@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/app/modules/config/read/env.mjs

@@ -5,6 +5,35 @@ import { ConfigEnvironmentVariableName } from "../constants.mjs";
 import { oneOf, read, readArray, readBool, readInt } from "envix";
 import { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from "typeorm-extension";
 //#region src/app/modules/config/read/env.ts
+const BOOLEAN_TRUE_VALUES = /* @__PURE__ */ new Set([
+	"true",
+	"t",
+	"1",
+	"yes",
+	"y",
+	"on"
+]);
+const BOOLEAN_FALSE_VALUES = /* @__PURE__ */ new Set([
+	"false",
+	"f",
+	"0",
+	"no",
+	"n",
+	"off"
+]);
+/**
+* Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead
+* of silently falling back to the default (envix's `readBool` swallows e.g.
+* `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent
+* default is a weakened posture. Returns `undefined` when the var is unset.
+*/ function readBoolStrict(name) {
+	const raw = read(name);
+	if (typeof raw !== "string" || raw.trim().length === 0) return;
+	const normalized = raw.trim().toLowerCase();
+	if (BOOLEAN_TRUE_VALUES.has(normalized)) return true;
+	if (BOOLEAN_FALSE_VALUES.has(normalized)) return false;
+	throw new Error(`The environment variable ${name} must be a boolean value (received "${raw}").`);
+}
 function readConfigRawFromEnv() {
 	const options = {};
 	const env = read(ConfigEnvironmentVariableName.NODE_ENV);
@@ -22,18 +51,54 @@ function readConfigRawFromEnv() {
 	if (typeof port !== "undefined") options.port = port;
 	const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);
 	if (publicURL) options.publicUrl = publicURL;
+	const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);
+	if (mtlsPublicURL) options.mtlsPublicUrl = mtlsPublicURL;
+	const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);
+	if (certificateSource) options.certificateSource = certificateSource;
 	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
 	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
 	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);
 	if (typeof tokenAccessMaxAge !== "undefined") options.tokenAccessMaxAge = tokenAccessMaxAge;
 	const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);
 	if (typeof tokenRefreshMaxAge !== "undefined") options.tokenRefreshMaxAge = tokenRefreshMaxAge;
+	const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);
+	if (typeof tokenRefreshGracePeriod !== "undefined") options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;
+	const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);
+	if (typeof promptLoginMaxAge !== "undefined") options.promptLoginMaxAge = promptLoginMaxAge;
+	const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);
+	if (typeof endSessionHintGracePeriod !== "undefined") options.endSessionHintGracePeriod = endSessionHintGracePeriod;
 	const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);
 	if (typeof registrationEnabled !== "undefined") options.registrationEnabled = registrationEnabled;
 	const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);
 	if (typeof emailVerificationEnabled !== "undefined") options.emailVerificationEnabled = emailVerificationEnabled;
 	const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);
 	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
+	const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);
+	if (typeof passwordMinLength !== "undefined") options.passwordMinLength = passwordMinLength;
+	const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);
+	if (typeof eventLogEnabled !== "undefined") options.eventLogEnabled = eventLogEnabled;
+	const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);
+	if (typeof eventLogRetentionDays !== "undefined") options.eventLogRetentionDays = eventLogRetentionDays;
+	const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);
+	if (typeof eventLogEntityEnabled !== "undefined") options.eventLogEntityEnabled = eventLogEntityEnabled;
+	const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);
