@authup/server-core 1.0.0-beta.47 → 1.0.0-beta.48

package/dist/adapters/http/middleware/built-in/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QAuBtE"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QA2BtE"}

package/dist/adapters/http/middleware/built-in/cors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // @routup/cors reflects the matched origin when given an array (and\n        // still honours credentials: true). Callers pass the trusted\n        // appOrigins allowlist; falls back to reflect-all only if unset.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAIZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;EAEJ,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. All authentication is header-based\n        // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n        // origin allowlist would add no security, only break dynamically\n        // registered browser clients. Operators can still pass an explicit\n        // `origin` via the middlewareCors config options.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;EAEJ,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}

package/dist/app/modules/http/modules/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AA8BxC,qBAAa,oBAAoB;IACvB,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9D,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB5D,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9D,WAAW,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE,UAAU,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlE,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjE,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/D,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrE,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B3E,OAAO,CAAC,0BAA0B;IAUlC,OAAO,CAAC,SAAS;CAGpB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AA8BxC,qBAAa,oBAAoB;IACvB,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9D,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAY5D,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9D,WAAW,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE,UAAU,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlE,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjE,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/D,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrE,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B3E,OAAO,CAAC,0BAA0B;IAUlC,OAAO,CAAC,SAAS;CAGpB"}

package/dist/app/modules/http/modules/middleware.mjs

@@ -5,7 +5,6 @@ import { AuthenticationInjectionKey } from "../../authentication/constants.mjs";
 import { RealmEntity } from "../../../../adapters/database/domains/realm/entity.mjs";
 import "../../../../adapters/database/domains/index.mjs";
 import { ConfigInjectionKey } from "../../config/constants.mjs";
-import { getAppOrigins } from "../../config/origins.mjs";
 import "../../config/index.mjs";
 import "../../authentication/index.mjs";
 import { DatabaseInjectionKey } from "../../database/constants.mjs";
@@ -54,9 +53,7 @@ var HTTPMiddlewareModule = class {
 	async mountCors(router, container) {
 		const config = container.resolve(ConfigInjectionKey);
 		if (!this.isEnabled(config.middlewareCors)) return;
-		const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};
-		if (typeof options.origin === "undefined") options.origin = getAppOrigins(config);
-		registerCorsMiddleware(router, options);
+		registerCorsMiddleware(router, this.transformBoolToEmptyObject(config.middlewareCors) ?? {});
 	}
 	async mountLogger(router, container) {
 		const middleware = createLoggerMiddleware({

