@web-ts-toolkit/moo 0.37.0 → 0.39.0

package/plugins/keycloak-user-sync.js

@@ -0,0 +1,644 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/keycloak-user-sync.ts
+var keycloak_user_sync_exports = {};
+__export(keycloak_user_sync_exports, {
+  keycloakUserSyncPlugin: () => keycloakUserSyncPlugin
+});
+module.exports = __toCommonJS(keycloak_user_sync_exports);
+
+// src/plugins/keycloak-user-sync/adapter.ts
+var createKeycloakUserSyncAdapter = (client, realm) => {
+  const supportedClient = client;
+  const realmHandle = () => supportedClient.realm(realm);
+  const users = supportedClient.core.users;
+  return {
+    async getRealm() {
+      return realmHandle().get();
+    },
+    async getUserById(username, id) {
+      return realmHandle().user(username).getById(id);
+    },
+    async getUserByUsername(username) {
+      return realmHandle().user(username).get();
+    },
+    async findUsersByEmail(email) {
+      return users.find({ realm, email, exact: true, first: 0, max: 2 });
+    },
+    async createUser(username, payload) {
+      return realmHandle().user(username).create(payload);
+    },
+    async updateUser(id, payload) {
+      await users.update({ realm, id }, payload);
+    },
+    async deleteUser(id) {
+      await users.del({ realm, id });
+    },
+    async sendVerifyEmail(id) {
+      await users.sendVerifyEmail({ realm, id });
+    },
+    async resetPassword(id, value, temporary) {
+      await users.resetPassword({ realm, id, credential: { temporary, type: "password", value } });
+    },
+    async ensureRole(name) {
+      await realmHandle().role(name).ensure({});
+    },
+    async getRole(name) {
+      return realmHandle().role(name).get();
+    },
+    async listRealmRoleMappings(id) {
+      return users.listRealmRoleMappings({ realm, id });
+    },
+    async addRealmRoleMappings(id, roles) {
+      await users.addRealmRoleMappings({ realm, id, roles });
+    },
+    async delRealmRoleMappings(id, roles) {
+      await users.delRealmRoleMappings({ realm, id, roles });
+    }
+  };
+};
+
+// src/plugins/keycloak-user-sync/planner.ts
+var dangerousAttributeKeys = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var assertSafeAttributeKey = (key) => {
+  if (dangerousAttributeKeys.has(key)) {
+    throw new Error(`keycloakUserSyncPlugin attribute key "${key}" is not supported`);
+  }
+};
+var stringValue = (value) => {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed || null;
+};
+var normalizeEmail = (value) => stringValue(value)?.toLowerCase() ?? null;
+var uniqueStrings = (values) => [
+  ...new Set(values.map(stringValue).filter((value) => value !== null))
+];
+var getPathValue = (value, path) => path.split(".").reduce((current, part) => {
+  if (typeof current !== "object" || current === null) return void 0;
+  return current[part];
+}, value);
+var normalizeProfileString = (value, allowClearing) => {
+  if (value === null) return allowClearing ? "" : null;
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (trimmed) return trimmed;
+  return allowClearing ? "" : null;
+};
+var normalizeAttributeValue = (value) => {
+  if (value === null || value === void 0) return null;
+  const values = Array.isArray(value) ? value : [value];
+  const normalized = values.map((item) => {
+    if (item instanceof Date) return item.toISOString();
+    if (typeof item === "string") return item;
+    if (typeof item === "number" || typeof item === "boolean" || typeof item === "bigint") return String(item);
+    return null;
+  }).filter((item) => item !== null);
+  return normalized.length ? normalized : null;
+};
+var normalizeAttributes = (attributes) => {
+  const normalizedAttributes = /* @__PURE__ */ Object.create(null);
+  if (typeof attributes !== "object" || attributes === null || Array.isArray(attributes)) return normalizedAttributes;
+  for (const [key, value] of Object.entries(attributes)) {
+    const normalizedKey = stringValue(key);
+    if (!normalizedKey) continue;
