@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/app/modules/http/modules/controller.mjs

@@ -4,37 +4,43 @@ import.meta.url;
 import { AuthenticationInjectionKey } from "../../authentication/constants.mjs";
 import { RealmEntity } from "../../../../adapters/database/domains/realm/entity.mjs";
 import { KeyEntity } from "../../../../adapters/database/domains/key/entity.mjs";
+import { PolicyRepository } from "../../../../adapters/database/domains/policy/repository.mjs";
 import { ClientEntity } from "../../../../adapters/database/domains/client/entity.mjs";
 import { RoleEntity } from "../../../../adapters/database/domains/role/entity.mjs";
 import { RoleAttributeEntity } from "../../../../adapters/database/domains/role-attribute/entity.mjs";
 import { ClientRoleEntity } from "../../../../adapters/database/domains/client-role/entity.mjs";
 import { PermissionEntity } from "../../../../adapters/database/domains/permission/entity.mjs";
-import { PolicyRepository } from "../../../../adapters/database/domains/policy/repository.mjs";
 import { ClientPermissionEntity } from "../../../../adapters/database/domains/client-permission/entity.mjs";
 import { ScopeEntity } from "../../../../adapters/database/domains/scope/entity.mjs";
 import { ClientScopeEntity } from "../../../../adapters/database/domains/client-scope/entity.mjs";
-import { IdentityProviderRepository } from "../../../../adapters/database/domains/identity-provider/repository.mjs";
 import { UserEntity } from "../../../../adapters/database/domains/user/entity.mjs";
 import { UserAttributeEntity } from "../../../../adapters/database/domains/user-attribute/entity.mjs";
 import { UserRepository } from "../../../../adapters/database/domains/user/repository.mjs";
+import { IdentityProviderRepository } from "../../../../adapters/database/domains/identity-provider/repository.mjs";
 import { IdentityProviderRoleMappingEntity } from "../../../../adapters/database/domains/identity-provider-role-mapping/entity.mjs";
 import { RobotEntity } from "../../../../adapters/database/domains/robot/entity.mjs";
 import { PermissionPolicyEntity } from "../../../../adapters/database/domains/permission-policy/entity.mjs";
 import { RobotPermissionEntity } from "../../../../adapters/database/domains/robot-permission/entity.mjs";
 import { RobotRoleEntity } from "../../../../adapters/database/domains/robot-role/entity.mjs";
 import { RolePermissionEntity } from "../../../../adapters/database/domains/role-permission/entity.mjs";
+import { UserAuthenticatorEntity } from "../../../../adapters/database/domains/user-authenticator/entity.mjs";
 import { UserPermissionEntity } from "../../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../../adapters/database/domains/index.mjs";
-import { ClientAuthenticator } from "../../../../core/authentication/entities/client/module.mjs";
 import { RobotAuthenticator } from "../../../../core/authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "../../../../core/authentication/entities/user/module.mjs";
+import { LoginThrottleService } from "../../../../core/authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "../../../../core/authentication/module.mjs";
+import { ClientCertificateValidator } from "../../../../core/client-certificate/module.mjs";
 import { ClientService } from "../../../../core/entities/client/service.mjs";
 import { WebClientProvisioner } from "../../../../core/entities/client/web-client.mjs";
 import { ClientPermissionService } from "../../../../core/entities/client-permission/service.mjs";
 import { ClientRoleService } from "../../../../core/entities/client-role/service.mjs";
 import { ClientScopeService } from "../../../../core/entities/client-scope/service.mjs";
+import { ConsentService } from "../../../../core/entities/consent/service.mjs";
+import { KeyProvisioner } from "../../../../core/key/provisioner.mjs";
+import { RealmCipher } from "../../../../core/key/realm-cipher.mjs";
+import { KeyService } from "../../../../core/entities/key/service.mjs";
 import { PermissionService } from "../../../../core/entities/permission/service.mjs";
 import { PermissionPolicyService } from "../../../../core/entities/permission-policy/service.mjs";
 import { PolicyService } from "../../../../core/entities/policy/service.mjs";
@@ -47,25 +53,29 @@ import { RoleAttributeService } from "../../../../core/entities/role-attribute/s
 import { RolePermissionService } from "../../../../core/entities/role-permission/service.mjs";
 import { ScopeService } from "../../../../core/entities/scope/service.mjs";
 import { SessionService } from "../../../../core/entities/session/service.mjs";
+import { TrustAnchorService } from "../../../../core/entities/trust-anchor/service.mjs";
 import { UserService } from "../../../../core/entities/user/service.mjs";