+	if (typeof eventLogEntityRetentionDays !== "undefined") options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;
+	const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);
+	if (typeof loginAttemptThrottleEnabled !== "undefined") options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;
+	const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);
+	if (typeof loginAttemptThreshold !== "undefined") options.loginAttemptThreshold = loginAttemptThreshold;
+	const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);
+	if (typeof loginAttemptWindow !== "undefined") options.loginAttemptWindow = loginAttemptWindow;
+	const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);
+	if (typeof mfaEnabled !== "undefined") options.mfaEnabled = mfaEnabled;
+	const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);
+	if (typeof mfaRequired !== "undefined") options.mfaRequired = mfaRequired;
+	const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);
+	if (typeof mfaFreshnessMaxAge !== "undefined") options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;
+	const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);
+	if (typeof mfaTicketMaxAge !== "undefined") options.mfaTicketMaxAge = mfaTicketMaxAge;
+	const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);
+	if (secretsEncryptionKey) options.secretsEncryptionKey = secretsEncryptionKey;
 	const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);
 	if (typeof clientBasicAuth !== "undefined") options.clientAuthBasic = clientBasicAuth;
 	const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","trustedOrigins","TRUSTED_ORIGINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf, \n    read, \n    readArray, \n    readBool, \n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYtB,KAAKM,8BAA8BiB,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,iBAAiBxB,UAAUK,8BAA8BoB,eAAe;CAC9E,IAAID,kBAAkBA,eAAeE,SAAS,GAC1CnB,QAAQiB,iBAAiBA;CAG7B,MAAMG,oBAAoBzB,QAAQG,8BAA8BuB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BpB,QAAQoB,oBAAoBA;CAGhC,MAAME,qBAAqB3B,QAAQG,8BAA8ByB,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BtB,QAAQsB,qBAAqBA;CAGjC,MAAME,sBAAsB9B,SAASI,8BAA8B2B,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BxB,QAAQwB,sBAAsBA;CAGlC,MAAME,2BAA2BhC,SAASI,8BAA8B6B,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC1B,QAAQ0B,2BAA2BA;CAGvC,MAAME,0BAA0BlC,SAASI,8BAA8B+B,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAKtC,MAAME,kBAAkBpC,SAASI,8BAA8BiC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9B,QAAQgC,kBAAkBF;CAG9B,MAAMG,sBAAsBvC,SAASI,8BAA8BoC,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjC,QAAQiC,sBAAsBA;CAGlC,MAAME,oBAAoB3C,KAAKM,8BAA8BsC,oBAAoB;CACjF,IAAID,mBACAnC,QAAQqC,qBAAqBF;CAGjC,MAAMG,yBAAyB5C,SAASI,8BAA8ByC,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtC,QAAQwC,0BAA0BF;CAKtC,MAAMG,gBAAgB/C,SAASI,8BAA8B4C,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzC,QAAQ2C,gBAAgBF;CAG5B,MAAMG,mBAAmBlD,SAASI,8BAA8B+C,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5C,QAAQ4C,mBAAmBA;CAG/B,MAAME,oBAAoBtD,KAAKM,8BAA8BiD,mBAAmB;CAChF,IAAID,mBACA9C,QAAQ8C,oBAAoBA;CAGhC,MAAME,yBAAyBtD,SAASI,8BAA8BmD,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChD,QAAQgD,yBAAyBA;CAKrC,MAAME,iBAAiBxD,SAASI,8BAA8BqD,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BlD,QAAQoD,iBAAiBF;CAG7B,MAAMG,oBAAoB3D,SAASI,8BAA8BwD,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BrD,QAAQqD,oBAAoBA;CAGhC,MAAME,mBAAmB/D,KAAKM,8BAA8B0D,kBAAkB;CAC9E,IAAID,kBACAvD,QAAQuD,mBAAmBA;CAG/B,MAAME,wBAAwB/D,SAASI,8BAA8B4D,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjCzD,QAAQyD,wBAAwBA;CAKpC,MAAME,cAAclE,UAAUK,8BAA8B8D,WAAW;CACvE,IAAID,eAAeA,YAAYxC,SAAS,GACpCnB,QAAQ2D,cAAcA;CAG1B,MAAME,qCAAqCnE,SAASI,8BAA8BgE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C7D,QAAQ6D,qCAAqCA;CAGjD,OAAO7D;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;CAAK;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;CAAM;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAGhC,MAAME,iBAAiB1C,UAAUK,8BAA8BsC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe7B,SAAS,GAC1CO,QAAQsB,iBAAiBA;CAG7B,MAAME,oBAAoB1C,QAAQG,8BAA8BwC,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxB,QAAQwB,oBAAoBA;CAGhC,MAAME,qBAAqB5C,QAAQG,8BAA8B0C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B1B,QAAQ0B,qBAAqBA;CAGjC,MAAME,0BAA0B9C,QAAQG,8BAA8B4C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAGtC,MAAME,oBAAoBhD,QAAQG,8BAA8B8C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B9B,QAAQ8B,oBAAoBA;CAGhC,MAAME,4BAA4BlD,QAAQG,8BAA8BgD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrChC,QAAQgC,4BAA4BA;CAGxC,MAAME,sBAAsBrD,SAASI,8BAA8BkD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BlC,QAAQkC,sBAAsBA;CAGlC,MAAME,2BAA2BvD,SAASI,8BAA8BoD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCpC,QAAQoC,2BAA2BA;CAGvC,MAAME,0BAA0BzD,SAASI,8BAA8BsD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAKhC,MAAME,kBAAkBrD,eAAeJ,8BAA8B0D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B1C,QAAQ0C,kBAAkBA;CAG9B,MAAME,wBAAwB9D,QAAQG,8BAA8B4D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC5C,QAAQ4C,wBAAwBA;CAGpC,MAAME,wBAAwBzD,eAAeJ,8BAA8B8D,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,8BAA8BlE,QAAQG,8BAA8BgE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvChD,QAAQgD,8BAA8BA;CAG1C,MAAME,8BAA8B7D,eAAeJ,8BAA8BkE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,wBAAwBtE,QAAQG,8BAA8BoE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAGpC,MAAME,qBAAqBxE,QAAQG,8BAA8BsE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BtD,QAAQsD,qBAAqBA;CAKjC,MAAME,aAAanE,eAAeJ,8BAA8BwE,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBxD,QAAQwD,aAAaA;CAGzB,MAAME,cAAcrE,eAAeJ,8BAA8B0E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB1D,QAAQ0D,cAAcA;CAG1B,MAAME,qBAAqB9E,QAAQG,8BAA8B4E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5D,QAAQ4D,qBAAqBA;CAGjC,MAAME,kBAAkBhF,QAAQG,8BAA8B8E,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9D,QAAQ8D,kBAAkBA;CAG9B,MAAME,uBAAuBrF,KAAKM,8BAA8BgF,sBAAsB;CACtF,IAAID,sBACAhE,QAAQgE,uBAAuBA;CAKnC,MAAME,kBAAkBrF,SAASI,8BAA8BkF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BlE,QAAQoE,kBAAkBF;CAG9B,MAAMG,sBAAsBxF,SAASI,8BAA8BqF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BrE,QAAQqE,sBAAsBA;CAGlC,MAAME,oBAAoB5F,KAAKM,8BAA8BuF,oBAAoB;CACjF,IAAID,mBACAvE,QAAQyE,qBAAqBF;CAGjC,MAAMG,yBAAyB7F,SAASI,8BAA8B0F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC1E,QAAQ4E,0BAA0BF;CAKtC,MAAMG,gBAAgBhG,SAASI,8BAA8B6F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB7E,QAAQ+E,gBAAgBF;CAG5B,MAAMG,mBAAmBnG,SAASI,8BAA8BgG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BhF,QAAQgF,mBAAmBA;CAG/B,MAAME,oBAAoBvG,KAAKM,8BAA8BkG,mBAAmB;CAChF,IAAID,mBACAlF,QAAQkF,oBAAoBA;CAGhC,MAAME,yBAAyBvG,SAASI,8BAA8BoG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCpF,QAAQoF,yBAAyBA;CAKrC,MAAME,iBAAiBzG,SAASI,8BAA8BsG,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BtF,QAAQwF,iBAAiBF;CAG7B,MAAMG,oBAAoB5G,SAASI,8BAA8ByG,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BzF,QAAQyF,oBAAoBA;CAGhC,MAAME,mBAAmBhH,KAAKM,8BAA8B2G,kBAAkB;CAC9E,IAAID,kBACA3F,QAAQ2F,mBAAmBA;CAG/B,MAAME,wBAAwBhH,SAASI,8BAA8B6G,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjC7F,QAAQ6F,wBAAwBA;CAKpC,MAAME,cAAcnH,UAAUK,8BAA8B+G,WAAW;CACvE,IAAID,eAAeA,YAAYtG,SAAS,GACpCO,QAAQ+F,cAAcA;CAG1B,MAAME,qCAAqCpH,SAASI,8BAA8BiH,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CjG,QAAQiG,qCAAqCA;CAGjD,OAAOjG;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -8,6 +8,7 @@ import type { UIOptions as SwaggerUIOptions } from '@routup/swagger-ui';
 import type { Options as BodyOptions } from '@routup/basic/body';
 import type { DataSourceOptions } from 'typeorm';
 import type { SMTPOptions } from '../mail/adapter/smtp/types.ts';
+import type { CertificateSource } from '../../../adapters/http/request/index.ts';
 export type Config = {
     /**
      * Application environment (e.g., 'production').
