@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/app/modules/config/normalize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.mjs","names":["read","path","process","EnvironmentName","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 3_600,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n}\n"],"mappings":";;;;;;;;;;;AAgBA,eAAsBO,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCT,KAAKU,KAAKT,QAAQU,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOlB,KAAK,YAAYG,gBAAgBgB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQf,gBAAgBsB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,OAAO;EACHR;EACAS,UAAUzB,QAAQU,IAAG;EACrBF;EAEAkB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENjB;EACAC;EACAC;EAEAgB,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EAEzBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/C;EAIHW;CACJ;AACJ"}

package/dist/app/modules/config/origins.d.ts

@@ -0,0 +1,25 @@
+import type { Config } from './types.ts';
+/**
+ * Expand a configured trusted-origin value to its canonical origin(s).
+ *
+ * A value with an explicit scheme contributes exactly that origin —
+ * the way to restrict a host to https only. A bare host[:port]
+ * (e.g. `hub.local`) contributes both the http and https origin.
+ *
+ * Only http(s) is accepted: other schemes either have no usable web
+ * origin (`new URL('myapp://x').origin` is the literal string "null")
+ * or are meaningless as a redirect target for the web client — letting
+ * them through would put garbage into a security-sensitive allowlist.
+ *
+ * Throws on values that don't parse as a URL/host or use another scheme.
+ */
+export declare function expandToOrigins(value: string): string[];
+/**
+ * Derive the set of trusted application origins (scheme://host[:port]).
+ *
+ * publicUrl may carry a path, so its origin is extracted; trustedOrigins
+ * entries are canonical origins — normalizeConfig owns that invariant
+ * (expansion + dedupe via expandToOrigins) — and are merged verbatim.
+ */
+export declare function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[];
+//# sourceMappingURL=origins.d.ts.map

package/dist/app/modules/config/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAcvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}

package/dist/app/modules/config/origins.mjs

@@ -0,0 +1,44 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { URL } from "node:url";
+//#region src/app/modules/config/origins.ts
+const SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\/\//i;
+const ALLOWED_PROTOCOLS = ["http:", "https:"];
+/**
+* Expand a configured trusted-origin value to its canonical origin(s).
+*
+* A value with an explicit scheme contributes exactly that origin —
+* the way to restrict a host to https only. A bare host[:port]
+* (e.g. `hub.local`) contributes both the http and https origin.
+*
+* Only http(s) is accepted: other schemes either have no usable web
+* origin (`new URL('myapp://x').origin` is the literal string "null")
+* or are meaningless as a redirect target for the web client — letting
+* them through would put garbage into a security-sensitive allowlist.
+*
+* Throws on values that don't parse as a URL/host or use another scheme.
+*/ function expandToOrigins(value) {
+	if (SCHEME_REGEX.test(value)) {
+		const url = new URL(value);
+		if (!ALLOWED_PROTOCOLS.includes(url.protocol)) throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);
+		return [url.origin];
+	}
+	return [new URL(`http://${value}`).origin, new URL(`https://${value}`).origin];
+}
+/**
+* Derive the set of trusted application origins (scheme://host[:port]).
+*
+* publicUrl may carry a path, so its origin is extracted; trustedOrigins
+* entries are canonical origins — normalizeConfig owns that invariant
+* (expansion + dedupe via expandToOrigins) — and are merged verbatim.
+*/ function getAppOrigins(config) {
+	const origins = /* @__PURE__ */ new Set();
+	origins.add(new URL(config.publicUrl).origin);
+	for (const origin of config.trustedOrigins ?? []) origins.add(origin);
+	return Array.from(origins);
+}
+//#endregion
+export { expandToOrigins, getAppOrigins };
+
+//# sourceMappingURL=origins.mjs.map