package/dist/app/modules/http/modules/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":["path","createAuthorizationMiddleware","createLoggerMiddleware","createRealmResolverMiddleware","createSwaggerMiddleware","registerAssetsMiddleware","registerBasicMiddleware","registerCorsMiddleware","registerErrorMiddleware","registerPrometheusMiddleware","registerRateLimitMiddleware","registerUIHttpClientMiddleware","HTTPInjectionKey","DIST_PATH","AuthenticationInjectionKey","ConfigInjectionKey","getAppOrigins","LoggerInjectionKey","IdentityInjectionKey","OAuth2InjectionToken","RealmEntity","RealmRepositoryAdapter","DatabaseInjectionKey","PermissionDatabaseProvider","HTTPMiddlewareModule","mountBefore","router","container","mountPrometheus","mountLogger","mountCors","mountAssets","mountUIHttpClient","mountBasic","mountRateLimit","mountSwagger","mountAuthorization","mountRealmResolver","mountAfter","logger","resolve","config","isEnabled","middlewareCors","options","transformBoolToEmptyObject","origin","middleware","env","use","has","UIHttpClient","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","documentPath","join","baseURL","publicUrl","realmRepository","dataSource","DataSource","identityResolver","Resolver","sessionManager","SessionManager","oauth2TokenVerifier","TokenVerifier","identityPermissionProvider","PermissionProvider","permissionProvider","clientAuthBasic","robotAuthBasic","userAuthBasic","input"],"sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport path from 'node:path';\nimport type { IContainer } from 'eldin';\nimport type { Repository } from 'typeorm';\nimport type { Realm } from '@authup/core-kit';\nimport {\n    createAuthorizationMiddleware,\n    createLoggerMiddleware,\n    createRealmResolverMiddleware,\n    createSwaggerMiddleware,\n    registerAssetsMiddleware,\n    registerBasicMiddleware,\n    registerCorsMiddleware,\n    registerErrorMiddleware,\n    registerPrometheusMiddleware,\n    registerRateLimitMiddleware,\n    registerUIHttpClientMiddleware,\n} from '../../../../adapters/http/index.ts';\nimport { HTTPInjectionKey } from '../constants.ts';\nimport { DIST_PATH } from '../../../../path.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { ConfigInjectionKey, getAppOrigins } from '../../config/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { RealmEntity } from '../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../../database/repositories/index.ts';\nimport {\n    DatabaseInjectionKey,\n    PermissionDatabaseProvider,\n} from '../../database/index.ts';\n\nexport class HTTPMiddlewareModule {\n    async mountBefore(router: App, container: IContainer): Promise<void> {\n        // @routup/prometheus must be installed before any other plugin or\n        // route so that its onion middleware can observe the full request\n        // lifecycle (the v3 README is explicit on this).\n        await this.mountPrometheus(router, container);\n        await this.mountLogger(router, container);\n        await this.mountCors(router, container);\n        await this.mountAssets(router);\n        await this.mountUIHttpClient(router, container);\n        await this.mountBasic(router);\n        await this.mountRateLimit(router, container);\n\n        await this.mountSwagger(router, container);\n        await this.mountAuthorization(router, container);\n        await this.mountRealmResolver(router, container);\n    }\n\n\n    async mountAfter(router: App, container: IContainer): Promise<void> {\n        registerErrorMiddleware(router, { logger: container.resolve(LoggerInjectionKey) });\n    }\n\n    // ----------------------------------------------------\n    async mountCors(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareCors)) {\n            return;\n        }\n\n        const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};\n\n        // Restrict CORS to the trusted application origins (publicUrl +\n        // additionalDomains) unless the operator explicitly configured an\n        // origin via the middlewareCors options object.