@@ -56,6 +57,20 @@ export type Config = {
      * default: http://localhost:3001
      */
     publicUrl: string;
+    /**
+     * Optional externally reachable base URL dedicated to endpoints that
+     * request TLS client certificates. Published as RFC 8705 mTLS endpoint
+     * aliases. The reverse proxy may route it to the same backend listener.
+     * default: null
+     */
+    mtlsPublicUrl: string | null;
+    /**
+     * Trusted-proxy client-certificate header contract. Enabling a source
+     * asserts that the backend listener is reachable only through a proxy that
+     * removes or overwrites the selected headers.
+     * default: disabled
+     */
+    certificateSource: CertificateSource;
     /**
      * Trusted first-party app origins (besides publicUrl) — used as
      * redirect targets for the per-realm public `web` client. Does NOT
@@ -119,10 +134,33 @@ export type Config = {
      */
     tokenRefreshMaxAge: number;
     /**
-     * Access token validity in seconds (default: 3600s / 1 hour).
-     * default: 3_600s (1h)
+     * Access token validity in seconds (default: 900s / 15 minutes).
+     * default: 900s (15min)
      */
     tokenAccessMaxAge: number;
+    /**
+     * Grace period (seconds) during which a just-rotated (consumed) refresh
+     * token is still accepted, minting new chain-linked tokens instead of
+     * triggering replay detection. Absorbs multi-tab / mobile refresh races.
+     * default: 0 (strict — first-use-wins)
+     */
+    tokenRefreshGracePeriod: number;
+    /**
+     * Max age (seconds) of the authentication that a `prompt=login` / `max_age`
+     * authorize request accepts before forcing re-authentication. A stateless
+     * approximation judged against the session's created_at.
+     * default: 60s
+     */
+    promptLoginMaxAge: number;
+    /**
+     * Seconds past its `exp` an (expired) `id_token_hint` presented at the
+     * RP-initiated logout endpoint (`/logout`) is still accepted for a
+     * server-side session revoke. Bounds how long a leaked id_token stays a
+     * replayable remote logout; beyond the window the click-gated confirm
+     * page still works.
+     * default: 0 (unbounded — spec/Keycloak parity)
+     */
+    endSessionHintGracePeriod: number;
     /**
      * Enable user registration?
      * default: false
@@ -138,6 +176,98 @@ export type Config = {
      * default: false
      */
     passwordRecoveryEnabled: boolean;
+    /**
+     * Minimum length for user-chosen passwords (user create/update,
+     * registration, password reset). The maximum is fixed at 512.
+     * default: 10
+     */
+    passwordMinLength: number;
+    /**
+     * Persist security audit events (login, authorize, replay detection, ...)
+     * to the auth_events table. When disabled only the structured log line
+     * is emitted.
+     * default: true
+     */
+    eventLogEnabled: boolean;
+    /**
+     * Per-row retention for persisted audit events in days (stamped as
+     * expires_at at write time, swept by the event cleaner). Raise it for
+     * longer compliance windows; 0 = keep forever.
+     * default: 90
+     */
+    eventLogRetentionDays: number;
+    /**
+     * Additionally mirror every entity create/update/delete published on the
+     * domain-event bus into the auth_events table (scope: entity). Only
+     * effective while eventLogEnabled is true.
+     * default: true
+     */
+    eventLogEntityEnabled: boolean;
+    /**
+     * Per-row retention for entity-CRUD audit events in days — deliberately
+     * short so entity churn self-prunes. 0 = keep forever.
+     * default: 7
+     */
+    eventLogEntityRetentionDays: number;
+    /**
+     * Throttle failed interactive logins per (identifier, ip) pair by
+     * counting recent loginFailed audit events. Requires eventLogEnabled.
+     * default: false
+     */
+    loginAttemptThrottleEnabled: boolean;
+    /**
+     * Failed attempts per (identifier, ip) pair within the window before
+     * the pair is throttled.
+     * default: 5
+     */
+    loginAttemptThreshold: number;
+    /**
+     * Sliding throttle window in seconds.
