@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/app/modules/config/normalize.mjs

@@ -1,11 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../../core/entities/event/constants.mjs";
+import "../../../core/index.mjs";
 import { toPublicHost } from "../../../utils/host.mjs";
 import { expandToOrigins } from "./origins.mjs";
 import { parseConfig } from "./parse.mjs";
-import { EnvironmentName } from "@authup/kit";
+import { EnvironmentName, base64ToArrayBuffer } from "@authup/kit";
 import { USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
+import { AuthupError } from "@authup/errors";
 import { read } from "envix";
 import path from "node:path";
 import process from "node:process";
@@ -31,7 +34,7 @@ async function normalizeConfig(input = {}) {
 		const devOrigin = "http://localhost:3000";
 		if (!trustedOrigins.includes(devOrigin)) trustedOrigins.push(devOrigin);
 	}
-	return {
+	const config = {
 		env,
 		rootPath: process.cwd(),
 		writableDirectoryPath,
@@ -41,6 +44,8 @@ async function normalizeConfig(input = {}) {
 		port,
 		host,
 		publicUrl,
+		mtlsPublicUrl: null,
+		certificateSource: "disabled",
 		middlewareBody: true,
 		middlewareCookie: true,
 		middlewareCors: true,
@@ -57,6 +62,18 @@ async function normalizeConfig(input = {}) {
 		emailVerificationEnabled: false,
 		passwordRecoveryEnabled: false,
 		passwordMinLength: USER_PASSWORD_MIN_LENGTH,
+		eventLogEnabled: true,
+		eventLogRetentionDays: 90,
+		eventLogEntityEnabled: true,
+		eventLogEntityRetentionDays: 7,
+		loginAttemptThrottleEnabled: false,
+		loginAttemptThreshold: 5,
+		loginAttemptWindow: 900,
+		secretsEncryptionKey: "",
+		mfaEnabled: false,
+		mfaRequired: false,
+		mfaFreshnessMaxAge: 60,
+		mfaTicketMaxAge: 600,
 		clientAuthBasic: false,
 		clientSystemEnabled: false,
 		clientSystemSecret: "start123",
@@ -74,6 +91,17 @@ async function normalizeConfig(input = {}) {
 		...parsed,
 		trustedOrigins
 	};
+	if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) throw new AuthupError("loginAttemptThrottleEnabled requires eventLogEnabled.");
+	if (config.mfaRequired && !config.mfaEnabled) throw new AuthupError("mfaRequired requires mfaEnabled.");
+	if (config.mtlsPublicUrl && config.certificateSource === "disabled") throw new AuthupError("mtlsPublicUrl requires certificateSource to be enabled.");
+	if (config.secretsEncryptionKey) {
+		let byteLength = -1;
+		try {
+			byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;
+		} catch {}
+		if (byteLength !== 32) throw new AuthupError("secretsEncryptionKey must decode to exactly 32 bytes (base64).");
+	}
+	return config;
 }
 //#endregion
 export { normalizeConfig };

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","EnvironmentName","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,eAAsBQ,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCV,KAAKW,KAAKV,QAAQW,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOnB,KAAK,YAAYI,gBAAgBgB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQf,gBAAgBsB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,OAAO;EACHR;EACAS,UAAU1B,QAAQW,IAAG;EACrBF;EAEAkB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENjB;EACAC;EACAC;EAEAgB,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmB5C;EAEnB6C,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGnD;EAIHW;CACJ;AACJ"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,eAAsBW,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCb,KAAKc,KAAKb,QAAQc,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOtB,KAAK,YAAYK,gBAAgBkB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQjB,gBAAgBwB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU9B,QAAQc,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EAEnBC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBlD;EAEnBmD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGlE;EAIHW;CACJ;CAIA,IAAIO,OAAO2B,+BAA+B,CAAC3B,OAAOuB,iBAC9C,MAAM,IAAIlD,YAAY,uDAAA;CAG1B,IAAI2B,OAAOgC,eAAe,CAAChC,OAAO+B,YAC9B,MAAM,IAAI1D,YAAY,kCAAA;CAG1B,IAAI2B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAIjC,YAAY,yDAAA;CAQ1B,IAAI2B,OAAO8B,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAa1E,oBAAoByB,OAAO8B,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAI5E,YAAY,gEAAA;CAE9B;CAEA,OAAO2B;AACX"}

