@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/core/oauth2/session-credential/module.mjs

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./constants.mjs";
+import { createNanoID } from "@authup/kit";
+import { createHash } from "node:crypto";
+//#region src/core/oauth2/session-credential/module.ts
+/**
+* Mint the opaque credential a console browser presents (plan 088). It is
+* written to `auth_sessions.secret` (a `select: false` column resolved only by
+* `ISessionRepository.findOneBySecret`) and handed to the browser in the
+* console session cookie.
+*/ function createSessionSecret() {
+	return createNanoID(48);
+}
+/**
+* The value actually stored in `auth_sessions.secret`.
+*
+* `select: false` limits what the ORM projects; it does nothing about what the
+* database CONTAINS, so storing the credential verbatim would make any read of
+* that table — a leaked backup, a read replica, a SQL injection that only
+* SELECTs — a source of replayable `authup_session` cookies. The
+* column holds a digest instead, and the cookie value never lands anywhere it
+* can be read back.
+*
+* A plain SHA-256 rather than a keyed HMAC, deliberately. Keying defends a
+* LOW-entropy input against offline guessing, which is why a password needs
+* bcrypt; this input is 48 nanoid characters over a 36-symbol alphabet (~248
+* bits), so there is no guessing attack for a key to frustrate. A keyed scheme
+* would also have to be GLOBAL — the lookup resolves a session BY this value,
+* so the realm is unknown at that point and a per-realm key is unavailable —
+* and the only global key (`SECRETS_ENCRYPTION_KEY`) is optional, so keying
+* would either be absent by default or need key management of its own.
+*
+* Deterministic, so the lookup stays a single indexed equality. Hex SHA-256 is
+* exactly 64 characters, which is the column's width.
+*/ function hashSessionSecret(secret) {
+	return createHash("sha256").update(secret).digest("hex");
+}
+//#endregion
+export { createSessionSecret, hashSessionSecret };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/session-credential/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["createHash","createNanoID","SESSION_SECRET_LENGTH","createSessionSecret","hashSessionSecret","secret","update","digest"],"sources":["../../../../src/core/oauth2/session-credential/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createHash } from 'node:crypto';\nimport { createNanoID } from '@authup/kit';\nimport { SESSION_SECRET_LENGTH } from './constants.ts';\n\n/**\n * Mint the opaque credential a console browser presents (plan 088). It is\n * written to `auth_sessions.secret` (a `select: false` column resolved only by\n * `ISessionRepository.findOneBySecret`) and handed to the browser in the\n * console session cookie.\n */\nexport function createSessionSecret() : string {\n    return createNanoID(SESSION_SECRET_LENGTH);\n}\n\n/**\n * The value actually stored in `auth_sessions.secret`.\n *\n * `select: false` limits what the ORM projects; it does nothing about what the\n * database CONTAINS, so storing the credential verbatim would make any read of\n * that table — a leaked backup, a read replica, a SQL injection that only\n * SELECTs — a source of replayable `authup_session` cookies. The\n * column holds a digest instead, and the cookie value never lands anywhere it\n * can be read back.\n *\n * A plain SHA-256 rather than a keyed HMAC, deliberately. Keying defends a\n * LOW-entropy input against offline guessing, which is why a password needs\n * bcrypt; this input is 48 nanoid characters over a 36-symbol alphabet (~248\n * bits), so there is no guessing attack for a key to frustrate. A keyed scheme\n * would also have to be GLOBAL — the lookup resolves a session BY this value,\n * so the realm is unknown at that point and a per-realm key is unavailable —\n * and the only global key (`SECRETS_ENCRYPTION_KEY`) is optional, so keying\n * would either be absent by default or need key management of its own.\n *\n * Deterministic, so the lookup stays a single indexed equality. Hex SHA-256 is\n * exactly 64 characters, which is the column's width.\n */\nexport function hashSessionSecret(secret: string) : string {\n    return createHash('sha256').update(secret).digest('hex');\n}\n"],"mappings":";;;;;;;;;;;;GAiBA,SAAgBG,sBAAAA;CACZ,OAAOF,aAAAA,EAAaC;AACxB;;;;;;;;;;;;;;;;;;;;;;GAwBA,SAAgBE,kBAAkBC,QAAc;CAC5C,OAAOL,WAAW,QAAA,CAAA,CAAUM,OAAOD,MAAAA,CAAAA,CAAQE,OAAO,KAAA;AACtD"}

