,~~wBAAwB,GAAG,~~OAAO~~,CAAC~~,MAAM,CAAC~~;~~CAchE~~"}
1	+ {"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGjH,qBAAa,kCAAmC,YAAW,+BAA+B;IACtF,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAInB,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC;IAevD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;CAM1E"}

package/dist/app/modules/oauth2/repositories/authorize/state/repository.mjs CHANGED Viewed

@@ -10,29 +10,20 @@ var OAuth2AuthorizationStateRepository = class {
 	constructor(cache) {
 		this.cache = cache;
 	}
-	async findOneById(key) {
-		const id = buildCacheKey({
-			prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,
-			key
-		});
-		const payload = await this.cache.get(id);
-		if (payload) return payload;
-		return null;
-	}
-	async remove(key) {
-		await this.cache.drop(buildCacheKey({
-			prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,
-			key
-		}));
-	}
 	async insert(data) {
 		const state = createNanoID();
 		await this.cache.set(buildCacheKey({
-			prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,
+			prefix: CacheOAuth2Prefix.AUTHORIZATION_STATE,
 			key: state
 		}), data, { ttl: 18e5 });
 		return state;
 	}
+	async popOneById(key) {
+		return this.cache.pop(buildCacheKey({
+			prefix: CacheOAuth2Prefix.AUTHORIZATION_STATE,
+			key
+		}));
+	}
 };
 //#endregion
 export { OAuth2AuthorizationStateRepository };

package/dist/app/modules/oauth2/repositories/authorize/state/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["createNanoID","buildCacheKey","CacheOAuth2Prefix","OAuth2AuthorizationStateRepository","cache","~~findOneById~~","~~key~~","id","~~prefix~~","~~AUTHORIZATION_CODE~~","~~payload~~","~~get~~","~~remove~~","~~drop~~","~~insert~~"~~,"data","state","set","ttl"~~],"sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '../../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../../constants.ts';\n\nexport class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {\n protected cache : ICache;\n\n constructor(cache: ICache) {\n this.cache = cache;\n }\n\n async ~~findOneById~~(~~key~~: ~~string~~): Promise<~~OAuth2AuthorizationState \| null~~> {\n const id = ~~buildCacheKey~~(~~{\n prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n key, \n }~~);\n ~~const payload = await this.cache.get<OAuth2AuthorizationState>(id);\n if (payload) {~~\n ~~return payload;\n~~ ~~}\n\n return null;\n }\n\n async remove(key: string): Promise<void> {\n~~ await this.cache.~~drop~~(\n buildCacheKey({\n prefix: CacheOAuth2Prefix.~~AUTHORIZATION_CODE~~,\n key, \n }),\n );\n }\n\n async ~~insert~~(~~data~~: ~~OAuth2AuthorizationState~~): Promise<~~string~~> {\n ~~const~~ ~~state = createNanoID();\n\n await~~ this.cache.~~set~~(\n buildCacheKey({\n prefix: CacheOAuth2Prefix.~~AUTHORIZATION_CODE~~,\n key~~: state, \n })~~,\n ~~data,\n { ttl: 1000 60 * 30~~ }~~, // 30 min\n~~ );\n~~\n return state;\n~~ }\n}\n"],"mappings":";;;;;;;AAaA,IAAaG,qCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,~~YAAYC~~,~~KAAuD~~;~~EACrE~~,MAAMC,~~KAAKN~~,~~cAAc~~;~~GACrBO~~,~~QAAQN~~,~~kBAAkBO;GAC1BH;EACJ~~,~~CAAA;EACA,~~MAAMI,~~UAAU~~,~~MAAM,KAAKN,MAAMO,IAA8BJ,EAAAA~~;~~EAC/D~~,~~IAAIG~~,~~SACA,OAAOA~~;~~EAGX~~,~~OAAO~~;~~CACX;CAEA~~,~~MAAME~~,~~OAAON~~,~~KAA4B;EACrC~~,~~MAAM~~,~~KAAKF~~,~~MAAMS~~,~~KACbZ,cAAc~~;~~GACVO~~,~~QAAQN,kBAAkBO~~;~~GAC1BH~~;~~EACJ,CAAA,CAAA;CAER;~~CAEA,~~MAAMQ~~,~~OAAOC~~,~~MAAiD~~;~~EAC1D~~,~~MAAMC~~,~~QAAQhB~~,~~aAAAA;EAEd~~,~~MAAM~~,~~KAAKI,MAAMa,IACbhB,~~cAAc;~~GACVO~~,~~QAAQN~~,~~kBAAkBO~~;~~GAC1BH,KAAKU~~;~~EACT~~,CAAA,~~GACAD,MACA,EAAEG,KAAK,KAAe,~~CAAA;~~EAG1B,OAAOF~~;~~CACX;~~AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["createNanoID","buildCacheKey","CacheOAuth2Prefix","OAuth2AuthorizationStateRepository","cache","insert","data","state","set","prefix","AUTHORIZATION_STATE","key","ttl","popOneById","pop"],"sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '../../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../../constants.ts';\n\nexport class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {\n protected cache : ICache;\n\n constructor(cache: ICache) {\n this.cache = cache;\n }\n\n async insert(data: OAuth2AuthorizationState): Promise<string> {\n const state = createNanoID();\n\n await this.cache.set(\n buildCacheKey({\n prefix: CacheOAuth2Prefix.AUTHORIZATION_STATE,\n key: state,\n }),\n data,\n { ttl: 1000 60 * 30 }, // 30 min\n );\n\n return state;\n }\n\n async popOneById(key: string): Promise<OAuth2AuthorizationState \| null> {\n return this.cache.pop<OAuth2AuthorizationState>(buildCacheKey({\n prefix: CacheOAuth2Prefix.AUTHORIZATION_STATE,\n key,\n }));\n }\n}\n"],"mappings":";;;;;;;AAaA,IAAaG,qCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,OAAOC,MAAiD;EAC1D,MAAMC,QAAQP,aAAAA;EAEd,MAAM,KAAKI,MAAMI,IACbP,cAAc;GACVQ,QAAQP,kBAAkBQ;GAC1BC,KAAKJ;EACT,CAAA,GACAD,MACA,EAAEM,KAAK,KAAe,CAAA;EAG1B,OAAOL;CACX;CAEA,MAAMM,WAAWF,KAAuD;EACpE,OAAO,KAAKP,MAAMU,IAA8Bb,cAAc;GAC1DQ,QAAQP,kBAAkBQ;GAC1BC;EACJ,CAAA,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/constants.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 export declare enum CacheOAuth2Prefix {
     AUTHORIZATION_STATE = "oauth2_authorization_state",
     AUTHORIZATION_CODE = "oauth2_authorization_code",
+    FEDERATED_LOGIN = "oauth2_federated_login",
     TOKEN = "oauth2_token",
     TOKEN_CLAIMS = "oauth2_token_claims",
     TOKEN_INACTIVE = "oauth2_token_blocked"

package/dist/app/modules/oauth2/repositories/constants.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB,mBAAmB,+BAA+B;IAClD,kBAAkB,8BAA8B;IAChD,KAAK,iBAAiB;IACtB,YAAY,wBAAwB;IACpC,cAAc,yBAAyB;CAC1C"}
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB,mBAAmB,+BAA+B;IAClD,kBAAkB,8BAA8B;IAChD,eAAe,2BAA2B;IAC1C,KAAK,iBAAiB;IACtB,YAAY,wBAAwB;IACpC,cAAc,yBAAyB;CAC1C"}

package/dist/app/modules/oauth2/repositories/constants.mjs CHANGED Viewed

@@ -5,6 +5,7 @@ import.meta.url;
 var CacheOAuth2Prefix = /*#__PURE__*/ function(CacheOAuth2Prefix) {
 	CacheOAuth2Prefix["AUTHORIZATION_STATE"] = "oauth2_authorization_state";
 	CacheOAuth2Prefix["AUTHORIZATION_CODE"] = "oauth2_authorization_code";
+	CacheOAuth2Prefix["FEDERATED_LOGIN"] = "oauth2_federated_login";
 	CacheOAuth2Prefix["TOKEN"] = "oauth2_token";
 	CacheOAuth2Prefix["TOKEN_CLAIMS"] = "oauth2_token_claims";
 	CacheOAuth2Prefix["TOKEN_INACTIVE"] = "oauth2_token_blocked";

package/dist/app/modules/oauth2/repositories/constants.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/\n Copyright (c) 2024-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n AUTHORIZATION_STATE = 'oauth2_authorization_state',\n AUTHORIZATION_CODE = 'oauth2_authorization_code',\n TOKEN = 'oauth2_token',\n TOKEN_CLAIMS = 'oauth2_token_claims',\n TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA~~;;;;;;~~CAAAA,OAAAA;~~AAMX~~,EAAA,CAAA,CAAA"}
1	+ {"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/\n Copyright (c) 2024-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n AUTHORIZATION_STATE = 'oauth2_authorization_state',\n AUTHORIZATION_CODE = 'oauth2_authorization_code',\n FEDERATED_LOGIN = 'oauth2_federated_login',\n TOKEN = 'oauth2_token',\n TOKEN_CLAIMS = 'oauth2_token_claims',\n TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;;CAAAA,OAAAA;AAOX,EAAA,CAAA,CAAA"}

package/dist/app/modules/oauth2/repositories/federated-login/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './store.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/federated-login/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/federated-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/app/modules/oauth2/repositories/federated-login/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2FederatedLoginStore } from "./store.mjs";
+export { OAuth2FederatedLoginStore };