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,wBAAgB,oBAAoB,IAAK,WAAW,CAwLnD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CAkQnD"}

package/dist/app/modules/config/read/env.mjs

@@ -5,6 +5,35 @@ import { ConfigEnvironmentVariableName } from "../constants.mjs";
 import { oneOf, read, readArray, readBool, readInt } from "envix";
 import { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from "typeorm-extension";
 //#region src/app/modules/config/read/env.ts
+const BOOLEAN_TRUE_VALUES = /* @__PURE__ */ new Set([
+	"true",
+	"t",
+	"1",
+	"yes",
+	"y",
+	"on"
+]);
+const BOOLEAN_FALSE_VALUES = /* @__PURE__ */ new Set([
+	"false",
+	"f",
+	"0",
+	"no",
+	"n",
+	"off"
+]);
+/**
+* Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead
+* of silently falling back to the default (envix's `readBool` swallows e.g.
+* `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent
+* default is a weakened posture. Returns `undefined` when the var is unset.
+*/ function readBoolStrict(name) {
+	const raw = read(name);
+	if (typeof raw !== "string" || raw.trim().length === 0) return;
+	const normalized = raw.trim().toLowerCase();
+	if (BOOLEAN_TRUE_VALUES.has(normalized)) return true;
+	if (BOOLEAN_FALSE_VALUES.has(normalized)) return false;
+	throw new Error(`The environment variable ${name} must be a boolean value (received "${raw}").`);
+}
 function readConfigRawFromEnv() {
 	const options = {};
 	const env = read(ConfigEnvironmentVariableName.NODE_ENV);
@@ -22,6 +51,10 @@ function readConfigRawFromEnv() {
 	if (typeof port !== "undefined") options.port = port;
 	const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);
 	if (publicURL) options.publicUrl = publicURL;
+	const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);
+	if (mtlsPublicURL) options.mtlsPublicUrl = mtlsPublicURL;
+	const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);
+	if (certificateSource) options.certificateSource = certificateSource;
 	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
 	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
 	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);
@@ -42,6 +75,30 @@ function readConfigRawFromEnv() {
 	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
 	const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);
 	if (typeof passwordMinLength !== "undefined") options.passwordMinLength = passwordMinLength;
+	const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);
+	if (typeof eventLogEnabled !== "undefined") options.eventLogEnabled = eventLogEnabled;
+	const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);
+	if (typeof eventLogRetentionDays !== "undefined") options.eventLogRetentionDays = eventLogRetentionDays;
+	const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);
+	if (typeof eventLogEntityEnabled !== "undefined") options.eventLogEntityEnabled = eventLogEntityEnabled;
+	const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);
+	if (typeof eventLogEntityRetentionDays !== "undefined") options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;
+	const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);
+	if (typeof loginAttemptThrottleEnabled !== "undefined") options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;
+	const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);
+	if (typeof loginAttemptThreshold !== "undefined") options.loginAttemptThreshold = loginAttemptThreshold;
+	const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);
+	if (typeof loginAttemptWindow !== "undefined") options.loginAttemptWindow = loginAttemptWindow;
+	const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);
+	if (typeof mfaEnabled !== "undefined") options.mfaEnabled = mfaEnabled;
+	const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);
+	if (typeof mfaRequired !== "undefined") options.mfaRequired = mfaRequired;
+	const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);
+	if (typeof mfaFreshnessMaxAge !== "undefined") options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;
+	const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);
