@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/adapters/http/request/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EACtD,MAAMK,SAASV,iBAAiB,KAAKE,KAAK;EAC1C,MAAMS,WAAWZ,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIQ,OAAOE,SAAShB,UAAUiB,MAAM,KAAKF,UAAU;GAC/CN,IAAIS,OAAOT,IAAIS,QAAQ,IAAIhB,WAAAA;GAC3BO,IAAIS,KAAKC,IAAIlB,kBAAkBmB,UAAUL,QAAAA;EAC7C;EAEA,OAAON;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","compile","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionCompileContext,\n    PermissionCompileResult,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async compile(ctx: PermissionCompileContext) : Promise<PermissionCompileResult> {\n        return this.evaluator.compile(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T) : T {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIA,MAAMK,QAAQL,KAAkE;EAC5E,OAAO,KAAKF,UAAUO,QAAQ,KAAKJ,cAAcD,GAAAA,CAAAA;CACrD;CAIUC,cAAgFD,KAAY;EAClG,MAAMM,SAASX,iBAAiB,KAAKE,KAAK;EAC1C,MAAMU,WAAWb,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIS,OAAOE,SAASjB,UAAUkB,MAAM,KAAKF,UAAU;GAC/CP,IAAIU,OAAOV,IAAIU,QAAQ,IAAIjB,WAAAA;GAC3BO,IAAIU,KAAKC,IAAInB,kBAAkBoB,UAAUL,QAAAA;EAC7C;EAEA,OAAOP;CACX;AACJ"}

package/dist/adapters/http/ui/render.mjs

@@ -11,7 +11,7 @@ import { getURLBasePath } from "@authup/kit";
 import path from "node:path";
 import { useRequestCookie } from "@routup/basic/cookie";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
-import { load } from "locter";
+import { read } from "locter";
 import fs from "node:fs";
 //#region src/adapters/http/ui/render.ts
 const COLOR_MODE_COOKIE = "vc-color-mode";
@@ -36,7 +36,7 @@ async function renderUIPage(event, ctx) {
 	} else {
 		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
 		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-		render = cachedRender ??= (await load(path.join(UI_DIST_PATH, "server", "server.js"))).render;
+		render = cachedRender ??= (await read(path.join(UI_DIST_PATH, "server", "server.js"))).render;
 	}
 	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
 	const [appHtml, preloadLinks] = await render({

package/dist/adapters/http/ui/render.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","load","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { load } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await load(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}
+{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","read","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await read(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAuBjB"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/serve.mjs

@@ -16,7 +16,10 @@ import { useRequestQuery } from "@routup/basic/query";
 		features: options.features,
 		redirect: sanitizeRelativeRedirect(query.redirect)
 	};
-	if (options.realmAware) data.realmId = typeof query.realm_id === "string" ? query.realm_id : void 0;
+	if (options.realmAware) {
+		const realmId = typeof query.realmId === "string" ? query.realmId : query.realm_id;
+		data.realmId = typeof realmId === "string" ? realmId : void 0;
+	}
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
 	return renderUIPage(event, {
 		url: options.url,

package/dist/adapters/http/ui/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realm_id` / `token` query params (e.g.\n    // prefill from an email deep link). Off by default so a page never\n    // reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        data.realmId = typeof query.realm_id === 'string' ? query.realm_id : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YACRH,KAAKI,UAAU,OAAOL,MAAMM,aAAa,WAAWN,MAAMM,WAAWC,KAAAA;CAGzE,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/app/index.mjs

