@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/database/extra-attribute-repository/tree/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["FindOptionsUtils","InstanceChecker","TreeRepository","TreeRepositoryUtils","ExtraAttributesTreeRepositoryAdapter","EATreeRepository","adapter","options","instance","entity","attributeEntity","ctx","isDataSource","manager","repository","attributeRepository","getRepository","create","entityLike","Array","isArray","map","i","preserveExtraAttributes","source","columns","Set","col","metadata","add","propertyName","rel","relations","key","Object","keys","has","saveOneWithEA","input","attributes","saveWithEA","findOneWithEA","extraOptions","findOneWithEAByPrimaryColumn","value","findManyWithEA","findWithEA","extendOneWithEA","output","extendManyWithEA","entities","findRoots","findDescendantsTree","qb","createDescendantsQueryBuilder","applyOptionsToTreeQueryBuilder","getRawAndEntities","relationMaps","createRelationMaps","raw","buildChildrenEntityTree","depth","findAncestors","findAncestorsTree","createAncestorsQueryBuilder","buildParentEntityTree","updateClosureTable","primaryKeyValue","primaryColumns","getEntityValue","closureTable","closureJunctionTable","executeClosureTableUpdate","connection","transaction","tableName","ancestorColumn","ancestorColumns","descendantColumn","descendantColumns","param","index","driver","createParameter","ancestors","query","databasePath","treeParentRelation","parentId","joinColumns","ancestorIds","filter","ancestor","length","descendants","descendantIds","descendant","placeholders","_","join","ancestorsOfDescendants","acc","reduce","curr","push","ancestorsOfDescendent","ancestorId","indexOf","descendantId"],"sources":["../../../../../src/adapters/database/extra-attribute-repository/tree/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    DataSource, \n    DeepPartial, \n    EntityManager, \n    FindManyOptions, \n    FindOneOptions, \n    FindTreeOptions,\n    SelectQueryBuilder,\n} from 'typeorm';\nimport {\n    FindOptionsUtils,\n    InstanceChecker,\n    TreeRepository, \n    TreeRepositoryUtils,\n} from 'typeorm';\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { ExtraAttributesRepositoryAdapter } from '../adapter.ts';\nimport type {\n    EARepositoryEntityBase, \n    EARepositoryFindOptions, \n    EARepositoryOptions, \n    EARepositorySaveOptions, \n    IEARepository,\n} from '../types.ts';\nimport { ExtraAttributesTreeRepositoryAdapter } from './adapter.ts';\n\n/**\n * @see https://github.com/typeorm/typeorm/blob/master/src/repository/TreeRepository.ts\n */\nexport class EATreeRepository<\n    T extends ObjectLiteral = ObjectLiteral,\n    A extends EARepositoryEntityBase = EARepositoryEntityBase,\n> extends TreeRepository<T> implements IEARepository<T> {\n    protected adapter: ExtraAttributesRepositoryAdapter<T, A>;\n\n    protected options: EARepositoryOptions<T, A>;\n\n    constructor(\n        instance: DataSource | EntityManager,\n        options: EARepositoryOptions<T, A>,\n    ) {\n        const {\n            entity,\n            attributeEntity,\n            ...ctx\n        } = options;\n\n        super(\n            entity,\n            InstanceChecker.isDataSource(instance) ? instance.manager : instance,\n        );\n\n        this.options = options;\n        this.adapter = new ExtraAttributesTreeRepositoryAdapter<T, A>({\n            ...ctx,\n            repository: this,\n            attributeRepository: this.manager.getRepository(attributeEntity),\n        });\n    }\n\n    // ------------------------------------------------------------------------------\n\n    override create(): T;\n\n    override create(entityLikeArray: DeepPartial<T>[]): T[];\n\n    override create(entityLike: DeepPartial<T>): T;\n\n    override create(entityLike?: DeepPartial<T> | DeepPartial<T>[]): T | T[] {\n        if (!entityLike) {\n            return super.create();\n        }\n\n        if (Array.isArray(entityLike)) {\n            return super.create(entityLike).map((entity, i) => {\n                this.preserveExtraAttributes(entity, entityLike[i]);\n                return entity;\n            });\n        }\n\n        const entity = super.create(entityLike);\n        this.preserveExtraAttributes(entity, entityLike);\n        return entity;\n    }\n\n    private preserveExtraAttributes(entity: T, source: DeepPartial<T>): void {\n        const columns = new Set<string>();\n        for (const col of this.metadata.columns) {\n            columns.add(col.propertyName);\n        }\n        for (const rel of this.metadata.relations) {\n            columns.add(rel.propertyName);\n        }\n\n        for (const key of Object.keys(source)) {\n            if (!columns.has(key) && !(key in entity)) {\n                (entity as Record<string, any>)[key] = (source as Record<string, any>)[key];\n            }\n        }\n    }\n\n    // ------------------------------------------------------------------------------\n\n    async saveOneWithEA<E extends Record<string, any>>(\n        input: T & E,\n        attributes?: E,\n        options?: EARepositorySaveOptions<T>,\n    ): Promise<T & E> {\n        return this.adapter.saveWithEA(input, attributes, options);\n    }\n\n    // ------------------------------------------------------------------------------\n\n    async findOneWithEA(\n        options: FindOneOptions<T>,\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<T | undefined> {\n        return this.adapter.findOneWithEA(options, extraOptions);\n    }\n\n    async findOneWithEAByPrimaryColumn<E extends Record<string, any>>(\n        value: T[keyof T],\n        extraOptions?: EARepositoryFindOptions,\n    ): Promise<E> {\n        return this.adapter.findOneWithEAByPrimaryColumn(value, extraOptions);\n    }\n\n    async findManyWithEA<\n        E extends Record<string, any>,\n    >(\n        options: FindManyOptions<T>,\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<(T & E)[]> {\n        return this.adapter.findWithEA(options, extraOptions);\n    }\n\n    // ------------------------------------------------------------------------------\n\n    async extendOneWithEA<E extends Record<string, any>>(\n        entity: T,\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<T & E> {\n        const [output] = await this.extendManyWithEA([entity], extraOptions);\n\n        return output as (T & E);\n    }\n\n    async extendManyWithEA<E extends Record<string, any>>(\n        entities: T[],\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<(T & E)[]> {\n        return this.adapter.extendManyWithEA(entities, extraOptions);\n    }\n\n    // -------------------------------------------------------------------------------\n\n    async findRoots(options?: FindTreeOptions): Promise<T[]> {\n        const entities = await super.findRoots(options);\n\n        await this.extendManyWithEA(entities);\n\n        return entities;\n    }\n\n    async findDescendantsTree(\n        entity: T,\n        options?: FindTreeOptions,\n    ): Promise<T> {\n        const qb: SelectQueryBuilder<T> = this.createDescendantsQueryBuilder(\n            'treeEntity',\n            'treeClosure',\n            entity,\n        );\n        FindOptionsUtils.applyOptionsToTreeQueryBuilder(qb, options);\n\n        const entities = await qb.getRawAndEntities();\n        const relationMaps = TreeRepositoryUtils.createRelationMaps(\n            this.manager,\n            this.metadata,\n            'treeEntity',\n            entities.raw,\n        );\n\n        await this.extendManyWithEA(entities.entities);\n\n        TreeRepositoryUtils.buildChildrenEntityTree(\n            this.metadata,\n            entity,\n            entities.entities,\n            relationMaps,\n            {\n                depth: -1,\n                ...options,\n            },\n        );\n\n        // The descendants closure may include the root, but `entity` here is a\n        // different reference than the one in `entities.entities`, so its own EA\n        // fields are not populated. Load them explicitly so leaf-as-root callers\n        // (e.g. policies bound directly to permissions/junctions) see EA.