@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/core/entities/client/service.mjs

@@ -102,6 +102,7 @@ var ClientService = class extends AbstractEntityService {
 					...this.resourceRealmMatch(validated)
 				})
 			});
+			const before = { ...entity };
 			entity = this.repository.merge(entity, validated);
 			if (!isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.CLIENT_UPDATE,
@@ -118,7 +119,20 @@ var ClientService = class extends AbstractEntityService {
 				entity.secretHashed = false;
 				entity.secretEncrypted = false;
 			}
-			await this.repository.save(entity);
+			const patch = { ...validated };
+			for (const key of Object.keys(patch)) if (patch[key] === before[key]) delete patch[key];
+			const { id } = entity;
+			entity = await this.repository.transaction(async (repository) => {
+				const current = await repository.findOneWithSecret({ id });
+				if (!current) throw new EntityNotFoundError();
+				const merged = repository.merge(current, patch);
+				if (merged.authMethod !== ClientAuthMethod.SECRET) {
+					merged.secret = null;
+					merged.secretHashed = false;
+					merged.secretEncrypted = false;
+				} else if (patch.secret) merged.secret = await credentialsService.protect(patch.secret, merged);
+				return repository.save(merged);
+			});
 			return {
 				entity,
 				created: false

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, the console\n        // clients) so an API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","before","merge","authMethod","SECRET","generateSecret","protect","patch","key","Object","keys","transaction","current","merged","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, the console\n        // clients) so an API caller can't create or rename a client onto them: that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            const before: Partial<Client> = { ...entity };\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            // Only the write runs inside the transaction: it pins one pooled\n            // connection, and the evaluator, join-column and uniqueness reads\n            // above each take their own from the same pool, so wrapping them\n            // too deadlocks the DataSource under ten concurrent saves. The\n            // fresh row is lock-read and this request's patch merged onto it,\n            // so a concurrent writer's columns survive (#3526).\n            const patch: Partial<Client> = { ...validated };\n            // A field echoed back with the value this request read is no\n            // intent to change it (the console posts its whole form), and\n            // writing it would overwrite a concurrent change.\n            for (const key of Object.keys(patch) as (keyof Client)[]) {\n                if (patch[key] === before[key]) {\n                    delete patch[key];\n                }\n            }\n\n            const { id } = entity;\n            entity = await this.repository.transaction(async (repository) => {\n                const current = await repository.findOneWithSecret({ id });\n                if (!current) {\n                    throw new EntityNotFoundError();\n                }\n\n                // The secret follows the FRESH row's authMethod, not the one\n                // this request read: a concurrent switch to `secret` must not\n                // have its credential cleared by an unrelated edit racing it.\n                const merged = repository.merge(current, patch);\n                if (merged.authMethod !== ClientAuthMethod.SECRET) {\n                    merged.secret = null;\n                    merged.secretHashed = false;\n                    merged.secretEncrypted = false;\n                } else if (patch.secret) {\n                    merged.secret = await credentialsService.protect(patch.secret, merged);\n                }\n\n                return repository.save(merged);\n            });\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ,MAAMU,SAA0B,EAAE,GAAGtC,OAAO;GAC5CA,SAAS,KAAKpB,WAAW2D,MAAMvC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOwC,eAAerE,iBAAiBsE,QAAQ;IAC/C,IAAI,CAACb,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBQ,eAAc;IAGxD,IAAId,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBS,QAAQf,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAQA,MAAMwC,QAAyB,EAAE,GAAGhB,UAAU;GAI9C,KAAK,MAAMiB,OAAOC,OAAOC,KAAKH,KAAAA,GAC1B,IAAIA,MAAMC,SAASP,OAAOO,MACtB,OAAOD,MAAMC;GAIrB,MAAM,EAAE9C,OAAOC;GACfA,SAAS,MAAM,KAAKpB,WAAWoE,YAAY,OAAOpE,eAAAA;IAC9C,MAAMqE,UAAU,MAAMrE,WAAWuC,kBAAkB,EAAEpB,GAAG,CAAA;IACxD,IAAI,CAACkD,SACD,MAAM,IAAIjF,oBAAAA;IAMd,MAAMkF,SAAStE,WAAW2D,MAAMU,SAASL,KAAAA;IACzC,IAAIM,OAAOV,eAAerE,iBAAiBsE,QAAQ;KAC/CS,OAAO/C,SAAS;KAChB+C,OAAO7C,eAAe;KACtB6C,OAAO9C,kBAAkB;IAC7B,OAAO,IAAIwC,MAAMzC,QACb+C,OAAO/C,SAAS,MAAM+B,mBAAmBS,QAAQC,MAAMzC,QAAQ+C,MAAAA;IAGnE,OAAOtE,WAAW8B,KAAKwC,MAAAA;GAC3B,CAAA;GAEA,OAAO;IACHlD;IACAmD,SAAS;GACb;EACJ;EAEA,IAAI,CAACvB,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOwC,eAAerE,iBAAiBsE,QAAQ;GAC/C,IAAI,CAACb,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBQ,eAAc;GAGxD1C,OAAOG,SAAS,MAAM+B,mBAAmBS,QAAQf,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACAmD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrD,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAegF,cAAc,CAAA;EAEjF,MAAMrD,SAAS,MAAM,KAAKpB,WAAW0E,UAAU,EAAEvD,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAegF;GACrBvD,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIwD,aAAavD;EACzB,MAAM,KAAKpB,WAAW4E,OAAOxD,MAAAA;EAC7BA,OAAOD,KAAKwD;EAEZ,OAAOvD;CACX;AACJ"}

package/dist/core/entities/client/system-clients.d.ts

@@ -49,11 +49,6 @@ export declare const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[];
  * separately-hosted surface (plan 078 "relocatable by choice") registers
  * its origin via TRUSTED_ORIGINS rather than editing the client row.
  *
- * The `scope` column is descriptive only. Scope authorization resolves
- * through the `auth_client_scopes` junction, which
- * `SystemClientProvisioner.ensureForRealm` fills from the definition's
- * `scopeNames`.
- *
  * `accessPolicyId` and `displayName` are deliberately NOT part of this set:
  * the MERGE must neither wipe an admin-bound access policy nor undo a
  * relabel.