+	if (typeof mfaTicketMaxAge !== "undefined") options.mfaTicketMaxAge = mfaTicketMaxAge;
+	const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);
+	if (secretsEncryptionKey) options.secretsEncryptionKey = secretsEncryptionKey;
 	const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);
 	if (typeof clientBasicAuth !== "undefined") options.clientAuthBasic = clientBasicAuth;
 	const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","trustedOrigins","TRUSTED_ORIGINS","length","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMT,KAAKM,8BAA8BI,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBX,KAAKM,8BAA8BM,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIP,wBAAAA,GAEAI,QAAQK,KAAKR,6BAAAA;CAKjB,MAAMS,QAAQf,MAAM,CAChBG,SAASI,8BAA8BS,KAAK,GAC5Cf,KAAKM,8BAA8BS,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAOjB,MAAM,CACfG,SAASI,8BAA8BW,IAAI,GAC3CjB,KAAKM,8BAA8BW,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAOlB,KAAKM,8BAA8Ba,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAOjB,QAAQG,8BAA8Be,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYtB,KAAKM,8BAA8BiB,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,iBAAiBxB,UAAUK,8BAA8BoB,eAAe;CAC9E,IAAID,kBAAkBA,eAAeE,SAAS,GAC1CnB,QAAQiB,iBAAiBA;CAG7B,MAAMG,oBAAoBzB,QAAQG,8BAA8BuB,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BpB,QAAQoB,oBAAoBA;CAGhC,MAAME,qBAAqB3B,QAAQG,8BAA8ByB,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BtB,QAAQsB,qBAAqBA;CAGjC,MAAME,0BAA0B7B,QAAQG,8BAA8B2B,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnCxB,QAAQwB,0BAA0BA;CAGtC,MAAME,oBAAoB/B,QAAQG,8BAA8B6B,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B1B,QAAQ0B,oBAAoBA;CAGhC,MAAME,4BAA4BjC,QAAQG,8BAA8B+B,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrC5B,QAAQ4B,4BAA4BA;CAGxC,MAAME,sBAAsBpC,SAASI,8BAA8BiC,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/B9B,QAAQ8B,sBAAsBA;CAGlC,MAAME,2BAA2BtC,SAASI,8BAA8BmC,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpChC,QAAQgC,2BAA2BA;CAGvC,MAAME,0BAA0BxC,SAASI,8BAA8BqC,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnClC,QAAQkC,0BAA0BA;CAGtC,MAAME,oBAAoBzC,QAAQG,8BAA8BuC,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BpC,QAAQoC,oBAAoBA;CAKhC,MAAME,kBAAkB5C,SAASI,8BAA8ByC,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BtC,QAAQwC,kBAAkBF;CAG9B,MAAMG,sBAAsB/C,SAASI,8BAA8B4C,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BzC,QAAQyC,sBAAsBA;CAGlC,MAAME,oBAAoBnD,KAAKM,8BAA8B8C,oBAAoB;CACjF,IAAID,mBACA3C,QAAQ6C,qBAAqBF;CAGjC,MAAMG,yBAAyBpD,SAASI,8BAA8BiD,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC9C,QAAQgD,0BAA0BF;CAKtC,MAAMG,gBAAgBvD,SAASI,8BAA8BoD,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBjD,QAAQmD,gBAAgBF;CAG5B,MAAMG,mBAAmB1D,SAASI,8BAA8BuD,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BpD,QAAQoD,mBAAmBA;CAG/B,MAAME,oBAAoB9D,KAAKM,8BAA8ByD,mBAAmB;CAChF,IAAID,mBACAtD,QAAQsD,oBAAoBA;CAGhC,MAAME,yBAAyB9D,SAASI,8BAA8B2D,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCxD,QAAQwD,yBAAyBA;CAKrC,MAAME,iBAAiBhE,SAASI,8BAA8B6D,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1B1D,QAAQ4D,iBAAiBF;CAG7B,MAAMG,oBAAoBnE,SAASI,8BAA8BgE,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B7D,QAAQ6D,oBAAoBA;CAGhC,MAAME,mBAAmBvE,KAAKM,8BAA8BkE,kBAAkB;CAC9E,IAAID,kBACA/D,QAAQ+D,mBAAmBA;CAG/B,MAAME,wBAAwBvE,SAASI,8BAA8BoE,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjCjE,QAAQiE,wBAAwBA;CAKpC,MAAME,cAAc1E,UAAUK,8BAA8BsE,WAAW;CACvE,IAAID,eAAeA,YAAYhD,SAAS,GACpCnB,QAAQmE,cAAcA;CAG1B,MAAME,qCAAqC3E,SAASI,8BAA8BwE,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CrE,QAAQqE,qCAAqCA;CAGjD,OAAOrE;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;CAAK;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;CAAM;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAGhC,MAAME,iBAAiB1C,UAAUK,8BAA8BsC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe7B,SAAS,GAC1CO,QAAQsB,iBAAiBA;CAG7B,MAAME,oBAAoB1C,QAAQG,8BAA8BwC,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxB,QAAQwB,oBAAoBA;CAGhC,MAAME,qBAAqB5C,QAAQG,8BAA8B0C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B1B,QAAQ0B,qBAAqBA;CAGjC,MAAME,0BAA0B9C,QAAQG,8BAA8B4C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAGtC,MAAME,oBAAoBhD,QAAQG,8BAA8B8C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B9B,QAAQ8B,oBAAoBA;CAGhC,MAAME,4BAA4BlD,QAAQG,8BAA8BgD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrChC,QAAQgC,4BAA4BA;CAGxC,MAAME,sBAAsBrD,SAASI,8BAA8BkD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BlC,QAAQkC,sBAAsBA;CAGlC,MAAME,2BAA2BvD,SAASI,8BAA8BoD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCpC,QAAQoC,2BAA2BA;CAGvC,MAAME,0BAA0BzD,SAASI,8BAA8BsD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAKhC,MAAME,kBAAkBrD,eAAeJ,8BAA8B0D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B1C,QAAQ0C,kBAAkBA;CAG9B,MAAME,wBAAwB9D,QAAQG,8BAA8B4D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC5C,QAAQ4C,wBAAwBA;CAGpC,MAAME,wBAAwBzD,eAAeJ,8BAA8B8D,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,8BAA8BlE,QAAQG,8BAA8BgE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvChD,QAAQgD,8BAA8BA;CAG1C,MAAME,8BAA8B7D,eAAeJ,8BAA8BkE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,wBAAwBtE,QAAQG,8BAA8BoE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAGpC,MAAME,qBAAqBxE,QAAQG,8BAA8BsE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BtD,QAAQsD,qBAAqBA;CAKjC,MAAME,aAAanE,eAAeJ,8BAA8BwE,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBxD,QAAQwD,aAAaA;CAGzB,MAAME,cAAcrE,eAAeJ,8BAA8B0E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB1D,QAAQ0D,cAAcA;CAG1B,MAAME,qBAAqB9E,QAAQG,8BAA8B4E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5D,QAAQ4D,qBAAqBA;CAGjC,MAAME,kBAAkBhF,QAAQG,8BAA8B8E,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9D,QAAQ8D,kBAAkBA;CAG9B,MAAME,uBAAuBrF,KAAKM,8BAA8BgF,sBAAsB;CACtF,IAAID,sBACAhE,QAAQgE,uBAAuBA;CAKnC,MAAME,kBAAkBrF,SAASI,8BAA8BkF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BlE,QAAQoE,kBAAkBF;CAG9B,MAAMG,sBAAsBxF,SAASI,8BAA8BqF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BrE,QAAQqE,sBAAsBA;CAGlC,MAAME,oBAAoB5F,KAAKM,8BAA8BuF,oBAAoB;CACjF,IAAID,mBACAvE,QAAQyE,qBAAqBF;CAGjC,MAAMG,yBAAyB7F,SAASI,8BAA8B0F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC1E,QAAQ4E,0BAA0BF;CAKtC,MAAMG,gBAAgBhG,SAASI,8BAA8B6F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB7E,QAAQ+E,gBAAgBF;CAG5B,MAAMG,mBAAmBnG,SAASI,8BAA8BgG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BhF,QAAQgF,mBAAmBA;CAG/B,MAAME,oBAAoBvG,KAAKM,8BAA8BkG,mBAAmB;CAChF,IAAID,mBACAlF,QAAQkF,oBAAoBA;CAGhC,MAAME,yBAAyBvG,SAASI,8BAA8BoG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCpF,QAAQoF,yBAAyBA;CAKrC,MAAME,iBAAiBzG,SAASI,8BAA8BsG,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BtF,QAAQwF,iBAAiBF;CAG7B,MAAMG,oBAAoB5G,SAASI,8BAA8ByG,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BzF,QAAQyF,oBAAoBA;CAGhC,MAAME,mBAAmBhH,KAAKM,8BAA8B2G,kBAAkB;CAC9E,IAAID,kBACA3F,QAAQ2F,mBAAmBA;CAG/B,MAAME,wBAAwBhH,SAASI,8BAA8B6G,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjC7F,QAAQ6F,wBAAwBA;CAKpC,MAAME,cAAcnH,UAAUK,8BAA8B+G,WAAW;CACvE,IAAID,eAAeA,YAAYtG,SAAS,GACpCO,QAAQ+F,cAAcA;CAG1B,MAAME,qCAAqCpH,SAASI,8BAA8BiH,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CjG,QAAQiG,qCAAqCA;CAGjD,OAAOjG;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -8,6 +8,7 @@ import type { UIOptions as SwaggerUIOptions } from '@routup/swagger-ui';
 import type { Options as BodyOptions } from '@routup/basic/body';
 import type { DataSourceOptions } from 'typeorm';
 import type { SMTPOptions } from '../mail/adapter/smtp/types.ts';
+import type { CertificateSource } from '../../../adapters/http/request/index.ts';
 export type Config = {
     /**
      * Application environment (e.g., 'production').
@@ -56,6 +57,20 @@ export type Config = {
      * default: http://localhost:3001
      */
     publicUrl: string;
+    /**
+     * Optional externally reachable base URL dedicated to endpoints that
+     * request TLS client certificates. Published as RFC 8705 mTLS endpoint
+     * aliases. The reverse proxy may route it to the same backend listener.