package/dist/core/oauth2/session-token/constants.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Rows removed per statement by the session-token expiry sweep. This is the
+ * highest-volume table in the schema (one row per issued access token, so one
+ * per ~15 minutes per active session), and the sweep runs every minute on
+ * every replica. A single unbounded DELETE would be one long transaction,
+ * issued concurrently by every replica. Batching keeps each statement
+ * bounded; the sweep still drains by looping.
+ */
+export declare const SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE = 1000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/session-token/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,OAAO,CAAC"}

package/dist/core/oauth2/session-token/constants.mjs

@@ -0,0 +1,16 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/session-token/constants.ts
+/**
+* Rows removed per statement by the session-token expiry sweep. This is the
+* highest-volume table in the schema (one row per issued access token, so one
+* per ~15 minutes per active session), and the sweep runs every minute on
+* every replica. A single unbounded DELETE would be one long transaction,
+* issued concurrently by every replica. Batching keeps each statement
+* bounded; the sweep still drains by looping.
+*/ const SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE = 1e3;
+//#endregion
+export { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/session-token/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE"],"sources":["../../../../src/core/oauth2/session-token/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rows removed per statement by the session-token expiry sweep. This is the\n * highest-volume table in the schema (one row per issued access token, so one\n * per ~15 minutes per active session), and the sweep runs every minute on\n * every replica. A single unbounded DELETE would be one long transaction,\n * issued concurrently by every replica. Batching keeps each statement\n * bounded; the sweep still drains by looping.\n */\nexport const SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE = 1000;\n"],"mappings":";;;;;;;;;;;GAeA,MAAaA,wCAAwC"}

package/dist/core/oauth2/session-token/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './error.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-token/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/session-token/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE } from "./constants.mjs";
 import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./error.mjs";
-export { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };
+export { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };

package/dist/core/oauth2/session-token/types.d.ts

@@ -101,10 +101,21 @@ export interface ISessionTokenRepository {
      */
     revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
     /**
-     * Delete every token row whose `expiresAt` is before the given timestamp.
+     * Expiry sweep: delete every token row whose `expiresAt` is before the
+     * given timestamp. Returns the number of removed rows. Removal is batched
+     * (see SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE).
      *
      * @param before iso timestamp
+     * @param options
      */
-    deleteExpired(before: string): Promise<number>;
+    deleteExpired(before: string, options?: SessionTokenDeleteExpiredOptions): Promise<number>;
 }
+export type SessionTokenDeleteExpiredOptions = {
+    /**
+     * Rows removed per statement. Defaults to
+     * SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, which anything that is not a
+     * positive safe integer also falls back to.
+     */
+    batchSize?: number;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/E;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEvD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/E;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEvD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;;;;OAOG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gCAAgC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9F;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/core/oauth2/token/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;IAE/B,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;gBAG/C,QAAQ,EAAG,SAAS,EACpB,eAAe,EAAG,sBAAsB;IAMtC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAI,OAAO,CAAC,kBAAkB,CAAC;CAwHpG"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;IAE/B,SAAS,CAAC,eAAe,EAAG,sBAAsB,CAAC;gBAG/C,QAAQ,EAAG,SAAS,EACpB,eAAe,EAAG,sBAAsB;IAMtC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAI,OAAO,CAAC,kBAAkB,CAAC;CA+HpG"}

package/dist/core/oauth2/token/verifier/module.mjs

@@ -27,9 +27,9 @@ var OAuth2TokenVerifier = class {
 		const header = extractTokenHeader(token);
 		if (!header.kid) throw JWTError.headerPropertyInvalid("kid");
 		const key = await this.keyStore.resolveById(header.kid);
-		if (!key) throw JWKError.notFound(header.kid);
-		if (key.use !== JWKUse.SIGNATURE) throw JWKError.notFound(header.kid);
-		if (key.status === KeyStatus.DISABLED) throw JWKError.notFound(header.kid);
+		if (!key) throw JWTError.headerPropertyInvalid("kid");
+		if (key.use !== JWKUse.SIGNATURE) throw JWTError.headerPropertyInvalid("kid");
+		if (key.status === KeyStatus.DISABLED) throw JWTError.headerPropertyInvalid("kid");
 		switch (key.type) {
 			case JWKType.OCT:
 				if (!key.decryptionKey) throw JWKError.decryptionKeyMissing();