package/dist/app/modules/oauth2/repositories/federated-login/store.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import type { ICache } from '@authup/server-kit';
+import type { IOAuth2FederatedLoginStore, OAuth2FederatedLoginPending } from '../../../../../core/index.ts';
+export declare class OAuth2FederatedLoginStore implements IOAuth2FederatedLoginStore {
+    protected cache: ICache;
+    constructor(cache: ICache);
+    save(data: OAuth2FederatedLoginPending): Promise<string>;
+    consume(id: string): Promise<OAuth2FederatedLoginPending | null>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/app/modules/oauth2/repositories/federated-login/store.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/federated-login/store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EACR,0BAA0B,EAC1B,2BAA2B,EAC9B,MAAM,8BAA8B,CAAC;AAItC,qBAAa,yBAA0B,YAAW,0BAA0B;IACxE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAInB,IAAI,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;CAUzE"}

package/dist/app/modules/oauth2/repositories/federated-login/store.mjs ADDED Viewed

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAUTH2_FEDERATED_LOGIN_TTL } from "../../../../../core/oauth2/federated-login/constants.mjs";
+import "../../../../../core/index.mjs";
+import { CacheOAuth2Prefix } from "../constants.mjs";
+import { createNanoID } from "@authup/kit";
+import { buildCacheKey } from "@authup/server-kit";
+//#region src/app/modules/oauth2/repositories/federated-login/store.ts
+var OAuth2FederatedLoginStore = class {
+	cache;
+	constructor(cache) {
+		this.cache = cache;
+	}
+	async save(data) {
+		const id = createNanoID();
+		await this.cache.set(buildCacheKey({
+			prefix: CacheOAuth2Prefix.FEDERATED_LOGIN,
+			key: id
+		}), data, { ttl: OAUTH2_FEDERATED_LOGIN_TTL });
+		return id;
+	}
+	async consume(id) {
+		return this.cache.pop(buildCacheKey({
+			prefix: CacheOAuth2Prefix.FEDERATED_LOGIN,
+			key: id
+		}));
+	}
+};
+//#endregion
+export { OAuth2FederatedLoginStore };
+//# sourceMappingURL=store.mjs.map

package/dist/app/modules/oauth2/repositories/federated-login/store.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"store.mjs","names":["createNanoID","buildCacheKey","OAUTH2_FEDERATED_LOGIN_TTL","CacheOAuth2Prefix","OAuth2FederatedLoginStore","cache","save","data","id","set","prefix","FEDERATED_LOGIN","key","ttl","consume","pop"],"sources":["../../../../../../src/app/modules/oauth2/repositories/federated-login/store.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type {\n IOAuth2FederatedLoginStore,\n OAuth2FederatedLoginPending,\n} from '../../../../../core/index.ts';\nimport { OAUTH2_FEDERATED_LOGIN_TTL } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2FederatedLoginStore implements IOAuth2FederatedLoginStore {\n protected cache : ICache;\n\n constructor(cache: ICache) {\n this.cache = cache;\n }\n\n async save(data: OAuth2FederatedLoginPending): Promise<string> {\n const id = createNanoID();\n\n await this.cache.set(\n buildCacheKey({\n prefix: CacheOAuth2Prefix.FEDERATED_LOGIN,\n key: id,\n }),\n data,\n { ttl: OAUTH2_FEDERATED_LOGIN_TTL },\n );\n\n return id;\n }\n\n async consume(id: string): Promise<OAuth2FederatedLoginPending | null> {\n // `pop` is the atomic read-and-drop (redis GETDEL, one tick on the\n // memory adapter). A get followed by a drop is two round-trips, and\n // two simultaneous completions of one pending login would both read\n // the payload before either drop landed.\n return this.cache.pop<OAuth2FederatedLoginPending>(buildCacheKey({\n prefix: CacheOAuth2Prefix.FEDERATED_LOGIN,\n key: id,\n }));\n }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaI,4BAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,KAAKC,MAAoD;EAC3D,MAAMC,KAAKR,aAAAA;EAEX,MAAM,KAAKK,MAAMI,IACbR,cAAc;GACVS,QAAQP,kBAAkBQ;GAC1BC,KAAKJ;EACT,CAAA,GACAD,MACA,EAAEM,KAAKX,2BAA2B,CAAA;EAGtC,OAAOM;CACX;CAEA,MAAMM,QAAQN,IAAyD;EAKnE,OAAO,KAAKH,MAAMU,IAAiCd,cAAc;GAC7DS,QAAQP,kBAAkBQ;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/index.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 export * from './authorize/index.ts';
 export * from './client/index.ts';
 export * from './consent/index.ts';
+export * from './federated-login/index.ts';
 export * from './scope/index.ts';
 export * from './session-token/index.ts';
 export * from './token/index.ts';

package/dist/app/modules/oauth2/repositories/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/app/modules/oauth2/repositories/index.mjs CHANGED Viewed

