@authup/server-core 1.0.0-beta.55 → 1.0.0-beta.57

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAGhC,MAAME,iBAAiB1C,UAAUK,8BAA8BsC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe7B,SAAS,GAC1CO,QAAQsB,iBAAiBA;CAG7B,MAAME,oBAAoB1C,QAAQG,8BAA8BwC,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxB,QAAQwB,oBAAoBA;CAGhC,MAAME,qBAAqB5C,QAAQG,8BAA8B0C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B1B,QAAQ0B,qBAAqBA;CAGjC,MAAME,0BAA0B9C,QAAQG,8BAA8B4C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAGtC,MAAME,oBAAoBhD,QAAQG,8BAA8B8C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B9B,QAAQ8B,oBAAoBA;CAGhC,MAAME,4BAA4BlD,QAAQG,8BAA8BgD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrChC,QAAQgC,4BAA4BA;CAGxC,MAAME,sBAAsBrD,SAASI,8BAA8BkD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BlC,QAAQkC,sBAAsBA;CAGlC,MAAME,2BAA2BvD,SAASI,8BAA8BoD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCpC,QAAQoC,2BAA2BA;CAGvC,MAAME,0BAA0BzD,SAASI,8BAA8BsD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAKhC,MAAME,kBAAkBrD,eAAeJ,8BAA8B0D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B1C,QAAQ0C,kBAAkBA;CAG9B,MAAME,wBAAwB9D,QAAQG,8BAA8B4D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC5C,QAAQ4C,wBAAwBA;CAGpC,MAAME,wBAAwBzD,eAAeJ,8BAA8B8D,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,8BAA8BlE,QAAQG,8BAA8BgE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvChD,QAAQgD,8BAA8BA;CAG1C,MAAME,8BAA8B7D,eAAeJ,8BAA8BkE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,wBAAwBtE,QAAQG,8BAA8BoE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAGpC,MAAME,qBAAqBxE,QAAQG,8BAA8BsE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BtD,QAAQsD,qBAAqBA;CAKjC,MAAME,aAAanE,eAAeJ,8BAA8BwE,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBxD,QAAQwD,aAAaA;CAGzB,MAAME,cAAcrE,eAAeJ,8BAA8B0E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB1D,QAAQ0D,cAAcA;CAG1B,MAAME,qBAAqB9E,QAAQG,8BAA8B4E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5D,QAAQ4D,qBAAqBA;CAGjC,MAAME,kBAAkBhF,QAAQG,8BAA8B8E,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9D,QAAQ8D,kBAAkBA;CAG9B,MAAME,uBAAuBrF,KAAKM,8BAA8BgF,sBAAsB;CACtF,IAAID,sBACAhE,QAAQgE,uBAAuBA;CAKnC,MAAME,kBAAkBrF,SAASI,8BAA8BkF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BlE,QAAQoE,kBAAkBF;CAG9B,MAAMG,sBAAsBxF,SAASI,8BAA8BqF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BrE,QAAQqE,sBAAsBA;CAGlC,MAAME,oBAAoB5F,KAAKM,8BAA8BuF,oBAAoB;CACjF,IAAID,mBACAvE,QAAQyE,qBAAqBF;CAGjC,MAAMG,yBAAyB7F,SAASI,8BAA8B0F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC1E,QAAQ4E,0BAA0BF;CAKtC,MAAMG,gBAAgBhG,SAASI,8BAA8B6F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB7E,QAAQ+E,gBAAgBF;CAG5B,MAAMG,mBAAmBnG,SAASI,8BAA8BgG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BhF,QAAQgF,mBAAmBA;CAG/B,MAAME,oBAAoBvG,KAAKM,8BAA8BkG,mBAAmB;CAChF,IAAID,mBACAlF,QAAQkF,oBAAoBA;CAGhC,MAAME,yBAAyBvG,SAASI,8BAA8BoG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCpF,QAAQoF,yBAAyBA;CAKrC,MAAME,cAAc1G,UAAUK,8BAA8BsG,WAAW;CACvE,IAAID,eAAeA,YAAY7F,SAAS,GACpCO,QAAQsF,cAAcA;CAG1B,MAAME,qCAAqC3G,SAASI,8BAA8BwG,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CxF,QAAQwF,qCAAqCA;CAGjD,OAAOxF;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    // canonicalized again in normalizeConfig for every config surface; the\n    // env read keeps the raw string, the shared canonicalizer decides.\n    const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n    if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n        options.trustProxy = trustProxy;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAKhC,MAAME,aAAa3C,KAAKM,8BAA8BsC,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAW9B,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQsB,aAAaA;CAGzB,MAAME,iBAAiB5C,UAAUK,8BAA8BwC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe/B,SAAS,GAC1CO,QAAQwB,iBAAiBA;CAG7B,MAAME,oBAAoB5C,QAAQG,8BAA8B0C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B1B,QAAQ0B,oBAAoBA;CAGhC,MAAME,qBAAqB9C,QAAQG,8BAA8B4C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5B,QAAQ4B,qBAAqBA;CAGjC,MAAME,0BAA0BhD,QAAQG,8BAA8B8C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC9B,QAAQ8B,0BAA0BA;CAGtC,MAAME,oBAAoBlD,QAAQG,8BAA8BgD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BhC,QAAQgC,oBAAoBA;CAGhC,MAAME,4BAA4BpD,QAAQG,8BAA8BkD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrClC,QAAQkC,4BAA4BA;CAGxC,MAAME,sBAAsBvD,SAASI,8BAA8BoD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BpC,QAAQoC,sBAAsBA;CAGlC,MAAME,2BAA2BzD,SAASI,8BAA8BsD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCtC,QAAQsC,2BAA2BA;CAGvC,MAAME,0BAA0B3D,SAASI,8BAA8BwD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCxC,QAAQwC,0BAA0BA;CAGtC,MAAME,oBAAoB5D,QAAQG,8BAA8B0D,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7B1C,QAAQ0C,oBAAoBA;CAKhC,MAAME,kBAAkBvD,eAAeJ,8BAA8B4D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B5C,QAAQ4C,kBAAkBA;CAG9B,MAAME,wBAAwBhE,QAAQG,8BAA8B8D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,wBAAwB3D,eAAeJ,8BAA8BgE,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjChD,QAAQgD,wBAAwBA;CAGpC,MAAME,8BAA8BpE,QAAQG,8BAA8BkE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,8BAA8B/D,eAAeJ,8BAA8BoE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvCpD,QAAQoD,8BAA8BA;CAG1C,MAAME,wBAAwBxE,QAAQG,8BAA8BsE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCtD,QAAQsD,wBAAwBA;CAGpC,MAAME,qBAAqB1E,QAAQG,8BAA8BwE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BxD,QAAQwD,qBAAqBA;CAKjC,MAAME,aAAarE,eAAeJ,8BAA8B0E,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtB1D,QAAQ0D,aAAaA;CAGzB,MAAME,cAAcvE,eAAeJ,8BAA8B4E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB5D,QAAQ4D,cAAcA;CAG1B,MAAME,qBAAqBhF,QAAQG,8BAA8B8E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B9D,QAAQ8D,qBAAqBA;CAGjC,MAAME,kBAAkBlF,QAAQG,8BAA8BgF,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BhE,QAAQgE,kBAAkBA;CAG9B,MAAME,uBAAuBvF,KAAKM,8BAA8BkF,sBAAsB;CACtF,IAAID,sBACAlE,QAAQkE,uBAAuBA;CAKnC,MAAME,kBAAkBvF,SAASI,8BAA8BoF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BpE,QAAQsE,kBAAkBF;CAG9B,MAAMG,sBAAsB1F,SAASI,8BAA8BuF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BvE,QAAQuE,sBAAsBA;CAGlC,MAAME,oBAAoB9F,KAAKM,8BAA8ByF,oBAAoB;CACjF,IAAID,mBACAzE,QAAQ2E,qBAAqBF;CAGjC,MAAMG,yBAAyB/F,SAASI,8BAA8B4F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC5E,QAAQ8E,0BAA0BF;CAKtC,MAAMG,gBAAgBlG,SAASI,8BAA8B+F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB/E,QAAQiF,gBAAgBF;CAG5B,MAAMG,mBAAmBrG,SAASI,8BAA8BkG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BlF,QAAQkF,mBAAmBA;CAG/B,MAAME,oBAAoBzG,KAAKM,8BAA8BoG,mBAAmB;CAChF,IAAID,mBACApF,QAAQoF,oBAAoBA;CAGhC,MAAME,yBAAyBzG,SAASI,8BAA8BsG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQsF,yBAAyBA;CAKrC,MAAME,cAAc5G,UAAUK,8BAA8BwG,WAAW;CACvE,IAAID,eAAeA,YAAY/F,SAAS,GACpCO,QAAQwF,cAAcA;CAG1B,MAAME,qCAAqC7G,SAASI,8BAA8B0G,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C1F,QAAQ0F,qCAAqCA;CAGjD,OAAO1F;AACX"}