package/dist/core/oauth2/token/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","KeyStatus","JWKError","JWKType","JWKUse","JWTError","OAuth2TokenVerifier","keyStore","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","resolveById","notFound","use","SIGNATURE","status","DISABLED","type","OCT","decryptionKey","decryptionKeyMissing","ignoreExpiry","EC","encryptionKey","signatureAlgorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm,\n    type TokenRSAAlgorithm,\n    extractTokenHeader,\n    verifyToken,\n} from '@authup/server-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWKError,\n    JWKType,\n    JWKUse,\n    JWTError,\n} from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyStore : IKeyStore;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyStore : IKeyStore,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyStore = keyStore;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyStore.resolveById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // the key store also holds at-rest encryption keys (use: enc) —\n        // those must never verify a token.\n        if (key.use !== JWKUse.SIGNATURE) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // disabled = neither signs nor verifies (passive still verifies).\n        if (key.status === KeyStatus.DISABLED) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryptionKey,\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryptionKey,\n                        ...(\n                            key.signatureAlgorithm ?\n                                { algorithms: [key.signatureAlgorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryptionKey,\n                        ...(\n                            key.signatureAlgorithm ?\n                                { algorithms: [key.signatureAlgorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        // Never populate the shared signature-keyed claims cache on the\n        // exp-ignoring path. An expired token verified with `ignoreExpiry`\n        // (the RP-initiated-logout id_token_hint) would otherwise be re-cached\n        // with buildTTL's 1h fallback (a past exp yields a non-positive ttl),\n        // and the cache-first branch above returns it with no exp re-check on\n        // every subsequent verify — so `/token/introspect` would report an\n        // expired token as active for up to an hour (RFC 7662). Keep the\n        // exp-bypass scoped to this single call.\n        if (!options.ignoreExpiry) {\n            await this.tokenRepository.saveWithSignature(payload, token);\n        }\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;;AAyBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,UACAC,iBACF;EACE,KAAKD,WAAWA;EAChB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK,iBAELT;QAAAA,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASrB,mBAAmBa,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,SAASiB,YAAYJ,OAAOC,GAAG;EACtD,IAAI,CAACE,KACD,MAAMrB,SAASuB,SAASL,OAAOC,GAAG;EAKtC,IAAIE,IAAIG,QAAQtB,OAAOuB,WACnB,MAAMzB,SAASuB,SAASL,OAAOC,GAAG;EAItC,IAAIE,IAAIK,WAAW3B,UAAU4B,UACzB,MAAM3B,SAASuB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIO,MAAZ;GACI,KAAK3B,QAAQ4B;IACT,IAAI,CAACR,IAAIS,eACL,MAAM9B,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAM3B,QAAQ4B;KACdR,KAAKA,IAAIS;IACb,GACA,EAAEE,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ,KAAK/B,QAAQgC;IACT,IAAI,CAACZ,IAAIa,eACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,qBACA,EAAEC,YAAY,CAACf,IAAIc,kBAAmB,EAAC,IACvC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ;IACI,IAAI,CAACX,IAAIa,eACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,qBACA,EAAEC,YAAY,CAACf,IAAIc,kBAAmB,EAAC,IACvC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;EAGjD;EAEA,IAAI,CAACpB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAW1C,IAAI,CAACJ,QAAQqB,cACT,MAAM,KAAK1B,gBAAgB+B,kBAAkBzB,SAASF,KAAAA;EAG1D,IAAI,CAACC,QAAQK,iBAELT;OAAAA,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","KeyStatus","JWKError","JWKType","JWKUse","JWTError","OAuth2TokenVerifier","keyStore","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","resolveById","use","SIGNATURE","status","DISABLED","type","OCT","decryptionKey","decryptionKeyMissing","ignoreExpiry","EC","encryptionKey","signatureAlgorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm,\n    