@@ -22,9 +22,6 @@ import { PermissionRepositoryAdapter } from "./modules/database/repositories/per
 import { PermissionPolicyRepositoryAdapter } from "./modules/database/repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./modules/database/repositories/permission-provider/module.mjs";
 import { PolicyRepositoryAdapter } from "./modules/database/repositories/policy/repository.mjs";
-import { RobotRepositoryAdapter } from "./modules/database/repositories/robot/repository.mjs";
-import { RobotPermissionRepositoryAdapter } from "./modules/database/repositories/robot-permission/repository.mjs";
-import { RobotRoleRepositoryAdapter } from "./modules/database/repositories/robot-role/repository.mjs";
 import { RoleRepositoryAdapter } from "./modules/database/repositories/role/repository.mjs";
 import { RoleAttributeRepositoryAdapter } from "./modules/database/repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./modules/database/repositories/role-permission/repository.mjs";
@@ -51,7 +48,6 @@ import { IdentityProviderAttributeMappingRepository } from "./modules/identity/r
 import { IdentityProviderPermissionMappingRepository } from "./modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./modules/identity/repositories/provider/mapper/role.mjs";
 import { ClientIdentityRepository } from "./modules/identity/repositories/client.mjs";
-import { RobotIdentityRepository } from "./modules/identity/repositories/robot.mjs";
 import { UserIdentityRepository } from "./modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
@@ -68,4 +64,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };

package/dist/app/modules/authentication/repositories/session.d.ts

@@ -1,4 +1,5 @@
 import type { Session } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
 import type { Repository } from 'typeorm';
 import type { ISessionRepository, SessionFindManyOptions, SessionOwner } from '../../../../core/index.ts';
@@ -11,9 +12,9 @@ export declare class SessionRepository implements ISessionRepository {
     protected repository: Repository<Session>;
     constructor(ctx: SessionRepositoryContext);
     findOneById(id: string): Promise<Session | null>;
-    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
     findAllByOwner(owner: SessionOwner): Promise<Session[]>;
-    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
+    findAllByQuery(query: IQuery): Promise<Session[]>;
     save(input: Partial<Session>): Promise<Session>;
     remove(session: Session): Promise<void>;
     removeById(id: string): Promise<void>;

package/dist/app/modules/authentication/repositories/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EACR,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAKnC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,QAAQ,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAkD7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAmB9D,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EACR,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAInC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,QAAQ,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IA0B7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgBjD,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}

