@portaidentity/server 1.7.0

package/dist/custom-claims/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/custom-claims/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAEV,qBAAqB,EAErB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAqBhC;AAMD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAU1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUvC;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AAMD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnE;AAMD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CASlC;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAa3B;AAMD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAUlC;AAMD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CASlB;AA8ED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAStF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CASjC"}

package/dist/custom-claims/repository.js

@@ -0,0 +1,338 @@
+/**
+ * Custom claims repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `custom_claim_definitions` and
+ * `custom_claim_values` tables using parameterized queries. Each function
+ * acquires the pool via `getPool()` and returns mapped objects via the
+ * type mapping functions.
+ *
+ * Definitions are scoped to an application with a unique (application_id,
+ * claim_name) constraint. Values are per-user with a unique (user_id,
+ * claim_id) constraint — upsert semantics via ON CONFLICT.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE for partial definition updates
+ * - Upsert for claim values (INSERT ... ON CONFLICT DO UPDATE)
+ * - Joined query for resolving user claim values with definitions
+ *
+ * Database tables: custom_claim_definitions, custom_claim_values
+ * (see migration 007_custom_claims.sql)
+ */
+import { getPool } from '../lib/database.js';
+import { mapRowToDefinition, mapRowToValue } from './types.js';
+// ===========================================================================
+// Claim Definitions
+// ===========================================================================
+// ---------------------------------------------------------------------------
+// Insert
+// ---------------------------------------------------------------------------
+/**
+ * Insert a new claim definition into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The (application_id, claim_name) pair must be unique (enforced by DB).
+ * Token inclusion flags use DB defaults when not provided.
+ *
+ * @param input - Definition data to insert
+ * @returns The newly created definition
+ * @throws If (application_id, claim_name) already exists (unique constraint)
+ */
+export async function insertDefinition(input) {
+    const pool = getPool();
+    const result = await pool.query(`INSERT INTO custom_claim_definitions
+       (application_id, claim_name, claim_type, description,
+        include_in_id_token, include_in_access_token, include_in_userinfo)
+     VALUES ($1, $2, $3, $4, $5, $6, $7)
+     RETURNING *`, [
+        input.applicationId,
+        input.claimName,
+        input.claimType,
+        input.description ?? null,
+        input.includeInIdToken ?? false,
+        input.includeInAccessToken ?? true,
+        input.includeInUserinfo ?? true,
+    ]);
+    return mapRowToDefinition(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Find
+// ---------------------------------------------------------------------------
+/**
+ * Find a claim definition by its UUID.
+ *
+ * @param id - Definition UUID
+ * @returns Definition or null if not found
+ */
+export async function findDefinitionById(id) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM custom_claim_definitions WHERE id = $1', [id]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToDefinition(result.rows[0]);
+}
+/**
+ * Find a claim definition by application ID and claim name.
+ *
+ * Used for duplicate checking and name-based lookups.
+ *
+ * @param applicationId - Application UUID
+ * @param claimName - Claim name (unique within application)
+ * @returns Definition or null if not found
+ */
+export async function findDefinitionByName(applicationId, claimName) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM custom_claim_definitions WHERE application_id = $1 AND claim_name = $2', [applicationId, claimName]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToDefinition(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Update
+// ---------------------------------------------------------------------------
+/**
+ * Mapping from UpdateClaimDefinitionInput keys to database column names.
+ * Used by the dynamic query builder to construct SET clauses.
+ */
+const FIELD_TO_COLUMN = {
+    description: 'description',
+    includeInIdToken: 'include_in_id_token',
+    includeInAccessToken: 'include_in_access_token',
+    includeInUserinfo: 'include_in_userinfo',
+};
+/**
+ * Update a claim definition's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified. Null is a valid value for description
+ * (clears it).
+ *
+ * @param id - Definition UUID
+ * @param input - Fields to update (only non-undefined fields are applied)
+ * @returns Updated definition
+ * @throws Error if definition not found or no fields provided
+ */
+export async function updateDefinition(id, input) {
+    const pool = getPool();
+    // Build dynamic SET clause from provided fields
+    const setClauses = [];
+    const values = [id]; // $1 is always the ID
+    let paramIndex = 2;
+    for (const [field, column] of Object.entries(FIELD_TO_COLUMN)) {
+        const value = input[field];
+        // Include the field if it's explicitly set (including null for clearing)
+        if (value !== undefined) {
+            setClauses.push(`${column} = $${paramIndex}`);
+            values.push(value);
+            paramIndex++;
+        }
+    }
+    if (setClauses.length === 0) {
+        throw new Error('No fields to update');
+    }
+    const sql = `UPDATE custom_claim_definitions SET ${setClauses.join(', ')} WHERE id = $1 RETURNING *`;
+    const result = await pool.query(sql, values);
+    if (result.rows.length === 0) {
+        throw new Error('Claim definition not found');
+    }
+    return mapRowToDefinition(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Delete
+// ---------------------------------------------------------------------------
+/**
+ * Delete a claim definition by ID.