+     * default: null
+     */
+    mtlsPublicUrl: string | null;
+    /**
+     * Trusted-proxy client-certificate header contract. Enabling a source
+     * asserts that the backend listener is reachable only through a proxy that
+     * removes or overwrites the selected headers.
+     * default: disabled
+     */
+    certificateSource: CertificateSource;
     /**
      * Trusted first-party app origins (besides publicUrl) — used as
      * redirect targets for the per-realm public `web` client. Does NOT
@@ -167,6 +182,92 @@ export type Config = {
      * default: 10
      */
     passwordMinLength: number;
+    /**
+     * Persist security audit events (login, authorize, replay detection, ...)
+     * to the auth_events table. When disabled only the structured log line
+     * is emitted.
+     * default: true
+     */
+    eventLogEnabled: boolean;
+    /**
+     * Per-row retention for persisted audit events in days (stamped as
+     * expires_at at write time, swept by the event cleaner). Raise it for
+     * longer compliance windows; 0 = keep forever.
+     * default: 90
+     */
+    eventLogRetentionDays: number;
+    /**
+     * Additionally mirror every entity create/update/delete published on the
+     * domain-event bus into the auth_events table (scope: entity). Only
+     * effective while eventLogEnabled is true.
+     * default: true
+     */
+    eventLogEntityEnabled: boolean;
+    /**
+     * Per-row retention for entity-CRUD audit events in days — deliberately
+     * short so entity churn self-prunes. 0 = keep forever.
+     * default: 7
+     */
+    eventLogEntityRetentionDays: number;
+    /**
+     * Throttle failed interactive logins per (identifier, ip) pair by
+     * counting recent loginFailed audit events. Requires eventLogEnabled.
+     * default: false
+     */
+    loginAttemptThrottleEnabled: boolean;
+    /**
+     * Failed attempts per (identifier, ip) pair within the window before
+     * the pair is throttled.
+     * default: 5
+     */
+    loginAttemptThreshold: number;
+    /**
+     * Sliding throttle window in seconds.
+     * default: 900
+     */
+    loginAttemptWindow: number;
+    /**
+     * Optional base64-encoded 32-byte KEK (AES-256-GCM) wrapping the realm
+     * key store's material at rest (auth_keys.decryption_key — realm
+     * signing private keys and the per-realm enc keys the MFA seed cipher
+     * rides). Unset = material persists unwrapped (Keycloak/authentik
+     * parity); setting it later wraps rows lazily on read, removing it
+     * while wrapped rows exist fails loud at first use.
+     * default: '' (unset)
+     */
+    secretsEncryptionKey: string;
+    /**
+     * Org-wide multi-factor authentication feature toggle. When enabled,
+     * users can enroll authenticator devices, and a user holding a
+     * confirmed device must present a second factor on interactive
+     * authorization and the password grant.
+     * default: false
+     */
+    mfaEnabled: boolean;
+    /**
+     * Enforce MFA for every user: a user without a confirmed device is
+     * routed to inline enrollment at next interactive login
+     * (configure-inline). Requires mfaEnabled.
+     * default: false
+     */
+    mfaRequired: boolean;
+    /**
+     * Max age (seconds) of the session's second-factor proof (mfa_at) an
+     * `acr_values=urn:authup:mfa` step-up request accepts before forcing
+     * a fresh challenge. Mirrors promptLoginMaxAge's semantics (the
+     * window absorbs the hosted challenge round-trip).
+     * default: 60
+     */
+    mfaFreshnessMaxAge: number;
+    /**
+     * Lifetime (seconds) of the "MFA-pending" login ticket the password
+     * grant issues when the second factor cannot ride the single POST
+     * (email / WebAuthn) — and of the pending session backing it (extended
+     * to the full session lifetime on completion). Sized to cover the
+     * email-OTP window (code expiry: 10 minutes).
+     * default: 600
+     */
+    mfaTicketMaxAge: number;
     /**
      * default: false
      */

