@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/adapters/http/middleware/index.mjs

@@ -11,10 +11,10 @@ import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./built-in/asse
 import { registerBasicMiddleware } from "./built-in/basic.mjs";
 import { registerCorsMiddleware } from "./built-in/cors.mjs";
 import { registerErrorMiddleware } from "./built-in/error.mjs";
-import { createLoggerMiddleware } from "./built-in/logger.mjs";
+import { createLoggerMiddleware, redactSensitiveURLParams } from "./built-in/logger.mjs";
 import { registerPrometheusMiddleware } from "./built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./built-in/ui-http-client.mjs";
 import "./built-in/index.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };

package/dist/adapters/http/request/helpers/identity.d.ts

@@ -13,5 +13,4 @@ export declare class RequestIdentity {
 export declare function useRequestIdentity(event: IAppEvent): RequestIdentity | undefined;
 export declare function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity): void;
 export declare function useRequestIdentityOrFail(event: IAppEvent): RequestIdentity;
-export declare function isRequestIdentityMasterRealmMember(input: RequestIdentity): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/adapters/http/request/helpers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,2GAEP;IAED,IAAI,IAAI,gCAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,eAAe,GAAI,OAAO,CAEnF"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,2GAEP;IAED,IAAI,IAAI,gCAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}

package/dist/adapters/http/request/helpers/identity.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { IdentityType, REALM_MASTER_NAME } from "@authup/core-kit";
+import { IdentityType } from "@authup/core-kit";
 import { UnauthorizedError } from "@authup/errors";
 //#region src/adapters/http/request/helpers/identity.ts
 const sym = Symbol("RIdentity");
@@ -45,10 +45,7 @@ function useRequestIdentityOrFail(event) {
 	if (!identity) throw new UnauthorizedError();
 	return identity;
 }
-function isRequestIdentityMasterRealmMember(input) {
-	return input.realmName === REALM_MASTER_NAME;
-}
 //#endregion
-export { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail };
+export { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail };
 
