@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/adapters/http/controllers/workflows/userinfo/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserInfoController","service","ctx","get","event","actor","id","identity","type","data","getOne"],"sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { User } from '@authup/core-kit';\nimport type { IUserService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserInfoControllerContext = {\n    service: IUserService,\n};\n\n/**\n * The OIDC userinfo endpoint (advertised via discovery). It serves the\n * authenticated user's own record as a FLAT claims document — it must\n * never adopt the `{ data, meta }` entity-record envelope, which is why\n * it is a dedicated route instead of an alias of `GET /users/@me`.\n */\n@DTags('auth')\n@DController('/userinfo')\nexport class UserInfoController {\n    protected service: IUserService;\n\n    constructor(ctx: UserInfoControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async get(\n        @DContext() event: IAppEvent,\n    ): Promise<User> {\n        const actor = buildActorContext(event);\n\n        let id = '@me';\n        if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            id = actor.identity.data.id;\n        }\n\n        return this.service.getOne(id, actor, useRequestQuery(event));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAaO,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,IACF,OACa;EACb,MAAME,QAAQN,kBAAkBK,KAAAA;EAEhC,IAAIE,KAAK;EACT,IACID,MAAME,YACNF,MAAME,SAASC,SAAS,QAExBF,KAAKD,MAAME,SAASE,KAAKH;EAG7B,OAAO,KAAKL,QAAQS,OAAOJ,IAAID,OAAOR,gBAAgBO,KAAAA,CAAAA;CAC1D;AACJ;;CAhBeN,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserInfoController","service","ctx","get","event","actor","id","identity","type","data","query","getOne","fields"],"sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { User } from '@authup/core-kit';\nimport type { IUserService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserInfoControllerContext = {\n    service: IUserService,\n};\n\n/**\n * The OIDC userinfo endpoint (advertised via discovery). It serves the\n * authenticated user's own record as a FLAT claims document — it must\n * never adopt the `{ data, meta }` entity-record envelope, which is why\n * it is a dedicated route instead of an alias of `GET /users/@me`.\n */\n@DTags('auth')\n@DController('/userinfo')\nexport class UserInfoController {\n    protected service: IUserService;\n\n    constructor(ctx: UserInfoControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async get(\n        @DContext() event: IAppEvent,\n    ): Promise<User> {\n        const actor = buildActorContext(event);\n\n        let id = '@me';\n        if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            id = actor.identity.data.id;\n        }\n\n        // `email` is a standard OIDC claim, but the column is `select: false`\n        // (opt-in projection), so the default field set leaves it out and the\n        // claims document arrives without it. This endpoint only ever serves\n        // the CALLER'S OWN record, so the claim rides on top of the defaults.\n        // A caller stating its own `fields` keeps full control: the opt-in\n        // stays opt-in wherever the projection is explicit.\n        const query = useRequestQuery(event);\n\n        return this.service.getOne(id, actor, {\n            ...query,\n            fields: query.fields || '+email',\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAaO,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,IACF,OACa;EACb,MAAME,QAAQN,kBAAkBK,KAAAA;EAEhC,IAAIE,KAAK;EACT,IACID,MAAME,YACNF,MAAME,SAASC,SAAS,QAExBF,KAAKD,MAAME,SAASE,KAAKH;EAS7B,MAAMI,QAAQb,gBAAgBO,KAAAA;EAE9B,OAAO,KAAKH,QAAQU,OAAOL,IAAID,OAAO;GAClC,GAAGK;GACHE,QAAQF,MAAME,UAAU;EAC5B,CAAA;CACJ;AACJ;;CA3Bed,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/index.mjs