\n        await this.extendOneWithEA(entity);\n\n        return entity;\n    }\n\n    async findAncestors(\n        entity: T,\n        options?: FindTreeOptions,\n    ): Promise<T[]> {\n        const entities = await super.findAncestors(entity, options);\n\n        await this.extendManyWithEA(entities);\n\n        return entities;\n    }\n\n    // -------------------------------------------------------------------------------\n\n    async findAncestorsTree(\n        entity: T,\n        options?: FindTreeOptions,\n    ): Promise<T> {\n        const qb = this.createAncestorsQueryBuilder(\n            'treeEntity',\n            'treeClosure',\n            entity,\n        );\n        FindOptionsUtils.applyOptionsToTreeQueryBuilder(qb, options);\n\n        const entities = await qb.getRawAndEntities();\n        const relationMaps = TreeRepositoryUtils.createRelationMaps(\n            this.manager,\n            this.metadata,\n            'treeEntity',\n            entities.raw,\n        );\n\n        await this.extendManyWithEA(entities.entities);\n\n        TreeRepositoryUtils.buildParentEntityTree(\n            this.metadata,\n            entity,\n            entities.entities,\n            relationMaps,\n        );\n        return entity;\n    }\n\n    // -------------------------------------------------------------------------------\n\n    async updateClosureTable(entity: T, manager?: EntityManager) {\n        const primaryKeyValue = this.metadata.primaryColumns[0].getEntityValue(entity);\n        if (!primaryKeyValue) {\n            return;\n        }\n\n        const closureTable = this.metadata.closureJunctionTable;\n        if (!closureTable) {\n            return;\n        }\n\n        if (manager) {\n            await this.executeClosureTableUpdate(entity, manager);\n        } else {\n            await this.manager.connection.transaction(async (manager) => {\n                await this.executeClosureTableUpdate(entity, manager);\n            });\n        }\n    }\n\n    private async executeClosureTableUpdate(entity: T, manager: EntityManager) {\n        const primaryKeyValue = this.metadata.primaryColumns[0].getEntityValue(entity);\n\n        const { tableName } = this.metadata.closureJunctionTable;\n        const ancestorColumn = this.metadata.closureJunctionTable.ancestorColumns[0];\n        const descendantColumn = this.metadata.closureJunctionTable.descendantColumns[0];\n\n        const param = (index: number) => manager.connection.driver.createParameter(`p${index}`, index);\n\n        // 1. Get All ancestors of current entity\n        const ancestors = await manager.query<Record<string, any>[]>(\n            `SELECT *\n                 FROM ${tableName}\n                 WHERE ${ancestorColumn.databasePath} != ${descendantColumn.databasePath} AND\n                       ${descendantColumn.databasePath} = ${param(0)} AND\n                       ${ancestorColumn.databasePath} != ${param(1)}`,\n            [primaryKeyValue, primaryKeyValue],\n        );\n\n        if (!this.metadata.treeParentRelation) {\n            return;\n        }\n\n        const parentId = this.metadata.treeParentRelation.joinColumns[0].getEntityValue(entity);\n\n        let ancestorIds : string[];\n        if (parentId) {\n            ancestorIds = [\n                parentId,\n                ...ancestors\n                    .filter((ancestor) => ancestor[ancestorColumn.databasePath] !== parentId)\n                    .map((ancestor) => ancestor[ancestorColumn.databasePath]),\n            ];\n        } else {\n            ancestorIds = ancestors.map((ancestor) => ancestor[ancestorColumn.databasePath]);\n        }\n\n        if (ancestorIds.length === 0) {\n            return;\n        }\n\n        // 2. Get All descendants of current entity.\n        const descendants = await manager.query<Record<string, any>[]>(\n            `SELECT *\n                     FROM ${tableName}\n                     WHERE ${ancestorColumn.databasePath} != ${descendantColumn.databasePath} AND\n                           ${ancestorColumn.databasePath} = ${param(0)} AND\n                           ${descendantColumn.databasePath} != ${param(1)}`,\n            [primaryKeyValue, primaryKeyValue],\n        );\n\n        if (parentId) {\n            // 3. get all descendant\n            const descendantIds = descendants\n                .map((descendant) => descendant[descendantColumn.databasePath]);\n\n            if (descendantIds.length > 0) {\n                // 4. get all ancestors of each descendant\n                const placeholders = descendantIds.map((_, i) => param(i + 1)).join(',');\n                const ancestorsOfDescendants = await manager.query<Record<string, any>[]>(\n                    `SELECT *\n                         FROM ${tableName}\n                         WHERE\n                             ${ancestorColumn.databasePath} != ${param(0)} AND\n                             ${ancestorColumn.databasePath} != ${descendantColumn.databasePath} AND\n                             ${descendantColumn.databasePath} IN (${placeholders})`,\n                    [primaryKeyValue, ...descendantIds],\n                );\n\n                const acc = ancestorsOfDescendants.reduce((acc, curr) => {\n                    if (!acc[curr[descendantColumn.databasePath]]) {\n                        acc[curr[descendantColumn.databasePath]] = [];\n                    }\n\n                    acc[curr[descendantColumn.databasePath]].push(curr[ancestorColumn.databasePath]);\n                    return acc;\n                }, {} as Record<string, string[]>);\n\n                // 5. Check if for each child a relation exists with each ancestor (create if not exist)\n                for (const descendant of descendantIds) {\n                    const ancestorsOfDescendent = acc[descendant] ?? [];\n\n                    for (const ancestorId of ancestorIds) {\n                        const index = ancestorsOfDescendent.indexOf(ancestorId);\n                        if (index === -1) {\n                            await manager.query(\n                                `INSERT INTO ${tableName}\n                                    (${ancestorColumn.databasePath}, ${descendantColumn.databasePath})\n                                    VALUES (${param(0)}, ${param(1)})`,\n                                [ancestorId, descendant],\n                            );\n                        }\n                    }\n                }\n            }\n        } else {\n            const descendantIds = [\n                primaryKeyValue,\n                ...descendants.map((descendant) => descendant[descendantColumn.databasePath]),\n            ];\n\n            for (const ancestorId of ancestorIds) {\n                for (const descendantId of descendantIds) {\n                    await manager.query(\n                        `DELETE FROM ${tableName}\n                            WHERE ${ancestorColumn.databasePath} = ${param(0)}\n                              AND ${descendantColumn.databasePath} = ${param(1)}`,\n                        [ancestorId, descendantId],\n                    );\n                }\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;GAoCA,IAAaK,mBAAb,cAGUH,eAAAA;CACII;CAEAC;CAEV,YACIC,UACAD,SACF;EACE,MAAM,EACFE,QACAC,iBACA,GAAGC,QACHJ;EAEJ,MACIE,QACAR,gBAAgBW,aAAaJ,QAAAA,IAAYA,SAASK,UAAUL,QAAAA;EAGhE,KAAKD,UAAUA;EACf,KAAKD,UAAU,IAAIF,qCAA2C;GAC1D,GAAGO;GACHG,YAAY;GACZC,qBAAqB,KAAKF,QAAQG,cAAcN,eAAAA;EACpD,CAAA;CACJ;CAUSO,OAAOC,YAAyD;EACrE,IAAI,CAACA,YACD,OAAO,MAAMD,OAAAA;EAGjB,IAAIE,MAAMC,QAAQF,UAAAA,GACd,OAAO,MAAMD,OAAOC,UAAAA,CAAAA,CAAYG,KAAKZ,QAAQa,MAAAA;GACzC,KAAKC,wBAAwBd,QAAQS,WAAWI,EAAE;GAClD,OAAOb;EACX,CAAA;EAGJ,MAAMA,SAAS,MAAMQ,OAAOC,UAAAA;EAC5B,KAAKK,wBAAwBd,QAAQS,UAAAA;EACrC,OAAOT;CACX;CAEQc,wBAAwBd,QAAWe,QAA8B;EACrE,MAAMC,0BAAU,IAAIC,IAAAA;EACpB,KAAK,MAAMC,OAAO,KAAKC,SAASH,SAC5BA,QAAQI,IAAIF,IAAIG,YAAY;EAEhC,KAAK,MAAMC,OAAO,KAAKH,SAASI,WAC5BP,QAAQI,IAAIE,IAAID,YAAY;EAGhC,KAAK,MAAMG,OAAOC,OAAOC,KAAKX,MAAAA,GAC1B,IAAI,CAACC,QAAQW,IAAIH,GAAAA,KAAQ,EAAEA,OAAOxB,SAC7BA,OAA+BwB,OAAO,OAAgCA;CAGnF;CAIA,MAAMI,cACFC,OACAC,YACAhC,SACc;EACd,OAAO,KAAKD,QAAQkC,WAAWF,OAAOC,YAAYhC,OAAAA;CACtD;CAIA,MAAMkC,cACFlC,SACAmC,eAAwC,CAAC,GACnB;EACtB,OAAO,KAAKpC,QAAQmC,cAAclC,SAASmC,YAAAA;CAC/C;CAEA,MAAMC,6BACFC,OACAF,cACU;EACV,OAAO,KAAKpC,QAAQqC,6BAA6BC,OAAOF,YAAAA;CAC5D;CAEA,MAAMG,eAGFtC,SACAmC,eAAwC,CAAC,GACvB;EAClB,OAAO,KAAKpC,QAAQwC,WAAWvC,SAASmC,YAAAA;CAC5C;CAIA,MAAMK,gBACFtC,QACAiC,eAAwC,CAAC,GAC3B;EACd,MAAM,CAACM,UAAU,MAAM,KAAKC,iBAAiB,CAACxC,MAAO,GAAEiC,YAAAA;EAEvD,OAAOM;CACX;CAEA,MAAMC,iBACFC,UACAR,eAAwC,CAAC,GACvB;EAClB,OAAO,KAAKpC,QAAQ2C,iBAAiBC,UAAUR,YAAAA;CACnD;CAIA,MAAMS,UAAU5C,SAAyC;EACrD,MAAM2C,WAAW,MAAM,MAAMC,UAAU5C,OAAAA;EAEvC,MAAM,KAAK0C,iBAAiBC,QAAAA;EAE5B,OAAOA;CACX;CAEA,MAAME,oBACF3C,QACAF,SACU;EACV,MAAM8C,KAA4B,KAAKC,8BACnC,cACA,eACA7C,MAAAA;EAEJT,iBAAiBuD,+BAA+BF,IAAI9C,OAAAA;EAEpD,MAAM2C,WAAW,MAAMG,GAAGG,kBAAiB;EAC3C,MAAMC,eAAetD,oBAAoBuD,mBACrC,KAAK7C,SACL,KAAKe,UACL,cACAsB,SAASS,GAAG;EAGhB,MAAM,KAAKV,iBAAiBC,SAASA,QAAQ;EAE7C/C,oBAAoByD,wBAChB,KAAKhC,UACLnB,QACAyC,SAASA,UACTO,cACA;GACII,OAAO;GACP,GAAGtD;EACP,CAAA;EAOJ,MAAM,KAAKwC,gBAAgBtC,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMqD,cACFrD,QACAF,SACY;EACZ,MAAM2C,WAAW,MAAM,MAAMY,cAAcrD,QAAQF,OAAAA;EAEnD,MAAM,KAAK0C,iBAAiBC,QAAAA;EAE5B,OAAOA;CACX;CAIA,MAAMa,kBACFtD,QACAF,SACU;EACV,MAAM8C,KAAK,KAAKW,4BACZ,cACA,eACAvD,MAAAA;EAEJT,iBAAiBuD,+BAA+BF,IAAI9C,OAAAA;EAEpD,MAAM2C,WAAW,MAAMG,GAAGG,kBAAiB;EAC3C,MAAMC,eAAetD,oBAAoBuD,mBACrC,KAAK7C,SACL,KAAKe,UACL,cACAsB,SAASS,GAAG;EAGhB,MAAM,KAAKV,iBAAiBC,SAASA,QAAQ;EAE7C/C,oBAAoB8D,sBAChB,KAAKrC,UACLnB,QACAyC,SAASA,UACTO,YAAAA;EAEJ,OAAOhD;CACX;CAIA,MAAMyD,mBAAmBzD,QAAWI,SAAyB;EAEzD,IAAI,CADoB,KAAKe,SAASwC,eAAe,EAAE,CAACC,eAAe5D,MAClE0D,GACD;EAIJ,IAAI,CADiB,KAAKvC,SAAS2C,sBAE/B;EAGJ,IAAI1D,SACA,MAAM,KAAK2D,0BAA0B/D,QAAQI,OAAAA;OAE7C,MAAM,KAAKA,QAAQ4D,WAAWC,YAAY,OAAO7D,YAAAA;GAC7C,MAAM,KAAK2D,0BAA0B/D,QAAQI,OAAAA;EACjD,CAAA;CAER;CAEA,MAAc2D,0BAA0B/D,QAAWI,SAAwB;EACvE,MAAMsD,kBAAkB,KAAKvC,SAASwC,eAAe,EAAE,CAACC,eAAe5D,MAAAA;EAEvE,MAAM,EAAEkE,cAAc,KAAK/C,SAAS2C;EACpC,MAAMK,iBAAiB,KAAKhD,SAAS2C,qBAAqBM,gBAAgB;EAC1E,MAAMC,mBAAmB,KAAKlD,SAAS2C,qBAAqBQ,kBAAkB;EAE9E,MAAMC,SAASC,UAAkBpE,QAAQ4D,WAAWS,OAAOC,gBAAgB,IAAIF,SAASA,KAAAA;EAGxF,MAAMG,YAAY,MAAMvE,QAAQwE,MAC5B;wBACYV,UAAU;yBACTC,eAAeU,aAAa,MAAMR,iBAAiBQ,aAAa;yBAChER,iBAAiBQ,aAAa,KAAKN,MAAM,CAAA,EAAG;yBAC5CJ,eAAeU,aAAa,MAAMN,MAAM,CAAA,KACrD,CAACb,iBAAiBA,eAAgB,CAAA;EAGtC,IAAI,CAAC,KAAKvC,SAAS2D,oBACf;EAGJ,MAAMC,WAAW,KAAK5D,SAAS2D,mBAAmBE,YAAY,EAAE,CAACpB,eAAe5D,MAAAA;EAEhF,IAAIiF;EACJ,IAAIF,UACAE,cAAc,CACVF,UACGJ,GAAAA,UACEO,QAAQC,aAAaA,SAAShB,eAAeU,kBAAkBE,QAAAA,CAAAA,CAC/DnE,KAAKuE,aAAaA,SAAShB,eAAeU,aAAa,CAC/D;OAEDI,cAAcN,UAAU/D,KAAKuE,aAAaA,SAAShB,eAAeU,aAAa;EAGnF,IAAII,YAAYG,WAAW,GACvB;EAIJ,MAAMC,cAAc,MAAMjF,QAAQwE,MAC9B;4BACgBV,UAAU;6BACTC,eAAeU,aAAa,MAAMR,iBAAiBQ,aAAa;6BAChEV,eAAeU,aAAa,KAAKN,MAAM,CAAA,EAAG;6BAC1CF,iBAAiBQ,aAAa,MAAMN,MAAM,CAAA,KAC3D,CAACb,iBAAiBA,eAAgB,CAAA;EAGtC,IAAIqB,UAAU;GAEV,MAAMO,gBAAgBD,YACjBzE,KAAK2E,eAAeA,WAAWlB,iBAAiBQ,aAAa;GAElE,IAAIS,cAAcF,SAAS,GAAG;IAE1B,MAAMI,eAAeF,cAAc1E,KAAK6E,GAAG5E,MAAM0D,MAAM1D,IAAI,CAAA,CAAA,CAAA,CAAI6E,KAAK,GAAA;IAWpE,MAAME,OAAMD,MAVyBvF,QAAQwE,MACzC;gCACYV,UAAU;;+BAEXC,eAAeU,aAAa,MAAMN,MAAM,CAAA,EAAG;+BAC3CJ,eAAeU,aAAa,MAAMR,iBAAiBQ,aAAa;+BAChER,iBAAiBQ,aAAa,OAAOW,aAAa,IAC7D,CAAC9B,iBAAoB4B,GAAAA,aAAc,CAAA,EAAA,CAGJO,QAAQD,KAAKE,SAAAA;KAC5C,IAAI,CAACF,IAAIE,KAAKzB,iBAAiBQ,gBAC3Be,IAAIE,KAAKzB,iBAAiBQ,iBAAiB,CAAA;KAG/Ce,IAAIE,KAAKzB,iBAAiBQ,cAAc,CAACkB,KAAKD,KAAK3B,eAAeU,aAAa;KAC/E,OAAOe;IACX,GAAG,CAAC,CAAA;IAGJ,KAAK,MAAML,cAAcD,eAAe;KACpC,MAAMU,wBAAwBJ,IAAIL,eAAe,CAAA;KAEjD,KAAK,MAAMU,cAAchB,aAErB,IADce,sBAAsBE,QAAQD,UACxCzB,MAAU,IACV,MAAMpE,QAAQwE,MACV,eAAeV,UAAU;uCAClBC,eAAeU,aAAa,IAAIR,iBAAiBQ,aAAa;8CACvDN,MAAM,CAAA,EAAG,IAAIA,MAAM,CAAA,EAAG,IACpC,CAAC0B,YAAYV,UAAW,CAAA;IAIxC;GACJ;EACJ,OAAO;GACH,MAAMD,gBAAgB,CAClB5B,iBACG2B,GAAAA,YAAYzE,KAAK2E,eAAeA,WAAWlB,iBAAiBQ,aAAa,CAC/E;GAED,KAAK,MAAMoB,cAAchB,aACrB,KAAK,MAAMkB,gBAAgBb,eACvB,MAAMlF,QAAQwE,MACV,eAAeV,UAAU;oCACbC,eAAeU,aAAa,KAAKN,MAAM,CAAA,EAAG;oCAC1CF,iBAAiBQ,aAAa,KAAKN,MAAM,CAAA,KACrD,CAAC0B,YAAYE,YAAa,CAAA;EAI1C;CACJ;AACJ"}
+{"version":3,"file":"repository.mjs","names":["FindOptionsUtils","InstanceChecker","TreeRepository","TreeRepositoryUtils","ExtraAttributesTreeRepositoryAdapter","EATreeRepository","adapter","options","instance","entity","attributeEntity","ctx","isDataSource","manager","repository","attributeRepository","getRepository","create","entityLike","Array","isArray","map","i","preserveExtraAttributes","source","columns","Set","col","metadata","add","propertyName","rel","relations","key","value","Object","entries","has","saveOneWithEA","input","attributes","saveWithEA","findOneWithEA","extraOptions","findOneWithEAByPrimaryColumn","findManyWithEA","findWithEA","extendOneWithEA","output","extendManyWithEA","entities","findRoots","findDescendantsTree","qb","createDescendantsQueryBuilder","applyOptionsToTreeQueryBuilder","getRawAndEntities","relationMaps","createRelationMaps","raw","buildChildrenEntityTree","depth","findAncestors","findAncestorsTree","createAncestorsQueryBuilder","buildParentEntityTree","updateClosureTable","primaryKeyValue","primaryColumns","getEntityValue","closureTable","closureJunctionTable","executeClosureTableUpdate","connection","transaction","tableName","ancestorColumn","ancestorColumns","descendantColumn","descendantColumns","param","index","driver","createParameter","ancestors","query","databasePath","treeParentRelation","parentId","joinColumns","ancestorIds","filter","ancestor","length","descendants","descendantIds","descendant","placeholders","_","join","ancestorsOfDescendants","acc","reduce","curr","push","ancestorsOfDescendent","ancestorId","indexOf","descendantId"],"sources":["../../../../../src/adapters/database/extra-attribute-repository/tree/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    DataSource, \n    DeepPartial, \n    EntityManager, \n    FindManyOptions, \n    FindOneOptions, \n    FindTreeOptions,\n    SelectQueryBuilder,\n} from 'typeorm';\nimport {\n    FindOptionsUtils,\n    InstanceChecker,\n    TreeRepository, \n    TreeRepositoryUtils,\n} from 'typeorm';\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { ExtraAttributesRepositoryAdapter } from '../adapter.ts';\nimport type {\n    EARepositoryEntityBase, \n    EARepositoryFindOptions, \n    EARepositoryOptions, \n    EARepositorySaveOptions, \n    IEARepository,\n} from '../types.ts';\nimport { ExtraAttributesTreeRepositoryAdapter } from './adapter.ts';\n\n/**\n * @see https://github.com/typeorm/typeorm/blob/master/src/repository/TreeRepository.ts\n */\nexport class EATreeRepository<\n    T extends ObjectLiteral = ObjectLiteral,\n    A extends EARepositoryEntityBase = EARepositoryEntityBase,\n> extends TreeRepository<T> implements IEARepository<T> {\n    protected adapter: ExtraAttributesRepositoryAdapter<T, A>;\n\n    protected options: EARepositoryOptions<T, A>;\n\n    constructor(\n        instance: DataSource | EntityManager,\n        options: EARepositoryOptions<T, A>,\n    ) {\n        const {\n            entity,\n            attributeEntity,\n            ...ctx\n        } = options;\n\n        super(\n            entity,\n            InstanceChecker.isDataSource(instance) ? instance.manager : instance,\n        );\n\n        this.options = options;\n        this.adapter = new ExtraAttributesTreeRepositoryAdapter<T, A>({\n            ...ctx,\n            repository: this,\n            attributeRepository: this.manager.getRepository(attributeEntity),\n        });\n    }\n\n    // ------------------------------------------------------------------------------\n\n    override create(): T;\n\n    override create(entityLikeArray: DeepPartial<T>[]): T[];\n\n    override create(entityLike: DeepPartial<T>): T;\n\n    override create(entityLike?: DeepPartial<T> | DeepPartial<T>[]): T | T[] {\n        if (!entityLike) {\n            return super.create();\n        }\n\n        if (Array.isArray(entityLike)) {\n            return super.create(entityLike).map((entity, i) => {\n                this.preserveExtraAttributes(entity, entityLike[i]);\n                return entity;\n            });\n        }\n\n        const entity = super.create(entityLike);\n        this.preserveExtraAttributes(entity, entityLike);\n        return entity;\n    }\n\n    private preserveExtraAttributes(entity: T, source: DeepPartial<T>): void {\n        const columns = new Set<string>();\n        for (const col of this.metadata.columns) {\n            columns.add(col.propertyName);\n        }\n        for (const rel of this.metadata.relations) {\n            columns.add(rel.propertyName);\n        }\n\n        for (const [key, value] of Object.entries(source as Record<string, any>)) {\n            if (!columns.has(key) && !