 //# sourceMappingURL=identity.mjs.map

package/dist/adapters/http/request/helpers/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["IdentityType","REALM_MASTER_NAME","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","client_id","realmId","realm_id","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail","isRequestIdentityMasterRealmMember"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType, REALM_MASTER_NAME } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n    public readonly raw : Identity;\n\n    constructor(identity: Identity) {\n        this.raw = identity;\n    }\n\n    get clientId() {\n        const { raw } = this;\n        if (raw.type === IdentityType.CLIENT) {\n            return raw.data.id;\n        }\n\n        return raw.data.client_id || null;\n    }\n\n    get data() {\n        return this.raw.data;\n    }\n\n    get type() {\n        return this.raw.type;\n    }\n\n    get id() {\n        return this.raw.data.id;\n    }\n\n    get realmId() {\n        return this.raw.data.realm_id || this.raw.data.realm?.id;\n    }\n\n    get realmName() {\n        return this.raw.data.realm?.name;\n    }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity | undefined {\n    return event.store[sym] as RequestIdentity | undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity) : void {\n    let data : RequestIdentity;\n\n    if (input instanceof RequestIdentity) {\n        data = input;\n    } else {\n        data = new RequestIdentity(input);\n    }\n\n    event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n    const identity = useRequestIdentity(event);\n    if (!identity) {\n        throw new UnauthorizedError();\n    }\n\n    return identity;\n}\n\nexport function isRequestIdentityMasterRealmMember(input: RequestIdentity) : boolean {\n    return input.realmName === REALM_MASTER_NAME;\n}\n"],"mappings":";;;;;;AAYA,MAAMG,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAAST,aAAaU,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKE,aAAa;CACjC;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIE,UAAU;EACV,OAAO,KAAKR,IAAIK,KAAKI,YAAY,KAAKT,IAAIK,KAAKK,OAAOJ;CAC1D;CAEA,IAAIK,YAAY;EACZ,OAAO,KAAKX,IAAIK,KAAKK,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMlB;AACvB;AAEA,SAAgBmB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIZ;CAEJ,IAAIY,iBAAiBlB,iBACjBM,OAAOY;MAEPZ,OAAO,IAAIN,gBAAgBkB,KAAAA;CAG/BH,MAAMC,MAAMlB,OAAOQ;AACvB;AAEA,SAAgBa,yBAAyBJ,OAAgB;CACrD,MAAMb,WAAWY,mBAAmBC,KAAAA;CACpC,IAAI,CAACb,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX;AAEA,SAAgBkB,mCAAmCF,OAAsB;CACrE,OAAOA,MAAMN,cAAchB;AAC/B"}
+{"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","client_id","realmId","realm_id","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n    public readonly raw : Identity;\n\n    constructor(identity: Identity) {\n        this.raw = identity;\n    }\n\n    get clientId() {\n        const { raw } = this;\n        if (raw.type === IdentityType.CLIENT) {\n            return raw.data.id;\n        }\n\n        return raw.data.client_id || null;\n    }\n\n    get data() {\n        return this.raw.data;\n    }\n\n    get type() {\n        return this.raw.type;\n    }\n\n    get id() {\n        return this.raw.data.id;\n    }\n\n    get realmId() {\n        return this.raw.data.realm_id || this.raw.data.realm?.id;\n    }\n\n    get realmName() {\n        return this.raw.data.realm?.name;\n    }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity | undefined {\n    return event.store[sym] as RequestIdentity | undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity) : void {\n    let data : RequestIdentity;\n\n    if (input instanceof RequestIdentity) {\n        data = input;\n    } else {\n        data = new RequestIdentity(input);\n    }\n\n    event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n    const identity = useRequestIdentity(event);\n    if (!identity) {\n        throw new UnauthorizedError();\n    }\n\n    return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKE,aAAa;CACjC;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIE,UAAU;EACV,OAAO,KAAKR,IAAIK,KAAKI,YAAY,KAAKT,IAAIK,KAAKK,OAAOJ;CAC1D;CAEA,IAAIK,YAAY;EACZ,OAAO,KAAKX,IAAIK,KAAKK,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMlB;AACvB;AAEA,SAAgBmB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIZ;CAEJ,IAAIY,iBAAiBlB,iBACjBM,OAAOY;MAEPZ,OAAO,IAAIN,gBAAgBkB,KAAAA;CAG/BH,MAAMC,MAAMlB,OAAOQ;AACvB;AAEA,SAAgBa,yBAAyBJ,OAAgB;CACrD,MAAMb,WAAWY,mBAAmBC,KAAAA;CACpC,IAAI,CAACb,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}

package/dist/adapters/http/request/helpers/index.d.ts

@@ -7,5 +7,6 @@ export * from './param-id.ts';
 export * from './realm-id.ts';
 export * from './redirect.ts';
 export * from './scopes.ts';
+export * from './session-id.ts';
 export * from './token.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./identity.mjs";
+import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./identity.mjs";
 import { buildActorContext } from "./actor.mjs";
 import { getBodyRealmID } from "./body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./locale.mjs";
@@ -10,5 +10,6 @@ import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail,
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./session-id.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/helpers/session-id.d.ts

@@ -0,0 +1,9 @@
+import type { IAppEvent } from 'routup';
+/**
+ * The id of the session the current bearer token belongs to (stashed by the
+ * authorization middleware). Used by `/sessions` self-service (e.g. "revoke all
+ * my other sessions").
+ */
+export declare function useRequestSessionId(event: IAppEvent): string | undefined;
+export declare function setRequestSessionId(event: IAppEvent, id: string): void;
+//# sourceMappingURL=session-id.d.ts.map

package/dist/adapters/http/request/helpers/session-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/session-id.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEtE"}