\n        if (typeof options.origin === 'undefined') {\n            options.origin = getAppOrigins(config);\n        }\n\n        registerCorsMiddleware(router, options);\n    }\n\n    async mountLogger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const middleware = createLoggerMiddleware({\n            env: config.env,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        router.use(middleware);\n    }\n\n    async mountAssets(router: App): Promise<void> {\n        await registerAssetsMiddleware(router);\n    }\n\n    async mountUIHttpClient(router: App, container: IContainer): Promise<void> {\n        if (!container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        registerUIHttpClientMiddleware(router, () => container.resolve(HTTPInjectionKey.UIHttpClient));\n    }\n\n    async mountBasic(router: App): Promise<void> {\n        registerBasicMiddleware(router);\n    }\n\n    async mountPrometheus(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewarePrometheus)) {\n            return;\n        }\n\n        registerPrometheusMiddleware(router, this.transformBoolToEmptyObject(config.middlewarePrometheus));\n    }\n\n    async mountRateLimit(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareRateLimit)) {\n            return;\n        }\n\n        registerRateLimitMiddleware(router, this.transformBoolToEmptyObject(config.middlewareRateLimit));\n    }\n\n    async mountSwagger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        if (!this.isEnabled(config.middlewareSwagger)) {\n            return;\n        }\n\n        const middleware = createSwaggerMiddleware({\n            documentPath: path.join(DIST_PATH, 'swagger.json'),\n            baseURL: config.publicUrl,\n        });\n\n        router.use('/docs', middleware);\n    }\n\n    async mountRealmResolver(router: App, container: IContainer): Promise<void> {\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const middleware = createRealmResolverMiddleware({ realmRepository: new RealmRepositoryAdapter(realmRepository) });\n\n        // Mounted at /realms/:realmId/:nested so the middleware only fires on\n        // nested-resource URLs (e.g. /realms/master/users/...). Bare\n        // /realms/:id routes belong to RealmController (CRUD, openid-config,\n        // jwks) and would otherwise 404 on PUT upserts where the realm\n        // doesn't exist yet.\n        router.use('/realms/:realmId/:nested', middleware);\n    }\n\n    async mountAuthorization(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n        const oauth2TokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n        const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n        const middleware = createAuthorizationMiddleware({\n            identityResolver,\n            identityPermissionProvider,\n            permissionProvider,\n            oauth2TokenVerifier,\n            sessionManager,\n            options: {\n                clientAuthBasic: config.clientAuthBasic,\n                robotAuthBasic: config.robotAuthBasic,\n                userAuthBasic: config.userAuthBasic,\n            },\n        });\n\n        router.use(middleware);\n    }\n\n    // ----------------------------------------------------\n\n    private transformBoolToEmptyObject<T extends Record<string, any>>(\n        input?: T | boolean,\n    ) : T | undefined {\n        if (typeof input === 'boolean') {\n            return {} as T;\n        }\n\n        return input || {} as T;\n    }\n\n    private isEnabled<T>(input: T | boolean) {\n        return typeof input !