package/dist/core/entities/client/system-clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-clients.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/system-clients.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEtG,MAAM,MAAM,8BAA8B,GAAG;IACzC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,EAG7C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,EAW7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE;;;;;;;OAOG;cACa,YAAY,CACxB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;;;;OAOG;cACa,YAAY,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiClG"}
+{"version":3,"file":"system-clients.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/system-clients.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEtG,MAAM,MAAM,8BAA8B,GAAG;IACzC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,EAG7C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,EAW7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE;;;;;;;OAOG;cACa,YAAY,CACxB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;;;;OAOG;cACa,YAAY,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiClG"}

package/dist/core/entities/client/system-clients.mjs

@@ -48,11 +48,6 @@ import { CLIENT_ACCOUNT_CONSOLE_NAME, CLIENT_ADMIN_CONSOLE_NAME, ClientAuthMetho
 * separately-hosted surface (plan 078 "relocatable by choice") registers
 * its origin via TRUSTED_ORIGINS rather than editing the client row.
 *
-* The `scope` column is descriptive only. Scope authorization resolves
-* through the `auth_client_scopes` junction, which
-* `SystemClientProvisioner.ensureForRealm` fills from the definition's
-* `scopeNames`.
-*
 * `accessPolicyId` and `displayName` are deliberately NOT part of this set:
 * the MERGE must neither wipe an admin-bound access policy nor undo a
 * relabel.
@@ -66,7 +61,6 @@ import { CLIENT_ACCOUNT_CONSOLE_NAME, CLIENT_ADMIN_CONSOLE_NAME, ClientAuthMetho
 		builtIn: true,
 		active: true,
 		grantTypes: "authorization_code refresh_token",
-		scope: definition.scopeNames.join(" "),
 		redirectUri: originPatterns,
 		postLogoutRedirectUri: originPatterns
 	};