+    assertSafeAttributeKey(normalizedKey);
+    const normalizedValue = normalizeAttributeValue(value);
+    if (normalizedValue) normalizedAttributes[normalizedKey] = normalizedValue;
+  }
+  return normalizedAttributes;
+};
+var getDocumentValue = (document, paths, field) => document.get(paths[field]);
+var buildTrackedPaths = (options) => uniqueStrings([
+  options.paths.providerId,
+  ...Object.entries(options.syncFields).filter(([, enabled]) => enabled).flatMap(
+    ([field]) => field === "enabled" ? [options.paths.enabled, options.paths.archived] : [options.paths[field]]
+  ),
+  ...options.syncFields.attributes && options.attributePaths ? options.attributePaths : []
+]);
+var planChangedFields = (options, isNew, isModified, currentProviderId) => {
+  const changedFields = /* @__PURE__ */ new Set();
+  if (isModified(options.paths.providerId)) changedFields.add("providerId");
+  for (const [field, enabled] of Object.entries(options.syncFields)) {
+    if (!enabled) continue;
+    const paths = field === "enabled" ? [options.paths.enabled, options.paths.archived] : [options.paths[field]];
+    if (paths.some(isModified)) changedFields.add(field);
+  }
+  if (options.syncFields.attributes && options.attributePaths?.some(isModified)) changedFields.add("attributes");
+  const shouldPersistMissingProviderId = stringValue(currentProviderId) === null;
+  const shouldSync = isNew || shouldPersistMissingProviderId || changedFields.size > 0;
+  return {
+    changedFields,
+    trackedPaths: buildTrackedPaths(options),
+    shouldSync,
+    passwordChanged: changedFields.has("password")
+  };
+};
+var buildProfilePayload = (document, options, allowClearing = false, changedFields) => {
+  const payload = {};
+  const shouldInclude = (field) => !changedFields || changedFields.has(field);
+  const copyString = (field) => {
+    if (!options.syncFields[field] || !shouldInclude(field)) return;
+    const value = normalizeProfileString(getDocumentValue(document, options.paths, field), allowClearing);
+    if (value !== null) payload[field] = value;
+  };
+  copyString("username");
+  copyString("email");
+  copyString("firstName");
+  copyString("lastName");
+  if (options.syncFields.emailVerified && shouldInclude("emailVerified") && typeof getDocumentValue(document, options.paths, "emailVerified") === "boolean") {
+    payload.emailVerified = getDocumentValue(document, options.paths, "emailVerified");
+  }
+  if (options.syncFields.enabled && shouldInclude("enabled")) {
+    const archived = getDocumentValue(document, options.paths, "archived");
+    const enabled = getDocumentValue(document, options.paths, "enabled");
+    if (typeof archived === "boolean") payload.enabled = !archived;
+    else if (typeof enabled === "boolean") payload.enabled = enabled;
+  }
+  return payload;
+};
+var getDesiredRoles = (document, options) => {
+  if (!options.syncFields.roles) return null;
+  const source = getDocumentValue(document, options.paths, "roles");
+  const mapped = options.mapRoles ? options.mapRoles(source, document) : Array.isArray(source) ? source : null;
+  if (!mapped) return null;
+  return uniqueStrings(mapped);
+};
+var getDesiredAttributes = (document, options) => {
+  if (!options.syncFields.attributes) return null;
+  const source = options.mapAttributes ? options.mapAttributes(document) : getDocumentValue(document, options.paths, "attributes");
+  return normalizeAttributes(source);
+};
+var getDesiredPassword = (document, options) => {
+  if (!options.syncFields.password) return null;
+  const value = options.mapPassword ? options.mapPassword(document) : getDocumentValue(document, options.paths, "password");
+  return typeof value === "string" && value.length > 0 ? value : null;
+};
+var mergeAttributes = (user, document, options) => {
+  const desiredAttributes = getDesiredAttributes(document, options);
+  if (!desiredAttributes) return void 0;
