@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/app/modules/config/constants.mjs

@@ -15,9 +15,13 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["TRUSTED_ORIGINS"] = "TRUSTED_ORIGINS";
 	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
 	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";
+	ConfigEnvironmentVariableName["TOKEN_REFRESH_GRACE_PERIOD"] = "TOKEN_REFRESH_GRACE_PERIOD";
+	ConfigEnvironmentVariableName["PROMPT_LOGIN_MAX_AGE"] = "PROMPT_LOGIN_MAX_AGE";
+	ConfigEnvironmentVariableName["END_SESSION_HINT_GRACE_PERIOD"] = "END_SESSION_HINT_GRACE_PERIOD";
 	ConfigEnvironmentVariableName["REGISTRATION_ENABLED"] = "REGISTRATION_ENABLED";
 	ConfigEnvironmentVariableName["EMAIL_VERIFICATION_ENABLED"] = "EMAIL_VERIFICATION_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_RECOVERY_ENABLED"] = "PASSWORD_RECOVERY_ENABLED";
+	ConfigEnvironmentVariableName["PASSWORD_MIN_LENGTH"] = "PASSWORD_MIN_LENGTH";
 	ConfigEnvironmentVariableName["CLIENT_AUTH_BASIC"] = "CLIENT_AUTH_BASIC";
 	ConfigEnvironmentVariableName["CLIENT_SYSTEM_ENABLED"] = "CLIENT_SYSTEM_ENABLED";
 	ConfigEnvironmentVariableName["CLIENT_SYSTEM_SECRET"] = "CLIENT_SYSTEM_SECRET";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqG9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyG9E"}

package/dist/app/modules/config/normalize.mjs

@@ -5,6 +5,7 @@ import { toPublicHost } from "../../../utils/host.mjs";
 import { expandToOrigins } from "./origins.mjs";
 import { parseConfig } from "./parse.mjs";
 import { EnvironmentName } from "@authup/kit";
+import { USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
 import { read } from "envix";
 import path from "node:path";
 import process from "node:process";
@@ -48,10 +49,14 @@ async function normalizeConfig(input = {}) {
 		middlewareRateLimit: true,
 		middlewareSwagger: true,
 		tokenRefreshMaxAge: 259200,
-		tokenAccessMaxAge: 3600,
+		tokenAccessMaxAge: 900,
+		tokenRefreshGracePeriod: 0,
+		promptLoginMaxAge: 60,
+		endSessionHintGracePeriod: 0,
 		registrationEnabled: false,
 		emailVerificationEnabled: false,
 		passwordRecoveryEnabled: false,
+		passwordMinLength: USER_PASSWORD_MIN_LENGTH,
 		clientAuthBasic: false,
 		clientSystemEnabled: false,
 		clientSystemSecret: "start123",

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","EnvironmentName","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 3_600,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n}\n"],"mappings":";;;;;;;;;;;AAgBA,eAAsBO,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCT,KAAKU,KAAKT,QAAQU,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOlB,KAAK,YAAYG,gBAAgBgB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQf,gBAAgBsB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,OAAO;EACHR;EACAS,UAAUzB,QAAQU,IAAG;EACrBF;EAEAkB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENjB;EACAC;EACAC;EAEAgB,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EAEzBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/C;EAIHW;CACJ;AACJ"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","EnvironmentName","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,eAAsBQ,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCV,KAAKW,KAAKV,QAAQW,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOnB,KAAK,YAAYI,gBAAgBgB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQf,gBAAgBsB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,OAAO;EACHR;EACAS,UAAU1B,QAAQW,IAAG;EACrBF;EAEAkB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENjB;EACAC;EACAC;EAEAgB,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmB5C;EAEnB6C,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGnD;EAIHW;CACJ;AACJ"}

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,wBAAgB,oBAAoB,IAAK,WAAW,CAoKnD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,wBAAgB,oBAAoB,IAAK,WAAW,CAwLnD"}

package/dist/app/modules/config/read/env.mjs

@@ -28,12 +28,20 @@ function readConfigRawFromEnv() {
 	if (typeof tokenAccessMaxAge !== "undefined") options.tokenAccessMaxAge = tokenAccessMaxAge;
 	const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);
 	if (typeof tokenRefreshMaxAge !== "undefined") options.tokenRefreshMaxAge = tokenRefreshMaxAge;
+	const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);
+	if (typeof tokenRefreshGracePeriod !== "undefined") options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;
+	const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);
+	if (typeof promptLoginMaxAge !== "undefined") options.promptLoginMaxAge = promptLoginMaxAge;
+	const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);
+	if (typeof endSessionHintGracePeriod !== "undefined") options.endSessionHintGracePeriod = endSessionHintGracePeriod;
 	const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);
 	if (typeof registrationEnabled !== "undefined") options.registrationEnabled = registrationEnabled;
 	const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);
 	if (typeof emailVerificationEnabled !== "undefined") options.emailVerificationEnabled = emailVerificationEnabled;
 	const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);
 	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
+	const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);
+	if (typeof passwordMinLength !== "undefined") options.passwordMinLength = passwordMinLength;
 	const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);
 	if (typeof clientBasicAuth !== "undefined") options.clientAuthBasic = clientBasicAuth;
 	const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","trustedOrigins","TRUSTED_ORIGINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf, \n    read, \n    readArray, \n    readBool, \n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYtB,KAAKM,8BAA8BiB,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,iBAAiBxB,UAAUK,8BAA8BoB,eAAe;CAC9E,IAAID,kBAAkBA,eAAeE,SAAS,GAC1CnB,QAAQiB,iBAAiBA;CAG7B,MAAMG,oBAAoBzB,QAAQG,8BAA8BuB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BpB,QAAQoB,oBAAoBA;CAGhC,MAAME,qBAAqB3B,QAAQG,8BAA8ByB,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BtB,QAAQsB,qBAAqBA;CAGjC,MAAME,sBAAsB9B,SAASI,8BAA8B2B,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BxB,QAAQwB,sBAAsBA;CAGlC,MAAME,2BAA2BhC,SAASI,8BAA8B6B,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC1B,QAAQ0B,2BAA2BA;CAGvC,MAAME,0BAA0BlC,SAASI,8BAA8B+B,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAKtC,MAAME,kBAAkBpC,SAASI,8BAA8BiC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9B,QAAQgC,kBAAkBF;CAG9B,MAAMG,sBAAsBvC,SAASI,8BAA8BoC,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjC,QAAQiC,sBAAsBA;CAGlC,MAAME,oBAAoB3C,KAAKM,8BAA8BsC,oBAAoB;CACjF,IAAID,mBACAnC,QAAQqC,qBAAqBF;CAGjC,MAAMG,yBAAyB5C,SAASI,8BAA8ByC,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtC,QAAQwC,0BAA0BF;CAKtC,MAAMG,gBAAgB/C,SAASI,8BAA8B4C,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzC,QAAQ2C,gBAAgBF;CAG5B,MAAMG,mBAAmBlD,SAASI,8BAA8B+C,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5C,QAAQ4C,mBAAmBA;CAG/B,MAAME,oBAAoBtD,KAAKM,8BAA8BiD,mBAAmB;CAChF,IAAID,mBACA9C,QAAQ8C,oBAAoBA;CAGhC,MAAME,yBAAyBtD,SAASI,8BAA8BmD,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChD,QAAQgD,yBAAyBA;CAKrC,MAAME,iBAAiBxD,SAASI,8BAA8BqD,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BlD,QAAQoD,iBAAiBF;CAG7B,MAAMG,oBAAoB3D,SAASI,8BAA8BwD,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BrD,QAAQqD,oBAAoBA;CAGhC,MAAME,mBAAmB/D,KAAKM,8BAA8B0D,kBAAkB;CAC9E,IAAID,kBACAvD,QAAQuD,mBAAmBA;CAG/B,MAAME,wBAAwB/D,SAASI,8BAA8B4D,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjCzD,QAAQyD,wBAAwBA;CAKpC,MAAME,cAAclE,UAAUK,8BAA8B8D,WAAW;CACvE,IAAID,eAAeA,YAAYxC,SAAS,GACpCnB,QAAQ2D,cAAcA;CAG1B,MAAME,qCAAqCnE,SAASI,8BAA8BgE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C7D,QAAQ6D,qCAAqCA;CAGjD,OAAO7D;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","trustedOrigins","TRUSTED_ORIGINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYtB,KAAKM,8BAA8BiB,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,iBAAiBxB,UAAUK,8BAA8BoB,eAAe;CAC9E,IAAID,kBAAkBA,eAAeE,SAAS,GAC1CnB,QAAQiB,iBAAiBA;CAG7B,MAAMG,oBAAoBzB,QAAQG,8BAA8BuB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BpB,QAAQoB,oBAAoBA;CAGhC,MAAME,qBAAqB3B,QAAQG,8BAA8ByB,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BtB,QAAQsB,qBAAqBA;CAGjC,MAAME,0BAA0B7B,QAAQG,8BAA8B2B,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnCxB,QAAQwB,0BAA0BA;CAGtC,MAAME,oBAAoB/B,QAAQG,8BAA8B6B,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B1B,QAAQ0B,oBAAoBA;CAGhC,MAAME,4BAA4BjC,QAAQG,8BAA8B+B,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrC5B,QAAQ4B,4BAA4BA;CAGxC,MAAME,sBAAsBpC,SAASI,8BAA8BiC,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/B9B,QAAQ8B,sBAAsBA;CAGlC,MAAME,2BAA2BtC,SAASI,8BAA8BmC,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpChC,QAAQgC,2BAA2BA;CAGvC,MAAME,0BAA0BxC,SAASI,8BAA8BqC,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnClC,QAAQkC,0BAA0BA;CAGtC,MAAME,oBAAoBzC,QAAQG,8BAA8BuC,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BpC,QAAQoC,oBAAoBA;CAKhC,MAAME,kBAAkB5C,SAASI,8BAA8ByC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BtC,QAAQwC,kBAAkBF;CAG9B,MAAMG,sBAAsB/C,SAASI,8BAA8B4C,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BzC,QAAQyC,sBAAsBA;CAGlC,MAAME,oBAAoBnD,KAAKM,8BAA8B8C,oBAAoB;CACjF,IAAID,mBACA3C,QAAQ6C,qBAAqBF;CAGjC,MAAMG,yBAAyBpD,SAASI,8BAA8BiD,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC9C,QAAQgD,0BAA0BF;CAKtC,MAAMG,gBAAgBvD,SAASI,8BAA8BoD,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBjD,QAAQmD,gBAAgBF;CAG5B,MAAMG,mBAAmB1D,SAASI,8BAA8BuD,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BpD,QAAQoD,mBAAmBA;CAG/B,MAAME,oBAAoB9D,KAAKM,8BAA8ByD,mBAAmB;CAChF,IAAID,mBACAtD,QAAQsD,oBAAoBA;CAGhC,MAAME,yBAAyB9D,SAASI,8BAA8B2D,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCxD,QAAQwD,yBAAyBA;CAKrC,MAAME,iBAAiBhE,SAASI,8BAA8B6D,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1B1D,QAAQ4D,iBAAiBF;CAG7B,MAAMG,oBAAoBnE,SAASI,8BAA8BgE,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B7D,QAAQ6D,oBAAoBA;CAGhC,MAAME,mBAAmBvE,KAAKM,8BAA8BkE,kBAAkB;CAC9E,IAAID,kBACA/D,QAAQ+D,mBAAmBA;CAG/B,MAAME,wBAAwBvE,SAASI,8BAA8BoE,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjCjE,QAAQiE,wBAAwBA;CAKpC,MAAME,cAAc1E,UAAUK,8BAA8BsE,WAAW;CACvE,IAAID,eAAeA,YAAYhD,SAAS,GACpCnB,QAAQmE,cAAcA;CAG1B,MAAME,qCAAqC3E,SAASI,8BAA8BwE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CrE,QAAQqE,qCAAqCA;CAGjD,OAAOrE;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -119,10 +119,33 @@ export type Config = {
      */
     tokenRefreshMaxAge: number;
     /**
-     * Access token validity in seconds (default: 3600s / 1 hour).
-     * default: 3_600s (1h)
+     * Access token validity in seconds (default: 900s / 15 minutes).
+     * default: 900s (15min)
      */
     tokenAccessMaxAge: number;
+    /**
+     * Grace period (seconds) during which a just-rotated (consumed) refresh
+     * token is still accepted, minting new chain-linked tokens instead of
+     * triggering replay detection. Absorbs multi-tab / mobile refresh races.
+     * default: 0 (strict — first-use-wins)
+     */
+    tokenRefreshGracePeriod: number;
+    /**
+     * Max age (seconds) of the authentication that a `prompt=login` / `max_age`
+     * authorize request accepts before forcing re-authentication. A stateless
+     * approximation judged against the session's created_at.
+     * default: 60s
+     */
+    promptLoginMaxAge: number;
+    /**
+     * Seconds past its `exp` an (expired) `id_token_hint` presented at the
+     * RP-initiated logout endpoint (`/logout`) is still accepted for a
+     * server-side session revoke. Bounds how long a leaked id_token stays a
+     * replayable remote logout; beyond the window the click-gated confirm
+     * page still works.
+     * default: 0 (unbounded — spec/Keycloak parity)
+     */
+    endSessionHintGracePeriod: number;
     /**
      * Enable user registration?
      * default: false
@@ -138,6 +161,12 @@ export type Config = {
      * default: false
      */
     passwordRecoveryEnabled: boolean;
+    /**
+     * Minimum length for user-chosen passwords (user create/update,
+     * registration, password reset). The maximum is fixed at 512.
+     * default: 10
+     */
+    passwordMinLength: number;
     /**
      * default: false
      */

