@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.57

package/dist/adapters/http/middleware/built-in/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}
+{"version":3,"file":"rate-limit.mjs","names":["rateLimit","getRequestIP","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","keyGenerator","event","max","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { getRequestIP } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        // @routup/rate-limit's default keyGenerator hardcodes\n        // `{ trustProxy: true }`; deriving the key here instead lets it\n        // follow the app-level trust contract (config `trustProxy`).\n        keyGenerator: (event) => getRequestIP(event) || '127.0.0.1',\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EAIzBC,eAAeC,UAAUR,aAAaQ,KAAAA,KAAU;EAChDC,IAAID,OAAK;GACL,MAAME,WAAWR,mBAAmBM,KAAAA;GACpC,IAAI,CAACE,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAN,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOS,IAAId,UAAUO,OAAAA,CAAAA;AACzB"}

package/dist/adapters/http/request/event-context.mjs

@@ -26,7 +26,7 @@ function useRequestEventContext() {
 			actorName: identity ? identity.data.name ?? null : null,
 			requestPath: event.path,
 			requestMethod: event.method,
-			requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			requestIpAddress: getRequestIP(event) ?? null,
 			requestUserAgent: getRequestHeader(event, "user-agent") ?? null
 		}, () => event.next());
 	});

package/dist/adapters/http/request/event-context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","requestPath","path","requestMethod","method","requestIpAddress","trustProxy","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAMK,UAAU,IAAIL,kBAAAA;AAEpB,SAAgBM,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOX,kBAAkB,OAAOY,UAAAA;EAC5B,MAAMC,WAAWV,mBAAmBS,KAAAA;EAYpC,OAAOP,2BAA2BC;GAT9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,aAAaT,MAAMU;GACnBC,eAAeX,MAAMY;GACrBC,kBAAkBvB,aAAaU,OAAO,EAAEc,YAAY,KAAK,CAAA,KAAM;GAC/DC,kBAAkB1B,iBAAiBW,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMgB,KAAI,CAAA;CAC3D,CAAA;AACJ"}
+{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","requestPath","path","requestMethod","method","requestIpAddress","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAMK,UAAU,IAAIL,kBAAAA;AAEpB,SAAgBM,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOX,kBAAkB,OAAOY,UAAAA;EAC5B,MAAMC,WAAWV,mBAAmBS,KAAAA;EAYpC,OAAOP,2BAA2BC;GAT9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,aAAaT,MAAMU;GACnBC,eAAeX,MAAMY;GACrBC,kBAAkBvB,aAAaU,KAAAA,KAAU;GACzCc,kBAAkBzB,iBAAiBW,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMe,KAAI,CAAA;CAC3D,CAAA;AACJ"}

package/dist/app/factory.d.ts

@@ -1,2 +1,3 @@
-export declare function createApplication(): import("orkos").IApplication;
+import type { CreateApplicationContext } from './types.ts';
+export declare function createApplication(context?: CreateApplicationContext): import("orkos").IApplication;
 //# sourceMappingURL=factory.d.ts.map

package/dist/app/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/app/factory.ts"],"names":[],"mappings":"AAaA,wBAAgB,iBAAiB,iCAkBhC"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/app/factory.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,gCAkBvE"}

package/dist/app/factory.mjs

@@ -6,8 +6,8 @@ import { ProvisionerModule } from "./modules/provisioning/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 //#region src/app/factory.ts
-function createApplication() {
-	return new ApplicationBuilder().withConfig().withLogger().withCache().withMail().withRuntime().withDatabase().withProvisioning(new ProvisionerModule([new DefaultProvisioningSource()])).withLdap().withAuthentication().withIdentity().withOAuth2().withComponents().withHTTP().build();
+function createApplication(context = {}) {
+	return new ApplicationBuilder().withConfig(context.config).withLogger().withCache().withMail().withRuntime().withDatabase().withProvisioning(new ProvisionerModule([new DefaultProvisioningSource()])).withLdap().withAuthentication().withIdentity().withOAuth2().withComponents().withHTTP().build();
 }
 //#endregion
 export { createApplication };