package/dist/core/entities/client/system-clients.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"system-clients.mjs","names":["CLIENT_ACCOUNT_CONSOLE_NAME","CLIENT_ADMIN_CONSOLE_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","SYSTEM_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","SYSTEM_CLIENT_DEFINITIONS","name","displayName","scopeNames","buildSystemClientAttributes","definition","realm","appOrigins","originPatterns","map","origin","join","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","redirectUri","postLogoutRedirectUri","SystemClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/system-clients.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_ACCOUNT_CONSOLE_NAME,\n    CLIENT_ADMIN_CONSOLE_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';\n\nexport type SystemClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes every system client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const SYSTEM_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * The public (PKCE) clients provisioned for every realm (plan 079):\n *\n * - `admin-console` — authup's own admin console (apps/client-admin-console),\n * - `account-console` — the account self-service surface (plan 080; each\n *   definition gets its own `<origin>/**` patterns from\n *   `buildSystemClientAttributes`, so an inert row adds no redirect\n *   surface).\n *\n * Downstream RPs register their own clients (per realm, or in every realm\n * via a wildcard realm provisioning entry, plan 082) — the former shared\n * `web` client was removed.\n *\n * `displayName` is seeded at CREATE only and never re-asserted by the\n * MERGE, so an admin may relabel a client without the next boot undoing it.\n */\nexport const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[] = [\n    {\n        name: CLIENT_ADMIN_CONSOLE_NAME,\n        displayName: 'Admin Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n    {\n        name: CLIENT_ACCOUNT_CONSOLE_NAME,\n        displayName: 'Account Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n];\n\n/**\n * Build the MERGE-owned attribute set for a realm's system client.\n *\n * `builtIn` makes the client auto-consent in the /authorize flow and\n * protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch) — deliberately the shared app-origin\n * set for every definition: `redirectUri` is re-asserted on each boot, so a\n * separately-hosted surface (plan 078 \"relocatable by choice\") registers\n * its origin via TRUSTED_ORIGINS rather than editing the client row.\n *\n * The `scope` column is descriptive only. Scope authorization resolves\n * through the `auth_client_scopes` junction, which\n * `SystemClientProvisioner.ensureForRealm` fills from the definition's\n * `scopeNames`.\n *\n * `accessPolicyId` and `displayName` are deliberately NOT part of this set:\n * the MERGE must neither wipe an admin-bound access policy nor undo a\n * relabel.\n */\nexport function buildSystemClientAttributes(\n    definition: SystemClientDefinition,\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: definition.name,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: definition.scopeNames.join(' '),\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class SystemClientProvisioner implements ISystemClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: SystemClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        for (const definition of SYSTEM_CLIENT_DEFINITIONS) {\n            const client = await this.ensureClient(definition, realm);\n\n            // Always run, even when the attributes were already up to date:\n            // an instance provisioned before the junction rows existed\n            // carries a steady-state client with no scopes at all.\n            await this.ensureScopes(definition, client);\n        }\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the\n     * row belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's system client.\n     */\n    protected async ensureClient(\n        definition: SystemClientDefinition,\n        realm: Realm | { id: string },\n    ): Promise<Client> {\n        const attributes = buildSystemClientAttributes(definition, realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: definition.name,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per client and realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${definition.name}' in realm ${realm.id}: the name is reserved for a built-in system client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildSystemClientAttributes` for\n                // the same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create({\n            ...attributes,\n            displayName: definition.displayName,\n        });\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the definition's scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void> {\n        for (const name of definition.scopeNames) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the ${definition.name} client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAkCA,MAAaK,4BAAsC,CAC/CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;GAkBD,MAAaC,4BAAsD,CAC/D;CACIC,MAAMR;CACNS,aAAa;CACbC,YAAYN;AAChB,GACA;CACII,MAAMT;CACNU,aAAa;CACbC,YAAYN;AAChB,CACH;;;;;;;;;;;;;;;;;;;;;;;;GA0BD,SAAgBO,4BACZC,YACAC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHV,MAAMI,WAAWJ;EACjBW,SAASN,MAAMO;EACfC,YAAYpB,iBAAiBqB;EAC7BC,oBAAoBrB,yBAAyBoB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAOf,WAAWF,WAAWQ,KAAK,GAAA;EAClCU,aAAab;EACbc,uBAAuBd;CAC3B;AACJ;AAEA,IAAae,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAnB;CAEAoB;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKnB,aAAaqB,IAAIrB;EACtB,KAAKoB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAevB,OAA8C;EAC/D,KAAK,MAAMD,cAAcL,2BAA2B;GAChD,MAAM8B,SAAS,MAAM,KAAKC,aAAa1B,YAAYC,KAAAA;GAKnD,MAAM,KAAK0B,aAAa3B,YAAYyB,MAAAA;EACxC;CACJ;;;;;;;;IAUA,MAAgBC,aACZ1B,YACAC,OACe;EACf,MAAM2B,aAAa7B,4BAA4BC,YAAYC,OAAO,KAAKC,UAAU;EAEjF,MAAM2B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDlC,MAAMI,WAAWJ;GACjBW,SAASN,MAAMO;EACnB,CAAA;EAEA,IAAIqB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAASjB,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOe,KACR,8CAA8CrC,WAAWJ,KAAK,aAAaK,MAAMO,GAAG,qDAAqD;IAejJ4B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE9B,IAAIqB,SAASrB,GAAG,CAAA,KAAMqB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAO;GACxC,GAAGlB;GACH/B,aAAaG,WAAWH;EAC5B,CAAA;EACA,OAAO,KAAKsB,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAa3B,YAAoCyB,QAA+B;EAC5F,KAAK,MAAM7B,QAAQI,WAAWF,YAAY;GACtC,MAAMiB,QAAQ,MAAM,KAAKK,gBAAgBU,UAAU;IAC/ClC;IACAW,SAAS;GACb,CAAA;GAEA,IAAI,CAACQ,OAAO;IACR,IAAI,KAAKO,QACL,KAAKA,OAAOe,KACR,mBAAmBzC,KAAK,YAAYI,WAAWJ,KAAK,mBAAmB6B,OAAOlB,QAAQ,gCAAgC;IAG9H;GACJ;GAOA,IAAIsB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDiB,UAAUtB,OAAOjB;IACjBwC,SAASjC,MAAMP;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKa,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEC,UAAUtB,OAAOjB;IACjByC,eAAexB,OAAOlB;IACtByC,SAASjC,MAAMP;IACf0C,cAAcnC,MAAMR;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}