package/dist/app/modules/authentication/repositories/session.mjs

@@ -1,12 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { SESSION_FILTER_KEYS } from "../../../../core/authentication/session/types.mjs";
-import "../../../../core/index.mjs";
+import { applyQuery } from "../../database/repositories/query.mjs";
 import { applyRealmScopeSelect } from "../../database/repositories/helpers.mjs";
 import { AuthenticationCachePrefix } from "./constants.mjs";
 import { buildCacheKey } from "@authup/server-kit";
-import { applyQuery } from "typeorm-extension";
 //#region src/app/modules/authentication/repositories/session.ts
 var SessionRepository = class {
 	cache;
@@ -25,36 +23,9 @@ var SessionRepository = class {
 	}
 	async findMany(query, options = {}) {
 		const qb = this.repository.createQueryBuilder("session");
-		const { pagination } = applyQuery(qb, query, {
-			defaultAlias: "session",
-			fields: { allowed: [
-				"id",
-				"sub",
-				"sub_kind",
-				"ip_address",
-				"user_agent",
-				"expires_at",
-				"refreshed_at",
-				"seen_at",
-				"created_at",
-				"updated_at",
-				"user_id",
-				"client_id",
-				"robot_id",
-				"realm_id"
-			] },
-			filters: { allowed: [...SESSION_FILTER_KEYS] },
-			relations: { allowed: ["realm"] },
-			sort: { allowed: [
-				"seen_at",
-				"expires_at",
-				"created_at",
-				"updated_at"
-			] },
-			pagination: { maxLimit: 50 }
-		});
-		applyRealmScopeSelect(qb, "session", ["sub", "sub_kind"]);
-		if (options.owner) qb.andWhere("session.sub = :ownerSub AND session.sub_kind = :ownerSubKind", {
+		const { pagination } = applyQuery(qb, query);
+		applyRealmScopeSelect(qb, "session", ["sub", "subKind"]);
+		if (options.owner) qb.andWhere("session.sub = :ownerSub AND session.subKind = :ownerSubKind", {
 			ownerSub: options.owner.sub,
 			ownerSubKind: options.owner.subKind
 		});
@@ -68,18 +39,15 @@ var SessionRepository = class {
 		};
 	}
 	async findAllByOwner(owner) {
-		return this.repository.createQueryBuilder("session").where("session.sub = :sub AND session.sub_kind = :subKind", {
+		return this.repository.createQueryBuilder("session").where("session.sub = :sub AND session.subKind = :subKind", {
 			sub: owner.sub,
 			subKind: owner.subKind
 		}).getMany();
 	}
 	async findAllByQuery(query) {
 		const qb = this.repository.createQueryBuilder("session");
-		applyQuery(qb, query, {
-			defaultAlias: "session",
-			filters: { allowed: [...SESSION_FILTER_KEYS] }
-		});
-		applyRealmScopeSelect(qb, "session", ["sub", "sub_kind"]);
+		applyQuery(qb, query);
+		applyRealmScopeSelect(qb, "session", ["sub", "subKind"]);
 		return qb.getMany();
 	}
 	async save(input) {
@@ -88,7 +56,7 @@ var SessionRepository = class {
 		await this.cache.set(buildCacheKey({
 			prefix: AuthenticationCachePrefix.SESSION,
 			key: session.id
-		}), session, { ttl: new Date(session.expires_at).getTime() - Date.now() });
+		}), session, { ttl: new Date(session.expiresAt).getTime() - Date.now() });
 		return session;
 	}
 	async remove(session) {