package/dist/app/modules/config/read/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/fs.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,kDA0C1E"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/fs.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiCtD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,kDA6C1E"}

package/dist/app/modules/config/read/fs.mjs

@@ -1,29 +1,52 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { Container } from "confinity";
+import { isObject, merge } from "smob";
+import { FSStore } from "confinity";
 //#region src/app/modules/config/read/fs.ts
+/**
+* Resolve one infrastructure section (`db`, `redis`, `smtp`), which may be
+* declared at the top level (shared), under `server.*` or under `server.core.*`.
+*
+* Keys are ordered **least specific first**. Two objects are merged, so a
+* shared base survives while the more specific declaration wins per key; a
+* scalar (a `redis://…` connection string, say) replaces whatever preceded it.
+* That is what "the most specific declaration wins" means for a section the
+* documentation explicitly describes as shared — `db.type` set once at the top
+* level still applies when only `db.database` is overridden per component.
+*
+* confinity v1 applied exactly this precedence inside `get([...keys])`; v2
+* removed the array form, so it is spelled out here instead.
+*/ function readSection(store, keys) {
+	let output;
+	for (const key of keys) {
+		const value = store.getSync(key);
+		if (typeof value === "undefined") continue;
+		output = isObject(value) && isObject(output) ? merge(value, output) : value;
+	}
+	return output;
+}
 async function readConfigRawFromFS(options = {}) {
-	const container = new Container({
+	const store = new FSStore({
 		prefix: "authup",
 		cwd: options.cwd
 	});
-	if (options.file) await container.loadFile(options.file);
-	else await container.load();
-	const raw = container.get("server.core") || {};
-	const db = container.get([
+	if (options.file) await store.loadFile(options.file);
+	else await store.load();
+	const raw = store.getSync("server.core") || {};
+	const db = readSection(store, [
 		"db",
 		"server.db",
 		"server.core.db"
 	]);
 	if (db) raw.db = db;
-	const redis = container.get([
+	const redis = readSection(store, [
 		"redis",
 		"server.redis",
 		"server.core.redis"
 	]);
 	if (redis) raw.redis = redis;
-	const smtp = container.get([
+	const smtp = readSection(store, [
 		"smtp",
 		"server.smtp",
 		"server.core.smtp"

package/dist/app/modules/config/read/fs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fs.mjs","names":["Container","readConfigRawFromFS","options","container","prefix","cwd","file","loadFile","load","raw","get","db","redis","smtp"],"sources":["../../../../../src/app/modules/config/read/fs.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Container } from 'confinity';\nimport type { ConfigInput } from '../types.ts';\nimport type { ConfigReadFsOptions } from './types.ts';\n\nexport async function readConfigRawFromFS(options: ConfigReadFsOptions = {}) {\n    const container = new Container({\n        prefix: 'authup',\n        cwd: options.cwd,\n    });\n\n    if (options.file) {\n        await container.loadFile(options.file);\n    } else {\n        await container.load();\n    }\n\n    const raw : ConfigInput = container.get('server.core') || {};\n\n    const db = container.get([\n        'db',\n        'server.db',\n        'server.core.db',\n    ]);\n    if (db) {\n        raw.db = db;\n    }\n\n    const redis = container.get([\n        'redis',\n        'server.redis',\n        'server.core.redis',\n    ]);\n    if (redis) {\n        raw.redis = redis;\n    }\n\n    const smtp = container.get([\n        'smtp',\n        'server.smtp',\n        'server.core.smtp',\n    ]);\n    if (smtp) {\n        raw.smtp = smtp;\n    }\n\n    return raw;\n}\n"],"mappings":";;;;;AAWA,eAAsBC,oBAAoBC,UAA+B,CAAC,GAAC;CACvE,MAAMC,YAAY,IAAIH,UAAU;EAC5BI,QAAQ;EACRC,KAAKH,QAAQG;CACjB,CAAA;CAEA,IAAIH,QAAQI,MACR,MAAMH,UAAUI,SAASL,QAAQI,IAAI;MAErC,MAAMH,UAAUK,KAAI;CAGxB,MAAMC,MAAoBN,UAAUO,IAAI,aAAA,KAAkB,CAAC;CAE3D,MAAMC,KAAKR,UAAUO,IAAI;EACrB;EACA;EACA;CACH,CAAA;CACD,IAAIC,IACAF,IAAIE,KAAKA;CAGb,MAAMC,QAAQT,UAAUO,IAAI;EACxB;EACA;EACA;CACH,CAAA;CACD,IAAIE,OACAH,IAAIG,QAAQA;CAGhB,MAAMC,OAAOV,UAAUO,IAAI;EACvB;EACA;EACA;CACH,CAAA;CACD,IAAIG,MACAJ,IAAII,OAAOA;CAGf,OAAOJ;AACX"}
+{"version":3,"file":"fs.mjs","names":["FSStore","isObject","merge","readSection","store","keys","output","key","value","getSync","readConfigRawFromFS","options","prefix","cwd","file","loadFile","load","raw","db","redis","smtp"],"sources":["../../../../../src/app/modules/config/read/fs.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { FSStore } from 'confinity';\nimport { isObject, merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport type { ConfigReadFsOptions } from './types.ts';\n\n/**\n * Resolve one infrastructure section (`db`, `redis`, `smtp`), which may be\n * declared at the top level (shared), under `server.*` or under `server.core.*`.\n *\n * Keys are ordered **least specific first**. Two objects are merged, so a\n * shared base survives while the more specific declaration wins per key; a\n * scalar (a `redis://…` connection string, say) replaces whatever preceded it.\n * That is what \"the most specific declaration wins\" means for a section the\n * documentation explicitly describes as shared — `db.type` set once at the top\n * level still applies when only `db.database` is overridden per component.\n *\n * confinity v1 applied exactly this precedence inside `get([...keys])`; v2\n * removed the array form, so it is spelled out here instead.\n */\nfunction readSection<T>(store: FSStore, keys: string[]) : T | undefined {\n    let output : unknown;\n\n    for (const key of keys) {\n        const value = store.getSync(key);\n        if (typeof value === 'undefined') {\n            continue;\n        }\n\n        output = isObject(value) && isObject(output) ?\n            merge(value, output) :\n            value;\n    }\n\n    return output as T | undefined;\n}\n\nexport async function readConfigRawFromFS(options: ConfigReadFsOptions = {}) {\n    const store = new FSStore({\n        prefix: 'authup',\n        cwd: options.cwd,\n    });\n\n    if (options.file) {\n        await store.loadFile(options.file);\n    } else {\n        await store.load();\n    }\n\n    // Read synchronously after the explicit load. `get` is asynchronous in\n    // confinity v2, and a missing `await` would hand a Promise to code that\n    // only checks whether it received an object.\n    const raw : ConfigInput = store.getSync<ConfigInput>('server.core') || {};\n\n    const db = readSection<ConfigInput['db']>(store, [\n        'db',\n        'server.db',\n        'server.core.db',\n    ]);\n    if (db) {\n        raw.db = db;\n    }\n\n    const redis = readSection<ConfigInput['redis']>(store, [\n        'redis',\n        'server.redis',\n        'server.core.redis',\n    ]);\n    if (redis) {\n        raw.redis = redis;\n    }\n\n    const smtp = readSection<ConfigInput['smtp']>(store, [\n        'smtp',\n        'server.smtp',\n        'server.core.smtp',\n    ]);\n    if (smtp) {\n        raw.smtp = smtp;\n    }\n\n    return raw;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GA0BA,SAASG,YAAeC,OAAgBC,MAAc;CAClD,IAAIC;CAEJ,KAAK,MAAMC,OAAOF,MAAM;EACpB,MAAMG,QAAQJ,MAAMK,QAAQF,GAAAA;EAC5B,IAAI,OAAOC,UAAU,aACjB;EAGJF,SAASL,SAASO,KAAAA,KAAUP,SAASK,MAAAA,IACjCJ,MAAMM,OAAOF,MAAAA,IACbE;CACR;CAEA,OAAOF;AACX;AAEA,eAAsBI,oBAAoBC,UAA+B,CAAC,GAAC;CACvE,MAAMP,QAAQ,IAAIJ,QAAQ;EACtBY,QAAQ;EACRC,KAAKF,QAAQE;CACjB,CAAA;CAEA,IAAIF,QAAQG,MACR,MAAMV,MAAMW,SAASJ,QAAQG,IAAI;MAEjC,MAAMV,MAAMY,KAAI;CAMpB,MAAMC,MAAoBb,MAAMK,QAAqB,aAAA,KAAkB,CAAC;CAExE,MAAMS,KAAKf,YAA+BC,OAAO;EAC7C;EACA;EACA;CACH,CAAA;CACD,IAAIc,IACAD,IAAIC,KAAKA;CAGb,MAAMC,QAAQhB,YAAkCC,OAAO;EACnD;EACA;EACA;CACH,CAAA;CACD,IAAIe,OACAF,IAAIE,QAAQA;CAGhB,MAAMC,OAAOjB,YAAiCC,OAAO;EACjD;EACA;EACA;CACH,CAAA;CACD,IAAIgB,MACAH,IAAIG,OAAOA;CAGf,OAAOH;AACX"}

