@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.58

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJ9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiK9E"}

package/dist/app/modules/config/normalize.mjs

@@ -5,6 +5,7 @@ import "../../../core/entities/event/constants.mjs";
 import "../../../core/index.mjs";
 import { toPublicHost } from "../../../utils/host.mjs";
 import { expandToOrigins } from "./origins.mjs";
+import { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from "./trust-proxy.mjs";
 import { parseConfig } from "./parse.mjs";
 import { EnvironmentName, base64ToArrayBuffer } from "@authup/kit";
 import { USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
@@ -46,6 +47,7 @@ async function normalizeConfig(input = {}) {
 		publicUrl,
 		mtlsPublicUrl: null,
 		certificateSource: "disabled",
+		trustProxy: true,
 		middlewareBody: true,
 		middlewareCookie: true,
 		middlewareCors: true,
@@ -87,6 +89,8 @@ async function normalizeConfig(input = {}) {
 		...parsed,
 		trustedOrigins
 	};
+	if (typeof config.trustProxy === "string") config.trustProxy = canonicalizeTrustProxy(config.trustProxy);
+	else if (Array.isArray(config.trustProxy)) config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);
 	if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) throw new AuthupError("loginAttemptThrottleEnabled requires eventLogEnabled.");
 	if (config.mfaRequired && !config.mfaEnabled) throw new AuthupError("mfaRequired requires mfaEnabled.");
 	if (config.mtlsPublicUrl && config.certificateSource === "disabled") throw new AuthupError("mtlsPublicUrl requires certificateSource to be enabled.");

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,eAAsBW,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAMH,YAAYE,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCb,KAAKc,KAAKb,QAAQc,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUX,aAAaU,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOtB,KAAK,YAAYK,gBAAgBkB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUjB,gBAAgBgB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQjB,gBAAgBwB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU9B,QAAQc,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EAEnBC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBlD;EAEnBmD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG9D;EAIHW;CACJ;CAIA,IAAIO,OAAO2B,+BAA+B,CAAC3B,OAAOuB,iBAC9C,MAAM,IAAIlD,YAAY,uDAAA;CAG1B,IAAI2B,OAAOgC,eAAe,CAAChC,OAAO+B,YAC9B,MAAM,IAAI1D,YAAY,kCAAA;CAG1B,IAAI2B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAIjC,YAAY,yDAAA;CAQ1B,IAAI2B,OAAO8B,sBAAsB;EAC7B,IAAIe,aAAa;EACjB,IAAI;GACAA,aAAatE,oBAAoByB,OAAO8B,qBAAqBgB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAIxE,YAAY,gEAAA;CAE9B;CAEA,OAAO2B;AACX"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBrD;EAEnBsD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/D;EAIHW;CACJ;CAMA,IAAI,OAAOO,OAAOO,eAAe,UAC7BP,OAAOO,aAAa7B,uBAAuBsB,OAAOO,UAAU;MACzD,IAAIuC,MAAMC,QAAQ/C,OAAOO,UAAU,GACtCP,OAAOO,aAAaP,OAAOO,WAAWyC,IAAIrE,+BAAAA;CAK9C,IAAIqB,OAAO4B,+BAA+B,CAAC5B,OAAOwB,iBAC9C,MAAM,IAAIrD,YAAY,uDAAA;CAG1B,IAAI6B,OAAOiC,eAAe,CAACjC,OAAOgC,YAC9B,MAAM,IAAI7D,YAAY,kCAAA;CAG1B,IAAI6B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAInC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAO+B,sBAAsB;EAC7B,IAAIkB,aAAa;EACjB,IAAI;GACAA,aAAa5E,oBAAoB2B,OAAO+B,qBAAqBmB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAI9E,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CA4OnD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CAmPnD"}