package/dist/app/modules/config/origins.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.mjs","names":["URL","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","test","url","includes","protocol","Error","origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/**\n * Expand a configured trusted-origin value to its canonical origin(s).\n *\n * A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n *\n * Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n *\n * Throws on values that don't parse as a URL/host or use another scheme.\n */\nexport function expandToOrigins(value: string): string[] {\n    if (SCHEME_REGEX.test(value)) {\n        const url = new URL(value);\n        if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n            throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n        }\n\n        return [url.origin];\n    }\n\n    return [\n        new URL(`http://${value}`).origin,\n        new URL(`https://${value}`).origin,\n    ];\n}\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[] {\n    const origins = new Set<string>();\n    origins.add(new URL(config.publicUrl).origin);\n\n    for (const origin of config.trustedOrigins ?? []) {\n        origins.add(origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;AAUA,MAAMC,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAA;;;;;;;;;;;;;;GAgBpC,SAAgBC,gBAAgBC,OAAa;CACzC,IAAIH,aAAaI,KAAKD,KAAAA,GAAQ;EAC1B,MAAME,MAAM,IAAIN,IAAII,KAAAA;EACpB,IAAI,CAACF,kBAAkBK,SAASD,IAAIE,QAAQ,GACxC,MAAM,IAAIC,MAAM,8DAA8DH,IAAIE,UAAU;EAGhG,OAAO,CAACF,IAAII,MAAAA;CAChB;CAEA,OAAO,CACH,IAAIV,IAAI,UAAUI,OAAO,CAAA,CAAEM,QAC3B,IAAIV,IAAI,WAAWI,OAAO,CAAA,CAAEM,MAAAA;AAEpC;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIf,IAAIY,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}

package/dist/app/modules/config/parse.d.ts

@@ -0,0 +1,3 @@
+import type { ConfigInput } from './types.ts';
+export declare function parseConfig(input?: unknown): Promise<ConfigInput>;
+//# sourceMappingURL=parse.d.ts.map

package/dist/app/modules/config/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/parse.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,wBAAsB,WAAW,CAAC,KAAK,GAAE,OAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ3E"}

package/dist/app/modules/config/parse.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConfigValidator } from "./validator.mjs";
+import { isObject } from "@authup/kit";
+//#region src/app/modules/config/parse.ts
+async function parseConfig(input = {}) {
+	if (!isObject(input)) throw new Error("The configuration input must be an object.");
+	return new ConfigValidator().run(input);
+}
+//#endregion
+export { parseConfig };
+
+//# sourceMappingURL=parse.mjs.map

package/dist/app/modules/config/parse.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.mjs","names":["isObject","ConfigValidator","parseConfig","input","Error","validator","run"],"sources":["../../../../src/app/modules/config/parse.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { ConfigInput } from './types.ts';\nimport { ConfigValidator } from './validator.ts';\n\nexport async function parseConfig(input: unknown = {}): Promise<ConfigInput> {\n    if (!isObject(input)) {\n        throw new Error('The configuration input must be an object.');\n    }\n\n    const validator = new ConfigValidator();\n\n    return validator.run(input);\n}\n"],"mappings":";;;;;;AAWA,eAAsBE,YAAYC,QAAiB,CAAC,GAAC;CACjD,IAAI,CAACH,SAASG,KAAAA,GACV,MAAM,IAAIC,MAAM,4CAAA;CAKpB,OAAOC,IAFeJ,gBAEfI,CAAAA,CAAUC,IAAIH,KAAAA;AACzB"}

package/dist/app/modules/config/read/env.d.ts

@@ -0,0 +1,3 @@
+import type { ConfigInput } from '../types.ts';
+export declare function readConfigRawFromEnv(): ConfigInput;
+//# sourceMappingURL=env.d.ts.map

package/dist/app/modules/config/read/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,wBAAgB,oBAAoB,IAAK,WAAW,CAoKnD"}