 import { UserAttributeService } from "../../../../core/entities/user-attribute/service.mjs";
+import { UserAuthenticatorService } from "../../../../core/entities/user-authenticator/service.mjs";
 import { UserPermissionService } from "../../../../core/entities/user-permission/service.mjs";
 import { UserRoleService } from "../../../../core/entities/user-role/service.mjs";
 import { IdentityProviderRoleMappingService } from "../../../../core/entities/identity-provider-role-mapping/service.mjs";
+import { OAuth2AccessPolicyEvaluator } from "../../../../core/oauth2/access-policy/module.mjs";
 import { OAuth2ClientAuthenticator } from "../../../../core/oauth2/client/authenticator.mjs";
 import { OAuth2EndSessionService } from "../../../../core/oauth2/end-session/service.mjs";
+import { OAuth2MfaLoginService } from "../../../../core/oauth2/mfa-login/module.mjs";
 import { PasswordRecoveryService } from "../../../../core/identity/password-recovery/service.mjs";
 import { PermissionCheckerService } from "../../../../core/identity/permission/checker/service.mjs";
 import { PolicyCheckerService } from "../../../../core/identity/policy/checker/service.mjs";
 import { RegistrationService } from "../../../../core/identity/registration/service.mjs";
 import "../../../../core/index.mjs";
+import { CacheInjectionKey } from "../../cache/constants.mjs";
 import { ConfigInjectionKey } from "../../config/constants.mjs";
 import { getAppOrigins } from "../../config/origins.mjs";
+import { useRequestEventContext } from "../../../../adapters/http/request/event-context.mjs";
 import "../../config/index.mjs";
+import "../../cache/index.mjs";
 import "../../authentication/index.mjs";
-import { DatabaseInjectionKey } from "../../database/constants.mjs";
-import { LoggerInjectionKey } from "../../logger/constants.mjs";
-import "../../logger/index.mjs";
 import { RealmRepositoryAdapter } from "../../database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "../../database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "../../database/repositories/client-permission/repository.mjs";
@@ -83,21 +93,32 @@ import { RoleRepositoryAdapter } from "../../database/repositories/role/reposito
 import { RoleAttributeRepositoryAdapter } from "../../database/repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "../../database/repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "../../database/repositories/scope/repository.mjs";
+import { TrustAnchorRepositoryAdapter } from "../../database/repositories/trust-anchor/repository.mjs";
 import { UserRepositoryAdapter } from "../../database/repositories/user/repository.mjs";
 import { UserAttributeRepositoryAdapter } from "../../database/repositories/user-attribute/repository.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "../../database/repositories/user-authenticator/repository.mjs";
 import { UserPermissionRepositoryAdapter } from "../../database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "../../database/repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "../../database/repositories/identity-provider-role-mapping/repository.mjs";
+import { DatabaseInjectionKey } from "../../database/constants.mjs";
+import { LoggerInjectionKey } from "../../logger/constants.mjs";
+import "../../logger/index.mjs";
 import "../../database/index.mjs";
+import { MetricsInjectionKey } from "../../metrics/constants.mjs";
+import "../../metrics/index.mjs";
 import { ClientController } from "../../../../adapters/http/controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "../../../../adapters/http/controllers/entities/client-permission/module.mjs";
 import { ClientRoleController } from "../../../../adapters/http/controllers/entities/client-role/module.mjs";
 import { ClientScopeController } from "../../../../adapters/http/controllers/entities/client-scope/module.mjs";
+import { ConsentController } from "../../../../adapters/http/controllers/entities/consent/module.mjs";
+import { EventController } from "../../../../adapters/http/controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "../../../../adapters/http/controllers/entities/identity-provider/module.mjs";
 import { IdentityProviderRoleMappingController } from "../../../../adapters/http/controllers/entities/identity-provide-role/module.mjs";
+import { KeyController } from "../../../../adapters/http/controllers/entities/key/module.mjs";
 import { PermissionController } from "../../../../adapters/http/controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "../../../../adapters/http/controllers/entities/permission-policy/module.mjs";
 import { ActivateController } from "../../../../adapters/http/controllers/workflows/activate/module.mjs";