package/dist/app/modules/config/read/env.mjs

@@ -55,6 +55,8 @@ function readConfigRawFromEnv() {
 	if (mtlsPublicURL) options.mtlsPublicUrl = mtlsPublicURL;
 	const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);
 	if (certificateSource) options.certificateSource = certificateSource;
+	const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);
+	if (typeof trustProxy === "string" && trustProxy.trim().length > 0) options.trustProxy = trustProxy;
 	const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);
 	if (trustedOrigins && trustedOrigins.length > 0) options.trustedOrigins = trustedOrigins;
 	const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAGhC,MAAME,iBAAiB1C,UAAUK,8BAA8BsC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe7B,SAAS,GAC1CO,QAAQsB,iBAAiBA;CAG7B,MAAME,oBAAoB1C,QAAQG,8BAA8BwC,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxB,QAAQwB,oBAAoBA;CAGhC,MAAME,qBAAqB5C,QAAQG,8BAA8B0C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B1B,QAAQ0B,qBAAqBA;CAGjC,MAAME,0BAA0B9C,QAAQG,8BAA8B4C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC5B,QAAQ4B,0BAA0BA;CAGtC,MAAME,oBAAoBhD,QAAQG,8BAA8B8C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B9B,QAAQ8B,oBAAoBA;CAGhC,MAAME,4BAA4BlD,QAAQG,8BAA8BgD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrChC,QAAQgC,4BAA4BA;CAGxC,MAAME,sBAAsBrD,SAASI,8BAA8BkD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BlC,QAAQkC,sBAAsBA;CAGlC,MAAME,2BAA2BvD,SAASI,8BAA8BoD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCpC,QAAQoC,2BAA2BA;CAGvC,MAAME,0BAA0BzD,SAASI,8BAA8BsD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAKhC,MAAME,kBAAkBrD,eAAeJ,8BAA8B0D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B1C,QAAQ0C,kBAAkBA;CAG9B,MAAME,wBAAwB9D,QAAQG,8BAA8B4D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC5C,QAAQ4C,wBAAwBA;CAGpC,MAAME,wBAAwBzD,eAAeJ,8BAA8B8D,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,8BAA8BlE,QAAQG,8BAA8BgE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvChD,QAAQgD,8BAA8BA;CAG1C,MAAME,8BAA8B7D,eAAeJ,8BAA8BkE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,wBAAwBtE,QAAQG,8BAA8BoE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAGpC,MAAME,qBAAqBxE,QAAQG,8BAA8BsE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BtD,QAAQsD,qBAAqBA;CAKjC,MAAME,aAAanE,eAAeJ,8BAA8BwE,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBxD,QAAQwD,aAAaA;CAGzB,MAAME,cAAcrE,eAAeJ,8BAA8B0E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB1D,QAAQ0D,cAAcA;CAG1B,MAAME,qBAAqB9E,QAAQG,8BAA8B4E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5D,QAAQ4D,qBAAqBA;CAGjC,MAAME,kBAAkBhF,QAAQG,8BAA8B8E,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9D,QAAQ8D,kBAAkBA;CAG9B,MAAME,uBAAuBrF,KAAKM,8BAA8BgF,sBAAsB;CACtF,IAAID,sBACAhE,QAAQgE,uBAAuBA;CAKnC,MAAME,kBAAkBrF,SAASI,8BAA8BkF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BlE,QAAQoE,kBAAkBF;CAG9B,MAAMG,sBAAsBxF,SAASI,8BAA8BqF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BrE,QAAQqE,sBAAsBA;CAGlC,MAAME,oBAAoB5F,KAAKM,8BAA8BuF,oBAAoB;CACjF,IAAID,mBACAvE,QAAQyE,qBAAqBF;CAGjC,MAAMG,yBAAyB7F,SAASI,8BAA8B0F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC1E,QAAQ4E,0BAA0BF;CAKtC,MAAMG,gBAAgBhG,SAASI,8BAA8B6F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB7E,QAAQ+E,gBAAgBF;CAG5B,MAAMG,mBAAmBnG,SAASI,8BAA8BgG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BhF,QAAQgF,mBAAmBA;CAG/B,MAAME,oBAAoBvG,KAAKM,8BAA8BkG,mBAAmB;CAChF,IAAID,mBACAlF,QAAQkF,oBAAoBA;CAGhC,MAAME,yBAAyBvG,SAASI,8BAA8BoG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCpF,QAAQoF,yBAAyBA;CAKrC,MAAME,cAAc1G,UAAUK,8BAA8BsG,WAAW;CACvE,IAAID,eAAeA,YAAY7F,SAAS,GACpCO,QAAQsF,cAAcA;CAG1B,MAAME,qCAAqC3G,SAASI,8BAA8BwG,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CxF,QAAQwF,qCAAqCA;CAGjD,OAAOxF;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    // canonicalized again in normalizeConfig for every config surface; the\n    // env read keeps the raw string, the shared canonicalizer decides.\n    const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n    if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n        options.trustProxy = trustProxy;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAKhC,MAAME,aAAa3C,KAAKM,8BAA8BsC,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAW9B,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQsB,aAAaA;CAGzB,MAAME,iBAAiB5C,UAAUK,8BAA8BwC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe/B,SAAS,GAC1CO,QAAQwB,iBAAiBA;CAG7B,MAAME,oBAAoB5C,QAAQG,8BAA8B0C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B1B,QAAQ0B,oBAAoBA;CAGhC,MAAME,qBAAqB9C,QAAQG,8BAA8B4C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5B,QAAQ4B,qBAAqBA;CAGjC,MAAME,0BAA0BhD,QAAQG,8BAA8B8C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC9B,QAAQ8B,0BAA0BA;CAGtC,MAAME,oBAAoBlD,QAAQG,8BAA8BgD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BhC,QAAQgC,oBAAoBA;CAGhC,MAAME,4BAA4BpD,QAAQG,8BAA8BkD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrClC,QAAQkC,4BAA4BA;CAGxC,MAAME,sBAAsBvD,SAASI,8BAA8BoD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BpC,QAAQoC,sBAAsBA;CAGlC,MAAME,2BAA2BzD,SAASI,8BAA8BsD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCtC,QAAQsC,2BAA2BA;CAGvC,MAAME,0BAA0B3D,SAASI,8BAA8BwD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCxC,QAAQwC,0BAA0BA;CAGtC,MAAME,oBAAoB5D,QAAQG,8BAA8B0D,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7B1C,QAAQ0C,oBAAoBA;CAKhC,MAAME,kBAAkBvD,eAAeJ,8BAA8B4D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B5C,QAAQ4C,kBAAkBA;CAG9B,MAAME,wBAAwBhE,QAAQG,8BAA8B8D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,wBAAwB3D,eAAeJ,8BAA8BgE,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjChD,QAAQgD,wBAAwBA;CAGpC,MAAME,8BAA8BpE,QAAQG,8BAA8BkE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,8BAA8B/D,eAAeJ,8BAA8BoE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvCpD,QAAQoD,8BAA8BA;CAG1C,MAAME,wBAAwBxE,QAAQG,8BAA8BsE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCtD,QAAQsD,wBAAwBA;CAGpC,MAAME,qBAAqB1E,QAAQG,8BAA8BwE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BxD,QAAQwD,qBAAqBA;CAKjC,MAAME,aAAarE,eAAeJ,8BAA8B0E,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtB1D,QAAQ0D,aAAaA;CAGzB,MAAME,cAAcvE,eAAeJ,8BAA8B4E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB5D,QAAQ4D,cAAcA;CAG1B,MAAME,qBAAqBhF,QAAQG,8BAA8B8E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B9D,QAAQ8D,qBAAqBA;CAGjC,MAAME,kBAAkBlF,QAAQG,8BAA8BgF,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BhE,QAAQgE,kBAAkBA;CAG9B,MAAME,uBAAuBvF,KAAKM,8BAA8BkF,sBAAsB;CACtF,IAAID,sBACAlE,QAAQkE,uBAAuBA;CAKnC,MAAME,kBAAkBvF,SAASI,8BAA8BoF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BpE,QAAQsE,kBAAkBF;CAG9B,MAAMG,sBAAsB1F,SAASI,8BAA8BuF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BvE,QAAQuE,sBAAsBA;CAGlC,MAAME,oBAAoB9F,KAAKM,8BAA8ByF,oBAAoB;CACjF,IAAID,mBACAzE,QAAQ2E,qBAAqBF;CAGjC,MAAMG,yBAAyB/F,SAASI,8BAA8B4F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC5E,QAAQ8E,0BAA0BF;CAKtC,MAAMG,gBAAgBlG,SAASI,8BAA8B+F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB/E,QAAQiF,gBAAgBF;CAG5B,MAAMG,mBAAmBrG,SAASI,8BAA8BkG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BlF,QAAQkF,mBAAmBA;CAG/B,MAAME,oBAAoBzG,KAAKM,8BAA8BoG,mBAAmB;CAChF,IAAID,mBACApF,QAAQoF,oBAAoBA;CAGhC,MAAME,yBAAyBzG,SAASI,8BAA8BsG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQsF,yBAAyBA;CAKrC,MAAME,cAAc5G,UAAUK,8BAA8BwG,WAAW;CACvE,IAAID,eAAeA,YAAY/F,SAAS,GACpCO,QAAQwF,cAAcA;CAG1B,MAAME,qCAAqC7G,SAASI,8BAA8B0G,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C1F,QAAQ0F,qCAAqCA;CAGjD,OAAO1F;AACX"}