package/dist/adapters/http/request/helpers/session-id.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/session-id.ts
+const sym = Symbol("RSessionId");
+/**
+* The id of the session the current bearer token belongs to (stashed by the
+* authorization middleware). Used by `/sessions` self-service (e.g. "revoke all
+* my other sessions").
+*/ function useRequestSessionId(event) {
+	return event.store[sym];
+}
+function setRequestSessionId(event, id) {
+	event.store[sym] = id;
+}
+//#endregion
+export { setRequestSessionId, useRequestSessionId };
+
+//# sourceMappingURL=session-id.mjs.map

package/dist/adapters/http/request/helpers/session-id.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id.mjs","names":["sym","Symbol","useRequestSessionId","event","store","setRequestSessionId","id"],"sources":["../../../../../src/adapters/http/request/helpers/session-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RSessionId');\n\n/**\n * The id of the session the current bearer token belongs to (stashed by the\n * authorization middleware). Used by `/sessions` self-service (e.g. \"revoke all\n * my other sessions\").\n */\nexport function useRequestSessionId(event: IAppEvent): string | undefined {\n    return event.store[sym] as string | undefined;\n}\n\nexport function setRequestSessionId(event: IAppEvent, id: string): void {\n    event.store[sym] = id;\n}\n"],"mappings":";;;;AASA,MAAMA,MAAMC,OAAO,YAAA;;;;;GAOnB,SAAgBC,oBAAoBC,OAAgB;CAChD,OAAOA,MAAMC,MAAMJ;AACvB;AAEA,SAAgBK,oBAAoBF,OAAkBG,IAAU;CAC5DH,MAAMC,MAAMJ,OAAOM;AACvB"}

package/dist/adapters/http/request/index.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RequestHandlerOperation } from "./constants.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./permission/helper.mjs";
-import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
+import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
 import { buildActorContext } from "./helpers/actor.mjs";
 import { getBodyRealmID } from "./helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./helpers/locale.mjs";
@@ -12,8 +12,9 @@ import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail,
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
 import "./helpers/index.mjs";
 import { RequestPermissionEvaluator } from "./permission/module.mjs";
 import "./permission/index.mjs";
-export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAMrE,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,2BAA2B;CAS3D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAMrE,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,2BAA2B;CAiB3D"}

package/dist/adapters/http/request/permission/module.mjs

@@ -27,9 +27,11 @@ var RequestPermissionEvaluator = class {
 		return this.evaluator.evaluateOneOf(this.extendContext(ctx));
 	}
 	extendContext(ctx) {
-		if (useRequestScopes(this.event).includes(ScopeName.GLOBAL)) {
-			ctx.input = ctx.input || new PolicyData();
-			ctx.input.set(BuiltInPolicyType.IDENTITY, useRequestIdentity(this.event));
+		const scopes = useRequestScopes(this.event);
+		const identity = useRequestIdentity(this.event);
+		if (scopes.includes(ScopeName.GLOBAL) && identity) {
+			ctx.data = ctx.data || new PolicyData();
+			ctx.data.set(BuiltInPolicyType.IDENTITY, identity);
 		}
 		return ctx;
 	}

package/dist/adapters/http/request/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","includes","GLOBAL","input","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        if (scopes.includes(ScopeName.GLOBAL)) {\n            ctx.input = ctx.input || new PolicyData();\n            ctx.input.set(BuiltInPolicyType.IDENTITY, useRequestIdentity(this.event));\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EAEtD,IADeL,iBAAiB,KAAKE,KACjCQ,CAAAA,CAAOC,SAASf,UAAUgB,MAAM,GAAG;GACnCP,IAAIQ,QAAQR,IAAIQ,SAAS,IAAIf,WAAAA;GAC7BO,IAAIQ,MAAMC,IAAIjB,kBAAkBkB,UAAUhB,mBAAmB,KAAKG,KAAK,CAAA;EAC3E;EAEA,OAAOG;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EACtD,MAAMK,SAASV,iBAAiB,KAAKE,KAAK;EAC1C,MAAMS,WAAWZ,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIQ,OAAOE,SAAShB,UAAUiB,MAAM,KAAKF,UAAU;GAC/CN,IAAIS,OAAOT,IAAIS,QAAQ,IAAIhB,WAAAA;GAC3BO,IAAIS,KAAKC,IAAIlB,kBAAkBmB,UAAUL,QAAAA;EAC7C;EAEA,OAAON;CACX;AACJ"}