type TokenRSAAlgorithm,\n    extractTokenHeader,\n    verifyToken,\n} from '@authup/server-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWKError,\n    JWKType,\n    JWKUse,\n    JWTError,\n} from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyStore : IKeyStore;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyStore : IKeyStore,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyStore = keyStore;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        // A `kid` that resolves to no usable verification key is a property of\n        // the TOKEN, not a missing JWK resource: `JWKError.notFound` is the\n        // right answer at `GET /jwks/:id`, and here it made a dead bearer 404\n        // on every resource route, escape the refresh grant's `isJWTError`\n        // catch as a 404 from `/token`, and drive the kit's http hook into its\n        // terminal branch instead of a refresh - so a key rotation ended every\n        // live browser session. It also stopped echoing the supplied `kid`.\n        const key = await this.keyStore.resolveById(header.kid);\n        if (!key) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        // the key store also holds at-rest encryption keys (use: enc) —\n        // those must never verify a token.\n        if (key.use !== JWKUse.SIGNATURE) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        // disabled = neither signs nor verifies (passive still verifies).\n        if (key.status === KeyStatus.DISABLED) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryptionKey,\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryptionKey,\n                        ...(\n                            key.signatureAlgorithm ?\n                                { algorithms: [key.signatureAlgorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryptionKey,\n                        ...(\n                            key.signatureAlgorithm ?\n                                { algorithms: [key.signatureAlgorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        // Never populate the shared signature-keyed claims cache on the\n        // exp-ignoring path. An expired token verified with `ignoreExpiry`\n        // (the RP-initiated-logout id_token_hint) would otherwise be re-cached\n        // with buildTTL's 1h fallback (a past exp yields a non-positive ttl),\n        // and the cache-first branch above returns it with no exp re-check on\n        // every subsequent verify — so `/token/introspect` would report an\n        // expired token as active for up to an hour (RFC 7662). Keep the\n        // exp-bypass scoped to this single call.\n        if (!options.ignoreExpiry) {\n            await this.tokenRepository.saveWithSignature(payload, token);\n        }\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;;AAyBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,UACAC,iBACF;EACE,KAAKD,WAAWA;EAChB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK,iBAELT;QAAAA,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASrB,mBAAmBa,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAUzC,MAAMC,MAAM,MAAM,KAAKhB,SAASiB,YAAYJ,OAAOC,GAAG;EACtD,IAAI,CAACE,KACD,MAAMlB,SAASiB,sBAAsB,KAAA;EAKzC,IAAIC,IAAIE,QAAQrB,OAAOsB,WACnB,MAAMrB,SAASiB,sBAAsB,KAAA;EAIzC,IAAIC,IAAII,WAAW1B,UAAU2B,UACzB,MAAMvB,SAASiB,sBAAsB,KAAA;EAGzC,QAAQC,IAAIM,MAAZ;GACI,KAAK1B,QAAQ2B;IACT,IAAI,CAACP,IAAIQ,eACL,MAAM7B,SAAS8B,qBAAoB;IAGvClB,UAAU,MAAMd,YACZY,OACA;KACIiB,MAAM1B,QAAQ2B;KACdP,KAAKA,IAAIQ;IACb,GACA,EAAEE,cAAcpB,QAAQoB,aAAa,CAAA;IAEzC;GAEJ,KAAK9B,QAAQ+B;IACT,IAAI,CAACX,IAAIY,eACL,MAAMjC,SAAS8B,qBAAoB;IAGvClB,UAAU,MAAMd,YACZY,OACA;KACIiB,MAAMN,IAAIM;KACVN,KAAKA,IAAIY;KACT,GACIZ,IAAIa,qBACA,EAAEC,YAAY,CAACd,IAAIa,kBAAmB,EAAC,IACvC,CAAA;IAEZ,GACA,EAAEH,cAAcpB,QAAQoB,aAAa,CAAA;IAEzC;GAEJ;IACI,IAAI,CAACV,IAAIY,eACL,MAAMjC,SAAS8B,qBAAoB;IAGvClB,UAAU,MAAMd,YACZY,OACA;KACIiB,MAAMN,IAAIM;KACVN,KAAKA,IAAIY;KACT,GACIZ,IAAIa,qBACA,EAAEC,YAAY,CAACd,IAAIa,kBAAmB,EAAC,IACvC,CAAA;IAEZ,GACA,EAAEH,cAAcpB,QAAQoB,aAAa,CAAA;EAGjD;EAEA,IAAI,CAACnB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAW1C,IAAI,CAACJ,QAAQoB,cACT,MAAM,KAAKzB,gBAAgB8B,kBAAkBxB,SAASF,KAAAA;EAG1D,IAAI,CAACC,QAAQK,iBAELT;OAAAA,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}