package/dist/app/modules/config/read/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/fs.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,kDA0C1E"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/fs.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiCtD,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,kDA6C1E"}

package/dist/app/modules/config/read/fs.mjs

@@ -1,29 +1,52 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { Container } from "confinity";
+import { isObject, merge } from "smob";
+import { FSStore } from "confinity";
 //#region src/app/modules/config/read/fs.ts
+/**
+* Resolve one infrastructure section (`db`, `redis`, `smtp`), which may be
+* declared at the top level (shared), under `server.*` or under `server.core.*`.
+*
+* Keys are ordered **least specific first**. Two objects are merged, so a
+* shared base survives while the more specific declaration wins per key; a
+* scalar (a `redis://…` connection string, say) replaces whatever preceded it.
+* That is what "the most specific declaration wins" means for a section the
+* documentation explicitly describes as shared — `db.type` set once at the top
+* level still applies when only `db.database` is overridden per component.
+*
+* confinity v1 applied exactly this precedence inside `get([...keys])`; v2
+* removed the array form, so it is spelled out here instead.
+*/ function readSection(store, keys) {
+	let output;
+	for (const key of keys) {
+		const value = store.getSync(key);
+		if (typeof value === "undefined") continue;
+		output = isObject(value) && isObject(output) ? merge(value, output) : value;
+	}
+	return output;
+}
 async function readConfigRawFromFS(options = {}) {
-	const container = new Container({
+	const store = new FSStore({
 		prefix: "authup",
 		cwd: options.cwd
 	});
-	if (options.file) await container.loadFile(options.file);
-	else await container.load();
-	const raw = container.get("server.core") || {};
-	const db = container.get([
+	if (options.file) await store.loadFile(options.file);
+	else await store.load();
+	const raw = store.getSync("server.core") || {};
+	const db = readSection(store, [
 		"db",
 		"server.db",
 		"server.core.db"
 	]);
 	if (db) raw.db = db;
-	const redis = container.get([
+	const redis = readSection(store, [
 		"redis",
 		"server.redis",
 		"server.core.redis"
 	]);
 	if (redis) raw.redis = redis;
-	const smtp = container.get([
+	const smtp = readSection(store, [
 		"smtp",
 		"server.smtp",
 		"server.core.smtp"