+{"version":3,"file":"system-clients.mjs","names":["CLIENT_ACCOUNT_CONSOLE_NAME","CLIENT_ADMIN_CONSOLE_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","SYSTEM_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","SYSTEM_CLIENT_DEFINITIONS","name","displayName","scopeNames","buildSystemClientAttributes","definition","realm","appOrigins","originPatterns","map","origin","join","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","redirectUri","postLogoutRedirectUri","SystemClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","scope","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/system-clients.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_ACCOUNT_CONSOLE_NAME,\n    CLIENT_ADMIN_CONSOLE_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';\n\nexport type SystemClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes every system client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const SYSTEM_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * The public (PKCE) clients provisioned for every realm (plan 079):\n *\n * - `admin-console` — authup's own admin console (apps/client-admin-console),\n * - `account-console` — the account self-service surface (plan 080; each\n *   definition gets its own `<origin>/**` patterns from\n *   `buildSystemClientAttributes`, so an inert row adds no redirect\n *   surface).\n *\n * Downstream RPs register their own clients (per realm, or in every realm\n * via a wildcard realm provisioning entry, plan 082) — the former shared\n * `web` client was removed.\n *\n * `displayName` is seeded at CREATE only and never re-asserted by the\n * MERGE, so an admin may relabel a client without the next boot undoing it.\n */\nexport const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[] = [\n    {\n        name: CLIENT_ADMIN_CONSOLE_NAME,\n        displayName: 'Admin Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n    {\n        name: CLIENT_ACCOUNT_CONSOLE_NAME,\n        displayName: 'Account Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n];\n\n/**\n * Build the MERGE-owned attribute set for a realm's system client.\n *\n * `builtIn` makes the client auto-consent in the /authorize flow and\n * protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch) — deliberately the shared app-origin\n * set for every definition: `redirectUri` is re-asserted on each boot, so a\n * separately-hosted surface (plan 078 \"relocatable by choice\") registers\n * its origin via TRUSTED_ORIGINS rather than editing the client row.\n *\n * `accessPolicyId` and `displayName` are deliberately NOT part of this set:\n * the MERGE must neither wipe an admin-bound access policy nor undo a\n * relabel.\n */\nexport function buildSystemClientAttributes(\n    definition: SystemClientDefinition,\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: definition.name,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class SystemClientProvisioner implements ISystemClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: SystemClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        for (const definition of SYSTEM_CLIENT_DEFINITIONS) {\n            const client = await this.ensureClient(definition, realm);\n\n            // Always run, even when the attributes were already up to date:\n            // an instance provisioned before the junction rows existed\n            // carries a steady-state client with no scopes at all.\n            await this.ensureScopes(definition, client);\n        }\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the\n     * row belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's system client.\n     */\n    protected async ensureClient(\n        definition: SystemClientDefinition,\n        realm: Realm | { id: string },\n    ): Promise<Client> {\n        const attributes = buildSystemClientAttributes(definition, realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: definition.name,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per client and realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${definition.name}' in realm ${realm.id}: the name is reserved for a built-in system client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildSystemClientAttributes` for\n                // the same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create({\n            ...attributes,\n            displayName: definition.displayName,\n        });\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the definition's scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void> {\n        for (const name of definition.scopeNames) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the ${definition.name} client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAkCA,MAAaK,4BAAsC,CAC/CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;GAkBD,MAAaC,4BAAsD,CAC/D;CACIC,MAAMR;CACNS,aAAa;CACbC,YAAYN;AAChB,GACA;CACII,MAAMT;CACNU,aAAa;CACbC,YAAYN;AAChB,CACH;;;;;;;;;;;;;;;;;;;GAqBD,SAAgBO,4BACZC,YACAC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHV,MAAMI,WAAWJ;EACjBW,SAASN,MAAMO;EACfC,YAAYpB,iBAAiBqB;EAC7BC,oBAAoBrB,yBAAyBoB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,aAAaZ;EACba,uBAAuBb;CAC3B;AACJ;AAEA,IAAac,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAlB;CAEAmB;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKlB,aAAaoB,IAAIpB;EACtB,KAAKmB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAetB,OAA8C;EAC/D,KAAK,MAAMD,cAAcL,2BAA2B;GAChD,MAAM6B,SAAS,MAAM,KAAKC,aAAazB,YAAYC,KAAAA;GAKnD,MAAM,KAAKyB,aAAa1B,YAAYwB,MAAAA;EACxC;CACJ;;;;;;;;IAUA,MAAgBC,aACZzB,YACAC,OACe;EACf,MAAM0B,aAAa5B,4BAA4BC,YAAYC,OAAO,KAAKC,UAAU;EAEjF,MAAM0B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDjC,MAAMI,WAAWJ;GACjBW,SAASN,MAAMO;EACnB,CAAA;EAEA,IAAIoB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAAShB,SAAS;IACnB,IAAI,KAAKS,QACL,KAAKA,OAAOe,KACR,8CAA8CpC,WAAWJ,KAAK,aAAaK,MAAMO,GAAG,qDAAqD;IAejJ2B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE7B,IAAIoB,SAASpB,GAAG,CAAA,KAAMoB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAO;GACxC,GAAGlB;GACH9B,aAAaG,WAAWH;EAC5B,CAAA;EACA,OAAO,KAAKqB,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAa1B,YAAoCwB,QAA+B;EAC5F,KAAK,MAAM5B,QAAQI,WAAWF,YAAY;GACtC,MAAMgD,QAAQ,MAAM,KAAK3B,gBAAgBU,UAAU;IAC/CjC;IACAW,SAAS;GACb,CAAA;GAEA,IAAI,CAACuC,OAAO;IACR,IAAI,KAAKzB,QACL,KAAKA,OAAOe,KACR,mBAAmBxC,KAAK,YAAYI,WAAWJ,KAAK,mBAAmB4B,OAAOjB,QAAQ,gCAAgC;IAG9H;GACJ;GAOA,IAAIqB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDkB,UAAUvB,OAAOhB;IACjBwC,SAASF,MAAMtC;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKY,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEE,UAAUvB,OAAOhB;IACjByC,eAAezB,OAAOjB;IACtByC,SAASF,MAAMtC;IACf0C,cAAcJ,MAAMvC;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}