package/dist/app/modules/authentication/repositories/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","SESSION_FILTER_KEYS","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","defaultAlias","fields","allowed","filters","relations","sort","maxLimit","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expires_at","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery } from 'typeorm-extension';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: Record<string, any>,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'session',\n            fields: {\n                allowed: [\n                    'id', \n                    'sub', \n                    'sub_kind', \n                    'ip_address', \n                    'user_agent',\n                    'expires_at', \n                    'refreshed_at', \n                    'seen_at', \n                    'created_at', \n                    'updated_at',\n                    'user_id', \n                    'client_id', \n                    'robot_id', \n                    'realm_id',\n                ],\n            },\n            filters: { allowed: [...SESSION_FILTER_KEYS] },\n            relations: { allowed: ['realm'] },\n            sort: { allowed: ['seen_at', 'expires_at', 'created_at', 'updated_at'] },\n            pagination: { maxLimit: 50 },\n        });\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'sub_kind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.sub_kind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.sub_kind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: Record<string, any>): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: deliberately no `pagination` — a bulk revoke must reach every\n        // matching row. `applyQuery` with a `pagination.maxLimit` would default\n        // the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query, {\n            defaultAlias: 'session',\n            filters: { allowed: [...SESSION_FILTER_KEYS] },\n        });\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'sub_kind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expires_at).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;AA0BA,IAAaK,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BZ,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAerB,WAAWmB,IAAIF,OAAO;GACzCK,cAAc;GACdC,QAAQ,EACJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAED,SAAS,CAAA,GAAIvB,mBAAAA,EAAqB;GAC7CyB,WAAW,EAAEF,SAAS,CAAC,OAAA,EAAS;GAChCG,MAAM,EAAEH,SAAS;IAAC;IAAW;IAAc;IAAc;KAAc;GACvEH,YAAY,EAAEO,UAAU,GAAG;EAC/B,CAAA;EAEA1B,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EAExD,IAAID,QAAQW,OAERV,GAAGW,SAAS,gEAAgE;GACxEC,UAAUb,QAAQW,MAAMG;GACxBC,cAAcf,QAAQW,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGf;GACP;EACJ;CACJ;CAEA,MAAMmB,eAAeX,OAAyC;EAC1D,OAAO,KAAKvB,WAAWc,mBAAmB,SAAA,CAAA,CACrCqB,MAAM,sDAAsD;GACzDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAe1B,OAAgD;EACjE,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CpB,WAAWmB,IAAIF,OAAO;GAClBK,cAAc;GACdG,SAAS,EAAED,SAAS,CAAA,GAAIvB,mBAAAA,EAAqB;EACjD,CAAA;EAEAC,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EAExD,OAAOA,GAAGuB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAMnC,UAAU,KAAKJ,WAAWwC,OAAOD,KAAAA;EACvC,MAAM,KAAKvC,WAAWsC,KAAKlC,OAAAA;EAE3B,MAAM,KAAKL,MAAM0C,IACbhD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAEsC,KAAK,IAAIC,KAAKvC,QAAQwC,UAAU,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG/D,OAAO1C;CACX;CAIA,MAAM2C,OAAO3C,SAAiC;EAC1C,MAAM,KAAKJ,WAAW+C,OAAO3C,OAAAA;EAC7B,MAAM,KAAKL,MAAMiD,KACbvD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAM8C,WAAW9C,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAK2C,OAAO3C,OAAAA;CAE1B;AACJ"}
+{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expiresAt","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery } from '../../database/repositories/query.ts';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: IQuery,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.subKind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: `parameters: ['filters']` — a bulk revoke must reach every\n        // matching row. Applying the schema's `pagination.maxLimit` would\n        // default the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expiresAt).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;AA0BA,IAAaI,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BX,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAepB,WAAWkB,IAAIF,KAAAA;EAEtCf,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAA,CAAU;EAEvD,IAAID,QAAQI,OAERH,GAAGI,SAAS,+DAA+D;GACvEC,UAAUN,QAAQI,MAAMG;GACxBC,cAAcR,QAAQI,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMV,GAAGW,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,eAAeX,OAAyC;EAC1D,OAAO,KAAKhB,WAAWc,mBAAmB,SAAA,CAAA,CACrCc,MAAM,qDAAqD;GACxDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAenB,OAAmC;EACpD,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CnB,WAAWkB,IAAIF,KAAAA;EAEff,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAA,CAAU;EAEvD,OAAOA,GAAGgB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAM5B,UAAU,KAAKJ,WAAWiC,OAAOD,KAAAA;EACvC,MAAM,KAAKhC,WAAW+B,KAAK3B,OAAAA;EAE3B,MAAM,KAAKL,MAAMmC,IACbxC,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAE+B,KAAK,IAAIC,KAAKhC,QAAQiC,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG9D,OAAOnC;CACX;CAIA,MAAMoC,OAAOpC,SAAiC;EAC1C,MAAM,KAAKJ,WAAWwC,OAAOpC,OAAAA;EAC7B,MAAM,KAAKL,MAAM0C,KACb/C,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAMuC,WAAWvC,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKoC,OAAOpC,OAAAA;CAE1B;AACJ"}