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAuFhC"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CA6FhC"}

package/dist/app/modules/config/validator.mjs

@@ -3,6 +3,7 @@ import "node:url";
 import.meta.url;
 import { expandToOrigins } from "./origins.mjs";
 import { isObject } from "@authup/kit";
+import { USER_PASSWORD_MAX_LENGTH } from "@authup/core-kit";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
@@ -44,9 +45,13 @@ var ConfigValidator = class extends Container {
 			middlewareSwagger: booleanValidator,
 			tokenAccessMaxAge: nonNegativeNumberValidator,
 			tokenRefreshMaxAge: nonNegativeNumberValidator,
+			tokenRefreshGracePeriod: nonNegativeNumberValidator,
+			promptLoginMaxAge: nonNegativeNumberValidator,
+			endSessionHintGracePeriod: nonNegativeNumberValidator,
 			registrationEnabled: booleanValidator,
 			emailVerificationEnabled: booleanValidator,
 			passwordRecoveryEnabled: booleanValidator,
+			passwordMinLength: createValidator(z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH)),
 			clientAuthBasic: booleanValidator,
 			clientSystemEnabled: booleanValidator,
 			clientSystemSecret: secretValidator,

package/dist/app/modules/config/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["isObject","createValidator","Container","z","expandToOrigins","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            robotAuthBasic: booleanValidator,\n            robotAdminEnabled: booleanValidator,\n            robotAdminSecret: secretValidator,\n            robotAdminSecretReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,kBAAb,cAAqCH,UAAAA;CACdI,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBN,gBAAgBE,EAAEK,OAAM,CAAA;EAChD,MAAMC,mBAAmBR,gBAAgBE,EAAEO,QAAO,CAAA;EAClD,MAAMC,6BAA6BV,gBAAgBE,EAAES,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBb,gBAAgBE,EAAEK,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBhB,gBACxBE,EAAEO,QAAO,CAAA,CAAGQ,GAAGf,EAAEgB,OAAOhB,EAAEK,OAAM,GAAIL,EAAEiB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBpB,gBACrBE,EAAEK,OAAM,CAAA,CACHU,GAAGf,EAAEO,QAAO,CAAA,CAAA,CACZQ,GAAGf,EAAEmB,QAA6BC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI5B,gBACAE,EAAEmB,QACGC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWjC,gBAAgBE,EAAEgC,IAAG,CAAA;GAChCC,gBAAgBnC,gBACZE,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAG8B,QAAQf,UAAAA;IACvB,IAAI;KACAnB,gBAAgBmB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPgB,gBAAgBtB;GAChBuB,gBAAgBvB;GAChBwB,kBAAkBxB;GAClByB,iBAAiBzB;GACjB0B,sBAAsB1B;GACtB2B,qBAAqB3B;GACrB4B,mBAAmBpC;GAEnBqC,mBAAmBnC;GACnBoC,oBAAoBpC;GACpBqC,qBAAqBvC;GACrBwC,0BAA0BxC;GAC1ByC,yBAAyBzC;GAEzB0C,iBAAiB1C;GACjB2C,qBAAqB3C;GACrB4C,oBAAoBvC;GACpBwC,yBAAyB7C;GAEzB8C,eAAe9C;GACf+C,kBAAkB/C;GAClBgD,mBAAmB3C;GACnB4C,wBAAwBjD;GAExBkD,gBAAgBlD;GAChBmD,mBAAmBnD;GACnBoD,kBAAkB/C;GAClBgD,uBAAuBrD;GAEvBsD,aAAa9D,gBACTE,EAAEK,OAAM,CAAA,CAAGU,GAAGf,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAA,CAAA;GAElCwD,oCAAoCvD;EACxC;EAEA,MAAMwD,OAAOC,OAAOD,KAAKzC,UAAAA;EACzB,KAAK,MAAM2C,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAG7C,WAAW2C,IAAI;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","int","positive","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            robotAuthBasic: booleanValidator,\n            robotAdminEnabled: booleanValidator,\n            robotAdminSecret: secretValidator,\n            robotAdminSecretReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;AAmBA,IAAaM,kBAAb,cAAqCH,UAAAA;CACdI,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBN,gBAAgBE,EAAEK,OAAM,CAAA;EAChD,MAAMC,mBAAmBR,gBAAgBE,EAAEO,QAAO,CAAA;EAClD,MAAMC,6BAA6BV,gBAAgBE,EAAES,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBb,gBAAgBE,EAAEK,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBhB,gBACxBE,EAAEO,QAAO,CAAA,CAAGQ,GAAGf,EAAEgB,OAAOhB,EAAEK,OAAM,GAAIL,EAAEiB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBpB,gBACrBE,EAAEK,OAAM,CAAA,CACHU,GAAGf,EAAEO,QAAO,CAAA,CAAA,CACZQ,GAAGf,EAAEmB,QAA6BC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI5B,gBACAE,EAAEmB,QACGC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWjC,gBAAgBE,EAAEgC,IAAG,CAAA;GAChCC,gBAAgBnC,gBACZE,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAG8B,QAAQf,UAAAA;IACvB,IAAI;KACAnB,gBAAgBmB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPgB,gBAAgBtB;GAChBuB,gBAAgBvB;GAChBwB,kBAAkBxB;GAClByB,iBAAiBzB;GACjB0B,sBAAsB1B;GACtB2B,qBAAqB3B;GACrB4B,mBAAmBpC;GAEnBqC,mBAAmBnC;GACnBoC,oBAAoBpC;GACpBqC,yBAAyBrC;GACzBsC,mBAAmBtC;GACnBuC,2BAA2BvC;GAC3BwC,qBAAqB1C;GACrB2C,0BAA0B3C;GAC1B4C,yBAAyB5C;GACzB6C,mBAAmBrD,gBACfE,EAAES,OAAM,CAAA,CAAG2C,IAAG,CAAA,CAAGC,SAAQ,CAAA,CAAGxC,IAAIjB,wBAAAA,CAAAA;GAGpC0D,iBAAiBhD;GACjBiD,qBAAqBjD;GACrBkD,oBAAoB7C;GACpB8C,yBAAyBnD;GAEzBoD,eAAepD;GACfqD,kBAAkBrD;GAClBsD,mBAAmBjD;GACnBkD,wBAAwBvD;GAExBwD,gBAAgBxD;GAChByD,mBAAmBzD;GACnB0D,kBAAkBrD;GAClBsD,uBAAuB3D;GAEvB4D,aAAapE,gBACTE,EAAEK,OAAM,CAAA,CAAGU,GAAGf,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAA,CAAA;GAElC8D,oCAAoC7D;EACxC;EAEA,MAAM8D,OAAOC,OAAOD,KAAK/C,UAAAA;EACzB,KAAK,MAAMiD,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGnD,WAAWiD,IAAI;CAE3D;AACJ"}