package/dist/core/entities/client/types.d.ts

@@ -31,6 +31,18 @@ export interface IClientRepository extends IEntityRepository<Client> {
     findOneWithSecret(where: Record<string, any>): Promise<Client | null>;
     getBoundRoles(entity: string | Client): Promise<Role[]>;
     getBoundPermissions(entity: string | Client): Promise<PermissionPolicyBinding[]>;
+    /**
+     * Runs `fn` inside one database transaction. Single-row reads on the
+     * handed-in repository (`findOneBy`, `findOneWithSecret`) are taken FOR
+     * UPDATE where the driver supports it and `save` commits with the
+     * callback, so a read-modify-write across the three calls cannot revert
+     * a concurrent write (#3526). Keep the callback to calls on the handed-in repository:
+     * the transaction pins one pooled connection, and anything else that
+     * reaches the DataSource (the permission evaluator, `validateJoinColumns`,
+     * `checkUniqueness`) takes a second one, which exhausts the pool under
+     * concurrent saves.
+     */
+    transaction<R>(fn: (repository: IClientRepository) => Promise<R>): Promise<R>;
 }
 export interface IClientService {
     getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Client>>;

package/dist/core/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAC/D,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAC/D,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAEjF;;;;;;;;;;OAUG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/entities/client-permission/service.mjs