package/dist/app/modules/config/read/fs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fs.mjs","names":["Container","readConfigRawFromFS","options","container","prefix","cwd","file","loadFile","load","raw","get","db","redis","smtp"],"sources":["../../../../../src/app/modules/config/read/fs.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Container } from 'confinity';\nimport type { ConfigInput } from '../types.ts';\nimport type { ConfigReadFsOptions } from './types.ts';\n\nexport async function readConfigRawFromFS(options: ConfigReadFsOptions = {}) {\n    const container = new Container({\n        prefix: 'authup',\n        cwd: options.cwd,\n    });\n\n    if (options.file) {\n        await container.loadFile(options.file);\n    } else {\n        await container.load();\n    }\n\n    const raw : ConfigInput = container.get('server.core') || {};\n\n    const db = container.get([\n        'db',\n        'server.db',\n        'server.core.db',\n    ]);\n    if (db) {\n        raw.db = db;\n    }\n\n    const redis = container.get([\n        'redis',\n        'server.redis',\n        'server.core.redis',\n    ]);\n    if (redis) {\n        raw.redis = redis;\n    }\n\n    const smtp = container.get([\n        'smtp',\n        'server.smtp',\n        'server.core.smtp',\n    ]);\n    if (smtp) {\n        raw.smtp = smtp;\n    }\n\n    return raw;\n}\n"],"mappings":";;;;;AAWA,eAAsBC,oBAAoBC,UAA+B,CAAC,GAAC;CACvE,MAAMC,YAAY,IAAIH,UAAU;EAC5BI,QAAQ;EACRC,KAAKH,QAAQG;CACjB,CAAA;CAEA,IAAIH,QAAQI,MACR,MAAMH,UAAUI,SAASL,QAAQI,IAAI;MAErC,MAAMH,UAAUK,KAAI;CAGxB,MAAMC,MAAoBN,UAAUO,IAAI,aAAA,KAAkB,CAAC;CAE3D,MAAMC,KAAKR,UAAUO,IAAI;EACrB;EACA;EACA;CACH,CAAA;CACD,IAAIC,IACAF,IAAIE,KAAKA;CAGb,MAAMC,QAAQT,UAAUO,IAAI;EACxB;EACA;EACA;CACH,CAAA;CACD,IAAIE,OACAH,IAAIG,QAAQA;CAGhB,MAAMC,OAAOV,UAAUO,IAAI;EACvB;EACA;EACA;CACH,CAAA;CACD,IAAIG,MACAJ,IAAII,OAAOA;CAGf,OAAOJ;AACX"}
+{"version":3,"file":"fs.mjs","names":["FSStore","isObject","merge","readSection","store","keys","output","key","value","getSync","readConfigRawFromFS","options","prefix","cwd","file","loadFile","load","raw","db","redis","smtp"],"sources":["../../../../../src/app/modules/config/read/fs.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { FSStore } from 'confinity';\nimport { isObject, merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport type { ConfigReadFsOptions } from './types.ts';\n\n/**\n * Resolve one infrastructure section (`db`, `redis`, `smtp`), which may be\n * declared at the top level (shared), under `server.*` or under `server.core.*`.\n *\n * Keys are ordered **least specific first**. Two objects are merged, so a\n * shared base survives while the more specific declaration wins per key; a\n * scalar (a `redis://…` connection string, say) replaces whatever preceded it.\n * That is what \"the most specific declaration wins\" means for a section the\n * documentation explicitly describes as shared — `db.type` set once at the top\n * level still applies when only `db.database` is overridden per component.\n *\n * confinity v1 applied exactly this precedence inside `get([...keys])`; v2\n * removed the array form, so it is spelled out here instead.\n */\nfunction readSection<T>(store: FSStore, keys: string[]) : T | undefined {\n    let output : unknown;\n\n    for (const key of keys) {\n        const value = store.getSync(key);\n        if (typeof value === 'undefined') {\n            continue;\n        }\n\n        output = isObject(value) && isObject(output) ?\n            merge(value, output) :\n            value;\n    }\n\n    return output as T | undefined;\n}\n\nexport async function readConfigRawFromFS(options: ConfigReadFsOptions = {}) {\n    const store = new FSStore({\n        prefix: 'authup',\n        cwd: options.cwd,\n    });\n\n    if (options.file) {\n        await store.loadFile(options.file);\n    } else {\n        await store.load();\n    }\n\n    // Read synchronously after the explicit load. `get` is asynchronous in\n    // confinity v2, and a missing `await` would hand a Promise to code that\n    // only checks whether it received an object.\n    const raw : ConfigInput = store.getSync<ConfigInput>('server.core') || {};\n\n    const db = readSection<ConfigInput['db']>(store, [\n        'db',\n        'server.db',\n        'server.core.db',\n    ]);\n    if (db) {\n        raw.db = db;\n    }\n\n    const redis = readSection<ConfigInput['redis']>(store, [\n        'redis',\n        'server.redis',\n        'server.core.redis',\n    ]);\n    if (redis) {\n        raw.redis = redis;\n    }\n\n    const smtp = readSection<ConfigInput['smtp']>(store, [\n        'smtp',\n        'server.smtp',\n        'server.core.smtp',\n    ]);\n    if (smtp) {\n        raw.smtp = smtp;\n    }\n\n    return raw;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GA0BA,SAASG,YAAeC,OAAgBC,MAAc;CAClD,IAAIC;CAEJ,KAAK,MAAMC,OAAOF,MAAM;EACpB,MAAMG,QAAQJ,MAAMK,QAAQF,GAAAA;EAC5B,IAAI,OAAOC,UAAU,aACjB;EAGJF,SAASL,SAASO,KAAAA,KAAUP,SAASK,MAAAA,IACjCJ,MAAMM,OAAOF,MAAAA,IACbE;CACR;CAEA,OAAOF;AACX;AAEA,eAAsBI,oBAAoBC,UAA+B,CAAC,GAAC;CACvE,MAAMP,QAAQ,IAAIJ,QAAQ;EACtBY,QAAQ;EACRC,KAAKF,QAAQE;CACjB,CAAA;CAEA,IAAIF,QAAQG,MACR,MAAMV,MAAMW,SAASJ,QAAQG,IAAI;MAEjC,MAAMV,MAAMY,KAAI;CAMpB,MAAMC,MAAoBb,MAAMK,QAAqB,aAAA,KAAkB,CAAC;CAExE,MAAMS,KAAKf,YAA+BC,OAAO;EAC7C;EACA;EACA;CACH,CAAA;CACD,IAAIc,IACAD,IAAIC,KAAKA;CAGb,MAAMC,QAAQhB,YAAkCC,OAAO;EACnD;EACA;EACA;CACH,CAAA;CACD,IAAIe,OACAF,IAAIE,QAAQA;CAGhB,MAAMC,OAAOjB,YAAiCC,OAAO;EACjD;EACA;EACA;CACH,CAAA;CACD,IAAIgB,MACAH,IAAIG,OAAOA;CAGf,OAAOH;AACX"}

package/dist/app/modules/config/read/module.mjs

@@ -7,10 +7,15 @@ import { merge } from "smob";
 //#region src/app/modules/config/read/module.ts
 async function readConfigRaw(options = {}) {
 	if (options.fs && options.env) {
-		const fs = await readConfigRawFromFS(boolableToObject(options.fs));
-		return merge(readConfigRawFromEnv(), fs);
+		const fsOptions = boolableToObject(options.fs);
+		const fs = await readConfigRawFromFS(fsOptions);
+		const env = readConfigRawFromEnv();
+		return merge(env, fs);
+	}
+	if (options.fs) {
+		const fsOptions = boolableToObject(options.fs);
+		return readConfigRawFromFS(fsOptions);
 	}
-	if (options.fs) return readConfigRawFromFS(boolableToObject(options.fs));
 	if (options.env) return readConfigRawFromEnv();
 	return {};
 }