package/dist/adapters/http/ui/index.d.ts

@@ -1,4 +1,5 @@
 export * from './base-path.ts';
+export * from './internal-http-client.ts';
 export * from './render.ts';
 export * from './serve.ts';
 export * from './types.ts';

package/dist/adapters/http/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/index.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { rebasePublicAssetURLs } from "./base-path.mjs";
+import { createInternalUIHttpClient, createPublicToInternalURLRewriter } from "./internal-http-client.mjs";
 import { renderUIPage } from "./render.mjs";
 import { serveWorkflowPage } from "./serve.mjs";
-export { rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };
+export { createInternalUIHttpClient, createPublicToInternalURLRewriter, rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };

package/dist/adapters/http/ui/internal-http-client.d.ts

@@ -0,0 +1,22 @@
+import type { IClient } from '@authup/core-http-kit';
+import type { InternalUIHttpClientContext } from './types.ts';
+/**
+ * Build a rewriter that maps URLs under the public base URL
+ * (scheme://host[/prefix]) onto the server's own listen address. URLs
+ * outside the public origin/prefix pass through untouched.
+ */
+export declare function createPublicToInternalURLRewriter(publicURL: string, internalURL: string): (url: string) => string;
+/**
+ * HTTP client for the SSR'd UI pages: the render's API calls target the
+ * server itself, so they are dispatched against its own listen address —
+ * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate
+ * would otherwise fail Node's fetch), no dependency on the public hostname
+ * resolving from inside the deployment.
+ *
+ * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the
+ * public URL because the rendered HTML derives user-facing URLs from it
+ * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and
+ * hydration does not patch attribute mismatches.
+ */
+export declare function createInternalUIHttpClient(ctx: InternalUIHttpClientContext): IClient;
+//# sourceMappingURL=internal-http-client.d.ts.map

package/dist/adapters/http/ui/internal-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-http-client.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GACnB,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAmC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAOrF"}

package/dist/adapters/http/ui/internal-http-client.mjs

@@ -0,0 +1,52 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Client } from "@authup/core-http-kit";
+import { FetchTransport, fetch } from "hapic";
+//#region src/adapters/http/ui/internal-http-client.ts
+/**
+* Build a rewriter that maps URLs under the public base URL
+* (scheme://host[/prefix]) onto the server's own listen address. URLs
+* outside the public origin/prefix pass through untouched.
+*/ function createPublicToInternalURLRewriter(publicURL, internalURL) {
+	const publicParsed = new URL(publicURL);
+	const internalParsed = new URL(internalURL);
+	if (internalParsed.hostname === "0.0.0.0" || internalParsed.hostname === "[::]") internalParsed.hostname = "127.0.0.1";
+	const basePath = publicParsed.pathname.replace(/\/+$/, "");
+	return (url) => {
+		let parsed;
+		try {
+			parsed = new URL(url);
+		} catch {
+			return url;
+		}
+		if (parsed.origin !== publicParsed.origin) return url;
+		let { pathname } = parsed;
+		if (basePath) if (pathname === basePath) pathname = "/";
+		else if (pathname.startsWith(`${basePath}/`)) pathname = pathname.substring(basePath.length);
+		else return url;
+		return new URL(pathname + parsed.search, internalParsed.origin).href;
+	};
+}
+/**
+* HTTP client for the SSR'd UI pages: the render's API calls target the
+* server itself, so they are dispatched against its own listen address —
+* no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate
+* would otherwise fail Node's fetch), no dependency on the public hostname
+* resolving from inside the deployment.
+*
+* The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the
+* public URL because the rendered HTML derives user-facing URLs from it
+* (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and
+* hydration does not patch attribute mismatches.
+*/ function createInternalUIHttpClient(ctx) {
+	const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);
+	return new Client({
+		baseURL: ctx.publicURL,
+		transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) })
+	});
+}
+//#endregion
+export { createInternalUIHttpClient, createPublicToInternalURLRewriter };
+
+//# sourceMappingURL=internal-http-client.mjs.map