@@ -91,7 +91,7 @@ var ClientPermissionService = class extends JunctionEntityService {
 		let actorScope = RealmScope.ANY;
 		let actorPolicyFree = true;
 		let actorPolicyId = null;
-		if (actor.identity && permission) {
+		if (permission && actor.identity) {
 			const grant = await this.identityPermissionProvider.resolveJunctionGrant({
 				type: actor.identity.type,
 				id: actor.identity.data.id

package/dist/core/entities/client-permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","clientPermissionSchema","ClientPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","clientId","permissionId","permission","permissionRealmId","realmId","client","clientRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","CLIENT_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission, Permission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientPermissionSchema } from './schema.ts';\n\nexport type ClientPermissionServiceContext = {\n    repository: IClientPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientPermissionValidator;\n\n    constructor(ctx: ClientPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientPermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            clientId: validated.clientId,\n            permissionId: validated.permissionId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,IAAaa,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIZ,0BAAAA;CACzB;CAEA,MAAMc,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAwBU;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAemB,yBAAyB,CAAA;EAE5F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAemC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,UAAUN,UAAUM;GACpBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAIzC,oBAAoB,EAAE6B,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAEnD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,cAAcvB,MAAM4B,UAAU;GACxC,MAAMC,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIN,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;IAC/BW,YAAYjB,UAAUiB,cAAcrD,WAAWsD;GACnD,CAAA;GAGJ/C,yBAAyB6B,WAAWc,KAAAA;EACxC;EAEA,MAAM7B,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAemB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDrC,kBAAkB2D,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAewD,yBAAyB,CAAA;EAE5F,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMiC,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAe2D,OAAO,CAAA;EAEhF,MAAMnB,aAAa,MAAM,KAAK7B,qBAAqBiD,YAAYjC,OAAOY,YAAY;EAClF,IAAIC,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBsB,SAASF,WAAWE;GACpBJ,UAAUE,WAAWF;EACzB,CAAA;EAGJ,IAAIuB,aAA8BjE,WAAWkE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAI/C,MAAM4B,YAAYL,YAAY;GAC9B,MAAMM,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IAAEC,MAAM/B,MAAM4B,SAASG;IAAMtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBsB,SAASF,WAAWE;IACpBJ,UAAUE,WAAWF;IACrBW,YAAYjB,UAAUiB,cAActB,OAAOsB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOvC,KAAK;EACrD,OAAO,IAAIT,MAAM4B,UACbgB,aAAajE,WAAWsD;EAG5B,MAAMgB,aAAa9D,wBAAwB;GACvC0B,MAAME;GACNmC,eAAexC,OAAOsB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKtD,WAAW0B,oBAAoB8B,UAAAA;EAE1C,MAAME,SAAS,KAAK1D,WAAW2D,MAAM1C,QAAQuC,UAAAA;EAE7C,MAAMjD,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAewD;GACrB5B,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBe,MAAAA;KACvDzE,kBAAkB2D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK1D,WAAW8C,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF5C,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAeoB,yBAAyB,CAAA;EAE5F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAeoB;GACrBQ,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvDhC,kBAAkB2D,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI6C,aAAa5C;EACzB,MAAM,KAAKjB,WAAW8D,OAAO7C,MAAAA;EAC7BA,OAAOD,KAAK6C;EAEZ,OAAO5C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","clientPermissionSchema","ClientPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","clientId","permissionId","permission","permissionRealmId","realmId","client","clientRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","CLIENT_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission, Permission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientPermissionSchema } from './schema.ts';\n\nexport type ClientPermissionServiceContext = {\n    repository: IClientPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientPermissionValidator;\n\n    constructor(ctx: ClientPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientPermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            clientId: validated.clientId,\n            permissionId: validated.permissionId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,IAAaa,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIZ,0BAAAA;CACzB;CAEA,MAAMc,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAwBU;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAemB,yBAAyB,CAAA;EAE5F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAemC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,UAAUN,UAAUM;GACpBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAIzC,oBAAoB,EAAE6B,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAEnD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,cAAcvB,MAAM4B,UAAU;GACxC,MAAMC,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIN,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;IAC/BW,YAAYjB,UAAUiB,cAAcrD,WAAWsD;GACnD,CAAA;GAGJ/C,yBAAyB6B,WAAWc,KAAAA;EACxC;EAEA,MAAM7B,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAemB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDrC,kBAAkB2D,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAewD,yBAAyB,CAAA;EAE5F,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMiC,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAe2D,OAAO,CAAA;EAEhF,MAAMnB,aAAa,MAAM,KAAK7B,qBAAqBiD,YAAYjC,OAAOY,YAAY;EAClF,IAAIC,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBsB,SAASF,WAAWE;GACpBJ,UAAUE,WAAWF;EACzB,CAAA;EAGJ,IAAIuB,aAA8BjE,WAAWkE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIxB,cAAcvB,MAAM4B,UAAU;GAC9B,MAAMC,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IAAEC,MAAM/B,MAAM4B,SAASG;IAAMtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBsB,SAASF,WAAWE;IACpBJ,UAAUE,WAAWF;IACrBW,YAAYjB,UAAUiB,cAActB,OAAOsB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOvC,KAAK;EACrD,OAAO,IAAIT,MAAM4B,UACbgB,aAAajE,WAAWsD;EAG5B,MAAMgB,aAAa9D,wBAAwB;GACvC0B,MAAME;GACNmC,eAAexC,OAAOsB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKtD,WAAW0B,oBAAoB8B,UAAAA;EAE1C,MAAME,SAAS,KAAK1D,WAAW2D,MAAM1C,QAAQuC,UAAAA;EAE7C,MAAMjD,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAewD;GACrB5B,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBe,MAAAA;KACvDzE,kBAAkB2D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK1D,WAAW8C,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF5C,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAeoB,yBAAyB,CAAA;EAE5F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAeoB;GACrBQ,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvDhC,kBAAkB2D,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI6C,aAAa5C;EACzB,MAAM,KAAKjB,WAAW8D,OAAO7C,MAAAA;EAC7BA,OAAOD,KAAK6C;EAEZ,OAAO5C;CACX;AACJ"}