package/dist/app/modules/config/read/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["merge","readConfigRawFromEnv","readConfigRawFromFS","readConfigRaw","options","fs","env","fsOptions","boolableToObject","input"],"sources":["../../../../../src/app/modules/config/read/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport { readConfigRawFromEnv } from './env.ts';\nimport { readConfigRawFromFS } from './fs.ts';\nimport type { ConfigRawReadOptions } from './types.ts';\n\nexport async function readConfigRaw(options: ConfigRawReadOptions = {}) : Promise<ConfigInput> {\n    if (options.fs && options.env) {\n        const fsOptions = boolableToObject(options.fs);\n        const fs = await readConfigRawFromFS(fsOptions);\n        const env = readConfigRawFromEnv();\n\n        return merge(env, fs);\n    }\n\n    if (options.fs) {\n        const fsOptions = boolableToObject(options.fs);\n        return readConfigRawFromFS(fsOptions);\n    }\n\n    if (options.env) {\n        return readConfigRawFromEnv();\n    }\n\n    return {};\n}\n\nfunction boolableToObject<T>(input: T | boolean) : T {\n    if (typeof input === 'boolean') {\n        return {} as T;\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;AAaA,eAAsBG,cAAcC,UAAgC,CAAC,GAAC;CAClE,IAAIA,QAAQC,MAAMD,QAAQE,KAAK;EAE3B,MAAMD,KAAK,MAAMH,oBADCM,iBAAiBJ,QAAQC,EACNE,CAAAA;EAGrC,OAAOP,MAFKC,qBAECK,GAAKD,EAAAA;CACtB;CAEA,IAAID,QAAQC,IAER,OAAOH,oBADWM,iBAAiBJ,QAAQC,EAChBE,CAAAA;CAG/B,IAAIH,QAAQE,KACR,OAAOL,qBAAAA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASO,iBAAoBC,OAAkB;CAC3C,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;CAGZ,OAAOA;AACX"}
+{"version":3,"file":"module.mjs","names":["merge","readConfigRawFromEnv","readConfigRawFromFS","readConfigRaw","options","fs","env","fsOptions","boolableToObject","input"],"sources":["../../../../../src/app/modules/config/read/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport { readConfigRawFromEnv } from './env.ts';\nimport { readConfigRawFromFS } from './fs.ts';\nimport type { ConfigRawReadOptions } from './types.ts';\n\nexport async function readConfigRaw(options: ConfigRawReadOptions = {}) : Promise<ConfigInput> {\n    if (options.fs && options.env) {\n        const fsOptions = boolableToObject(options.fs);\n        const fs = await readConfigRawFromFS(fsOptions);\n        const env = readConfigRawFromEnv();\n\n        return merge(env, fs);\n    }\n\n    if (options.fs) {\n        const fsOptions = boolableToObject(options.fs);\n        return readConfigRawFromFS(fsOptions);\n    }\n\n    if (options.env) {\n        return readConfigRawFromEnv();\n    }\n\n    return {};\n}\n\nfunction boolableToObject<T>(input: T | boolean) : T {\n    if (typeof input === 'boolean') {\n        return {} as T;\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;AAaA,eAAsBG,cAAcC,UAAgC,CAAC,GAAC;CAClE,IAAIA,QAAQC,MAAMD,QAAQE,KAAK;EAC3B,MAAMC,YAAYC,iBAAiBJ,QAAQC,EAAE;EAC7C,MAAMA,KAAK,MAAMH,oBAAoBK,SAAAA;EACrC,MAAMD,MAAML,qBAAAA;EAEZ,OAAOD,MAAMM,KAAKD,EAAAA;CACtB;CAEA,IAAID,QAAQC,IAAI;EACZ,MAAME,YAAYC,iBAAiBJ,QAAQC,EAAE;EAC7C,OAAOH,oBAAoBK,SAAAA;CAC/B;CAEA,IAAIH,QAAQE,KACR,OAAOL,qBAAAA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASO,iBAAoBC,OAAkB;CAC3C,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;CAGZ,OAAOA;AACX"}

package/dist/app/modules/config/trust-proxy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Canonicalize a string-form trustProxy value into its semantic type. This
+ * MUST run for every config surface (env, .conf, file, programmatic input) —
+ * not just env: proxy-addr accepts single-integer "long value" IPv4 notation,
+ * so an un-canonicalized `trustProxy: "1"` (e.g. a stringifying configmap)
+ * would silently compile to an allowlist of `0.0.0.1` instead of one trusted
+ * hop. The integer form wins over the boolean words (`'1'` means ONE hop,
+ * never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr
+ * presets are all case-insensitive semantically, but proxy-addr matches the
+ * presets case-sensitively) and passes through as the allowlist form.
+ */
+export declare function canonicalizeTrustProxy(raw: string): boolean | number | string;
+/**
+ * An entry of the explicit array (allowlist) form must be an address, CIDR,
+ * or preset — an integer-string or boolean word there is a mis-typed scalar
+ * form and must fail loud instead of compiling to a bogus `0.0.0.1`-style
+ * allowlist entry.
+ */
+export declare function isValidTrustProxyListEntry(value: string): boolean;
+/**
+ * The allowlist form needs the same trim + lowercase the scalar form gets:
+ * proxy-addr trims a comma-separated scalar string itself and matches its
+ * presets case-sensitively, so without this an array entry that PASSES
+ * validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or
+ * `LOOPBACK` — would still throw `invalid IP address` inside `new App`.
+ */
+export declare function canonicalizeTrustProxyListEntry(value: string): string;
+//# sourceMappingURL=trust-proxy.d.ts.map

package/dist/app/modules/config/trust-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-proxy.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/trust-proxy.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAyB7E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErE"}