+import { AuthenticatorChallengeController } from "../../../../adapters/http/controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "../../../../adapters/http/controllers/workflows/authorize/module.mjs";
 import { JwkController } from "../../../../adapters/http/controllers/workflows/jwks/module.mjs";
 import { LogoutController } from "../../../../adapters/http/controllers/workflows/logout/module.mjs";
@@ -117,8 +138,10 @@ import { RolePermissionController } from "../../../../adapters/http/controllers/
 import { PolicyController } from "../../../../adapters/http/controllers/entities/policy/module.mjs";
 import { ScopeController } from "../../../../adapters/http/controllers/entities/scope/module.mjs";
 import { SessionController } from "../../../../adapters/http/controllers/entities/session/module.mjs";
+import { TrustAnchorController } from "../../../../adapters/http/controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "../../../../adapters/http/controllers/entities/user/module.mjs";
 import { UserAttributeController } from "../../../../adapters/http/controllers/entities/user-attribute/module.mjs";
+import { UserAuthenticatorController } from "../../../../adapters/http/controllers/entities/user-authenticator/module.mjs";
 import { UserPermissionController } from "../../../../adapters/http/controllers/entities/user-permission/module.mjs";
 import { UserRoleController } from "../../../../adapters/http/controllers/entities/user-role/module.mjs";
 import "../../../../adapters/http/controllers/index.mjs";
@@ -133,6 +156,7 @@ import { decorators } from "@routup/decorators";
 //#region src/app/modules/http/modules/controller.ts
 var HTTPControllerModule = class {
 	async mount(router, container) {
+		const eventController = this.createEventController(container);
 		const realmController = this.createRealmController(container);
 		const roleController = this.createRoleController(container);
 		const permissionController = await this.createPermissionController(container);
@@ -147,9 +171,13 @@ var HTTPControllerModule = class {
 		const roleAttributeController = this.createRoleAttributeController(container);
 		const rolePermissionController = this.createRolePermissionController(container);
 		const scopeController = this.createScopeController(container);
+		const keyController = this.createKeyController(container);
+		const trustAnchorController = this.createTrustAnchorController(container);
 		const sessionController = this.createSessionController(container);
+		const consentController = this.createConsentController(container);
 		const userController = this.createUserController(container);
 		const userAttributeController = this.createUserAttributeController(container);
+		const userAuthenticatorController = this.createUserAuthenticatorController(container);
 		const userPermissionController = this.createUserPermissionController(container);
 		const userRoleController = this.createUserRoleController(container);
 		const policyController = this.createPolicyController(container);
@@ -164,13 +192,18 @@ var HTTPControllerModule = class {
 			this.createPasswordResetController(container),
 			this.createRegisterController(container),
 			this.createLogoutController(container),
+			this.createAuthenticatorChallengeController(container),
 			this.createStatusController(container),
 			clientController,
 			clientPermissionController,
 			clientRoleController,
 			clientScopeController,
+			consentController,
+			eventController,
 			identityProviderRoleController,
 			this.createIdentityProvider(container),
+			keyController,
+			trustAnchorController,
 			permissionController,
 			permissionPolicyController,
 			policyController,
@@ -185,6 +218,7 @@ var HTTPControllerModule = class {
 			sessionController,
 			userController,
 			userAttributeController,
+			userAuthenticatorController,
 			userPermissionController,
 			userRoleController
 		] }));
@@ -194,26 +228,36 @@ var HTTPControllerModule = class {
 		const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);
 		const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);
 		const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);
+		const eventService = container.resolve(DatabaseInjectionKey.EventService);
+		const metrics = container.resolve(MetricsInjectionKey);
 		return new AuthorizeController({
 			options: {
 				baseURL: config.publicUrl,
 				features: this.buildUIFeatures(config),
-				promptLoginMaxAge: config.promptLoginMaxAge
+				promptLoginMaxAge: config.promptLoginMaxAge,
+				mfaFreshnessMaxAge: config.mfaFreshnessMaxAge
 			},
 			codeIssuer,
 			codeRequestVerifier,
-			sessionManager
+			sessionManager,
+			eventService,
+			metrics,
+			mfaChallengeProvider: this.resolveUserAuthenticatorService(container),
+			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),
+			consentService: this.createConsentService(container),