(key in entity)) {\n                (entity as Record<string, any>)[key] = value;\n            }\n        }\n    }\n\n    // ------------------------------------------------------------------------------\n\n    async saveOneWithEA<E extends Record<string, any>>(\n        input: T & E,\n        attributes?: E,\n        options?: EARepositorySaveOptions<T>,\n    ): Promise<T & E> {\n        return this.adapter.saveWithEA(input, attributes, options);\n    }\n\n    // ------------------------------------------------------------------------------\n\n    async findOneWithEA(\n        options: FindOneOptions<T>,\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<T | undefined> {\n        return this.adapter.findOneWithEA(options, extraOptions);\n    }\n\n    async findOneWithEAByPrimaryColumn<E extends Record<string, any>>(\n        value: T[keyof T],\n        extraOptions?: EARepositoryFindOptions,\n    ): Promise<E> {\n        return this.adapter.findOneWithEAByPrimaryColumn(value, extraOptions);\n    }\n\n    async findManyWithEA<\n        E extends Record<string, any>,\n    >(\n        options: FindManyOptions<T>,\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<(T & E)[]> {\n        return this.adapter.findWithEA(options, extraOptions);\n    }\n\n    // ------------------------------------------------------------------------------\n\n    async extendOneWithEA<E extends Record<string, any>>(\n        entity: T,\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<T & E> {\n        const [output] = await this.extendManyWithEA([entity], extraOptions);\n\n        return output as (T & E);\n    }\n\n    async extendManyWithEA<E extends Record<string, any>>(\n        entities: T[],\n        extraOptions: EARepositoryFindOptions = {},\n    ): Promise<(T & E)[]> {\n        return this.adapter.extendManyWithEA(entities, extraOptions);\n    }\n\n    // -------------------------------------------------------------------------------\n\n    async findRoots(options?: FindTreeOptions): Promise<T[]> {\n        const entities = await super.findRoots(options);\n\n        await this.extendManyWithEA(entities);\n\n        return entities;\n    }\n\n    async findDescendantsTree(\n        entity: T,\n        options?: FindTreeOptions,\n    ): Promise<T> {\n        const qb: SelectQueryBuilder<T> = this.createDescendantsQueryBuilder(\n            'treeEntity',\n            'treeClosure',\n            entity,\n        );\n        FindOptionsUtils.applyOptionsToTreeQueryBuilder(qb, options);\n\n        const entities = await qb.getRawAndEntities();\n        const relationMaps = TreeRepositoryUtils.createRelationMaps(\n            this.manager,\n            this.metadata,\n            'treeEntity',\n            entities.raw,\n        );\n\n        await this.extendManyWithEA(entities.entities);\n\n        TreeRepositoryUtils.buildChildrenEntityTree(\n            this.metadata,\n            entity,\n            entities.entities,\n            relationMaps,\n            {\n                depth: -1,\n                ...options,\n            },\n        );\n\n        // The descendants closure may include the root, but `entity` here is a\n        // different reference than the one in `entities.entities`, so its own EA\n        // fields are not populated. Load them explicitly so leaf-as-root callers\n        // (e.g. policies bound directly to permissions/junctions) see EA.\n        await this.extendOneWithEA(entity);\n\n        return entity;\n    }\n\n    async findAncestors(\n        entity: T,\n        options?: FindTreeOptions,\n    ): Promise<T[]> {\n        const entities = await super.findAncestors(entity, options);\n\n        await this.extendManyWithEA(entities);\n\n        return entities;\n    }\n\n    // -------------------------------------------------------------------------------\n\n    async findAncestorsTree(\n        entity: T,\n        options?: FindTreeOptions,\n    ): Promise<T> {\n        const qb = this.createAncestorsQueryBuilder(\n            'treeEntity',\n            'treeClosure',\n            entity,\n        );\n        FindOptionsUtils.applyOptionsToTreeQueryBuilder(qb, options);\n\n        const entities = await qb.getRawAndEntities();\n        const relationMaps = TreeRepositoryUtils.createRelationMaps(\n            this.manager,\n            this.metadata,\n            'treeEntity',\n            entities.raw,\n        );\n\n        await this.extendManyWithEA(entities.entities);\n\n        TreeRepositoryUtils.buildParentEntityTree(\n            this.metadata,\n            entity,\n            entities.entities,\n            relationMaps,\n        );\n        return entity;\n    }\n\n    // -------------------------------------------------------------------------------\n\n    async updateClosureTable(entity: T, manager?: EntityManager) {\n        const primaryKeyValue = this.metadata.primaryColumns[0].getEntityValue(entity);\n        if (!primaryKeyValue) {\n            return;\n        }\n\n        const closureTable = this.metadata.closureJunctionTable;\n        if (!closureTable) {\n            return;\n        }\n\n        if (manager) {\n            await this.executeClosureTableUpdate(entity, manager);\n        } else {\n            await this.manager.connection.transaction(async (manager) => {\n                await this.executeClosureTableUpdate(entity, manager);\n            });\n        }\n    }\n\n    private async executeClosureTableUpdate(entity: T, manager: EntityManager) {\n        const primaryKeyValue = this.metadata.primaryColumns[0].getEntityValue(entity);\n\n        const { tableName } = this.metadata.closureJunctionTable;\n        const ancestorColumn = this.metadata.closureJunctionTable.ancestorColumns[0];\n        const descendantColumn = this.metadata.closureJunctionTable.descendantColumns[0];\n\n        const param = (index: number) => manager.connection.driver.createParameter(`p${index}`, index);\n\n        // 1. Get All ancestors of current entity\n        const ancestors = await manager.query<Record<string, any>[]>(\n            `SELECT *\n                 FROM ${tableName}\n                 WHERE ${ancestorColumn.databasePath} != ${descendantColumn.databasePath} AND\n                       ${descendantColumn.databasePath} = ${param(0)} AND\n                       ${ancestorColumn.databasePath} != ${param(1)}`,\n            [primaryKeyValue, primaryKeyValue],\n        );\n\n        if (!this.metadata.treeParentRelation) {\n            return;\n        }\n\n        const parentId = this.metadata.treeParentRelation.joinColumns[0].getEntityValue(entity);\n\n        let ancestorIds : string[];\n        if (parentId) {\n            ancestorIds = [\n                parentId,\n                ...ancestors\n                    .filter((ancestor) => ancestor[ancestorColumn.databasePath] !== parentId)\n                    .map((ancestor) => ancestor[ancestorColumn.databasePath]),\n            ];\n        } else {\n            ancestorIds = ancestors.map((ancestor) => ancestor[ancestorColumn.databasePath]);\n        }\n\n        if (ancestorIds.length === 0) {\n            return;\n        }\n\n        // 2. Get All descendants of current entity.