package/dist/core/entities/event/constants.d.ts

@@ -1,9 +1,4 @@
-/**
- * Default retention for persisted security events in days (hosted-provider
- * posture, Okta-parity; raise via eventLogRetentionDays /
- * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
- */
-export declare const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+export { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '@authup/server-config';
 /**
  * Rows removed per statement by the retention sweep. The sweep runs every
  * minute on every replica, and the first one after a retention change (or the

package/dist/core/entities/event/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC"}

package/dist/core/entities/event/constants.mjs

@@ -1,13 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "@authup/server-config";
 //#region src/core/entities/event/constants.ts
 /**
-* Default retention for persisted security events in days (hosted-provider
-* posture, Okta-parity; raise via eventLogRetentionDays /
-* EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
-*/ const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
-/**
 * Rows removed per statement by the retention sweep. The sweep runs every
 * minute on every replica, and the first one after a retention change (or the
 * day a full retention window first matures) can match millions of rows. A

package/dist/core/entities/event/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT","EVENT_RETENTION_SWEEP_BATCH_SIZE","EVENT_ACTOR_NAME_MAX_LENGTH"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n */\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n\n/**\n * Rows removed per statement by the retention sweep. The sweep runs every\n * minute on every replica, and the first one after a retention change (or the\n * day a full retention window first matures) can match millions of rows. A\n * single unbounded DELETE would then be one long transaction, issued\n * concurrently by every replica. Batching keeps each statement bounded; the\n * sweep still drains by looping.\n */\nexport const EVENT_RETENTION_SWEEP_BATCH_SIZE = 1000;\n\n/**\n * Column bound for the denormalized actor name. Shared by the write boundary\n * (EventService.record truncates to it) and every reader that matches stored\n * rows by actor name (the login throttle) so the two cannot drift — an\n * untruncated lookup key never matches its own truncated rows.\n */\nexport const EVENT_ACTOR_NAME_MAX_LENGTH = 128;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC;;;;;;;;GAUhD,MAAaC,mCAAmC;;;;;;GAQhD,MAAaC,8BAA8B"}
+{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT","EVENT_RETENTION_SWEEP_BATCH_SIZE","EVENT_ACTOR_NAME_MAX_LENGTH"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n// The default retention for persisted security events is declared with the\n// key it is the default of (eventLogRetentionDays, in\n// `@authup/server-config`), and re-exported here for this module's own\n// consumers.\nexport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '@authup/server-config';\n\n/**\n * Rows removed per statement by the retention sweep. The sweep runs every\n * minute on every replica, and the first one after a retention change (or the\n * day a full retention window first matures) can match millions of rows. A\n * single unbounded DELETE would then be one long transaction, issued\n * concurrently by every replica. Batching keeps each statement bounded; the\n * sweep still drains by looping.\n */\nexport const EVENT_RETENTION_SWEEP_BATCH_SIZE = 1000;\n\n/**\n * Column bound for the denormalized actor name. Shared by the write boundary\n * (EventService.record truncates to it) and every reader that matches stored\n * rows by actor name (the login throttle) so the two cannot drift — an\n * untruncated lookup key never matches its own truncated rows.\n */\nexport const EVENT_ACTOR_NAME_MAX_LENGTH = 128;\n"],"mappings":";;;;;;;;;;;;GAqBA,MAAaC,mCAAmC;;;;;;GAQhD,MAAaC,8BAA8B"}

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA2DF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CA2D9D"}
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA2DF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CA4D9D"}

package/dist/core/entities/event/entity-event-handler.mjs

@@ -69,7 +69,7 @@ const ENTITY_REALM_KEY_MAP = {
 	}
 	async handle(ctx) {
 		try {
-			if (ctx.content.type === "event") return;
+			if (ctx.content.type === EntityType.EVENT) return;
 			const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];
 			if (!name) return;
 			const refId = ctx.content.data?.id ?? null;
@@ -96,7 +96,8 @@ const ENTITY_REALM_KEY_MAP = {
 				requestIpAddress: requestContext?.requestIpAddress ?? null,
 				requestUserAgent: requestContext?.requestUserAgent ?? null,
 				data,
-				retentionDays: this.options.retentionDays
+				retentionDays: this.options.retentionDays,
+				transaction: ctx.transaction
 			});
 		} catch {}
 	}