== 'boolean' || input === true;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAawB,uBAAb,MAAaA;CACT,MAAMC,YAAYC,QAAaC,WAAsC;EAIjE,MAAM,KAAKC,gBAAgBF,QAAQC,SAAAA;EACnC,MAAM,KAAKE,YAAYH,QAAQC,SAAAA;EAC/B,MAAM,KAAKG,UAAUJ,QAAQC,SAAAA;EAC7B,MAAM,KAAKI,YAAYL,MAAAA;EACvB,MAAM,KAAKM,kBAAkBN,QAAQC,SAAAA;EACrC,MAAM,KAAKM,WAAWP,MAAAA;EACtB,MAAM,KAAKQ,eAAeR,QAAQC,SAAAA;EAElC,MAAM,KAAKQ,aAAaT,QAAQC,SAAAA;EAChC,MAAM,KAAKS,mBAAmBV,QAAQC,SAAAA;EACtC,MAAM,KAAKU,mBAAmBX,QAAQC,SAAAA;CAC1C;CAGA,MAAMW,WAAWZ,QAAaC,WAAsC;EAChEnB,wBAAwBkB,QAAQ,EAAEa,QAAQZ,UAAUa,QAAQvB,kBAAAA,EAAoB,CAAA;CACpF;CAGA,MAAMa,UAAUJ,QAAaC,WAAsC;EAC/D,MAAMc,SAASd,UAAUa,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOE,cAAc,GACrC;EAGJ,MAAMC,UAAU,KAAKC,2BAA2BJ,OAAOE,cAAc,KAAK,CAAC;EAK3E,IAAI,OAAOC,QAAQE,WAAW,aAC1BF,QAAQE,SAAS9B,cAAcyB,MAAAA;EAGnClC,uBAAuBmB,QAAQkB,OAAAA;CACnC;CAEA,MAAMf,YAAYH,QAAaC,WAAsC;EAEjE,MAAMoB,aAAa7C,uBAAuB;GACtC8C,KAFWrB,UAAUa,QAAQzB,kBAExB0B,CAAAA,CAAOO;GACZT,QAAQZ,UAAUa,QAAQvB,kBAAAA;EAC9B,CAAA;EAEAS,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMhB,YAAYL,QAA4B;EAC1C,MAAMrB,yBAAyBqB,MAAAA;CACnC;CAEA,MAAMM,kBAAkBN,QAAaC,WAAsC;EACvE,IAAI,CAACA,UAAUuB,IAAItC,iBAAiBuC,YAAY,GAC5C;EAGJxC,+BAA+Be,cAAcC,UAAUa,QAAQ5B,iBAAiBuC,YAAY,CAAA;CAChG;CAEA,MAAMlB,WAAWP,QAA4B;EACzCpB,wBAAwBoB,MAAAA;CAC5B;CAEA,MAAME,gBAAgBF,QAAaC,WAAsC;EACrE,MAAMc,SAASd,UAAUa,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOW,oBAAoB,GAC3C;EAGJ3C,6BAA6BiB,QAAQ,KAAKmB,2BAA2BJ,OAAOW,oBAAoB,CAAA;CACpG;CAEA,MAAMlB,eAAeR,QAAaC,WAAsC;EACpE,MAAMc,SAASd,UAAUa,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOY,mBAAmB,GAC1C;EAGJ3C,4BAA4BgB,QAAQ,KAAKmB,2BAA2BJ,OAAOY,mBAAmB,CAAA;CAClG;CAEA,MAAMlB,aAAaT,QAAaC,WAAsC;EAClE,MAAMc,SAASd,UAAUa,QAAQzB,kBAAAA;EACjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOa,iBAAiB,GACxC;EAGJ,MAAMP,aAAa3C,wBAAwB;GACvCmD,cAAcvD,KAAKwD,KAAK3C,WAAW,cAAA;GACnC4C,SAAShB,OAAOiB;EACpB,CAAA;EAEAhC,OAAOuB,IAAI,SAASF,UAAAA;CACxB;CAEA,MAAMV,mBAAmBX,QAAaC,WAAsC;EAExE,MAAMoB,aAAa5C,8BAA8B,EAAEwD,iBAAiB,IAAItC,uBADhDM,UAAUa,QAA2BpB,WACkCuC,CAAAA,EAAiB,CAAA;EAOhHjC,OAAOuB,IAAI,4BAA4BF,UAAAA;CAC3C;CAEA,MAAMX,mBAAmBV,QAAaC,WAAsC;EACxE,MAAMc,SAASd,UAAUa,QAAQzB,kBAAAA;EACjC,MAAM6C,aAAajC,UAAUa,QAAQlB,qBAAqBuC,UAAU;EAEpE,MAAMC,mBAAmBnC,UAAUa,QAAQtB,qBAAqB6C,QAAQ;EACxE,MAAMC,iBAAiBrC,UAAUa,QAAQ1B,2BAA2BmD,cAAc;EAClF,MAAMC,sBAAsBvC,UAAUa,QAAQrB,qBAAqBgD,aAAa;EAKhF,MAAMpB,aAAa9C,8BAA8B;GAC7C6D;GACAM,4BAN+BzC,UAAUa,QAAQtB,qBAAqBmD,kBAMtED;GACAE,oBAAAA,IAL2B/C,2BAA2BqC,UAKtDU;GACAJ;GACAF;GACApB,SAAS;IACL2B,iBAAiB9B,OAAO8B;IACxBC,gBAAgB/B,OAAO+B;IACvBC,eAAehC,OAAOgC;GAC1B;EACJ,CAAA;EAEA/C,OAAOuB,IAAIF,UAAAA;CACf;CAIQF,2BACJ6B,OACc;EACd,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;EAGZ,OAAOA,SAAS,CAAC;CACrB;CAEQhC,UAAagC,OAAoB;EACrC,OAAO,OAAOA,UAAU,aAAaA,UAAU;CACnD;AACJ"}
+{"version":3,"file":"middleware.mjs","names":["path","createAuthorizationMiddleware","createLoggerMiddleware","createRealmResolverMiddleware","createSwaggerMiddleware","registerAssetsMiddleware","registerBasicMiddleware","registerCorsMiddleware","registerErrorMiddleware","registerPrometheusMiddleware","registerRateLimitMiddleware","registerUIHttpClientMiddleware","HTTPInjectionKey","DIST_PATH","AuthenticationInjectionKey","ConfigInjectionKey","LoggerInjectionKey","IdentityInjectionKey","OAuth2InjectionToken","RealmEntity","RealmRepositoryAdapter","DatabaseInjectionKey","PermissionDatabaseProvider","HTTPMiddlewareModule","mountBefore","router","container","mountPrometheus","mountLogger","mountCors","mountAssets","mountUIHttpClient","mountBasic","mountRateLimit","mountSwagger","mountAuthorization","mountRealmResolver","mountAfter","logger","resolve","config","isEnabled","middlewareCors","options","transformBoolToEmptyObject","middleware","env","use","has","UIHttpClient","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","documentPath","join","baseURL","publicUrl","realmRepository","dataSource","DataSource","identityResolver","Resolver","sessionManager","SessionManager","oauth2TokenVerifier","TokenVerifier","identityPermissionProvider","PermissionProvider","permissionProvider","clientAuthBasic","robotAuthBasic","userAuthBasic","input"],"sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport path from 'node:path';\nimport type { IContainer } from 'eldin';\nimport type { Repository } from 'typeorm';\nimport type { Realm } from '@authup/core-kit';\nimport {\n    createAuthorizationMiddleware,\n    createLoggerMiddleware,\n    createRealmResolverMiddleware,\n    createSwaggerMiddleware,\n    registerAssetsMiddleware,\n    registerBasicMiddleware,\n    registerCorsMiddleware,\n    registerErrorMiddleware,\n    registerPrometheusMiddleware,\n    registerRateLimitMiddleware,\n    registerUIHttpClientMiddleware,\n} from '../../../../adapters/http/index.ts';\nimport { HTTPInjectionKey } from '../constants.ts';\nimport { DIST_PATH } from '../../../../path.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { ConfigInjectionKey } from '../../config/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { RealmEntity } from '../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../../database/repositories/index.ts';\nimport {\n    DatabaseInjectionKey,\n    PermissionDatabaseProvider,\n} from '../../database/index.ts';\n\nexport class HTTPMiddlewareModule {\n    async mountBefore(router: App, container: IContainer): Promise<void> {\n        // @routup/prometheus must be installed before any other plugin or\n        // route so that its onion middleware can observe the full request\n        // lifecycle (the v3 README is explicit on this).\n        await this.mountPrometheus(router, container);\n        await this.mountLogger(router, container);\n        await this.mountCors(router, container);\n        await this.mountAssets(router);\n        await this.mountUIHttpClient(router, container);\n        await this.mountBasic(router);\n        await this.mountRateLimit(router, container);\n\n        await this.mountSwagger(router, container);\n        await this.mountAuthorization(router, container);\n        await this.mountRealmResolver(router, container);\n    }\n\n\n    async mountAfter(router: App, container: IContainer): Promise<void> {\n        registerErrorMiddleware(router, { logger: container.resolve(LoggerInjectionKey) });\n    }\n\n    // ----------------------------------------------------\n    async mountCors(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareCors)) {\n            return;\n        }\n\n        const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};\n\n        registerCorsMiddleware(router, options);\n    }\n\n    async mountLogger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const middleware = createLoggerMiddleware({\n            env: config.env,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        router.use(middleware);\n    }\n\n    async mountAssets(router: App): Promise<void> {\n        await registerAssetsMiddleware(router);\n    }\n\n    async mountUIHttpClient(router: App, container: IContainer): Promise<void> {\n        if (!container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        