package/dist/app/modules/database/module.d.ts

@@ -20,6 +20,7 @@ export declare class DatabaseModule implements IModule {
     constructor(options?: DatabaseModuleOptions);
     setup(container: IContainer): Promise<void>;
     teardown(container: IContainer): Promise<void>;
+    protected disposeEventPublisher(): Promise<void>;
     protected setupDatabase(container: IContainer, options: DataSourceOptions): Promise<void>;
     protected migrate(container: IContainer, dataSource: DataSource): Promise<void>;
     /**

package/dist/app/modules/database/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/module.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,oBAAoB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,SAAS,CAAC;AAMtD,OAAO,EACH,wBAAwB,EAK3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAGxC,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,cAAc,EAAG,wBAAwB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,gBAAgB,CAAC,EAAG,WAAW,CAAC;IAE1C,SAAS,CAAC,cAAc,CAAC,EAAG,oBAAoB,CAAC;gBAErC,OAAO,GAAE,qBAA0B;IAQzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAuBpC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;cAgB/E,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrF;;;;OAIG;cACa,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,iBAAiB,CAAC;IAgC1F,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAI,IAAI;IAiBpF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAyBjF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/module.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,oBAAoB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,SAAS,CAAC;AAMtD,OAAO,EACH,wBAAwB,EAK3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAGxC,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,cAAc,EAAG,wBAAwB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,gBAAgB,CAAC,EAAG,WAAW,CAAC;IAE1C,SAAS,CAAC,cAAc,CAAC,EAAG,oBAAoB,CAAC;gBAErC,OAAO,GAAE,qBAA0B;IAQzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAepC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;cActC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;cAgB/E,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrF;;;;OAIG;cACa,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,iBAAiB,CAAC;IAgC1F,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAI,IAAI;IAiBpF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAyBjF"}

package/dist/app/modules/database/module.mjs

@@ -42,19 +42,32 @@ var DatabaseModule = class {
 		logger.debug("Establishing database connection...");
 		await dataSource.initialize();
 		logger.debug("Established database connection.");
-		if (this.options.migrate) await this.options.migrate(container, dataSource);
-		else await this.migrate(container, dataSource);
-		container.register(DatabaseInjectionKey.DataSource, { useValue: dataSource });
-		this.registerRepositories(container, dataSource);
-		this.registerEventPublisher(container, dataSource);
+		try {
+			if (this.options.migrate) await this.options.migrate(container, dataSource);
+			else await this.migrate(container, dataSource);
+			this.registerRepositories(container, dataSource);
+			this.registerEventPublisher(container, dataSource);
+			container.register(DatabaseInjectionKey.DataSource, { useValue: dataSource });
+		} catch (e) {
+			try {
+				if (dataSource.isInitialized) await dataSource.destroy();
+				await this.disposeEventPublisher();
+			} catch (cleanupError) {
+				logger.warn(`Failed to clean up database resources after setup error: ${cleanupError}`);
+			}
+			throw e;
+		}
 	}
 	async teardown(container) {
 		const dataSource = container.tryResolve(DatabaseInjectionKey.DataSource);
 		if (dataSource.success) {
-			await dataSource.data.destroy();
+			if (dataSource.data.isInitialized) await dataSource.data.destroy();
 			container.unregister(DatabaseInjectionKey.DataSource);
 		}
 		container.unregister(DatabaseInjectionKey.DomainEventPublisher);
+		await this.disposeEventPublisher();
+	}
+	async disposeEventPublisher() {
 		if (this.eventPublisher) {
 			await this.eventPublisher.dispose();
 			this.eventPublisher = void 0;