+			logger: container.resolve(LoggerInjectionKey)
 		});
 	}
 	createToken(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		const logger = container.resolve(LoggerInjectionKey);
+		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);
 		const codeVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeVerifier);
 		const accessTokenIssuer = container.resolve(OAuth2InjectionToken.AccessTokenIssuer);
 		const refreshTokenIssuer = container.resolve(OAuth2InjectionToken.RefreshTokenIssuer);
 		const openIdTokenIssuer = container.resolve(OAuth2InjectionToken.OpenIDTokenIssuer);
-		const keyRepository = container.resolve(OAuth2InjectionToken.KeyRepository);
+		const keyStore = container.resolve(OAuth2InjectionToken.KeyStore);
 		const tokenRevoker = container.resolve(OAuth2InjectionToken.TokenRevoker);
 		const tokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);
 		const tokenRepository = container.resolve(OAuth2InjectionToken.TokenRepository);
@@ -221,28 +265,43 @@ var HTTPControllerModule = class {
 		const identityResolver = container.resolve(IdentityInjectionKey.Resolver);
 		const identityProviderLdapCollectionAuthenticator = container.resolve(IdentityInjectionKey.ProviderLdapCollectionAuthenticator);
 		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
-		const clientAuthenticator = new ClientAuthenticator(identityResolver);
 		const robotAuthenticator = new RobotAuthenticator(identityResolver);
 		const userAuthenticator = new CredentialsAuthenticator([identityProviderLdapCollectionAuthenticator, new UserAuthenticator(identityResolver)]);
-		const oauth2ClientAuthenticator = new OAuth2ClientAuthenticator(identityResolver);
+		const oauth2ClientAuthenticator = new OAuth2ClientAuthenticator({
+			identityResolver,
+			certificateValidator: new ClientCertificateValidator({ trustAnchorRepository: new TrustAnchorRepositoryAdapter(dataSource) })
+		});
 		return new TokenController({
 			codeVerifier,
 			accessTokenIssuer,
 			refreshTokenIssuer,
 			openIdTokenIssuer,
-			keyRepository,
+			keyStore,
 			tokenVerifier,
 			tokenRevoker,
 			tokenRepository,
 			sessionTokenRepository,
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			metrics: container.resolve(MetricsInjectionKey),
+			loginThrottleService: new LoginThrottleService({
+				repository: container.resolve(DatabaseInjectionKey.EventRepository),
+				options: {
+					enabled: config.loginAttemptThrottleEnabled,
+					threshold: config.loginAttemptThreshold,
+					windowSeconds: config.loginAttemptWindow
+				}
+			}),
+			userAuthenticatorService: this.resolveUserAuthenticatorService(container),
+			mfaLoginService: this.resolveMfaLoginService(container),
+			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),
 			tokenRefreshGracePeriod: config.tokenRefreshGracePeriod,
 			logger,
 			identityResolver,
 			identityPermissionProvider,
-			clientAuthenticator,
 			robotAuthenticator,
 			userAuthenticator,
 			oauth2ClientAuthenticator,
+			certificateSource: config.certificateSource,
 			realmRepository: new RealmRepositoryAdapter(container.resolve(RealmEntity)),
 			sessionManager
 		});
@@ -293,6 +352,7 @@ var HTTPControllerModule = class {
 			mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),
 			repository,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
 			options: {
 				passwordRecoveryEnabled: config.passwordRecoveryEnabled,
 				emailVerificationEnabled: config.emailVerificationEnabled,
@@ -318,6 +378,7 @@ var HTTPControllerModule = class {
 			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
 			clientRepository: container.resolve(OAuth2InjectionToken.ClientRepository),
 			realmRepository: new RealmRepositoryAdapter(container.resolve(RealmEntity)),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
 			hintGracePeriod: config.endSessionHintGracePeriod
 		});
 		return new LogoutController({
@@ -349,6 +410,7 @@ var HTTPControllerModule = class {
 			mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),
 			repository,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
 			options: {
 				registrationEnabled: config.registrationEnabled,
 				emailVerificationEnabled: config.emailVerificationEnabled,
@@ -373,10 +435,12 @@ var HTTPControllerModule = class {
 			options: { baseURL: config.publicUrl },
 			repository,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
+			clientRepository: container.resolve(OAuth2InjectionToken.ClientRepository),
 			accountManager,
 			codeIssuer,
 			codeRequestVerifier,
-			stateManager
+			stateManager,
+			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container)
 		});
 	}
 	createClientController(container) {
@@ -522,9 +586,108 @@ var HTTPControllerModule = class {
 			realmRepository
 		}) });
 	}
+	createKeyController(container) {
+		return new KeyController({ service: new KeyService({