@@ -25,6 +25,7 @@ import { ForceLoggedInMiddleware } from "./middleware/built-in/loggedin/module.m
 import { ForceUserLoggedInMiddleware } from "./middleware/built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./middleware/built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./middleware/built-in/realm-resolver/factory.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./middleware/built-in/theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./middleware/built-in/assets.mjs";
 import { registerBasicMiddleware } from "./middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./middleware/built-in/cors.mjs";
@@ -60,6 +61,7 @@ import { IdentityProviderRoleMappingController } from "./controllers/entities/id
 import { KeyController } from "./controllers/entities/key/module.mjs";
 import { PermissionController } from "./controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./controllers/entities/permission-policy/module.mjs";
+import { AccountController } from "./controllers/workflows/account/module.mjs";
 import { ActivateController } from "./controllers/workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "./controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./controllers/workflows/authorize/module.mjs";
@@ -94,4 +96,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/adapters/http/middleware/built-in/assets.d.ts

@@ -1,4 +1,11 @@
 import type { App } from 'routup';
+import type { ViteDevServer } from 'vite';
+import type { AssetsMiddlewareOptions } from './types.ts';
 export declare const VITE_SERVER_STORE_KEY: unique symbol;
-export declare function registerAssetsMiddleware(router: App): Promise<void>;
+/**
+ * Returns the vite dev server it created (JIT mode only), so the caller can
+ * close it on teardown. It owns a file watcher and an HMR websocket, which
+ * outlive the http listener otherwise.
+ */
+export declare function registerAssetsMiddleware(router: App, options?: AssetsMiddlewareOptions): Promise<ViteDevServer | undefined>;
 //# sourceMappingURL=assets.d.ts.map

package/dist/adapters/http/middleware/built-in/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAOlC,eAAO,MAAM,qBAAqB,eAAuB,CAAC;AAE1D,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,GAAG,iBAyCzD"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAM1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,qBAAqB,eAAuB,CAAC;AAE1D;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC1C,MAAM,EAAE,GAAG,EACX,OAAO,GAAE,uBAA4B,GACrC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAgFrC"}

package/dist/adapters/http/middleware/built-in/assets.mjs

@@ -1,29 +1,53 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from "../../../../path.mjs";
+import { PACKAGE_PATH } from "../../../../path.mjs";
+import { THEME_ASSET_MOUNT_PATH } from "../../ui/theme/contract/constants.mjs";
+import { createThemeAssetsHandler } from "../../ui/theme/assets.mjs";
+import { ThemeProvider } from "../../ui/theme/module.mjs";
+import "../../ui/theme/index.mjs";
+import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from "../../ui/auth-console/resolve.mjs";
+import "../../ui/auth-console/index.mjs";
+import { registerThemeMiddleware } from "./theme.mjs";
+import { resolveAccountConsoleDistPath } from "../../ui/account-console/module.mjs";
+import "../../ui/account-console/index.mjs";
+import { InternalError } from "@authup/errors";
 import path from "node:path";
 import { defineCoreHandler } from "routup";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { fromNodeMiddleware } from "routup/node";
 import { read } from "locter";
+import fs from "node:fs";
 import { createHandler } from "@routup/assets";
 //#region src/adapters/http/middleware/built-in/assets.ts
 const VITE_SERVER_STORE_KEY = Symbol("ViteServer");
-async function registerAssetsMiddleware(router) {
+/**
+* Returns the vite dev server it created (JIT mode only), so the caller can
+* close it on teardown. It owns a file watcher and an HMR websocket, which
+* outlive the http listener otherwise.
+*/ async function registerAssetsMiddleware(router, options = {}) {
+	await registerThemeAssets(router, options);
+	const accountDistPath = resolveAccountConsoleDistPath();
+	if (accountDistPath) router.use("account/assets", createHandler(path.posix.join(accountDistPath, "assets"), {
+		fallthrough: false,
+		scan: false
+	}));
 	if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {
 		router.use("public", createHandler(path.posix.join(PACKAGE_PATH, "public"), {
 			fallthrough: true,
 			scan: false
 		}));
-		router.use("public", createHandler(path.posix.join(UI_DIST_PATH, "client"), {
+		const authConsoleDistPath = resolveAuthConsoleDistPath();
+		if (authConsoleDistPath) router.use("public", createHandler(path.posix.join(authConsoleDistPath, "client"), {
 			fallthrough: false,
 			scan: false
 		}));
 		return;
 	}
+	const authConsolePackagePath = resolveAuthConsolePackagePath();
+	if (!authConsolePackagePath) throw new InternalError("The auth console package (@authup/client-auth-console) is not installed.");
 	const server = await (await read("vite")).createServer({
-		root: UI_SOURCE_PATH,
+		root: authConsolePackagePath,
 		base: "/public/",
 		logLevel: "error",
 		server: {
@@ -40,6 +64,26 @@ async function registerAssetsMiddleware(router) {
 		event.store[VITE_SERVER_STORE_KEY] = server;
 		return event.next();
 	}));
+	return server;
+}
+/**
+* Load the operator theme and mount its `assets/` directory at /theme.
+*
+* A missing directory disables the feature entirely: no provider is
+* created, no middleware is registered, and both console serve paths keep
+* returning byte-identical un-themed pages. So the default configuration
+* pays nothing, not even a per-request core handler.
+*/ async function registerThemeAssets(router, options) {
+	const { themeDirectoryPath } = options;
+	if (!themeDirectoryPath || !fs.existsSync(themeDirectoryPath)) return;
+	const provider = new ThemeProvider({
+		directoryPath: themeDirectoryPath,
+		fragmentsEnabled: options.themeFragmentsEnabled,
+		logger: options.logger
+	});
+	await provider.load();
+	registerThemeMiddleware(router, provider);
+	router.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(provider));
 }
 //#endregion
 export { VITE_SERVER_STORE_KEY, registerAssetsMiddleware };