+ *
+ * CASCADE constraint automatically removes all associated claim values.
+ *
+ * @param id - Definition UUID
+ * @returns true if deleted, false if not found
+ */
+export async function deleteDefinition(id) {
+    const pool = getPool();
+    const result = await pool.query('DELETE FROM custom_claim_definitions WHERE id = $1', [id]);
+    return (result.rowCount ?? 0) > 0;
+}
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+/**
+ * List all claim definitions for an application, ordered by claim name.
+ *
+ * Returns a simple array (no pagination) since applications typically
+ * have a manageable number of custom claims.
+ *
+ * @param applicationId - Application UUID
+ * @returns Array of definitions for the application
+ */
+export async function listDefinitionsByApplication(applicationId) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM custom_claim_definitions WHERE application_id = $1 ORDER BY claim_name ASC', [applicationId]);
+    return result.rows.map(mapRowToDefinition);
+}
+// ---------------------------------------------------------------------------
+// Existence check
+// ---------------------------------------------------------------------------
+/**
+ * Check if a claim name already exists for a given application.
+ *
+ * Used for uniqueness validation before insert. The optional excludeId
+ * parameter allows excluding a specific definition (for future use if
+ * name updates are ever supported).
+ *
+ * @param applicationId - Application UUID
+ * @param claimName - Claim name to check
+ * @param excludeId - Optional definition ID to exclude from the check
+ * @returns true if the claim name already exists
+ */
+export async function claimNameExists(applicationId, claimName, excludeId) {
+    const pool = getPool();
+    if (excludeId) {
+        const result = await pool.query(`SELECT EXISTS(
+        SELECT 1 FROM custom_claim_definitions
+        WHERE application_id = $1 AND claim_name = $2 AND id != $3
+      ) as exists`, [applicationId, claimName, excludeId]);
+        return result.rows[0].exists;
+    }
+    const result = await pool.query(`SELECT EXISTS(
+      SELECT 1 FROM custom_claim_definitions
+      WHERE application_id = $1 AND claim_name = $2
+    ) as exists`, [applicationId, claimName]);
+    return result.rows[0].exists;
+}
+// ===========================================================================
+// Claim Values
+// ===========================================================================
+// ---------------------------------------------------------------------------
+// Upsert
+// ---------------------------------------------------------------------------
+/**
+ * Set (upsert) a claim value for a user.
+ *
+ * Uses INSERT ... ON CONFLICT (user_id, claim_id) DO UPDATE to handle
+ * both initial value setting and subsequent updates in a single query.
+ * The value is stored as JSONB.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @param value - The claim value (must match definition's claim_type)
+ * @returns The upserted claim value
+ */
+export async function upsertValue(userId, claimId, value) {
+    const pool = getPool();
+    const result = await pool.query(`INSERT INTO custom_claim_values (user_id, claim_id, value)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (user_id, claim_id) DO UPDATE
+       SET value = EXCLUDED.value, updated_at = NOW()
+     RETURNING *`, [userId, claimId, JSON.stringify(value)]);
+    return mapRowToValue(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Find value
+// ---------------------------------------------------------------------------
+/**
+ * Get a claim value for a user and claim definition.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @returns Claim value or null if not set
+ */
+export async function findValue(userId, claimId) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM custom_claim_values WHERE user_id = $1 AND claim_id = $2', [userId, claimId]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToValue(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Delete value
+// ---------------------------------------------------------------------------
+/**
+ * Delete a claim value for a user and claim definition.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @returns true if deleted, false if not found
+ */
+export async function deleteValue(userId, claimId) {
+    const pool = getPool();
+    const result = await pool.query('DELETE FROM custom_claim_values WHERE user_id = $1 AND claim_id = $2', [userId, claimId]);
+    return (result.rowCount ?? 0) > 0;
+}
+/**
+ * Map a joined row to a CustomClaimWithValue object.
+ *
+ * Splits the aliased columns into separate definition and value objects.