package/dist/adapters/http/ui/internal-http-client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-http-client.mjs","names":["Client","FetchTransport","fetch","createPublicToInternalURLRewriter","publicURL","internalURL","publicParsed","URL","internalParsed","hostname","basePath","pathname","replace","url","parsed","origin","startsWith","substring","length","search","href","createInternalUIHttpClient","ctx","rewriteURL","baseURL","transport","input","init"],"sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { FetchTransport, fetch } from 'hapic';\nimport type { InternalUIHttpClientContext } from './types.ts';\n\n/**\n * Build a rewriter that maps URLs under the public base URL\n * (scheme://host[/prefix]) onto the server's own listen address. URLs\n * outside the public origin/prefix pass through untouched.\n */\nexport function createPublicToInternalURLRewriter(\n    publicURL: string,\n    internalURL: string,\n) : (url: string) => string {\n    const publicParsed = new URL(publicURL);\n    const internalParsed = new URL(internalURL);\n    // a wildcard listen address (0.0.0.0 / [::]) is not reliably dialable —\n    // loop back explicitly\n    if (internalParsed.hostname === '0.0.0.0' || internalParsed.hostname === '[::]') {\n        internalParsed.hostname = '127.0.0.1';\n    }\n    const basePath = publicParsed.pathname.replace(/\\/+$/, '');\n\n    return (url: string) => {\n        let parsed : URL;\n        try {\n            parsed = new URL(url);\n        } catch {\n            return url;\n        }\n\n        if (parsed.origin !== publicParsed.origin) {\n            return url;\n        }\n\n        let { pathname } = parsed;\n        if (basePath) {\n            if (pathname === basePath) {\n                pathname = '/';\n            } else if (pathname.startsWith(`${basePath}/`)) {\n                pathname = pathname.substring(basePath.length);\n            } else {\n                return url;\n            }\n        }\n\n        return new URL(pathname + parsed.search, internalParsed.origin).href;\n    };\n}\n\n/**\n * HTTP client for the SSR'd UI pages: the render's API calls target the\n * server itself, so they are dispatched against its own listen address —\n * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate\n * would otherwise fail Node's fetch), no dependency on the public hostname\n * resolving from inside the deployment.\n *\n * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the\n * public URL because the rendered HTML derives user-facing URLs from it\n * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and\n * hydration does not patch attribute mismatches.\n */\nexport function createInternalUIHttpClient(ctx: InternalUIHttpClientContext) : IClient {\n    const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);\n\n    return new Client({\n        baseURL: ctx.publicURL,\n        transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) }),\n    });\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBG,kCACZC,WACAC,aAAmB;CAEnB,MAAMC,eAAe,IAAIC,IAAIH,SAAAA;CAC7B,MAAMI,iBAAiB,IAAID,IAAIF,WAAAA;CAG/B,IAAIG,eAAeC,aAAa,aAAaD,eAAeC,aAAa,QACrED,eAAeC,WAAW;CAE9B,MAAMC,WAAWJ,aAAaK,SAASC,QAAQ,QAAQ,EAAA;CAEvD,QAAQC,QAAAA;EACJ,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIP,IAAIM,GAAAA;EACrB,QAAQ;GACJ,OAAOA;EACX;EAEA,IAAIC,OAAOC,WAAWT,aAAaS,QAC/B,OAAOF;EAGX,IAAI,EAAEF,aAAaG;EACnB,IAAIJ,UACA,IAAIC,aAAaD,UACbC,WAAW;OACR,IAAIA,SAASK,WAAW,GAAGN,SAAS,EAAE,GACzCC,WAAWA,SAASM,UAAUP,SAASQ,MAAM;OAE7C,OAAOL;EAIf,OAAO,IAAIN,IAAII,WAAWG,OAAOK,QAAQX,eAAeO,MAAM,CAAA,CAAEK;CACpE;AACJ;;;;;;;;;;;;GAcA,SAAgBC,2BAA2BC,KAAgC;CACvE,MAAMC,aAAapB,kCAAkCmB,IAAIlB,WAAWkB,IAAIjB,WAAW;CAEnF,OAAO,IAAIL,OAAO;EACdwB,SAASF,IAAIlB;EACbqB,WAAW,IAAIxB,eAAe,EAAEC,QAAQwB,OAAOC,SAASzB,MAAMqB,WAAWG,KAAAA,GAAQC,IAAAA,EAAM,CAAA;CAC3F,CAAA;AACJ"}