package/dist/app/modules/config/trust-proxy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Canonicalize a string-form trustProxy value into its semantic type. This
+ * MUST run for every config surface (env, .conf, file, programmatic input) —
+ * not just env: proxy-addr accepts single-integer "long value" IPv4 notation,
+ * so an un-canonicalized `trustProxy: "1"` (e.g. a stringifying configmap)
+ * would silently compile to an allowlist of `0.0.0.1` instead of one trusted
+ * hop. The integer form wins over the boolean words (`'1'` means ONE hop,
+ * never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr
+ * presets are all case-insensitive semantically, but proxy-addr matches the
+ * presets case-sensitively) and passes through as the allowlist form.
+ */
+export declare function canonicalizeTrustProxy(raw: string): boolean | number | string;
+/**
+ * An entry of the explicit array (allowlist) form must be an address, CIDR,
+ * or preset — an integer-string or boolean word there is a mis-typed scalar
+ * form and must fail loud instead of compiling to a bogus `0.0.0.1`-style
+ * allowlist entry.
+ */
+export declare function isValidTrustProxyListEntry(value: string): boolean;
+/**
+ * The allowlist form needs the same trim + lowercase the scalar form gets:
+ * proxy-addr trims a comma-separated scalar string itself and matches its
+ * presets case-sensitively, so without this an array entry that PASSES
+ * validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or
+ * `LOOPBACK` — would still throw `invalid IP address` inside `new App`.
+ */
+export declare function canonicalizeTrustProxyListEntry(value: string): string;
+//# sourceMappingURL=trust-proxy.d.ts.map

package/dist/app/modules/config/trust-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-proxy.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/trust-proxy.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAyB7E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE"}

package/dist/app/modules/config/trust-proxy.mjs

@@ -0,0 +1,64 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthupError } from "@authup/errors";
+//#region src/app/modules/config/trust-proxy.ts
+const BOOLEAN_TRUE_WORDS = /* @__PURE__ */ new Set([
+	"true",
+	"t",
+	"yes",
+	"y",
+	"on"
+]);
+const BOOLEAN_FALSE_WORDS = /* @__PURE__ */ new Set([
+	"false",
+	"f",
+	"no",
+	"n",
+	"off"
+]);
+const INTEGER = /^\d+$/;
+/**
+* Canonicalize a string-form trustProxy value into its semantic type. This
+* MUST run for every config surface (env, .conf, file, programmatic input) —
+* not just env: proxy-addr accepts single-integer "long value" IPv4 notation,
+* so an un-canonicalized `trustProxy: "1"` (e.g. a stringifying configmap)
+* would silently compile to an allowlist of `0.0.0.1` instead of one trusted
+* hop. The integer form wins over the boolean words (`'1'` means ONE hop,
+* never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr
+* presets are all case-insensitive semantically, but proxy-addr matches the
+* presets case-sensitively) and passes through as the allowlist form.
+*/ function canonicalizeTrustProxy(raw) {
+	const normalized = raw.trim();
+	if (INTEGER.test(normalized)) {
+		const hops = Number.parseInt(normalized, 10);
+		if (!Number.isSafeInteger(hops)) throw new AuthupError(`The trustProxy hop count "${normalized}" exceeds the safe integer range.`);
+		return hops;
+	}
+	const lowered = normalized.toLowerCase();
+	if (BOOLEAN_TRUE_WORDS.has(lowered)) return true;
+	if (BOOLEAN_FALSE_WORDS.has(lowered)) return false;
+	return lowered;
+}
+/**
+* An entry of the explicit array (allowlist) form must be an address, CIDR,
+* or preset — an integer-string or boolean word there is a mis-typed scalar
+* form and must fail loud instead of compiling to a bogus `0.0.0.1`-style
+* allowlist entry.
+*/ function isValidTrustProxyListEntry(value) {
+	const normalized = canonicalizeTrustProxyListEntry(value);
+	return normalized.length > 0 && !INTEGER.test(normalized) && !BOOLEAN_TRUE_WORDS.has(normalized) && !BOOLEAN_FALSE_WORDS.has(normalized);
+}
+/**
+* The allowlist form needs the same trim + lowercase the scalar form gets:
+* proxy-addr trims a comma-separated scalar string itself and matches its
+* presets case-sensitively, so without this an array entry that PASSES
+* validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or
+* `LOOPBACK` — would still throw `invalid IP address` inside `new App`.
+*/ function canonicalizeTrustProxyListEntry(value) {
+	return value.trim().toLowerCase();
+}
+//#endregion
+export { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry, isValidTrustProxyListEntry };
+
+//# sourceMappingURL=trust-proxy.mjs.map