+  const currentAttributes = Object.assign(/* @__PURE__ */ Object.create(null), user?.attributes ?? {});
+  if (options.managedAttributes) {
+    for (const key of options.managedAttributes) {
+      delete currentAttributes[key];
+    }
+  }
+  return Object.assign(/* @__PURE__ */ Object.create(null), currentAttributes, desiredAttributes);
+};
+var planEmailVerification = ({
+  created,
+  wasNew,
+  syncEmail,
+  syncEmailVerified,
+  previousEmail,
+  currentEmail,
+  remoteEmail
+}) => {
+  const normalizedPreviousEmail = normalizeEmail(previousEmail);
+  const normalizedCurrentEmail = normalizeEmail(currentEmail);
+  const normalizedRemoteEmail = normalizeEmail(remoteEmail);
+  const emailSyncTargetChanged = !created && syncEmail && normalizedCurrentEmail !== null && normalizedRemoteEmail !== normalizedCurrentEmail;
+  const persistedLocalEmailChanged = !created && !wasNew && syncEmail && normalizedCurrentEmail !== null && normalizedPreviousEmail !== normalizedCurrentEmail;
+  const initialLinkSameEmail = wasNew && !created && normalizedCurrentEmail !== null && normalizedRemoteEmail === normalizedCurrentEmail;
+  return {
+    changed: syncEmailVerified && (persistedLocalEmailChanged || emailSyncTargetChanged && !initialLinkSameEmail),
+    initialLinkSameEmail
+  };
+};
+var planRoleDiff = (desiredNames, assignedRoles, desiredRoles, managedRoles) => {
+  const managedNames = managedRoles ? new Set(managedRoles) : null;
+  const effectiveDesiredNames = managedNames ? desiredNames.filter((name) => managedNames.has(name)) : desiredNames;
+  const assignedNames = new Set(assignedRoles.map((role) => role.name).filter((name) => Boolean(name)));
+  const desiredNameSet = new Set(effectiveDesiredNames);
+  return {
+    desiredNames,
+    effectiveDesiredNames,
+    toAdd: desiredRoles.filter((role) => role.name && !assignedNames.has(role.name)),
+    toRemove: managedNames ? assignedRoles.filter((role) => role.name && !desiredNameSet.has(role.name) && managedNames.has(role.name)) : []
+  };
+};
+
+// src/plugins/keycloak-user-sync.ts
+var syncStateKey = "keycloakUserSync";
+var pluginRegisteredKey = /* @__PURE__ */ Symbol("keycloakUserSyncPluginRegistered");
+var defaultPaths = {
+  providerId: "providerId",
+  username: "username",
+  email: "email",
+  emailVerified: "emailVerified",
+  firstName: "firstName",
+  lastName: "lastName",
+  enabled: "enabled",
+  archived: "archived",
+  roles: "roles",
+  attributes: "attributes",
+  password: "password"
+  // pragma: allowlist secret
+};
+var defaultSyncFields = {
+  username: true,
+  email: true,
+  emailVerified: true,
+  firstName: true,
+  lastName: true,
+  enabled: true,
+  roles: true,
+  attributes: true,
+  password: false
+};
+var identityFields = ["providerId", "username", "email"];
+var syncFieldNames = [
+  "username",
+  "email",
+  "emailVerified",
+  "firstName",
+  "lastName",
+  "enabled",
+  "roles",
+  "attributes",
+  "password"
+];
+var pathNames = [
+  "providerId",
+  "username",
+  "email",
+  "emailVerified",
+  "firstName",
+  "lastName",
+  "enabled",
+  "archived",
+  "roles",
+  "attributes",
+  "password"
+];
+var isIdentityField = (value) => typeof value === "string" && identityFields.includes(value);
+var hasSchemaPath = (schema, path) => {
+  const schemaWithVirtuals = schema;
+  return Boolean(schema.path(path) ?? schemaWithVirtuals.virtualpath?.(path));
+};
+var requiredString = (value, name) => {
+  const normalized = stringValue(value);
+  if (!normalized) throw new Error(`keycloakUserSyncPlugin requires a non-empty ${name}`);
+  return normalized;
+};
+var validateOptionKeys = (value, allowed, name) => {
+  if (value === void 0) return;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`keycloakUserSyncPlugin ${name} must be an object`);
+  }
+  for (const key of Object.keys(value)) {
+    if (!allowed.includes(key)) throw new Error(`keycloakUserSyncPlugin received unsupported ${name} key "${key}"`);
+  }
+};
+var normalizeOptionalStringList = (values, name) => {