package/dist/app/modules/config/read/env.mjs

@@ -0,0 +1,70 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConfigEnvironmentVariableName } from "../constants.mjs";
+import { oneOf, read, readArray, readBool, readInt } from "envix";
+import { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from "typeorm-extension";
+//#region src/app/modules/config/read/env.ts
+function readConfigRawFromEnv() {
+	const options = {};
+	const env = read(ConfigEnvironmentVariableName.NODE_ENV);
+	if (env) options.env = env;
+	const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);
+	if (writableDirectoryPath) options.writableDirectoryPath = writableDirectoryPath;
+	if (hasEnvDataSourceOptions()) options.db = readDataSourceOptionsFromEnv();
+	const redis = oneOf([readBool(ConfigEnvironmentVariableName.REDIS), read(ConfigEnvironmentVariableName.REDIS)]);
+	if (typeof redis !== "undefined") options.redis = redis;
+	const smtp = oneOf([readBool(ConfigEnvironmentVariableName.SMTP), read(ConfigEnvironmentVariableName.SMTP)]);
+	if (typeof smtp !== "undefined") options.smtp = smtp;
+	const host = read(ConfigEnvironmentVariableName.HOST);
+	if (host) options.host = host;
+	const port = readInt(ConfigEnvironmentVariableName.PORT);
+	if (typeof port !== "undefined") options.port = port;
+	const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);
+	if (publicURL) options.publicUrl = publicURL;
+	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
+	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
+	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);
+	if (typeof tokenAccessMaxAge !== "undefined") options.tokenAccessMaxAge = tokenAccessMaxAge;
+	const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);
+	if (typeof tokenRefreshMaxAge !== "undefined") options.tokenRefreshMaxAge = tokenRefreshMaxAge;
+	const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);
+	if (typeof registrationEnabled !== "undefined") options.registrationEnabled = registrationEnabled;
+	const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);
+	if (typeof emailVerificationEnabled !== "undefined") options.emailVerificationEnabled = emailVerificationEnabled;
+	const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);
+	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
+	const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);
+	if (typeof clientBasicAuth !== "undefined") options.clientAuthBasic = clientBasicAuth;
+	const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);
+	if (typeof clientSystemEnabled !== "undefined") options.clientSystemEnabled = clientSystemEnabled;
+	const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);
+	if (clientAdminSecret) options.clientSystemSecret = clientAdminSecret;
+	const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);
+	if (typeof clientAdminSecretReset !== "undefined") options.clientSystemSecretReset = clientAdminSecretReset;
+	const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);
+	if (typeof userBasicAuth !== "undefined") options.userAuthBasic = userBasicAuth;
+	const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);
+	if (typeof userAdminEnabled !== "undefined") options.userAdminEnabled = userAdminEnabled;
+	const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);
+	if (userAdminPassword) options.userAdminPassword = userAdminPassword;
+	const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);
+	if (typeof userAdminPasswordReset !== "undefined") options.userAdminPasswordReset = userAdminPasswordReset;
+	const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);
+	if (typeof robotBasicAuth !== "undefined") options.robotAuthBasic = robotBasicAuth;
+	const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);
+	if (typeof robotAdminEnabled !== "undefined") options.robotAdminEnabled = robotAdminEnabled;
+	const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);
+	if (robotAdminSecret) options.robotAdminSecret = robotAdminSecret;
+	const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);
+	if (typeof robotAdminSecretReset !== "undefined") options.robotAdminSecretReset = robotAdminSecretReset;
+	const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);
+	if (permissions && permissions.length > 0) options.permissions = permissions;
+	const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);
+	if (typeof permissionsDefaultPolicyAssignment !== "undefined") options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;
+	return options;
+}
+//#endregion
+export { readConfigRawFromEnv };
+
+//# sourceMappingURL=env.mjs.map