package/dist/app/modules/config/trust-proxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-proxy.mjs","names":["AuthupError","BOOLEAN_TRUE_WORDS","Set","BOOLEAN_FALSE_WORDS","INTEGER","canonicalizeTrustProxy","raw","normalized","trim","test","hops","Number","parseInt","isSafeInteger","lowered","toLowerCase","has","isValidTrustProxyListEntry","value","canonicalizeTrustProxyListEntry","length"],"sources":["../../../../src/app/modules/config/trust-proxy.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\n\nconst BOOLEAN_TRUE_WORDS = new Set(['true', 't', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_WORDS = new Set(['false', 'f', 'no', 'n', 'off']);\n\nconst INTEGER = /^\\d+$/;\n\n/**\n * Canonicalize a string-form trustProxy value into its semantic type. This\n * MUST run for every config surface (env, .conf, file, programmatic input) —\n * not just env: proxy-addr accepts single-integer \"long value\" IPv4 notation,\n * so an un-canonicalized `trustProxy: \"1\"` (e.g. a stringifying configmap)\n * would silently compile to an allowlist of `0.0.0.1` instead of one trusted\n * hop. The integer form wins over the boolean words (`'1'` means ONE hop,\n * never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr\n * presets are all case-insensitive semantically, but proxy-addr matches the\n * presets case-sensitively) and passes through as the allowlist form.\n */\nexport function canonicalizeTrustProxy(raw: string): boolean | number | string {\n    const normalized = raw.trim();\n    if (INTEGER.test(normalized)) {\n        const hops = Number.parseInt(normalized, 10);\n        // The typed surface rejects an out-of-range hop count (zod's int() is\n        // safe-integer bounded), so the string surface must not smuggle one\n        // past it — canonicalization runs AFTER validation, and parseInt\n        // saturates a huge digit string into an unsafe integer / Infinity,\n        // which routup reads as \"trust every hop\".\n        if (!Number.isSafeInteger(hops)) {\n            throw new AuthupError(`The trustProxy hop count \"${normalized}\" exceeds the safe integer range.`);\n        }\n\n        return hops;\n    }\n\n    const lowered = normalized.toLowerCase();\n    if (BOOLEAN_TRUE_WORDS.has(lowered)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_WORDS.has(lowered)) {\n        return false;\n    }\n\n    return lowered;\n}\n\n/**\n * An entry of the explicit array (allowlist) form must be an address, CIDR,\n * or preset — an integer-string or boolean word there is a mis-typed scalar\n * form and must fail loud instead of compiling to a bogus `0.0.0.1`-style\n * allowlist entry.\n */\nexport function isValidTrustProxyListEntry(value: string): boolean {\n    const normalized = canonicalizeTrustProxyListEntry(value);\n    return normalized.length > 0 &&\n        !INTEGER.test(normalized) &&\n        !BOOLEAN_TRUE_WORDS.has(normalized) &&\n        !BOOLEAN_FALSE_WORDS.has(normalized);\n}\n\n/**\n * The allowlist form needs the same trim + lowercase the scalar form gets:\n * proxy-addr trims a comma-separated scalar string itself and matches its\n * presets case-sensitively, so without this an array entry that PASSES\n * validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or\n * `LOOPBACK` — would still throw `invalid IP address` inside `new App`.\n */\nexport function canonicalizeTrustProxyListEntry(value: string): string {\n    return value.trim().toLowerCase();\n}\n"],"mappings":";;;;;AASA,MAAMC,qCAAqB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAO;CAAK;AAAK,CAAA;AAClE,MAAMC,sCAAsB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAM;CAAK;AAAM,CAAA;AAEpE,MAAME,UAAU;;;;;;;;;;;GAahB,SAAgBC,uBAAuBC,KAAW;CAC9C,MAAMC,aAAaD,IAAIE,KAAI;CAC3B,IAAIJ,QAAQK,KAAKF,UAAAA,GAAa;EAC1B,MAAMG,OAAOC,OAAOC,SAASL,YAAY,EAAA;EAMzC,IAAI,CAACI,OAAOE,cAAcH,IAAAA,GACtB,MAAM,IAAIV,YAAY,6BAA6BO,WAAW,kCAAkC;EAGpG,OAAOG;CACX;CAEA,MAAMI,UAAUP,WAAWQ,YAAW;CACtC,IAAId,mBAAmBe,IAAIF,OAAAA,GACvB,OAAO;CAEX,IAAIX,oBAAoBa,IAAIF,OAAAA,GACxB,OAAO;CAGX,OAAOA;AACX;;;;;;GAQA,SAAgBG,2BAA2BC,OAAa;CACpD,MAAMX,aAAaY,gCAAgCD,KAAAA;CACnD,OAAOX,WAAWa,SAAS,KACvB,CAAChB,QAAQK,KAAKF,UAAAA,KACd,CAACN,mBAAmBe,IAAIT,UAAAA,KACxB,CAACJ,oBAAoBa,IAAIT,UAAAA;AACjC;;;;;;;GASA,SAAgBY,gCAAgCD,OAAa;CACzD,OAAOA,MAAMV,KAAI,CAAA,CAAGO,YAAW;AACnC"}

package/dist/app/modules/config/types.d.ts

@@ -71,6 +71,24 @@ export type Config = {
      * default: disabled
      */
     certificateSource: CertificateSource;
+    /**
+     * Which upstream proxies to trust when deriving the client IP from
+     * `X-Forwarded-For` (routup's `TrustProxyInput` minus the function
+     * form): `true` trusts every hop, `false` trusts none (the socket
+     * peer address is used), a number trusts that many hops, and a
+     * string / string[] is a proxy-addr allowlist (IPs, CIDRs, or the
+     * presets `loopback`, `linklocal`, `uniquelocal`; a comma-separated
+     * string splits into a list).
+     *
+     * SECURITY: with `true`, any DIRECT client can spoof its IP via the
+     * `X-Forwarded-For` header — login-throttle keys, audit-event rows,
+     * and the session inventory all record the forged value. Pin the
+     * actual proxy (`1`, `loopback`, or its address/CIDR) when the
+     * listener is reachable without a proxy or exact attribution
+     * matters.
+     * default: true
+     */
+    trustProxy: boolean | number | string | string[];
     /**
      * Trusted first-party app origins (besides publicUrl) — used as
      * redirect targets for the per-realm public `web` client. Does NOT

