@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/http/request/client-certificate.mjs

@@ -0,0 +1,88 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildClientCertificateThumbprint, parseClientCertificateChain } from "../../../core/client-certificate/module.mjs";
+import "../../../core/index.mjs";
+import { base64ToArrayBuffer } from "@authup/kit";
+import { BadRequestError } from "@authup/errors";
+import { X509Certificate } from "@peculiar/x509";
+//#region src/adapters/http/request/client-certificate.ts
+const MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;
+const MAX_CERTIFICATE_CHAIN_LENGTH = 10;
+const STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;
+async function extractClientCertificateEvidence(event, source) {
+	if (source === "disabled") return;
+	let result;
+	if (source === "standard") result = extractStandardEvidence(event);
+	else if (source === "forwarded") result = extractForwardedEvidence(event);
+	else throw new BadRequestError("The client certificate source is not configured correctly.");
+	if (!result) return;
+	return {
+		...result,
+		thumbprint: await buildClientCertificateThumbprint(result.certificate)
+	};
+}
+function extractStandardEvidence(event) {
+	const leafHeader = event.headers.get("client-cert");
+	const chainHeader = event.headers.get("client-cert-chain");
+	if (!leafHeader) {
+		if (chainHeader) throw certificateHeaderError();
+		return;
+	}
+	assertHeaderLength(leafHeader);
+	return {
+		certificate: parseStructuredCertificate(leafHeader),
+		chain: chainHeader ? parseStructuredCertificateList(chainHeader) : []
+	};
+}
+function extractForwardedEvidence(event) {
+	const value = event.headers.get("x-forwarded-tls-client-cert");
+	if (!value) return;
+	assertHeaderLength(value);
+	let pem;
+	try {
+		pem = value.includes("-----BEGIN CERTIFICATE-----") ? value : decodeURIComponent(value.replace(/\+/g, "%20"));
+	} catch {
+		throw certificateHeaderError();
+	}
+	let certificates;
+	try {
+		certificates = parseClientCertificateChain(pem);
+	} catch {
+		throw certificateHeaderError();
+	}
+	if (certificates.length !== 1 || !certificates[0]) throw certificateHeaderError();
+	return {
+		certificate: certificates[0],
+		chain: []
+	};
+}
+function parseStructuredCertificateList(value) {
+	assertHeaderLength(value);
+	const items = value.split(",").map((item) => item.trim());
+	if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) throw certificateHeaderError();
+	return items.map(parseStructuredCertificate);
+}
+function parseStructuredCertificate(value) {
+	const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());
+	if (!match?.[1]) throw certificateHeaderError();
+	try {
+		const raw = base64ToArrayBuffer(match[1]);
+		if (raw.byteLength === 0) throw certificateHeaderError();
+		const certificate = new X509Certificate(raw);
+		if (certificate.toString("base64").replace(/=+$/, "") !== match[1].replace(/=+$/, "")) throw certificateHeaderError();
+		return certificate;
+	} catch {
+		throw certificateHeaderError();
+	}
+}
+function assertHeaderLength(value) {
+	if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) throw certificateHeaderError();
+}
+function certificateHeaderError() {
+	return new BadRequestError("The forwarded client certificate header is malformed.");
+}
+//#endregion
+export { extractClientCertificateEvidence };
+
+//# sourceMappingURL=client-certificate.mjs.map