+ *
+ * @param row - Joined row from the combined query
+ * @returns Object with definition and value properties
+ */
+function mapJoinedRow(row) {
+    return {
+        definition: {
+            id: row.def_id,
+            applicationId: row.application_id,
+            claimName: row.claim_name,
+            claimType: row.claim_type,
+            description: row.description,
+            includeInIdToken: row.include_in_id_token,
+            includeInAccessToken: row.include_in_access_token,
+            includeInUserinfo: row.include_in_userinfo,
+            createdAt: row.def_created_at,
+            updatedAt: row.def_updated_at,
+        },
+        value: {
+            id: row.val_id,
+            userId: row.user_id,
+            claimId: row.claim_id,
+            value: row.value,
+            createdAt: row.val_created_at,
+            updatedAt: row.val_updated_at,
+        },
+    };
+}
+/**
+ * The SQL for joining claim values with their definitions.
+ * Used by both getValuesForUser and getValuesForUserByApp.
+ */
+const JOINED_SELECT = `
+  SELECT
+    d.id AS def_id, d.application_id, d.claim_name, d.claim_type,
+    d.description, d.include_in_id_token, d.include_in_access_token,
+    d.include_in_userinfo, d.created_at AS def_created_at,
+    d.updated_at AS def_updated_at,
+    v.id AS val_id, v.user_id, v.claim_id, v.value,
+    v.created_at AS val_created_at, v.updated_at AS val_updated_at
+  FROM custom_claim_values v
+  JOIN custom_claim_definitions d ON d.id = v.claim_id
+`;
+/**
+ * Get all claim values for a user, joined with definitions.
+ *
+ * Returns values across all applications. Used for admin views.
+ *
+ * @param userId - User UUID
+ * @returns Array of definition+value pairs
+ */
+export async function getValuesForUser(userId) {
+    const pool = getPool();
+    const result = await pool.query(`${JOINED_SELECT} WHERE v.user_id = $1 ORDER BY d.claim_name ASC`, [userId]);
+    return result.rows.map(mapJoinedRow);
+}
+/**
+ * Get all claim values for a user within a specific application.
+ *
+ * This is the token claims hot path — scoped to the client's application.
+ * Returns joined definition+value pairs so the caller can filter by
+ * token type inclusion flags.
+ *
+ * @param userId - User UUID
+ * @param applicationId - Application UUID
+ * @returns Array of definition+value pairs for the application
+ */
+export async function getValuesForUserByApp(userId, applicationId) {
+    const pool = getPool();
+    const result = await pool.query(`${JOINED_SELECT} WHERE v.user_id = $1 AND d.application_id = $2 ORDER BY d.claim_name ASC`, [userId, applicationId]);
+    return result.rows.map(mapJoinedRow);
+}
+//# sourceMappingURL=repository.js.map

package/dist/custom-claims/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/custom-claims/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAW7C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iBAIa,EACb;QACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,gBAAgB,IAAI,KAAK;QAC/B,KAAK,CAAC,oBAAoB,IAAI,IAAI;QAClC,KAAK,CAAC,iBAAiB,IAAI,IAAI;KAChC,CACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sDAAsD,EACtD,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sFAAsF,EACtF,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,WAAW,EAAE,aAAa;IAC1B,gBAAgB,EAAE,qBAAqB;IACvC,oBAAoB,EAAE,yBAAyB;IAC/C,iBAAiB,EAAE,qBAAqB;CACzC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAyC,CAAC,CAAC;QAC/D,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAA2B,GAAG,EAAE,MAAM,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,oDAAoD,EACpD,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,0FAA0F,EAC1F,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,SAAiB,EACjB,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;kBAGY,EACZ,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CACtC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;gBAGY,EACZ,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,KAAc;IAEd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iBAIa,EACb,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;IAEF,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,wEAAwE,EACxE,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sEAAsE,EACtE,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AA6BD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAc;IAClC,OAAO;QACL,UAAU,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAuB;YACtC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,gBAAgB,EAAE,GAAG,CAAC,mBAAmB;YACzC,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;YACjD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,SAAS,EAAE,GAAG,CAAC,cAAc;SAC9B;QACD,KAAK,EAAE;YACL,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,SAAS,EAAE,GAAG,CAAC,cAAc;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;CAUrB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,GAAG,aAAa,iDAAiD,EACjE,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,GAAG,aAAa,2EAA2E,EAC3F,CAAC,MAAM,EAAE,aAAa,CAAC,CACxB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC"}

package/dist/custom-claims/service.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Custom claims service — business logic layer.
+ *
+ * Orchestrates claim definition CRUD, value management, and token claims
+ * building. This is the primary public interface for the custom-claims
+ * module — callers should use these functions instead of accessing the
+ * repository or cache directly.