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CA2GhC"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAyHhC"}

package/dist/app/modules/config/validator.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { expandToOrigins } from "./origins.mjs";
+import { isValidTrustProxyListEntry } from "./trust-proxy.mjs";
 import { CERTIFICATE_SOURCES } from "../../../adapters/http/request/constants.mjs";
 import "../../../adapters/http/request/index.mjs";
 import { isObject } from "@authup/kit";
@@ -32,6 +33,12 @@ var ConfigValidator = class extends Container {
 			publicUrl: createValidator(z.url()),
 			mtlsPublicUrl: createValidator(z.url().nullable()),
 			certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),
+			trustProxy: createValidator(z.union([
+				z.boolean(),
+				z.number().int().nonnegative(),
+				z.string(),
+				z.array(z.string().refine(isValidTrustProxyListEntry, "must be an IP, CIDR, or proxy-addr preset"))
+			])),
 			trustedOrigins: createValidator(z.array(z.string().refine((value) => {
 				try {
 					expandToOrigins(value);

package/dist/app/modules/config/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","int","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","union","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlDataSourceOptions | PostgresDataSourceOptions | BetterSqlite3DataSourceOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,IAAaO,kBAAb,cAAqCJ,UAAAA;CACdK,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBP,gBAAgBE,EAAEM,OAAM,CAAA;EAChD,MAAMC,mBAAmBT,gBAAgBE,EAAEQ,QAAO,CAAA;EAClD,MAAMC,6BAA6BX,gBAAgBE,EAAEU,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBd,gBAAgBE,EAAEM,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBjB,gBACxBE,EAAEQ,QAAO,CAAA,CAAGQ,GAAGhB,EAAEiB,OAAOjB,EAAEM,OAAM,GAAIN,EAAEkB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBrB,gBACrBE,EAAEM,OAAM,CAAA,CACHU,GAAGhB,EAAEQ,QAAO,CAAA,CAAA,CACZQ,GAAGhB,EAAEoB,QAA6BC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI7B,gBACAE,EAAEoB,QACGC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWlC,gBAAgBE,EAAEiC,IAAG,CAAA;GAChCC,eAAepC,gBAAgBE,EAAEiC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBtC,gBAAgBE,EAAEqC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,gBAAgBxC,gBACZE,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAGkC,QAAQnB,UAAAA;IACvB,IAAI;KACApB,gBAAgBoB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPoB,gBAAgB1B;GAChB2B,gBAAgB3B;GAChB4B,kBAAkB5B;GAClB6B,iBAAiB7B;GACjB8B,sBAAsB9B;GACtB+B,qBAAqB/B;GACrBgC,mBAAmBxC;GAEnByC,mBAAmBvC;GACnBwC,oBAAoBxC;GACpByC,yBAAyBzC;GACzB0C,mBAAmB1C;GACnB2C,2BAA2B3C;GAC3B4C,qBAAqB9C;GACrB+C,0BAA0B/C;GAC1BgD,yBAAyBhD;GACzBiD,mBAAmB1D,gBACfE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA,CAAG5C,IAAIlB,wBAAAA,CAAAA;GAGpC+D,iBAAiBpD;GACjBqD,uBAAuBnD;GACvBoD,uBAAuBtD;GACvBuD,6BAA6BrD;GAC7BsD,6BAA6BxD;GAC7ByD,uBAAuBlE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAChEO,oBAAoBnE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAI7DQ,sBAAsBpE,gBAAgBE,EAAEmE,MAAM,CAACnE,EAAEoE,QAAQ,EAAA,GAAKpE,EAAEqE,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAY/D;GACZgE,aAAahE;GACbiE,oBAAoB/D;GACpBgE,iBAAiB3E,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAE1DgB,iBAAiBnE;GACjBoE,qBAAqBpE;GACrBqE,oBAAoBhE;GACpBiE,yBAAyBtE;GAEzBuE,eAAevE;GACfwE,kBAAkBxE;GAClByE,mBAAmBpE;GACnBqE,wBAAwB1E;GAExB2E,aAAapF,gBACTE,EAAEM,OAAM,CAAA,CAAGU,GAAGhB,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAA,CAAA;GAElC6E,oCAAoC5E;EACxC;EAEA,MAAM6E,OAAOC,OAAOD,KAAK9D,UAAAA;EACzB,KAAK,MAAMgE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGlE,WAAWgE,IAAI;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlDataSourceOptions | PostgresDataSourceOptions | BetterSqlite3DataSourceOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustProxy: createValidator(z.union([\n                z.boolean(),\n                z.number().int().nonnegative(),\n                // scalar strings are canonicalized in normalizeConfig\n                // (integer/boolean words → their semantic type)\n                z.string(),\n                // the explicit allowlist form: an integer-string or boolean\n                // word entry is a mis-typed scalar and must fail loud —\n                // proxy-addr would silently compile '1' to 0.0.0.1\n                z.array(z.string().refine(\n                    isValidTrustProxyListEntry,\n                    'must be an IP, CIDR, or proxy-addr preset',\n                )),\n            ])),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI9B,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWnC,gBAAgBE,EAAEkC,IAAG,CAAA;GAChCC,eAAerC,gBAAgBE,EAAEkC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBvC,gBAAgBE,EAAEsC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,YAAYzC,gBAAgBE,EAAEwC,MAAM;IAChCxC,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAG7B,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,OACfzC,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD0C,gBAAgB9C,gBACZE,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,QAAQrB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPuB,gBAAgB7B;GAChB8B,gBAAgB9B;GAChB+B,kBAAkB/B;GAClBgC,iBAAiBhC;GACjBiC,sBAAsBjC;GACtBkC,qBAAqBlC;GACrBmC,mBAAmB3C;GAEnB4C,mBAAmB1C;GACnB2C,oBAAoB3C;GACpB4C,yBAAyB5C;GACzB6C,mBAAmB7C;GACnB8C,2BAA2B9C;GAC3B+C,qBAAqBjD;GACrBkD,0BAA0BlD;GAC1BmD,yBAAyBnD;GACzBoD,mBAAmB9D,gBACfE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAG9C,IAAInB,wBAAAA,CAAAA;GAGpCkE,iBAAiBtD;GACjBuD,uBAAuBrD;GACvBsD,uBAAuBxD;GACvByD,6BAA6BvD;GAC7BwD,6BAA6B1D;GAC7B2D,uBAAuBrE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEO,oBAAoBtE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DQ,sBAAsBvE,gBAAgBE,EAAEwC,MAAM,CAACxC,EAAEsE,QAAQ,EAAA,GAAKtE,EAAEuE,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYhE;GACZiE,aAAajE;GACbkE,oBAAoBhE;GACpBiE,iBAAiB7E,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1De,iBAAiBpE;GACjBqE,qBAAqBrE;GACrBsE,oBAAoBjE;GACpBkE,yBAAyBvE;GAEzBwE,eAAexE;GACfyE,kBAAkBzE;GAClB0E,mBAAmBrE;GACnBsE,wBAAwB3E;GAExB4E,aAAatF,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElC8E,oCAAoC7E;EACxC;EAEA,MAAM8E,OAAOC,OAAOD,KAAK/D,UAAAA;EACzB,KAAK,MAAMiE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGnE,WAAWiE,IAAI;CAE3D;AACJ"}

package/dist/app/modules/database/repositories/client/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/client/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AAYxF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,uBAAwB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,8BAA8B;IAKzC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmB9E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAetE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsB9E,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM3E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7D,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY3E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAIrC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAI9C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAmBvD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;CAUzF"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/client/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AAYxF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,uBAAwB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,8BAA8B;IAKzC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAiB9E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIzC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAetE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsB9E,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM3E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7D,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY3E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAIrC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAI9C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAmBvD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;CAUzF"}