@@ -8,9 +8,11 @@ import { OAuth2ClientRepository } from "./client/repository.mjs";
 import "./client/index.mjs";
 import { ConsentRepositoryAdapter } from "./consent/repository.mjs";
 import "./consent/index.mjs";
+import { OAuth2FederatedLoginStore } from "./federated-login/store.mjs";
+import "./federated-login/index.mjs";
 import { OAuth2ScopeRepository } from "./scope/repository.mjs";
 import { SessionTokenRepositoryAdapter } from "./session-token/repository.mjs";
 import "./session-token/index.mjs";
 import { OAuth2TokenRepository } from "./token/repository.mjs";
 import "./token/index.mjs";
-export { ConsentRepositoryAdapter, OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };
+export { ConsentRepositoryAdapter, OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2FederatedLoginStore, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };

package/dist/app/modules/runtime/module.mjs CHANGED Viewed

@@ -1,13 +1,13 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { resolveURL } from "../../../utils/url.mjs";
+import "../../../utils/index.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import "../config/index.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
-import { resolveURL } from "../../../utils/url.mjs";
-import "../../../utils/index.mjs";
 //#region src/app/modules/runtime/module.ts
 var RuntimeModule = class {
 	name;

package/dist/cli/commands/migration.mjs CHANGED Viewed

@@ -11,9 +11,9 @@ import { ApplicationBuilder } from "../../app/builder.mjs";
 import "../../app/index.mjs";
 import { createCLIConfigModule } from "../config.mjs";
 import { DataSource } from "typeorm";
+import { checkDatabase, createDatabase, dropDatabase, generateMigration, transformFilePath } from "typeorm-extension";
 import path from "node:path";
 import process from "node:process";
-import { checkDatabase, createDatabase, dropDatabase, generateMigration, transformFilePath } from "typeorm-extension";
 import { defineCommand } from "citty";
 //#region src/cli/commands/migration.ts
 var MigrationOperation = /*#__PURE__*/ function(MigrationOperation) {

package/dist/core/entities/client-scope/schema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,~~gDA2B5B~~,CAAC"}
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDA8C5B,CAAC"}

package/dist/core/entities/client-scope/schema.mjs CHANGED Viewed

@@ -17,7 +17,9 @@ const clientScopeSchema = defineSchema({
 		["scopeId"],
 		["default"],
 		["clientRealmId"],
-		["scopeRealmId"]
+		["scopeRealmId"],
+		["createdAt"],
+		["updatedAt"]
 	],
 	fields: { default: [
 		"id",
@@ -44,6 +46,19 @@ const clientScopeSchema = defineSchema({
 		allowed: ["client", "scope"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
+	sorts: {
+		allowed: [
+			"id",
+			"default",
+			"clientId",
+			"clientRealmId",
+			"scopeId",
+			"scopeRealmId",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/client-scope/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","indexes","fields","default","filters","allowed","indexed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n name: EntityType.CLIENT_SCOPE,\n indexes: [\n ['id'],\n ['clientId', 'scopeId'],\n ['scopeId'],\n ['default'],\n ['clientRealmId'],\n ['scopeRealmId'],\n ],\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'default',\n 'clientId',\n 'clientRealmId',\n 'scopeId',\n 'scopeRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['clientId', 'scopeId', 'default', 'id', 'clientRealmId', 'scopeRealmId'], indexed: true },\n relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,YAAY,SAAU;EACvB,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,eAAgB;EACjB,CAAC,cAAe;~~CACnB~~;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAW;GAAW;GAAM;GAAiB;EAAe;EAAEC,SAAS;CAAK;CAC7GC,WAAW;EAAEF,SAAS,CAAC,UAAU,OAAQ;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;~~CAC5FgB~~,YAAY,EAAEC,UAAU,GAAG;~~CAC3BjB~~;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n name: EntityType.CLIENT_SCOPE,\n indexes: [\n ['id'],\n ['clientId', 'scopeId'],\n ['scopeId'],\n ['default'],\n ['clientRealmId'],\n ['scopeRealmId'],\n ['createdAt'],\n ['updatedAt'],\n ],\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'default',\n 'clientId',\n 'clientRealmId',\n 'scopeId',\n 'scopeRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['clientId', 'scopeId', 'default', 'id', 'clientRealmId', 'scopeRealmId'], indexed: true },\n relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n // wider than the junction siblings' id/createdAt/updatedAt on purpose:\n // every column here is already indexed and already sorts today through\n // the missing-allow-list fallback, so a narrow list would demote the\n // rest from working-and-sorted to silently unsorted (#3441)\n sorts: {\n allowed: [\n 'id',\n 'default',\n 'clientId',\n 'clientRealmId',\n 'scopeId',\n 'scopeRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n indexed: true,\n },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,YAAY,SAAU;EACvB,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,eAAgB;EACjB,CAAC,cAAe;EAChB,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAW;GAAW;GAAM;GAAiB;EAAe;EAAEC,SAAS;CAAK;CAC7GC,WAAW;EAAEF,SAAS,CAAC,UAAU,OAAQ;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAK5FgB,OAAO;EACHJ,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS;CACb;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/event/constants.d.ts CHANGED Viewed