package/dist/adapters/http/ui/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE1F"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAqF1F"}

package/dist/adapters/http/ui/render.mjs

@@ -1,12 +1,12 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
+import { rebasePublicAssetURLs } from "./base-path.mjs";
 import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
+import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
 import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
 import "../middleware/index.mjs";
-import { rebasePublicAssetURLs } from "./base-path.mjs";
 import { getURLBasePath } from "@authup/kit";
 import path from "node:path";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
@@ -52,6 +52,9 @@ async function renderUIPage(event, ctx) {
 	body = body.replace(/<html\b[^>]*>/i, `<html ${htmlAttrs}>`);
 	body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));
 	event.response.headers.set("content-type", "text/html; charset=utf-8");
+	event.response.headers.set("content-security-policy", "frame-ancestors 'none'");
+	event.response.headers.set("x-frame-options", "DENY");
+	event.response.headers.set("referrer-policy", "no-referrer");
 	return body;
 }
 //#endregion

package/dist/adapters/http/ui/render.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","load","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { load } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await load(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAC3C,OAAOP;AACX"}
+{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","load","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { load } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await load(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}

package/dist/adapters/http/ui/types.d.ts

@@ -5,4 +5,16 @@ export type UIRenderContext = {
         data: Record<string, any>;
     };
 };
+export type InternalUIHttpClientContext = {
+    /**
+     * The public base URL (config `publicUrl`) — stays the client's
+     * `baseURL` so URLs rendered into the HTML remain user-facing.
+     */
+    publicURL: string;
+    /**
+     * The server's own listen address (e.g. http://localhost:3010/) —
+     * where the transport actually dispatches requests.
+     */
+    internalURL: string;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC7B,CAAC;CACL,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/app/modules/authentication/repositories/session.d.ts

@@ -1,7 +1,7 @@
 import type { Session } from '@authup/core-kit';
-import type { ICache } from '@authup/server-kit';
+import type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
 import type { Repository } from 'typeorm';
-import type { ISessionRepository } from '../../../../core/index.ts';
+import type { ISessionRepository, SessionFindManyOptions, SessionOwner } from '../../../../core/index.ts';
 type SessionRepositoryContext = {
     repository: Repository<Session>;
     cache: ICache;
@@ -11,6 +11,9 @@ export declare class SessionRepository implements ISessionRepository {
     protected repository: Repository<Session>;
     constructor(ctx: SessionRepositoryContext);
     findOneById(id: string): Promise<Session | null>;
+    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findAllByOwner(owner: SessionOwner): Promise<Session[]>;
+    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
     save(input: Partial<Session>): Promise<Session>;
     remove(session: Session): Promise<void>;
     removeById(id: string): Promise<void>;

package/dist/app/modules/authentication/repositories/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EACR,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAKnC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,QAAQ,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAkD7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAmB9D,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}