package/dist/app/factory.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"factory.mjs","names":["ApplicationBuilder","DefaultProvisioningSource","ProvisionerModule","createApplication","withConfig","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","build"],"sources":["../../src/app/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ApplicationBuilder } from './builder.ts';\nimport {\n    DefaultProvisioningSource,\n    ProvisionerModule,\n} from './modules/index.ts';\n\nexport function createApplication() {\n    return new ApplicationBuilder()\n        .withConfig()\n        .withLogger()\n        .withCache()\n        .withMail()\n        .withRuntime()\n        .withDatabase()\n        .withProvisioning(new ProvisionerModule([\n            new DefaultProvisioningSource(),\n        ]))\n        .withLdap()\n        .withAuthentication()\n        .withIdentity()\n        .withOAuth2()\n        .withComponents()\n        .withHTTP()\n        .build();\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,oBAAAA;CACZ,OAAO,IAAIH,mBAAAA,CAAAA,CACNI,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTC,SAAQ,CAAA,CACRC,YAAW,CAAA,CACXC,aAAY,CAAA,CACZC,iBAAiB,IAAIR,kBAAkB,CACpC,IAAID,0BAAAA,CACP,CAAA,CAAA,CAAA,CACAU,SAAQ,CAAA,CACRC,mBAAkB,CAAA,CAClBC,aAAY,CAAA,CACZC,WAAU,CAAA,CACVC,eAAc,CAAA,CACdC,SAAQ,CAAA,CACRC,MAAK;AACd"}
+{"version":3,"file":"factory.mjs","names":["ApplicationBuilder","DefaultProvisioningSource","ProvisionerModule","createApplication","context","withConfig","config","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","build"],"sources":["../../src/app/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ApplicationBuilder } from './builder.ts';\nimport {\n    DefaultProvisioningSource,\n    ProvisionerModule,\n} from './modules/index.ts';\nimport type { CreateApplicationContext } from './types.ts';\n\nexport function createApplication(context: CreateApplicationContext = {}) {\n    return new ApplicationBuilder()\n        .withConfig(context.config)\n        .withLogger()\n        .withCache()\n        .withMail()\n        .withRuntime()\n        .withDatabase()\n        .withProvisioning(new ProvisionerModule([\n            new DefaultProvisioningSource(),\n        ]))\n        .withLdap()\n        .withAuthentication()\n        .withIdentity()\n        .withOAuth2()\n        .withComponents()\n        .withHTTP()\n        .build();\n}\n"],"mappings":";;;;;;;;AAcA,SAAgBG,kBAAkBC,UAAoC,CAAC,GAAC;CACpE,OAAO,IAAIJ,mBAAAA,CAAAA,CACNK,WAAWD,QAAQE,MAAM,CAAA,CACzBC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTC,SAAQ,CAAA,CACRC,YAAW,CAAA,CACXC,aAAY,CAAA,CACZC,iBAAiB,IAAIV,kBAAkB,CACpC,IAAID,0BAAAA,CACP,CAAA,CAAA,CAAA,CACAY,SAAQ,CAAA,CACRC,mBAAkB,CAAA,CAClBC,aAAY,CAAA,CACZC,WAAU,CAAA,CACVC,eAAc,CAAA,CACdC,SAAQ,CAAA,CACRC,MAAK;AACd"}

package/dist/app/index.d.ts

@@ -1,4 +1,5 @@
 export * from './builder.ts';
 export * from './factory.ts';
 export * from './modules/index.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/app/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}