package/dist/app/modules/config/read/env.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","trustedOrigins","TRUSTED_ORIGINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf, \n    read, \n    readArray, \n    readBool, \n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYtB,KAAKM,8BAA8BiB,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,iBAAiBxB,UAAUK,8BAA8BoB,eAAe;CAC9E,IAAID,kBAAkBA,eAAeE,SAAS,GAC1CnB,QAAQiB,iBAAiBA;CAG7B,MAAMG,oBAAoBzB,QAAQG,8BAA8BuB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BpB,QAAQoB,oBAAoBA;CAGhC,MAAME,qBAAqB3B,QAAQG,8BAA8ByB,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BtB,QAAQsB,qBAAqBA;CAGjC,MAAME,sBAAsB9B,SAASI,8BAA8B2B,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BxB,QAAQwB,sBAAsBA;CAGlC,MAAME,2BAA2BhC,SAASI,8BAA8B6B,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC1B,QAAQ0B,2BAA2BA;CAGvC,MAAME,0BAA0BlC,SAASI,8BAA8B+B,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAKtC,MAAME,kBAAkBpC,SAASI,8BAA8BiC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9B,QAAQgC,kBAAkBF;CAG9B,MAAMG,sBAAsBvC,SAASI,8BAA8BoC,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjC,QAAQiC,sBAAsBA;CAGlC,MAAME,oBAAoB3C,KAAKM,8BAA8BsC,oBAAoB;CACjF,IAAID,mBACAnC,QAAQqC,qBAAqBF;CAGjC,MAAMG,yBAAyB5C,SAASI,8BAA8ByC,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtC,QAAQwC,0BAA0BF;CAKtC,MAAMG,gBAAgB/C,SAASI,8BAA8B4C,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzC,QAAQ2C,gBAAgBF;CAG5B,MAAMG,mBAAmBlD,SAASI,8BAA8B+C,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5C,QAAQ4C,mBAAmBA;CAG/B,MAAME,oBAAoBtD,KAAKM,8BAA8BiD,mBAAmB;CAChF,IAAID,mBACA9C,QAAQ8C,oBAAoBA;CAGhC,MAAME,yBAAyBtD,SAASI,8BAA8BmD,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChD,QAAQgD,yBAAyBA;CAKrC,MAAME,iBAAiBxD,SAASI,8BAA8BqD,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BlD,QAAQoD,iBAAiBF;CAG7B,MAAMG,oBAAoB3D,SAASI,8BAA8BwD,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BrD,QAAQqD,oBAAoBA;CAGhC,MAAME,mBAAmB/D,KAAKM,8BAA8B0D,kBAAkB;CAC9E,IAAID,kBACAvD,QAAQuD,mBAAmBA;CAG/B,MAAME,wBAAwB/D,SAASI,8BAA8B4D,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjCzD,QAAQyD,wBAAwBA;CAKpC,MAAME,cAAclE,UAAUK,8BAA8B8D,WAAW;CACvE,IAAID,eAAeA,YAAYxC,SAAS,GACpCnB,QAAQ2D,cAAcA;CAG1B,MAAME,qCAAqCnE,SAASI,8BAA8BgE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C7D,QAAQ6D,qCAAqCA;CAGjD,OAAO7D;AACX"}

package/dist/app/modules/config/read/fs.d.ts

@@ -0,0 +1,3 @@
+import type { ConfigReadFsOptions } from './types.ts';
+export declare function readConfigRawFromFS(options?: ConfigReadFsOptions): Promise<Partial<import("../types.ts").Config>>;
+//# sourceMappingURL=fs.d.ts.map

package/dist/app/modules/config/read/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/fs.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,kDA0C1E"}

package/dist/app/modules/config/read/fs.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Container } from "confinity";
+//#region src/app/modules/config/read/fs.ts
+async function readConfigRawFromFS(options = {}) {
+	const container = new Container({
+		prefix: "authup",
+		cwd: options.cwd
+	});
+	if (options.file) await container.loadFile(options.file);
+	else await container.load();
+	const raw = container.get("server.core") || {};
+	const db = container.get([
+		"db",
+		"server.db",
+		"server.core.db"
+	]);
+	if (db) raw.db = db;
+	const redis = container.get([
+		"redis",
+		"server.redis",
+		"server.core.redis"
+	]);
+	if (redis) raw.redis = redis;
+	const smtp = container.get([
+		"smtp",
+		"server.smtp",
+		"server.core.smtp"
+	]);
+	if (smtp) raw.smtp = smtp;
+	return raw;
+}
+//#endregion
+export { readConfigRawFromFS };
+
+//# sourceMappingURL=fs.mjs.map