\n        const descendants = await manager.query<Record<string, any>[]>(\n            `SELECT *\n                     FROM ${tableName}\n                     WHERE ${ancestorColumn.databasePath} != ${descendantColumn.databasePath} AND\n                           ${ancestorColumn.databasePath} = ${param(0)} AND\n                           ${descendantColumn.databasePath} != ${param(1)}`,\n            [primaryKeyValue, primaryKeyValue],\n        );\n\n        if (parentId) {\n            // 3. get all descendant\n            const descendantIds = descendants\n                .map((descendant) => descendant[descendantColumn.databasePath]);\n\n            if (descendantIds.length > 0) {\n                // 4. get all ancestors of each descendant\n                const placeholders = descendantIds.map((_, i) => param(i + 1)).join(',');\n                const ancestorsOfDescendants = await manager.query<Record<string, any>[]>(\n                    `SELECT *\n                         FROM ${tableName}\n                         WHERE\n                             ${ancestorColumn.databasePath} != ${param(0)} AND\n                             ${ancestorColumn.databasePath} != ${descendantColumn.databasePath} AND\n                             ${descendantColumn.databasePath} IN (${placeholders})`,\n                    [primaryKeyValue, ...descendantIds],\n                );\n\n                const acc = ancestorsOfDescendants.reduce((acc, curr) => {\n                    if (!acc[curr[descendantColumn.databasePath]]) {\n                        acc[curr[descendantColumn.databasePath]] = [];\n                    }\n\n                    acc[curr[descendantColumn.databasePath]].push(curr[ancestorColumn.databasePath]);\n                    return acc;\n                }, {} as Record<string, string[]>);\n\n                // 5. Check if for each child a relation exists with each ancestor (create if not exist)\n                for (const descendant of descendantIds) {\n                    const ancestorsOfDescendent = acc[descendant] ?? [];\n\n                    for (const ancestorId of ancestorIds) {\n                        const index = ancestorsOfDescendent.indexOf(ancestorId);\n                        if (index === -1) {\n                            await manager.query(\n                                `INSERT INTO ${tableName}\n                                    (${ancestorColumn.databasePath}, ${descendantColumn.databasePath})\n                                    VALUES (${param(0)}, ${param(1)})`,\n                                [ancestorId, descendant],\n                            );\n                        }\n                    }\n                }\n            }\n        } else {\n            const descendantIds = [\n                primaryKeyValue,\n                ...descendants.map((descendant) => descendant[descendantColumn.databasePath]),\n            ];\n\n            for (const ancestorId of ancestorIds) {\n                for (const descendantId of descendantIds) {\n                    await manager.query(\n                        `DELETE FROM ${tableName}\n                            WHERE ${ancestorColumn.databasePath} = ${param(0)}\n                              AND ${descendantColumn.databasePath} = ${param(1)}`,\n                        [ancestorId, descendantId],\n                    );\n                }\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;GAoCA,IAAaK,mBAAb,cAGUH,eAAAA;CACII;CAEAC;CAEV,YACIC,UACAD,SACF;EACE,MAAM,EACFE,QACAC,iBACA,GAAGC,QACHJ;EAEJ,MACIE,QACAR,gBAAgBW,aAAaJ,QAAAA,IAAYA,SAASK,UAAUL,QAAAA;EAGhE,KAAKD,UAAUA;EACf,KAAKD,UAAU,IAAIF,qCAA2C;GAC1D,GAAGO;GACHG,YAAY;GACZC,qBAAqB,KAAKF,QAAQG,cAAcN,eAAAA;EACpD,CAAA;CACJ;CAUSO,OAAOC,YAAyD;EACrE,IAAI,CAACA,YACD,OAAO,MAAMD,OAAAA;EAGjB,IAAIE,MAAMC,QAAQF,UAAAA,GACd,OAAO,MAAMD,OAAOC,UAAAA,CAAAA,CAAYG,KAAKZ,QAAQa,MAAAA;GACzC,KAAKC,wBAAwBd,QAAQS,WAAWI,EAAE;GAClD,OAAOb;EACX,CAAA;EAGJ,MAAMA,SAAS,MAAMQ,OAAOC,UAAAA;EAC5B,KAAKK,wBAAwBd,QAAQS,UAAAA;EACrC,OAAOT;CACX;CAEQc,wBAAwBd,QAAWe,QAA8B;EACrE,MAAMC,0BAAU,IAAIC,IAAAA;EACpB,KAAK,MAAMC,OAAO,KAAKC,SAASH,SAC5BA,QAAQI,IAAIF,IAAIG,YAAY;EAEhC,KAAK,MAAMC,OAAO,KAAKH,SAASI,WAC5BP,QAAQI,IAAIE,IAAID,YAAY;EAGhC,KAAK,MAAM,CAACG,KAAKC,UAAUC,OAAOC,QAAQZ,MAAAA,GACtC,IAAI,CAACC,QAAQY,IAAIJ,GAAAA,KAAQ,EAAEA,OAAOxB,SAC7BA,OAA+BwB,OAAOC;CAGnD;CAIA,MAAMI,cACFC,OACAC,YACAjC,SACc;EACd,OAAO,KAAKD,QAAQmC,WAAWF,OAAOC,YAAYjC,OAAAA;CACtD;CAIA,MAAMmC,cACFnC,SACAoC,eAAwC,CAAC,GACnB;EACtB,OAAO,KAAKrC,QAAQoC,cAAcnC,SAASoC,YAAAA;CAC/C;CAEA,MAAMC,6BACFV,OACAS,cACU;EACV,OAAO,KAAKrC,QAAQsC,6BAA6BV,OAAOS,YAAAA;CAC5D;CAEA,MAAME,eAGFtC,SACAoC,eAAwC,CAAC,GACvB;EAClB,OAAO,KAAKrC,QAAQwC,WAAWvC,SAASoC,YAAAA;CAC5C;CAIA,MAAMI,gBACFtC,QACAkC,eAAwC,CAAC,GAC3B;EACd,MAAM,CAACK,UAAU,MAAM,KAAKC,iBAAiB,CAACxC,MAAO,GAAEkC,YAAAA;EAEvD,OAAOK;CACX;CAEA,MAAMC,iBACFC,UACAP,eAAwC,CAAC,GACvB;EAClB,OAAO,KAAKrC,QAAQ2C,iBAAiBC,UAAUP,YAAAA;CACnD;CAIA,MAAMQ,UAAU5C,SAAyC;EACrD,MAAM2C,WAAW,MAAM,MAAMC,UAAU5C,OAAAA;EAEvC,MAAM,KAAK0C,iBAAiBC,QAAAA;EAE5B,OAAOA;CACX;CAEA,MAAME,oBACF3C,QACAF,SACU;EACV,MAAM8C,KAA4B,KAAKC,8BACnC,cACA,eACA7C,MAAAA;EAEJT,iBAAiBuD,+BAA+BF,IAAI9C,OAAAA;EAEpD,MAAM2C,WAAW,MAAMG,GAAGG,kBAAiB;EAC3C,MAAMC,eAAetD,oBAAoBuD,mBACrC,KAAK7C,SACL,KAAKe,UACL,cACAsB,SAASS,GAAG;EAGhB,MAAM,KAAKV,iBAAiBC,SAASA,QAAQ;EAE7C/C,oBAAoByD,wBAChB,KAAKhC,UACLnB,QACAyC,SAASA,UACTO,cACA;GACII,OAAO;GACP,GAAGtD;EACP,CAAA;EAOJ,MAAM,KAAKwC,gBAAgBtC,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMqD,cACFrD,QACAF,SACY;EACZ,MAAM2C,WAAW,MAAM,MAAMY,cAAcrD,QAAQF,OAAAA;EAEnD,MAAM,KAAK0C,iBAAiBC,QAAAA;EAE5B,OAAOA;CACX;CAIA,MAAMa,kBACFtD,QACAF,SACU;EACV,MAAM8C,KAAK,KAAKW,4BACZ,cACA,eACAvD,MAAAA;EAEJT,iBAAiBuD,+BAA+BF,IAAI9C,OAAAA;EAEpD,MAAM2C,WAAW,MAAMG,GAAGG,kBAAiB;EAC3C,MAAMC,eAAetD,oBAAoBuD,mBACrC,KAAK7C,SACL,KAAKe,UACL,cACAsB,SAASS,GAAG;EAGhB,MAAM,KAAKV,iBAAiBC,SAASA,QAAQ;EAE7C/C,oBAAoB8D,sBAChB,KAAKrC,UACLnB,QACAyC,SAASA,UACTO,YAAAA;EAEJ,OAAOhD;CACX;CAIA,MAAMyD,mBAAmBzD,QAAWI,SAAyB;EAEzD,IAAI,CADoB,KAAKe,SAASwC,eAAe,EAAE,CAACC,eAAe5D,MAClE0D,GACD;EAIJ,IAAI,CADiB,KAAKvC,SAAS2C,sBAE/B;EAGJ,IAAI1D,SACA,MAAM,KAAK2D,0BAA0B/D,QAAQI,OAAAA;OAE7C,MAAM,KAAKA,QAAQ4D,WAAWC,YAAY,OAAO7D,YAAAA;GAC7C,MAAM,KAAK2D,0BAA0B/D,QAAQI,OAAAA;EACjD,CAAA;CAER;CAEA,MAAc2D,0BAA0B/D,QAAWI,SAAwB;EACvE,MAAMsD,kBAAkB,KAAKvC,SAASwC,eAAe,EAAE,CAACC,eAAe5D,MAAAA;EAEvE,MAAM,EAAEkE,cAAc,KAAK/C,SAAS2C;EACpC,MAAMK,iBAAiB,KAAKhD,SAAS2C,qBAAqBM,gBAAgB;EAC1E,MAAMC,mBAAmB,KAAKlD,SAAS2C,qBAAqBQ,kBAAkB;EAE9E,MAAMC,SAASC,UAAkBpE,QAAQ4D,WAAWS,OAAOC,gBAAgB,IAAIF,SAASA,KAAAA;EAGxF,MAAMG,YAAY,MAAMvE,QAAQwE,MAC5B;wBACYV,UAAU;yBACTC,eAAeU,aAAa,MAAMR,iBAAiBQ,aAAa;yBAChER,iBAAiBQ,aAAa,KAAKN,MAAM,CAAA,EAAG;yBAC5CJ,eAAeU,aAAa,MAAMN,MAAM,CAAA,KACrD,CAACb,iBAAiBA,eAAgB,CAAA;EAGtC,IAAI,CAAC,KAAKvC,SAAS2D,oBACf;EAGJ,MAAMC,WAAW,KAAK5D,SAAS2D,mBAAmBE,YAAY,EAAE,CAACpB,eAAe5D,MAAAA;EAEhF,IAAIiF;EACJ,IAAIF,UACAE,cAAc,CACVF,UACGJ,GAAAA,UACEO,QAAQC,aAAaA,SAAShB,eAAeU,kBAAkBE,QAAAA,CAAAA,CAC/DnE,KAAKuE,aAAaA,SAAShB,eAAeU,aAAa,CAC/D;OAEDI,cAAcN,UAAU/D,KAAKuE,aAAaA,SAAShB,eAAeU,aAAa;EAGnF,IAAII,YAAYG,WAAW,GACvB;EAIJ,MAAMC,cAAc,MAAMjF,QAAQwE,MAC9B;4BACgBV,UAAU;6BACTC,eAAeU,aAAa,MAAMR,iBAAiBQ,aAAa;6BAChEV,eAAeU,aAAa,KAAKN,MAAM,CAAA,EAAG;6BAC1CF,iBAAiBQ,aAAa,MAAMN,MAAM,CAAA,KAC3D,CAACb,iBAAiBA,eAAgB,CAAA;EAGtC,IAAIqB,UAAU;GAEV,MAAMO,gBAAgBD,YACjBzE,KAAK2E,eAAeA,WAAWlB,iBAAiBQ,aAAa;GAElE,IAAIS,cAAcF,SAAS,GAAG;IAE1B,MAAMI,eAAeF,cAAc1E,KAAK6E,GAAG5E,MAAM0D,MAAM1D,IAAI,CAAA,CAAA,CAAA,CAAI6E,KAAK,GAAA;IAWpE,MAAME,OAAMD,MAVyBvF,QAAQwE,MACzC;gCACYV,UAAU;;+BAEXC,eAAeU,aAAa,MAAMN,MAAM,CAAA,EAAG;+BAC3CJ,eAAeU,aAAa,MAAMR,iBAAiBQ,aAAa;+BAChER,iBAAiBQ,aAAa,OAAOW,aAAa,IAC7D,CAAC9B,iBAAoB4B,GAAAA,aAAc,CAAA,EAAA,CAGJO,QAAQD,KAAKE,SAAAA;KAC5C,IAAI,CAACF,IAAIE,KAAKzB,iBAAiBQ,gBAC3Be,IAAIE,KAAKzB,iBAAiBQ,iBAAiB,CAAA;KAG/Ce,IAAIE,KAAKzB,iBAAiBQ,cAAc,CAACkB,KAAKD,KAAK3B,eAAeU,aAAa;KAC/E,OAAOe;IACX,GAAG,CAAC,CAAA;IAGJ,KAAK,MAAML,cAAcD,eAAe;KACpC,MAAMU,wBAAwBJ,IAAIL,eAAe,CAAA;KAEjD,KAAK,MAAMU,cAAchB,aAErB,IADce,sBAAsBE,QAAQD,UACxCzB,MAAU,IACV,MAAMpE,QAAQwE,MACV,eAAeV,UAAU;uCAClBC,eAAeU,aAAa,IAAIR,iBAAiBQ,aAAa;8CACvDN,MAAM,CAAA,EAAG,IAAIA,MAAM,CAAA,EAAG,IACpC,CAAC0B,YAAYV,UAAW,CAAA;IAIxC;GACJ;EACJ,OAAO;GACH,MAAMD,gBAAgB,CAClB5B,iBACG2B,GAAAA,YAAYzE,KAAK2E,eAAeA,WAAWlB,iBAAiBQ,aAAa,CAC/E;GAED,KAAK,MAAMoB,cAAchB,aACrB,KAAK,MAAMkB,gBAAgBb,eACvB,MAAMlF,QAAQwE,MACV,eAAeV,UAAU;oCACbC,eAAeU,aAAa,KAAKN,MAAM,CAAA,EAAG;oCAC1CF,iBAAiBQ,aAAa,KAAKN,MAAM,CAAA,KACrD,CAAC0B,YAAYE,YAAa,CAAA;EAI1C;CACJ;AACJ"}