+ *
+ * Responsibilities:
+ * - Validate claim names (reserved, format) before create
+ * - Enforce uniqueness (application_id + claim_name)
+ * - Validate value types against definition types before set
+ * - Cache orchestration for definitions (cache-first reads, invalidation on writes)
+ * - Audit logging for all write operations (fire-and-forget)
+ * - Build custom claims for token issuance (filtered by token type)
+ *
+ * @see repository.ts — Database operations
+ * @see cache.ts — Redis cache for definitions
+ * @see validators.ts — Name and value validation
+ */
+import type { CustomClaimDefinition, CreateClaimDefinitionInput, UpdateClaimDefinitionInput, CustomClaimValue, CustomClaimWithValue, TokenType } from './types.js';
+/**
+ * Create a custom claim definition for an application.
+ *
+ * Validates the claim name is not reserved, matches the required format,
+ * and is unique within the application. Invalidates the definitions cache
+ * after successful creation.
+ *
+ * @param input - Definition data to create
+ * @returns The newly created definition
+ * @throws ClaimValidationError if name is reserved, invalid format, or duplicate
+ */
+export declare function createDefinition(input: CreateClaimDefinitionInput): Promise<CustomClaimDefinition>;
+/**
+ * Update a claim definition (inclusion flags and description only).
+ *
+ * claimName and claimType cannot be changed — they define the claim's
+ * identity. Invalidates the definitions cache after update.
+ *
+ * @param id - Definition UUID
+ * @param input - Fields to update
+ * @returns Updated definition
+ * @throws ClaimNotFoundError if definition not found
+ */
+export declare function updateDefinition(id: string, input: UpdateClaimDefinitionInput): Promise<CustomClaimDefinition>;
+/**
+ * Delete a claim definition (cascades to all associated values).
+ *
+ * Invalidates the definitions cache after deletion.
+ *
+ * @param id - Definition UUID
+ * @throws ClaimNotFoundError if definition not found
+ */
+export declare function deleteDefinition(id: string): Promise<void>;
+/**
+ * Find a claim definition by ID.
+ *
+ * @param id - Definition UUID
+ * @returns Definition or null if not found
+ */
+export declare function findDefinitionById(id: string): Promise<CustomClaimDefinition | null>;
+/**
+ * List all claim definitions for an application. Cache-first.
+ *
+ * Checks Redis cache first. On cache miss, queries the database
+ * and populates the cache for subsequent requests.
+ *
+ * @param applicationId - Application UUID
+ * @returns Array of definitions
+ */
+export declare function listDefinitions(applicationId: string): Promise<CustomClaimDefinition[]>;
+/**
+ * Set a custom claim value for a user.
+ *
+ * Validates that the claim definition exists and the value matches
+ * the definition's claim type. Uses upsert semantics (insert or update).
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @param value - The value to set (must match definition's claimType)
+ * @returns The upserted claim value
+ * @throws ClaimNotFoundError if definition not found
+ * @throws ClaimValidationError if value type mismatch
+ */
+export declare function setValue(userId: string, claimId: string, value: unknown): Promise<CustomClaimValue>;
+/**
+ * Get a specific claim value for a user.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @returns Claim value or null if not set
+ */
+export declare function getValue(userId: string, claimId: string): Promise<CustomClaimValue | null>;
+/**
+ * Delete a claim value for a user.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @throws ClaimNotFoundError if value not found
+ */
+export declare function deleteValue(userId: string, claimId: string): Promise<void>;
+/**
+ * Get all claim values for a user (across all applications).
+ *
+ * Returns joined definition+value pairs for admin views.
+ *
+ * @param userId - User UUID
+ * @returns Array of definition+value pairs
+ */
+export declare function getValuesForUser(userId: string): Promise<CustomClaimWithValue[]>;
+/**
+ * Build custom claims for inclusion in a token.
+ *
+ * Resolves the user's custom claim values for the specified application,
+ * filtered by the token type (id_token, access_token, or userinfo).
+ * Returns a flat object: { claimName: value, ... }
+ *
+ * Token type filtering:
+ * - id_token → only claims where includeInIdToken is true
+ * - access_token → only claims where includeInAccessToken is true
+ * - userinfo → only claims where includeInUserinfo is true
+ *
+ * @param userId - The user whose claims to resolve
+ * @param applicationId - The application whose claim definitions to use
+ * @param tokenType - Which token type is being built
+ * @returns Flat object with claim names as keys and values
+ */
+export declare function buildCustomClaims(userId: string, applicationId: string, tokenType: TokenType): Promise<Record<string, unknown>>;
+//# sourceMappingURL=service.d.ts.map

package/dist/custom-claims/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/custom-claims/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAuBH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,SAAS,EACV,MAAM,YAAY,CAAC;AAMpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAkChC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CA0BhC;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAE1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAc7F;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahF;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAEtF;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBlC"}