package/dist/app/modules/config/read/fs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.mjs","names":["Container","readConfigRawFromFS","options","container","prefix","cwd","file","loadFile","load","raw","get","db","redis","smtp"],"sources":["../../../../../src/app/modules/config/read/fs.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Container } from 'confinity';\nimport type { ConfigInput } from '../types.ts';\nimport type { ConfigReadFsOptions } from './types.ts';\n\nexport async function readConfigRawFromFS(options: ConfigReadFsOptions = {}) {\n    const container = new Container({\n        prefix: 'authup',\n        cwd: options.cwd,\n    });\n\n    if (options.file) {\n        await container.loadFile(options.file);\n    } else {\n        await container.load();\n    }\n\n    const raw : ConfigInput = container.get('server.core') || {};\n\n    const db = container.get([\n        'db',\n        'server.db',\n        'server.core.db',\n    ]);\n    if (db) {\n        raw.db = db;\n    }\n\n    const redis = container.get([\n        'redis',\n        'server.redis',\n        'server.core.redis',\n    ]);\n    if (redis) {\n        raw.redis = redis;\n    }\n\n    const smtp = container.get([\n        'smtp',\n        'server.smtp',\n        'server.core.smtp',\n    ]);\n    if (smtp) {\n        raw.smtp = smtp;\n    }\n\n    return raw;\n}\n"],"mappings":";;;;;AAWA,eAAsBC,oBAAoBC,UAA+B,CAAC,GAAC;CACvE,MAAMC,YAAY,IAAIH,UAAU;EAC5BI,QAAQ;EACRC,KAAKH,QAAQG;CACjB,CAAA;CAEA,IAAIH,QAAQI,MACR,MAAMH,UAAUI,SAASL,QAAQI,IAAI;MAErC,MAAMH,UAAUK,KAAI;CAGxB,MAAMC,MAAoBN,UAAUO,IAAI,aAAA,KAAkB,CAAC;CAE3D,MAAMC,KAAKR,UAAUO,IAAI;EACrB;EACA;EACA;EACH;CACD,IAAIC,IACAF,IAAIE,KAAKA;CAGb,MAAMC,QAAQT,UAAUO,IAAI;EACxB;EACA;EACA;EACH;CACD,IAAIE,OACAH,IAAIG,QAAQA;CAGhB,MAAMC,OAAOV,UAAUO,IAAI;EACvB;EACA;EACA;EACH;CACD,IAAIG,MACAJ,IAAII,OAAOA;CAGf,OAAOJ;AACX"}

package/dist/app/modules/config/read/index.d.ts

@@ -0,0 +1,5 @@
+export * from './module.ts';
+export * from './env.ts';
+export * from './fs.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/config/read/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC"}

package/dist/app/modules/config/read/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { readConfigRawFromEnv } from "./env.mjs";
+import { readConfigRawFromFS } from "./fs.mjs";
+import { readConfigRaw } from "./module.mjs";
+export { readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/config/read/module.d.ts

@@ -0,0 +1,4 @@
+import type { ConfigInput } from '../types.ts';
+import type { ConfigRawReadOptions } from './types.ts';
+export declare function readConfigRaw(options?: ConfigRawReadOptions): Promise<ConfigInput>;
+//# sourceMappingURL=module.d.ts.map

package/dist/app/modules/config/read/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,WAAW,CAAC,CAmB7F"}

package/dist/app/modules/config/read/module.mjs

@@ -0,0 +1,24 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { readConfigRawFromEnv } from "./env.mjs";
+import { readConfigRawFromFS } from "./fs.mjs";
+import { merge } from "smob";
+//#region src/app/modules/config/read/module.ts
+async function readConfigRaw(options = {}) {
+	if (options.fs && options.env) {
+		const fs = await readConfigRawFromFS(boolableToObject(options.fs));
+		return merge(readConfigRawFromEnv(), fs);
+	}
+	if (options.fs) return readConfigRawFromFS(boolableToObject(options.fs));
+	if (options.env) return readConfigRawFromEnv();
+	return {};
+}
+function boolableToObject(input) {
+	if (typeof input === "boolean") return {};
+	return input;
+}
+//#endregion
+export { readConfigRaw };
+
+//# sourceMappingURL=module.mjs.map