package/dist/app/modules/config/trust-proxy.mjs

@@ -0,0 +1,64 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthupError } from "@authup/errors";
+//#region src/app/modules/config/trust-proxy.ts
+const BOOLEAN_TRUE_WORDS = /* @__PURE__ */ new Set([
+	"true",
+	"t",
+	"yes",
+	"y",
+	"on"
+]);
+const BOOLEAN_FALSE_WORDS = /* @__PURE__ */ new Set([
+	"false",
+	"f",
+	"no",
+	"n",
+	"off"
+]);
+const INTEGER = /^\d+$/;
+/**
+* Canonicalize a string-form trustProxy value into its semantic type. This
+* MUST run for every config surface (env, .conf, file, programmatic input) —
+* not just env: proxy-addr accepts single-integer "long value" IPv4 notation,
+* so an un-canonicalized `trustProxy: "1"` (e.g. a stringifying configmap)
+* would silently compile to an allowlist of `0.0.0.1` instead of one trusted
+* hop. The integer form wins over the boolean words (`'1'` means ONE hop,
+* never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr
+* presets are all case-insensitive semantically, but proxy-addr matches the
+* presets case-sensitively) and passes through as the allowlist form.
+*/ function canonicalizeTrustProxy(raw) {
+	const normalized = raw.trim();
+	if (INTEGER.test(normalized)) {
+		const hops = Number.parseInt(normalized, 10);
+		if (!Number.isSafeInteger(hops)) throw new AuthupError(`The trustProxy hop count "${normalized}" exceeds the safe integer range.`);
+		return hops;
+	}
+	const lowered = normalized.toLowerCase();
+	if (BOOLEAN_TRUE_WORDS.has(lowered)) return true;
+	if (BOOLEAN_FALSE_WORDS.has(lowered)) return false;
+	return lowered;
+}
+/**
+* An entry of the explicit array (allowlist) form must be an address, CIDR,
+* or preset — an integer-string or boolean word there is a mis-typed scalar
+* form and must fail loud instead of compiling to a bogus `0.0.0.1`-style
+* allowlist entry.
+*/ function isValidTrustProxyListEntry(value) {
+	const normalized = canonicalizeTrustProxyListEntry(value);
+	return normalized.length > 0 && !INTEGER.test(normalized) && !BOOLEAN_TRUE_WORDS.has(normalized) && !BOOLEAN_FALSE_WORDS.has(normalized);
+}
+/**
+* The allowlist form needs the same trim + lowercase the scalar form gets:
+* proxy-addr trims a comma-separated scalar string itself and matches its
+* presets case-sensitively, so without this an array entry that PASSES
+* validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or
+* `LOOPBACK` — would still throw `invalid IP address` inside `new App`.
+*/ function canonicalizeTrustProxyListEntry(value) {
+	return value.trim().toLowerCase();
+}
+//#endregion
+export { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry, isValidTrustProxyListEntry };
+
+//# sourceMappingURL=trust-proxy.mjs.map

package/dist/app/modules/config/trust-proxy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-proxy.mjs","names":["AuthupError","BOOLEAN_TRUE_WORDS","Set","BOOLEAN_FALSE_WORDS","INTEGER","canonicalizeTrustProxy","raw","normalized","trim","test","hops","Number","parseInt","isSafeInteger","lowered","toLowerCase","has","isValidTrustProxyListEntry","value","canonicalizeTrustProxyListEntry","length"],"sources":["../../../../src/app/modules/config/trust-proxy.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\n\nconst BOOLEAN_TRUE_WORDS = new Set(['true', 't', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_WORDS = new Set(['false', 'f', 'no', 'n', 'off']);\n\nconst INTEGER = /^\\d+$/;\n\n/**\n * Canonicalize a string-form trustProxy value into its semantic type. This\n * MUST run for every config surface (env, .conf, file, programmatic input) —\n * not just env: proxy-addr accepts single-integer \"long value\" IPv4 notation,\n * so an un-canonicalized `trustProxy: \"1\"` (e.g. a stringifying configmap)\n * would silently compile to an allowlist of `0.0.0.1` instead of one trusted\n * hop. The integer form wins over the boolean words (`'1'` means ONE hop,\n * never trust-all); anything else lowercases (IPs, CIDRs, and the proxy-addr\n * presets are all case-insensitive semantically, but proxy-addr matches the\n * presets case-sensitively) and passes through as the allowlist form.\n */\nexport function canonicalizeTrustProxy(raw: string): boolean | number | string {\n    const normalized = raw.trim();\n    if (INTEGER.test(normalized)) {\n        const hops = Number.parseInt(normalized, 10);\n        // The typed surface rejects an out-of-range hop count (zod's int() is\n        // safe-integer bounded), so the string surface must not smuggle one\n        // past it — canonicalization runs AFTER validation, and parseInt\n        // saturates a huge digit string into an unsafe integer / Infinity,\n        // which routup reads as \"trust every hop\".\n        if (!Number.isSafeInteger(hops)) {\n            throw new AuthupError(`The trustProxy hop count \"${normalized}\" exceeds the safe integer range.`);\n        }\n\n        return hops;\n    }\n\n    const lowered = normalized.toLowerCase();\n    if (BOOLEAN_TRUE_WORDS.has(lowered)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_WORDS.has(lowered)) {\n        return false;\n    }\n\n    return lowered;\n}\n\n/**\n * An entry of the explicit array (allowlist) form must be an address, CIDR,\n * or preset — an integer-string or boolean word there is a mis-typed scalar\n * form and must fail loud instead of compiling to a bogus `0.0.0.1`-style\n * allowlist entry.\n */\nexport function isValidTrustProxyListEntry(value: string): boolean {\n    const normalized = canonicalizeTrustProxyListEntry(value);\n    return normalized.length > 0 &&\n        !INTEGER.test(normalized) &&\n        !BOOLEAN_TRUE_WORDS.has(normalized) &&\n        !BOOLEAN_FALSE_WORDS.has(normalized);\n}\n\n/**\n * The allowlist form needs the same trim + lowercase the scalar form gets:\n * proxy-addr trims a comma-separated scalar string itself and matches its\n * presets case-sensitively, so without this an array entry that PASSES\n * validation (which compares the canonicalized value) — ` 10.0.0.0/8 ` or\n * `LOOPBACK` — would still throw `invalid IP address` inside `new App`.\n */\nexport function canonicalizeTrustProxyListEntry(value: string): string {\n    return value.trim().toLowerCase();\n}\n"],"mappings":";;;;;AASA,MAAMC,qCAAqB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAO;CAAK;AAAK,CAAA;AAClE,MAAMC,sCAAsB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAM;CAAK;AAAM,CAAA;AAEpE,MAAME,UAAU;;;;;;;;;;;GAahB,SAAgBC,uBAAuBC,KAAW;CAC9C,MAAMC,aAAaD,IAAIE,KAAI;CAC3B,IAAIJ,QAAQK,KAAKF,UAAAA,GAAa;EAC1B,MAAMG,OAAOC,OAAOC,SAASL,YAAY,EAAA;EAMzC,IAAI,CAACI,OAAOE,cAAcH,IAAAA,GACtB,MAAM,IAAIV,YAAY,6BAA6BO,WAAW,kCAAkC;EAGpG,OAAOG;CACX;CAEA,MAAMI,UAAUP,WAAWQ,YAAW;CACtC,IAAId,mBAAmBe,IAAIF,OAAAA,GACvB,OAAO;CAEX,IAAIX,oBAAoBa,IAAIF,OAAAA,GACxB,OAAO;CAGX,OAAOA;AACX;;;;;;GAQA,SAAgBG,2BAA2BC,OAAa;CACpD,MAAMX,aAAaY,gCAAgCD,KAAAA;CACnD,OAAOX,WAAWa,SAAS,KACvB,CAAChB,QAAQK,KAAKF,UAAAA,KACd,CAACN,mBAAmBe,IAAIT,UAAAA,KACxB,CAACJ,oBAAoBa,IAAIT,UAAAA;AACjC;;;;;;;GASA,SAAgBY,gCAAgCD,OAAa;CACzD,OAAOA,MAAMV,KAAI,CAAA,CAAGO,YAAW;AACnC"}