package/dist/app/modules/database/repositories/client/repository.mjs

@@ -6,8 +6,8 @@ import { ClientEntity } from "../../../../../adapters/database/domains/client/en
 import { ClientRoleEntity } from "../../../../../adapters/database/domains/client-role/entity.mjs";
 import { ClientPermissionEntity } from "../../../../../adapters/database/domains/client-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
-import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
+import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
 import { loadBoundPermissions } from "../bindings.mjs";
@@ -27,10 +27,9 @@ var ClientRepositoryAdapter = class {
 		const qb = this.repository.createQueryBuilder("client");
 		qb.groupBy("client.id");
 		const { pagination } = applyQuery(qb, query);
-		applyRealmScopeSelect(qb, "client", ["secretHashed", "secretEncrypted"]);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/client/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["buildRedisKeyPath","isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","loadBoundPermissions","CachePrefix","ClientEntity","ClientPermissionEntity","ClientRoleEntity","RealmRepositoryAdapter","ClientRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","findOneWithSecret","Object","entries","forEach","key","value","addSelect","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundRoles","getRepository","find","clientId","relations","role","cache","prefix","CLIENT_OWNED_ROLES","milliseconds","map","entry","getBoundPermissions","junctionTarget","cachePrefix","CLIENT_OWNED_PERMISSIONS","cacheKey"],"sources":["../../../../../../src/app/modules/database/repositories/client/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Realm, Role } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IClientRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport {\n    CachePrefix,\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type ClientRepositoryAdapterContext = {\n    repository: Repository<Client>,\n    realmRepository: Repository<Realm>,\n};\n\nexport class ClientRepositoryAdapter implements IClientRepository {\n    private readonly repository: Repository<Client>;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: ClientRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Client>> {\n        const qb = this.repository.createQueryBuilder('client');\n        qb.groupBy('client.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'client', ['secretHashed', 'secretEncrypted']);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<Client | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Client | null> {\n        const qb = this.repository.createQueryBuilder('client');\n        qb.where('client.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('client.realmId = :realmId', { realmId });\n        }\n\n        return qb.getOne();\n    }\n\n    async findOne(id: string, query?: IQuery, realmKey?: string): Promise<Client | null> {\n        const qb = this.repository.createQueryBuilder('client');\n\n        if (isUUID(id)) {\n            qb.where('client.id = :id', { id });\n        } else {\n            qb.where('client.name = :name', { name: id });\n\n            if (realmKey) {\n                const realmId = await this.realmRepository.resolveId(realmKey);\n                if (!realmId) {\n                    return null;\n                }\n                qb.andWhere('client.realmId = :realmId', { realmId });\n            }\n        }\n\n        applyQuery(qb, query);\n\n        return qb.getOne();\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Client | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Client[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Client | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    async findOneWithSecret(where: Record<string, any>): Promise<Client | null> {\n        const qb = this.repository.createQueryBuilder('client');\n\n        Object.entries(where).forEach(([key, value]) => {\n            qb.andWhere(`client.${key} = :${key}`, { [key]: value });\n        });\n\n        qb.addSelect('client.secret');\n\n        return qb.getOne();\n    }\n\n    create(data: Partial<Client>): Client {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Client, data: Partial<Client>): Client {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Client): Promise<Client> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Client): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Client>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: ClientEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Client>, existing?: Client): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: ClientEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async getBoundRoles(entity: string | Client): Promise<Role[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        const entries = await this.repository.manager\n            .getRepository(ClientRoleEntity)\n            .find({\n                where: { clientId: id },\n                relations: { role: true },\n                cache: {\n                    id: buildRedisKeyPath({\n                        prefix: CachePrefix.CLIENT_OWNED_ROLES,\n                        key: id,\n                    }),\n                    milliseconds: 60_000,\n                },\n            });\n\n        return entries.map((entry) => entry.role);\n    }\n\n    async getBoundPermissions(entity: string | Client): Promise<PermissionPolicyBinding[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        return loadBoundPermissions({\n            manager: this.repository.manager,\n            junctionTarget: ClientPermissionEntity,\n            where: { clientId: id },\n            cachePrefix: CachePrefix.CLIENT_OWNED_PERMISSIONS,\n            cacheKey: id,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,IAAac,0BAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAqC;EAC7C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAgE;EAC3E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGE,QAAQ,WAAA;EAEX,MAAM,EAAEC,eAAepB,WAAWiB,IAAID,KAAAA;EAEtCd,sBAAsBe,IAAI,UAAU,CAAC,gBAAgB,iBAAkB,CAAA;EAEvE,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAoC;EAC5C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAA2C;EACzE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGe,MAAM,uBAAuB,EAAEF,KAAK,CAAA;EAEvC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,6BAA6B,EAAEF,QAAQ,CAAA;EACvD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,QAAQV,IAAYX,OAAgBe,UAA2C;EACjF,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAE9C,IAAIpB,OAAO6B,EAAAA,GACPV,GAAGe,MAAM,mBAAmB,EAAEL,GAAG,CAAA;OAC9B;GACHV,GAAGe,MAAM,uBAAuB,EAAEF,MAAMH,GAAG,CAAA;GAE3C,IAAII,UAAU;IACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;IACrD,IAAI,CAACE,SACD,OAAO;IAEXhB,GAAGkB,SAAS,6BAA6B,EAAEF,QAAQ,CAAA;GACvD;EACJ;EAEAjC,WAAWiB,IAAID,KAAAA;EAEf,OAAOC,GAAGmB,OAAM;CACpB;CAEA,MAAME,kBAAkBC,UAAkBC,OAAwC;EAC9E,OAAO1C,OAAOyC,QAAAA,IACV,KAAKb,YAAYa,QAAAA,IACjB,KAAKV,cAAcU,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWT,OAA+C;EAC5D,OAAO,KAAKpB,WAAW8B,OAAOtC,yBAAyB4B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAoD;EAChE,OAAO,KAAKpB,WAAWgB,UAAUxB,yBAAyB4B,KAAAA,CAAAA;CAC9D;CAEA,MAAMW,kBAAkBX,OAAoD;EACxE,MAAMf,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAE9C0B,OAAOC,QAAQb,KAAAA,CAAAA,CAAOc,SAAS,CAACC,KAAKC,WAAM;GACvC/B,GAAGkB,SAAS,UAAUY,IAAI,MAAMA,OAAO,GAAGA,MAAMC,MAAM,CAAA;EAC1D,CAAA;EAEA/B,GAAGgC,UAAU,eAAA;EAEb,OAAOhC,GAAGmB,OAAM;CACpB;CAEAc,OAAO1B,MAA+B;EAClC,OAAO,KAAKZ,WAAWsC,OAAO1B,IAAAA;CAClC;CAEA2B,MAAMC,QAAgB5B,MAA+B;EACjD,OAAO,KAAKZ,WAAWuC,MAAMC,QAAQ5B,IAAAA;CACzC;CAEA,MAAM6B,KAAKD,QAAiC;EACxC,OAAO,KAAKxC,WAAWyC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA+B;EACxC,MAAM,KAAKxC,WAAW0C,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoB/B,MAAsC;EAC5D,MAAMzB,0BAA0ByB,MAAM;GAClCgC,YAAY,KAAK5C,WAAW6C,QAAQC;GACpCC,cAAcpD;EAClB,CAAA;CACJ;CAEA,MAAMqD,gBAAgBpC,MAAuBqC,UAAkC;EAQ3E,IAAI,CAACC,MAPkB3D,eAAe;GAClCqD,YAAY,KAAK5C,WAAW6C,QAAQC;GACpCC,cAAcpD;GACd6C,QAAQ5B;GACRuC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI5D,sBAAAA;CAElB;CAEA,MAAM+D,cAAcZ,QAA0C;EAC1D,MAAMzB,KAAK,OAAOyB,WAAW,WAAWA,SAASA,OAAOzB;EAexD,QAAOkB,MAde,KAAKjC,WAAW6C,QACjCQ,cAAcxD,gBAAAA,CAAAA,CACdyD,KAAK;GACFlC,OAAO,EAAEmC,UAAUxC,GAAG;GACtByC,WAAW,EAAEC,MAAM,KAAK;GACxBC,OAAO;IACH3C,IAAI9B,kBAAkB;KAClB0E,QAAQjE,YAAYkE;KACpBzB,KAAKpB;IACT,CAAA;IACA8C,cAAc;GAClB;EACJ,CAAA,EAAA,CAEWC,KAAKC,UAAUA,MAAMN,IAAI;CAC5C;CAEA,MAAMO,oBAAoBxB,QAA6D;EACnF,MAAMzB,KAAK,OAAOyB,WAAW,WAAWA,SAASA,OAAOzB;EACxD,OAAOtB,qBAAqB;GACxBoD,SAAS,KAAK7C,WAAW6C;GACzBoB,gBAAgBrE;GAChBwB,OAAO,EAAEmC,UAAUxC,GAAG;GACtBmD,aAAaxE,YAAYyE;GACzBC,UAAUrD;EACd,CAAA;CACJ;AACJ"}