@@ -4,6 +4,15 @@
  * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
  */
 export declare const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+/**
+ * Rows removed per statement by the retention sweep. The sweep runs every
+ * minute on every replica, and the first one after a retention change (or the
+ * day a full retention window first matures) can match millions of rows. A
+ * single unbounded DELETE would then be one long transaction, issued
+ * concurrently by every replica. Batching keeps each statement bounded; the
+ * sweep still drains by looping.
+ */
+export declare const EVENT_RETENTION_SWEEP_BATCH_SIZE = 1000;
 /**
  * Column bound for the denormalized actor name. Shared by the write boundary
  * (EventService.record truncates to it) and every reader that matches stored

package/dist/core/entities/event/constants.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC"}
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC"}

package/dist/core/entities/event/constants.mjs CHANGED Viewed

@@ -8,12 +8,20 @@ import.meta.url;
 * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
 */ const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
 /**
+* Rows removed per statement by the retention sweep. The sweep runs every
+* minute on every replica, and the first one after a retention change (or the
+* day a full retention window first matures) can match millions of rows. A
+* single unbounded DELETE would then be one long transaction, issued
+* concurrently by every replica. Batching keeps each statement bounded; the
+* sweep still drains by looping.
+*/ const EVENT_RETENTION_SWEEP_BATCH_SIZE = 1e3;
+/**
 * Column bound for the denormalized actor name. Shared by the write boundary
 * (EventService.record truncates to it) and every reader that matches stored
 * rows by actor name (the login throttle) so the two cannot drift — an
 * untruncated lookup key never matches its own truncated rows.
 */ const EVENT_ACTOR_NAME_MAX_LENGTH = 128;
 //#endregion
-export { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT };
+export { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE };
 //# sourceMappingURL=constants.mjs.map

package/dist/core/entities/event/constants.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT","EVENT_ACTOR_NAME_MAX_LENGTH"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\n/\n Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n /\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n\n/\n Column bound for the denormalized actor name. Shared by the write boundary\n * (EventService.record truncates to it) and every reader that matches stored\n * rows by actor name (the login throttle) so the two cannot drift — an\n * untruncated lookup key never matches its own truncated rows.\n */\nexport const EVENT_ACTOR_NAME_MAX_LENGTH = 128;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC;;;;;;GAQhD,MAAaC,8BAA8B"}
1	+ {"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT","EVENT_RETENTION_SWEEP_BATCH_SIZE","EVENT_ACTOR_NAME_MAX_LENGTH"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\n/\n Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n /\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n\n/\n Rows removed per statement by the retention sweep. The sweep runs every\n * minute on every replica, and the first one after a retention change (or the\n * day a full retention window first matures) can match millions of rows. A\n * single unbounded DELETE would then be one long transaction, issued\n * concurrently by every replica. Batching keeps each statement bounded; the\n * sweep still drains by looping.\n /\nexport const EVENT_RETENTION_SWEEP_BATCH_SIZE = 1000;\n\n/\n Column bound for the denormalized actor name. Shared by the write boundary\n * (EventService.record truncates to it) and every reader that matches stored\n * rows by actor name (the login throttle) so the two cannot drift — an\n * untruncated lookup key never matches its own truncated rows.\n */\nexport const EVENT_ACTOR_NAME_MAX_LENGTH = 128;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC;;;;;;;;GAUhD,MAAaC,mCAAmC;;;;;;GAQhD,MAAaC,8BAA8B"}

package/dist/core/entities/event/entity-event-handler.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;~~AA4CF~~;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;~~CAsD9D~~"}
1	+ {"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA2DF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CA2D9D"}

package/dist/core/entities/event/entity-event-handler.mjs CHANGED Viewed

@@ -10,6 +10,19 @@ const ENTITY_EVENT_NAME_MAP = {
 	[EntityDefaultEventName.UPDATED]: EventName.UPDATED,
 	[EntityDefaultEventName.DELETED]: EventName.DELETED
 };
+/**
+* Entity types whose rows are generic (name, value) pairs. Their payload
+* column is always called `value`, so {@link buildEntityDiff}'s key-name
+* denylist cannot see what it holds - and for an identity provider it holds
+* the OAuth2 `clientSecret` or the LDAP bind password. The diff is dropped
+* wholesale rather than the denylist widened, because no regex over the
+* column name can ever decide this.
+*/ const ENTITY_OPAQUE_VALUE_TYPES = /* @__PURE__ */ new Set([
+	EntityType.IDENTITY_PROVIDER_ATTRIBUTE,
+	EntityType.POLICY_ATTRIBUTE,
+	EntityType.ROLE_ATTRIBUTE,
+	EntityType.USER_ATTRIBUTE
+]);
 const ENTITY_REALM_KEY_MAP = {
 	[EntityType.CLIENT]: "realmId",
 	[EntityType.CLIENT_PERMISSION]: "clientRealmId",
@@ -64,7 +77,7 @@ const ENTITY_REALM_KEY_MAP = {
 			const realmId = typeof realmIdCurrent === "undefined" ? resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null : realmIdCurrent;
 			const requestContext = this.requestContext ? this.requestContext() : void 0;
 			let data = null;
-			if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {
+			if (name === EventName.UPDATED && !ENTITY_OPAQUE_VALUE_TYPES.has(ctx.content.type) && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {
 				const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);
 				if (Object.keys(diff).length > 0) data = { diff };
 			}