package/dist/adapters/http/request/client-certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n    buildClientCertificateThumbprint,\n    parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    if (source === 'disabled') {\n        return undefined;\n    }\n\n    let result: Omit<ClientCertificateEvidence, 'thumbprint'> | undefined;\n    if (source === 'standard') {\n        result = extractStandardEvidence(event);\n    } else if (source === 'forwarded') {\n        result = extractForwardedEvidence(event);\n    } else {\n        throw new BadRequestError('The client certificate source is not configured correctly.');\n    }\n    if (!result) {\n        return undefined;\n    }\n\n    return {\n        ...result,\n        thumbprint: await buildClientCertificateThumbprint(result.certificate),\n    };\n}\n\nfunction extractStandardEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const leafHeader = event.headers.get('client-cert');\n    const chainHeader = event.headers.get('client-cert-chain');\n\n    if (!leafHeader) {\n        if (chainHeader) {\n            throw certificateHeaderError();\n        }\n        return undefined;\n    }\n\n    assertHeaderLength(leafHeader);\n    const certificate = parseStructuredCertificate(leafHeader);\n    const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n    return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const value = event.headers.get('x-forwarded-tls-client-cert');\n    if (!value) {\n        return undefined;\n    }\n\n    assertHeaderLength(value);\n\n    let pem: string;\n    try {\n        // Native raw PEM is useful in tests and a few proxy integrations. The\n        // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n        // space, while literal base64 plus signs arrive as `%2B`.\n        pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n            value :\n            decodeURIComponent(value.replace(/\\+/g, '%20'));\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    let certificates: X509Certificate[];\n    try {\n        certificates = parseClientCertificateChain(pem);\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    if (certificates.length !== 1 || !certificates[0]) {\n        throw certificateHeaderError();\n    }\n\n    return {\n        certificate: certificates[0],\n        chain: [],\n    };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n    assertHeaderLength(value);\n    const items = value.split(',').map((item) => item.trim());\n    if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) {\n        throw certificateHeaderError();\n    }\n\n    return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n    const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n    if (!match?.[1]) {\n        throw certificateHeaderError();\n    }\n\n    try {\n        const raw = base64ToArrayBuffer(match[1]);\n        if (raw.byteLength === 0) {\n            throw certificateHeaderError();\n        }\n\n        const certificate = new X509Certificate(raw);\n        if (\n            certificate.toString('base64').replace(/=+$/, '') !==\n            match[1].replace(/=+$/, '')\n        ) {\n            throw certificateHeaderError();\n        }\n\n        return certificate;\n    } catch {\n        throw certificateHeaderError();\n    }\n}\n\nfunction assertHeaderLength(value: string): void {\n    if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n        throw certificateHeaderError();\n    }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n    return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;AAkBA,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}

package/dist/adapters/http/request/constants.d.ts

@@ -5,4 +5,5 @@ export declare enum RequestHandlerOperation {
     UPDATE = "update",
     DELETE = "delete"
 }
+export declare const CERTIFICATE_SOURCES: readonly ["disabled", "standard", "forwarded"];
 //# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/request/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB;AAED,eAAO,MAAM,mBAAmB,gDAItB,CAAC"}

package/dist/adapters/http/request/constants.mjs

@@ -10,7 +10,12 @@ var RequestHandlerOperation = /*#__PURE__*/ function(RequestHandlerOperation) {
 	RequestHandlerOperation["DELETE"] = "delete";
 	return RequestHandlerOperation;
 }({});
+const CERTIFICATE_SOURCES = [
+	"disabled",
+	"standard",
+	"forwarded"
+];
 //#endregion
-export { RequestHandlerOperation };
+export { CERTIFICATE_SOURCES, RequestHandlerOperation };
 
 //# sourceMappingURL=constants.mjs.map

package/dist/adapters/http/request/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n    'disabled',\n    'standard',\n    'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA;;AAQZ,MAAaC,sBAAsB;CAC/B;CACA;CACA"}

package/dist/adapters/http/request/event-context.d.ts

@@ -0,0 +1,19 @@
+import type { Handler } from 'routup';
+import type { EventRequestContext } from '../../../core/index.ts';
+/**
+ * Actor + request attribution snapshot for entity-CRUD audit rows, carried
+ * across the request's async continuation via AsyncLocalStorage so the
+ * database subscribers (which have no request handle) can attribute their
+ * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —
+ * the getter returns undefined, the correct "system" semantics.
+ */
+export type RequestEventContext = EventRequestContext;
+export declare function runWithRequestEventContext<R>(ctx: RequestEventContext, fn: () => R): R;
+export declare function useRequestEventContext(): RequestEventContext | undefined;
+/**
+ * Builds the {@link RequestEventContext} from the routup event and wraps the
+ * downstream pipeline in it. Must be mounted AFTER the authorization
+ * middleware — the identity has to be resolved for actor attribution.
+ */
+export declare function createRequestEventContextMiddleware(): Handler;
+//# sourceMappingURL=event-context.d.ts.map

package/dist/adapters/http/request/event-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-context.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/event-context.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAItD,wBAAgB,0BAA0B,CAAC,CAAC,EACxC,GAAG,EAAE,mBAAmB,EACxB,EAAE,EAAE,MAAM,CAAC,GACZ,CAAC,CAEH;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,IAAK,OAAO,CAgB9D"}