+  if (values === void 0) return void 0;
+  if (!Array.isArray(values)) throw new Error(`keycloakUserSyncPlugin ${name} must be an array of non-empty strings`);
+  return Object.freeze(
+    uniqueStrings(
+      values.map((value, index) => {
+        const normalized = stringValue(value);
+        if (!normalized) throw new Error(`keycloakUserSyncPlugin ${name}[${index}] must be a non-empty string`);
+        if (name === "managedAttributes") assertSafeAttributeKey(normalized);
+        return normalized;
+      })
+    )
+  );
+};
+var normalizeMaxRolesPerSync = (value) => {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("keycloakUserSyncPlugin maxRolesPerSync must be a positive safe integer");
+  }
+  return value;
+};
+var normalizeIdentityList = (identifyBy) => {
+  const configured = identifyBy === void 0 ? ["providerId", "username", "email"] : typeof identifyBy === "string" ? [identifyBy] : identifyBy;
+  if (!Array.isArray(configured)) {
+    throw new Error("keycloakUserSyncPlugin identifyBy must be a supported identity or non-empty identity array");
+  }
+  const identities = configured.map((identity, index) => {
+    if (!isIdentityField(identity)) {
+      throw new Error(`keycloakUserSyncPlugin identifyBy[${index}] must be providerId, username, or email`);
+    }
+    return identity;
+  });
+  const uniqueIdentities = Object.freeze([...new Set(identities)]);
+  if (uniqueIdentities.length === 0) throw new Error("keycloakUserSyncPlugin identifyBy must not be empty");
+  return uniqueIdentities;
+};
+var normalizePaths = (paths) => {
+  validateOptionKeys(paths, pathNames, "paths");
+  const normalized = { ...defaultPaths };
+  for (const name of pathNames) {
+    const value = paths?.[name];
+    if (value !== void 0) normalized[name] = requiredString(value, `paths.${name}`);
+  }
+  return Object.freeze(normalized);
+};
+var normalizeSyncFields = (syncFields) => {
+  validateOptionKeys(syncFields, syncFieldNames, "syncFields");
+  return Object.freeze({ ...defaultSyncFields, ...syncFields });
+};
+var validateConfiguredSchemaPath = (schema, path, name) => {
+  if (!hasSchemaPath(schema, path)) {
+    throw new Error(`keycloakUserSyncPlugin ${name} path "${path}" does not exist in the schema`);
+  }
+};
+var normalizeOptions = (schema, options) => {
+  if (!options?.client) throw new Error("keycloakUserSyncPlugin requires a client option");
+  const paths = normalizePaths(options.paths);
+  const syncFields = normalizeSyncFields(options.syncFields);
+  const normalized = Object.freeze({
+    ...options,
+    realm: requiredString(options.realm, "realm option"),
+    identifyBy: normalizeIdentityList(options.identifyBy),
+    paths,
+    syncFields,
+    attributePaths: normalizeOptionalStringList(options.attributePaths, "attributePaths"),
+    managedAttributes: normalizeOptionalStringList(options.managedAttributes, "managedAttributes"),
+    managedRoles: normalizeOptionalStringList(options.managedRoles, "managedRoles"),
+    maxRolesPerSync: normalizeMaxRolesPerSync(options.maxRolesPerSync)
+  });
+  validateConfiguredSchemaPath(schema, paths.providerId, "paths.providerId");
+  for (const identity of normalized.identifyBy)
+    validateConfiguredSchemaPath(schema, paths[identity], `paths.${identity}`);
+  if (syncFields.emailVerified) validateConfiguredSchemaPath(schema, paths.emailVerified, "paths.emailVerified");
+  if (syncFields.firstName) validateConfiguredSchemaPath(schema, paths.firstName, "paths.firstName");
+  if (syncFields.lastName) validateConfiguredSchemaPath(schema, paths.lastName, "paths.lastName");
+  if (syncFields.enabled && !hasSchemaPath(schema, paths.enabled) && !hasSchemaPath(schema, paths.archived)) {
+    throw new Error(
+      `keycloakUserSyncPlugin requires either paths.enabled "${paths.enabled}" or paths.archived "${paths.archived}" in the schema`
+    );
+  }
+  if (syncFields.roles && !normalized.mapRoles) validateConfiguredSchemaPath(schema, paths.roles, "paths.roles");