+			repository: container.resolve(OAuth2InjectionToken.KeyStore),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			requestContext: useRequestEventContext
+		}) });
+	}
+	createTrustAnchorController(container) {
+		return new TrustAnchorController({ service: new TrustAnchorService({
+			repository: new TrustAnchorRepositoryAdapter(container.resolve(DatabaseInjectionKey.DataSource)),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			requestContext: useRequestEventContext
+		}) });
+	}
 	createSessionController(container) {
 		return new SessionController({ service: new SessionService({ repository: container.resolve(AuthenticationInjectionKey.SessionRepository) }) });
 	}
+	createConsentService(container) {
+		return new ConsentService({ repository: container.resolve(OAuth2InjectionToken.ConsentRepository) });
+	}
+	createConsentController(container) {
+		return new ConsentController({ service: this.createConsentService(container) });
+	}
+	accessPolicyEvaluator;
+	resolveAccessPolicyEvaluator(container) {
+		if (this.accessPolicyEvaluator) return this.accessPolicyEvaluator;
+		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
+		this.accessPolicyEvaluator = new OAuth2AccessPolicyEvaluator({
+			policyProvider: new PolicyRepository(dataSource),
+			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider),
+			logger: container.resolve(LoggerInjectionKey)
+		});
+		return this.accessPolicyEvaluator;
+	}
+	userAuthenticatorService;
+	resolveUserAuthenticatorService(container) {
+		if (this.userAuthenticatorService) return this.userAuthenticatorService;
+		const config = container.resolve(ConfigInjectionKey);
+		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
+		const repository = new UserAuthenticatorRepositoryAdapter(container.resolve(UserAuthenticatorEntity));
+		const userRepository = new UserRepositoryAdapter({
+			repository: new UserRepository(dataSource),
+			realmRepository: container.resolve(RealmEntity)
+		});
+		let issuer;
+		let webauthn;
+		try {
+			const url = new URL(config.publicUrl);
+			issuer = url.hostname;
+			webauthn = {
+				rpId: url.hostname,
+				rpName: issuer,
+				origin: url.origin
+			};
+		} catch {
+			issuer = void 0;
+			webauthn = void 0;
+		}
+		this.userAuthenticatorService = new UserAuthenticatorService({
+			repository,
+			userRepository,
+			cache: container.resolve(CacheInjectionKey),
+			cipher: new RealmCipher({ keyStore: container.resolve(OAuth2InjectionToken.KeyStore) }),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			mailClient: container.resolve(MailInjectionKey),
+			mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),
+			options: {
+				enabled: config.mfaEnabled,
+				required: config.mfaRequired,
+				issuer,
+				webauthn
+			}
+		});
+		return this.userAuthenticatorService;
+	}
+	createUserAuthenticatorController(container) {
+		return new UserAuthenticatorController({ service: this.resolveUserAuthenticatorService(container) });
+	}
+	mfaLoginService;
+	resolveMfaLoginService(container) {
+		if (this.mfaLoginService) return this.mfaLoginService;
+		this.mfaLoginService = new OAuth2MfaLoginService({
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
+			ticketIssuer: container.resolve(OAuth2InjectionToken.MfaTokenIssuer),
+			accessTokenIssuer: container.resolve(OAuth2InjectionToken.AccessTokenIssuer),
+			refreshTokenIssuer: container.resolve(OAuth2InjectionToken.RefreshTokenIssuer),
+			tokenRepository: container.resolve(OAuth2InjectionToken.TokenRepository),
+			eventService: container.resolve(DatabaseInjectionKey.EventService),
+			metrics: container.resolve(MetricsInjectionKey)
+		});
+		return this.mfaLoginService;
+	}
+	createAuthenticatorChallengeController(container) {
+		return new AuthenticatorChallengeController({
+			service: this.resolveUserAuthenticatorService(container),
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
+			mfaLoginService: this.resolveMfaLoginService(container)
+		});
+	}
+	createEventController(container) {
+		return new EventController({ service: container.resolve(DatabaseInjectionKey.EventService) });
+	}
 	createUserController(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
@@ -605,11 +768,19 @@ var HTTPControllerModule = class {
 				appOrigins: getAppOrigins(config),
 				logger
 			}),
+			keyProvisioner: new KeyProvisioner({
+				keyStore: container.resolve(OAuth2InjectionToken.KeyStore),
+				logger
+			}),
 			logger
 		});
 		const keyRepository = dataSource.getRepository(KeyEntity);
 		return new RealmController({
-			options: { baseURL: config.publicUrl },
+			options: {
+				baseURL: config.publicUrl,
+				mtlsBaseURL: config.mtlsPublicUrl,
+				clientCertificatesEnabled: config.certificateSource !== "disabled"
+			},
 			service,
 			keyRepository
 		});