package/dist/adapters/http/request/event-context.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "./helpers/identity.mjs";
+import "./helpers/index.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { defineCoreHandler, getRequestHeader, getRequestIP } from "routup";
+//#region src/adapters/http/request/event-context.ts
+const storage = new AsyncLocalStorage();
+function runWithRequestEventContext(ctx, fn) {
+	return storage.run(ctx, fn);
+}
+function useRequestEventContext() {
+	return storage.getStore();
+}
+/**
+* Builds the {@link RequestEventContext} from the routup event and wraps the
+* downstream pipeline in it. Must be mounted AFTER the authorization
+* middleware — the identity has to be resolved for actor attribution.
+*/ function createRequestEventContextMiddleware() {
+	return defineCoreHandler(async (event) => {
+		const identity = useRequestIdentity(event);
+		return runWithRequestEventContext({
+			actorType: identity ? identity.type : null,
+			actorId: identity ? identity.id : null,
+			actorName: identity ? identity.data.name ?? null : null,
+			requestPath: event.path,
+			requestMethod: event.method,
+			requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			requestUserAgent: getRequestHeader(event, "user-agent") ?? null
+		}, () => event.next());
+	});
+}
+//#endregion
+export { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext };
+
+//# sourceMappingURL=event-context.mjs.map

package/dist/adapters/http/request/event-context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","requestPath","path","requestMethod","method","requestIpAddress","trustProxy","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAMK,UAAU,IAAIL,kBAAAA;AAEpB,SAAgBM,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOX,kBAAkB,OAAOY,UAAAA;EAC5B,MAAMC,WAAWV,mBAAmBS,KAAAA;EAYpC,OAAOP,2BAA2BC;GAT9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,aAAaT,MAAMU;GACnBC,eAAeX,MAAMY;GACrBC,kBAAkBvB,aAAaU,OAAO,EAAEc,YAAY,KAAK,CAAA,KAAM;GAC/DC,kBAAkB1B,iBAAiBW,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMgB,KAAI,CAAA;CAC3D,CAAA;AACJ"}

package/dist/adapters/http/request/helpers/index.d.ts

@@ -3,6 +3,7 @@ export * from './body-realm-id.ts';
 export * from './identity.ts';
 export * from './locale.ts';
 export * from './locations.ts';
+export * from './mfa-login-ticket.ts';
 export * from './param-id.ts';
 export * from './realm-id.ts';
 export * from './redirect.ts';

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -6,10 +6,11 @@ import { buildActorContext } from "./actor.mjs";
 import { getBodyRealmID } from "./body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./locale.mjs";
 import { readFromLocations } from "./locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./session-id.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/helpers/mfa-login-ticket.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IAppEvent } from 'routup';
+import type { RequestIdentity } from './identity.ts';
+/**
+ * A verified "MFA-pending" login ticket (kind: mfa_token, issue #3242) —
+ * stashed on its own request slot, NEVER the main identity slot, so every
+ * identity-gated route stays default-deny for a ticket bearer. Only the
+ * challenge routes read it.
+ */
+export type RequestMfaLoginTicket = {
+    identity: RequestIdentity;
+    payload: OAuth2TokenPayload;
+};
+export declare function useRequestMfaLoginTicket(event: IAppEvent): RequestMfaLoginTicket | undefined;
+export declare function setRequestMfaLoginTicket(event: IAppEvent, input: RequestMfaLoginTicket): void;
+//# sourceMappingURL=mfa-login-ticket.d.ts.map

package/dist/adapters/http/request/helpers/mfa-login-ticket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-ticket.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/mfa-login-ticket.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,qBAAqB,GAAG,SAAS,CAE7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,GAAI,IAAI,CAE9F"}

package/dist/adapters/http/request/helpers/mfa-login-ticket.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/mfa-login-ticket.ts
+const sym = Symbol("RMfaLoginTicket");
+function useRequestMfaLoginTicket(event) {
+	return event.store[sym];
+}
+function setRequestMfaLoginTicket(event, input) {
+	event.store[sym] = input;
+}
+//#endregion
+export { setRequestMfaLoginTicket, useRequestMfaLoginTicket };
+
+//# sourceMappingURL=mfa-login-ticket.mjs.map