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CA6FhC"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAgHhC"}

package/dist/app/modules/config/validator.mjs

@@ -2,6 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { expandToOrigins } from "./origins.mjs";
+import { CERTIFICATE_SOURCES } from "../../../adapters/http/request/constants.mjs";
+import "../../../adapters/http/request/index.mjs";
 import { isObject } from "@authup/kit";
 import { USER_PASSWORD_MAX_LENGTH } from "@authup/core-kit";
 import { Container } from "validup";
@@ -28,6 +30,8 @@ var ConfigValidator = class extends Container {
 			port: nonNegativeNumberValidator,
 			host: stringValidator,
 			publicUrl: createValidator(z.url()),
+			mtlsPublicUrl: createValidator(z.url().nullable()),
+			certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),
 			trustedOrigins: createValidator(z.array(z.string().refine((value) => {
 				try {
 					expandToOrigins(value);
@@ -52,6 +56,18 @@ var ConfigValidator = class extends Container {
 			emailVerificationEnabled: booleanValidator,
 			passwordRecoveryEnabled: booleanValidator,
 			passwordMinLength: createValidator(z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH)),
+			eventLogEnabled: booleanValidator,
+			eventLogRetentionDays: nonNegativeNumberValidator,
+			eventLogEntityEnabled: booleanValidator,
+			eventLogEntityRetentionDays: nonNegativeNumberValidator,
+			loginAttemptThrottleEnabled: booleanValidator,
+			loginAttemptThreshold: createValidator(z.number().int().positive()),
+			loginAttemptWindow: createValidator(z.number().int().positive()),
+			secretsEncryptionKey: createValidator(z.union([z.literal(""), z.base64()])),
+			mfaEnabled: booleanValidator,
+			mfaRequired: booleanValidator,
+			mfaFreshnessMaxAge: nonNegativeNumberValidator,
+			mfaTicketMaxAge: createValidator(z.number().int().positive()),
 			clientAuthBasic: booleanValidator,
 			clientSystemEnabled: booleanValidator,
 			clientSystemSecret: secretValidator,