package/dist/app/index.mjs

@@ -6,6 +6,10 @@ import { CacheInjectionKey } from "./modules/cache/constants.mjs";
 import { ModuleName } from "./modules/constants.mjs";
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./modules/config/constants.mjs";
 import { expandToOrigins, getAppOrigins } from "./modules/config/origins.mjs";
+import { readConfigRawFromEnv } from "./modules/config/read/env.mjs";
+import { readConfigRawFromFS } from "./modules/config/read/fs.mjs";
+import { readConfigRaw } from "./modules/config/read/module.mjs";
+import { readConfig } from "./modules/config/helpers.mjs";
 import { ConfigModule } from "./modules/config/module.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
 import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
@@ -64,4 +68,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/authentication/repositories/session.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { applyQuery } from "../../database/repositories/query.mjs";
+import { applyQuery, redactFieldConditions } from "../../database/repositories/query.mjs";
 import { applyRealmScopeSelect } from "../../database/repositories/helpers.mjs";
 import { AuthenticationCachePrefix } from "./constants.mjs";
 import { buildCacheKey } from "@authup/server-kit";
@@ -31,7 +31,7 @@ var SessionRepository = class {
 		});
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/authentication/repositories/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expiresAt","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery } from '../../database/repositories/query.ts';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: IQuery,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.subKind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: `parameters: ['filters']` — a bulk revoke must reach every\n        // matching row. Applying the schema's `pagination.maxLimit` would\n        // default the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expiresAt).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;AA0BA,IAAaI,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BX,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAepB,WAAWkB,IAAIF,KAAAA;EAEtCf,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,IAAID,QAAQI,OAERH,GAAGI,SAAS,+DAA+D;GACvEC,UAAUN,QAAQI,MAAMG;GACxBC,cAAcR,QAAQI,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMV,GAAGW,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,eAAeX,OAAyC;EAC1D,OAAO,KAAKhB,WAAWc,mBAAmB,SAAA,CAAA,CACrCc,MAAM,qDAAqD;GACxDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAenB,OAAmC;EACpD,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CnB,WAAWkB,IAAIF,KAAAA;EAEff,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,OAAOA,GAAGgB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAM5B,UAAU,KAAKJ,WAAWiC,OAAOD,KAAAA;EACvC,MAAM,KAAKhC,WAAW+B,KAAK3B,OAAAA;EAE3B,MAAM,KAAKL,MAAMmC,IACbxC,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAE+B,KAAK,IAAIC,KAAKhC,QAAQiC,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG9D,OAAOnC;CACX;CAIA,MAAMoC,OAAOpC,SAAiC;EAC1C,MAAM,KAAKJ,WAAWwC,OAAOpC,OAAAA;EAC7B,MAAM,KAAKL,MAAM0C,KACb/C,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAMuC,WAAWvC,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKoC,OAAOpC,OAAAA;CAE1B;AACJ"}
+{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","redactFieldConditions","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expiresAt","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../database/repositories/query.ts';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: IQuery,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.subKind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: `parameters: ['filters']` — a bulk revoke must reach every\n        // matching row. Applying the schema's `pagination.maxLimit` would\n        // default the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expiresAt).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;AA0BA,IAAaK,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BZ,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAerB,WAAWmB,IAAIF,KAAAA;EAEtCf,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,IAAID,QAAQI,OAERH,GAAGI,SAAS,+DAA+D;GACvEC,UAAUN,QAAQI,MAAMG;GACxBC,cAAcR,QAAQI,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMV,GAAGW,gBAAe;EAElD,OAAO;GACHC,MAAM9B,sBAAsBgB,OAAOW,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,eAAeX,OAAyC;EAC1D,OAAO,KAAKhB,WAAWc,mBAAmB,SAAA,CAAA,CACrCc,MAAM,qDAAqD;GACxDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAenB,OAAmC;EACpD,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CpB,WAAWmB,IAAIF,KAAAA;EAEff,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,OAAOA,GAAGgB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAM5B,UAAU,KAAKJ,WAAWiC,OAAOD,KAAAA;EACvC,MAAM,KAAKhC,WAAW+B,KAAK3B,OAAAA;EAE3B,MAAM,KAAKL,MAAMmC,IACbzC,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAE+B,KAAK,IAAIC,KAAKhC,QAAQiC,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG9D,OAAOnC;CACX;CAIA,MAAMoC,OAAOpC,SAAiC;EAC1C,MAAM,KAAKJ,WAAWwC,OAAOpC,OAAAA;EAC7B,MAAM,KAAKL,MAAM0C,KACbhD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAMuC,WAAWvC,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKoC,OAAOpC,OAAAA;CAE1B;AACJ"}

package/dist/app/modules/components/module.d.ts

@@ -1,9 +1,12 @@
+import type { Component } from '../../../components/index.ts';
 import type { IModule } from 'orkos';
 import type { IContainer } from 'eldin';
 export declare class ComponentsModule implements IModule {
     readonly name: string;
     readonly dependencies: string[];
+    protected components: Component[];
     constructor();
     setup(container: IContainer): Promise<void>;
+    teardown(container: IContainer): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/components/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA+BpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAQ9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;;IAQ5B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBvD"}