registerUIHttpClientMiddleware(router, () => container.resolve(HTTPInjectionKey.UIHttpClient));\n    }\n\n    async mountBasic(router: App): Promise<void> {\n        registerBasicMiddleware(router);\n    }\n\n    async mountPrometheus(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewarePrometheus)) {\n            return;\n        }\n\n        registerPrometheusMiddleware(router, this.transformBoolToEmptyObject(config.middlewarePrometheus));\n    }\n\n    async mountRateLimit(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareRateLimit)) {\n            return;\n        }\n\n        registerRateLimitMiddleware(router, this.transformBoolToEmptyObject(config.middlewareRateLimit));\n    }\n\n    async mountSwagger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        if (!this.isEnabled(config.middlewareSwagger)) {\n            return;\n        }\n\n        const middleware = createSwaggerMiddleware({\n            documentPath: path.join(DIST_PATH, 'swagger.json'),\n            baseURL: config.publicUrl,\n        });\n\n        router.use('/docs', middleware);\n    }\n\n    async mountRealmResolver(router: App, container: IContainer): Promise<void> {\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const middleware = createRealmResolverMiddleware({ realmRepository: new RealmRepositoryAdapter(realmRepository) });\n\n        // Mounted at /realms/:realmId/:nested so the middleware only fires on\n        // nested-resource URLs (e.g. /realms/master/users/...). Bare\n        // /realms/:id routes belong to RealmController (CRUD, openid-config,\n        // jwks) and would otherwise 404 on PUT upserts where the realm\n        // doesn't exist yet.\n        router.use('/realms/:realmId/:nested', middleware);\n    }\n\n    async mountAuthorization(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n        const oauth2TokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n        const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n        const middleware = createAuthorizationMiddleware({\n            identityResolver,\n            identityPermissionProvider,\n            permissionProvider,\n            oauth2TokenVerifier,\n            sessionManager,\n            options: {\n                clientAuthBasic: config.clientAuthBasic,\n                robotAuthBasic: config.robotAuthBasic,\n                userAuthBasic: config.userAuthBasic,\n            },\n        });\n\n        router.use(middleware);\n    }\n\n    // ----------------------------------------------------\n\n    private transformBoolToEmptyObject<T extends Record<string, any>>(\n        input?: T | boolean,\n    ) : T | undefined {\n        if (typeof input === 'boolean') {\n            return {} as T;\n        }\n\n        return input || {} as T;\n    }\n\n    private isEnabled<T>(input: T | boolean) {\n        return typeof input !== 'boolean' || input === true;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAauB,uBAAb,MAAaA;CACT,MAAMC,YAAYC,QAAaC,WAAsC;EAIjE,MAAM,KAAKC,gBAAgBF,QAAQC,SAAAA;EACnC,MAAM,KAAKE,YAAYH,QAAQC,SAAAA;EAC/B,MAAM,KAAKG,UAAUJ,QAAQC,SAAAA;EAC7B,MAAM,KAAKI,YAAYL,MAAAA;EACvB,MAAM,KAAKM,kBAAkBN,QAAQC,SAAAA;EACrC,MAAM,KAAKM,WAAWP,MAAAA;EACtB,MAAM,KAAKQ,eAAeR,QAAQC,SAAAA;EAElC,MAAM,KAAKQ,aAAaT,QAAQC,SAAAA;EAChC,MAAM,KAAKS,mBAAmBV,QAAQC,SAAAA;EACtC,MAAM,KAAKU,mBAAmBX,QAAQC,SAAAA;CAC1C;CAGA,MAAMW,WAAWZ,QAAaC,WAAsC;EAChElB,wBAAwBiB,QAAQ,EAAEa,QAAQZ,UAAUa,QAAQvB,kBAAAA,EAAoB,CAAA;CACpF;CAGA,MAAMa,UAAUJ,QAAaC,WAAsC;EAC/D,MAAMc,SAASd,UAAUa,QAAQxB,kBAAAA;EAEjC,IAAI,CAAC,KAAK0B,UAAUD,OAAOE,cAAc,GACrC;EAKJnC,uBAAuBkB,QAFP,KAAKmB,2BAA2BJ,OAAOE,cAAc,KAAK,CAAC,CAE5CC;CACnC