package/dist/app/modules/config/constants.d.ts

@@ -41,10 +41,6 @@ export declare enum ConfigEnvironmentVariableName {
     USER_ADMIN_ENABLED = "USER_ADMIN_ENABLED",
     USER_ADMIN_PASSWORD = "USER_ADMIN_PASSWORD",
     USER_ADMIN_PASSWORD_RESET = "USER_ADMIN_PASSWORD_RESET",
-    ROBOT_AUTH_BASIC = "ROBOT_AUTH_BASIC",
-    ROBOT_ADMIN_ENABLED = "ROBOT_ADMIN_ENABLED",
-    ROBOT_ADMIN_SECRET = "ROBOT_ADMIN_SECRET",
-    ROBOT_ADMIN_SECRET_RESET = "ROBOT_ADMIN_SECRET_RESET",
     PERMISSIONS = "PERMISSIONS",
     PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = "PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"
 }

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -44,10 +44,6 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["USER_ADMIN_ENABLED"] = "USER_ADMIN_ENABLED";
 	ConfigEnvironmentVariableName["USER_ADMIN_PASSWORD"] = "USER_ADMIN_PASSWORD";
 	ConfigEnvironmentVariableName["USER_ADMIN_PASSWORD_RESET"] = "USER_ADMIN_PASSWORD_RESET";
-	ConfigEnvironmentVariableName["ROBOT_AUTH_BASIC"] = "ROBOT_AUTH_BASIC";
-	ConfigEnvironmentVariableName["ROBOT_ADMIN_ENABLED"] = "ROBOT_ADMIN_ENABLED";
-	ConfigEnvironmentVariableName["ROBOT_ADMIN_SECRET"] = "ROBOT_ADMIN_SECRET";
-	ConfigEnvironmentVariableName["ROBOT_ADMIN_SECRET_RESET"] = "ROBOT_ADMIN_SECRET_RESET";
 	ConfigEnvironmentVariableName["PERMISSIONS"] = "PERMISSIONS";
 	ConfigEnvironmentVariableName["PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"] = "PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT";
 	return ConfigEnvironmentVariableName;

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2J9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJ9E"}

package/dist/app/modules/config/normalize.mjs

@@ -82,10 +82,6 @@ async function normalizeConfig(input = {}) {
 		userAdminEnabled: true,
 		userAdminPassword: "start123",
 		userAdminPasswordReset: false,
-		robotAuthBasic: false,
-		robotAdminEnabled: false,
-		robotAdminSecret: "start123",
-		robotAdminSecretReset: false,
 		permissions: [],
 		permissionsDefaultPolicyAssignment: true,
 		...parsed,

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,eAAsBW,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCb,KAAKc,KAAKb,QAAQc,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOtB,KAAK,YAAYK,gBAAgBkB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQjB,gBAAgBwB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU9B,QAAQc,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EAEnBC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBlD;EAEnBmD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGlE;EAIHW;CACJ;CAIA,IAAIO,OAAO2B,+BAA+B,CAAC3B,OAAOuB,iBAC9C,MAAM,IAAIlD,YAAY,uDAAA;CAG1B,IAAI2B,OAAOgC,eAAe,CAAChC,OAAO+B,YAC9B,MAAM,IAAI1D,YAAY,kCAAA;CAG1B,IAAI2B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAIjC,YAAY,yDAAA;CAQ1B,IAAI2B,OAAO8B,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAa1E,oBAAoByB,OAAO8B,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAI5E,YAAY,gEAAA;CAE9B;CAEA,OAAO2B;AACX"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,eAAsBW,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCb,KAAKc,KAAKb,QAAQc,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOtB,KAAK,YAAYK,gBAAgBkB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQjB,gBAAgBwB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU9B,QAAQc,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EAEnBC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBlD;EAEnBmD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG9D;EAIHW;CACJ;CAIA,IAAIO,OAAO2B,+BAA+B,CAAC3B,OAAOuB,iBAC9C,MAAM,IAAIlD,YAAY,uDAAA;CAG1B,IAAI2B,OAAOgC,eAAe,CAAChC,OAAO+B,YAC9B,MAAM,IAAI1D,YAAY,kCAAA;CAG1B,IAAI2B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAIjC,YAAY,yDAAA;CAQ1B,IAAI2B,OAAO8B,sBAAsB;EAC7B,IAAIe,aAAa;EACjB,IAAI;GACAA,aAAatE,oBAAoByB,OAAO8B,qBAAqBgB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAIxE,YAAY,gEAAA;CAE9B;CAEA,OAAO2B;AACX"}