package/dist/adapters/http/request/helpers/mfa-login-ticket.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-ticket.mjs","names":["sym","Symbol","useRequestMfaLoginTicket","event","store","setRequestMfaLoginTicket","input"],"sources":["../../../../../src/adapters/http/request/helpers/mfa-login-ticket.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport type { RequestIdentity } from './identity.ts';\n\nconst sym = Symbol('RMfaLoginTicket');\n\n/**\n * A verified \"MFA-pending\" login ticket (kind: mfa_token, issue #3242) —\n * stashed on its own request slot, NEVER the main identity slot, so every\n * identity-gated route stays default-deny for a ticket bearer. Only the\n * challenge routes read it.\n */\nexport type RequestMfaLoginTicket = {\n    identity: RequestIdentity,\n    payload: OAuth2TokenPayload,\n};\n\nexport function useRequestMfaLoginTicket(event: IAppEvent) : RequestMfaLoginTicket | undefined {\n    return event.store[sym] as RequestMfaLoginTicket | undefined;\n}\n\nexport function setRequestMfaLoginTicket(event: IAppEvent, input: RequestMfaLoginTicket) : void {\n    event.store[sym] = input;\n}\n"],"mappings":";;;;AAWA,MAAMA,MAAMC,OAAO,iBAAA;AAanB,SAAgBC,yBAAyBC,OAAgB;CACrD,OAAOA,MAAMC,MAAMJ;AACvB;AAEA,SAAgBK,yBAAyBF,OAAkBG,OAA4B;CACnFH,MAAMC,MAAMJ,OAAOM;AACvB"}

package/dist/adapters/http/request/index.d.ts

@@ -1,4 +1,7 @@
 export * from './constants.ts';
+export * from './client-certificate.ts';
+export * from './event-context.ts';
 export * from './helpers/index.ts';
 export * from './permission/index.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/index.mjs

@@ -1,13 +1,15 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { RequestHandlerOperation } from "./constants.mjs";
+import { CERTIFICATE_SOURCES, RequestHandlerOperation } from "./constants.mjs";
+import { extractClientCertificateEvidence } from "./client-certificate.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./permission/helper.mjs";
 import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
 import { buildActorContext } from "./helpers/actor.mjs";
 import { getBodyRealmID } from "./helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./helpers/locale.mjs";
 import { readFromLocations } from "./helpers/locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
@@ -15,6 +17,7 @@ import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
 import "./helpers/index.mjs";
+import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./event-context.mjs";
 import { RequestPermissionEvaluator } from "./permission/module.mjs";
 import "./permission/index.mjs";
-export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { CERTIFICATE_SOURCES, LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, createRequestEventContextMiddleware, extractClientCertificateEvidence, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/types.d.ts

@@ -0,0 +1,3 @@
+import type { CERTIFICATE_SOURCES } from './constants.ts';
+export type CertificateSource = typeof CERTIFICATE_SOURCES[number];
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/request/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC"}

package/dist/adapters/http/ui/render.mjs

@@ -1,16 +1,16 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
 import { rebasePublicAssetURLs } from "./base-path.mjs";
 import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
-import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
 import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
 import "../middleware/index.mjs";
 import { getURLBasePath } from "@authup/kit";
 import path from "node:path";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { useRequestCookie } from "@routup/basic/cookie";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { load } from "locter";
 import fs from "node:fs";
 //#region src/adapters/http/ui/render.ts