package/dist/core/entities/event/entity-event-handler.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","SESSION_TOKEN","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n EntityDefaultEventName,\n EntityType,\n EventName,\n EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n EntityEventHandlerOptions,\n EventRequestContext,\n IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n eventService: IEventService,\n requestContext?: () => EventRequestContext \| undefined,\n options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n [EntityDefaultEventName.CREATED]: EventName.CREATED,\n [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n [EntityType.CLIENT]: 'realmId',\n [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n [EntityType.CLIENT_ROLE]: 'clientRealmId',\n [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n [EntityType.CONSENT]: 'realmId',\n // Unreachable in practice: auth_session_tokens has no entity subscriber,\n // so no domain event is ever published for it. Present for exhaustiveness,\n // and the key is the one it would resolve through if that changed.\n [EntityType.SESSION_TOKEN]: 'sessionId',\n [EntityType.EVENT]: 'realmId',\n [EntityType.IDENTITY_PROVIDER]: 'realmId',\n [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n [EntityType.KEY]: 'realmId',\n [EntityType.POLICY]: 'realmId',\n [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n [EntityType.PERMISSION]: 'realmId',\n [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n [EntityType.REALM]: 'id',\n [EntityType.ROLE]: 'realmId',\n [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n [EntityType.SCOPE]: 'realmId',\n [EntityType.SESSION]: 'realmId',\n [EntityType.TRUST_ANCHOR]: 'realmId',\n [EntityType.USER]: 'realmId',\n [EntityType.USER_ATTRIBUTE]: 'realmId',\n [EntityType.USER_AUTHENTICATOR]: 'realmId',\n [EntityType.USER_PERMISSION]: 'userRealmId',\n [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/\n Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n protected eventService : IEventService;\n\n protected requestContext? : () => EventRequestContext \| undefined;\n\n protected options : EntityEventHandlerOptions;\n\n constructor(ctx: EntityEventHandlerContext) {\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n this.options = ctx.options ?? {};\n }\n\n async handle(ctx: DomainEventPublishContext): Promise<void> {\n try {\n // recursion guard — no event subscriber exists today (the\n // auth_events entity is deliberately subscriber-less), so this is\n // defense in depth against an audit-write feedback loop.\n if (ctx.content.type === 'event') {\n return;\n }\n\n const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n if (!name) {\n return;\n }\n\n const refId = ctx.content.data?.id ?? null;\n const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n const realmId = typeof realmIdCurrent === 'undefined' ?\n (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n realmIdCurrent;\n\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n let data : Record<string, any> \| null = null;\n if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n if (Object.keys(diff).length > 0) {\n data = { diff };\n }\n }\n\n await this.eventService.record({\n scope: EventScope.ENTITY,\n name,\n refType: ctx.content.type,\n refId,\n realmId,\n actorType: requestContext?.actorType ?? null,\n actorId: requestContext?.actorId ?? null,\n actorName: requestContext?.actorName ?? null,\n sessionId: requestContext?.sessionId ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data,\n retentionDays: this.options.retentionDays,\n });\n } catch {\n // record() never throws, but the bridge itself must also never\n // fail the originating publish.