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CAkQnD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CA4OnD"}

package/dist/app/modules/config/read/env.mjs

@@ -115,14 +115,6 @@ function readConfigRawFromEnv() {
 	if (userAdminPassword) options.userAdminPassword = userAdminPassword;
 	const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);
 	if (typeof userAdminPasswordReset !== "undefined") options.userAdminPasswordReset = userAdminPasswordReset;
-	const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);
-	if (typeof robotBasicAuth !== "undefined") options.robotAuthBasic = robotBasicAuth;
-	const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);
-	if (typeof robotAdminEnabled !== "undefined") options.robotAdminEnabled = robotAdminEnabled;
-	const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);
-	if (robotAdminSecret) options.robotAdminSecret = robotAdminSecret;
-	const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);
-	if (typeof robotAdminSecretReset !== "undefined") options.robotAdminSecretReset = robotAdminSecretReset;
 	const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);
 	if (permissions && permissions.length > 0) options.permissions = permissions;
 	const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","robotBasicAuth","ROBOT_AUTH_BASIC","robotAuthBasic","robotAdminEnabled","ROBOT_ADMIN_ENABLED","robotAdminSecret","ROBOT_ADMIN_SECRET","robotAdminSecretReset","ROBOT_ADMIN_SECRET_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3ConnectionOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3ConnectionOptions.js';\nimport type { MysqlConnectionOptions } from 'typeorm/driver/mysql/MysqlConnectionOptions.js';\nimport type { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlConnectionOptions |\n        PostgresConnectionOptions |\n        BetterSqlite3ConnectionOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const robotBasicAuth = readBool(ConfigEnvironmentVariableName.ROBOT_AUTH_BASIC);\n    if (typeof robotBasicAuth !== 'undefined') {\n        options.robotAuthBasic = robotBasicAuth;\n    }\n\n    const robotAdminEnabled = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_ENABLED);\n    if (typeof robotAdminEnabled !== 'undefined') {\n        options.robotAdminEnabled = robotAdminEnabled;\n    }\n\n    const robotAdminSecret = read(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET);\n    if (robotAdminSecret) {\n        options.robotAdminSecret = robotAdminSecret;\n    }\n\n    const robotAdminSecretReset = readBool(ConfigEnvironmentVariableName.ROBOT_ADMIN_SECRET_RESET);\n    if (typeof robotAdminSecretReset !== 'undefined') {\n        options.robotAdminSecretReset = robotAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;CAAK;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;CAAM;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAGhC,MAAME,iBAAiB1C,UAAUK,8BAA8BsC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe7B,SAAS,GAC1CO,QAAQsB,iBAAiBA;CAG7B,MAAME,oBAAoB1C,QAAQG,8BAA8BwC,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxB,QAAQwB,oBAAoBA;CAGhC,MAAME,qBAAqB5C,QAAQG,8BAA8B0C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B1B,QAAQ0B,qBAAqBA;CAGjC,MAAME,0BAA0B9C,QAAQG,8BAA8B4C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAGtC,MAAME,oBAAoBhD,QAAQG,8BAA8B8C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B9B,QAAQ8B,oBAAoBA;CAGhC,MAAME,4BAA4BlD,QAAQG,8BAA8BgD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrChC,QAAQgC,4BAA4BA;CAGxC,MAAME,sBAAsBrD,SAASI,8BAA8BkD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BlC,QAAQkC,sBAAsBA;CAGlC,MAAME,2BAA2BvD,SAASI,8BAA8BoD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCpC,QAAQoC,2BAA2BA;CAGvC,MAAME,0BAA0BzD,SAASI,8BAA8BsD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAKhC,MAAME,kBAAkBrD,eAAeJ,8BAA8B0D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B1C,QAAQ0C,kBAAkBA;CAG9B,MAAME,wBAAwB9D,QAAQG,8BAA8B4D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC5C,QAAQ4C,wBAAwBA;CAGpC,MAAME,wBAAwBzD,eAAeJ,8BAA8B8D,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,8BAA8BlE,QAAQG,8BAA8BgE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvChD,QAAQgD,8BAA8BA;CAG1C,MAAME,8BAA8B7D,eAAeJ,8BAA8BkE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,wBAAwBtE,QAAQG,8BAA8BoE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAGpC,MAAME,qBAAqBxE,QAAQG,8BAA8BsE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BtD,QAAQsD,qBAAqBA;CAKjC,MAAME,aAAanE,eAAeJ,8BAA8BwE,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBxD,QAAQwD,aAAaA;CAGzB,MAAME,cAAcrE,eAAeJ,8BAA8B0E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB1D,QAAQ0D,cAAcA;CAG1B,MAAME,qBAAqB9E,QAAQG,8BAA8B4E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5D,QAAQ4D,qBAAqBA;CAGjC,MAAME,kBAAkBhF,QAAQG,8BAA8B8E,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9D,QAAQ8D,kBAAkBA;CAG9B,MAAME,uBAAuBrF,KAAKM,8BAA8BgF,sBAAsB;CACtF,IAAID,sBACAhE,QAAQgE,uBAAuBA;CAKnC,MAAME,kBAAkBrF,SAASI,8BAA8BkF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BlE,QAAQoE,kBAAkBF;CAG9B,MAAMG,sBAAsBxF,SAASI,8BAA8BqF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BrE,QAAQqE,sBAAsBA;CAGlC,MAAME,oBAAoB5F,KAAKM,8BAA8BuF,oBAAoB;CACjF,IAAID,mBACAvE,QAAQyE,qBAAqBF;CAGjC,MAAMG,yBAAyB7F,SAASI,8BAA8B0F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC1E,QAAQ4E,0BAA0BF;CAKtC,MAAMG,gBAAgBhG,SAASI,8BAA8B6F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB7E,QAAQ+E,gBAAgBF;CAG5B,MAAMG,mBAAmBnG,SAASI,8BAA8BgG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BhF,QAAQgF,mBAAmBA;CAG/B,MAAME,oBAAoBvG,KAAKM,8BAA8BkG,mBAAmB;CAChF,IAAID,mBACAlF,QAAQkF,oBAAoBA;CAGhC,MAAME,yBAAyBvG,SAASI,8BAA8BoG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCpF,QAAQoF,yBAAyBA;CAKrC,MAAME,iBAAiBzG,SAASI,8BAA8BsG,gBAAgB;CAC9E,IAAI,OAAOD,mBAAmB,aAC1BtF,QAAQwF,iBAAiBF;CAG7B,MAAMG,oBAAoB5G,SAASI,8BAA8ByG,mBAAmB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BzF,QAAQyF,oBAAoBA;CAGhC,MAAME,mBAAmBhH,KAAKM,8BAA8B2G,kBAAkB;CAC9E,IAAID,kBACA3F,QAAQ2F,mBAAmBA;CAG/B,MAAME,wBAAwBhH,SAASI,8BAA8B6G,wBAAwB;CAC7F,IAAI,OAAOD,0BAA0B,aACjC7F,QAAQ6F,wBAAwBA;CAKpC,MAAME,cAAcnH,UAAUK,8BAA8B+G,WAAW;CACvE,IAAID,eAAeA,YAAYtG,SAAS,GACpCO,QAAQ+F,cAAcA;CAG1B,MAAME,qCAAqCpH,SAASI,8BAA8BiH,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CjG,QAAQiG,qCAAqCA;CAGjD,OAAOjG;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;CAAK;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;CAAM;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAAA,CAC3C;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAAA,CAC1C;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAGhC,MAAME,iBAAiB1C,UAAUK,8BAA8BsC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe7B,SAAS,GAC1CO,QAAQsB,iBAAiBA;CAG7B,MAAME,oBAAoB1C,QAAQG,8BAA8BwC,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxB,QAAQwB,oBAAoBA;CAGhC,MAAME,qBAAqB5C,QAAQG,8BAA8B0C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