+  if (syncFields.attributes && !normalized.mapAttributes)
+    validateConfiguredSchemaPath(schema, paths.attributes, "paths.attributes");
+  if (syncFields.password && !normalized.mapPassword)
+    validateConfiguredSchemaPath(schema, paths.password, "paths.password");
+  return normalized;
+};
+var getState = (document) => document.$locals[syncStateKey];
+var getDocumentSession = (document) => document.$session?.() ?? null;
+var assertNoDocumentSession = (document, operation) => {
+  if (getDocumentSession(document)) {
+    throw new Error(
+      `keycloakUserSyncPlugin direct ${operation} hooks do not support Mongoose sessions or transactions; use an application-owned outbox/worker for transactional delivery`
+    );
+  }
+};
+function keycloakUserSyncPlugin(schema, rawOptions) {
+  const schemaWithMarker = schema;
+  if (schemaWithMarker[pluginRegisteredKey]) {
+    throw new Error("keycloakUserSyncPlugin is already registered on this schema");
+  }
+  const options = normalizeOptions(schema, rawOptions);
+  schemaWithMarker[pluginRegisteredKey] = true;
+  const paths = options.paths;
+  const syncFields = options.syncFields;
+  const identities = options.identifyBy;
+  const adapter = createKeycloakUserSyncAdapter(options.client, options.realm);
+  const trackedPaths = buildTrackedPaths(options);
+  const buildSafeErrorContext = (operation, document) => ({
+    operation,
+    localDocumentId: document._id === void 0 || document._id === null ? void 0 : String(document._id)
+  });
+  const handleError = async (error, operation, document) => {
+    const safeContext = buildSafeErrorContext(operation, document);
+    const logger = options.logger === false ? null : options.logger ?? console;
+    try {
+      await logger?.error(`Keycloak user sync failed during ${operation}`, { ...safeContext, error });
+    } catch {
+    }
+    try {
+      const callbackContext = options.includeDocumentInErrorContext ? { ...safeContext, document } : safeContext;
+      await options.onError?.(error, callbackContext);
+    } catch {
+    }
+    if (options.throwOnError !== false) throw error;
+  };
+  const readDocumentValue = (document, field) => getDocumentValue(document, paths, field);
+  const getPreviousValue = (previous, field) => getPathValue(previous, paths[field]);
+  const getUsername = (document) => stringValue(readDocumentValue(document, "username")) ?? stringValue(readDocumentValue(document, "email"));
+  const resolveUser = async (document, previous) => {
+    const realm = await adapter.getRealm();
+    if (!realm) throw new Error(`Keycloak realm "${options.realm}" was not found`);
+    const duplicateEmailsAllowed = realm.duplicateEmailsAllowed === true;
+    const orderedIdentities = duplicateEmailsAllowed ? ["providerId", "username", "email"].filter((identity) => identities.includes(identity)) : identities;
+    const getCompleteUserById = async (user) => {
+      if (!user.id) return user;
+      return await adapter.getUserById(user.username ?? user.id, user.id) ?? user;
+    };
+    for (const identity of orderedIdentities) {
+      if (identity === "providerId") {
+        for (const providerId of uniqueStrings([
+          readDocumentValue(document, "providerId"),
+          getPreviousValue(previous, "providerId")
+        ])) {
+          const user = await adapter.getUserById(getUsername(document) ?? providerId, providerId);
+          if (user) return { user, duplicateEmailsAllowed };
+        }
+      }
+      if (identity === "username") {
+        for (const username of uniqueStrings([
+          readDocumentValue(document, "username"),
+          getPreviousValue(previous, "username")
+        ])) {
+          const user = await adapter.getUserByUsername(username);
+          if (user) return { user, duplicateEmailsAllowed };
+        }
+      }
+      if (identity === "email") {
+        for (const email of uniqueStrings([