package/dist/core/provisioning/merge/module.mjs

@@ -45,8 +45,10 @@ function mergeProvisioningEntities(target, source, options = {}) {
 		...source.attributes
 	};
 	const inheritStrategy = options.inheritStrategy ?? true;
-	if (target.strategy && !source.strategy) if (inheritStrategy) output.strategy = target.strategy;
-	else delete output.strategy;
+	if (target.strategy && !source.strategy) {
+		if (inheritStrategy) output.strategy = target.strategy;
+		else delete output.strategy;
+	}
 	if (target.relations && source.relations) output.relations = mergeProvisioningRecord(target.relations, source.relations, options);
 	else if (target.relations && !source.relations) output.relations = target.relations;
 	if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
@@ -60,7 +62,7 @@ function mergeProvisioningEntities(target, source, options = {}) {
 }
 function mergeProvisioningRecord(target, source, options = {}) {
 	const output = { ...target };
-	for (const key of Object.keys(source)) output[key] = key in target ? mergeProvisioningValue(target[key], source[key], options) : source[key];
+	for (const [key, value] of Object.entries(source)) output[key] = key in target ? mergeProvisioningValue(target[key], value, options) : value;
 	return output;
 }
 function mergeProvisioningValue(target, source, options = {}) {

package/dist/core/provisioning/merge/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","Object","keys","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","value","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const key of Object.keys(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], source[key], options) :\n            source[key];\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAC3B,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;MAEzB,OAAOF,OAAOE;CAItB,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAMM,OAAOa,OAAOC,KAAKnB,MAAAA,GAC1BW,OAAON,OAAOA,OAAON,SACjBqB,uBAAuBrB,OAAOM,MAAML,OAAOK,MAAMJ,OAAAA,IACjDD,OAAOK;CAEf,OAAOM;AACX;AAEA,SAASS,uBACLrB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIsB,MAAMC,QAAQvB,MAAAA,KAAWsB,MAAMC,QAAQtB,MAAAA,GAAS;EAChD,IAAIuB,0BAA0BxB,MAAAA,KAAWwB,0BAA0BvB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIuB,IAAI,CAAIzB,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASuB,0BAA0BE,OAAgB;CAC/C,OAAOA,MAAMC,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}
+{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","value","Object","entries","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const [key, value] of Object.entries(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], value, options) :\n            value;\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAAU;EACrC,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;OAEzB,OAAOF,OAAOE;CAEtB;CAEA,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAM,CAACM,KAAKa,UAAUC,OAAOC,QAAQpB,MAAAA,GACtCW,OAAON,OAAOA,OAAON,SACjBsB,uBAAuBtB,OAAOM,MAAMa,OAAOjB,OAAAA,IAC3CiB;CAER,OAAOP;AACX;AAEA,SAASU,uBACLtB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIuB,MAAMC,QAAQxB,MAAAA,KAAWuB,MAAMC,QAAQvB,MAAAA,GAAS;EAChD,IAAIwB,0BAA0BzB,MAAAA,KAAWyB,0BAA0BxB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIwB,IAAI,CAAI1B,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASwB,0BAA0BN,OAAgB;CAC/C,OAAOA,MAAMQ,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}

package/dist/core/query/module.mjs

@@ -98,7 +98,7 @@ for (const schema of schemas) schemaRegistry.add(schema);
 * anonymous — the HTTP adapter always builds one); a decode without
 * an actor is a system call and runs unrestricted.
 */ async function decodeQuery(input, options) {
-	const normalized = isObject(input) || typeof input === "string" ? input : {};
+	const normalized = typeof input === "string" || isObject(input) ? input : {};
 	return await queryCodec.decodeAsync(normalized, {
 		schema: options.schema,
 		parameters: options.parameters,

package/dist/core/query/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderAccountSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","sessionTokenSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition,\n    IQuery,\n    ObjectLiteral,\n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderAccountSchema } from '../entities/identity-provider-account/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { sessionTokenSchema } from '../entities/session-token/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\n/**\n * Every registered entity schema. Exported so the invariant guard can\n * enumerate them: `SchemaRegistry` keeps its map protected and exposes\n * no iterator (tada5hi/rapiq#904).\n */\nexport const schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderAccountSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    sessionTokenSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. A client-sent\n * condition on the same field intersects with the scope instead of\n * replacing it, and compound client trees (`or(...)`) are preserved\n * as-is. Same guarantee class as a mandatory `andWhere` at the\n * repository — expressed once in the IR. Appended conditions do not\n * pass through `decodeQuery`, so the schema allow-lists do not\n * constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n *\n * Non-displaceability is structural since rapiq beta.19\n * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so\n * no later composition step can drop a conjunct and the appended scope\n * needs no marker to survive.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,MAAa8B,iBAAiB,IAAI5B,eAAAA;;;;;GAOlC,MAAa6B,UAA0B;CACnC3B;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAalC,eAAe8B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAanC,SAASiC,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAI1C,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;;;;;GAuBA,SAAgB2C,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI7C,MAAM;EACb8C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}
+{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderAccountSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","sessionTokenSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition,\n    IQuery,\n    ObjectLiteral,\n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderAccountSchema } from '../entities/identity-provider-account/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { sessionTokenSchema } from '../entities/session-token/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\n/**\n * Every registered entity schema. Exported so the invariant guard can\n * enumerate them: `SchemaRegistry` keeps its map protected and exposes\n * no iterator (tada5hi/rapiq#904).\n */\nexport const schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderAccountSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    sessionTokenSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = typeof input === 'string' || isObject(input) ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. A client-sent\n * condition on the same field intersects with the scope instead of\n * replacing it, and compound client trees (`or(...)`) are preserved\n * as-is. Same guarantee class as a mandatory `andWhere` at the\n * repository — expressed once in the IR. Appended conditions do not\n * pass through `decodeQuery`, so the schema allow-lists do not\n * constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n *\n * Non-displaceability is structural since rapiq beta.19\n * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so\n * no later composition step can drop a conjunct and the appended scope\n * needs no marker to survive.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,MAAa8B,iBAAiB,IAAI5B,eAAAA;;;;;GAOlC,MAAa6B,UAA0B;CACnC3B;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAalC,eAAe8B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAa,OAAOF,UAAU,YAAYjC,SAASiC,KAAAA,IAASA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAI1C,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;;;;;GAuBA,SAAgB2C,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI7C,MAAM;EACb8C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}

package/dist/core/security/policy/evaluator.mjs

@@ -104,7 +104,7 @@ var PermissionBindingPolicyEvaluator = class {
 				pending: true,
 				issues: pendingIssues
 			};
-			if (ctx.withConditions && lowerable && conditions.length > 0) result.condition = conditions.length === 1 ? conditions[0] : or(...conditions);
+			if (lowerable && ctx.withConditions && conditions.length > 0) result.condition = conditions.length === 1 ? conditions[0] : or(...conditions);
 			return result;
 		}
 		const success = maybeInvertPolicyOutcome(false, policy.invert);

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from '@ebec/core';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (ctx.withConditions && lowerable && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAmB;CACjD;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CACEjB,GAAAA,IAAIiB,QAAQ,CAAA,CACnB;GACL,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIhC,IAAIiD,kBAAkBd,aAAaF,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}
+{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from '@ebec/core';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (lowerable && ctx.withConditions && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAmB;CACjD;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CACEjB,GAAAA,IAAIiB,QAAQ,CAAA,CACnB;GACL,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIG,aAAanC,IAAIiD,kBAAkBhB,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}