+{"version":3,"file":"repository.mjs","names":["buildRedisKeyPath","isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","isEntityUnique","translateWhereConditions","loadBoundPermissions","CachePrefix","ClientEntity","ClientPermissionEntity","ClientRoleEntity","RealmRepositoryAdapter","ClientRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","findOneWithSecret","Object","entries","forEach","key","value","addSelect","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundRoles","getRepository","find","clientId","relations","role","cache","prefix","CLIENT_OWNED_ROLES","milliseconds","map","entry","getBoundPermissions","junctionTarget","cachePrefix","CLIENT_OWNED_PERMISSIONS","cacheKey"],"sources":["../../../../../../src/app/modules/database/repositories/client/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Realm, Role } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IClientRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport {\n    CachePrefix,\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type ClientRepositoryAdapterContext = {\n    repository: Repository<Client>,\n    realmRepository: Repository<Realm>,\n};\n\nexport class ClientRepositoryAdapter implements IClientRepository {\n    private readonly repository: Repository<Client>;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: ClientRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Client>> {\n        const qb = this.repository.createQueryBuilder('client');\n        qb.groupBy('client.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<Client | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Client | null> {\n        const qb = this.repository.createQueryBuilder('client');\n        qb.where('client.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('client.realmId = :realmId', { realmId });\n        }\n\n        return qb.getOne();\n    }\n\n    async findOne(id: string, query?: IQuery, realmKey?: string): Promise<Client | null> {\n        const qb = this.repository.createQueryBuilder('client');\n\n        if (isUUID(id)) {\n            qb.where('client.id = :id', { id });\n        } else {\n            qb.where('client.name = :name', { name: id });\n\n            if (realmKey) {\n                const realmId = await this.realmRepository.resolveId(realmKey);\n                if (!realmId) {\n                    return null;\n                }\n                qb.andWhere('client.realmId = :realmId', { realmId });\n            }\n        }\n\n        applyQuery(qb, query);\n\n        return qb.getOne();\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Client | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Client[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Client | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    async findOneWithSecret(where: Record<string, any>): Promise<Client | null> {\n        const qb = this.repository.createQueryBuilder('client');\n\n        Object.entries(where).forEach(([key, value]) => {\n            qb.andWhere(`client.${key} = :${key}`, { [key]: value });\n        });\n\n        qb.addSelect('client.secret');\n\n        return qb.getOne();\n    }\n\n    create(data: Partial<Client>): Client {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Client, data: Partial<Client>): Client {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Client): Promise<Client> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Client): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Client>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: ClientEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Client>, existing?: Client): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: ClientEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async getBoundRoles(entity: string | Client): Promise<Role[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        const entries = await this.repository.manager\n            .getRepository(ClientRoleEntity)\n            .find({\n                where: { clientId: id },\n                relations: { role: true },\n                cache: {\n                    id: buildRedisKeyPath({\n                        prefix: CachePrefix.CLIENT_OWNED_ROLES,\n                        key: id,\n                    }),\n                    milliseconds: 60_000,\n                },\n            });\n\n        return entries.map((entry) => entry.role);\n    }\n\n    async getBoundPermissions(entity: string | Client): Promise<PermissionPolicyBinding[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        return loadBoundPermissions({\n            manager: this.repository.manager,\n            junctionTarget: ClientPermissionEntity,\n            where: { clientId: id },\n            cachePrefix: CachePrefix.CLIENT_OWNED_PERMISSIONS,\n            cacheKey: id,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,IAAac,0BAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAqC;EAC7C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAgE;EAC3E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGE,QAAQ,WAAA;EAEX,MAAM,EAAEC,eAAepB,WAAWiB,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMvB,sBAAsBe,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAoC;EAC5C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAA2C;EACzE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGe,MAAM,uBAAuB,EAAEF,KAAK,CAAA;EAEvC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,6BAA6B,EAAEF,QAAQ,CAAA;EACvD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,QAAQV,IAAYX,OAAgBe,UAA2C;EACjF,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAE9C,IAAIpB,OAAO6B,EAAAA,GACPV,GAAGe,MAAM,mBAAmB,EAAEL,GAAG,CAAA;OAC9B;GACHV,GAAGe,MAAM,uBAAuB,EAAEF,MAAMH,GAAG,CAAA;GAE3C,IAAII,UAAU;IACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;IACrD,IAAI,CAACE,SACD,OAAO;IAEXhB,GAAGkB,SAAS,6BAA6B,EAAEF,QAAQ,CAAA;GACvD;EACJ;EAEAjC,WAAWiB,IAAID,KAAAA;EAEf,OAAOC,GAAGmB,OAAM;CACpB;CAEA,MAAME,kBAAkBC,UAAkBC,OAAwC;EAC9E,OAAO1C,OAAOyC,QAAAA,IACV,KAAKb,YAAYa,QAAAA,IACjB,KAAKV,cAAcU,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWT,OAA+C;EAC5D,OAAO,KAAKpB,WAAW8B,OAAOtC,yBAAyB4B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAoD;EAChE,OAAO,KAAKpB,WAAWgB,UAAUxB,yBAAyB4B,KAAAA,CAAAA;CAC9D;CAEA,MAAMW,kBAAkBX,OAAoD;EACxE,MAAMf,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAE9C0B,OAAOC,QAAQb,KAAAA,CAAAA,CAAOc,SAAS,CAACC,KAAKC,WAAM;GACvC/B,GAAGkB,SAAS,UAAUY,IAAI,MAAMA,OAAO,GAAGA,MAAMC,MAAM,CAAA;EAC1D,CAAA;EAEA/B,GAAGgC,UAAU,eAAA;EAEb,OAAOhC,GAAGmB,OAAM;CACpB;CAEAc,OAAO1B,MAA+B;EAClC,OAAO,KAAKZ,WAAWsC,OAAO1B,IAAAA;CAClC;CAEA2B,MAAMC,QAAgB5B,MAA+B;EACjD,OAAO,KAAKZ,WAAWuC,MAAMC,QAAQ5B,IAAAA;CACzC;CAEA,MAAM6B,KAAKD,QAAiC;EACxC,OAAO,KAAKxC,WAAWyC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA+B;EACxC,MAAM,KAAKxC,WAAW0C,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoB/B,MAAsC;EAC5D,MAAMzB,0BAA0ByB,MAAM;GAClCgC,YAAY,KAAK5C,WAAW6C,QAAQC;GACpCC,cAAcpD;EAClB,CAAA;CACJ;CAEA,MAAMqD,gBAAgBpC,MAAuBqC,UAAkC;EAQ3E,IAAI,CAACC,MAPkB3D,eAAe;GAClCqD,YAAY,KAAK5C,WAAW6C,QAAQC;GACpCC,cAAcpD;GACd6C,QAAQ5B;GACRuC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI3D,sBAAAA;CAElB;CAEA,MAAM8D,cAAcZ,QAA0C;EAC1D,MAAMzB,KAAK,OAAOyB,WAAW,WAAWA,SAASA,OAAOzB;EAexD,QAAOkB,MAde,KAAKjC,WAAW6C,QACjCQ,cAAcxD,gBAAAA,CAAAA,CACdyD,KAAK;GACFlC,OAAO,EAAEmC,UAAUxC,GAAG;GACtByC,WAAW,EAAEC,MAAM,KAAK;GACxBC,OAAO;IACH3C,IAAI9B,kBAAkB;KAClB0E,QAAQjE,YAAYkE;KACpBzB,KAAKpB;IACT,CAAA;IACA8C,cAAc;GAClB;EACJ,CAAA,EAAA,CAEWC,KAAKC,UAAUA,MAAMN,IAAI;CAC5C;CAEA,MAAMO,oBAAoBxB,QAA6D;EACnF,MAAMzB,KAAK,OAAOyB,WAAW,WAAWA,SAASA,OAAOzB;EACxD,OAAOtB,qBAAqB;GACxBoD,SAAS,KAAK7C,WAAW6C;GACzBoB,gBAAgBrE;GAChBwB,OAAO,EAAEmC,UAAUxC,GAAG;GACtBmD,aAAaxE,YAAYyE;GACzBC,UAAUrD;EACd,CAAA;CACJ;AACJ"}