package/dist/app/index.mjs

@@ -10,16 +10,14 @@ import { ConfigModule } from "./modules/config/module.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
 import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
 import { AuthenticationModule } from "./modules/authentication/module.mjs";
-import { DatabaseInjectionKey } from "./modules/database/constants.mjs";
-import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
-import { LoggerModule } from "./modules/logger/module.mjs";
-import { DatabaseModule } from "./modules/database/module.mjs";
 import { RealmRepositoryAdapter } from "./modules/database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./modules/database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "./modules/database/repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "./modules/database/repositories/client-role/repository.mjs";
 import { ClientScopeRepositoryAdapter } from "./modules/database/repositories/client-scope/repository.mjs";
+import { EventRepositoryAdapter } from "./modules/database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./modules/database/repositories/identity-provider/repository.mjs";
+import { KeyRepositoryAdapter } from "./modules/database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./modules/database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./modules/database/repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./modules/database/repositories/permission-provider/module.mjs";
@@ -31,13 +29,21 @@ import { RoleRepositoryAdapter } from "./modules/database/repositories/role/repo
 import { RoleAttributeRepositoryAdapter } from "./modules/database/repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./modules/database/repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "./modules/database/repositories/scope/repository.mjs";
+import { TrustAnchorRepositoryAdapter } from "./modules/database/repositories/trust-anchor/repository.mjs";
 import { UserRepositoryAdapter } from "./modules/database/repositories/user/repository.mjs";
 import { UserAttributeRepositoryAdapter } from "./modules/database/repositories/user-attribute/repository.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "./modules/database/repositories/user-authenticator/repository.mjs";
 import { UserPermissionRepositoryAdapter } from "./modules/database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "./modules/database/repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./modules/database/repositories/identity-provider-role-mapping/repository.mjs";
+import { DatabaseInjectionKey } from "./modules/database/constants.mjs";
+import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
+import { LoggerModule } from "./modules/logger/module.mjs";
+import { DatabaseModule } from "./modules/database/module.mjs";
 import { ComponentsModule } from "./modules/components/module.mjs";
 import { HTTPInjectionKey } from "./modules/http/constants.mjs";
+import { MetricsInjectionKey } from "./modules/metrics/constants.mjs";
+import { PromAuthFlowMetrics } from "./modules/metrics/prom.mjs";
 import { OAuth2InjectionToken } from "./modules/oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./modules/identity/constants.mjs";
 import { IdentityProviderAccountRepository } from "./modules/identity/repositories/provider/account/module.mjs";
@@ -62,4 +68,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, UserAttributeRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };

package/dist/app/modules/components/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA+BpD"}

package/dist/app/modules/components/module.mjs

@@ -2,10 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ModuleName } from "../constants.mjs";
+import { ConfigInjectionKey } from "../config/constants.mjs";
+import "../config/index.mjs";
 import { createDatabaseUniqueEntriesComponent } from "../../../components/database/unique-entries/factory.mjs";
+import { createEventCleanerComponent } from "../../../components/event-cleaner/module.mjs";
 import { createOAuth2CleanerComponent } from "../../../components/oauth2-cleaner/module.mjs";
 import "../../../components/index.mjs";
 import { DatabaseInjectionKey } from "../database/constants.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
 import "../database/index.mjs";
 //#region src/app/modules/components/module.ts
 var ComponentsModule = class {
@@ -13,11 +18,26 @@ var ComponentsModule = class {
 	dependencies;
 	constructor() {
 		this.name = ModuleName.COMPONENTS;
-		this.dependencies = [ModuleName.DATABASE];
+		this.dependencies = [
+			ModuleName.CONFIG,
+			ModuleName.LOGGER,
+			ModuleName.DATABASE
+		];
 	}
 	async setup(container) {
+		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
-		[createOAuth2CleanerComponent(dataSource), createDatabaseUniqueEntriesComponent(dataSource)].forEach((component) => component.start());
+		const logger = container.resolve(LoggerInjectionKey);
+		const components = [createOAuth2CleanerComponent(dataSource, logger), createDatabaseUniqueEntriesComponent(dataSource)];
+		const securitySweep = config.eventLogRetentionDays > 0;
+		const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;
+		if (config.eventLogEnabled && (securitySweep || entitySweep)) components.push(createEventCleanerComponent(dataSource, logger));
+		components.forEach((component) => {
+			component.start().catch((e) => {
+				logger.error("Starting a background component failed.");
+				logger.error(e);
+			});
+		});
 	}
 };
 //#endregion