package/dist/app/modules/config/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","int","positive","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            robotAuthBasic: booleanValidator,\n            robotAdminEnabled: booleanValidator,\n            robotAdminSecret: secretValidator,\n            robotAdminSecretReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;AAmBA,IAAaM,kBAAb,cAAqCH,UAAAA;CACdI,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBN,gBAAgBE,EAAEK,OAAM,CAAA;EAChD,MAAMC,mBAAmBR,gBAAgBE,EAAEO,QAAO,CAAA;EAClD,MAAMC,6BAA6BV,gBAAgBE,EAAES,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBb,gBAAgBE,EAAEK,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBhB,gBACxBE,EAAEO,QAAO,CAAA,CAAGQ,GAAGf,EAAEgB,OAAOhB,EAAEK,OAAM,GAAIL,EAAEiB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBpB,gBACrBE,EAAEK,OAAM,CAAA,CACHU,GAAGf,EAAEO,QAAO,CAAA,CAAA,CACZQ,GAAGf,EAAEmB,QAA6BC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI5B,gBACAE,EAAEmB,QACGC,UAAUvB,SAASuB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWjC,gBAAgBE,EAAEgC,IAAG,CAAA;GAChCC,gBAAgBnC,gBACZE,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAG8B,QAAQf,UAAAA;IACvB,IAAI;KACAnB,gBAAgBmB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPgB,gBAAgBtB;GAChBuB,gBAAgBvB;GAChBwB,kBAAkBxB;GAClByB,iBAAiBzB;GACjB0B,sBAAsB1B;GACtB2B,qBAAqB3B;GACrB4B,mBAAmBpC;GAEnBqC,mBAAmBnC;GACnBoC,oBAAoBpC;GACpBqC,yBAAyBrC;GACzBsC,mBAAmBtC;GACnBuC,2BAA2BvC;GAC3BwC,qBAAqB1C;GACrB2C,0BAA0B3C;GAC1B4C,yBAAyB5C;GACzB6C,mBAAmBrD,gBACfE,EAAES,OAAM,CAAA,CAAG2C,IAAG,CAAA,CAAGC,SAAQ,CAAA,CAAGxC,IAAIjB,wBAAAA,CAAAA;GAGpC0D,iBAAiBhD;GACjBiD,qBAAqBjD;GACrBkD,oBAAoB7C;GACpB8C,yBAAyBnD;GAEzBoD,eAAepD;GACfqD,kBAAkBrD;GAClBsD,mBAAmBjD;GACnBkD,wBAAwBvD;GAExBwD,gBAAgBxD;GAChByD,mBAAmBzD;GACnB0D,kBAAkBrD;GAClBsD,uBAAuB3D;GAEvB4D,aAAapE,gBACTE,EAAEK,OAAM,CAAA,CAAGU,GAAGf,EAAEkC,MAAMlC,EAAEK,OAAM,CAAA,CAAA,CAAA;GAElC8D,oCAAoC7D;EACxC;EAEA,MAAM8D,OAAOC,OAAOD,KAAK/C,UAAAA;EACzB,KAAK,MAAMiD,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGnD,WAAWiD,IAAI;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","int","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","union","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlConnectionOptions | PostgresConnectionOptions | BetterSqlite3ConnectionOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            robotAuthBasic: booleanValidator,\n            robotAdminEnabled: booleanValidator,\n            robotAdminSecret: secretValidator,\n            robotAdminSecretReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,IAAaO,kBAAb,cAAqCJ,UAAAA;CACdK,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBP,gBAAgBE,EAAEM,OAAM,CAAA;EAChD,MAAMC,mBAAmBT,gBAAgBE,EAAEQ,QAAO,CAAA;EAClD,MAAMC,6BAA6BX,gBAAgBE,EAAEU,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBd,gBAAgBE,EAAEM,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBjB,gBACxBE,EAAEQ,QAAO,CAAA,CAAGQ,GAAGhB,EAAEiB,OAAOjB,EAAEM,OAAM,GAAIN,EAAEkB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBrB,gBACrBE,EAAEM,OAAM,CAAA,CACHU,GAAGhB,EAAEQ,QAAO,CAAA,CAAA,CACZQ,GAAGhB,EAAEoB,QAA6BC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI7B,gBACAE,EAAEoB,QACGC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWlC,gBAAgBE,EAAEiC,IAAG,CAAA;GAChCC,eAAepC,gBAAgBE,EAAEiC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBtC,gBAAgBE,EAAEqC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,gBAAgBxC,gBACZE,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAGkC,QAAQnB,UAAAA;IACvB,IAAI;KACApB,gBAAgBoB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPoB,gBAAgB1B;GAChB2B,gBAAgB3B;GAChB4B,kBAAkB5B;GAClB6B,iBAAiB7B;GACjB8B,sBAAsB9B;GACtB+B,qBAAqB/B;GACrBgC,mBAAmBxC;GAEnByC,mBAAmBvC;GACnBwC,oBAAoBxC;GACpByC,yBAAyBzC;GACzB0C,mBAAmB1C;GACnB2C,2BAA2B3C;GAC3B4C,qBAAqB9C;GACrB+C,0BAA0B/C;GAC1BgD,yBAAyBhD;GACzBiD,mBAAmB1D,gBACfE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA,CAAG5C,IAAIlB,wBAAAA,CAAAA;GAGpC+D,iBAAiBpD;GACjBqD,uBAAuBnD;GACvBoD,uBAAuBtD;GACvBuD,6BAA6BrD;GAC7BsD,6BAA6BxD;GAC7ByD,uBAAuBlE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAChEO,oBAAoBnE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAI7DQ,sBAAsBpE,gBAAgBE,EAAEmE,MAAM,CAACnE,EAAEoE,QAAQ,EAAA,GAAKpE,EAAEqE,OAAM,CAAA,CAAG,CAAA;GAEzEC,YAAY/D;GACZgE,aAAahE;GACbiE,oBAAoB/D;GACpBgE,iBAAiB3E,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAE1DgB,iBAAiBnE;GACjBoE,qBAAqBpE;GACrBqE,oBAAoBhE;GACpBiE,yBAAyBtE;GAEzBuE,eAAevE;GACfwE,kBAAkBxE;GAClByE,mBAAmBpE;GACnBqE,wBAAwB1E;GAExB2E,gBAAgB3E;GAChB4E,mBAAmB5E;GACnB6E,kBAAkBxE;GAClByE,uBAAuB9E;GAEvB+E,aAAaxF,gBACTE,EAAEM,OAAM,CAAA,CAAGU,GAAGhB,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAA,CAAA;GAElCiF,oCAAoChF;EACxC;EAEA,MAAMiF,OAAOC,OAAOD,KAAKlE,UAAAA;EACzB,KAAK,MAAMoE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGtE,WAAWoE,IAAI;CAE3D;AACJ"}