package/dist/app/modules/database/repositories/client-permission/repository.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { ClientPermissionEntity } from "../../../../../adapters/database/domains/client-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/client-permission/repository.ts
@@ -18,7 +18,7 @@ var ClientPermissionRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/client-permission/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","ClientPermissionEntity","translateWhereConditions","ClientPermissionRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","_name","Promise","resolve","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/client-permission/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientPermission } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IClientPermissionRepository } from '../../../../../core/entities/client-permission/types.ts';\nimport { ClientPermissionEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class ClientPermissionRepositoryAdapter implements IClientPermissionRepository {\n    private readonly repository: Repository<ClientPermission>;\n\n    constructor(repository: Repository<ClientPermission>) {\n        this.repository = repository;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        const qb = this.repository.createQueryBuilder('clientPermission');\n        qb.groupBy('clientPermission.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<ClientPermission | null> {\n        return this.findOneBy({ id });\n    }\n\n    findOneByName(_name: string): Promise<ClientPermission | null> {\n        return Promise.resolve(null);\n    }\n\n    findOneByIdOrName(idOrName: string): Promise<ClientPermission | null> {\n        return this.findOneById(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<ClientPermission[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<ClientPermission | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<ClientPermission>): ClientPermission {\n        return this.repository.create(data);\n    }\n\n    merge(entity: ClientPermission, data: Partial<ClientPermission>): ClientPermission {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: ClientPermission): Promise<ClientPermission> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: ClientPermission): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<ClientPermission>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: ClientPermissionEntity,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaI,oCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA0C;EAClD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,kBAAA;EAC9CD,GAAGE,QAAQ,qBAAA;EAEX,MAAM,EAAEC,eAAeV,WAAWO,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA8C;EACtD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEAE,cAAcC,OAAiD;EAC3D,OAAOC,QAAQC,QAAQ,IAAA;CAC3B;CAEAC,kBAAkBC,UAAoD;EAClE,OAAO,KAAKR,YAAYQ,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAyD;EACtE,OAAO,KAAKtB,WAAWuB,OAAOzB,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMR,UAAUQ,OAA8D;EAC1E,OAAO,KAAKtB,WAAWc,UAAUhB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOd,MAAmD;EACtD,OAAO,KAAKV,WAAWwB,OAAOd,IAAAA;CAClC;CAEAe,MAAMC,QAA0BhB,MAAmD;EAC/E,OAAO,KAAKV,WAAWyB,MAAMC,QAAQhB,IAAAA;CACzC;CAEA,MAAMiB,KAAKD,QAAqD;EAC5D,OAAO,KAAK1B,WAAW2B,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAyC;EAClD,MAAM,KAAK1B,WAAW4B,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBnB,MAAgD;EACtE,MAAMf,0BAA0Be,MAAM;GAClCoB,YAAY,KAAK9B,WAAW+B,QAAQC;GACpCC,cAAcpC;EAClB,CAAA;CACJ;AACJ"}
+{"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","redactFieldConditions","ClientPermissionEntity","translateWhereConditions","ClientPermissionRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","_name","Promise","resolve","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/client-permission/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientPermission } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IClientPermissionRepository } from '../../../../../core/entities/client-permission/types.ts';\nimport { ClientPermissionEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class ClientPermissionRepositoryAdapter implements IClientPermissionRepository {\n    private readonly repository: Repository<ClientPermission>;\n\n    constructor(repository: Repository<ClientPermission>) {\n        this.repository = repository;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        const qb = this.repository.createQueryBuilder('clientPermission');\n        qb.groupBy('clientPermission.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<ClientPermission | null> {\n        return this.findOneBy({ id });\n    }\n\n    findOneByName(_name: string): Promise<ClientPermission | null> {\n        return Promise.resolve(null);\n    }\n\n    findOneByIdOrName(idOrName: string): Promise<ClientPermission | null> {\n        return this.findOneById(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<ClientPermission[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<ClientPermission | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<ClientPermission>): ClientPermission {\n        return this.repository.create(data);\n    }\n\n    merge(entity: ClientPermission, data: Partial<ClientPermission>): ClientPermission {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: ClientPermission): Promise<ClientPermission> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: ClientPermission): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<ClientPermission>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: ClientPermissionEntity,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaK,oCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA0C;EAClD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,kBAAA;EAC9CD,GAAGE,QAAQ,qBAAA;EAEX,MAAM,EAAEC,eAAeX,WAAWQ,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMd,sBAAsBM,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA8C;EACtD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEAE,cAAcC,OAAiD;EAC3D,OAAOC,QAAQC,QAAQ,IAAA;CAC3B;CAEAC,kBAAkBC,UAAoD;EAClE,OAAO,KAAKR,YAAYQ,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAyD;EACtE,OAAO,KAAKtB,WAAWuB,OAAOzB,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMR,UAAUQ,OAA8D;EAC1E,OAAO,KAAKtB,WAAWc,UAAUhB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOd,MAAmD;EACtD,OAAO,KAAKV,WAAWwB,OAAOd,IAAAA;CAClC;CAEAe,MAAMC,QAA0BhB,MAAmD;EAC/E,OAAO,KAAKV,WAAWyB,MAAMC,QAAQhB,IAAAA;CACzC;CAEA,MAAMiB,KAAKD,QAAqD;EAC5D,OAAO,KAAK1B,WAAW2B,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAyC;EAClD,MAAM,KAAK1B,WAAW4B,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBnB,MAAgD;EACtE,MAAMhB,0BAA0BgB,MAAM;GAClCoB,YAAY,KAAK9B,WAAW+B,QAAQC;GACpCC,cAAcpC;EAClB,CAAA;CACJ;AACJ"}

package/dist/app/modules/database/repositories/client-role/repository.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { ClientRoleEntity } from "../../../../../adapters/database/domains/client-role/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/client-role/repository.ts
@@ -18,7 +18,7 @@ var ClientRoleRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination