@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/app/modules/database/repositories/helpers.d.ts

@@ -1,4 +1,4 @@
-import type { DataSource, EntityTarget, ObjectLiteral, SelectQueryBuilder } from 'typeorm';
+import type { DataSource, EntityTarget, FindOptionsWhere, ObjectLiteral, Repository, SelectQueryBuilder } from 'typeorm';
 /**
  * Force-load the columns a realm-gated `getMany` per-row check depends on.
  * rapiq honors a client `fields` projection over the adapter `default`, so a
@@ -11,6 +11,29 @@ import type { DataSource, EntityTarget, ObjectLiteral, SelectQueryBuilder } from
  * `ORDER BY "<alias>_id"` as ambiguous (mysql: duplicate column name).
  */
 export declare function applyRealmScopeSelect<T extends ObjectLiteral>(qb: SelectQueryBuilder<T>, alias: string, extraColumns?: string[]): void;
+/**
+ * Resolve a caller-supplied sweep batch size against its default. A
+ * non-positive or non-integral size must never reach `take`: typeorm ignores
+ * a falsy one, which silently restores the single unbounded DELETE the
+ * batching exists to prevent, and the rest reach the driver as invalid SQL.
+ */
+export declare function resolveSweepBatchSize(requested: number | undefined, fallback: number): number;
+/**
+ * Delete every row matching `where`, one bounded statement at a time, looping
+ * until the match is drained. The retention and expiry sweeps run every
+ * minute on every replica, and the first one after a retention change (or the
+ * day a full window first matures) can match millions of rows: a single
+ * unbounded DELETE would then be one long transaction, issued concurrently by
+ * every replica.
+ *
+ * Ids are selected first and deleted by id, because `DELETE ... LIMIT` is
+ * MySQL-only. A batch that removes nothing means another replica's sweep owns
+ * those rows, so the loop stops rather than re-selecting them; the next tick
+ * picks up whatever is left.
+ */
+export declare function deleteInBatches<T extends ObjectLiteral & {
+    id: string;
+}>(repository: Repository<T>, where: FindOptionsWhere<T>, batchSize: number): Promise<number>;
 /**
  * Naming-strategy-safe replacement for typeorm-extension's `isEntityUnique`:
  * the upstream helper interpolates bare property names into the WHERE clause,

package/dist/app/modules/database/repositories/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,UAAU,EACV,YAAY,EACZ,aAAa,EACb,kBAAkB,EACrB,MAAM,SAAS,CAAC;AAGjB;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,aAAa,EACzD,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,EACzB,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,MAAM,EAAO,GAC5B,IAAI,CASN;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,CAAC,SAAS,aAAa,EAAE,OAAO,EAAE;IACnE,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAYxF"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,UAAU,EACV,YAAY,EAEZ,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,kBAAkB,EACrB,MAAM,SAAS,CAAC;AAGjB;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,aAAa,EACzD,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,EACzB,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,MAAM,EAAO,GAC5B,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAU7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,CAAC,SAAS,aAAa,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC1E,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EACzB,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC1B,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,CAAC,SAAS,aAAa,EAAE,OAAO,EAAE;IACnE,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAYxF"}

package/dist/app/modules/database/repositories/helpers.mjs

@@ -19,6 +19,43 @@ import { Brackets, In, IsNull } from "typeorm";
 	if (selections.length > 0) qb.addSelect(selections);
 }
 /**
+* Resolve a caller-supplied sweep batch size against its default. A
+* non-positive or non-integral size must never reach `take`: typeorm ignores
+* a falsy one, which silently restores the single unbounded DELETE the
+* batching exists to prevent, and the rest reach the driver as invalid SQL.
+*/ function resolveSweepBatchSize(requested, fallback) {
+	if (typeof requested === "number" && Number.isSafeInteger(requested) && requested > 0) return requested;
+	return fallback;
+}
+/**
+* Delete every row matching `where`, one bounded statement at a time, looping
+* until the match is drained. The retention and expiry sweeps run every
+* minute on every replica, and the first one after a retention change (or the
+* day a full window first matures) can match millions of rows: a single
+* unbounded DELETE would then be one long transaction, issued concurrently by
+* every replica.
+*
+* Ids are selected first and deleted by id, because `DELETE ... LIMIT` is
+* MySQL-only. A batch that removes nothing means another replica's sweep owns
+* those rows, so the loop stops rather than re-selecting them; the next tick
+* picks up whatever is left.
+*/ async function deleteInBatches(repository, where, batchSize) {
+	let total = 0;
+	for (;;) {
+		const rows = await repository.find({
+			select: { id: true },
+			where,
+			take: batchSize
+		});
+		if (rows.length === 0) break;
+		const result = await repository.delete({ id: In(rows.map((row) => row.id)) });
+		total += result.affected ?? rows.length;
+		if (result.affected === 0) break;
+		if (rows.length < batchSize) break;
+	}
+	return total;
+}
+/**
 * Naming-strategy-safe replacement for typeorm-extension's `isEntityUnique`:
 * the upstream helper interpolates bare property names into the WHERE clause,
 * which no longer resolve as columns once the snake_case naming strategy
@@ -63,6 +100,6 @@ function translateWhereConditions(where) {
 	return result;
 }
 //#endregion
-export { applyRealmScopeSelect, isEntityUnique, translateWhereConditions };
+export { applyRealmScopeSelect, deleteInBatches, isEntityUnique, resolveSweepBatchSize, translateWhereConditions };
 
 //# sourceMappingURL=helpers.mjs.map

package/dist/app/modules/database/repositories/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["Brackets","In","IsNull","applyRealmScopeSelect","qb","alias","extraColumns","existing","Set","expressionMap","selects","map","select","selection","selections","column","filter","has","length","addSelect","isEntityUnique","options","metadata","dataSource","getMetadata","entityTarget","repository","getRepository","columnGroups","ownUniques","unique","columns","propertyName","indices","index","isUnique","entityMetadata","target","primaryKeys","primaryColumns","group","createQueryBuilder","where","inner","key","value","entity","andWhere","entityExisting","getOne","translateWhereConditions","result","Object","entries","forEach","Array","isArray"],"sources":["../../../../../src/app/modules/database/repositories/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    DataSource, \n    EntityTarget, \n    ObjectLiteral, \n    SelectQueryBuilder,\n} from 'typeorm';\nimport { Brackets, In, IsNull } from 'typeorm';\n\n/**\n * Force-load the columns a realm-gated `getMany` per-row check depends on.\n * rapiq honors a client `fields` projection over the adapter `default`, so a\n * projection omitting `realmId` would otherwise leave the per-row\n * `resourceRealmMatch` with no realm to match — neutralizing the realmScope\n * reach factor and leaking cross-realm rows to an own/ownOrNull-scoped reader.\n * Call it AFTER `applyQuery`. Columns already in the projection must be\n * skipped: `addSelect` emits a second identically-aliased column, and under a\n * join + take (the DISTINCT id-subquery) postgres then rejects the wrapper's\n * `ORDER BY \"<alias>_id\"` as ambiguous (mysql: duplicate column name).\n */\nexport function applyRealmScopeSelect<T extends ObjectLiteral>(\n    qb: SelectQueryBuilder<T>,\n    alias: string,\n    extraColumns: string[] = [],\n): void {\n    const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));\n    const selections = ['realmId', ...extraColumns]\n        .map((column) => `${alias}.${column}`)\n        .filter((selection) => !existing.has(selection));\n\n    if (selections.length > 0) {\n        qb.addSelect(selections);\n    }\n}\n\n/**\n * Naming-strategy-safe replacement for typeorm-extension's `isEntityUnique`:\n * the upstream helper interpolates bare property names into the WHERE clause,\n * which no longer resolve as columns once the snake_case naming strategy\n * decouples property names (`realmId`) from column names (`realm_id`).\n * Alias-qualified property paths (`entity.realmId`) let TypeORM translate\n * them through the entity metadata instead.\n */\nexport async function isEntityUnique<T extends ObjectLiteral>(options: {\n    dataSource: DataSource,\n    entityTarget: EntityTarget<T>,\n    entity: Partial<T>,\n    entityExisting?: T | null,\n}): Promise<boolean> {\n    const metadata = options.dataSource.getMetadata(options.entityTarget);\n    const repository = options.dataSource.getRepository<T>(options.entityTarget);\n\n    const columnGroups : string[][] = metadata.ownUniques.length > 0 ?\n        metadata.ownUniques.map(\n            (unique) => unique.columns.map((column) => column.propertyName),\n        ) :\n        metadata.indices\n            .filter((index) => index.isUnique && index.entityMetadata.target === metadata.target)\n            .map((index) => index.columns.map((column) => column.propertyName));\n\n    const primaryKeys = metadata.primaryColumns.map((column) => column.propertyName);\n\n    for (const group of columnGroups) {\n        const qb = repository.createQueryBuilder('entity');\n\n        qb.where(new Brackets((inner) => {\n            for (const key of group) {\n                const value = (options.entity as ObjectLiteral)[key] ?? null;\n                if (value === null) {\n                    inner.andWhere(`entity.${key} IS NULL`);\n                } else {\n                    inner.andWhere(`entity.${key} = :target_${key}`, { [`target_${key}`]: value });\n                }\n            }\n        }));\n\n        if (options.entityExisting) {\n            const existing = options.entityExisting as ObjectLiteral;\n            qb.andWhere(new Brackets((inner) => {\n                for (const key of primaryKeys) {\n                    const value = existing[key] ?? null;\n                    if (value === null) {\n                        inner.andWhere(`entity.${key} IS NOT NULL`);\n                    } else {\n                        inner.andWhere(`entity.${key} != :source_${key}`, { [`source_${key}`]: value });\n                    }\n                }\n            }));\n        }\n\n         \n        const entity = await qb.getOne();\n        if (entity) {\n            return false;\n        }\n    }\n\n    return true;\n}\n\nexport function translateWhereConditions(where: Record<string, any>): Record<string, any> {\n    const result: Record<string, any> = {};\n    Object.entries(where).forEach(([key, value]) => {\n        if (value === null) {\n            result[key] = IsNull();\n        } else if (Array.isArray(value)) {\n            result[key] = In(value);\n        } else {\n            result[key] = value;\n        }\n    });\n    return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;GA0BA,SAAgBG,sBACZC,IACAC,OACAC,eAAyB,CAAA,GAAE;CAE3B,MAAMC,WAAW,IAAIC,IAAIJ,GAAGK,cAAcC,QAAQC,KAAKC,WAAWA,OAAOC,SAAS,CAAA;CAClF,MAAMC,aAAa,CAAC,WAAcR,GAAAA,YAAa,CAAA,CAC1CK,KAAKI,WAAW,GAAGV,MAAM,GAAGU,QAAQ,CAAA,CACpCC,QAAQH,cAAc,CAACN,SAASU,IAAIJ,SAAAA,CAAAA;CAEzC,IAAIC,WAAWI,SAAS,GACpBd,GAAGe,UAAUL,UAAAA;AAErB;;;;;;;;GAUA,eAAsBM,eAAwCC,SAK7D;CACG,MAAMC,WAAWD,QAAQE,WAAWC,YAAYH,QAAQI,YAAY;CACpE,MAAMC,aAAaL,QAAQE,WAAWI,cAAiBN,QAAQI,YAAY;CAE3E,MAAMG,eAA4BN,SAASO,WAAWX,SAAS,IAC3DI,SAASO,WAAWlB,KACfmB,WAAWA,OAAOC,QAAQpB,KAAKI,WAAWA,OAAOiB,YAAY,CAAA,IAElEV,SAASW,QACJjB,QAAQkB,UAAUA,MAAMC,YAAYD,MAAME,eAAeC,WAAWf,SAASe,MAAM,CAAA,CACnF1B,KAAKuB,UAAUA,MAAMH,QAAQpB,KAAKI,WAAWA,OAAOiB,YAAY,CAAA;CAEzE,MAAMM,cAAchB,SAASiB,eAAe5B,KAAKI,WAAWA,OAAOiB,YAAY;CAE/E,KAAK,MAAMQ,SAASZ,cAAc;EAC9B,MAAMxB,KAAKsB,WAAWe,mBAAmB,QAAA;EAEzCrC,GAAGsC,MAAM,IAAI1C,UAAU2C,UAAAA;GACnB,KAAK,MAAMC,OAAOJ,OAAO;IACrB,MAAMK,QAAQ,QAASC,OAAyBF,QAAQ;IACxD,IAAIC,UAAU,MACVF,MAAMI,SAAS,UAAUH,IAAI,SAAS;SAEtCD,MAAMI,SAAS,UAAUH,IAAI,aAAaA,OAAO,GAAG,UAAUA,QAAQC,MAAM,CAAA;GAEpF;EACJ,CAAA,CAAA;EAEA,IAAIxB,QAAQ2B,gBAAgB;GACxB,MAAMzC,WAAWc,QAAQ2B;GACzB5C,GAAG2C,SAAS,IAAI/C,UAAU2C,UAAAA;IACtB,KAAK,MAAMC,OAAON,aAAa;KAC3B,MAAMO,QAAQtC,SAASqC,QAAQ;KAC/B,IAAIC,UAAU,MACVF,MAAMI,SAAS,UAAUH,IAAI,aAAa;UAE1CD,MAAMI,SAAS,UAAUH,IAAI,cAAcA,OAAO,GAAG,UAAUA,QAAQC,MAAM,CAAA;IAErF;GACJ,CAAA,CAAA;EACJ;EAIA,IAAIC,MADiB1C,GAAG6C,OAAM,GAE1B,OAAO;CAEf;CAEA,OAAO;AACX;AAEA,SAAgBC,yBAAyBR,OAA0B;CAC/D,MAAMS,SAA8B,CAAC;CACrCC,OAAOC,QAAQX,KAAAA,CAAAA,CAAOY,SAAS,CAACV,KAAKC,WAAM;EACvC,IAAIA,UAAU,MACVM,OAAOP,OAAO1C,OAAAA;OACX,IAAIqD,MAAMC,QAAQX,KAAAA,GACrBM,OAAOP,OAAO3C,GAAG4C,KAAAA;OAEjBM,OAAOP,OAAOC;CAEtB,CAAA;CACA,OAAOM;AACX"}
+{"version":3,"file":"helpers.mjs","names":["Brackets","In","IsNull","applyRealmScopeSelect","qb","alias","extraColumns","existing","Set","expressionMap","selects","map","select","selection","selections","column","filter","has","length","addSelect","resolveSweepBatchSize","requested","fallback","Number","isSafeInteger","deleteInBatches","repository","where","batchSize","total","rows","find","id","take","result","delete","row","affected","isEntityUnique","options","metadata","dataSource","getMetadata","entityTarget","getRepository","columnGroups","ownUniques","unique","columns","propertyName","indices","index","isUnique","entityMetadata","target","primaryKeys","primaryColumns","group","createQueryBuilder","inner","key","value","entity","andWhere","entityExisting","getOne","translateWhereConditions","Object","entries","forEach","Array","isArray"],"sources":["../../../../../src/app/modules/database/repositories/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    DataSource,\n    EntityTarget,\n    FindOptionsSelect,\n    FindOptionsWhere,\n    ObjectLiteral,\n    Repository,\n    SelectQueryBuilder,\n} from 'typeorm';\nimport { Brackets, In, IsNull } from 'typeorm';\n\n/**\n * Force-load the columns a realm-gated `getMany` per-row check depends on.\n * rapiq honors a client `fields` projection over the adapter `default`, so a\n * projection omitting `realmId` would otherwise leave the per-row\n * `resourceRealmMatch` with no realm to match — neutralizing the realmScope\n * reach factor and leaking cross-realm rows to an own/ownOrNull-scoped reader.\n * Call it AFTER `applyQuery`. Columns already in the projection must be\n * skipped: `addSelect` emits a second identically-aliased column, and under a\n * join + take (the DISTINCT id-subquery) postgres then rejects the wrapper's\n * `ORDER BY \"<alias>_id\"` as ambiguous (mysql: duplicate column name).\n */\nexport function applyRealmScopeSelect<T extends ObjectLiteral>(\n    qb: SelectQueryBuilder<T>,\n    alias: string,\n    extraColumns: string[] = [],\n): void {\n    const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));\n    const selections = ['realmId', ...extraColumns]\n        .map((column) => `${alias}.${column}`)\n        .filter((selection) => !existing.has(selection));\n\n    if (selections.length > 0) {\n        qb.addSelect(selections);\n    }\n}\n\n/**\n * Resolve a caller-supplied sweep batch size against its default. A\n * non-positive or non-integral size must never reach `take`: typeorm ignores\n * a falsy one, which silently restores the single unbounded DELETE the\n * batching exists to prevent, and the rest reach the driver as invalid SQL.\n */\nexport function resolveSweepBatchSize(requested: number | undefined, fallback: number): number {\n    if (\n        typeof requested === 'number' &&\n        Number.isSafeInteger(requested) &&\n        requested > 0\n    ) {\n        return requested;\n    }\n\n    return fallback;\n}\n\n/**\n * Delete every row matching `where`, one bounded statement at a time, looping\n * until the match is drained. The retention and expiry sweeps run every\n * minute on every replica, and the first one after a retention change (or the\n * day a full window first matures) can match millions of rows: a single\n * unbounded DELETE would then be one long transaction, issued concurrently by\n * every replica.\n *\n * Ids are selected first and deleted by id, because `DELETE ... LIMIT` is\n * MySQL-only. A batch that removes nothing means another replica's sweep owns\n * those rows, so the loop stops rather than re-selecting them; the next tick\n * picks up whatever is left.\n */\nexport async function deleteInBatches<T extends ObjectLiteral & { id: string }>(\n    repository: Repository<T>,\n    where: FindOptionsWhere<T>,\n    batchSize: number,\n): Promise<number> {\n    let total = 0;\n\n    for (;;) {\n        const rows = await repository.find({\n            select: { id: true } as FindOptionsSelect<T>,\n            where,\n            take: batchSize,\n        });\n\n        if (rows.length === 0) {\n            break;\n        }\n\n        const result = await repository.delete({ id: In(rows.map((row) => row.id)) } as FindOptionsWhere<T>);\n\n        // A driver that does not report affected rows still made progress, so\n        // count the batch rather than returning 0.\n        total += result.affected ?? rows.length;\n\n        if (result.affected === 0) {\n            break;\n        }\n\n        if (rows.length < batchSize) {\n            break;\n        }\n    }\n\n    return total;\n}\n\n/**\n * Naming-strategy-safe replacement for typeorm-extension's `isEntityUnique`:\n * the upstream helper interpolates bare property names into the WHERE clause,\n * which no longer resolve as columns once the snake_case naming strategy\n * decouples property names (`realmId`) from column names (`realm_id`).\n * Alias-qualified property paths (`entity.realmId`) let TypeORM translate\n * them through the entity metadata instead.\n */\nexport async function isEntityUnique<T extends ObjectLiteral>(options: {\n    dataSource: DataSource,\n    entityTarget: EntityTarget<T>,\n    entity: Partial<T>,\n    entityExisting?: T | null,\n}): Promise<boolean> {\n    const metadata = options.dataSource.getMetadata(options.entityTarget);\n    const repository = options.dataSource.getRepository<T>(options.entityTarget);\n\n    const columnGroups : string[][] = metadata.ownUniques.length > 0 ?\n        metadata.ownUniques.map(\n            (unique) => unique.columns.map((column) => column.propertyName),\n        ) :\n        metadata.indices\n            .filter((index) => index.isUnique && index.entityMetadata.target === metadata.target)\n            .map((index) => index.columns.map((column) => column.propertyName));\n\n    const primaryKeys = metadata.primaryColumns.map((column) => column.propertyName);\n\n    for (const group of columnGroups) {\n        const qb = repository.createQueryBuilder('entity');\n\n        qb.where(new Brackets((inner) => {\n            for (const key of group) {\n                const value = (options.entity as ObjectLiteral)[key] ?? null;\n                if (value === null) {\n                    inner.andWhere(`entity.${key} IS NULL`);\n                } else {\n                    inner.andWhere(`entity.${key} = :target_${key}`, { [`target_${key}`]: value });\n                }\n            }\n        }));\n\n        if (options.entityExisting) {\n            const existing = options.entityExisting as ObjectLiteral;\n            qb.andWhere(new Brackets((inner) => {\n                for (const key of primaryKeys) {\n                    const value = existing[key] ?? null;\n                    if (value === null) {\n                        inner.andWhere(`entity.${key} IS NOT NULL`);\n                    } else {\n                        inner.andWhere(`entity.${key} != :source_${key}`, { [`source_${key}`]: value });\n                    }\n                }\n            }));\n        }\n\n         \n        const entity = await qb.getOne();\n        if (entity) {\n            return false;\n        }\n    }\n\n    return true;\n}\n\nexport function translateWhereConditions(where: Record<string, any>): Record<string, any> {\n    const result: Record<string, any> = {};\n    Object.entries(where).forEach(([key, value]) => {\n        if (value === null) {\n            result[key] = IsNull();\n        } else if (Array.isArray(value)) {\n            result[key] = In(value);\n        } else {\n            result[key] = value;\n        }\n    });\n    return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;GA6BA,SAAgBG,sBACZC,IACAC,OACAC,eAAyB,CAAA,GAAE;CAE3B,MAAMC,WAAW,IAAIC,IAAIJ,GAAGK,cAAcC,QAAQC,KAAKC,WAAWA,OAAOC,SAAS,CAAA;CAClF,MAAMC,aAAa,CAAC,WAAcR,GAAAA,YAAa,CAAA,CAC1CK,KAAKI,WAAW,GAAGV,MAAM,GAAGU,QAAQ,CAAA,CACpCC,QAAQH,cAAc,CAACN,SAASU,IAAIJ,SAAAA,CAAAA;CAEzC,IAAIC,WAAWI,SAAS,GACpBd,GAAGe,UAAUL,UAAAA;AAErB;;;;;;GAQA,SAAgBM,sBAAsBC,WAA+BC,UAAgB;CACjF,IACI,OAAOD,cAAc,YACrBE,OAAOC,cAAcH,SAAAA,KACrBA,YAAY,GAEZ,OAAOA;CAGX,OAAOC;AACX;;;;;;;;;;;;;GAeA,eAAsBG,gBAClBC,YACAC,OACAC,WAAiB;CAEjB,IAAIC,QAAQ;CAEZ,SAAS;EACL,MAAMC,OAAO,MAAMJ,WAAWK,KAAK;GAC/BnB,QAAQ,EAAEoB,IAAI,KAAK;GACnBL;GACAM,MAAML;EACV,CAAA;EAEA,IAAIE,KAAKZ,WAAW,GAChB;EAGJ,MAAMgB,SAAS,MAAMR,WAAWS,OAAO,EAAEH,IAAI/B,GAAG6B,KAAKnB,KAAKyB,QAAQA,IAAIJ,EAAE,CAAA,EAAG,CAAA;EAI3EH,SAASK,OAAOG,YAAYP,KAAKZ;EAEjC,IAAIgB,OAAOG,aAAa,GACpB;EAGJ,IAAIP,KAAKZ,SAASU,WACd;CAER;CAEA,OAAOC;AACX;;;;;;;;GAUA,eAAsBS,eAAwCC,SAK7D;CACG,MAAMC,WAAWD,QAAQE,WAAWC,YAAYH,QAAQI,YAAY;CACpE,MAAMjB,aAAaa,QAAQE,WAAWG,cAAiBL,QAAQI,YAAY;CAE3E,MAAME,eAA4BL,SAASM,WAAW5B,SAAS,IAC3DsB,SAASM,WAAWnC,KACfoC,WAAWA,OAAOC,QAAQrC,KAAKI,WAAWA,OAAOkC,YAAY,CAAA,IAElET,SAASU,QACJlC,QAAQmC,UAAUA,MAAMC,YAAYD,MAAME,eAAeC,WAAWd,SAASc,MAAM,CAAA,CACnF3C,KAAKwC,UAAUA,MAAMH,QAAQrC,KAAKI,WAAWA,OAAOkC,YAAY,CAAA;CAEzE,MAAMM,cAAcf,SAASgB,eAAe7C,KAAKI,WAAWA,OAAOkC,YAAY;CAE/E,KAAK,MAAMQ,SAASZ,cAAc;EAC9B,MAAMzC,KAAKsB,WAAWgC,mBAAmB,QAAA;EAEzCtD,GAAGuB,MAAM,IAAI3B,UAAU2D,UAAAA;GACnB,KAAK,MAAMC,OAAOH,OAAO;IACrB,MAAMI,QAAQ,QAASC,OAAyBF,QAAQ;IACxD,IAAIC,UAAU,MACVF,MAAMI,SAAS,UAAUH,IAAI,SAAS;SAEtCD,MAAMI,SAAS,UAAUH,IAAI,aAAaA,OAAO,GAAG,UAAUA,QAAQC,MAAM,CAAA;GAEpF;EACJ,CAAA,CAAA;EAEA,IAAItB,QAAQyB,gBAAgB;GACxB,MAAMzD,WAAWgC,QAAQyB;GACzB5D,GAAG2D,SAAS,IAAI/D,UAAU2D,UAAAA;IACtB,KAAK,MAAMC,OAAOL,aAAa;KAC3B,MAAMM,QAAQtD,SAASqD,QAAQ;KAC/B,IAAIC,UAAU,MACVF,MAAMI,SAAS,UAAUH,IAAI,aAAa;UAE1CD,MAAMI,SAAS,UAAUH,IAAI,cAAcA,OAAO,GAAG,UAAUA,QAAQC,MAAM,CAAA;IAErF;GACJ,CAAA,CAAA;EACJ;EAIA,IAAIC,MADiB1D,GAAG6D,OAAM,GAE1B,OAAO;CAEf;CAEA,OAAO;AACX;AAEA,SAAgBC,yBAAyBvC,OAA0B;CAC/D,MAAMO,SAA8B,CAAC;CACrCiC,OAAOC,QAAQzC,KAAAA,CAAAA,CAAO0C,SAAS,CAACT,KAAKC,WAAM;EACvC,IAAIA,UAAU,MACV3B,OAAO0B,OAAO1D,OAAAA;OACX,IAAIoE,MAAMC,QAAQV,KAAAA,GACrB3B,OAAO0B,OAAO3D,GAAG4D,KAAAA;OAEjB3B,OAAO0B,OAAOC;CAEtB,CAAA;CACA,OAAO3B;AACX"}

package/dist/app/modules/database/repositories/identity-provider/repository.mjs

@@ -4,8 +4,8 @@ import.meta.url;
 import { IdentityProviderEntity } from "../../../../../adapters/database/domains/identity-provider/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";

package/dist/app/modules/database/repositories/identity-provider-account/repository.mjs

@@ -39,13 +39,15 @@ var IdentityProviderAccountRepositoryAdapter = class {
 	}
 	async removeGuarded(entity, userHasOtherLogin) {
 		if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {
-			if (await this.repository.countBy({ userId: entity.userId }) <= 1 && !userHasOtherLogin) return false;
+			const count = await this.repository.countBy({ userId: entity.userId });
+			if (!userHasOtherLogin && count <= 1) return false;
 			await this.repository.remove(entity);
 			return true;
 		}
 		return this.dataSource.transaction(async (manager) => {
 			const repository = manager.getRepository(IdentityProviderAccountEntity);
-			if ((await repository.createQueryBuilder("identityProviderAccount").select(["identityProviderAccount.id"]).where("identityProviderAccount.userId = :userId", { userId: entity.userId }).setLock("pessimistic_write").getMany()).length <= 1 && !userHasOtherLogin) return false;
+			const rows = await repository.createQueryBuilder("identityProviderAccount").select(["identityProviderAccount.id"]).where("identityProviderAccount.userId = :userId", { userId: entity.userId }).setLock("pessimistic_write").getMany();
+			if (!userHasOtherLogin && rows.length <= 1) return false;
 			await repository.remove(entity);
 			return true;
 		});

package/dist/app/modules/database/repositories/identity-provider-account/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["EntityConflictError","applyQuery","redactFieldConditions","IdentityProviderAccountEntity","isUniqueConstraintDatabaseError","isDatabaseTypeRowLockable","IdentityProviderAccountRepositoryAdapter","dataSource","repository","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","existing","Set","expressionMap","selects","map","select","selection","selections","column","filter","has","length","addSelect","userId","andWhere","ownerUserId","realmId","ownerRealmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","removeGuarded","entity","userHasOtherLogin","type","count","countBy","remove","transaction","manager","rows","where","setLock","getMany","findOneByProviderIdentity","identity","findOne","providerUserId","providerId","provider","relations","user","save","e"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider-account/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport { EntityConflictError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type {\n    DataSource, \n    DeepPartial, \n    Repository,\n} from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { IdentityProviderAccountEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport { isDatabaseTypeRowLockable } from '../../../../../adapters/database/helpers/index.ts';\nimport type {\n    IIdentityProviderAccountRepository,\n    IdentityProviderAccountFindManyOptions,\n    IdentityProviderIdentity,\n} from '../../../../../core/index.ts';\n\nexport class IdentityProviderAccountRepositoryAdapter implements IIdentityProviderAccountRepository {\n    protected dataSource: DataSource;\n\n    protected repository: Repository<IdentityProviderAccountEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.repository = dataSource.getRepository(IdentityProviderAccountEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: IdentityProviderAccountFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>> {\n        const qb = this.repository.createQueryBuilder('identityProviderAccount');\n\n        const { pagination } = applyQuery(qb, query);\n\n        // plan-039 force-select: the per-row gate reads userId (ownership)\n        // and userRealmId (realm reach). The shared applyRealmScopeSelect\n        // pins a `realmId` column this entity does not have, so dedupe and\n        // add the two columns the same way it would.\n        const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));\n        const selections = ['userId', 'userRealmId']\n            .map((column) => `identityProviderAccount.${column}`)\n            .filter((selection) => !existing.has(selection));\n        if (selections.length > 0) {\n            qb.addSelect(selections);\n        }\n\n        if (options.userId) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userId = :ownerUserId', { ownerUserId: options.userId });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/identity-provider-accounts` mount —\n            // mandatory constraint, not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userRealmId = :ownerRealmId', { ownerRealmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean> {\n        if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {\n            // better-sqlite3: a single synchronous writer, so the\n            // count/delete race cannot manifest and no transaction is\n            // needed. Deliberately NOT wrapped in one — a held write\n            // transaction would contend the database lock (single-file\n            // driver) without buying any atomicity here. Plain\n            // count-then-remove, exactly as the un-guarded path did.\n            const count = await this.repository.countBy({ userId: entity.userId });\n            if (count <= 1 && !userHasOtherLogin) {\n                return false;\n            }\n\n            await this.repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        }\n\n        // mysql / postgres: real concurrency. Lock the user's account rows,\n        // count, and delete in one transaction so two concurrent unlinks for\n        // the same user cannot both read > 1 and both delete.\n        return this.dataSource.transaction(async (manager) => {\n            const repository = manager.getRepository(IdentityProviderAccountEntity);\n\n            const rows = await repository.createQueryBuilder('identityProviderAccount')\n                .select(['identityProviderAccount.id'])\n                .where('identityProviderAccount.userId = :userId', { userId: entity.userId })\n                .setLock('pessimistic_write')\n                .getMany();\n\n            if (rows.length <= 1 && !userHasOtherLogin) {\n                return false;\n            }\n\n            await repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        });\n    }\n\n    async findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOne({\n            where: {\n                providerUserId: identity.id,\n                providerId: identity.provider.id,\n            },\n            relations: { user: true },\n        });\n    }\n\n    async save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount> {\n        try {\n            return await this.repository.save(entity);\n        } catch (e) {\n            // one of the two unique indexes rejected the row: the identity\n            // is already linked (issue #3442) or the user already holds a link\n            // at this provider. The driver does not say which, so the manager\n            // classifies after a re-read; here only the driver error is kept\n            // from escaping as a 500.\n            if (isUniqueConstraintDatabaseError(e)) {\n                throw new EntityConflictError({ entity: 'identity provider account' });\n            }\n\n            throw e;\n        }\n    }\n\n    async remove(entity: IdentityProviderAccount): Promise<void> {\n        await this.repository.remove(entity as IdentityProviderAccountEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaM,2CAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,aAAaD,WAAWE,cAAcN,6BAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkD,CAAC,GACa;EAChE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,yBAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAMtC,MAAMK,WAAW,IAAIC,IAAIJ,GAAGK,cAAcC,QAAQC,KAAKC,WAAWA,OAAOC,SAAS,CAAA;EAClF,MAAMC,aAAa,CAAC,UAAU,aAAc,CAAA,CACvCH,KAAKI,WAAW,2BAA2BA,QAAQ,CAAA,CACnDC,QAAQH,cAAc,CAACN,SAASU,IAAIJ,SAAAA,CAAAA;EACzC,IAAIC,WAAWI,SAAS,GACpBd,GAAGe,UAAUL,UAAAA;EAGjB,IAAIX,QAAQiB,QAERhB,GAAGiB,SAAS,iDAAiD,EAAEC,aAAanB,QAAQiB,OAAO,CAAA;EAG/F,IAAIjB,QAAQoB,SAGRnB,GAAGiB,SAAS,uDAAuD,EAAEG,cAAcrB,QAAQoB,QAAQ,CAAA;EAGvG,MAAM,CAACE,UAAUC,SAAS,MAAMtB,GAAGuB,gBAAe;EAElD,OAAO;GACHC,MAAMnC,sBAAsBS,OAAOuB,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGpB;GACP;EACJ;CACJ;CAEA,MAAMwB,YAAYC,IAAqD;EACnE,OAAO,KAAKhC,WAAWiC,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,cAAcC,QAAiCC,mBAA8C;EAC/F,IAAI,CAACvC,0BAA0B,KAAKE,WAAWK,QAAQiC,IAAI,GAAG;GAQ1D,IAAIC,MADgB,KAAKtC,WAAWuC,QAAQ,EAAElB,QAAQc,OAAOd,OAAO,CAAA,KACvD,KAAK,CAACe,mBACf,OAAO;GAGX,MAAM,KAAKpC,WAAWwC,OAAOL,MAAAA;GAC7B,OAAO;EACX;EAKA,OAAO,KAAKpC,WAAW0C,YAAY,OAAOC,YAAAA;GACtC,MAAM1C,aAAa0C,QAAQzC,cAAcN,6BAAAA;GAQzC,KAAIgD,MANe3C,WAAWM,mBAAmB,yBAAA,CAAA,CAC5CO,OAAO,CAAC,4BAA6B,CAAA,CAAA,CACrC+B,MAAM,4CAA4C,EAAEvB,QAAQc,OAAOd,OAAO,CAAA,CAAA,CAC1EwB,QAAQ,mBAAA,CAAA,CACRC,QAAO,EAAA,CAEH3B,UAAU,KAAK,CAACiB,mBACrB,OAAO;GAGX,MAAMpC,WAAWwC,OAAOL,MAAAA;GACxB,OAAO;EACX,CAAA;CACJ;CAEA,MAAMY,0BAA0BC,UAA6E;EACzG,OAAO,KAAKhD,WAAWiD,QAAQ;GAC3BL,OAAO;IACHM,gBAAgBF,SAAShB;IACzBmB,YAAYH,SAASI,SAASpB;GAClC;GACAqB,WAAW,EAAEC,MAAM,KAAK;EAC5B,CAAA;CACJ;CAEA,MAAMC,KAAKpB,QAAgF;EACvF,IAAI;GACA,OAAO,MAAM,KAAKnC,WAAWuD,KAAKpB,MAAAA;EACtC,SAASqB,GAAG;GAMR,IAAI5D,gCAAgC4D,CAAAA,GAChC,MAAM,IAAIhE,oBAAoB,EAAE2C,QAAQ,4BAA4B,CAAA;GAGxE,MAAMqB;EACV;CACJ;CAEA,MAAMhB,OAAOL,QAAgD;EACzD,MAAM,KAAKnC,WAAWwC,OAAOL,MAAAA;CACjC;AACJ"}
+{"version":3,"file":"repository.mjs","names":["EntityConflictError","applyQuery","redactFieldConditions","IdentityProviderAccountEntity","isUniqueConstraintDatabaseError","isDatabaseTypeRowLockable","IdentityProviderAccountRepositoryAdapter","dataSource","repository","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","existing","Set","expressionMap","selects","map","select","selection","selections","column","filter","has","length","addSelect","userId","andWhere","ownerUserId","realmId","ownerRealmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","removeGuarded","entity","userHasOtherLogin","type","count","countBy","remove","transaction","manager","rows","where","setLock","getMany","findOneByProviderIdentity","identity","findOne","providerUserId","providerId","provider","relations","user","save","e"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider-account/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport { EntityConflictError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type {\n    DataSource, \n    DeepPartial, \n    Repository,\n} from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { IdentityProviderAccountEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport { isDatabaseTypeRowLockable } from '../../../../../adapters/database/helpers/index.ts';\nimport type {\n    IIdentityProviderAccountRepository,\n    IdentityProviderAccountFindManyOptions,\n    IdentityProviderIdentity,\n} from '../../../../../core/index.ts';\n\nexport class IdentityProviderAccountRepositoryAdapter implements IIdentityProviderAccountRepository {\n    protected dataSource: DataSource;\n\n    protected repository: Repository<IdentityProviderAccountEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.repository = dataSource.getRepository(IdentityProviderAccountEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: IdentityProviderAccountFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>> {\n        const qb = this.repository.createQueryBuilder('identityProviderAccount');\n\n        const { pagination } = applyQuery(qb, query);\n\n        // plan-039 force-select: the per-row gate reads userId (ownership)\n        // and userRealmId (realm reach). The shared applyRealmScopeSelect\n        // pins a `realmId` column this entity does not have, so dedupe and\n        // add the two columns the same way it would.\n        const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));\n        const selections = ['userId', 'userRealmId']\n            .map((column) => `identityProviderAccount.${column}`)\n            .filter((selection) => !existing.has(selection));\n        if (selections.length > 0) {\n            qb.addSelect(selections);\n        }\n\n        if (options.userId) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userId = :ownerUserId', { ownerUserId: options.userId });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/identity-provider-accounts` mount —\n            // mandatory constraint, not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userRealmId = :ownerRealmId', { ownerRealmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean> {\n        if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {\n            // better-sqlite3: a single synchronous writer, so the\n            // count/delete race cannot manifest and no transaction is\n            // needed. Deliberately NOT wrapped in one — a held write\n            // transaction would contend the database lock (single-file\n            // driver) without buying any atomicity here. Plain\n            // count-then-remove, exactly as the un-guarded path did.\n            const count = await this.repository.countBy({ userId: entity.userId });\n            if (!userHasOtherLogin && count <= 1) {\n                return false;\n            }\n\n            await this.repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        }\n\n        // mysql / postgres: real concurrency. Lock the user's account rows,\n        // count, and delete in one transaction so two concurrent unlinks for\n        // the same user cannot both read > 1 and both delete.\n        return this.dataSource.transaction(async (manager) => {\n            const repository = manager.getRepository(IdentityProviderAccountEntity);\n\n            const rows = await repository.createQueryBuilder('identityProviderAccount')\n                .select(['identityProviderAccount.id'])\n                .where('identityProviderAccount.userId = :userId', { userId: entity.userId })\n                .setLock('pessimistic_write')\n                .getMany();\n\n            if (!userHasOtherLogin && rows.length <= 1) {\n                return false;\n            }\n\n            await repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        });\n    }\n\n    async findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOne({\n            where: {\n                providerUserId: identity.id,\n                providerId: identity.provider.id,\n            },\n            relations: { user: true },\n        });\n    }\n\n    async save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount> {\n        try {\n            return await this.repository.save(entity);\n        } catch (e) {\n            // one of the two unique indexes rejected the row: the identity\n            // is already linked (issue #3442) or the user already holds a link\n            // at this provider. The driver does not say which, so the manager\n            // classifies after a re-read; here only the driver error is kept\n            // from escaping as a 500.\n            if (isUniqueConstraintDatabaseError(e)) {\n                throw new EntityConflictError({ entity: 'identity provider account' });\n            }\n\n            throw e;\n        }\n    }\n\n    async remove(entity: IdentityProviderAccount): Promise<void> {\n        await this.repository.remove(entity as IdentityProviderAccountEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaM,2CAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,aAAaD,WAAWE,cAAcN,6BAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkD,CAAC,GACa;EAChE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,yBAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAMtC,MAAMK,WAAW,IAAIC,IAAIJ,GAAGK,cAAcC,QAAQC,KAAKC,WAAWA,OAAOC,SAAS,CAAA;EAClF,MAAMC,aAAa,CAAC,UAAU,aAAc,CAAA,CACvCH,KAAKI,WAAW,2BAA2BA,QAAQ,CAAA,CACnDC,QAAQH,cAAc,CAACN,SAASU,IAAIJ,SAAAA,CAAAA;EACzC,IAAIC,WAAWI,SAAS,GACpBd,GAAGe,UAAUL,UAAAA;EAGjB,IAAIX,QAAQiB,QAERhB,GAAGiB,SAAS,iDAAiD,EAAEC,aAAanB,QAAQiB,OAAO,CAAA;EAG/F,IAAIjB,QAAQoB,SAGRnB,GAAGiB,SAAS,uDAAuD,EAAEG,cAAcrB,QAAQoB,QAAQ,CAAA;EAGvG,MAAM,CAACE,UAAUC,SAAS,MAAMtB,GAAGuB,gBAAe;EAElD,OAAO;GACHC,MAAMnC,sBAAsBS,OAAOuB,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGpB;GACP;EACJ;CACJ;CAEA,MAAMwB,YAAYC,IAAqD;EACnE,OAAO,KAAKhC,WAAWiC,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,cAAcC,QAAiCC,mBAA8C;EAC/F,IAAI,CAACvC,0BAA0B,KAAKE,WAAWK,QAAQiC,IAAI,GAAG;GAO1D,MAAMC,QAAQ,MAAM,KAAKtC,WAAWuC,QAAQ,EAAElB,QAAQc,OAAOd,OAAO,CAAA;GACpE,IAAI,CAACe,qBAAqBE,SAAS,GAC/B,OAAO;GAGX,MAAM,KAAKtC,WAAWwC,OAAOL,MAAAA;GAC7B,OAAO;EACX;EAKA,OAAO,KAAKpC,WAAW0C,YAAY,OAAOC,YAAAA;GACtC,MAAM1C,aAAa0C,QAAQzC,cAAcN,6BAAAA;GAEzC,MAAMgD,OAAO,MAAM3C,WAAWM,mBAAmB,yBAAA,CAAA,CAC5CO,OAAO,CAAC,4BAA6B,CAAA,CAAA,CACrC+B,MAAM,4CAA4C,EAAEvB,QAAQc,OAAOd,OAAO,CAAA,CAAA,CAC1EwB,QAAQ,mBAAA,CAAA,CACRC,QAAO;GAEZ,IAAI,CAACV,qBAAqBO,KAAKxB,UAAU,GACrC,OAAO;GAGX,MAAMnB,WAAWwC,OAAOL,MAAAA;GACxB,OAAO;EACX,CAAA;CACJ;CAEA,MAAMY,0BAA0BC,UAA6E;EACzG,OAAO,KAAKhD,WAAWiD,QAAQ;GAC3BL,OAAO;IACHM,gBAAgBF,SAAShB;IACzBmB,YAAYH,SAASI,SAASpB;GAClC;GACAqB,WAAW,EAAEC,MAAM,KAAK;EAC5B,CAAA;CACJ;CAEA,MAAMC,KAAKpB,QAAgF;EACvF,IAAI;GACA,OAAO,MAAM,KAAKnC,WAAWuD,KAAKpB,MAAAA;EACtC,SAASqB,GAAG;GAMR,IAAI5D,gCAAgC4D,CAAAA,GAChC,MAAM,IAAIhE,oBAAoB,EAAE2C,QAAQ,4BAA4B,CAAA;GAGxE,MAAMqB;EACV;CACJ;CAEA,MAAMhB,OAAOL,QAAgD;EACzD,MAAM,KAAKnC,WAAWwC,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/database/repositories/key/repository.mjs

@@ -8,8 +8,8 @@ import "../../../../../core/key/constants.mjs";
 import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "../../../../../core/key/wrap.mjs";
 import "../../../../../core/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { Like } from "typeorm";

package/dist/app/modules/database/repositories/permission/repository.mjs

@@ -4,8 +4,8 @@ import.meta.url;
 import { PermissionEntity } from "../../../../../adapters/database/domains/permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";

package/dist/app/modules/database/repositories/policy/repository.mjs

@@ -4,8 +4,8 @@ import.meta.url;
 import { PolicyEntity } from "../../../../../adapters/database/domains/policy/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";

package/dist/app/modules/database/repositories/role/repository.mjs

@@ -6,8 +6,8 @@ import { RoleEntity } from "../../../../../adapters/database/domains/role/entity
 import { RolePermissionEntity } from "../../../../../adapters/database/domains/role-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { loadBoundPermissions } from "../bindings.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";

package/dist/app/modules/database/repositories/scope/repository.mjs

@@ -4,8 +4,8 @@ import.meta.url;
 import { ScopeEntity } from "../../../../../adapters/database/domains/scope/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";

package/dist/app/modules/database/repositories/trust-anchor/repository.mjs

@@ -4,8 +4,8 @@ import.meta.url;
 import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
 import { TrustAnchorEntity } from "../../../../../adapters/database/domains/trust-anchor/entity.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";

package/dist/app/modules/database/repositories/user/repository.d.ts

@@ -4,15 +4,19 @@ import type { PermissionPolicyBinding } from '@authup/access';
 import type { Repository } from 'typeorm';
 import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 import type { IUserRepository } from '../../../../../core/index.ts';
-import type { UserRepository } from '../../../../../adapters/database/domains/index.ts';
+import { UserRepository } from '../../../../../adapters/database/domains/index.ts';
 export type UserRepositoryAdapterContext = {
     repository: UserRepository;
     realmRepository: Repository<Realm>;
 };
+export type UserRepositoryAdapterOptions = {
+    lockRows?: boolean;
+};
 export declare class UserRepositoryAdapter implements IUserRepository {
     private readonly repository;
     private readonly realmRepository;
-    constructor(ctx: UserRepositoryAdapterContext);
+    private readonly lockRows;
+    constructor(ctx: UserRepositoryAdapterContext, options?: UserRepositoryAdapterOptions);
     findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<User>>;
     findOneById(id: string): Promise<User | null>;
     findOneByName(name: string, realmKey?: string): Promise<User | null>;
@@ -25,6 +29,7 @@ export declare class UserRepositoryAdapter implements IUserRepository {
     merge(entity: User, data: Partial<User>): User;
     save(entity: User): Promise<User>;
     remove(entity: User): Promise<void>;
+    transaction<R>(fn: (repository: IUserRepository) => Promise<R>): Promise<R>;
     validateJoinColumns(data: Partial<User>): Promise<void>;
     checkUniqueness(data: Partial<User>, existing?: User): Promise<void>;
     getBoundRoles(entity: string | User): Promise<Role[]>;

package/dist/app/modules/database/repositories/user/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/user/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAWxF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,cAAc,CAAC;IAC3B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,qBAAsB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAE5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,4BAA4B;IAKvC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAqBtE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ7C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAmBpE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAMzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA0B5E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIvD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAI3D,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAU1E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIjC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIxC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAapE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAmBrD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;CAUvF"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/user/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGtF,OAAO,EAKH,cAAc,EAEjB,MAAM,mDAAmD,CAAC;AAK3D,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,cAAc,CAAC;IAC3B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,qBAAa,qBAAsB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAE5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;IAEnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;gBAEvB,GAAG,EAAE,4BAA4B,EAAE,OAAO,GAAE,4BAAiC;IAMnF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAqBtE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ7C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAmBpE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAMzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA0B5E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIvD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAO3D,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAU1E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIjC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIxC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB3E,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAapE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAmBrD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;CAUvF"}

package/dist/app/modules/database/repositories/user/repository.mjs

@@ -1,14 +1,18 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { isDatabaseTypeRowLockable } from "../../../../../adapters/database/helpers/is-supported.mjs";
+import "../../../../../adapters/database/helpers/index.mjs";
+import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
 import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
 import { UserEntity } from "../../../../../adapters/database/domains/user/entity.mjs";
+import { UserRepository } from "../../../../../adapters/database/domains/user/repository.mjs";
 import { UserPermissionEntity } from "../../../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { applyQuery, redactFieldConditions } from "../query.mjs";
-import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { loadBoundPermissions } from "../bindings.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
@@ -16,12 +20,14 @@ import { isUUID } from "@authup/kit";
 import { buildRedisKeyPath } from "@authup/server-kit";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/user/repository.ts
-var UserRepositoryAdapter = class {
+var UserRepositoryAdapter = class UserRepositoryAdapter {
 	repository;
 	realmRepository;
-	constructor(ctx) {
+	lockRows;
+	constructor(ctx, options = {}) {
 		this.repository = ctx.repository;
 		this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);
+		this.lockRows = options.lockRows ?? false;
 	}
 	async findMany(query) {
 		const qb = this.repository.createQueryBuilder("user");
@@ -78,7 +84,10 @@ var UserRepositoryAdapter = class {
 		return this.repository.findBy(translateWhereConditions(where));
 	}
 	async findOneBy(where) {
-		return this.repository.findOneBy(translateWhereConditions(where));
+		return this.repository.findOne({
+			where: translateWhereConditions(where),
+			...this.lockRows ? { lock: { mode: "pessimistic_write" } } : {}
+		});
 	}
 	async findOneByWithEmail(where) {
 		const qb = this.repository.createQueryBuilder("user");
@@ -99,6 +108,14 @@ var UserRepositoryAdapter = class {
 	async remove(entity) {
 		await this.repository.remove(entity);
 	}
+	async transaction(fn) {
+		const dataSource = this.repository.manager.connection;
+		if (!isDatabaseTypeRowLockable(dataSource.options.type)) return fn(this);
+		return dataSource.transaction((manager) => fn(new UserRepositoryAdapter({
+			repository: new UserRepository(manager),
+			realmRepository: manager.getRepository(RealmEntity)
+		}, { lockRows: true })));
+	}
 	async validateJoinColumns(data) {
 		await validateEntityJoinColumns(data, {
 			dataSource: this.repository.manager.connection,

package/dist/app/modules/database/repositories/user/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["buildRedisKeyPath","isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","CachePrefix","UserEntity","UserPermissionEntity","UserRoleEntity","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","loadBoundPermissions","RealmRepositoryAdapter","UserRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","extendManyWithEA","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findOne","findManyBy","findBy","findOneByWithEmail","addSelect","translated","create","merge","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundRoles","entries","getRepository","find","userId","relations","role","cache","prefix","USER_OWNED_ROLES","key","milliseconds","map","entry","getBoundPermissions","junctionTarget","cachePrefix","USER_OWNED_PERMISSIONS","cacheKey"],"sources":["../../../../../../src/app/modules/database/repositories/user/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Role, User } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IUserRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { UserRepository } from '../../../../../adapters/database/domains/index.ts';\nimport {\n    CachePrefix,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type UserRepositoryAdapterContext = {\n    repository: UserRepository,\n    realmRepository: Repository<Realm>,\n};\n\nexport class UserRepositoryAdapter implements IUserRepository {\n    private readonly repository: UserRepository;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: UserRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<User>> {\n        const qb = this.repository.createQueryBuilder('user');\n        qb.groupBy('user.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'user', ['id']);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        await this.repository.extendManyWithEA(entities);\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<User | null> {\n        const entity = await this.findOneBy({ id });\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<User | null> {\n        const qb = this.repository.createQueryBuilder('user');\n        qb.where('user.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('user.realmId = :realmId', { realmId });\n        }\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<User | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findOne(id: string, query?: IQuery, realmKey?: string): Promise<User | null> {\n        const qb = this.repository.createQueryBuilder('user');\n\n        if (isUUID(id)) {\n            qb.where('user.id = :id', { id });\n        } else {\n            qb.where('user.name = :name', { name: id });\n\n            if (realmKey) {\n                const realmId = await this.realmRepository.resolveId(realmKey);\n                if (!realmId) {\n                    return null;\n                }\n                qb.andWhere('user.realmId = :realmId', { realmId });\n            }\n        }\n\n        applyQuery(qb, query);\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<User[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<User | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    async findOneByWithEmail(where: Record<string, any>): Promise<User | null> {\n        const qb = this.repository.createQueryBuilder('user');\n        qb.addSelect('user.email');\n\n        const translated = translateWhereConditions(where);\n        qb.where(translated);\n\n        return qb.getOne();\n    }\n\n    create(data: Partial<User>): User {\n        return this.repository.create(data);\n    }\n\n    merge(entity: User, data: Partial<User>): User {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: User): Promise<User> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: User): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<User>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: UserEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<User>, existing?: User): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: UserEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async getBoundRoles(entity: string | User): Promise<Role[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        const entries = await this.repository.manager\n            .getRepository(UserRoleEntity)\n            .find({\n                where: { userId: id },\n                relations: { role: true },\n                cache: {\n                    id: buildRedisKeyPath({\n                        prefix: CachePrefix.USER_OWNED_ROLES,\n                        key: id,\n                    }),\n                    milliseconds: 60_000,\n                },\n            });\n\n        return entries.map((entry) => entry.role);\n    }\n\n    async getBoundPermissions(entity: string | User): Promise<PermissionPolicyBinding[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        return loadBoundPermissions({\n            manager: this.repository.manager,\n            junctionTarget: UserPermissionEntity,\n            where: { userId: id },\n            cachePrefix: CachePrefix.USER_OWNED_PERMISSIONS,\n            cacheKey: id,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkCA,IAAae,wBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAmC;EAC3C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA8D;EACzE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGE,QAAQ,SAAA;EAEX,MAAM,EAAEC,eAAerB,WAAWkB,IAAID,KAAAA;EAEtCV,sBAAsBW,IAAI,QAAQ,CAAC,IAAK,CAAA;EAExC,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,MAAM,KAAKX,WAAWY,iBAAiBH,QAAAA;EAEvC,OAAO;GACHI,MAAMzB,sBAAsBgB,OAAOK,QAAAA;GACnCK,MAAM;IACFJ;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMO,YAAYC,IAAkC;EAChD,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAAyC;EACvE,MAAMjB,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGkB,MAAM,qBAAqB,EAAEF,KAAK,CAAA;EAErC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKvB,gBAAgBwB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXnB,GAAGqB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;EACrD;EAEA,MAAMP,SAAS,MAAMZ,GAAGsB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAsC;EAC5E,OAAO7C,OAAO4C,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,QAAQf,IAAYZ,OAAgBkB,UAAyC;EAC/E,MAAMjB,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAE9C,IAAIrB,OAAO+B,EAAAA,GACPX,GAAGkB,MAAM,iBAAiB,EAAEP,GAAG,CAAA;OAC5B;GACHX,GAAGkB,MAAM,qBAAqB,EAAEF,MAAML,GAAG,CAAA;GAEzC,IAAIM,UAAU;IACV,MAAME,UAAU,MAAM,KAAKvB,gBAAgBwB,UAAUH,QAAAA;IACrD,IAAI,CAACE,SACD,OAAO;IAEXnB,GAAGqB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;GACrD;EACJ;EAEArC,WAAWkB,IAAID,KAAAA;EAEf,MAAMa,SAAS,MAAMZ,GAAGsB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMe,WAAWT,OAA6C;EAC1D,OAAO,KAAKvB,WAAWiC,OAAOrC,yBAAyB2B,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAAkD;EAC9D,OAAO,KAAKvB,WAAWkB,UAAUtB,yBAAyB2B,KAAAA,CAAAA;CAC9D;CAEA,MAAMW,mBAAmBX,OAAkD;EACvE,MAAMlB,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAG8B,UAAU,YAAA;EAEb,MAAMC,aAAaxC,yBAAyB2B,KAAAA;EAC5ClB,GAAGkB,MAAMa,UAAAA;EAET,OAAO/B,GAAGsB,OAAM;CACpB;CAEAU,OAAOxB,MAA2B;EAC9B,OAAO,KAAKb,WAAWqC,OAAOxB,IAAAA;CAClC;CAEAyB,MAAMrB,QAAcJ,MAA2B;EAC3C,OAAO,KAAKb,WAAWsC,MAAMrB,QAAQJ,IAAAA;CACzC;CAEA,MAAM0B,KAAKtB,QAA6B;EACpC,OAAO,KAAKjB,WAAWuC,KAAKtB,MAAAA;CAChC;CAEA,MAAMuB,OAAOvB,QAA6B;EACtC,MAAM,KAAKjB,WAAWwC,OAAOvB,MAAAA;CACjC;CAEA,MAAMwB,oBAAoB5B,MAAoC;EAC1D,MAAM3B,0BAA0B2B,MAAM;GAClC6B,YAAY,KAAK1C,WAAW2C,QAAQC;GACpCC,cAActD;EAClB,CAAA;CACJ;CAEA,MAAMuD,gBAAgBjC,MAAqBkC,UAAgC;EAQvE,IAAI,CAACC,MAPkBrD,eAAe;GAClC+C,YAAY,KAAK1C,WAAW2C,QAAQC;GACpCC,cAActD;GACd0B,QAAQJ;GACRoC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI1D,sBAAAA;CAElB;CAEA,MAAM6D,cAAcjC,QAAwC;EACxD,MAAMD,KAAK,OAAOC,WAAW,WAAWA,SAASA,OAAOD;EAexD,QAAOmC,MAde,KAAKnD,WAAW2C,QACjCS,cAAc3D,cAAAA,CAAAA,CACd4D,KAAK;GACF9B,OAAO,EAAE+B,QAAQtC,GAAG;GACpBuC,WAAW,EAAEC,MAAM,KAAK;GACxBC,OAAO;IACHzC,IAAIhC,kBAAkB;KAClB0E,QAAQpE,YAAYqE;KACpBC,KAAK5C;IACT,CAAA;IACA6C,cAAc;GAClB;EACJ,CAAA,EAAA,CAEWC,KAAKC,UAAUA,MAAMP,IAAI;CAC5C;CAEA,MAAMQ,oBAAoB/C,QAA2D;EACjF,MAAMD,KAAK,OAAOC,WAAW,WAAWA,SAASA,OAAOD;EACxD,OAAOnB,qBAAqB;GACxB8C,SAAS,KAAK3C,WAAW2C;GACzBsB,gBAAgBzE;GAChB+B,OAAO,EAAE+B,QAAQtC,GAAG;GACpBkD,aAAa5E,YAAY6E;GACzBC,UAAUpD;EACd,CAAA;CACJ;AACJ"}
+{"version":3,"file":"repository.mjs","names":["buildRedisKeyPath","isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","isDatabaseTypeRowLockable","CachePrefix","RealmEntity","UserEntity","UserPermissionEntity","UserRepository","UserRoleEntity","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","loadBoundPermissions","RealmRepositoryAdapter","UserRepositoryAdapter","repository","realmRepository","lockRows","ctx","options","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","extendManyWithEA","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findOne","findManyBy","findBy","lock","mode","findOneByWithEmail","addSelect","translated","create","merge","save","remove","transaction","fn","dataSource","manager","connection","type","getRepository","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundRoles","entries","find","userId","relations","role","cache","prefix","USER_OWNED_ROLES","key","milliseconds","map","entry","getBoundPermissions","junctionTarget","cachePrefix","USER_OWNED_PERMISSIONS","cacheKey"],"sources":["../../../../../../src/app/modules/database/repositories/user/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Role, User } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IUserRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isDatabaseTypeRowLockable } from '../../../../../adapters/database/helpers/index.ts';\nimport {\n    CachePrefix,\n    RealmEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRepository,\n    UserRoleEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type UserRepositoryAdapterContext = {\n    repository: UserRepository,\n    realmRepository: Repository<Realm>,\n};\n\nexport type UserRepositoryAdapterOptions = {\n    lockRows?: boolean,\n};\n\nexport class UserRepositoryAdapter implements IUserRepository {\n    private readonly repository: UserRepository;\n\n    private readonly realmRepository: IRealmRepository;\n\n    private readonly lockRows: boolean;\n\n    constructor(ctx: UserRepositoryAdapterContext, options: UserRepositoryAdapterOptions = {}) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n        this.lockRows = options.lockRows ?? false;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<User>> {\n        const qb = this.repository.createQueryBuilder('user');\n        qb.groupBy('user.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'user', ['id']);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        await this.repository.extendManyWithEA(entities);\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<User | null> {\n        const entity = await this.findOneBy({ id });\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<User | null> {\n        const qb = this.repository.createQueryBuilder('user');\n        qb.where('user.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('user.realmId = :realmId', { realmId });\n        }\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<User | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findOne(id: string, query?: IQuery, realmKey?: string): Promise<User | null> {\n        const qb = this.repository.createQueryBuilder('user');\n\n        if (isUUID(id)) {\n            qb.where('user.id = :id', { id });\n        } else {\n            qb.where('user.name = :name', { name: id });\n\n            if (realmKey) {\n                const realmId = await this.realmRepository.resolveId(realmKey);\n                if (!realmId) {\n                    return null;\n                }\n                qb.andWhere('user.realmId = :realmId', { realmId });\n            }\n        }\n\n        applyQuery(qb, query);\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<User[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<User | null> {\n        return this.repository.findOne({\n            where: translateWhereConditions(where),\n            ...(this.lockRows ? { lock: { mode: 'pessimistic_write' } } : {}),\n        });\n    }\n\n    async findOneByWithEmail(where: Record<string, any>): Promise<User | null> {\n        const qb = this.repository.createQueryBuilder('user');\n        qb.addSelect('user.email');\n\n        const translated = translateWhereConditions(where);\n        qb.where(translated);\n\n        return qb.getOne();\n    }\n\n    create(data: Partial<User>): User {\n        return this.repository.create(data);\n    }\n\n    merge(entity: User, data: Partial<User>): User {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: User): Promise<User> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: User): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async transaction<R>(fn: (repository: IUserRepository) => Promise<R>): Promise<R> {\n        const dataSource = this.repository.manager.connection;\n        if (!isDatabaseTypeRowLockable(dataSource.options.type)) {\n            // better-sqlite3: no FOR UPDATE, and the driver shares ONE query\n            // runner, so a transaction here would nest as a savepoint inside\n            // whatever else is running on it. Plain unlocked passthrough,\n            // exactly as the un-guarded path did (the removeGuarded rule).\n            return fn(this);\n        }\n\n        // mysql / postgres: real concurrency. Hand the callback an adapter\n        // bound to the transaction's manager whose single-row reads lock,\n        // so the row loaded by save() cannot change under the merge.\n        return dataSource.transaction((manager) => fn(new UserRepositoryAdapter({\n            repository: new UserRepository(manager),\n            realmRepository: manager.getRepository(RealmEntity),\n        }, { lockRows: true })));\n    }\n\n    async validateJoinColumns(data: Partial<User>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: UserEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<User>, existing?: User): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: UserEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async getBoundRoles(entity: string | User): Promise<Role[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        const entries = await this.repository.manager\n            .getRepository(UserRoleEntity)\n            .find({\n                where: { userId: id },\n                relations: { role: true },\n                cache: {\n                    id: buildRedisKeyPath({\n                        prefix: CachePrefix.USER_OWNED_ROLES,\n                        key: id,\n                    }),\n                    milliseconds: 60_000,\n                },\n            });\n\n        return entries.map((entry) => entry.role);\n    }\n\n    async getBoundPermissions(entity: string | User): Promise<PermissionPolicyBinding[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        return loadBoundPermissions({\n            manager: this.repository.manager,\n            junctionTarget: UserPermissionEntity,\n            where: { userId: id },\n            cachePrefix: CachePrefix.USER_OWNED_PERMISSIONS,\n            cacheKey: id,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAakB,wBAAb,MAAaA,sBAAAA;CACQC;CAEAC;CAEAC;CAEjB,YAAYC,KAAmCC,UAAwC,CAAC,GAAG;EACvF,KAAKJ,aAAaG,IAAIH;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBK,IAAIF,eAAe;EACrE,KAAKC,WAAWE,QAAQF,YAAY;CACxC;CAEA,MAAMG,SAASC,OAA8D;EACzE,MAAMC,KAAK,KAAKP,WAAWQ,mBAAmB,MAAA;EAC9CD,GAAGE,QAAQ,SAAA;EAEX,MAAM,EAAEC,eAAe1B,WAAWuB,IAAID,KAAAA;EAEtCZ,sBAAsBa,IAAI,QAAQ,CAAC,IAAK,CAAA;EAExC,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,MAAM,KAAKb,WAAWc,iBAAiBH,QAAAA;EAEvC,OAAO;GACHI,MAAM9B,sBAAsBqB,OAAOK,QAAAA;GACnCK,MAAM;IACFJ;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMO,YAAYC,IAAkC;EAChD,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAKnB,WAAWqB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAAyC;EACvE,MAAMjB,KAAK,KAAKP,WAAWQ,mBAAmB,MAAA;EAC9CD,GAAGkB,MAAM,qBAAqB,EAAEF,KAAK,CAAA;EAErC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKzB,gBAAgB0B,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXnB,GAAGqB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;EACrD;EAEA,MAAMP,SAAS,MAAMZ,GAAGsB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKnB,WAAWqB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAsC;EAC5E,OAAOlD,OAAOiD,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,QAAQf,IAAYZ,OAAgBkB,UAAyC;EAC/E,MAAMjB,KAAK,KAAKP,WAAWQ,mBAAmB,MAAA;EAE9C,IAAI1B,OAAOoC,EAAAA,GACPX,GAAGkB,MAAM,iBAAiB,EAAEP,GAAG,CAAA;OAC5B;GACHX,GAAGkB,MAAM,qBAAqB,EAAEF,MAAML,GAAG,CAAA;GAEzC,IAAIM,UAAU;IACV,MAAME,UAAU,MAAM,KAAKzB,gBAAgB0B,UAAUH,QAAAA;IACrD,IAAI,CAACE,SACD,OAAO;IAEXnB,GAAGqB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;GACrD;EACJ;EAEA1C,WAAWuB,IAAID,KAAAA;EAEf,MAAMa,SAAS,MAAMZ,GAAGsB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKnB,WAAWqB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMe,WAAWT,OAA6C;EAC1D,OAAO,KAAKzB,WAAWmC,OAAOvC,yBAAyB6B,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAAkD;EAC9D,OAAO,KAAKzB,WAAWiC,QAAQ;GAC3BR,OAAO7B,yBAAyB6B,KAAAA;GAChC,GAAI,KAAKvB,WAAW,EAAEkC,MAAM,EAAEC,MAAM,oBAAoB,EAAE,IAAI,CAAC;EACnE,CAAA;CACJ;CAEA,MAAMC,mBAAmBb,OAAkD;EACvE,MAAMlB,KAAK,KAAKP,WAAWQ,mBAAmB,MAAA;EAC9CD,GAAGgC,UAAU,YAAA;EAEb,MAAMC,aAAa5C,yBAAyB6B,KAAAA;EAC5ClB,GAAGkB,MAAMe,UAAAA;EAET,OAAOjC,GAAGsB,OAAM;CACpB;CAEAY,OAAO1B,MAA2B;EAC9B,OAAO,KAAKf,WAAWyC,OAAO1B,IAAAA;CAClC;CAEA2B,MAAMvB,QAAcJ,MAA2B;EAC3C,OAAO,KAAKf,WAAW0C,MAAMvB,QAAQJ,IAAAA;CACzC;CAEA,MAAM4B,KAAKxB,QAA6B;EACpC,OAAO,KAAKnB,WAAW2C,KAAKxB,MAAAA;CAChC;CAEA,MAAMyB,OAAOzB,QAA6B;EACtC,MAAM,KAAKnB,WAAW4C,OAAOzB,MAAAA;CACjC;CAEA,MAAM0B,YAAeC,IAA6D;EAC9E,MAAMC,aAAa,KAAK/C,WAAWgD,QAAQC;EAC3C,IAAI,CAAC9D,0BAA0B4D,WAAW3C,QAAQ8C,IAAI,GAKlD,OAAOJ,GAAG,IAAI;EAMlB,OAAOC,WAAWF,aAAaG,YAAYF,GAAG,IAAI/C,sBAAsB;GACpEC,YAAY,IAAIR,eAAewD,OAAAA;GAC/B/C,iBAAiB+C,QAAQG,cAAc9D,WAAAA;EAC3C,GAAG,EAAEa,UAAU,KAAK,CAAA,CAAA,CAAA;CACxB;CAEA,MAAMkD,oBAAoBrC,MAAoC;EAC1D,MAAMhC,0BAA0BgC,MAAM;GAClCgC,YAAY,KAAK/C,WAAWgD,QAAQC;GACpCI,cAAc/D;EAClB,CAAA;CACJ;CAEA,MAAMgE,gBAAgBvC,MAAqBwC,UAAgC;EAQvE,IAAI,CAACC,MAPkB7D,eAAe;GAClCoD,YAAY,KAAK/C,WAAWgD,QAAQC;GACpCI,cAAc/D;GACd6B,QAAQJ;GACR0C,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIrE,sBAAAA;CAElB;CAEA,MAAMwE,cAAcvC,QAAwC;EACxD,MAAMD,KAAK,OAAOC,WAAW,WAAWA,SAASA,OAAOD;EAexD,QAAOyC,MAde,KAAK3D,WAAWgD,QACjCG,cAAc1D,cAAAA,CAAAA,CACdmE,KAAK;GACFnC,OAAO,EAAEoC,QAAQ3C,GAAG;GACpB4C,WAAW,EAAEC,MAAM,KAAK;GACxBC,OAAO;IACH9C,IAAIrC,kBAAkB;KAClBoF,QAAQ7E,YAAY8E;KACpBC,KAAKjD;IACT,CAAA;IACAkD,cAAc;GAClB;EACJ,CAAA,EAAA,CAEWC,KAAKC,UAAUA,MAAMP,IAAI;CAC5C;CAEA,MAAMQ,oBAAoBpD,QAA2D;EACjF,MAAMD,KAAK,OAAOC,WAAW,WAAWA,SAASA,OAAOD;EACxD,OAAOrB,qBAAqB;GACxBmD,SAAS,KAAKhD,WAAWgD;GACzBwB,gBAAgBjF;GAChBkC,OAAO,EAAEoC,QAAQ3C,GAAG;GACpBuD,aAAarF,YAAYsF;GACzBC,UAAUzD;EACd,CAAA;CACJ;AACJ"}

package/dist/app/modules/http/constants.d.ts

@@ -1,9 +1,11 @@
 import type { IClient } from '@authup/core-http-kit';
 import { TypedToken } from 'eldin';
 import type { serve } from 'routup/node';
+import type { IApp } from 'routup';
 export type HTTPServer = ReturnType<typeof serve>;
 export declare const HTTPInjectionKey: {
+    App: TypedToken<IApp>;
     Server: TypedToken<HTTPServer>;
-    UIHttpClient: TypedToken<IClient>;
+    InternalHttpClient: TypedToken<IClient>;
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/http/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAElD,eAAO,MAAM,gBAAgB,EAAG;IAC5B,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/B,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;CAe5B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAElD,eAAO,MAAM,gBAAgB,EAAG;IAC5B,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/B,kBAAkB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;CAgBlC,CAAC"}

package/dist/app/modules/http/constants.mjs

@@ -4,18 +4,19 @@ import.meta.url;
 import { TypedToken } from "eldin";
 //#region src/app/modules/http/constants.ts
 const HTTPInjectionKey = {
+	App: new TypedToken("IApp"),
 	Server: new TypedToken("Server"),
 	/**
 	* HTTP client for the SSR'd UI pages. `HTTPModule.setup` registers a
 	* default whose transport dispatches against the server's own listen
-	* address (see `createInternalUIHttpClient`); a registration made
+	* address (see `createInternalHttpClient`); a registration made
 	* BEFORE setup wins (test injection). Register it with a
 	* `useFactory` provider and `lifetime: 'transient'` so every
 	* resolve yields a FRESH client: client-web-kit's authentication
 	* hook writes per-user Authorization state onto the client it
 	* attaches to, so a singleton-lifetime instance shared across
 	* concurrent renders would leak tokens between sessions.
-	*/ UIHttpClient: new TypedToken("UIHttpClient")
+	*/ InternalHttpClient: new TypedToken("InternalHttpClient")
 };
 //#endregion
 export { HTTPInjectionKey };

package/dist/app/modules/http/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","HTTPInjectionKey","Server","UIHttpClient"],"sources":["../../../../src/app/modules/http/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport { TypedToken } from 'eldin';\nimport type { serve } from 'routup/node';\n\nexport type HTTPServer = ReturnType<typeof serve>;\n\nexport const HTTPInjectionKey : {\n    Server: TypedToken<HTTPServer>,\n    UIHttpClient: TypedToken<IClient>,\n} = {\n    Server: new TypedToken<HTTPServer>('Server'),\n    /**\n     * HTTP client for the SSR'd UI pages. `HTTPModule.setup` registers a\n     * default whose transport dispatches against the server's own listen\n     * address (see `createInternalUIHttpClient`); a registration made\n     * BEFORE setup wins (test injection). Register it with a\n     * `useFactory` provider and `lifetime: 'transient'` so every\n     * resolve yields a FRESH client: client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client it\n     * attaches to, so a singleton-lifetime instance shared across\n     * concurrent renders would leak tokens between sessions.\n     */\n    UIHttpClient: new TypedToken<IClient>('UIHttpClient'),\n} as const;\n"],"mappings":";;;;;AAaA,MAAaC,mBAGT;CACAC,QAAQ,IAAIF,WAAuB,QAAA;;;;;;;;;;;IAYnCG,cAAc,IAAIH,WAAoB,cAAA;AAC1C"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","HTTPInjectionKey","App","Server","InternalHttpClient"],"sources":["../../../../src/app/modules/http/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport { TypedToken } from 'eldin';\nimport type { serve } from 'routup/node';\nimport type { IApp } from 'routup';\n\nexport type HTTPServer = ReturnType<typeof serve>;\n\nexport const HTTPInjectionKey : {\n    App: TypedToken<IApp>,\n    Server: TypedToken<HTTPServer>,\n    InternalHttpClient: TypedToken<IClient>,\n} = {\n    App: new TypedToken<IApp>('IApp'),\n    Server: new TypedToken<HTTPServer>('Server'),\n    /**\n     * HTTP client for the SSR'd UI pages. `HTTPModule.setup` registers a\n     * default whose transport dispatches against the server's own listen\n     * address (see `createInternalHttpClient`); a registration made\n     * BEFORE setup wins (test injection). Register it with a\n     * `useFactory` provider and `lifetime: 'transient'` so every\n     * resolve yields a FRESH client: client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client it\n     * attaches to, so a singleton-lifetime instance shared across\n     * concurrent renders would leak tokens between sessions.\n     */\n    InternalHttpClient: new TypedToken<IClient>('InternalHttpClient'),\n} as const;\n"],"mappings":";;;;;AAcA,MAAaC,mBAIT;CACAC,KAAK,IAAIF,WAAiB,MAAA;CAC1BG,QAAQ,IAAIH,WAAuB,QAAA;;;;;;;;;;;IAYnCI,oBAAoB,IAAIJ,WAAoB,oBAAA;AAChD"}

package/dist/app/modules/http/module.d.ts

@@ -1,25 +1,46 @@
+import type { IApp } from 'routup';
 import type { IModule } from 'orkos';
 import type { HTTPServer } from './constants.ts';
 import type { IContainer } from 'eldin';
 import { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';
+export type HTTPModuleOptions = {
+    /**
+     * Anything else that rides this listener, mounted in the one window where
+     * it belongs.
+     *
+     * A callback rather than a list, because the ORDER is not negotiable and
+     * is this module's business: it runs AFTER the controllers, so nothing it
+     * carries can shadow a protocol route (every console declares a wildcard
+     * shell route, and `/console/<name>/login/start` is server-core's), and
+     * BEFORE the error middleware, so it inherits the error handling every
+     * other route has. A caller mounting on the resolved app after `setup()`
+     * lands after both, on an already-listening server.
+     *
+     * server-core learns nothing from this: it hands over the app and the
+     * caller composes. A controller for a console appearing in this package
+     * is the smell the hook exists to prevent (plan 101 D2).
+     */
+    mount?: (app: IApp) => Promise<void> | void;
+};
 export declare class HTTPModule implements IModule {
     readonly name: string;
     readonly dependencies: string[];
     protected instance: HTTPServer | undefined;
     protected middleware: HTTPMiddlewareModule;
     protected controller: HTTPControllerModule;
-    protected uiHttpClientRegistered: boolean;
-    constructor();
+    protected internalHttpClientRegistered: boolean;
+    protected options: HTTPModuleOptions;
+    constructor(options?: HTTPModuleOptions);
     setup(container: IContainer): Promise<void>;
     /**
-     * Default HTTP client for the SSR'd UI pages: dispatches against the
-     * server's own listen address instead of round-tripping through the
-     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).
-     * Skipped when the token is already bound (test injection wins).
-     * Transient lifetime is mandatory — client-web-kit's authentication
-     * hook writes per-user Authorization state onto the client.
+     * Default HTTP client for this server's calls to its own API: dispatches
+     * against the server's own listen address instead of round-tripping
+     * through the reverse proxy at `publicUrl` (see
+     * `createInternalHttpClient`). Skipped when the token is already bound
+     * (test injection wins). Transient lifetime is mandatory: the
+     * authentication hook writes per-user Authorization state onto a client.
      */
-    protected registerUIHttpClient(container: IContainer): void;
+    protected registerInternalHttpClient(container: IContainer): void;
     /**
      * Auth-flow metric counters for the emit points (plan 058 Part 2).
      * Registered before the controllers are built — the factories resolve the

package/dist/app/modules/http/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4DjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBvD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAInC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,MAAM,MAAM,iBAAiB,GAAG;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC/C,CAAC;AAEF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,4BAA4B,EAAG,OAAO,CAAC;IAEjD,SAAS,CAAC,OAAO,EAAG,iBAAiB,CAAC;gBAE1B,OAAO,GAAE,iBAAsB;IAWrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DjD;;;;;;;OAOG;IACH,SAAS,CAAC,0BAA0B,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+BjE;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAevD"}