package/dist/app/modules/config/read/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["merge","readConfigRawFromEnv","readConfigRawFromFS","readConfigRaw","options","fs","env","fsOptions","boolableToObject","input"],"sources":["../../../../../src/app/modules/config/read/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport { readConfigRawFromEnv } from './env.ts';\nimport { readConfigRawFromFS } from './fs.ts';\nimport type { ConfigRawReadOptions } from './types.ts';\n\nexport async function readConfigRaw(options: ConfigRawReadOptions = {}) : Promise<ConfigInput> {\n    if (options.fs && options.env) {\n        const fsOptions = boolableToObject(options.fs);\n        const fs = await readConfigRawFromFS(fsOptions);\n        const env = readConfigRawFromEnv();\n\n        return merge(env, fs);\n    }\n\n    if (options.fs) {\n        const fsOptions = boolableToObject(options.fs);\n        return readConfigRawFromFS(fsOptions);\n    }\n\n    if (options.env) {\n        return readConfigRawFromEnv();\n    }\n\n    return {};\n}\n\nfunction boolableToObject<T>(input: T | boolean) : T {\n    if (typeof input === 'boolean') {\n        return {} as T;\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;AAaA,eAAsBG,cAAcC,UAAgC,CAAC,GAAC;CAClE,IAAIA,QAAQC,MAAMD,QAAQE,KAAK;EAE3B,MAAMD,KAAK,MAAMH,oBADCM,iBAAiBJ,QAAQC,EACNE,CAAAA;EAGrC,OAAOP,MAFKC,qBAECK,GAAKD,EAAAA;CACtB;CAEA,IAAID,QAAQC,IAER,OAAOH,oBADWM,iBAAiBJ,QAAQC,EAChBE,CAAAA;CAG/B,IAAIH,QAAQE,KACR,OAAOL,qBAAAA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASO,iBAAoBC,OAAkB;CAC3C,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;CAGZ,OAAOA;AACX"}

package/dist/app/modules/config/read/types.d.ts

@@ -0,0 +1,9 @@
+export type ConfigReadFsOptions = {
+    cwd?: string;
+    file?: string | string[];
+};
+export type ConfigRawReadOptions = {
+    fs?: boolean | ConfigReadFsOptions;
+    env?: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/app/modules/config/read/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mBAAmB,GAAG;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,EAAE,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;IACnC,GAAG,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC"}

package/dist/app/modules/config/read/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/app/modules/config/types.d.ts