package/dist/app/modules/components/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createDatabaseUniqueEntriesComponent","createOAuth2CleanerComponent","DatabaseInjectionKey","ModuleName","ComponentsModule","name","dependencies","COMPONENTS","DATABASE","setup","container","dataSource","resolve","DataSource","components","forEach","component","start"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport { createDatabaseUniqueEntriesComponent, createOAuth2CleanerComponent } from '../../../components/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource),\n            createDatabaseUniqueEntriesComponent(dataSource),\n        ];\n\n        components.forEach((component) => component.start());\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;AAcA,IAAaI,mBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOF,WAAWI;EACvB,KAAKD,eAAe,CAACH,WAAWK,QAAAA;CACpC;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,aAAaD,UAAUE,QAAQV,qBAAqBW,UAAU;EAOpEC,CAJIb,6BAA6BU,UAAAA,GAC7BX,qCAAqCW,UAAAA,CAGzCG,CAAAA,CAAWC,SAASC,cAAcA,UAAUC,MAAK,CAAA;CACrD;AAGJ"}
+{"version":3,"file":"module.mjs","names":["createDatabaseUniqueEntriesComponent","createEventCleanerComponent","createOAuth2CleanerComponent","ConfigInjectionKey","DatabaseInjectionKey","LoggerInjectionKey","ModuleName","ComponentsModule","name","dependencies","COMPONENTS","CONFIG","LOGGER","DATABASE","setup","container","config","resolve","dataSource","DataSource","logger","components","securitySweep","eventLogRetentionDays","entitySweep","eventLogEntityEnabled","eventLogEntityRetentionDays","eventLogEnabled","push","forEach","component","start","catch","e","error"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport {\n    createDatabaseUniqueEntriesComponent,\n    createEventCleanerComponent,\n    createOAuth2CleanerComponent,\n} from '../../../components/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource, logger),\n            createDatabaseUniqueEntriesComponent(dataSource),\n        ];\n\n        // The sweep only exists when rows are written AND at least one row\n        // family carries an expiry — security events (eventLogRetentionDays)\n        // and entity-CRUD events (eventLogEntityRetentionDays) are stamped\n        // independently, so either non-zero retention needs the cleaner.\n        const securitySweep = config.eventLogRetentionDays > 0;\n        const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;\n        if (config.eventLogEnabled && (securitySweep || entitySweep)) {\n            components.push(createEventCleanerComponent(dataSource, logger));\n        }\n\n        // start() is deliberately fire-and-forget, so a rejection must be\n        // caught here — an unhandled rejection is fatal on modern node.\n        components.forEach((component) => {\n            component.start().catch((e) => {\n                logger.error('Starting a background component failed.');\n                logger.error(e);\n            });\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoBA,IAAaO,mBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOF,WAAWI;EACvB,KAAKD,eAAe;GAACH,WAAWK;GAAQL,WAAWM;GAAQN,WAAWO;;CAC1E;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EACjC,MAAMe,aAAaH,UAAUE,QAAQb,qBAAqBe,UAAU;EACpE,MAAMC,SAASL,UAAUE,QAAQZ,kBAAAA;EAEjC,MAAMgB,aAA0B,CAC5BnB,6BAA6BgB,YAAYE,MAAAA,GACzCpB,qCAAqCkB,UAAAA,CAAAA;EAOzC,MAAMI,gBAAgBN,OAAOO,wBAAwB;EACrD,MAAMC,cAAcR,OAAOS,yBAAyBT,OAAOU,8BAA8B;EACzF,IAAIV,OAAOW,oBAAoBL,iBAAiBE,cAC5CH,WAAWO,KAAK3B,4BAA4BiB,YAAYE,MAAAA,CAAAA;EAK5DC,WAAWQ,SAASC,cAAAA;GAChBA,UAAUC,MAAK,CAAA,CAAGC,OAAOC,MAAAA;IACrBb,OAAOc,MAAM,yCAAA;IACbd,OAAOc,MAAMD,CAAAA;GACjB,CAAA;EACJ,CAAA;CACJ;AAGJ"}