package/dist/app/modules/components/module.mjs

@@ -4,7 +4,6 @@ import.meta.url;
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import "../config/index.mjs";
-import { createDatabaseUniqueEntriesComponent } from "../../../components/database/unique-entries/factory.mjs";
 import { createEventCleanerComponent } from "../../../components/event-cleaner/module.mjs";
 import { createOAuth2CleanerComponent } from "../../../components/oauth2-cleaner/module.mjs";
 import "../../../components/index.mjs";
@@ -16,6 +15,7 @@ import "../database/index.mjs";
 var ComponentsModule = class {
 	name;
 	dependencies;
+	components;
 	constructor() {
 		this.name = ModuleName.COMPONENTS;
 		this.dependencies = [
@@ -23,15 +23,17 @@ var ComponentsModule = class {
 			ModuleName.LOGGER,
 			ModuleName.DATABASE
 		];
+		this.components = [];
 	}
 	async setup(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const logger = container.resolve(LoggerInjectionKey);
-		const components = [createOAuth2CleanerComponent(dataSource, logger), createDatabaseUniqueEntriesComponent(dataSource)];
+		const components = [createOAuth2CleanerComponent(dataSource, logger)];
 		const securitySweep = config.eventLogRetentionDays > 0;
 		const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;
 		if (config.eventLogEnabled && (securitySweep || entitySweep)) components.push(createEventCleanerComponent(dataSource, logger));
+		this.components = components;
 		components.forEach((component) => {
 			component.start().catch((e) => {
 				logger.error("Starting a background component failed.");
@@ -39,6 +41,19 @@ var ComponentsModule = class {
 			});
 		});
 	}
+	async teardown(container) {
+		const logger = container.tryResolve(LoggerInjectionKey);
+		const { components } = this;
+		this.components = [];
+		for (const component of components) try {
+			await component.stop();
+		} catch (e) {
+			if (logger.success) {
+				logger.data.warn("Stopping a background component failed.");
+				logger.data.warn(e);
+			}
+		}
+	}
 };
 //#endregion
 export { ComponentsModule };

package/dist/app/modules/components/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createDatabaseUniqueEntriesComponent","createEventCleanerComponent","createOAuth2CleanerComponent","ConfigInjectionKey","DatabaseInjectionKey","LoggerInjectionKey","ModuleName","ComponentsModule","name","dependencies","COMPONENTS","CONFIG","LOGGER","DATABASE","setup","container","config","resolve","dataSource","DataSource","logger","components","securitySweep","eventLogRetentionDays","entitySweep","eventLogEntityEnabled","eventLogEntityRetentionDays","eventLogEnabled","push","forEach","component","start","catch","e","error"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport {\n    createDatabaseUniqueEntriesComponent,\n    createEventCleanerComponent,\n    createOAuth2CleanerComponent,\n} from '../../../components/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource, logger),\n            createDatabaseUniqueEntriesComponent(dataSource),\n        ];\n\n        // The sweep only exists when rows are written AND at least one row\n        // family carries an expiry — security events (eventLogRetentionDays)\n        // and entity-CRUD events (eventLogEntityRetentionDays) are stamped\n        // independently, so either non-zero retention needs the cleaner.\n        const securitySweep = config.eventLogRetentionDays > 0;\n        const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;\n        if (config.eventLogEnabled && (securitySweep || entitySweep)) {\n            components.push(createEventCleanerComponent(dataSource, logger));\n        }\n\n        // start() is deliberately fire-and-forget, so a rejection must be\n        // caught here — an unhandled rejection is fatal on modern node.\n        components.forEach((component) => {\n            component.start().catch((e) => {\n                logger.error('Starting a background component failed.');\n                logger.error(e);\n            });\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoBA,IAAaO,mBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOF,WAAWI;EACvB,KAAKD,eAAe;GAACH,WAAWK;GAAQL,WAAWM;GAAQN,WAAWO;EAAS;CACnF;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EACjC,MAAMe,aAAaH,UAAUE,QAAQb,qBAAqBe,UAAU;EACpE,MAAMC,SAASL,UAAUE,QAAQZ,kBAAAA;EAEjC,MAAMgB,aAA0B,CAC5BnB,6BAA6BgB,YAAYE,MAAAA,GACzCpB,qCAAqCkB,UAAAA,CACxC;EAMD,MAAMI,gBAAgBN,OAAOO,wBAAwB;EACrD,MAAMC,cAAcR,OAAOS,yBAAyBT,OAAOU,8BAA8B;EACzF,IAAIV,OAAOW,oBAAoBL,iBAAiBE,cAC5CH,WAAWO,KAAK3B,4BAA4BiB,YAAYE,MAAAA,CAAAA;EAK5DC,WAAWQ,SAASC,cAAAA;GAChBA,UAAUC,MAAK,CAAA,CAAGC,OAAOC,MAAAA;IACrBb,OAAOc,MAAM,yCAAA;IACbd,OAAOc,MAAMD,CAAAA;GACjB,CAAA;EACJ,CAAA;CACJ;AAGJ"}
+{"version":3,"file":"module.mjs","names":["createEventCleanerComponent","createOAuth2CleanerComponent","ConfigInjectionKey","DatabaseInjectionKey","LoggerInjectionKey","ModuleName","ComponentsModule","name","dependencies","components","COMPONENTS","CONFIG","LOGGER","DATABASE","setup","container","config","resolve","dataSource","DataSource","logger","securitySweep","eventLogRetentionDays","entitySweep","eventLogEntityEnabled","eventLogEntityRetentionDays","eventLogEnabled","push","forEach","component","start","catch","e","error","teardown","tryResolve","stop","success","data","warn"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport {\n    createEventCleanerComponent,\n    createOAuth2CleanerComponent,\n} from '../../../components/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected components: Component[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.DATABASE];\n        this.components = [];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource, logger),\n        ];\n\n        // The sweep only exists when rows are written AND at least one row\n        // family carries an expiry — security events (eventLogRetentionDays)\n        // and entity-CRUD events (eventLogEntityRetentionDays) are stamped\n        // independently, so either non-zero retention needs the cleaner.\n        const securitySweep = config.eventLogRetentionDays > 0;\n        const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;\n        if (config.eventLogEnabled && (securitySweep || entitySweep)) {\n            components.push(createEventCleanerComponent(dataSource, logger));\n        }\n\n        this.components = components;\n\n        // start() is deliberately fire-and-forget, so a rejection must be\n        // caught here — an unhandled rejection is fatal on modern node.\n        components.forEach((component) => {\n            component.start().catch((e) => {\n                logger.error('Starting a background component failed.');\n                logger.error(e);\n            });\n        });\n    }\n\n    async teardown(container: IContainer): Promise<void> {\n        const logger = container.tryResolve(LoggerInjectionKey);\n\n        const { components } = this;\n        this.components = [];\n\n        for (const component of components) {\n            try {\n                await component.stop();\n            } catch (e) {\n                if (logger.success) {\n                    logger.data.warn('Stopping a background component failed.');\n                    logger.data.warn(e);\n                }\n            }\n        }\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,IAAaM,mBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,cAAc;EACV,KAAKF,OAAOF,WAAWK;EACvB,KAAKF,eAAe;GAACH,WAAWM;GAAQN,WAAWO;GAAQP,WAAWQ;EAAS;EAC/E,KAAKJ,aAAa,CAAA;CACtB;CAEA,MAAMK,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQf,kBAAAA;EACjC,MAAMgB,aAAaH,UAAUE,QAAQd,qBAAqBgB,UAAU;EACpE,MAAMC,SAASL,UAAUE,QAAQb,kBAAAA;EAEjC,MAAMK,aAA0B,CAC5BR,6BAA6BiB,YAAYE,MAAAA,CAC5C;EAMD,MAAMC,gBAAgBL,OAAOM,wBAAwB;EACrD,MAAMC,cAAcP,OAAOQ,yBAAyBR,OAAOS,8BAA8B;EACzF,IAAIT,OAAOU,oBAAoBL,iBAAiBE,cAC5Cd,WAAWkB,KAAK3B,4BAA4BkB,YAAYE,MAAAA,CAAAA;EAG5D,KAAKX,aAAaA;EAIlBA,WAAWmB,SAASC,cAAAA;GAChBA,UAAUC,MAAK,CAAA,CAAGC,OAAOC,MAAAA;IACrBZ,OAAOa,MAAM,yCAAA;IACbb,OAAOa,MAAMD,CAAAA;GACjB,CAAA;EACJ,CAAA;CACJ;CAEA,MAAME,SAASnB,WAAsC;EACjD,MAAMK,SAASL,UAAUoB,WAAW/B,kBAAAA;EAEpC,MAAM,EAAEK,eAAe;EACvB,KAAKA,aAAa,CAAA;EAElB,KAAK,MAAMoB,aAAapB,YACpB,IAAI;GACA,MAAMoB,UAAUO,KAAI;EACxB,SAASJ,GAAG;GACR,IAAIZ,OAAOiB,SAAS;IAChBjB,OAAOkB,KAAKC,KAAK,yCAAA;IACjBnB,OAAOkB,KAAKC,KAAKP,CAAAA;GACrB;EACJ;CAER;AAGJ"}

package/dist/app/modules/config/constants.d.ts

@@ -11,6 +11,7 @@ export declare enum ConfigEnvironmentVariableName {
     PUBLIC_URL = "PUBLIC_URL",
     MTLS_PUBLIC_URL = "MTLS_PUBLIC_URL",
     CERTIFICATE_SOURCE = "CERTIFICATE_SOURCE",
+    TRUST_PROXY = "TRUST_PROXY",
     TRUSTED_ORIGINS = "TRUSTED_ORIGINS",
     TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
     TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -14,6 +14,7 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["PUBLIC_URL"] = "PUBLIC_URL";
 	ConfigEnvironmentVariableName["MTLS_PUBLIC_URL"] = "MTLS_PUBLIC_URL";
 	ConfigEnvironmentVariableName["CERTIFICATE_SOURCE"] = "CERTIFICATE_SOURCE";
+	ConfigEnvironmentVariableName["TRUST_PROXY"] = "TRUST_PROXY";
 	ConfigEnvironmentVariableName["TRUSTED_ORIGINS"] = "TRUSTED_ORIGINS";
 	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
 	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAkDX,EAAA,CAAA,CAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUST_PROXY = 'TRUST_PROXY',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAmDX,EAAA,CAAA,CAAA"}

package/dist/app/modules/config/helpers.d.ts

@@ -0,0 +1,9 @@
+import type { ConfigRawReadOptions } from './read/index.ts';
+import type { Config } from './types.ts';
+/**
+ * Read config from env (and optionally fs) and normalize it.
+ *
+ * @param options
+ */
+export declare function readConfig(options?: ConfigRawReadOptions): Promise<Config>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/app/modules/config/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/helpers.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC,CAOrF"}

package/dist/app/modules/config/helpers.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { normalizeConfig } from "./normalize.mjs";
+import { readConfigRaw } from "./read/module.mjs";
+import "./read/index.mjs";
+//#region src/app/modules/config/helpers.ts
+/**
+* Read config from env (and optionally fs) and normalize it.
+*
+* @param options
+*/ async function readConfig(options = {}) {
+	return normalizeConfig(await readConfigRaw({
+		env: true,
+		...options
+	}));
+}
+//#endregion
+export { readConfig };
+
+//# sourceMappingURL=helpers.mjs.map

package/dist/app/modules/config/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":["normalizeConfig","readConfigRaw","readConfig","options","raw","env"],"sources":["../../../../src/app/modules/config/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config } from './types.ts';\n\n/**\n * Read config from env (and optionally fs) and normalize it.\n *\n * @param options\n */\nexport async function readConfig(options: ConfigRawReadOptions = {}) : Promise<Config> {\n    const raw = await readConfigRaw({\n        env: true,\n        ...options,\n    });\n\n    return normalizeConfig(raw);\n}\n"],"mappings":";;;;;;;;;;;GAiBA,eAAsBE,WAAWC,UAAgC,CAAC,GAAC;CAM/D,OAAOH,gBAAgBI,MALLH,cAAc;EAC5BI,KAAK;EACL,GAAGF;CACP,CAAA,CAEuBC;AAC3B"}

package/dist/app/modules/config/index.d.ts

@@ -1,5 +1,7 @@
 export * from './constants.ts';
+export * from './helpers.ts';
 export * from './module.ts';
 export * from './origins.ts';
+export * from './read/index.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/app/modules/config/index.mjs

@@ -3,5 +3,10 @@ import "node:url";
 import.meta.url;
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./constants.mjs";
 import { expandToOrigins, getAppOrigins } from "./origins.mjs";
+import { readConfigRawFromEnv } from "./read/env.mjs";
+import { readConfigRawFromFS } from "./read/fs.mjs";
+import { readConfigRaw } from "./read/module.mjs";
+import "./read/index.mjs";
+import { readConfig } from "./helpers.mjs";
 import { ConfigModule } from "./module.mjs";
-export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, expandToOrigins, getAppOrigins };
+export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/config/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,QAAQ,EAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;gBAI5C,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa;IAOrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC;CAQnE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,QAAQ,EAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;gBAI5C,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa;IAOrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD;;;;OAIG;IACG,IAAI,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC;CAGnE"}

package/dist/app/modules/config/module.mjs

@@ -3,9 +3,7 @@ import "node:url";
 import.meta.url;
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "./constants.mjs";
-import { normalizeConfig } from "./normalize.mjs";
-import { readConfigRaw } from "./read/module.mjs";
-import "./read/index.mjs";
+import { readConfig } from "./helpers.mjs";
 //#region src/app/modules/config/module.ts
 var ConfigModule = class {
 	name;
@@ -26,10 +24,7 @@ var ConfigModule = class {
 	*
 	* @param options
 	*/ async read(options = {}) {
-		return normalizeConfig(await readConfigRaw({
-			env: true,
-			...options
-		}));
+		return readConfig(options);
 	}
 };
 //#endregion

package/dist/app/modules/config/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ModuleName","ConfigInjectionKey","normalizeConfig","readConfigRaw","ConfigModule","name","instance","config","CONFIG","setup","container","read","register","useValue","options","raw","env"],"sources":["../../../../src/app/modules/config/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config, ConfigFactory } from './types.ts';\n\nexport class ConfigModule implements IModule {\n    readonly name: string;\n\n    protected instance : Config | ConfigFactory | undefined;\n\n    // ----------------------------------------------------\n\n    constructor(config?: Config | ConfigFactory) {\n        this.name = ModuleName.CONFIG;\n        this.instance = config;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        let instance : Config;\n        if (typeof this.instance === 'function') {\n            instance = await this.instance();\n        } else if (this.instance) {\n            instance = this.instance;\n        } else {\n            instance = await this.read();\n        }\n\n        container.register(ConfigInjectionKey, { useValue: instance });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Read config from env and fs.\n     *\n     * @param options\n     */\n    async read(options: ConfigRawReadOptions = {}) : Promise<Config> {\n        const raw = await readConfigRaw({\n            env: true,\n            ...options,\n        });\n\n        return normalizeConfig(raw);\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,eAAb,MAAaA;CACAC;CAECC;CAIV,YAAYC,QAAiC;EACzC,KAAKF,OAAOL,WAAWQ;EACvB,KAAKF,WAAWC;CACpB;CAIA,MAAME,MAAMC,WAAsC;EAC9C,IAAIJ;EACJ,IAAI,OAAO,KAAKA,aAAa,YACzBA,WAAW,MAAM,KAAKA,SAAQ;OAC3B,IAAI,KAAKA,UACZA,WAAW,KAAKA;OAEhBA,WAAW,MAAM,KAAKK,KAAI;EAG9BD,UAAUE,SAASX,oBAAoB,EAAEY,UAAUP,SAAS,CAAA;CAChE;;;;;IASA,MAAMK,KAAKG,UAAgC,CAAC,GAAqB;EAM7D,OAAOZ,gBAAgBa,MALLZ,cAAc;GAC5Ba,KAAK;GACL,GAAGF;EACP,CAAA,CAEuBC;CAC3B;AACJ"}
+{"version":3,"file":"module.mjs","names":["ModuleName","ConfigInjectionKey","readConfig","ConfigModule","name","instance","config","CONFIG","setup","container","read","register","useValue","options"],"sources":["../../../../src/app/modules/config/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { readConfig } from './helpers.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport type { Config, ConfigFactory } from './types.ts';\n\nexport class ConfigModule implements IModule {\n    readonly name: string;\n\n    protected instance : Config | ConfigFactory | undefined;\n\n    // ----------------------------------------------------\n\n    constructor(config?: Config | ConfigFactory) {\n        this.name = ModuleName.CONFIG;\n        this.instance = config;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        let instance : Config;\n        if (typeof this.instance === 'function') {\n            instance = await this.instance();\n        } else if (this.instance) {\n            instance = this.instance;\n        } else {\n            instance = await this.read();\n        }\n\n        container.register(ConfigInjectionKey, { useValue: instance });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Read config from env and fs.\n     *\n     * @param options\n     */\n    async read(options: ConfigRawReadOptions = {}) : Promise<Config> {\n        return readConfig(options);\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAaG,eAAb,MAAaA;CACAC;CAECC;CAIV,YAAYC,QAAiC;EACzC,KAAKF,OAAOJ,WAAWO;EACvB,KAAKF,WAAWC;CACpB;CAIA,MAAME,MAAMC,WAAsC;EAC9C,IAAIJ;EACJ,IAAI,OAAO,KAAKA,aAAa,YACzBA,WAAW,MAAM,KAAKA,SAAQ;OAC3B,IAAI,KAAKA,UACZA,WAAW,KAAKA;OAEhBA,WAAW,MAAM,KAAKK,KAAI;EAG9BD,UAAUE,SAASV,oBAAoB,EAAEW,UAAUP,SAAS,CAAA;CAChE;;;;;IASA,MAAMK,KAAKG,UAAgC,CAAC,GAAqB;EAC7D,OAAOX,WAAWW,OAAAA;CACtB;AACJ"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJ9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiK9E"}

package/dist/app/modules/config/normalize.mjs

@@ -5,6 +5,7 @@ import "../../../core/entities/event/constants.mjs";
 import "../../../core/index.mjs";
 import { toPublicHost } from "../../../utils/host.mjs";
 import { expandToOrigins } from "./origins.mjs";
+import { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from "./trust-proxy.mjs";
 import { parseConfig } from "./parse.mjs";
 import { EnvironmentName, base64ToArrayBuffer } from "@authup/kit";
 import { USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
@@ -46,6 +47,7 @@ async function normalizeConfig(input = {}) {
 		publicUrl,
 		mtlsPublicUrl: null,
 		certificateSource: "disabled",
+		trustProxy: true,
 		middlewareBody: true,
 		middlewareCookie: true,
 		middlewareCors: true,
@@ -87,6 +89,8 @@ async function normalizeConfig(input = {}) {
 		...parsed,
 		trustedOrigins
 	};
+	if (typeof config.trustProxy === "string") config.trustProxy = canonicalizeTrustProxy(config.trustProxy);
+	else if (Array.isArray(config.trustProxy)) config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);
 	if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) throw new AuthupError("loginAttemptThrottleEnabled requires eventLogEnabled.");
 	if (config.mfaRequired && !config.mfaEnabled) throw new AuthupError("mfaRequired requires mfaEnabled.");
 	if (config.mtlsPublicUrl && config.certificateSource === "disabled") throw new AuthupError("mtlsPublicUrl requires certificateSource to be enabled.");

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,eAAsBW,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCb,KAAKc,KAAKb,QAAQc,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOtB,KAAK,YAAYK,gBAAgBkB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQjB,gBAAgBwB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU9B,QAAQc,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EAEnBC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBlD;EAEnBmD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG9D;EAIHW;CACJ;CAIA,IAAIO,OAAO2B,+BAA+B,CAAC3B,OAAOuB,iBAC9C,MAAM,IAAIlD,YAAY,uDAAA;CAG1B,IAAI2B,OAAOgC,eAAe,CAAChC,OAAO+B,YAC9B,MAAM,IAAI1D,YAAY,kCAAA;CAG1B,IAAI2B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAIjC,YAAY,yDAAA;CAQ1B,IAAI2B,OAAO8B,sBAAsB;EAC7B,IAAIe,aAAa;EACjB,IAAI;GACAA,aAAatE,oBAAoByB,OAAO8B,qBAAqBgB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAIxE,YAAY,gEAAA;CAE9B;CAEA,OAAO2B;AACX"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBrD;EAEnBsD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/D;EAIHW;CACJ;CAMA,IAAI,OAAOO,OAAOO,eAAe,UAC7BP,OAAOO,aAAa7B,uBAAuBsB,OAAOO,UAAU;MACzD,IAAIuC,MAAMC,QAAQ/C,OAAOO,UAAU,GACtCP,OAAOO,aAAaP,OAAOO,WAAWyC,IAAIrE,+BAAAA;CAK9C,IAAIqB,OAAO4B,+BAA+B,CAAC5B,OAAOwB,iBAC9C,MAAM,IAAIrD,YAAY,uDAAA;CAG1B,IAAI6B,OAAOiC,eAAe,CAACjC,OAAOgC,YAC9B,MAAM,IAAI7D,YAAY,kCAAA;CAG1B,IAAI6B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAInC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAO+B,sBAAsB;EAC7B,IAAIkB,aAAa;EACjB,IAAI;GACAA,aAAa5E,oBAAoB2B,OAAO+B,qBAAqBmB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAI9E,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CA4OnD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CAmPnD"}

package/dist/app/modules/config/read/env.mjs

@@ -55,6 +55,8 @@ function readConfigRawFromEnv() {
 	if (mtlsPublicURL) options.mtlsPublicUrl = mtlsPublicURL;
 	const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);
 	if (certificateSource) options.certificateSource = certificateSource;
+	const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);
+	if (typeof trustProxy === "string" && trustProxy.trim().length > 0) options.trustProxy = trustProxy;
 	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
 	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
 	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);