package/dist/app/modules/database/constants.d.ts

@@ -1,8 +1,11 @@
 import type { IDomainEventPublisher } from '@authup/server-kit';
 import type { DataSource } from 'typeorm';
 import { TypedToken } from 'eldin';
+import type { IEventRepository, IEventService } from '../../../core/index.ts';
 export declare const DatabaseInjectionKey: {
     readonly DataSource: TypedToken<DataSource>;
     readonly DomainEventPublisher: TypedToken<IDomainEventPublisher>;
+    readonly EventRepository: TypedToken<IEventRepository>;
+    readonly EventService: TypedToken<IEventService>;
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/database/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnC,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE9E,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC"}

package/dist/app/modules/database/constants.mjs

@@ -5,7 +5,9 @@ import { TypedToken } from "eldin";
 //#region src/app/modules/database/constants.ts
 const DatabaseInjectionKey = {
 	DataSource: new TypedToken("DataSource"),
-	DomainEventPublisher: new TypedToken("DomainEventPublisher")
+	DomainEventPublisher: new TypedToken("DomainEventPublisher"),
+	EventRepository: new TypedToken("EventRepository"),
+	EventService: new TypedToken("EventService")
 };
 //#endregion
 export { DatabaseInjectionKey };

package/dist/app/modules/database/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","DatabaseInjectionKey","DataSource","DomainEventPublisher"],"sources":["../../../../src/app/modules/database/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IDomainEventPublisher } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { TypedToken } from 'eldin';\n\nexport const DatabaseInjectionKey = {\n    DataSource: new TypedToken<DataSource>('DataSource'),\n    DomainEventPublisher: new TypedToken<IDomainEventPublisher>('DomainEventPublisher'),\n} as const;\n"],"mappings":";;;;;AAWA,MAAaC,uBAAuB;CAChCC,YAAY,IAAIF,WAAuB,YAAA;CACvCG,sBAAsB,IAAIH,WAAkC,sBAAA;AAChE"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","DatabaseInjectionKey","DataSource","DomainEventPublisher","EventRepository","EventService"],"sources":["../../../../src/app/modules/database/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IDomainEventPublisher } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { TypedToken } from 'eldin';\nimport type { IEventRepository, IEventService } from '../../../core/index.ts';\n\nexport const DatabaseInjectionKey = {\n    DataSource: new TypedToken<DataSource>('DataSource'),\n    DomainEventPublisher: new TypedToken<IDomainEventPublisher>('DomainEventPublisher'),\n    EventRepository: new TypedToken<IEventRepository>('EventRepository'),\n    EventService: new TypedToken<IEventService>('EventService'),\n} as const;\n"],"mappings":";;;;;AAYA,MAAaC,uBAAuB;CAChCC,YAAY,IAAIF,WAAuB,YAAA;CACvCG,sBAAsB,IAAIH,WAAkC,sBAAA;CAC5DI,iBAAiB,IAAIJ,WAA6B,iBAAA;CAClDK,cAAc,IAAIL,WAA0B,cAAA;AAChD"}

package/dist/app/modules/database/index.mjs

@@ -1,14 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { DatabaseInjectionKey } from "./constants.mjs";
-import { DatabaseModule } from "./module.mjs";
 import { RealmRepositoryAdapter } from "./repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "./repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "./repositories/client-role/repository.mjs";
 import { ClientScopeRepositoryAdapter } from "./repositories/client-scope/repository.mjs";
+import { EventRepositoryAdapter } from "./repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./repositories/identity-provider/repository.mjs";
+import { KeyRepositoryAdapter } from "./repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./repositories/permission-provider/module.mjs";
@@ -20,10 +20,14 @@ import { RoleRepositoryAdapter } from "./repositories/role/repository.mjs";
 import { RoleAttributeRepositoryAdapter } from "./repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "./repositories/scope/repository.mjs";
+import { TrustAnchorRepositoryAdapter } from "./repositories/trust-anchor/repository.mjs";
 import { UserRepositoryAdapter } from "./repositories/user/repository.mjs";
 import { UserAttributeRepositoryAdapter } from "./repositories/user-attribute/repository.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "./repositories/user-authenticator/repository.mjs";
 import { UserPermissionRepositoryAdapter } from "./repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "./repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./repositories/identity-provider-role-mapping/repository.mjs";
 import "./repositories/index.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, UserAttributeRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+import { DatabaseInjectionKey } from "./constants.mjs";
+import { DatabaseModule } from "./module.mjs";
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, DatabaseInjectionKey, DatabaseModule, EventRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };

package/dist/app/modules/database/module.d.ts

@@ -31,5 +31,6 @@ export declare class DatabaseModule implements IModule {
     protected buildDataSourceOptions(container: IContainer): Promise<DataSourceOptions>;
     protected registerRepositories(container: IContainer, dataSource: DataSource): void;
     protected registerEventPublisher(container: IContainer, dataSource: DataSource): void;
+    protected registerEvents(container: IContainer, dataSource: DataSource): void;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/database/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/module.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,oBAAoB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,SAAS,CAAC;AAMtD,OAAO,EACH,wBAAwB,EAK3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAGxC,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,cAAc,EAAG,wBAAwB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,gBAAgB,CAAC,EAAG,WAAW,CAAC;IAE1C,SAAS,CAAC,cAAc,CAAC,EAAG,oBAAoB,CAAC;gBAErC,OAAO,GAAE,qBAA0B;IAQzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAepC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;cActC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;cAgB/E,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrF;;;;OAIG;cACa,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,iBAAiB,CAAC;IAgC1F,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAI,IAAI;IAiBpF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAyBjF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/database/module.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,oBAAoB,EAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAmB,MAAM,SAAS,CAAC;AAMtD,OAAO,EACH,wBAAwB,EAM3B,MAAM,qCAAqC,CAAC;AAM7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAGxC,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,cAAc,EAAG,wBAAwB,CAAC;IAEpD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,gBAAgB,CAAC,EAAG,WAAW,CAAC;IAE1C,SAAS,CAAC,cAAc,CAAC,EAAG,oBAAoB,CAAC;gBAErC,OAAO,GAAE,qBAA0B;IAQzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAiBpC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;cActC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;cAgB/E,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrF;;;;OAIG;cACa,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,iBAAiB,CAAC;IAgC1F,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAI,IAAI;IAiBpF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAkC9E,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAmBzE"}