package/dist/adapters/database/index.mjs

@@ -64,11 +64,11 @@ import { UserPermissionSubscriber } from "./domains/user-permission/subscriber.m
 import { UserRoleEntity } from "./domains/user-role/entity.mjs";
 import { UserRoleSubscriber } from "./domains/user-role/subscriber.mjs";
 import "./domains/index.mjs";
+import { DatabaseConflictError } from "./errors/conflict.mjs";
+import { getDatabaseDriverErrorCode, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError } from "./errors/driver.mjs";
+import "./errors/index.mjs";
 import { DatabaseQueryResultCache } from "./cache/module.mjs";
 import "./cache/index.mjs";
 import { DataSourceOptionsBuilder } from "./data-source/options/module.mjs";
 import "./data-source/index.mjs";
-import { DatabaseConflictError } from "./errors/conflict.mjs";
-import { getDatabaseDriverErrorCode, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError } from "./errors/driver.mjs";
-import "./errors/index.mjs";
 export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, EventEntity, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, SessionTokenEntity, TrustAnchorEntity, UserAttributeEntity, UserAttributeSubscriber, UserAuthenticatorEntity, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, getDatabaseDriverErrorCode, isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError };

package/dist/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The beta.64 release window, folded into one migration per dialect.
+ *
+ * ## `auth_sessions.secret` (plan 088 Stage 1: the console session credential)
+ *
+ * The opaque value a console browser presents in the `authup_session` cookie.
+ * It is NOT the session id: that id is published as the `sid` claim in every
+ * id_token and in every `/sessions` row, so it is a public identifier and
+ * cannot double as a credential. This column is the secret half.
+ *
+ * Nullable because every bearer-mode session has none, and unique so one value
+ * resolves at most one session. The entity additionally marks it
+ * `select: false`, so it is re-selected only by `findOneBySecret` and never on
+ * an ordinary session read.
+ *
+ * ## `auth_users.email_verified` (issue #3519: the OIDC claim gets a column)
+ *
+ * The claim was mapped onto `auth_users.active`, which is the account's
+ * enable flag and carries no statement about the address. It was wrong in
+ * both directions: registration sets `active` outright when email
+ * verification is off (the default), and a federated or provisioned user is
+ * created active with a synthesized `<name>@example.com`, so authup asserted
+ * a verified address nobody had ever received mail at; conversely an admin
+ * deactivating a user who DID complete activation flipped the claim back to
+ * false.
+ *
+ * NOT NULL DEFAULT false, so the ALTER backfills every existing row itself.
+ * False is the only safe backfill: `activate_hash` is null both after a
+ * completed activation and for a user who was never asked to verify, so the
+ * two states are indistinguishable and no row can be proven verified. An
+ * operator repairs a known-good address through the API. The column is
+ * admin-settable, and denied on the self-edit path by
+ * `system.user-names-self-manage`.
+ *
+ * ## `auth_clients` columns (issue #3355 and plan 064 Stage 1)
+ *
+ * `scope` was a text copy of the client's scope list that nothing has read
+ * since #3354: `/authorize` grants exactly the scopes bound in
+ * `auth_client_scopes`, so a value here never granted anything. `root_url`
+ * was stored and never resolved against anything. Both drop WITH their data;
+ * the generated down() re-adds them empty, and
+ * `docs/src/guide/deployment/upgrading.md` carries the export query for an
+ * operator who set either.
+ *
+ * `backchannel_logout_uri` is the one absolute http(s) URL Authup POSTs a
+ * signed `logout_token` to when a session the client received tokens for is
+ * revoked (OIDC Back-Channel Logout 1.0). Nullable with no default, so every
+ * existing row and every provisioned system client starts with no push.
+ */
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class SessionUserAndClientColumns1787571998009 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1787571998009-SessionUserAndClientColumns.d.ts.map

package/dist/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1787571998009-SessionUserAndClientColumns.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D,qBAAa,wCAAyC,YAAW,kBAAkB;IAC/E,IAAI,SAA8C;IAErC,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAsB7D"}

package/dist/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.mjs

@@ -0,0 +1,105 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.ts
+/**
+* The beta.64 release window, folded into one migration per dialect.
+*
+* ## `auth_sessions.secret` (plan 088 Stage 1: the console session credential)
+*
+* The opaque value a console browser presents in the `authup_session` cookie.
+* It is NOT the session id: that id is published as the `sid` claim in every
+* id_token and in every `/sessions` row, so it is a public identifier and
+* cannot double as a credential. This column is the secret half.
+*
+* Nullable because every bearer-mode session has none, and unique so one value
+* resolves at most one session. The entity additionally marks it
+* `select: false`, so it is re-selected only by `findOneBySecret` and never on
+* an ordinary session read.
+*
+* ## `auth_users.email_verified` (issue #3519: the OIDC claim gets a column)
+*
+* The claim was mapped onto `auth_users.active`, which is the account's
+* enable flag and carries no statement about the address. It was wrong in
+* both directions: registration sets `active` outright when email
+* verification is off (the default), and a federated or provisioned user is
+* created active with a synthesized `<name>@example.com`, so authup asserted
+* a verified address nobody had ever received mail at; conversely an admin
+* deactivating a user who DID complete activation flipped the claim back to
+* false.
+*
+* NOT NULL DEFAULT false, so the ALTER backfills every existing row itself.
+* False is the only safe backfill: `activate_hash` is null both after a
+* completed activation and for a user who was never asked to verify, so the
+* two states are indistinguishable and no row can be proven verified. An
+* operator repairs a known-good address through the API. The column is
+* admin-settable, and denied on the self-edit path by
+* `system.user-names-self-manage`.
+*
+* ## `auth_clients` columns (issue #3355 and plan 064 Stage 1)
+*
+* `scope` was a text copy of the client's scope list that nothing has read
+* since #3354: `/authorize` grants exactly the scopes bound in
+* `auth_client_scopes`, so a value here never granted anything. `root_url`
+* was stored and never resolved against anything. Both drop WITH their data;
+* the generated down() re-adds them empty, and
+* `docs/src/guide/deployment/upgrading.md` carries the export query for an
+* operator who set either.
+*
+* `backchannel_logout_uri` is the one absolute http(s) URL Authup POSTs a
+* signed `logout_token` to when a session the client received tokens for is
+* revoked (OIDC Back-Channel Logout 1.0). Nullable with no default, so every
+* existing row and every provisioned system client starts with no push.
+*/ var SessionUserAndClientColumns1787571998009 = class {
+	name = "SessionUserAndClientColumns1787571998009";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\`
+            ADD \`secret\` varchar(64) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\`
+            ADD UNIQUE INDEX \`IDX_833c743f7cd787dfc8b70ba400\` (\`secret\`)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_users\`
+            ADD \`email_verified\` tinyint NOT NULL DEFAULT 0
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`root_url\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`scope\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\`
+            ADD \`backchannel_logout_uri\` varchar(2000) NULL
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`backchannel_logout_uri\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\`
+            ADD \`scope\` varchar(512) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\`
+            ADD \`root_url\` varchar(2000) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_users\` DROP COLUMN \`email_verified\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP INDEX \`IDX_833c743f7cd787dfc8b70ba400\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`secret\`
+        `);
+	}
+};
+//#endregion
+export { SessionUserAndClientColumns1787571998009 };
+
+//# sourceMappingURL=1787571998009-SessionUserAndClientColumns.mjs.map