\n }\n }\n}\n\nfunction resolveEntityRealmId(\n type: string,\n data: unknown,\n): string \| null \| undefined {\n if (!isObject(data)) {\n return undefined;\n }\n\n const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n if (!hasOwnProperty(data, key)) {\n return undefined;\n }\n\n return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EAIrBf,WAAWgB,gBAAgB;EAC3BhB,WAAWiB,QAAQ;EACnBjB,WAAWkB,oBAAoB;EAC/BlB,WAAWmB,4BAA4B;EACvCnB,WAAWoB,8BAA8B;EACzCpB,WAAWqB,sCAAsC;EACjDrB,WAAWsB,uCAAuC;EAClDtB,WAAWuB,iCAAiC;EAC5CvB,WAAWwB,MAAM;EACjBxB,WAAWyB,SAAS;EACpBzB,WAAW0B,mBAAmB;EAC9B1B,WAAW2B,aAAa;EACxB3B,WAAW4B,oBAAoB;EAC/B5B,WAAW6B,QAAQ;EACnB7B,WAAW8B,OAAO;EAClB9B,WAAW+B,iBAAiB;EAC5B/B,WAAWgC,kBAAkB;EAC7BhC,WAAWiC,QAAQ;EACnBjC,WAAWkC,UAAU;EACrBlC,WAAWmC,eAAe;EAC1BnC,WAAWoC,OAAO;EAClBpC,WAAWqC,iBAAiB;EAC5BrC,WAAWsC,qBAAqB;EAChCtC,WAAWuC,kBAAkB;EAC7BvC,WAAWwC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO3C,sBAAsBuC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAShD,UAAUO,WAAWJ,SAASyC,IAAIE,QAAQK,IAAI,KAAKhD,SAASyC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOtD,gBAAgBwC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO9D,WAAW+D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,WAAW3B,gBAAgB2B,aAAa;IACxCC,aAAa5B,gBAAgB4B,eAAe;IAC5CC,eAAe7B,gBAAgB6B,iBAAiB;IAChDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDC,kBAAkB/B,gBAAgB+B,oBAAoB;IACtDtB;IACAuB,eAAe,KAAK/B,QAAQ+B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASpB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAChD,SAASgD,IAAAA,GACV;CAGJ,MAAMwB,MAAMlE,qBAAqBsC,SAA4B;CAC7D,IAAI,CAAC7C,eAAeiD,MAAMwB,GAAAA,GACtB;CAGJ,OAAO,OAAOxB,KAAKwB,SAAS,WAAWxB,KAAKwB,OAAO;AACvD"}
1	+ {"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_OPAQUE_VALUE_TYPES","Set","IDENTITY_PROVIDER_ATTRIBUTE","POLICY_ATTRIBUTE","ROLE_ATTRIBUTE","USER_ATTRIBUTE","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","SESSION_TOKEN","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","has","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n EntityDefaultEventName,\n EntityType,\n EventName,\n EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n EntityEventHandlerOptions,\n EventRequestContext,\n IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n eventService: IEventService,\n requestContext?: () => EventRequestContext \| undefined,\n options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n [EntityDefaultEventName.CREATED]: EventName.CREATED,\n [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\n/\n Entity types whose rows are generic (name, value) pairs. Their payload\n * column is always called `value`, so {@link buildEntityDiff}'s key-name\n * denylist cannot see what it holds - and for an identity provider it holds\n * the OAuth2 `clientSecret` or the LDAP bind password. The diff is dropped\n * wholesale rather than the denylist widened, because no regex over the\n * column name can ever decide this.\n /\nconst ENTITY_OPAQUE_VALUE_TYPES = new Set<string>([\n EntityType.IDENTITY_PROVIDER_ATTRIBUTE,\n EntityType.POLICY_ATTRIBUTE,\n EntityType.ROLE_ATTRIBUTE,\n EntityType.USER_ATTRIBUTE,\n]);\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n [EntityType.CLIENT]: 'realmId',\n [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n [EntityType.CLIENT_ROLE]: 'clientRealmId',\n [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n [EntityType.CONSENT]: 'realmId',\n // Unreachable in practice: auth_session_tokens has no entity subscriber,\n // so no domain event is ever published for it. Present for exhaustiveness,\n // and the key is the one it would resolve through if that changed.\n [EntityType.SESSION_TOKEN]: 'sessionId',\n [EntityType.EVENT]: 'realmId',\n [EntityType.IDENTITY_PROVIDER]: 'realmId',\n [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n [EntityType.KEY]: 'realmId',\n [EntityType.POLICY]: 'realmId',\n [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n [EntityType.PERMISSION]: 'realmId',\n [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n [EntityType.REALM]: 'id',\n [EntityType.ROLE]: 'realmId',\n [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n [EntityType.SCOPE]: 'realmId',\n [EntityType.SESSION]: 'realmId',\n [EntityType.TRUST_ANCHOR]: 'realmId',\n [EntityType.USER]: 'realmId',\n [EntityType.USER_ATTRIBUTE]: 'realmId',\n [EntityType.USER_AUTHENTICATOR]: 'realmId',\n [EntityType.USER_PERMISSION]: 'userRealmId',\n [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/\n Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n protected eventService : IEventService;\n\n protected requestContext? : () => EventRequestContext \| undefined;\n\n protected options : EntityEventHandlerOptions;\n\n constructor(ctx: EntityEventHandlerContext) {\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n this.options = ctx.options ?? {};\n }\n\n async handle(ctx: DomainEventPublishContext): Promise<void> {\n try {\n // recursion guard — no event subscriber exists today (the\n // auth_events entity is deliberately subscriber-less), so this is\n // defense in depth against an audit-write feedback loop.