package/dist/app/modules/authentication/repositories/session.mjs

@@ -1,8 +1,12 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { SESSION_FILTER_KEYS } from "../../../../core/authentication/session/types.mjs";
+import "../../../../core/index.mjs";
+import { applyRealmScopeSelect } from "../../database/repositories/helpers.mjs";
 import { AuthenticationCachePrefix } from "./constants.mjs";
 import { buildCacheKey } from "@authup/server-kit";
+import { applyQuery } from "typeorm-extension";
 //#region src/app/modules/authentication/repositories/session.ts
 var SessionRepository = class {
 	cache;
@@ -19,6 +23,65 @@ var SessionRepository = class {
 		if (session) return session;
 		return this.repository.findOneBy({ id });
 	}
+	async findMany(query, options = {}) {
+		const qb = this.repository.createQueryBuilder("session");
+		const { pagination } = applyQuery(qb, query, {
+			defaultAlias: "session",
+			fields: { allowed: [
+				"id",
+				"sub",
+				"sub_kind",
+				"ip_address",
+				"user_agent",
+				"expires_at",
+				"refreshed_at",
+				"seen_at",
+				"created_at",
+				"updated_at",
+				"user_id",
+				"client_id",
+				"robot_id",
+				"realm_id"
+			] },
+			filters: { allowed: [...SESSION_FILTER_KEYS] },
+			relations: { allowed: ["realm"] },
+			sort: { allowed: [
+				"seen_at",
+				"expires_at",
+				"created_at",
+				"updated_at"
+			] },
+			pagination: { maxLimit: 50 }
+		});
+		applyRealmScopeSelect(qb, "session", ["sub", "sub_kind"]);
+		if (options.owner) qb.andWhere("session.sub = :ownerSub AND session.sub_kind = :ownerSubKind", {
+			ownerSub: options.owner.sub,
+			ownerSubKind: options.owner.subKind
+		});
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: entities,
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findAllByOwner(owner) {
+		return this.repository.createQueryBuilder("session").where("session.sub = :sub AND session.sub_kind = :subKind", {
+			sub: owner.sub,
+			subKind: owner.subKind
+		}).getMany();
+	}
+	async findAllByQuery(query) {
+		const qb = this.repository.createQueryBuilder("session");
+		applyQuery(qb, query, {
+			defaultAlias: "session",
+			filters: { allowed: [...SESSION_FILTER_KEYS] }
+		});
+		applyRealmScopeSelect(qb, "session", ["sub", "sub_kind"]);
+		return qb.getMany();
+	}
 	async save(input) {
 		const session = this.repository.create(input);
 		await this.repository.save(session);