+     * default: 900
+     */
+    loginAttemptWindow: number;
+    /**
+     * Optional base64-encoded 32-byte KEK (AES-256-GCM) wrapping the realm
+     * key store's material at rest (auth_keys.decryption_key — realm
+     * signing private keys and the per-realm enc keys the MFA seed cipher
+     * rides). Unset = material persists unwrapped (Keycloak/authentik
+     * parity); setting it later wraps rows lazily on read, removing it
+     * while wrapped rows exist fails loud at first use.
+     * default: '' (unset)
+     */
+    secretsEncryptionKey: string;
+    /**
+     * Org-wide multi-factor authentication feature toggle. When enabled,
+     * users can enroll authenticator devices, and a user holding a
+     * confirmed device must present a second factor on interactive
+     * authorization and the password grant.
+     * default: false
+     */
+    mfaEnabled: boolean;
+    /**
+     * Enforce MFA for every user: a user without a confirmed device is
+     * routed to inline enrollment at next interactive login
+     * (configure-inline). Requires mfaEnabled.
+     * default: false
+     */
+    mfaRequired: boolean;
+    /**
+     * Max age (seconds) of the session's second-factor proof (mfa_at) an
+     * `acr_values=urn:authup:mfa` step-up request accepts before forcing
+     * a fresh challenge. Mirrors promptLoginMaxAge's semantics (the
+     * window absorbs the hosted challenge round-trip).
+     * default: 60
+     */
+    mfaFreshnessMaxAge: number;
+    /**
+     * Lifetime (seconds) of the "MFA-pending" login ticket the password
+     * grant issues when the second factor cannot ride the single POST
+     * (email / WebAuthn) — and of the pending session backing it (extended
+     * to the full session lifetime on completion). Sized to cover the
+     * email-OTP window (code expiry: 10 minutes).
+     * default: 600
+     */
+    mfaTicketMaxAge: number;
     /**
      * default: false
      */

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAuFhC"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAgHhC"}

package/dist/app/modules/config/validator.mjs

@@ -2,7 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { expandToOrigins } from "./origins.mjs";
+import { CERTIFICATE_SOURCES } from "../../../adapters/http/request/constants.mjs";
+import "../../../adapters/http/request/index.mjs";
 import { isObject } from "@authup/kit";
+import { USER_PASSWORD_MAX_LENGTH } from "@authup/core-kit";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
@@ -27,6 +30,8 @@ var ConfigValidator = class extends Container {
 			port: nonNegativeNumberValidator,
 			host: stringValidator,
 			publicUrl: createValidator(z.url()),
+			mtlsPublicUrl: createValidator(z.url().nullable()),
+			certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),
 			trustedOrigins: createValidator(z.array(z.string().refine((value) => {
 				try {
 					expandToOrigins(value);
@@ -44,9 +49,25 @@ var ConfigValidator = class extends Container {
 			middlewareSwagger: booleanValidator,
 			tokenAccessMaxAge: nonNegativeNumberValidator,
 			tokenRefreshMaxAge: nonNegativeNumberValidator,
+			tokenRefreshGracePeriod: nonNegativeNumberValidator,
+			promptLoginMaxAge: nonNegativeNumberValidator,
+			endSessionHintGracePeriod: nonNegativeNumberValidator,
 			registrationEnabled: booleanValidator,
 			emailVerificationEnabled: booleanValidator,
 			passwordRecoveryEnabled: booleanValidator,
+			passwordMinLength: createValidator(z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH)),
+			eventLogEnabled: booleanValidator,
+			eventLogRetentionDays: nonNegativeNumberValidator,
+			eventLogEntityEnabled: booleanValidator,
+			eventLogEntityRetentionDays: nonNegativeNumberValidator,
+			loginAttemptThrottleEnabled: booleanValidator,
+			loginAttemptThreshold: createValidator(z.number().int().positive()),
+			loginAttemptWindow: createValidator(z.number().int().positive()),
+			secretsEncryptionKey: createValidator(z.union([z.literal(""), z.base64()])),
+			mfaEnabled: booleanValidator,
+			mfaRequired: booleanValidator,
+			mfaFreshnessMaxAge: nonNegativeNumberValidator,
+			mfaTicketMaxAge: createValidator(z.number().int().positive()),
 			clientAuthBasic: booleanValidator,
 			clientSystemEnabled: booleanValidator,
 			clientSystemSecret: secretValidator,

package/dist/app/modules/config/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["isObject","createValidator","Container","z","expandToOrigins","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            robotAuthBasic: booleanValidator,\n            robotAdminEnabled: booleanValidator,\n            robotAdminSecret: secretValidator,\n            robotAdminSecretReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,kBAAb,cAAqCH,UAAAA;CACdI,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBN,gBAAgBE,EAAEK,OAAM,CAAA;EAChD,MAAMC,mBAAmBR,gBAAgBE,EAAEO,QAAO,CAAA;EAClD,MAAMC,6BAA6BV,gBAAgBE,EAAES,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBb,gBAAgBE,EAAEK,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBhB,gBACxBE,EAAEO,QAAO,CAAA,CAAGQ,GAAGf,EAAEgB,OAAOhB,EAAEK,OAAM,GAAIL,EAAEiB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBpB,gBACrBE,EAAEK,OAAM,CAAA,CACHU,GAAGf,EAAEO,QAAO,CAAA,CAAA,CACZQ,GAAGf,EAAEmB,QAA6BC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI5B,gBACAE,EAAEmB,QACGC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWjC,gBAAgBE,EAAEgC,IAAG,CAAA;GAChCC,gBAAgBnC,gBACZE,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAG8B,QAAQf,UAAAA;IACvB,IAAI;KACAnB,gBAAgBmB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPgB,gBAAgBtB;GAChBuB,gBAAgBvB;GAChBwB,kBAAkBxB;GAClByB,iBAAiBzB;GACjB0B,sBAAsB1B;GACtB2B,qBAAqB3B;GACrB4B,mBAAmBpC;GAEnBqC,mBAAmBnC;GACnBoC,oBAAoBpC;GACpBqC,qBAAqBvC;GACrBwC,0BAA0BxC;GAC1ByC,yBAAyBzC;GAEzB0C,iBAAiB1C;GACjB2C,qBAAqB3C;GACrB4C,oBAAoBvC;GACpBwC,yBAAyB7C;GAEzB8C,eAAe9C;GACf+C,kBAAkB/C;GAClBgD,mBAAmB3C;GACnB4C,wBAAwBjD;GAExBkD,gBAAgBlD;GAChBmD,mBAAmBnD;GACnBoD,kBAAkB/C;GAClBgD,uBAAuBrD;GAEvBsD,aAAa9D,gBACTE,EAAEK,OAAM,CAAA,CAAGU,GAAGf,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAA,CAAA;GAElCwD,oCAAoCvD;EACxC;EAEA,MAAMwD,OAAOC,OAAOD,KAAKzC,UAAAA;EACzB,KAAK,MAAM2C,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAG7C,WAAW2C,IAAI;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","int","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","union","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            robotAuthBasic: booleanValidator,\n            robotAdminEnabled: booleanValidator,\n            robotAdminSecret: secretValidator,\n            robotAdminSecretReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,IAAaO,kBAAb,cAAqCJ,UAAAA;CACdK,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBP,gBAAgBE,EAAEM,OAAM,CAAA;EAChD,MAAMC,mBAAmBT,gBAAgBE,EAAEQ,QAAO,CAAA;EAClD,MAAMC,6BAA6BX,gBAAgBE,EAAEU,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBd,gBAAgBE,EAAEM,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBjB,gBACxBE,EAAEQ,QAAO,CAAA,CAAGQ,GAAGhB,EAAEiB,OAAOjB,EAAEM,OAAM,GAAIN,EAAEkB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBrB,gBACrBE,EAAEM,OAAM,CAAA,CACHU,GAAGhB,EAAEQ,QAAO,CAAA,CAAA,CACZQ,GAAGhB,EAAEoB,QAA6BC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI7B,gBACAE,EAAEoB,QACGC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWlC,gBAAgBE,EAAEiC,IAAG,CAAA;GAChCC,eAAepC,gBAAgBE,EAAEiC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBtC,gBAAgBE,EAAEqC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,gBAAgBxC,gBACZE,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAGkC,QAAQnB,UAAAA;IACvB,IAAI;KACApB,gBAAgBoB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPoB,gBAAgB1B;GAChB2B,gBAAgB3B;GAChB4B,kBAAkB5B;GAClB6B,iBAAiB7B;GACjB8B,sBAAsB9B;GACtB+B,qBAAqB/B;GACrBgC,mBAAmBxC;GAEnByC,mBAAmBvC;GACnBwC,oBAAoBxC;GACpByC,yBAAyBzC;GACzB0C,mBAAmB1C;GACnB2C,2BAA2B3C;GAC3B4C,qBAAqB9C;GACrB+C,0BAA0B/C;GAC1BgD,yBAAyBhD;GACzBiD,mBAAmB1D,gBACfE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA,CAAG5C,IAAIlB,wBAAAA,CAAAA;GAGpC+D,iBAAiBpD;GACjBqD,uBAAuBnD;GACvBoD,uBAAuBtD;GACvBuD,6BAA6BrD;GAC7BsD,6BAA6BxD;GAC7ByD,uBAAuBlE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAChEO,oBAAoBnE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAI7DQ,sBAAsBpE,gBAAgBE,EAAEmE,MAAM,CAACnE,EAAEoE,QAAQ,EAAA,GAAKpE,EAAEqE,OAAM,CAAA,CAAG,CAAA;GAEzEC,YAAY/D;GACZgE,aAAahE;GACbiE,oBAAoB/D;GACpBgE,iBAAiB3E,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAE1DgB,iBAAiBnE;GACjBoE,qBAAqBpE;GACrBqE,oBAAoBhE;GACpBiE,yBAAyBtE;GAEzBuE,eAAevE;GACfwE,kBAAkBxE;GAClByE,mBAAmBpE;GACnBqE,wBAAwB1E;GAExB2E,gBAAgB3E;GAChB4E,mBAAmB5E;GACnB6E,kBAAkBxE;GAClByE,uBAAuB9E;GAEvB+E,aAAaxF,gBACTE,EAAEM,OAAM,CAAA,CAAGU,GAAGhB,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAA,CAAA;GAElCiF,oCAAoChF;EACxC;EAEA,MAAMiF,OAAOC,OAAOD,KAAKlE,UAAAA;EACzB,KAAK,MAAMoE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGtE,WAAWoE,IAAI;CAE3D;AACJ"}

package/dist/app/modules/database/constants.d.ts

@@ -1,8 +1,11 @@
 import type { IDomainEventPublisher } from '@authup/server-kit';
 import type { DataSource } from 'typeorm';
 import { TypedToken } from 'eldin';
+import type { IEventRepository, IEventService } from '../../../core/index.ts';
 export declare const DatabaseInjectionKey: {
     readonly DataSource: TypedToken<DataSource>;
     readonly DomainEventPublisher: TypedToken<IDomainEventPublisher>;
+    readonly EventRepository: TypedToken<IEventRepository>;
+    readonly EventService: TypedToken<IEventService>;
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/database/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnC,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE9E,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC"}

package/dist/app/modules/database/constants.mjs

@@ -5,7 +5,9 @@ import { TypedToken } from "eldin";
 //#region src/app/modules/database/constants.ts
 const DatabaseInjectionKey = {
 	DataSource: new TypedToken("DataSource"),
-	DomainEventPublisher: new TypedToken("DomainEventPublisher")
+	DomainEventPublisher: new TypedToken("DomainEventPublisher"),
+	EventRepository: new TypedToken("EventRepository"),
+	EventService: new TypedToken("EventService")
 };
 //#endregion
 export { DatabaseInjectionKey };

package/dist/app/modules/database/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","DatabaseInjectionKey","DataSource","DomainEventPublisher"],"sources":["../../../../src/app/modules/database/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IDomainEventPublisher } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { TypedToken } from 'eldin';\n\nexport const DatabaseInjectionKey = {\n    DataSource: new TypedToken<DataSource>('DataSource'),\n    DomainEventPublisher: new TypedToken<IDomainEventPublisher>('DomainEventPublisher'),\n} as const;\n"],"mappings":";;;;;AAWA,MAAaC,uBAAuB;CAChCC,YAAY,IAAIF,WAAuB,YAAA;CACvCG,sBAAsB,IAAIH,WAAkC,sBAAA;AAChE"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","DatabaseInjectionKey","DataSource","DomainEventPublisher","EventRepository","EventService"],"sources":["../../../../src/app/modules/database/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IDomainEventPublisher } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { TypedToken } from 'eldin';\nimport type { IEventRepository, IEventService } from '../../../core/index.ts';\n\nexport const DatabaseInjectionKey = {\n    DataSource: new TypedToken<DataSource>('DataSource'),\n    DomainEventPublisher: new TypedToken<IDomainEventPublisher>('DomainEventPublisher'),\n    EventRepository: new TypedToken<IEventRepository>('EventRepository'),\n    EventService: new TypedToken<IEventService>('EventService'),\n} as const;\n"],"mappings":";;;;;AAYA,MAAaC,uBAAuB;CAChCC,YAAY,IAAIF,WAAuB,YAAA;CACvCG,sBAAsB,IAAIH,WAAkC,sBAAA;CAC5DI,iBAAiB,IAAIJ,WAA6B,iBAAA;CAClDK,cAAc,IAAIL,WAA0B,cAAA;AAChD"}

package/dist/app/modules/database/index.mjs

@@ -1,14 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { DatabaseInjectionKey } from "./constants.mjs";
-import { DatabaseModule } from "./module.mjs";
 import { RealmRepositoryAdapter } from "./repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "./repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "./repositories/client-role/repository.mjs";
 import { ClientScopeRepositoryAdapter } from "./repositories/client-scope/repository.mjs";
+import { EventRepositoryAdapter } from "./repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./repositories/identity-provider/repository.mjs";