package/dist/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1787571998009-SessionUserAndClientColumns.mjs","names":["SessionUserAndClientColumns1787571998009","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1787571998009-SessionUserAndClientColumns.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The beta.64 release window, folded into one migration per dialect.\n *\n * ## `auth_sessions.secret` (plan 088 Stage 1: the console session credential)\n *\n * The opaque value a console browser presents in the `authup_session` cookie.\n * It is NOT the session id: that id is published as the `sid` claim in every\n * id_token and in every `/sessions` row, so it is a public identifier and\n * cannot double as a credential. This column is the secret half.\n *\n * Nullable because every bearer-mode session has none, and unique so one value\n * resolves at most one session. The entity additionally marks it\n * `select: false`, so it is re-selected only by `findOneBySecret` and never on\n * an ordinary session read.\n *\n * ## `auth_users.email_verified` (issue #3519: the OIDC claim gets a column)\n *\n * The claim was mapped onto `auth_users.active`, which is the account's\n * enable flag and carries no statement about the address. It was wrong in\n * both directions: registration sets `active` outright when email\n * verification is off (the default), and a federated or provisioned user is\n * created active with a synthesized `<name>@example.com`, so authup asserted\n * a verified address nobody had ever received mail at; conversely an admin\n * deactivating a user who DID complete activation flipped the claim back to\n * false.\n *\n * NOT NULL DEFAULT false, so the ALTER backfills every existing row itself.\n * False is the only safe backfill: `activate_hash` is null both after a\n * completed activation and for a user who was never asked to verify, so the\n * two states are indistinguishable and no row can be proven verified. An\n * operator repairs a known-good address through the API. The column is\n * admin-settable, and denied on the self-edit path by\n * `system.user-names-self-manage`.\n *\n * ## `auth_clients` columns (issue #3355 and plan 064 Stage 1)\n *\n * `scope` was a text copy of the client's scope list that nothing has read\n * since #3354: `/authorize` grants exactly the scopes bound in\n * `auth_client_scopes`, so a value here never granted anything. `root_url`\n * was stored and never resolved against anything. Both drop WITH their data;\n * the generated down() re-adds them empty, and\n * `docs/src/guide/deployment/upgrading.md` carries the export query for an\n * operator who set either.\n *\n * `backchannel_logout_uri` is the one absolute http(s) URL Authup POSTs a\n * signed `logout_token` to when a session the client received tokens for is\n * revoked (OIDC Back-Channel Logout 1.0). Nullable with no default, so every\n * existing row and every provisioned system client starts with no push.\n */\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\nexport class SessionUserAndClientColumns1787571998009 implements MigrationInterface {\n    name = 'SessionUserAndClientColumns1787571998009';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\`\n            ADD \\`secret\\` varchar(64) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\`\n            ADD UNIQUE INDEX \\`IDX_833c743f7cd787dfc8b70ba400\\` (\\`secret\\`)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_users\\`\n            ADD \\`email_verified\\` tinyint NOT NULL DEFAULT 0\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`root_url\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`scope\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\`\n            ADD \\`backchannel_logout_uri\\` varchar(2000) NULL\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`backchannel_logout_uri\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\`\n            ADD \\`scope\\` varchar(512) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\`\n            ADD \\`root_url\\` varchar(2000) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_users\\` DROP COLUMN \\`email_verified\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP INDEX \\`IDX_833c743f7cd787dfc8b70ba400\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`secret\\`\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,IAAaA,2CAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The beta.64 release window, folded into one migration per dialect.
+ *
+ * ## `auth_sessions.secret` (plan 088 Stage 1: the console session credential)
+ *
+ * The opaque value a console browser presents in the `authup_session` cookie.
+ * It is NOT the session id: that id is published as the `sid` claim in every
+ * id_token and in every `/sessions` row, so it is a public identifier and
+ * cannot double as a credential. This column is the secret half.
+ *
+ * Nullable because every bearer-mode session has none, and unique so one value
+ * resolves at most one session. The entity additionally marks it
+ * `select: false`, so it is re-selected only by `findOneBySecret` and never on
+ * an ordinary session read.
+ *
+ * ## `auth_users.email_verified` (issue #3519: the OIDC claim gets a column)
+ *
+ * The claim was mapped onto `auth_users.active`, which is the account's
+ * enable flag and carries no statement about the address. It was wrong in
+ * both directions: registration sets `active` outright when email
+ * verification is off (the default), and a federated or provisioned user is
+ * created active with a synthesized `<name>@example.com`, so authup asserted
+ * a verified address nobody had ever received mail at; conversely an admin
+ * deactivating a user who DID complete activation flipped the claim back to
+ * false.
+ *
+ * NOT NULL DEFAULT false, so the ALTER backfills every existing row itself.
+ * False is the only safe backfill: `activate_hash` is null both after a
+ * completed activation and for a user who was never asked to verify, so the
+ * two states are indistinguishable and no row can be proven verified. An
+ * operator repairs a known-good address through the API. The column is
+ * admin-settable, and denied on the self-edit path by
+ * `system.user-names-self-manage`.
+ *
+ * ## `auth_clients` columns (issue #3355 and plan 064 Stage 1)
+ *
+ * `scope` was a text copy of the client's scope list that nothing has read
+ * since #3354: `/authorize` grants exactly the scopes bound in
+ * `auth_client_scopes`, so a value here never granted anything. `root_url`
+ * was stored and never resolved against anything. Both drop WITH their data;
+ * the generated down() re-adds them empty, and
+ * `docs/src/guide/deployment/upgrading.md` carries the export query for an
+ * operator who set either.
+ *
+ * `backchannel_logout_uri` is the one absolute http(s) URL Authup POSTs a
+ * signed `logout_token` to when a session the client received tokens for is
+ * revoked (OIDC Back-Channel Logout 1.0). Nullable with no default, so every
+ * existing row and every provisioned system client starts with no push.
+ */
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class SessionUserAndClientColumns1787571998009 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1787571998009-SessionUserAndClientColumns.d.ts.map

package/dist/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1787571998009-SessionUserAndClientColumns.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D,qBAAa,wCAAyC,YAAW,kBAAkB;IAC/E,IAAI,SAA8C;IAErC,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAsB7D"}

package/dist/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.mjs

@@ -0,0 +1,104 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.ts
+/**
+* The beta.64 release window, folded into one migration per dialect.
+*
+* ## `auth_sessions.secret` (plan 088 Stage 1: the console session credential)
+*
+* The opaque value a console browser presents in the `authup_session` cookie.
+* It is NOT the session id: that id is published as the `sid` claim in every
+* id_token and in every `/sessions` row, so it is a public identifier and
+* cannot double as a credential. This column is the secret half.
+*
+* Nullable because every bearer-mode session has none, and unique so one value
+* resolves at most one session. The entity additionally marks it
+* `select: false`, so it is re-selected only by `findOneBySecret` and never on
+* an ordinary session read.
+*
+* ## `auth_users.email_verified` (issue #3519: the OIDC claim gets a column)
+*
+* The claim was mapped onto `auth_users.active`, which is the account's
+* enable flag and carries no statement about the address. It was wrong in
+* both directions: registration sets `active` outright when email
+* verification is off (the default), and a federated or provisioned user is
+* created active with a synthesized `<name>@example.com`, so authup asserted
+* a verified address nobody had ever received mail at; conversely an admin
+* deactivating a user who DID complete activation flipped the claim back to
+* false.
+*
+* NOT NULL DEFAULT false, so the ALTER backfills every existing row itself.
+* False is the only safe backfill: `activate_hash` is null both after a
+* completed activation and for a user who was never asked to verify, so the
+* two states are indistinguishable and no row can be proven verified. An
+* operator repairs a known-good address through the API. The column is
+* admin-settable, and denied on the self-edit path by
+* `system.user-names-self-manage`.
+*
+* ## `auth_clients` columns (issue #3355 and plan 064 Stage 1)
+*
+* `scope` was a text copy of the client's scope list that nothing has read
+* since #3354: `/authorize` grants exactly the scopes bound in
+* `auth_client_scopes`, so a value here never granted anything. `root_url`
+* was stored and never resolved against anything. Both drop WITH their data;
+* the generated down() re-adds them empty, and
+* `docs/src/guide/deployment/upgrading.md` carries the export query for an
+* operator who set either.
+*
+* `backchannel_logout_uri` is the one absolute http(s) URL Authup POSTs a
+* signed `logout_token` to when a session the client received tokens for is
+* revoked (OIDC Back-Channel Logout 1.0). Nullable with no default, so every
+* existing row and every provisioned system client starts with no push.
+*/ var SessionUserAndClientColumns1787571998009 = class {
+	name = "SessionUserAndClientColumns1787571998009";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions"
+            ADD "secret" character varying(64)
+        `);
+		await queryRunner.query(`
+            CREATE UNIQUE INDEX "IDX_833c743f7cd787dfc8b70ba400" ON "auth_sessions" ("secret")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_users"
+            ADD "email_verified" boolean NOT NULL DEFAULT false
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "scope"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "root_url"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients"
+            ADD "backchannel_logout_uri" character varying(2000)
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "backchannel_logout_uri"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients"
+            ADD "root_url" character varying(2000)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients"
+            ADD "scope" character varying(512)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_users" DROP COLUMN "email_verified"
+        `);
+		await queryRunner.query(`
+            DROP INDEX "public"."IDX_833c743f7cd787dfc8b70ba400"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "secret"
+        `);
+	}
+};
+//#endregion
+export { SessionUserAndClientColumns1787571998009 };
+
+//# sourceMappingURL=1787571998009-SessionUserAndClientColumns.mjs.map

package/dist/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1787571998009-SessionUserAndClientColumns.mjs","names":["SessionUserAndClientColumns1787571998009","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1787571998009-SessionUserAndClientColumns.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The beta.64 release window, folded into one migration per dialect.\n *\n * ## `auth_sessions.secret` (plan 088 Stage 1: the console session credential)\n *\n * The opaque value a console browser presents in the `authup_session` cookie.\n * It is NOT the session id: that id is published as the `sid` claim in every\n * id_token and in every `/sessions` row, so it is a public identifier and\n * cannot double as a credential. This column is the secret half.\n *\n * Nullable because every bearer-mode session has none, and unique so one value\n * resolves at most one session. The entity additionally marks it\n * `select: false`, so it is re-selected only by `findOneBySecret` and never on\n * an ordinary session read.\n *\n * ## `auth_users.email_verified` (issue #3519: the OIDC claim gets a column)\n *\n * The claim was mapped onto `auth_users.active`, which is the account's\n * enable flag and carries no statement about the address. It was wrong in\n * both directions: registration sets `active` outright when email\n * verification is off (the default), and a federated or provisioned user is\n * created active with a synthesized `<name>@example.com`, so authup asserted\n * a verified address nobody had ever received mail at; conversely an admin\n * deactivating a user who DID complete activation flipped the claim back to\n * false.\n *\n * NOT NULL DEFAULT false, so the ALTER backfills every existing row itself.\n * False is the only safe backfill: `activate_hash` is null both after a\n * completed activation and for a user who was never asked to verify, so the\n * two states are indistinguishable and no row can be proven verified. An\n * operator repairs a known-good address through the API. The column is\n * admin-settable, and denied on the self-edit path by\n * `system.user-names-self-manage`.\n *\n * ## `auth_clients` columns (issue #3355 and plan 064 Stage 1)\n *\n * `scope` was a text copy of the client's scope list that nothing has read\n * since #3354: `/authorize` grants exactly the scopes bound in\n * `auth_client_scopes`, so a value here never granted anything. `root_url`\n * was stored and never resolved against anything. Both drop WITH their data;\n * the generated down() re-adds them empty, and\n * `docs/src/guide/deployment/upgrading.md` carries the export query for an\n * operator who set either.\n *\n * `backchannel_logout_uri` is the one absolute http(s) URL Authup POSTs a\n * signed `logout_token` to when a session the client received tokens for is\n * revoked (OIDC Back-Channel Logout 1.0). Nullable with no default, so every\n * existing row and every provisioned system client starts with no push.\n */\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\nexport class SessionUserAndClientColumns1787571998009 implements MigrationInterface {\n    name = 'SessionUserAndClientColumns1787571998009';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\"\n            ADD \"secret\" character varying(64)\n        `);\n        await queryRunner.query(`\n            CREATE UNIQUE INDEX \"IDX_833c743f7cd787dfc8b70ba400\" ON \"auth_sessions\" (\"secret\")\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_users\"\n            ADD \"email_verified\" boolean NOT NULL DEFAULT false\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"scope\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"root_url\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\"\n            ADD \"backchannel_logout_uri\" character varying(2000)\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"backchannel_logout_uri\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\"\n            ADD \"root_url\" character varying(2000)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\"\n            ADD \"scope\" character varying(512)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_users\" DROP COLUMN \"email_verified\"\n        `);\n        await queryRunner.query(`\n            DROP INDEX \"public\".\"IDX_833c743f7cd787dfc8b70ba400\"\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" DROP COLUMN \"secret\"\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,IAAaA,2CAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/database/subscriber/module.d.ts