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_OPAQUE_VALUE_TYPES","Set","IDENTITY_PROVIDER_ATTRIBUTE","POLICY_ATTRIBUTE","ROLE_ATTRIBUTE","USER_ATTRIBUTE","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","SESSION_TOKEN","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","has","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\n/**\n * Entity types whose rows are generic (name, value) pairs. Their payload\n * column is always called `value`, so {@link buildEntityDiff}'s key-name\n * denylist cannot see what it holds - and for an identity provider it holds\n * the OAuth2 `clientSecret` or the LDAP bind password. The diff is dropped\n * wholesale rather than the denylist widened, because no regex over the\n * column name can ever decide this.\n */\nconst ENTITY_OPAQUE_VALUE_TYPES = new Set<string>([\n    EntityType.IDENTITY_PROVIDER_ATTRIBUTE,\n    EntityType.POLICY_ATTRIBUTE,\n    EntityType.ROLE_ATTRIBUTE,\n    EntityType.USER_ATTRIBUTE,\n]);\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    // Unreachable in practice: auth_session_tokens has no entity subscriber,\n    // so no domain event is ever published for it. Present for exhaustiveness,\n    // and the key is the one it would resolve through if that changed.\n    [EntityType.SESSION_TOKEN]: 'sessionId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (\n                name === EventName.UPDATED &&\n                !ENTITY_OPAQUE_VALUE_TYPES.has(ctx.content.type) &&\n                isObject(ctx.content.data) &&\n                isObject(ctx.dataPrevious)\n            ) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                sessionId: requestContext?.sessionId ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;;;;;;;;GAUA,MAAMC,4CAA4B,IAAIC,IAAY;CAC9CX,WAAWY;CACXZ,WAAWa;CACXb,WAAWc;CACXd,WAAWe;AACd,CAAA;AAED,MAAMC,uBAAyD;EAC1DhB,WAAWiB,SAAS;EACpBjB,WAAWkB,oBAAoB;EAC/BlB,WAAWmB,cAAc;EACzBnB,WAAWoB,eAAe;EAC1BpB,WAAWqB,UAAU;EAIrBrB,WAAWsB,gBAAgB;EAC3BtB,WAAWuB,QAAQ;EACnBvB,WAAWwB,oBAAoB;EAC/BxB,WAAWyB,4BAA4B;EACvCzB,WAAWY,8BAA8B;EACzCZ,WAAW0B,sCAAsC;EACjD1B,WAAW2B,uCAAuC;EAClD3B,WAAW4B,iCAAiC;EAC5C5B,WAAW6B,MAAM;EACjB7B,WAAW8B,SAAS;EACpB9B,WAAWa,mBAAmB;EAC9Bb,WAAW+B,aAAa;EACxB/B,WAAWgC,oBAAoB;EAC/BhC,WAAWiC,QAAQ;EACnBjC,WAAWkC,OAAO;EAClBlC,WAAWc,iBAAiB;EAC5Bd,WAAWmC,kBAAkB;EAC7BnC,WAAWoC,QAAQ;EACnBpC,WAAWqC,UAAU;EACrBrC,WAAWsC,eAAe;EAC1BtC,WAAWuC,OAAO;EAClBvC,WAAWe,iBAAiB;EAC5Bf,WAAWwC,qBAAqB;EAChCxC,WAAWyC,kBAAkB;EAC7BzC,WAAW0C,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO7C,sBAAsByC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IACIH,SAASlD,UAAUO,WACnB,CAACE,0BAA0BmD,IAAId,IAAIE,QAAQC,IAAI,KAC/C9C,SAAS2C,IAAIE,QAAQK,IAAI,KACzBlD,SAAS2C,IAAIY,YAAY,GAC3B;IACE,MAAMG,OAAOzD,gBAAgB0C,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAII,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BX,OAAO,EAAEQ,KAAK;GAEtB;GAEA,MAAM,KAAKlB,aAAasB,OAAO;IAC3BC,OAAOjE,WAAWkE;IAClBjB;IACAkB,SAAStB,IAAIE,QAAQC;IACrBG;IACAK;IACAY,WAAWzB,gBAAgByB,aAAa;IACxCC,SAAS1B,gBAAgB0B,WAAW;IACpCC,WAAW3B,gBAAgB2B,aAAa;IACxCC,WAAW5B,gBAAgB4B,aAAa;IACxCC,aAAa7B,gBAAgB6B,eAAe;IAC5CC,eAAe9B,gBAAgB8B,iBAAiB;IAChDC,kBAAkB/B,gBAAgB+B,oBAAoB;IACtDC,kBAAkBhC,gBAAgBgC,oBAAoB;IACtDvB;IACAwB,eAAe,KAAKhC,QAAQgC;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASrB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAClD,SAASkD,IAAAA,GACV;CAGJ,MAAMyB,MAAM/D,qBAAqBkC,SAA4B;CAC7D,IAAI,CAAC/C,eAAemD,MAAMyB,GAAAA,GACtB;CAGJ,OAAO,OAAOzB,KAAKyB,SAAS,WAAWzB,KAAKyB,OAAO;AACvD"}
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_OPAQUE_VALUE_TYPES","Set","IDENTITY_PROVIDER_ATTRIBUTE","POLICY_ATTRIBUTE","ROLE_ATTRIBUTE","USER_ATTRIBUTE","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","SESSION_TOKEN","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","has","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","transaction","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\n/**\n * Entity types whose rows are generic (name, value) pairs. Their payload\n * column is always called `value`, so {@link buildEntityDiff}'s key-name\n * denylist cannot see what it holds - and for an identity provider it holds\n * the OAuth2 `clientSecret` or the LDAP bind password. The diff is dropped\n * wholesale rather than the denylist widened, because no regex over the\n * column name can ever decide this.\n */\nconst ENTITY_OPAQUE_VALUE_TYPES = new Set<string>([\n    EntityType.IDENTITY_PROVIDER_ATTRIBUTE,\n    EntityType.POLICY_ATTRIBUTE,\n    EntityType.ROLE_ATTRIBUTE,\n    EntityType.USER_ATTRIBUTE,\n]);\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    // Unreachable in practice: auth_session_tokens has no entity subscriber,\n    // so no domain event is ever published for it. Present for exhaustiveness,\n    // and the key is the one it would resolve through if that changed.\n    [EntityType.SESSION_TOKEN]: 'sessionId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === EntityType.EVENT) {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (\n                name === EventName.UPDATED &&\n                !ENTITY_OPAQUE_VALUE_TYPES.has(ctx.content.type) &&\n                isObject(ctx.content.data) &&\n                isObject(ctx.dataPrevious)\n            ) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                sessionId: requestContext?.sessionId ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n                transaction: ctx.transaction,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;;;;;;;;GAUA,MAAMC,4CAA4B,IAAIC,IAAY;CAC9CX,WAAWY;CACXZ,WAAWa;CACXb,WAAWc;CACXd,WAAWe;AACd,CAAA;AAED,MAAMC,uBAAyD;EAC1DhB,WAAWiB,SAAS;EACpBjB,WAAWkB,oBAAoB;EAC/BlB,WAAWmB,cAAc;EACzBnB,WAAWoB,eAAe;EAC1BpB,WAAWqB,UAAU;EAIrBrB,WAAWsB,gBAAgB;EAC3BtB,WAAWuB,QAAQ;EACnBvB,WAAWwB,oBAAoB;EAC/BxB,WAAWyB,4BAA4B;EACvCzB,WAAWY,8BAA8B;EACzCZ,WAAW0B,sCAAsC;EACjD1B,WAAW2B,uCAAuC;EAClD3B,WAAW4B,iCAAiC;EAC5C5B,WAAW6B,MAAM;EACjB7B,WAAW8B,SAAS;EACpB9B,WAAWa,mBAAmB;EAC9Bb,WAAW+B,aAAa;EACxB/B,WAAWgC,oBAAoB;EAC/BhC,WAAWiC,QAAQ;EACnBjC,WAAWkC,OAAO;EAClBlC,WAAWc,iBAAiB;EAC5Bd,WAAWmC,kBAAkB;EAC7BnC,WAAWoC,QAAQ;EACnBpC,WAAWqC,UAAU;EACrBrC,WAAWsC,eAAe;EAC1BtC,WAAWuC,OAAO;EAClBvC,WAAWe,iBAAiB;EAC5Bf,WAAWwC,qBAAqB;EAChCxC,WAAWyC,kBAAkB;EAC7BzC,WAAW0C,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAASlD,WAAWuB,OAChC;GAGJ,MAAM4B,OAAO7C,sBAAsByC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IACIH,SAASlD,UAAUO,WACnB,CAACE,0BAA0BmD,IAAId,IAAIE,QAAQC,IAAI,KAC/C9C,SAAS2C,IAAIE,QAAQK,IAAI,KACzBlD,SAAS2C,IAAIY,YAAY,GAC3B;IACE,MAAMG,OAAOzD,gBAAgB0C,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAII,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BX,OAAO,EAAEQ,KAAK;GAEtB;GAEA,MAAM,KAAKlB,aAAasB,OAAO;IAC3BC,OAAOjE,WAAWkE;IAClBjB;IACAkB,SAAStB,IAAIE,QAAQC;IACrBG;IACAK;IACAY,WAAWzB,gBAAgByB,aAAa;IACxCC,SAAS1B,gBAAgB0B,WAAW;IACpCC,WAAW3B,gBAAgB2B,aAAa;IACxCC,WAAW5B,gBAAgB4B,aAAa;IACxCC,aAAa7B,gBAAgB6B,eAAe;IAC5CC,eAAe9B,gBAAgB8B,iBAAiB;IAChDC,kBAAkB/B,gBAAgB+B,oBAAoB;IACtDC,kBAAkBhC,gBAAgBgC,oBAAoB;IACtDvB;IACAwB,eAAe,KAAKhC,QAAQgC;IAC5BC,aAAahC,IAAIgC;GACrB,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAAStB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAClD,SAASkD,IAAAA,GACV;CAGJ,MAAM0B,MAAMhE,qBAAqBkC,SAA4B;CAC7D,IAAI,CAAC/C,eAAemD,MAAM0B,GAAAA,GACtB;CAGJ,OAAO,OAAO1B,KAAK0B,SAAS,WAAW1B,KAAK0B,OAAO;AACvD"}

package/dist/core/entities/event/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAsF3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAsF3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}

package/dist/core/entities/event/service.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import "./constants.mjs";
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
 import { eventSchema } from "./schema.mjs";
 import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
 import "../../query/index.mjs";
@@ -75,7 +75,7 @@ var EventService = class extends AbstractEntityService {
 		});
 		if (this.options.enabled === false) return;
 		try {
-			const retentionDays = input.retentionDays ?? this.options.retentionDays ?? 90;
+			const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;
 			const entity = this.repository.create({
 				id: randomUUID(),
 				scope: input.scope,
@@ -96,7 +96,7 @@ var EventService = class extends AbstractEntityService {
 				expiring: retentionDays > 0,
 				expiresAt: retentionDays > 0 ? new Date(Date.now() + retentionDays * DAY_IN_MS).toISOString() : null
 			});
-			await this.repository.save(entity);
+			await this.repository.save(entity, { transaction: input.transaction });
 		} catch {
 			this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);
 		}