package/dist/app/modules/authentication/repositories/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["buildCacheKey","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","save","input","create","set","ttl","Date","expires_at","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport type { ISessionRepository } from '../../../../core/index.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expires_at).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaE,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BT,cAAc;GACVU,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,KAAKC,OAA2C;EAClD,MAAMP,UAAU,KAAKJ,WAAWY,OAAOD,KAAAA;EACvC,MAAM,KAAKX,WAAWU,KAAKN,OAAAA;EAE3B,MAAM,KAAKL,MAAMc,IACbjB,cAAc;GACVU,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAEU,KAAK,IAAIC,KAAKX,QAAQY,UAAU,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG/D,OAAOd;CACX;CAIA,MAAMe,OAAOf,SAAiC;EAC1C,MAAM,KAAKJ,WAAWmB,OAAOf,OAAAA;EAC7B,MAAM,KAAKL,MAAMqB,KACbxB,cAAc;GACVU,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAMkB,WAAWlB,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKe,OAAOf,OAAAA;CAE1B;AACJ"}
+{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","SESSION_FILTER_KEYS","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","defaultAlias","fields","allowed","filters","relations","sort","maxLimit","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expires_at","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery } from 'typeorm-extension';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: Record<string, any>,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'session',\n            fields: {\n                allowed: [\n                    'id', \n                    'sub', \n                    'sub_kind', \n                    'ip_address', \n                    'user_agent',\n                    'expires_at', \n                    'refreshed_at', \n                    'seen_at', \n                    'created_at', \n                    'updated_at',\n                    'user_id', \n                    'client_id', \n                    'robot_id', \n                    'realm_id',\n                ],\n            },\n            filters: { allowed: [...SESSION_FILTER_KEYS] },\n            relations: { allowed: ['realm'] },\n            sort: { allowed: ['seen_at', 'expires_at', 'created_at', 'updated_at'] },\n            pagination: { maxLimit: 50 },\n        });\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'sub_kind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.sub_kind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.sub_kind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: Record<string, any>): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: deliberately no `pagination` — a bulk revoke must reach every\n        // matching row. `applyQuery` with a `pagination.maxLimit` would default\n        // the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query, {\n            defaultAlias: 'session',\n            filters: { allowed: [...SESSION_FILTER_KEYS] },\n        });\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'sub_kind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expires_at).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;AA0BA,IAAaK,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BZ,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAerB,WAAWmB,IAAIF,OAAO;GACzCK,cAAc;GACdC,QAAQ,EACJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAED,SAAS,CAAA,GAAIvB,mBAAAA,EAAqB;GAC7CyB,WAAW,EAAEF,SAAS,CAAC,OAAA,EAAS;GAChCG,MAAM,EAAEH,SAAS;IAAC;IAAW;IAAc;IAAc;KAAc;GACvEH,YAAY,EAAEO,UAAU,GAAG;EAC/B,CAAA;EAEA1B,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EAExD,IAAID,QAAQW,OAERV,GAAGW,SAAS,gEAAgE;GACxEC,UAAUb,QAAQW,MAAMG;GACxBC,cAAcf,QAAQW,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGf;GACP;EACJ;CACJ;CAEA,MAAMmB,eAAeX,OAAyC;EAC1D,OAAO,KAAKvB,WAAWc,mBAAmB,SAAA,CAAA,CACrCqB,MAAM,sDAAsD;GACzDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAe1B,OAAgD;EACjE,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CpB,WAAWmB,IAAIF,OAAO;GAClBK,cAAc;GACdG,SAAS,EAAED,SAAS,CAAA,GAAIvB,mBAAAA,EAAqB;EACjD,CAAA;EAEAC,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EAExD,OAAOA,GAAGuB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAMnC,UAAU,KAAKJ,WAAWwC,OAAOD,KAAAA;EACvC,MAAM,KAAKvC,WAAWsC,KAAKlC,OAAAA;EAE3B,MAAM,KAAKL,MAAM0C,IACbhD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAEsC,KAAK,IAAIC,KAAKvC,QAAQwC,UAAU,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG/D,OAAO1C;CACX;CAIA,MAAM2C,OAAO3C,SAAiC;EAC1C,MAAM,KAAKJ,WAAW+C,OAAO3C,OAAAA;EAC7B,MAAM,KAAKL,MAAMiD,KACbvD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAM8C,WAAW9C,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAK2C,OAAO3C,OAAAA;CAE1B;AACJ"}

package/dist/app/modules/config/constants.d.ts

@@ -12,9 +12,13 @@ export declare enum ConfigEnvironmentVariableName {
     TRUSTED_ORIGINS = "TRUSTED_ORIGINS",
     TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
     TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",
+    TOKEN_REFRESH_GRACE_PERIOD = "TOKEN_REFRESH_GRACE_PERIOD",
+    PROMPT_LOGIN_MAX_AGE = "PROMPT_LOGIN_MAX_AGE",
+    END_SESSION_HINT_GRACE_PERIOD = "END_SESSION_HINT_GRACE_PERIOD",
     REGISTRATION_ENABLED = "REGISTRATION_ENABLED",
     EMAIL_VERIFICATION_ENABLED = "EMAIL_VERIFICATION_ENABLED",
     PASSWORD_RECOVERY_ENABLED = "PASSWORD_RECOVERY_ENABLED",
+    PASSWORD_MIN_LENGTH = "PASSWORD_MIN_LENGTH",
     CLIENT_AUTH_BASIC = "CLIENT_AUTH_BASIC",
     CLIENT_SYSTEM_ENABLED = "CLIENT_SYSTEM_ENABLED",
     CLIENT_SYSTEM_SECRET = "CLIENT_SYSTEM_SECRET",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAEvD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}