package/dist/app/modules/database/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DomainEventPublisher","DomainEventRedisHandler","DomainEventSocketHandler","createRedisClient","AuthupError","DataSource","InstanceChecker","checkDatabase","createDatabase","synchronizeDatabaseSchema","DataSourceOptionsBuilder","DatabaseQueryResultCache","EntitySubscriber","isDatabaseTypeSupported","isDatabaseTypeSupportedForEnvironment","CacheInjectionKey","ModuleName","DatabaseInjectionKey","ConfigInjectionKey","LoggerInjectionKey","DatabaseModule","name","dependencies","optionsBuilder","options","eventRedisClient","eventPublisher","DATABASE","CONFIG","LOGGER","setup","container","logger","resolve","prepareBuild","dataSourceOptions","buildDataSourceOptions","setupDatabase","dataSource","debug","initialize","migrate","register","useValue","registerRepositories","registerEventPublisher","teardown","tryResolve","success","data","destroy","unregister","dispose","undefined","disconnect","check","exists","synchronize","ifNotExist","config","db","buildWith","buildWithEnv","type","env","cacheResult","Object","assign","cache","provider","entities","Array","isArray","entity","isEntitySchema","useFactory","getRepository","publisher","redis","client","i","subscribers","length","subscriber","setPublisher"],"sources":["../../../../src/app/modules/database/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DomainEventPublisher,\n    DomainEventRedisHandler,\n    DomainEventSocketHandler,\n    createRedisClient,\n} from '@authup/server-kit';\nimport type { RedisClient } from '@authup/server-kit';\nimport { AuthupError } from '@authup/errors';\nimport type { DataSourceOptions } from 'typeorm';\nimport { DataSource, InstanceChecker } from 'typeorm';\nimport {\n    checkDatabase,\n    createDatabase,\n    synchronizeDatabaseSchema,\n} from 'typeorm-extension';\nimport {\n    DataSourceOptionsBuilder,\n    DatabaseQueryResultCache,\n    EntitySubscriber,\n    isDatabaseTypeSupported,\n    isDatabaseTypeSupportedForEnvironment,\n} from '../../../adapters/database/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { DatabaseInjectionKey } from './constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport type DatabaseModuleOptions = {\n    prepareBuild?: (container: IContainer) => Promise<void>;\n    setup?: (container: IContainer, options: DataSourceOptions) => Promise<void>;\n    migrate?: (container: IContainer, dataSource: DataSource) => Promise<void>;\n};\n\nexport class DatabaseModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected optionsBuilder : DataSourceOptionsBuilder;\n\n    protected options: DatabaseModuleOptions;\n\n    protected eventRedisClient? : RedisClient;\n\n    protected eventPublisher? : DomainEventPublisher;\n\n    constructor(options: DatabaseModuleOptions = {}) {\n        this.name = ModuleName.DATABASE;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n\n        this.optionsBuilder = new DataSourceOptionsBuilder();\n        this.options = options;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const logger = container.resolve(LoggerInjectionKey);\n\n        if (this.options.prepareBuild) {\n            await this.options.prepareBuild(container);\n        }\n\n        const dataSourceOptions = await this.buildDataSourceOptions(container);\n\n        if (this.options.setup) {\n            await this.options.setup(container, dataSourceOptions);\n        } else {\n            await this.setupDatabase(container, dataSourceOptions);\n        }\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        logger.debug('Establishing database connection...');\n        await dataSource.initialize();\n        logger.debug('Established database connection.');\n\n        if (this.options.migrate) {\n            await this.options.migrate(container, dataSource);\n        } else {\n            await this.migrate(container, dataSource);\n        }\n\n        container.register(DatabaseInjectionKey.DataSource, { useValue: dataSource });\n\n        this.registerRepositories(container, dataSource);\n        this.registerEventPublisher(container, dataSource);\n    }\n\n    async teardown(container: IContainer): Promise<void> {\n        const dataSource = container.tryResolve(DatabaseInjectionKey.DataSource);\n        if (dataSource.success) {\n            await dataSource.data.destroy();\n\n            container.unregister(DatabaseInjectionKey.DataSource);\n        }\n\n        container.unregister(DatabaseInjectionKey.DomainEventPublisher);\n\n        if (this.eventPublisher) {\n            await this.eventPublisher.dispose();\n            this.eventPublisher = undefined;\n        }\n\n        if (this.eventRedisClient) {\n            this.eventRedisClient.disconnect();\n            this.eventRedisClient = undefined;\n        }\n    }\n\n    // ----------------------------------------------------\n\n    protected async setupDatabase(container: IContainer, options: DataSourceOptions): Promise<void> {\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const check = await checkDatabase({ options });\n\n        if (!check.exists) {\n            logger.debug('Creating database...');\n            await createDatabase({\n                options,\n                synchronize: false,\n                ifNotExist: true, \n            });\n            logger.debug('Created database');\n        }\n    }\n\n    protected async migrate(container: IContainer, dataSource: DataSource): Promise<void> {\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Migrating database...');\n        await synchronizeDatabaseSchema(dataSource);\n        logger.debug('Migrated database');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Load data source options for connection.\n     *\n     * @protected\n     */\n    protected async buildDataSourceOptions(container: IContainer) : Promise<DataSourceOptions> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        let options : DataSourceOptions | undefined;\n        if (config.db) {\n            options = this.optionsBuilder.buildWith(config.db);\n        } else {\n            options = this.optionsBuilder.buildWithEnv();\n        }\n\n        if (!isDatabaseTypeSupported(options.type)) {\n            throw new AuthupError(`Database type ${options.type} is not supported (only: mysql, better-sqlite3 and postgres).`);\n        }\n\n        if (!isDatabaseTypeSupportedForEnvironment(options.type, config.env)) {\n            throw new AuthupError(`Database type ${options.type} is not supported for ${config.env}.`);\n        }\n\n        const cacheResult = container.tryResolve(CacheInjectionKey);\n        if (cacheResult.success) {\n            Object.assign(options, {\n                cache: {\n                    provider() {\n                        return new DatabaseQueryResultCache(cacheResult.data);\n                    },\n                },\n            } satisfies Partial<DataSourceOptions>);\n        }\n\n        return options;\n    }\n\n    protected registerRepositories(container: IContainer, dataSource: DataSource) : void {\n        const entities = dataSource.options.entities || [];\n        if (!Array.isArray(entities)) {\n            return;\n        }\n\n        for (const entity of entities) {\n            if (InstanceChecker.isEntitySchema(entity)) {\n                continue;\n            }\n\n            // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n            // @ts-expect-error\n            container.register(entity, { useFactory: () => dataSource.getRepository(entity) });\n        }\n    }\n\n    protected registerEventPublisher(container: IContainer, dataSource: DataSource) {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const publisher = new DomainEventPublisher({ logger });\n        this.eventPublisher = publisher;\n        if (config.redis) {\n            const client = createRedisClient(config.redis);\n            if (client !== config.redis) {\n                this.eventRedisClient = client;\n            }\n\n            publisher.register(new DomainEventRedisHandler(client));\n            publisher.register(new DomainEventSocketHandler(client));\n        }\n\n        container.register(DatabaseInjectionKey.DomainEventPublisher, { useValue: publisher });\n\n        for (let i = 0; i < dataSource.subscribers.length; i++) {\n            const subscriber = dataSource.subscribers[i];\n            if (subscriber instanceof EntitySubscriber) {\n                subscriber.setPublisher(publisher);\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA2CA,IAAaoB,iBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,YAAYF,UAAiC,CAAC,GAAG;EAC7C,KAAKH,OAAOL,WAAWW;EACvB,KAAKL,eAAe,CAACN,WAAWY,QAAQZ,WAAWa,MAAAA;EAEnD,KAAKN,iBAAiB,IAAIb,yBAAAA;EAC1B,KAAKc,UAAUA;CACnB;CAEA,MAAMM,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,IAAI,KAAKK,QAAQU,cACb,MAAM,KAAKV,QAAQU,aAAaH,SAAAA;EAGpC,MAAMI,oBAAoB,MAAM,KAAKC,uBAAuBL,SAAAA;EAE5D,IAAI,KAAKP,QAAQM,OACb,MAAM,KAAKN,QAAQM,MAAMC,WAAWI,iBAAAA;OAEpC,MAAM,KAAKE,cAAcN,WAAWI,iBAAAA;EAGxC,MAAMG,aAAa,IAAIjC,WAAW8B,iBAAAA;EAElCH,OAAOO,MAAM,qCAAA;EACb,MAAMD,WAAWE,WAAU;EAC3BR,OAAOO,MAAM,kCAAA;EAEb,IAAI,KAAKf,QAAQiB,SACb,MAAM,KAAKjB,QAAQiB,QAAQV,WAAWO,UAAAA;OAEtC,MAAM,KAAKG,QAAQV,WAAWO,UAAAA;EAGlCP,UAAUW,SAASzB,qBAAqBZ,YAAY,EAAEsC,UAAUL,WAAW,CAAA;EAE3E,KAAKM,qBAAqBb,WAAWO,UAAAA;EACrC,KAAKO,uBAAuBd,WAAWO,UAAAA;CAC3C;CAEA,MAAMQ,SAASf,WAAsC;EACjD,MAAMO,aAAaP,UAAUgB,WAAW9B,qBAAqBZ,UAAU;EACvE,IAAIiC,WAAWU,SAAS;GACpB,MAAMV,WAAWW,KAAKC,QAAO;GAE7BnB,UAAUoB,WAAWlC,qBAAqBZ,UAAU;EACxD;EAEA0B,UAAUoB,WAAWlC,qBAAqBjB,oBAAoB;EAE9D,IAAI,KAAK0B,gBAAgB;GACrB,MAAM,KAAKA,eAAe0B,QAAO;GACjC,KAAK1B,iBAAiB2B,KAAAA;EAC1B;EAEA,IAAI,KAAK5B,kBAAkB;GACvB,KAAKA,iBAAiB6B,WAAU;GAChC,KAAK7B,mBAAmB4B,KAAAA;EAC5B;CACJ;CAIA,MAAgBhB,cAAcN,WAAuBP,SAA2C;EAC5F,MAAMQ,SAASD,UAAUE,QAAQd,kBAAAA;EAIjC,IAAI,EAACoC,MAFehD,cAAc,EAAEiB,QAAQ,CAAA,EAAA,CAEjCgC,QAAQ;GACfxB,OAAOO,MAAM,sBAAA;GACb,MAAM/B,eAAe;IACjBgB;IACAiC,aAAa;IACbC,YAAY;GAChB,CAAA;GACA1B,OAAOO,MAAM,kBAAA;EACjB;CACJ;CAEA,MAAgBE,QAAQV,WAAuBO,YAAuC;EAClF,MAAMN,SAASD,UAAUE,QAAQd,kBAAAA;EAEjCa,OAAOO,MAAM,uBAAA;EACb,MAAM9B,0BAA0B6B,UAAAA;EAChCN,OAAOO,MAAM,mBAAA;CACjB;;;;;IASA,MAAgBH,uBAAuBL,WAAoD;EACvF,MAAM4B,SAAS5B,UAAUE,QAAQf,kBAAAA;EAEjC,IAAIM;EACJ,IAAImC,OAAOC,IACPpC,UAAU,KAAKD,eAAesC,UAAUF,OAAOC,EAAE;OAEjDpC,UAAU,KAAKD,eAAeuC,aAAY;EAG9C,IAAI,CAACjD,wBAAwBW,QAAQuC,IAAI,GACrC,MAAM,IAAI3D,YAAY,iBAAiBoB,QAAQuC,KAAK,8DAA8D;EAGtH,IAAI,CAACjD,sCAAsCU,QAAQuC,MAAMJ,OAAOK,GAAG,GAC/D,MAAM,IAAI5D,YAAY,iBAAiBoB,QAAQuC,KAAK,wBAAwBJ,OAAOK,IAAI,EAAE;EAG7F,MAAMC,cAAclC,UAAUgB,WAAWhC,iBAAAA;EACzC,IAAIkD,YAAYjB,SACZkB,OAAOC,OAAO3C,SAAS,EACnB4C,OAAO,EACHC,WAAAA;GACI,OAAO,IAAI1D,yBAAyBsD,YAAYhB,IAAI;EACxD,EACJ,EACJ,CAAA;EAGJ,OAAOzB;CACX;CAEUoB,qBAAqBb,WAAuBO,YAA+B;EACjF,MAAMgC,WAAWhC,WAAWd,QAAQ8C,YAAY,CAAA;EAChD,IAAI,CAACC,MAAMC,QAAQF,QAAAA,GACf;EAGJ,KAAK,MAAMG,UAAUH,UAAU;GAC3B,IAAIhE,gBAAgBoE,eAAeD,MAAAA,GAC/B;GAKJ1C,UAAUW,SAAS+B,QAAQ,EAAEE,kBAAkBrC,WAAWsC,cAAcH,MAAAA,EAAQ,CAAA;EACpF;CACJ;CAEU5B,uBAAuBd,WAAuBO,YAAwB;EAC5E,MAAMqB,SAAS5B,UAAUE,QAAQf,kBAAAA;EAGjC,MAAM2D,YAAY,IAAI7E,qBAAqB,EAAEgC,QAF9BD,UAAUE,QAAQd,kBAEYa,EAAO,CAAA;EACpD,KAAKN,iBAAiBmD;EACtB,IAAIlB,OAAOmB,OAAO;GACd,MAAMC,SAAS5E,kBAAkBwD,OAAOmB,KAAK;GAC7C,IAAIC,WAAWpB,OAAOmB,OAClB,KAAKrD,mBAAmBsD;GAG5BF,UAAUnC,SAAS,IAAIzC,wBAAwB8E,MAAAA,CAAAA;GAC/CF,UAAUnC,SAAS,IAAIxC,yBAAyB6E,MAAAA,CAAAA;EACpD;EAEAhD,UAAUW,SAASzB,qBAAqBjB,sBAAsB,EAAE2C,UAAUkC,UAAU,CAAA;EAEpF,KAAK,IAAIG,IAAI,GAAGA,IAAI1C,WAAW2C,YAAYC,QAAQF,KAAK;GACpD,MAAMG,aAAa7C,WAAW2C,YAAYD;GAC1C,IAAIG,sBAAsBvE,kBACtBuE,WAAWC,aAAaP,SAAAA;EAEhC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["DomainEventPublisher","DomainEventRedisHandler","DomainEventSocketHandler","createRedisClient","AuthupError","DataSource","InstanceChecker","checkDatabase","createDatabase","synchronizeDatabaseSchema","DataSourceOptionsBuilder","DatabaseQueryResultCache","EntitySubscriber","isDatabaseTypeSupported","isDatabaseTypeSupportedForEnvironment","CacheInjectionKey","ModuleName","DatabaseInjectionKey","ConfigInjectionKey","LoggerInjectionKey","DatabaseModule","name","dependencies","optionsBuilder","options","eventRedisClient","eventPublisher","DATABASE","CONFIG","LOGGER","setup","container","logger","resolve","prepareBuild","dataSourceOptions","buildDataSourceOptions","setupDatabase","dataSource","debug","initialize","migrate","registerRepositories","registerEventPublisher","register","useValue","e","isInitialized","destroy","disposeEventPublisher","cleanupError","warn","teardown","tryResolve","success","data","unregister","dispose","undefined","disconnect","check","exists","synchronize","ifNotExist","config","db","buildWith","buildWithEnv","type","env","cacheResult","Object","assign","cache","provider","entities","Array","isArray","entity","isEntitySchema","useFactory","getRepository","publisher","redis","client","i","subscribers","length","subscriber","setPublisher"],"sources":["../../../../src/app/modules/database/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DomainEventPublisher,\n    DomainEventRedisHandler,\n    DomainEventSocketHandler,\n    createRedisClient,\n} from '@authup/server-kit';\nimport type { RedisClient } from '@authup/server-kit';\nimport { AuthupError } from '@authup/errors';\nimport type { DataSourceOptions } from 'typeorm';\nimport { DataSource, InstanceChecker } from 'typeorm';\nimport {\n    checkDatabase,\n    createDatabase,\n    synchronizeDatabaseSchema,\n} from 'typeorm-extension';\nimport {\n    DataSourceOptionsBuilder,\n    DatabaseQueryResultCache,\n    EntitySubscriber,\n    isDatabaseTypeSupported,\n    isDatabaseTypeSupportedForEnvironment,\n} from '../../../adapters/database/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { DatabaseInjectionKey } from './constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport type DatabaseModuleOptions = {\n    prepareBuild?: (container: IContainer) => Promise<void>;\n    setup?: (container: IContainer, options: DataSourceOptions) => Promise<void>;\n    migrate?: (container: IContainer, dataSource: DataSource) => Promise<void>;\n};\n\nexport class DatabaseModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected optionsBuilder : DataSourceOptionsBuilder;\n\n    protected options: DatabaseModuleOptions;\n\n    protected eventRedisClient? : RedisClient;\n\n    protected eventPublisher? : DomainEventPublisher;\n\n    constructor(options: DatabaseModuleOptions = {}) {\n        this.name = ModuleName.DATABASE;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n\n        this.optionsBuilder = new DataSourceOptionsBuilder();\n        this.options = options;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const logger = container.resolve(LoggerInjectionKey);\n\n        if (this.options.prepareBuild) {\n            await this.options.prepareBuild(container);\n        }\n\n        const dataSourceOptions = await this.buildDataSourceOptions(container);\n\n        if (this.options.setup) {\n            await this.options.setup(container, dataSourceOptions);\n        } else {\n            await this.setupDatabase(container, dataSourceOptions);\n        }\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        logger.debug('Establishing database connection...');\n        await dataSource.initialize();\n        logger.debug('Established database connection.');\n\n        try {\n            if (this.options.migrate) {\n                await this.options.migrate(container, dataSource);\n            } else {\n                await this.migrate(container, dataSource);\n            }\n\n            this.registerRepositories(container, dataSource);\n            this.registerEventPublisher(container, dataSource);\n\n            container.register(DatabaseInjectionKey.DataSource, { useValue: dataSource });\n        } catch (e) {\n            // teardown() is skipped for a module that fails its own setup(),\n            // so release the connection pool and any event-publisher handles\n            // here. Guard cleanup so it can never mask the original error.\n            try {\n                if (dataSource.isInitialized) {\n                    await dataSource.destroy();\n                }\n\n                await this.disposeEventPublisher();\n            } catch (cleanupError) {\n                logger.warn(`Failed to clean up database resources after setup error: ${cleanupError}`);\n            }\n\n            throw e;\n        }\n    }\n\n    async teardown(container: IContainer): Promise<void> {\n        const dataSource = container.tryResolve(DatabaseInjectionKey.DataSource);\n        if (dataSource.success) {\n            if (dataSource.data.isInitialized) {\n                await dataSource.data.destroy();\n            }\n\n            container.unregister(DatabaseInjectionKey.DataSource);\n        }\n\n        container.unregister(DatabaseInjectionKey.DomainEventPublisher);\n\n        await this.disposeEventPublisher();\n    }\n\n    protected async disposeEventPublisher(): Promise<void> {\n        if (this.eventPublisher) {\n            await this.eventPublisher.dispose();\n            this.eventPublisher = undefined;\n        }\n\n        if (this.eventRedisClient) {\n            this.eventRedisClient.disconnect();\n            this.eventRedisClient = undefined;\n        }\n    }\n\n    // ----------------------------------------------------\n\n    protected async setupDatabase(container: IContainer, options: DataSourceOptions): Promise<void> {\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const check = await checkDatabase({ options });\n\n        if (!check.exists) {\n            logger.debug('Creating database...');\n            await createDatabase({\n                options,\n                synchronize: false,\n                ifNotExist: true, \n            });\n            logger.debug('Created database');\n        }\n    }\n\n    protected async migrate(container: IContainer, dataSource: DataSource): Promise<void> {\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Migrating database...');\n        await synchronizeDatabaseSchema(dataSource);\n        logger.debug('Migrated database');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Load data source options for connection.\n     *\n     * @protected\n     */\n    protected async buildDataSourceOptions(container: IContainer) : Promise<DataSourceOptions> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        let options : DataSourceOptions | undefined;\n        if (config.db) {\n            options = this.optionsBuilder.buildWith(config.db);\n        } else {\n            options = this.optionsBuilder.buildWithEnv();\n        }\n\n        if (!isDatabaseTypeSupported(options.type)) {\n            throw new AuthupError(`Database type ${options.type} is not supported (only: mysql, better-sqlite3 and postgres).`);\n        }\n\n        if (!isDatabaseTypeSupportedForEnvironment(options.type, config.env)) {\n            throw new AuthupError(`Database type ${options.type} is not supported for ${config.env}.`);\n        }\n\n        const cacheResult = container.tryResolve(CacheInjectionKey);\n        if (cacheResult.success) {\n            Object.assign(options, {\n                cache: {\n                    provider() {\n                        return new DatabaseQueryResultCache(cacheResult.data);\n                    },\n                },\n            } satisfies Partial<DataSourceOptions>);\n        }\n\n        return options;\n    }\n\n    protected registerRepositories(container: IContainer, dataSource: DataSource) : void {\n        const entities = dataSource.options.entities || [];\n        if (!Array.isArray(entities)) {\n            return;\n        }\n\n        for (const entity of entities) {\n            if (InstanceChecker.isEntitySchema(entity)) {\n                continue;\n            }\n\n            // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n            // @ts-expect-error\n            container.register(entity, { useFactory: () => dataSource.getRepository(entity) });\n        }\n    }\n\n    protected registerEventPublisher(container: IContainer, dataSource: DataSource) {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const publisher = new DomainEventPublisher({ logger });\n        this.eventPublisher = publisher;\n        if (config.redis) {\n            const client = createRedisClient(config.redis);\n            if (client !== config.redis) {\n                this.eventRedisClient = client;\n            }\n\n            publisher.register(new DomainEventRedisHandler(client));\n            publisher.register(new DomainEventSocketHandler(client));\n        }\n\n        container.register(DatabaseInjectionKey.DomainEventPublisher, { useValue: publisher });\n\n        for (let i = 0; i < dataSource.subscribers.length; i++) {\n            const subscriber = dataSource.subscribers[i];\n            if (subscriber instanceof EntitySubscriber) {\n                subscriber.setPublisher(publisher);\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA2CA,IAAaoB,iBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,YAAYF,UAAiC,CAAC,GAAG;EAC7C,KAAKH,OAAOL,WAAWW;EACvB,KAAKL,eAAe,CAACN,WAAWY,QAAQZ,WAAWa,MAAAA;EAEnD,KAAKN,iBAAiB,IAAIb,yBAAAA;EAC1B,KAAKc,UAAUA;CACnB;CAEA,MAAMM,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,IAAI,KAAKK,QAAQU,cACb,MAAM,KAAKV,QAAQU,aAAaH,SAAAA;EAGpC,MAAMI,oBAAoB,MAAM,KAAKC,uBAAuBL,SAAAA;EAE5D,IAAI,KAAKP,QAAQM,OACb,MAAM,KAAKN,QAAQM,MAAMC,WAAWI,iBAAAA;OAEpC,MAAM,KAAKE,cAAcN,WAAWI,iBAAAA;EAGxC,MAAMG,aAAa,IAAIjC,WAAW8B,iBAAAA;EAElCH,OAAOO,MAAM,qCAAA;EACb,MAAMD,WAAWE,WAAU;EAC3BR,OAAOO,MAAM,kCAAA;EAEb,IAAI;GACA,IAAI,KAAKf,QAAQiB,SACb,MAAM,KAAKjB,QAAQiB,QAAQV,WAAWO,UAAAA;QAEtC,MAAM,KAAKG,QAAQV,WAAWO,UAAAA;GAGlC,KAAKI,qBAAqBX,WAAWO,UAAAA;GACrC,KAAKK,uBAAuBZ,WAAWO,UAAAA;GAEvCP,UAAUa,SAAS3B,qBAAqBZ,YAAY,EAAEwC,UAAUP,WAAW,CAAA;EAC/E,SAASQ,GAAG;GAIR,IAAI;IACA,IAAIR,WAAWS,eACX,MAAMT,WAAWU,QAAO;IAG5B,MAAM,KAAKC,sBAAqB;GACpC,SAASC,cAAc;IACnBlB,OAAOmB,KAAK,4DAA4DD,cAAc;GAC1F;GAEA,MAAMJ;EACV;CACJ;CAEA,MAAMM,SAASrB,WAAsC;EACjD,MAAMO,aAAaP,UAAUsB,WAAWpC,qBAAqBZ,UAAU;EACvE,IAAIiC,WAAWgB,SAAS;GACpB,IAAIhB,WAAWiB,KAAKR,eAChB,MAAMT,WAAWiB,KAAKP,QAAO;GAGjCjB,UAAUyB,WAAWvC,qBAAqBZ,UAAU;EACxD;EAEA0B,UAAUyB,WAAWvC,qBAAqBjB,oBAAoB;EAE9D,MAAM,KAAKiD,sBAAqB;CACpC;CAEA,MAAgBA,wBAAuC;EACnD,IAAI,KAAKvB,gBAAgB;GACrB,MAAM,KAAKA,eAAe+B,QAAO;GACjC,KAAK/B,iBAAiBgC,KAAAA;EAC1B;EAEA,IAAI,KAAKjC,kBAAkB;GACvB,KAAKA,iBAAiBkC,WAAU;GAChC,KAAKlC,mBAAmBiC,KAAAA;EAC5B;CACJ;CAIA,MAAgBrB,cAAcN,WAAuBP,SAA2C;EAC5F,MAAMQ,SAASD,UAAUE,QAAQd,kBAAAA;EAIjC,IAAI,EAACyC,MAFerD,cAAc,EAAEiB,QAAQ,CAAA,EAAA,CAEjCqC,QAAQ;GACf7B,OAAOO,MAAM,sBAAA;GACb,MAAM/B,eAAe;IACjBgB;IACAsC,aAAa;IACbC,YAAY;GAChB,CAAA;GACA/B,OAAOO,MAAM,kBAAA;EACjB;CACJ;CAEA,MAAgBE,QAAQV,WAAuBO,YAAuC;EAClF,MAAMN,SAASD,UAAUE,QAAQd,kBAAAA;EAEjCa,OAAOO,MAAM,uBAAA;EACb,MAAM9B,0BAA0B6B,UAAAA;EAChCN,OAAOO,MAAM,mBAAA;CACjB;;;;;IASA,MAAgBH,uBAAuBL,WAAoD;EACvF,MAAMiC,SAASjC,UAAUE,QAAQf,kBAAAA;EAEjC,IAAIM;EACJ,IAAIwC,OAAOC,IACPzC,UAAU,KAAKD,eAAe2C,UAAUF,OAAOC,EAAE;OAEjDzC,UAAU,KAAKD,eAAe4C,aAAY;EAG9C,IAAI,CAACtD,wBAAwBW,QAAQ4C,IAAI,GACrC,MAAM,IAAIhE,YAAY,iBAAiBoB,QAAQ4C,KAAK,8DAA8D;EAGtH,IAAI,CAACtD,sCAAsCU,QAAQ4C,MAAMJ,OAAOK,GAAG,GAC/D,MAAM,IAAIjE,YAAY,iBAAiBoB,QAAQ4C,KAAK,wBAAwBJ,OAAOK,IAAI,EAAE;EAG7F,MAAMC,cAAcvC,UAAUsB,WAAWtC,iBAAAA;EACzC,IAAIuD,YAAYhB,SACZiB,OAAOC,OAAOhD,SAAS,EACnBiD,OAAO,EACHC,WAAAA;GACI,OAAO,IAAI/D,yBAAyB2D,YAAYf,IAAI;EACxD,EACJ,EACJ,CAAA;EAGJ,OAAO/B;CACX;CAEUkB,qBAAqBX,WAAuBO,YAA+B;EACjF,MAAMqC,WAAWrC,WAAWd,QAAQmD,YAAY,CAAA;EAChD,IAAI,CAACC,MAAMC,QAAQF,QAAAA,GACf;EAGJ,KAAK,MAAMG,UAAUH,UAAU;GAC3B,IAAIrE,gBAAgByE,eAAeD,MAAAA,GAC/B;GAKJ/C,UAAUa,SAASkC,QAAQ,EAAEE,kBAAkB1C,WAAW2C,cAAcH,MAAAA,EAAQ,CAAA;EACpF;CACJ;CAEUnC,uBAAuBZ,WAAuBO,YAAwB;EAC5E,MAAM0B,SAASjC,UAAUE,QAAQf,kBAAAA;EAGjC,MAAMgE,YAAY,IAAIlF,qBAAqB,EAAEgC,QAF9BD,UAAUE,QAAQd,kBAEYa,EAAO,CAAA;EACpD,KAAKN,iBAAiBwD;EACtB,IAAIlB,OAAOmB,OAAO;GACd,MAAMC,SAASjF,kBAAkB6D,OAAOmB,KAAK;GAC7C,IAAIC,WAAWpB,OAAOmB,OAClB,KAAK1D,mBAAmB2D;GAG5BF,UAAUtC,SAAS,IAAI3C,wBAAwBmF,MAAAA,CAAAA;GAC/CF,UAAUtC,SAAS,IAAI1C,yBAAyBkF,MAAAA,CAAAA;EACpD;EAEArD,UAAUa,SAAS3B,qBAAqBjB,sBAAsB,EAAE6C,UAAUqC,UAAU,CAAA;EAEpF,KAAK,IAAIG,IAAI,GAAGA,IAAI/C,WAAWgD,YAAYC,QAAQF,KAAK;GACpD,MAAMG,aAAalD,WAAWgD,YAAYD;GAC1C,IAAIG,sBAAsB5E,kBACtB4E,WAAWC,aAAaP,SAAAA;EAEhC;CACJ;AACJ"}

package/dist/app/modules/database/repositories/bindings.d.ts

@@ -1,5 +1,6 @@
 import type { EntityManager, EntityTarget, FindOptionsWhere, ObjectLiteral } from 'typeorm';
 import type { PermissionPolicyBinding } from '@authup/access';
+import { RealmScope } from '@authup/access';
 import type { Permission } from '@authup/core-kit';
 export type LoadBoundPermissionsOptions<E extends ObjectLiteral> = {
     manager: EntityManager;
@@ -11,6 +12,7 @@ export type LoadBoundPermissionsOptions<E extends ObjectLiteral> = {
 type PermissionJunction = {
     permission: Permission;
     policy_id?: string | null;
+    realm_scope?: `${RealmScope}` | null;
 };
 export declare function loadBoundPermissions<E extends PermissionJunction & ObjectLiteral>(options: LoadBoundPermissionsOptions<E>): Promise<PermissionPolicyBinding[]>;
 export {};

package/dist/app/modules/database/repositories/bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/bindings.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,aAAa,EACb,YAAY,EAEZ,gBAAgB,EAChB,aAAa,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAc,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,MAAM,2BAA2B,CAAC,CAAC,SAAS,aAAa,IAAI;IAC/D,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,kBAAkB,GAAG,aAAa,EACnF,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAiCpC"}
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/bindings.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,aAAa,EACb,YAAY,EAEZ,gBAAgB,EAChB,aAAa,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAc,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,MAAM,2BAA2B,CAAC,CAAC,SAAS,aAAa,IAAI;IAC/D,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,kBAAkB,GAAG,aAAa,EACnF,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAoCpC"}

package/dist/app/modules/database/repositories/bindings.mjs

@@ -4,6 +4,7 @@ import.meta.url;
 import { PolicyRepository } from "../../../../adapters/database/domains/policy/repository.mjs";
 import "../../../../adapters/database/domains/policy/index.mjs";
 import { buildRedisKeyPath } from "@authup/server-kit";
+import { RealmScope } from "@authup/access";
 //#region src/app/modules/database/repositories/bindings.ts
 async function loadBoundPermissions(options) {
 	const entries = await options.manager.getRepository(options.junctionTarget).find({
@@ -25,7 +26,8 @@ async function loadBoundPermissions(options) {
 		if (entry.policy_id && policyTrees[entry.policy_id]) policies.push(policyTrees[entry.policy_id]);
 		return {
 			permission: entry.permission,
-			policies: policies.length > 0 ? policies : void 0
+			policies: policies.length > 0 ? policies : void 0,
+			realm_scope: entry.realm_scope ?? RealmScope.OWN
 		};
 	});
 }

package/dist/app/modules/database/repositories/bindings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.mjs","names":["buildRedisKeyPath","PolicyRepository","loadBoundPermissions","options","repository","manager","getRepository","junctionTarget","relations","permission","entries","find","where","cache","id","prefix","cachePrefix","key","cacheKey","milliseconds","policyIds","Set","entry","policy_id","add","policyTrees","loadPolicyTrees","map","policies","push","length","undefined","policyRepository","trees","Promise","all","findDescendantsTreeById","then","tree","result"],"sources":["../../../../../src/app/modules/database/repositories/bindings.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    EntityManager,\n    EntityTarget,\n    FindOptionsRelations,\n    FindOptionsWhere,\n    ObjectLiteral,\n} from 'typeorm';\nimport type { BasePolicy, PermissionPolicyBinding } from '@authup/access';\nimport type { Permission } from '@authup/core-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { PolicyRepository } from '../../../../adapters/database/domains/policy/index.ts';\n\nexport type LoadBoundPermissionsOptions<E extends ObjectLiteral> = {\n    manager: EntityManager;\n    junctionTarget: EntityTarget<E>;\n    where: FindOptionsWhere<E>;\n    cachePrefix: string;\n    cacheKey: string;\n};\n\ntype PermissionJunction = {\n    permission: Permission;\n    policy_id?: string | null;\n};\n\nexport async function loadBoundPermissions<E extends PermissionJunction & ObjectLiteral>(\n    options: LoadBoundPermissionsOptions<E>,\n): Promise<PermissionPolicyBinding[]> {\n    const repository = options.manager.getRepository(options.junctionTarget);\n    const relations = { permission: true } as FindOptionsRelations<E>;\n\n    const entries = await repository.find({\n        where: options.where,\n        relations,\n        cache: {\n            id: buildRedisKeyPath({ prefix: options.cachePrefix, key: options.cacheKey }),\n            milliseconds: 60_000,\n        },\n    });\n\n    const policyIds = new Set<string>();\n    for (const entry of entries) {\n        if (entry.policy_id) {\n            policyIds.add(entry.policy_id);\n        }\n    }\n\n    const policyTrees = await loadPolicyTrees(options.manager, [...policyIds]);\n\n    return entries.map((entry) => {\n        const policies: BasePolicy[] = [];\n        if (entry.policy_id && policyTrees[entry.policy_id]) {\n            policies.push(policyTrees[entry.policy_id]);\n        }\n\n        return {\n            permission: entry.permission,\n            policies: policies.length > 0 ? policies : undefined,\n        };\n    });\n}\n\nasync function loadPolicyTrees(\n    manager: EntityManager,\n    policyIds: string[],\n): Promise<Record<string, BasePolicy>> {\n    if (policyIds.length === 0) {\n        return {};\n    }\n\n    const policyRepository = new PolicyRepository(manager);\n    const trees = await Promise.all(\n        policyIds.map((id) => policyRepository.findDescendantsTreeById(id)\n            .then((tree) => [id, tree] as const)),\n    );\n\n    const result: Record<string, BasePolicy> = {};\n    for (const [id, tree] of trees) {\n        if (tree) {\n            result[id] = tree;\n        }\n    }\n    return result;\n}\n"],"mappings":";;;;;;;AAgCA,eAAsBE,qBAClBC,SAAuC;CAKvC,MAAMO,UAAU,MAHGP,QAAQE,QAAQC,cAAcH,QAAQI,cAGnCH,CAAAA,CAAWO,KAAK;EAClCC,OAAOT,QAAQS;EACfJ,WAAAA,EAJgBC,YAAY,KAI5BD;EACAK,OAAO;GACHC,IAAId,kBAAkB;IAAEe,QAAQZ,QAAQa;IAAaC,KAAKd,QAAQe;GAAS,CAAA;GAC3EC,cAAc;EAClB;CACJ,CAAA;CAEA,MAAMC,4BAAY,IAAIC,IAAAA;CACtB,KAAK,MAAMC,SAASZ,SAChB,IAAIY,MAAMC,WACNH,UAAUI,IAAIF,MAAMC,SAAS;CAIrC,MAAME,cAAc,MAAMC,gBAAgBvB,QAAQE,SAAS,CAAA,GAAIe,SAAAA,CAAU;CAEzE,OAAOV,QAAQiB,KAAKL,UAAAA;EAChB,MAAMM,WAAyB,CAAA;EAC/B,IAAIN,MAAMC,aAAaE,YAAYH,MAAMC,YACrCK,SAASC,KAAKJ,YAAYH,MAAMC,UAAU;EAG9C,OAAO;GACHd,YAAYa,MAAMb;GAClBmB,UAAUA,SAASE,SAAS,IAAIF,WAAWG,KAAAA;EAC/C;CACJ,CAAA;AACJ;AAEA,eAAeL,gBACXrB,SACAe,WAAmB;CAEnB,IAAIA,UAAUU,WAAW,GACrB,OAAO,CAAC;CAGZ,MAAME,mBAAmB,IAAI/B,iBAAiBI,OAAAA;CAC9C,MAAM4B,QAAQ,MAAMC,QAAQC,IACxBf,UAAUO,KAAKb,OAAOkB,iBAAiBI,wBAAwBtB,EAAAA,CAAAA,CAC1DuB,MAAMC,SAAS,CAACxB,IAAIwB,IAAAA,CAAK,CAAA,CAAA;CAGlC,MAAMC,SAAqC,CAAC;CAC5C,KAAK,MAAM,CAACzB,IAAIwB,SAASL,OACrB,IAAIK,MACAC,OAAOzB,MAAMwB;CAGrB,OAAOC;AACX"}
+{"version":3,"file":"bindings.mjs","names":["RealmScope","buildRedisKeyPath","PolicyRepository","loadBoundPermissions","options","repository","manager","getRepository","junctionTarget","relations","permission","entries","find","where","cache","id","prefix","cachePrefix","key","cacheKey","milliseconds","policyIds","Set","entry","policy_id","add","policyTrees","loadPolicyTrees","map","policies","push","length","undefined","realm_scope","OWN","policyRepository","trees","Promise","all","findDescendantsTreeById","then","tree","result"],"sources":["../../../../../src/app/modules/database/repositories/bindings.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    EntityManager,\n    EntityTarget,\n    FindOptionsRelations,\n    FindOptionsWhere,\n    ObjectLiteral,\n} from 'typeorm';\nimport type { BasePolicy, PermissionPolicyBinding } from '@authup/access';\nimport { RealmScope } from '@authup/access';\nimport type { Permission } from '@authup/core-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { PolicyRepository } from '../../../../adapters/database/domains/policy/index.ts';\n\nexport type LoadBoundPermissionsOptions<E extends ObjectLiteral> = {\n    manager: EntityManager;\n    junctionTarget: EntityTarget<E>;\n    where: FindOptionsWhere<E>;\n    cachePrefix: string;\n    cacheKey: string;\n};\n\ntype PermissionJunction = {\n    permission: Permission;\n    policy_id?: string | null;\n    realm_scope?: `${RealmScope}` | null;\n};\n\nexport async function loadBoundPermissions<E extends PermissionJunction & ObjectLiteral>(\n    options: LoadBoundPermissionsOptions<E>,\n): Promise<PermissionPolicyBinding[]> {\n    const repository = options.manager.getRepository(options.junctionTarget);\n    const relations = { permission: true } as FindOptionsRelations<E>;\n\n    const entries = await repository.find({\n        where: options.where,\n        relations,\n        cache: {\n            id: buildRedisKeyPath({ prefix: options.cachePrefix, key: options.cacheKey }),\n            milliseconds: 60_000,\n        },\n    });\n\n    const policyIds = new Set<string>();\n    for (const entry of entries) {\n        if (entry.policy_id) {\n            policyIds.add(entry.policy_id);\n        }\n    }\n\n    const policyTrees = await loadPolicyTrees(options.manager, [...policyIds]);\n\n    return entries.map((entry) => {\n        const policies: BasePolicy[] = [];\n        if (entry.policy_id && policyTrees[entry.policy_id]) {\n            policies.push(policyTrees[entry.policy_id]);\n        }\n\n        return {\n            permission: entry.permission,\n            policies: policies.length > 0 ? policies : undefined,\n            // Fail-closed coercion: a missing column (stale cache / pre-migration row)\n            // becomes the most restrictive `own`.\n            realm_scope: entry.realm_scope ?? RealmScope.OWN,\n        };\n    });\n}\n\nasync function loadPolicyTrees(\n    manager: EntityManager,\n    policyIds: string[],\n): Promise<Record<string, BasePolicy>> {\n    if (policyIds.length === 0) {\n        return {};\n    }\n\n    const policyRepository = new PolicyRepository(manager);\n    const trees = await Promise.all(\n        policyIds.map((id) => policyRepository.findDescendantsTreeById(id)\n            .then((tree) => [id, tree] as const)),\n    );\n\n    const result: Record<string, BasePolicy> = {};\n    for (const [id, tree] of trees) {\n        if (tree) {\n            result[id] = tree;\n        }\n    }\n    return result;\n}\n"],"mappings":";;;;;;;;AAkCA,eAAsBG,qBAClBC,SAAuC;CAKvC,MAAMO,UAAU,MAHGP,QAAQE,QAAQC,cAAcH,QAAQI,cAGnCH,CAAAA,CAAWO,KAAK;EAClCC,OAAOT,QAAQS;EACfJ,WAAAA,EAJgBC,YAAY,KAI5BD;EACAK,OAAO;GACHC,IAAId,kBAAkB;IAAEe,QAAQZ,QAAQa;IAAaC,KAAKd,QAAQe;GAAS,CAAA;GAC3EC,cAAc;EAClB;CACJ,CAAA;CAEA,MAAMC,4BAAY,IAAIC,IAAAA;CACtB,KAAK,MAAMC,SAASZ,SAChB,IAAIY,MAAMC,WACNH,UAAUI,IAAIF,MAAMC,SAAS;CAIrC,MAAME,cAAc,MAAMC,gBAAgBvB,QAAQE,SAAS,CAAA,GAAIe,SAAAA,CAAU;CAEzE,OAAOV,QAAQiB,KAAKL,UAAAA;EAChB,MAAMM,WAAyB,CAAA;EAC/B,IAAIN,MAAMC,aAAaE,YAAYH,MAAMC,YACrCK,SAASC,KAAKJ,YAAYH,MAAMC,UAAU;EAG9C,OAAO;GACHd,YAAYa,MAAMb;GAClBmB,UAAUA,SAASE,SAAS,IAAIF,WAAWG,KAAAA;GAG3CC,aAAaV,MAAMU,eAAejC,WAAWkC;EACjD;CACJ,CAAA;AACJ;AAEA,eAAeP,gBACXrB,SACAe,WAAmB;CAEnB,IAAIA,UAAUU,WAAW,GACrB,OAAO,CAAC;CAGZ,MAAMI,mBAAmB,IAAIjC,iBAAiBI,OAAAA;CAC9C,MAAM8B,QAAQ,MAAMC,QAAQC,IACxBjB,UAAUO,KAAKb,OAAOoB,iBAAiBI,wBAAwBxB,EAAAA,CAAAA,CAC1DyB,MAAMC,SAAS,CAAC1B,IAAI0B,IAAAA,CAAK,CAAA,CAAA;CAGlC,MAAMC,SAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC3B,IAAI0B,SAASL,OACrB,IAAIK,MACAC,OAAO3B,MAAM0B;CAGrB,OAAOC;AACX"}

package/dist/app/modules/database/repositories/client/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/client/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AAYxF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,uBAAwB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,8BAA8B;IAKzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAkD3F,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IActE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+C3F,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM3E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7D,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY3E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAIrC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAI9C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAmBvD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;CAUzF"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/client/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AAYxF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,uBAAwB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,8BAA8B;IAKzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAqD3F,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAetE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgD3F,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM3E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7D,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY3E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAIrC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAI9C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAmBvD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;CAUzF"}

package/dist/app/modules/database/repositories/client/repository.mjs

@@ -6,9 +6,9 @@ import { ClientEntity } from "../../../../../adapters/database/domains/client/en
 import { ClientRoleEntity } from "../../../../../adapters/database/domains/client-role/entity.mjs";
 import { ClientPermissionEntity } from "../../../../../adapters/database/domains/client-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
+import { applyRealmScopeSelect, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
-import { translateWhereConditions } from "../helpers.mjs";
 import { loadBoundPermissions } from "../bindings.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";
@@ -40,6 +40,7 @@ var ClientRepositoryAdapter = class {
 					"base_url",
 					"root_url",
 					"redirect_uri",
+					"post_logout_redirect_uri",
 					"grant_types",
 					"scope",
 					"is_confidential",
@@ -68,6 +69,7 @@ var ClientRepositoryAdapter = class {
 				"updated_at"
 			] }
 		});
+		applyRealmScopeSelect(qb, "client", ["secret_hashed", "secret_encrypted"]);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
 			data: entities,
@@ -84,8 +86,9 @@ var ClientRepositoryAdapter = class {
 		const qb = this.repository.createQueryBuilder("client");
 		qb.where("client.name = :name", { name });
 		if (realmKey) {
-			const realm = await this.realmRepository.resolve(realmKey);
-			if (realm) qb.andWhere("client.realm_id = :realmId", { realmId: realm.id });
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return null;
+			qb.andWhere("client.realm_id = :realmId", { realmId });
 		}
 		return qb.getOne();
 	}
@@ -95,9 +98,9 @@ var ClientRepositoryAdapter = class {
 		else {
 			qb.where("client.name = :name", { name: id });
 			if (realmKey) {
-				const realm = await this.realmRepository.resolve(realmKey);
-				if (!realm) return null;
-				qb.andWhere("client.realm_id = :realmId", { realmId: realm.id });
+				const realmId = await this.realmRepository.resolveId(realmKey);
+				if (!realmId) return null;
+				qb.andWhere("client.realm_id = :realmId", { realmId });
 			}
 		}
 		applyQuery(qb, query || {}, {
@@ -115,6 +118,7 @@ var ClientRepositoryAdapter = class {
 					"base_url",
 					"root_url",
 					"redirect_uri",
+					"post_logout_redirect_uri",
 					"grant_types",
 					"scope",
 					"is_confidential",