package/dist/app/modules/config/types.d.ts

@@ -71,6 +71,24 @@ export type Config = {
      * default: disabled
      */
     certificateSource: CertificateSource;
+    /**
+     * Which upstream proxies to trust when deriving the client IP from
+     * `X-Forwarded-For` (routup's `TrustProxyInput` minus the function
+     * form): `true` trusts every hop, `false` trusts none (the socket
+     * peer address is used), a number trusts that many hops, and a
+     * string / string[] is a proxy-addr allowlist (IPs, CIDRs, or the
+     * presets `loopback`, `linklocal`, `uniquelocal`; a comma-separated
+     * string splits into a list).
+     *
+     * SECURITY: with `true`, any DIRECT client can spoof its IP via the
+     * `X-Forwarded-For` header — login-throttle keys, audit-event rows,
+     * and the session inventory all record the forged value. Pin the
+     * actual proxy (`1`, `loopback`, or its address/CIDR) when the
+     * listener is reachable without a proxy or exact attribution
+     * matters.
+     * default: true
+     */
+    trustProxy: boolean | number | string | string[];
     /**
      * Trusted first-party app origins (besides publicUrl) — used as
      * redirect targets for the per-realm public `web` client. Does NOT

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CA2GhC"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAyHhC"}

package/dist/app/modules/config/validator.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { expandToOrigins } from "./origins.mjs";
+import { isValidTrustProxyListEntry } from "./trust-proxy.mjs";
 import { CERTIFICATE_SOURCES } from "../../../adapters/http/request/constants.mjs";
 import "../../../adapters/http/request/index.mjs";
 import { isObject } from "@authup/kit";
@@ -32,6 +33,12 @@ var ConfigValidator = class extends Container {
 			publicUrl: createValidator(z.url()),
 			mtlsPublicUrl: createValidator(z.url().nullable()),
 			certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),
+			trustProxy: createValidator(z.union([
+				z.boolean(),
+				z.number().int().nonnegative(),
+				z.string(),
+				z.array(z.string().refine(isValidTrustProxyListEntry, "must be an IP, CIDR, or proxy-addr preset"))
+			])),
 			trustedOrigins: createValidator(z.array(z.string().refine((value) => {
 				try {
 					expandToOrigins(value);