@@ -0,0 +1,212 @@
+import type { RedisClient, RedisClientOptions } from '@authup/server-kit';
+import type { ParseOptions as CookieOptions } from '@routup/basic/cookie';
+import type { Options as CorsOptions } from '@routup/cors';
+import type { OptionsInput as PrometheusOptions } from '@routup/prometheus';
+import type { ParseOptions as QueryOptions } from '@routup/basic/query';
+import type { OptionsInput as RateLimitOptions } from '@routup/rate-limit';
+import type { UIOptions as SwaggerUIOptions } from '@routup/swagger-ui';
+import type { Options as BodyOptions } from '@routup/basic/body';
+import type { DataSourceOptions } from 'typeorm';
+import type { SMTPOptions } from '../mail/adapter/smtp/types.ts';
+export type Config = {
+    /**
+     * Application environment (e.g., 'production').
+     * default: 'development'
+     */
+    env: string;
+    /**
+     * default: process.cwd()
+     */
+    rootPath: string;
+    /**
+     * Relative or absolute path.
+     * If the path is relative, the rootPath will be appended.
+     *
+     * default: writable
+     */
+    writableDirectoryPath: string;
+    /**
+     * default: true
+     */
+    logger: boolean;
+    /**
+     * default driver: better-sqlite3
+     */
+    db?: DataSourceOptions;
+    /**
+     * default: true
+     */
+    redis: string | boolean | RedisClient | RedisClientOptions;
+    /**
+     * default: false
+     */
+    smtp: string | boolean | SMTPOptions;
+    /**
+     * Application port number.
+     * default: 3001
+     */
+    port: number;
+    /**
+     * Application host.
+     * default: localhost
+     */
+    host: string;
+    /**
+     * API base URL.
+     * default: http://localhost:3001
+     */
+    publicUrl: string;
+    /**
+     * Trusted first-party app origins (besides publicUrl) — used as
+     * redirect targets for the per-realm public `web` client. Does NOT
+     * drive CORS (the API reflects any origin by default; an explicit
+     * CORS allowlist goes through middlewareCors), and does not affect
+     * UIs using their own registered OAuth2 client. Input entries may be
+     * full http(s) origins (scheme://host[:port]; other protocols are
+     * rejected) or bare hosts (host[:port]) — a bare host expands to
+     * both its http and https origin during normalization, so the
+     * normalized config always holds full origins (scheme://host[:port],
+     * no path); each is stored as `<origin>/**` in the web client's
+     * redirect_uri set.
+     *
+     * SECURITY: the `web` client is built_in (auto-consent + `global`
+     * scope), so any origin listed here can obtain a full-permission user
+     * token once a user logs in. Adding an origin grants it full login
+     * capability for every realm.
+     *
+     * default: []
+     */
+    trustedOrigins: string[];
+    /**
+     * use body middleware
+     *
+     * default: true
+     */
+    middlewareBody: boolean | BodyOptions;
+    /**
+     * use cors middleware
+     *
+     * default: true
+     */
+    middlewareCors: boolean | CorsOptions;
+    /**
+     * use cookie middleware
+     *
+     * default: true
+     */
+    middlewareCookie: boolean | CookieOptions;
+    /**
+     * Prometheus middleware (options)
+     */
+    middlewarePrometheus: boolean | PrometheusOptions;
+    /**
+     * Query middleware (options)
+     */
+    middlewareQuery: boolean | QueryOptions;
+    /**
+     * Rate limit middleware (options).
+     */
+    middlewareRateLimit: boolean | RateLimitOptions;
+    /**
+     * Swagger middleware (options)
+     *
+     * default: true
+     */
+    middlewareSwagger: boolean | SwaggerUIOptions;
+    /**
+     * Refresh token validity in seconds (default: 259,200s / 3 days).
+     * default: 259_200s (3days)
+     */
+    tokenRefreshMaxAge: number;
+    /**
+     * Access token validity in seconds (default: 3600s / 1 hour).
+     * default: 3_600s (1h)
+     */
+    tokenAccessMaxAge: number;
+    /**
+     * Enable user registration?
+     * default: false
+     */
+    registrationEnabled: boolean;
+    /**
+     * Require email verification for registration or login?
+     * default: false
+     */
+    emailVerificationEnabled: boolean;
+    /**
+     * Allow password reset via email?
+     * default: false
+     */
+    passwordRecoveryEnabled: boolean;
+    /**
+     * default: false
+     */
+    clientAuthBasic: boolean;
+    /**
+     * Enable a client account for the default realm.
+     * default: false
+     */
+    clientSystemEnabled: boolean;
+    /**
+     * The secret of the default client.
+     */
+    clientSystemSecret: string;
+    /**
+     * Reset client secret on application startup.
+     * default: undefined
+     */
+    clientSystemSecretReset: boolean;
+    /**
+     * default: false
+     */
+    userAuthBasic: boolean;
+    /**
+     * Enable default admin user.
+     * default: true
+     */
+    userAdminEnabled: boolean;
+    /**
+     * The password of the default admin user.
+     * default: 'start123'
+     */
+    userAdminPassword: string;
+    /**
+     * Reset admin password on application startup.
+     * default: undefined
+     */
+    userAdminPasswordReset: boolean;
+    /**
+     * default: false
+     */
+    robotAuthBasic: boolean;
+    /**
+     * Enable a global robot account.
+     * default: false
+     */
+    robotAdminEnabled: boolean;
+    /**
+     * The secret of the default admin user.
+     * default: (**generated**)
+     */
+    robotAdminSecret: string;
+    /**
+     * Reset the robot secret on application startup.
+     * default: false
+     */
+    robotAdminSecretReset: boolean;
+    /**
+     * default: []
+     */
+    permissions: string | string[];
+    /**
+     * Auto-assign system.default policy to new permissions without policies.
+     * Creates an entry in the permission-policy junction table.
+     * default: true
+     *
+     * @deprecated Will be removed in v2.0.0. External systems should assign policies explicitly.
+     */
+    permissionsDefaultPolicyAssignment: boolean;
+};
+export type ConfigInput = Partial<Config>;
+export type ConfigFactory = () => Promise<Config> | Config;
+//# sourceMappingURL=types.d.ts.map

package/dist/app/modules/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/app/modules/config/validator.d.ts

@@ -0,0 +1,6 @@
+import { Container } from 'validup';
+import type { Config } from './types.ts';
+export declare class ConfigValidator extends Container<Config> {
+    protected initialize(): void;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/app/modules/config/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAuFhC"}