+import { KeyRepositoryAdapter } from "./repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./repositories/permission-provider/module.mjs";
@@ -20,10 +20,14 @@ import { RoleRepositoryAdapter } from "./repositories/role/repository.mjs";
 import { RoleAttributeRepositoryAdapter } from "./repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "./repositories/scope/repository.mjs";
+import { TrustAnchorRepositoryAdapter } from "./repositories/trust-anchor/repository.mjs";
 import { UserRepositoryAdapter } from "./repositories/user/repository.mjs";
 import { UserAttributeRepositoryAdapter } from "./repositories/user-attribute/repository.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "./repositories/user-authenticator/repository.mjs";
 import { UserPermissionRepositoryAdapter } from "./repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "./repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./repositories/identity-provider-role-mapping/repository.mjs";
 import "./repositories/index.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, UserAttributeRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+import { DatabaseInjectionKey } from "./constants.mjs";
+import { DatabaseModule } from "./module.mjs";
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, EventRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };

package/dist/app/modules/database/module.d.ts

@@ -20,6 +20,7 @@ export declare class DatabaseModule implements IModule {
     constructor(options?: DatabaseModuleOptions);
     setup(container: IContainer): Promise<void>;
     teardown(container: IContainer): Promise<void>;
+    protected disposeEventPublisher(): Promise<void>;
     protected setupDatabase(container: IContainer, options: DataSourceOptions): Promise<void>;
     protected migrate(container: IContainer, dataSource: DataSource): Promise<void>;
     /**
@@ -30,5 +31,6 @@ export declare class DatabaseModule implements IModule {
     protected buildDataSourceOptions(container: IContainer): Promise<DataSourceOptions>;
     protected registerRepositories(container: IContainer, dataSource: DataSource): void;
     protected registerEventPublisher(container: IContainer, dataSource: DataSource): void;
+    protected registerEvents(container: IContainer, dataSource: DataSource): void;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/database/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/module.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,oBAAoB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,SAAS,CAAC;AAMtD,OAAO,EACH,wBAAwB,EAK3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAGxC,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,cAAc,EAAG,wBAAwB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,gBAAgB,CAAC,EAAG,WAAW,CAAC;IAE1C,SAAS,CAAC,cAAc,CAAC,EAAG,oBAAoB,CAAC;gBAErC,OAAO,GAAE,qBAA0B;IAQzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAuBpC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;cAgB/E,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrF;;;;OAIG;cACa,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,iBAAiB,CAAC;IAgC1F,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAI,IAAI;IAiBpF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAyBjF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/module.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,oBAAoB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,SAAS,CAAC;AAMtD,OAAO,EACH,wBAAwB,EAM3B,MAAM,qCAAqC,CAAC;AAM7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAGxC,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,cAAc,EAAG,wBAAwB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,gBAAgB,CAAC,EAAG,WAAW,CAAC;IAE1C,SAAS,CAAC,cAAc,CAAC,EAAG,oBAAoB,CAAC;gBAErC,OAAO,GAAE,qBAA0B;IAQzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAiBpC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;cActC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;cAgB/E,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrF;;;;OAIG;cACa,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,iBAAiB,CAAC;IAgC1F,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAI,IAAI;IAiBpF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAkC9E,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAmBzE"}