+          readDocumentValue(document, "email"),
+          getPreviousValue(previous, "email")
+        ])) {
+          const matches = (await adapter.findUsersByEmail(email)).filter(
+            (user) => normalizeEmail(user.email) === normalizeEmail(email)
+          );
+          if (matches.length > 1) {
+            throw new Error("Cannot identify a unique Keycloak user for the configured email identity");
+          }
+          if (matches.length === 1) return { user: await getCompleteUserById(matches[0]), duplicateEmailsAllowed };
+        }
+      }
+    }
+    return { user: null, duplicateEmailsAllowed };
+  };
+  const resolveCreatedUser = async (document, username) => {
+    const userByUsername = await adapter.getUserByUsername(username);
+    if (userByUsername) return userByUsername;
+    const email = stringValue(readDocumentValue(document, "email"));
+    if (!email) return null;
+    const matches = (await adapter.findUsersByEmail(email)).filter(
+      (user) => normalizeEmail(user.email) === normalizeEmail(email)
+    );
+    if (matches.length > 1) throw new Error("Cannot identify a unique Keycloak user for the configured email identity");
+    const match = matches[0];
+    if (!match?.id) return match ?? null;
+    return await adapter.getUserById(match.username ?? match.id, match.id) ?? match;
+  };
+  const syncRoles = async (user, document) => {
+    if (!syncFields.roles || !user.id) return;
+    const desiredNames = getDesiredRoles(document, options);
+    if (desiredNames === null) return;
+    const maxRolesPerSync = options.maxRolesPerSync ?? 100;
+    if (desiredNames.length > maxRolesPerSync) {
+      throw new Error(`keycloakUserSyncPlugin supports at most ${maxRolesPerSync} desired roles per sync operation`);
+    }
+    const managedNames = options.managedRoles ? new Set(options.managedRoles) : null;
+    const effectiveDesiredNames = managedNames ? desiredNames.filter((name) => managedNames.has(name)) : desiredNames;
+    if (effectiveDesiredNames.length === 0 && !managedNames) return;
+    const desiredRoles = [];
+    for (const roleName of effectiveDesiredNames) {
+      if (options.ensureRoles !== false) await adapter.ensureRole(roleName);
+      const role = await adapter.getRole(roleName);
+      if (!role?.id) throw new Error(`Keycloak realm role "${roleName}" was not found`);
+      desiredRoles.push(role);
+    }
+    const assignedRoles = await adapter.listRealmRoleMappings(user.id);
+    const { toAdd, toRemove } = planRoleDiff(desiredNames, assignedRoles, desiredRoles, options.managedRoles);
+    if (toAdd.length) {
+      await adapter.addRealmRoleMappings(user.id, toAdd);
+    }
+    if (toRemove.length) {
+      await adapter.delRealmRoleMappings(user.id, toRemove);
+    }
+  };
+  const persistProviderId = async (document, providerId) => {
+    if (options.persistProviderId === false || readDocumentValue(document, "providerId") === providerId) return;
+    document.set(paths.providerId, providerId);
+    await document.constructor.updateOne(
+      { _id: document._id },
+      { $set: { [paths.providerId]: providerId } },
+      { session: getDocumentSession(document) }
+    );
+    document.unmarkModified(paths.providerId);
+  };
+  const syncDocument = async (document, state) => {
+    const resolved = await resolveUser(document, state.previous);
+    let user = resolved.user;
+    let created = false;
+    const shouldSyncProfile = state.wasNew || ["username", "email", "emailVerified", "firstName", "lastName", "enabled"].some(
+      (field) => state.changedFields.has(field)
+    );
+    const shouldSyncAttributes = state.wasNew || state.changedFields.has("attributes");
+    const payload = shouldSyncProfile ? buildProfilePayload(document, options, Boolean(resolved.user), state.wasNew ? void 0 : state.changedFields) : {};
+    const desiredPassword = getDesiredPassword(document, options);
+    if (!user) {
+      const username = getUsername(document);