package/dist/app/modules/config/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustedOrigins","array","refine","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","int","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","union","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlDataSourceOptions | PostgresDataSourceOptions | BetterSqlite3DataSourceOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,IAAaO,kBAAb,cAAqCJ,UAAAA;CACdK,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBP,gBAAgBE,EAAEM,OAAM,CAAA;EAChD,MAAMC,mBAAmBT,gBAAgBE,EAAEQ,QAAO,CAAA;EAClD,MAAMC,6BAA6BX,gBAAgBE,EAAEU,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBd,gBAAgBE,EAAEM,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBjB,gBACxBE,EAAEQ,QAAO,CAAA,CAAGQ,GAAGhB,EAAEiB,OAAOjB,EAAEM,OAAM,GAAIN,EAAEkB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBrB,gBACrBE,EAAEM,OAAM,CAAA,CACHU,GAAGhB,EAAEQ,QAAO,CAAA,CAAA,CACZQ,GAAGhB,EAAEoB,QAA6BC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI7B,gBACAE,EAAEoB,QACGC,UAAUxB,SAASwB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWlC,gBAAgBE,EAAEiC,IAAG,CAAA;GAChCC,eAAepC,gBAAgBE,EAAEiC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBtC,gBAAgBE,EAAEqC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,gBAAgBxC,gBACZE,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAGkC,QAAQnB,UAAAA;IACvB,IAAI;KACApB,gBAAgBoB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPoB,gBAAgB1B;GAChB2B,gBAAgB3B;GAChB4B,kBAAkB5B;GAClB6B,iBAAiB7B;GACjB8B,sBAAsB9B;GACtB+B,qBAAqB/B;GACrBgC,mBAAmBxC;GAEnByC,mBAAmBvC;GACnBwC,oBAAoBxC;GACpByC,yBAAyBzC;GACzB0C,mBAAmB1C;GACnB2C,2BAA2B3C;GAC3B4C,qBAAqB9C;GACrB+C,0BAA0B/C;GAC1BgD,yBAAyBhD;GACzBiD,mBAAmB1D,gBACfE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA,CAAG5C,IAAIlB,wBAAAA,CAAAA;GAGpC+D,iBAAiBpD;GACjBqD,uBAAuBnD;GACvBoD,uBAAuBtD;GACvBuD,6BAA6BrD;GAC7BsD,6BAA6BxD;GAC7ByD,uBAAuBlE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAChEO,oBAAoBnE,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAI7DQ,sBAAsBpE,gBAAgBE,EAAEmE,MAAM,CAACnE,EAAEoE,QAAQ,EAAA,GAAKpE,EAAEqE,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAY/D;GACZgE,aAAahE;GACbiE,oBAAoB/D;GACpBgE,iBAAiB3E,gBAAgBE,EAAEU,OAAM,CAAA,CAAG+C,IAAG,CAAA,CAAGC,SAAQ,CAAA;GAE1DgB,iBAAiBnE;GACjBoE,qBAAqBpE;GACrBqE,oBAAoBhE;GACpBiE,yBAAyBtE;GAEzBuE,eAAevE;GACfwE,kBAAkBxE;GAClByE,mBAAmBpE;GACnBqE,wBAAwB1E;GAExB2E,aAAapF,gBACTE,EAAEM,OAAM,CAAA,CAAGU,GAAGhB,EAAEuC,MAAMvC,EAAEM,OAAM,CAAA,CAAA,CAAA;GAElC6E,oCAAoC5E;EACxC;EAEA,MAAM6E,OAAOC,OAAOD,KAAK9D,UAAAA;EACzB,KAAK,MAAMgE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGlE,WAAWgE,IAAI;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlDataSourceOptions | PostgresDataSourceOptions | BetterSqlite3DataSourceOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustProxy: createValidator(z.union([\n                z.boolean(),\n                z.number().int().nonnegative(),\n                // scalar strings are canonicalized in normalizeConfig\n                // (integer/boolean words → their semantic type)\n                z.string(),\n                // the explicit allowlist form: an integer-string or boolean\n                // word entry is a mis-typed scalar and must fail loud —\n                // proxy-addr would silently compile '1' to 0.0.0.1\n                z.array(z.string().refine(\n                    isValidTrustProxyListEntry,\n                    'must be an IP, CIDR, or proxy-addr preset',\n                )),\n            ])),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI9B,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWnC,gBAAgBE,EAAEkC,IAAG,CAAA;GAChCC,eAAerC,gBAAgBE,EAAEkC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBvC,gBAAgBE,EAAEsC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,YAAYzC,gBAAgBE,EAAEwC,MAAM;IAChCxC,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAG7B,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,OACfzC,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD0C,gBAAgB9C,gBACZE,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,QAAQrB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPuB,gBAAgB7B;GAChB8B,gBAAgB9B;GAChB+B,kBAAkB/B;GAClBgC,iBAAiBhC;GACjBiC,sBAAsBjC;GACtBkC,qBAAqBlC;GACrBmC,mBAAmB3C;GAEnB4C,mBAAmB1C;GACnB2C,oBAAoB3C;GACpB4C,yBAAyB5C;GACzB6C,mBAAmB7C;GACnB8C,2BAA2B9C;GAC3B+C,qBAAqBjD;GACrBkD,0BAA0BlD;GAC1BmD,yBAAyBnD;GACzBoD,mBAAmB9D,gBACfE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAG9C,IAAInB,wBAAAA,CAAAA;GAGpCkE,iBAAiBtD;GACjBuD,uBAAuBrD;GACvBsD,uBAAuBxD;GACvByD,6BAA6BvD;GAC7BwD,6BAA6B1D;GAC7B2D,uBAAuBrE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEO,oBAAoBtE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DQ,sBAAsBvE,gBAAgBE,EAAEwC,MAAM,CAACxC,EAAEsE,QAAQ,EAAA,GAAKtE,EAAEuE,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYhE;GACZiE,aAAajE;GACbkE,oBAAoBhE;GACpBiE,iBAAiB7E,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1De,iBAAiBpE;GACjBqE,qBAAqBrE;GACrBsE,oBAAoBjE;GACpBkE,yBAAyBvE;GAEzBwE,eAAexE;GACfyE,kBAAkBzE;GAClB0E,mBAAmBrE;GACnBsE,wBAAwB3E;GAExB4E,aAAatF,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElC8E,oCAAoC7E;EACxC;EAEA,MAAM8E,OAAOC,OAAOD,KAAK/D,UAAAA;EACzB,KAAK,MAAMiE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGnE,WAAWiE,IAAI;CAE3D;AACJ"}

package/dist/app/modules/database/module.mjs

@@ -135,7 +135,8 @@ var DatabaseModule = class {
 	}
 	registerEventPublisher(container, dataSource) {
 		const config = container.resolve(ConfigInjectionKey);
-		const publisher = new DomainEventPublisher({ logger: container.resolve(LoggerInjectionKey) });
+		const logger = container.resolve(LoggerInjectionKey);
+		const publisher = new DomainEventPublisher({ logger });
 		this.eventPublisher = publisher;
 		if (config.redis) {
 			const client = createRedisClient(config.redis);