B1B,QAAQ0B,qBAAqBA;CAGjC,MAAME,0BAA0B9C,QAAQG,8BAA8B4C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAGtC,MAAME,oBAAoBhD,QAAQG,8BAA8B8C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B9B,QAAQ8B,oBAAoBA;CAGhC,MAAME,4BAA4BlD,QAAQG,8BAA8BgD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrChC,QAAQgC,4BAA4BA;CAGxC,MAAME,sBAAsBrD,SAASI,8BAA8BkD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BlC,QAAQkC,sBAAsBA;CAGlC,MAAME,2BAA2BvD,SAASI,8BAA8BoD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCpC,QAAQoC,2BAA2BA;CAGvC,MAAME,0BAA0BzD,SAASI,8BAA8BsD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAKhC,MAAME,kBAAkBrD,eAAeJ,8BAA8B0D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B1C,QAAQ0C,kBAAkBA;CAG9B,MAAME,wBAAwB9D,QAAQG,8BAA8B4D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC5C,QAAQ4C,wBAAwBA;CAGpC,MAAME,wBAAwBzD,eAAeJ,8BAA8B8D,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,8BAA8BlE,QAAQG,8BAA8BgE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvChD,QAAQgD,8BAA8BA;CAG1C,MAAME,8BAA8B7D,eAAeJ,8BAA8BkE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,wBAAwBtE,QAAQG,8BAA8BoE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAGpC,MAAME,qBAAqBxE,QAAQG,8BAA8BsE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BtD,QAAQsD,qBAAqBA;CAKjC,MAAME,aAAanE,eAAeJ,8BAA8BwE,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBxD,QAAQwD,aAAaA;CAGzB,MAAME,cAAcrE,eAAeJ,8BAA8B0E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB1D,QAAQ0D,cAAcA;CAG1B,MAAME,qBAAqB9E,QAAQG,8BAA8B4E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5D,QAAQ4D,qBAAqBA;CAGjC,MAAME,kBAAkBhF,QAAQG,8BAA8B8E,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9D,QAAQ8D,kBAAkBA;CAG9B,MAAME,uBAAuBrF,KAAKM,8BAA8BgF,sBAAsB;CACtF,IAAID,sBACAhE,QAAQgE,uBAAuBA;CAKnC,MAAME,kBAAkBrF,SAASI,8BAA8BkF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BlE,QAAQoE,kBAAkBF;CAG9B,MAAMG,sBAAsBxF,SAASI,8BAA8BqF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BrE,QAAQqE,sBAAsBA;CAGlC,MAAME,oBAAoB5F,KAAKM,8BAA8BuF,oBAAoB;CACjF,IAAID,mBACAvE,QAAQyE,qBAAqBF;CAGjC,MAAMG,yBAAyB7F,SAASI,8BAA8B0F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC1E,QAAQ4E,0BAA0BF;CAKtC,MAAMG,gBAAgBhG,SAASI,8BAA8B6F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB7E,QAAQ+E,gBAAgBF;CAG5B,MAAMG,mBAAmBnG,SAASI,8BAA8BgG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BhF,QAAQgF,mBAAmBA;CAG/B,MAAME,oBAAoBvG,KAAKM,8BAA8BkG,mBAAmB;CAChF,IAAID,mBACAlF,QAAQkF,oBAAoBA;CAGhC,MAAME,yBAAyBvG,SAASI,8BAA8BoG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCpF,QAAQoF,yBAAyBA;CAKrC,MAAME,cAAc1G,UAAUK,8BAA8BsG,WAAW;CACvE,IAAID,eAAeA,YAAY7F,SAAS,GACpCO,QAAQsF,cAAcA;CAG1B,MAAME,qCAAqC3G,SAASI,8BAA8BwG,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CxF,QAAQwF,qCAAqCA;CAGjD,OAAOxF;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -305,25 +305,6 @@ export type Config = {
      * default: undefined
      */
     userAdminPasswordReset: boolean;
-    /**
-     * default: false
-     */
-    robotAuthBasic: boolean;
-    /**
-     * Enable a global robot account.
-     * default: false
-     */
-    robotAdminEnabled: boolean;
-    /**
-     * The secret of the default admin user.
-     * default: (**generated**)
-     */
-    robotAdminSecret: string;
-    /**
-     * Reset the robot secret on application startup.
-     * default: false
-     */
-    robotAdminSecretReset: boolean;
     /**
      * default: []
      */