+      if (!username) throw new Error("Cannot create a Keycloak user without a username or email");
+      payload.attributes = mergeAttributes(null, document, options);
+      try {
+        user = await adapter.createUser(username, payload) ?? null;
+      } catch (error) {
+        if (identities.length === 0) throw error;
+        const recoveredUser = await resolveCreatedUser(document, username);
+        if (!recoveredUser) throw error;
+        user = recoveredUser;
+      }
+      created = true;
+    }
+    if (!user?.id) throw new Error("Keycloak did not return a user ID");
+    const userId = user.id;
+    await persistProviderId(document, userId);
+    const emailVerificationPlan = planEmailVerification({
+      created,
+      wasNew: state.wasNew,
+      syncEmail: syncFields.email,
+      syncEmailVerified: syncFields.emailVerified,
+      previousEmail: getPreviousValue(state.previous, "email"),
+      currentEmail: readDocumentValue(document, "email"),
+      remoteEmail: user.email
+    });
+    if (!created) {
+      if (emailVerificationPlan.initialLinkSameEmail) delete payload.emailVerified;
+      if (emailVerificationPlan.changed) {
+        const email = stringValue(readDocumentValue(document, "email"));
+        if (syncFields.email && email) payload.email = email;
+        payload.emailVerified = false;
+      }
+      if (shouldSyncAttributes) payload.attributes = mergeAttributes(user, document, options);
+      if (Object.keys(payload).length > 0) {
+        await adapter.updateUser(userId, payload);
+        user = { ...user, ...payload };
+      }
+    }
+    if ((created || state.passwordChanged) && desiredPassword) {
+      await adapter.resetPassword(userId, desiredPassword, options.passwordTemporary ?? false);
+    }
+    if (created || state.changedFields.has("roles")) await syncRoles(user, document);
+    if (emailVerificationPlan.changed && options.sendVerificationEmailOnChange !== false) {
+      await adapter.sendVerifyEmail(userId);
+    }
+  };
+  const deleteDocument = async (document) => {
+    const { user } = await resolveUser(document);
+    if (user?.id) await adapter.deleteUser(user.id);
+  };
+  schema.pre("save", async function keycloakUserSyncPreSave() {
+    assertNoDocumentSession(this, "save");
+    const providerIdChanged = !this.isNew && this.isModified(paths.providerId);
+    const changePlan = planChangedFields(
+      options,
+      this.isNew,
+      (path) => this.isModified(path),
+      options.persistProviderId === false ? "disabled" : this.get(paths.providerId)
+    );
+    const state = { ...changePlan, wasNew: this.isNew };
+    this.$locals[syncStateKey] = state;
+    if (!state.shouldSync || this.isNew) return;
+    state.previous = await this.constructor.findById(this._id).select(trackedPaths).session(getDocumentSession(this)).lean();
+    if (providerIdChanged) {
+      const previousProviderId = stringValue(getPreviousValue(state.previous, "providerId"));
+      const currentProviderId = stringValue(readDocumentValue(this, "providerId"));
+      if (previousProviderId !== currentProviderId) {
+        throw new Error(
+          "keycloakUserSyncPlugin providerId is server-controlled and cannot be changed after persistence"
+        );
+      }
+    }
+  });
+  schema.post("save", async function keycloakUserSyncPostSave() {
+    const state = getState(this);
+    if (!state?.shouldSync) return;
+    try {
+      await syncDocument(this, state);
+    } catch (error) {
+      await handleError(error, "save", this);
+    }
+  });
+  schema.pre(
+    "deleteOne",
+    { document: true, query: false },
+    async function keycloakUserSyncPreDelete() {
+      assertNoDocumentSession(this, "delete");
+      try {
+        await deleteDocument(this);
+      } catch (error) {
+        await handleError(error, "delete", this);
+        throw error;
+      }
+    }
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  keycloakUserSyncPlugin
+});