\n if (ctx.content.type === 'event') {\n return;\n }\n\n const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n if (!name) {\n return;\n }\n\n const refId = ctx.content.data?.id ?? null;\n const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n const realmId = typeof realmIdCurrent === 'undefined' ?\n (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n realmIdCurrent;\n\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n let data : Record<string, any> \| null = null;\n if (\n name === EventName.UPDATED &&\n !ENTITY_OPAQUE_VALUE_TYPES.has(ctx.content.type) &&\n isObject(ctx.content.data) &&\n isObject(ctx.dataPrevious)\n ) {\n const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n if (Object.keys(diff).length > 0) {\n data = { diff };\n }\n }\n\n await this.eventService.record({\n scope: EventScope.ENTITY,\n name,\n refType: ctx.content.type,\n refId,\n realmId,\n actorType: requestContext?.actorType ?? null,\n actorId: requestContext?.actorId ?? null,\n actorName: requestContext?.actorName ?? null,\n sessionId: requestContext?.sessionId ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data,\n retentionDays: this.options.retentionDays,\n });\n } catch {\n // record() never throws, but the bridge itself must also never\n // fail the originating publish.\n }\n }\n}\n\nfunction resolveEntityRealmId(\n type: string,\n data: unknown,\n): string \| null \| undefined {\n if (!isObject(data)) {\n return undefined;\n }\n\n const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n if (!hasOwnProperty(data, key)) {\n return undefined;\n }\n\n return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;;;;;;;;GAUA,MAAMC,4CAA4B,IAAIC,IAAY;CAC9CX,WAAWY;CACXZ,WAAWa;CACXb,WAAWc;CACXd,WAAWe;AACd,CAAA;AAED,MAAMC,uBAAyD;EAC1DhB,WAAWiB,SAAS;EACpBjB,WAAWkB,oBAAoB;EAC/BlB,WAAWmB,cAAc;EACzBnB,WAAWoB,eAAe;EAC1BpB,WAAWqB,UAAU;EAIrBrB,WAAWsB,gBAAgB;EAC3BtB,WAAWuB,QAAQ;EACnBvB,WAAWwB,oBAAoB;EAC/BxB,WAAWyB,4BAA4B;EACvCzB,WAAWY,8BAA8B;EACzCZ,WAAW0B,sCAAsC;EACjD1B,WAAW2B,uCAAuC;EAClD3B,WAAW4B,iCAAiC;EAC5C5B,WAAW6B,MAAM;EACjB7B,WAAW8B,SAAS;EACpB9B,WAAWa,mBAAmB;EAC9Bb,WAAW+B,aAAa;EACxB/B,WAAWgC,oBAAoB;EAC/BhC,WAAWiC,QAAQ;EACnBjC,WAAWkC,OAAO;EAClBlC,WAAWc,iBAAiB;EAC5Bd,WAAWmC,kBAAkB;EAC7BnC,WAAWoC,QAAQ;EACnBpC,WAAWqC,UAAU;EACrBrC,WAAWsC,eAAe;EAC1BtC,WAAWuC,OAAO;EAClBvC,WAAWe,iBAAiB;EAC5Bf,WAAWwC,qBAAqB;EAChCxC,WAAWyC,kBAAkB;EAC7BzC,WAAW0C,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO7C,sBAAsByC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IACIH,SAASlD,UAAUO,WACnB,CAACE,0BAA0BmD,IAAId,IAAIE,QAAQC,IAAI,KAC/C9C,SAAS2C,IAAIE,QAAQK,IAAI,KACzBlD,SAAS2C,IAAIY,YAAY,GAC3B;IACE,MAAMG,OAAOzD,gBAAgB0C,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAII,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BX,OAAO,EAAEQ,KAAK;GAEtB;GAEA,MAAM,KAAKlB,aAAasB,OAAO;IAC3BC,OAAOjE,WAAWkE;IAClBjB;IACAkB,SAAStB,IAAIE,QAAQC;IACrBG;IACAK;IACAY,WAAWzB,gBAAgByB,aAAa;IACxCC,SAAS1B,gBAAgB0B,WAAW;IACpCC,WAAW3B,gBAAgB2B,aAAa;IACxCC,WAAW5B,gBAAgB4B,aAAa;IACxCC,aAAa7B,gBAAgB6B,eAAe;IAC5CC,eAAe9B,gBAAgB8B,iBAAiB;IAChDC,kBAAkB/B,gBAAgB+B,oBAAoB;IACtDC,kBAAkBhC,gBAAgBgC,oBAAoB;IACtDvB;IACAwB,eAAe,KAAKhC,QAAQgC;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASrB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAClD,SAASkD,IAAAA,GACV;CAGJ,MAAMyB,MAAM/D,qBAAqBkC,SAA4B;CAC7D,IAAI,CAAC/C,eAAemD,MAAMyB,GAAAA,GACtB;CAGJ,OAAO,OAAOzB,KAAKyB,SAAS,WAAWzB,KAAKyB,OAAO;AACvD"}

package/dist/core/entities/event/index.mjs CHANGED Viewed

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
+import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE } from "./constants.mjs";
 import { eventSchema } from "./schema.mjs";
 import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./diff.mjs";
 import { EntityEventHandler } from "./entity-event-handler.mjs";
 import { sanitizeEventData } from "./sanitize.mjs";
 import { EventService } from "./service.mjs";
-export { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, eventSchema, sanitizeEventData };
+export { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EVENT_RETENTION_SWEEP_BATCH_SIZE, EntityEventHandler, EventService, buildEntityDiff, eventSchema, sanitizeEventData };