;CAEA,MAAMf,YAAYH,QAAaC,WAAsC;EAEjE,MAAMmB,aAAa3C,uBAAuB;GACtC4C,KAFWpB,UAAUa,QAAQxB,kBAExByB,CAAAA,CAAOM;GACZR,QAAQZ,UAAUa,QAAQvB,kBAAAA;EAC9B,CAAA;EAEAS,OAAOsB,IAAIF,UAAAA;CACf;CAEA,MAAMf,YAAYL,QAA4B;EAC1C,MAAMpB,yBAAyBoB,MAAAA;CACnC;CAEA,MAAMM,kBAAkBN,QAAaC,WAAsC;EACvE,IAAI,CAACA,UAAUsB,IAAIpC,iBAAiBqC,YAAY,GAC5C;EAGJtC,+BAA+Bc,cAAcC,UAAUa,QAAQ3B,iBAAiBqC,YAAY,CAAA;CAChG;CAEA,MAAMjB,WAAWP,QAA4B;EACzCnB,wBAAwBmB,MAAAA;CAC5B;CAEA,MAAME,gBAAgBF,QAAaC,WAAsC;EACrE,MAAMc,SAASd,UAAUa,QAAQxB,kBAAAA;EAEjC,IAAI,CAAC,KAAK0B,UAAUD,OAAOU,oBAAoB,GAC3C;EAGJzC,6BAA6BgB,QAAQ,KAAKmB,2BAA2BJ,OAAOU,oBAAoB,CAAA;CACpG;CAEA,MAAMjB,eAAeR,QAAaC,WAAsC;EACpE,MAAMc,SAASd,UAAUa,QAAQxB,kBAAAA;EAEjC,IAAI,CAAC,KAAK0B,UAAUD,OAAOW,mBAAmB,GAC1C;EAGJzC,4BAA4Be,QAAQ,KAAKmB,2BAA2BJ,OAAOW,mBAAmB,CAAA;CAClG;CAEA,MAAMjB,aAAaT,QAAaC,WAAsC;EAClE,MAAMc,SAASd,UAAUa,QAAQxB,kBAAAA;EACjC,IAAI,CAAC,KAAK0B,UAAUD,OAAOY,iBAAiB,GACxC;EAGJ,MAAMP,aAAazC,wBAAwB;GACvCiD,cAAcrD,KAAKsD,KAAKzC,WAAW,cAAA;GACnC0C,SAASf,OAAOgB;EACpB,CAAA;EAEA/B,OAAOsB,IAAI,SAASF,UAAAA;CACxB;CAEA,MAAMT,mBAAmBX,QAAaC,WAAsC;EAExE,MAAMmB,aAAa1C,8BAA8B,EAAEsD,iBAAiB,IAAIrC,uBADhDM,UAAUa,QAA2BpB,WACkCsC,CAAAA,EAAiB,CAAA;EAOhHhC,OAAOsB,IAAI,4BAA4BF,UAAAA;CAC3C;CAEA,MAAMV,mBAAmBV,QAAaC,WAAsC;EACxE,MAAMc,SAASd,UAAUa,QAAQxB,kBAAAA;EACjC,MAAM2C,aAAahC,UAAUa,QAAQlB,qBAAqBsC,UAAU;EAEpE,MAAMC,mBAAmBlC,UAAUa,QAAQtB,qBAAqB4C,QAAQ;EACxE,MAAMC,iBAAiBpC,UAAUa,QAAQzB,2BAA2BiD,cAAc;EAClF,MAAMC,sBAAsBtC,UAAUa,QAAQrB,qBAAqB+C,aAAa;EAKhF,MAAMpB,aAAa5C,8BAA8B;GAC7C2D;GACAM,4BAN+BxC,UAAUa,QAAQtB,qBAAqBkD,kBAMtED;GACAE,oBAAAA,IAL2B9C,2BAA2BoC,UAKtDU;GACAJ;GACAF;GACAnB,SAAS;IACL0B,iBAAiB7B,OAAO6B;IACxBC,gBAAgB9B,OAAO8B;IACvBC,eAAe/B,OAAO+B;GAC1B;EACJ,CAAA;EAEA9C,OAAOsB,IAAIF,UAAAA;CACf;CAIQD,2BACJ4B,OACc;EACd,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;EAGZ,OAAOA,SAAS,CAAC;CACrB;CAEQ/B,UAAa+B,OAAoB;EACrC,OAAO,OAAOA,UAAU,aAAaA,UAAU;CACnD;AACJ"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-core",
     "type": "module",
-    "version": "1.0.0-beta.47",
+    "version": "1.0.0-beta.48",
     "description": "This is a standalone application.",
     "license": "AGPL-3.0-only",
     "main": "dist/index.mjs",
@@ -67,14 +67,14 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.47",
-        "@authup/core-http-kit": "^1.0.0-beta.47",
-        "@authup/core-kit": "^1.0.0-beta.47",
-        "@authup/errors": "^1.0.0-beta.47",
-        "@authup/i18n": "^1.0.0-beta.47",
-        "@authup/kit": "^1.0.0-beta.47",
-        "@authup/server-kit": "^1.0.0-beta.47",
-        "@authup/specs": "^1.0.0-beta.47",
+        "@authup/access": "^1.0.0-beta.48",
+        "@authup/core-http-kit": "^1.0.0-beta.48",
+        "@authup/core-kit": "^1.0.0-beta.48",
+        "@authup/errors": "^1.0.0-beta.48",
+        "@authup/i18n": "^1.0.0-beta.48",
+        "@authup/kit": "^1.0.0-beta.48",
+        "@authup/server-kit": "^1.0.0-beta.48",
+        "@authup/specs": "^1.0.0-beta.48",
         "@ebec/http": "^4.1.0",
         "@hapic/oauth2": "^3.2.0",
         "@routup/assets": "^5.0.0",
@@ -114,10 +114,10 @@
         "zod": "^4.4.3"
     },
     "devDependencies": {
-        "@authup/client-web-kit": "^1.0.0-beta.47",
-        "@authup/client-web-kit-theme": "^1.0.0-beta.47",
-        "@authup/client-web-theme": "^1.0.0-beta.47",
-        "@authup/server-test-kit": "^1.0.0-beta.47",
+        "@authup/client-web-kit": "^1.0.0-beta.48",
+        "@authup/client-web-kit-theme": "^1.0.0-beta.48",
+        "@authup/client-web-theme": "^1.0.0-beta.48",
+        "@authup/server-test-kit": "^1.0.0-beta.48",
         "@faker-js/faker": "^10.4.0",
         "@fontsource/asap": "^5.2.9",
         "@fontsource/nunito": "^5.2.7",