@@ -1,7 +1,7 @@
 import type { EntityType } from '@authup/core-kit';
 import { EntityDefaultEventName } from '@authup/core-kit';
 import type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';
-import type { DataSource, EntitySubscriberInterface, InsertEvent, ObjectLiteral, RemoveEvent, UpdateEvent } from 'typeorm';
+import type { DataSource, EntityManager, EntitySubscriberInterface, InsertEvent, ObjectLiteral, RemoveEvent, UpdateEvent } from 'typeorm';
 import type { EntitySubscriberContext } from './types.ts';
 export declare function buildEntityDestinations<T extends ObjectLiteral>(type: `${EntityType}`, realmIds?: (data: T) => (string | null | undefined)[]): (data: T) => DomainEventDestinations;
 export declare class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {
@@ -14,6 +14,10 @@ export declare class EntitySubscriber<T extends ObjectLiteral> implements Entity
     afterUpdate(event: UpdateEvent<T>): Promise<any>;
     afterRemove(event: RemoveEvent<T>): Promise<any>;
     protected dropCacheKeys(connection: DataSource, data: T): Promise<void>;
-    protected publish(event: `${EntityDefaultEventName}`, data: T, dataPrevious?: T): Promise<void>;
+    /**
+     * `transaction` is the hook's `event.manager`: the after* hooks run inside
+     * the persist transaction, so a handler that persists rides it (#3539).
+     */
+    protected publish(event: `${EntityDefaultEventName}`, data: T, dataPrevious?: T, transaction?: EntityManager): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/database/subscriber/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,CACnB,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAClC,IAAI,EAAE,CAAC,EACP,YAAY,CAAC,EAAE,CAAC,GAChB,OAAO,CAAC,IAAI,CAAC;CAepB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,aAAa,EACb,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;IAQ9E;;;OAGG;cACa,OAAO,CACnB,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAClC,IAAI,EAAE,CAAC,EACP,YAAY,CAAC,EAAE,CAAC,EAChB,WAAW,CAAC,EAAE,aAAa,GAC3B,OAAO,CAAC,IAAI,CAAC;CAgBpB"}

package/dist/adapters/database/subscriber/module.mjs

@@ -36,24 +36,27 @@ var EntitySubscriber = class {
 	async afterInsert(event) {
 		if (!event.entity) return;
 		if (this.ctx.cache && this.ctx.cache.onInsert) await this.dropCacheKeys(event.connection, event.entity);
-		await this.publish(EntityDefaultEventName.CREATED, event.entity);
+		await this.publish(EntityDefaultEventName.CREATED, event.entity, void 0, event.manager);
 	}
 	async afterUpdate(event) {
 		if (!event.entity) return;
 		await this.dropCacheKeys(event.connection, event.entity);
-		await this.publish(EntityDefaultEventName.UPDATED, event.entity, event.databaseEntity);
+		await this.publish(EntityDefaultEventName.UPDATED, event.entity, event.databaseEntity, event.manager);
 	}
 	async afterRemove(event) {
 		const entity = event.databaseEntity ?? event.entity;
 		if (!entity) return;
 		await this.dropCacheKeys(event.connection, entity);
-		await this.publish(EntityDefaultEventName.DELETED, entity);
+		await this.publish(EntityDefaultEventName.DELETED, entity, void 0, event.manager);
 	}
 	async dropCacheKeys(connection, data) {
 		if (!this.ctx.cache || !connection.queryResultCache) return;
 		await connection.queryResultCache.remove(this.ctx.cache.keys(data));
 	}
-	async publish(event, data, dataPrevious) {
+	/**
+	* `transaction` is the hook's `event.manager`: the after* hooks run inside
+	* the persist transaction, so a handler that persists rides it (#3539).
+	*/ async publish(event, data, dataPrevious, transaction) {
 		if (!this.publisher) return;
 		await this.publisher.safePublish({
 			content: {
@@ -62,7 +65,8 @@ var EntitySubscriber = class {
 				data
 			},
 			destinations: this.ctx.destinations(data),
-			...dataPrevious ? { dataPrevious } : {}
+			...dataPrevious ? { dataPrevious } : {},
+			transaction
 		});
 	}
 };

package/dist/adapters/database/subscriber/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","databaseEntity","afterRemove","DELETED","queryResultCache","remove","keys","dataPrevious","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T, event.databaseEntity);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        // remove() strips the primary key from event.entity before the\n        // subscriber runs — databaseEntity is the pre-removal row and keeps\n        // the id-keyed cache invalidation (and the DELETED payload) intact.\n        const entity = event.databaseEntity ?? event.entity;\n        if (!entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, entity);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    protected async publish(\n        event: `${EntityDefaultEventName}`,\n        data: T,\n        dataPrevious?: T,\n    ) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n            ...(dataPrevious ? { dataPrevious } : {}),\n        });\n    }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CACvD;EAED,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,QAAaD,MAAMU,cAAc;CAC9F;CAEA,MAAMC,YAAYX,OAAqC;EAInD,MAAMC,SAASD,MAAMU,kBAAkBV,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QACZN,OACAnB,MACAmC,cACc;EACd,IAAI,CAAC,KAAKrB,WACN;EAGJ,MAAM,KAAKA,UAAUsB,YAAY;GAC7BC,SAAS;IACLvC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;GACpC,GAAImC,eAAe,EAAEA,aAAa,IAAI,CAAC;EAC3C,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","undefined","manager","afterUpdate","UPDATED","databaseEntity","afterRemove","DELETED","queryResultCache","remove","keys","dataPrevious","transaction","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n    EntityDefaultEventName,\n    buildEntityChannelName,\n    buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n    DataSource,\n    EntityManager,\n    EntitySubscriberInterface,\n    InsertEvent,\n    ObjectLiteral,\n    RemoveEvent,\n    UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n    type: `${EntityType}`,\n    realmIds?: (data: T) => (string | null | undefined)[],\n) : (data: T) => DomainEventDestinations {\n    return (data) => {\n        const destinations : DomainEventDestinations = [\n            { channel: (id) => buildEntityChannelName(type, id) },\n        ];\n\n        if (realmIds) {\n            const items = realmIds(data);\n            const seen = new Set<string>();\n            for (const realmId of items) {\n                if (realmId && !seen.has(realmId)) {\n                    seen.add(realmId);\n                    destinations.push({\n                        channel: (id) => buildEntityChannelName(type, id),\n                        namespace: buildEntityNamespaceName(realmId),\n                    });\n                }\n            }\n        }\n\n        return destinations;\n    };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n    protected ctx : EntitySubscriberContext<T>;\n\n    protected publisher? : IDomainEventPublisher;\n\n    constructor(ctx: EntitySubscriberContext<T>) {\n        this.ctx = ctx;\n        this.publisher = ctx.publisher;\n    }\n\n    setPublisher(publisher: IDomainEventPublisher) : void {\n        this.publisher = publisher;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n    listenTo() : Function | string {\n        return this.ctx.target;\n    }\n\n    async afterInsert(event: InsertEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        if (this.ctx.cache && this.ctx.cache.onInsert) {\n            await this.dropCacheKeys(event.connection, event.entity);\n        }\n\n        await this.publish(EntityDefaultEventName.CREATED, event.entity, undefined, event.manager);\n    }\n\n    async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n        if (!event.entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, event.entity as T);\n\n        await this.publish(EntityDefaultEventName.UPDATED, event.entity as T, event.databaseEntity, event.manager);\n    }\n\n    async afterRemove(event: RemoveEvent<T>): Promise<any> {\n        // remove() strips the primary key from event.entity before the\n        // subscriber runs — databaseEntity is the pre-removal row and keeps\n        // the id-keyed cache invalidation (and the DELETED payload) intact.\n        const entity = event.databaseEntity ?? event.entity;\n        if (!entity) {\n            return;\n        }\n\n        await this.dropCacheKeys(event.connection, entity);\n\n        await this.publish(EntityDefaultEventName.DELETED, entity, undefined, event.manager);\n    }\n\n    protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n        if (!this.ctx.cache || !connection.queryResultCache) {\n            return;\n        }\n\n        await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n    }\n\n    /**\n     * `transaction` is the hook's `event.manager`: the after* hooks run inside\n     * the persist transaction, so a handler that persists rides it (#3539).\n     */\n    protected async publish(\n        event: `${EntityDefaultEventName}`,\n        data: T,\n        dataPrevious?: T,\n        transaction?: EntityManager,\n    ) : Promise<void> {\n        if (!this.publisher) {\n            return;\n        }\n\n        await this.publisher.safePublish({\n            content: {\n                type: this.ctx.type,\n                event,\n                data,\n            },\n            destinations: this.ctx.destinations(data),\n            ...(dataPrevious ? { dataPrevious } : {}),\n            transaction,\n        });\n    }\n}\n"],"mappings":";;;;;AAyBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CACvD;EAED,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,QAAQO,KAAAA,GAAWR,MAAMS,OAAO;CAC7F;CAEA,MAAMC,YAAYV,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBoC,SAASX,MAAMC,QAAaD,MAAMY,gBAAgBZ,MAAMS,OAAO;CAC7G;CAEA,MAAMI,YAAYb,OAAqC;EAInD,MAAMC,SAASD,MAAMY,kBAAkBZ,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBuC,SAASb,QAAQO,KAAAA,GAAWR,MAAMS,OAAO;CACvF;CAEA,MAAgBL,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWU,kBAC/B;EAGJ,MAAMV,WAAWU,iBAAiBC,OAAO,KAAKtB,IAAIQ,MAAMe,KAAKpC,IAAAA,CAAAA;CACjE;;;;IAMA,MAAgByB,QACZN,OACAnB,MACAqC,cACAC,aACc;EACd,IAAI,CAAC,KAAKxB,WACN;EAGJ,MAAM,KAAKA,UAAUyB,YAAY;GAC7BC,SAAS;IACL1C,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;GACpC,GAAIqC,eAAe,EAAEA,aAAa,IAAI,CAAC;GACvCC;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs

@@ -30,7 +30,7 @@ var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 			client,
 			redirectUriVerified
 		});
-		if (this.consentService && client && !client.builtIn) try {
+		if (client && this.consentService && !client.builtIn) try {
 			await this.consentService.record({
 				clientId: client.id,
 				realmId: client.realmId,