package/dist/app/modules/config/constants.d.ts

@@ -9,6 +9,8 @@ export declare enum ConfigEnvironmentVariableName {
     HOST = "HOST",
     PORT = "PORT",
     PUBLIC_URL = "PUBLIC_URL",
+    MTLS_PUBLIC_URL = "MTLS_PUBLIC_URL",
+    CERTIFICATE_SOURCE = "CERTIFICATE_SOURCE",
     TRUSTED_ORIGINS = "TRUSTED_ORIGINS",
     TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
     TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",
@@ -19,6 +21,18 @@ export declare enum ConfigEnvironmentVariableName {
     EMAIL_VERIFICATION_ENABLED = "EMAIL_VERIFICATION_ENABLED",
     PASSWORD_RECOVERY_ENABLED = "PASSWORD_RECOVERY_ENABLED",
     PASSWORD_MIN_LENGTH = "PASSWORD_MIN_LENGTH",
+    EVENT_LOG_ENABLED = "EVENT_LOG_ENABLED",
+    EVENT_LOG_RETENTION_DAYS = "EVENT_LOG_RETENTION_DAYS",
+    EVENT_LOG_ENTITY_ENABLED = "EVENT_LOG_ENTITY_ENABLED",
+    EVENT_LOG_ENTITY_RETENTION_DAYS = "EVENT_LOG_ENTITY_RETENTION_DAYS",
+    LOGIN_ATTEMPT_THROTTLE_ENABLED = "LOGIN_ATTEMPT_THROTTLE_ENABLED",
+    LOGIN_ATTEMPT_THRESHOLD = "LOGIN_ATTEMPT_THRESHOLD",
+    LOGIN_ATTEMPT_WINDOW = "LOGIN_ATTEMPT_WINDOW",
+    SECRETS_ENCRYPTION_KEY = "SECRETS_ENCRYPTION_KEY",
+    MFA_ENABLED = "MFA_ENABLED",
+    MFA_REQUIRED = "MFA_REQUIRED",
+    MFA_FRESHNESS_MAX_AGE = "MFA_FRESHNESS_MAX_AGE",
+    MFA_TICKET_MAX_AGE = "MFA_TICKET_MAX_AGE",
     CLIENT_AUTH_BASIC = "CLIENT_AUTH_BASIC",
     CLIENT_SYSTEM_ENABLED = "CLIENT_SYSTEM_ENABLED",
     CLIENT_SYSTEM_SECRET = "CLIENT_SYSTEM_SECRET",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -12,6 +12,8 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["HOST"] = "HOST";
 	ConfigEnvironmentVariableName["PORT"] = "PORT";
 	ConfigEnvironmentVariableName["PUBLIC_URL"] = "PUBLIC_URL";
+	ConfigEnvironmentVariableName["MTLS_PUBLIC_URL"] = "MTLS_PUBLIC_URL";
+	ConfigEnvironmentVariableName["CERTIFICATE_SOURCE"] = "CERTIFICATE_SOURCE";
 	ConfigEnvironmentVariableName["TRUSTED_ORIGINS"] = "TRUSTED_ORIGINS";
 	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
 	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";
@@ -22,6 +24,18 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["EMAIL_VERIFICATION_ENABLED"] = "EMAIL_VERIFICATION_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_RECOVERY_ENABLED"] = "PASSWORD_RECOVERY_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_MIN_LENGTH"] = "PASSWORD_MIN_LENGTH";
+	ConfigEnvironmentVariableName["EVENT_LOG_ENABLED"] = "EVENT_LOG_ENABLED";
+	ConfigEnvironmentVariableName["EVENT_LOG_RETENTION_DAYS"] = "EVENT_LOG_RETENTION_DAYS";
+	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_ENABLED"] = "EVENT_LOG_ENTITY_ENABLED";
+	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_RETENTION_DAYS"] = "EVENT_LOG_ENTITY_RETENTION_DAYS";
+	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_THROTTLE_ENABLED"] = "LOGIN_ATTEMPT_THROTTLE_ENABLED";
+	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_THRESHOLD"] = "LOGIN_ATTEMPT_THRESHOLD";
+	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_WINDOW"] = "LOGIN_ATTEMPT_WINDOW";
+	ConfigEnvironmentVariableName["SECRETS_ENCRYPTION_KEY"] = "SECRETS_ENCRYPTION_KEY";
+	ConfigEnvironmentVariableName["MFA_ENABLED"] = "MFA_ENABLED";
+	ConfigEnvironmentVariableName["MFA_REQUIRED"] = "MFA_REQUIRED";
+	ConfigEnvironmentVariableName["MFA_FRESHNESS_MAX_AGE"] = "MFA_FRESHNESS_MAX_AGE";
+	ConfigEnvironmentVariableName["MFA_TICKET_MAX_AGE"] = "MFA_TICKET_MAX_AGE";
 	ConfigEnvironmentVariableName["CLIENT_AUTH_BASIC"] = "CLIENT_AUTH_BASIC";
 	ConfigEnvironmentVariableName["CLIENT_SYSTEM_ENABLED"] = "CLIENT_SYSTEM_ENABLED";
 	ConfigEnvironmentVariableName["CLIENT_SYSTEM_SECRET"] = "CLIENT_SYSTEM_SECRET";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyG9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2J9E"}