package/dist/adapters/http/middleware/built-in/assets.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"assets.mjs","names":["read","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        router.use('public', createHandler(\n            path.posix.join(UI_DIST_PATH, 'client'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n        return;\n    }\n\n    const vite = await read('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: UI_SOURCE_PATH,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"assets.mjs","names":["InternalError","read","CodeTransformation","isCodeTransformation","createHandler","fs","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","resolveAccountConsoleDistPath","resolveAuthConsoleDistPath","resolveAuthConsolePackagePath","THEME_ASSET_MOUNT_PATH","ThemeProvider","createThemeAssetsHandler","registerThemeMiddleware","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","options","registerThemeAssets","accountDistPath","use","posix","join","fallthrough","scan","JUST_IN_TIME","authConsoleDistPath","undefined","authConsolePackagePath","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next","themeDirectoryPath","existsSync","provider","directoryPath","fragmentsEnabled","themeFragmentsEnabled","logger","load"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { InternalError } from '@authup/errors';\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH } from '../../../../path.ts';\nimport { resolveAccountConsoleDistPath } from '../../ui/account-console/index.ts';\nimport { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from '../../ui/auth-console/index.ts';\nimport { THEME_ASSET_MOUNT_PATH, ThemeProvider, createThemeAssetsHandler } from '../../ui/theme/index.ts';\nimport { registerThemeMiddleware } from './theme.ts';\nimport type { AssetsMiddlewareOptions } from './types.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\n/**\n * Returns the vite dev server it created (JIT mode only), so the caller can\n * close it on teardown. It owns a file watcher and an HMR websocket, which\n * outlive the http listener otherwise.\n */\nexport async function registerAssetsMiddleware(\n    router: App,\n    options: AssetsMiddlewareOptions = {},\n) : Promise<ViteDevServer | undefined> {\n    // Mounted FIRST, and outside the JIT early-return below, so an\n    // operator theme applies in dev mode too. An invalid manifest throws\n    // here and fails the boot.\n    await registerThemeAssets(router, options);\n\n    // Static assets of the account console SPA (its fixed vite base is\n    // /account/). Served in dev mode too — the bundle is prebuilt, not\n    // vite-transformed. A missing bundle only disables the mount; the page\n    // route reports the actionable error.\n    const accountDistPath = resolveAccountConsoleDistPath();\n    if (accountDistPath) {\n        router.use('account/assets', createHandler(\n            path.posix.join(accountDistPath, 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n    }\n\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        // Static assets of the auth console SSR bundle (its fixed vite base\n        // is /public/). A missing bundle only disables the mount; the page\n        // routes report the actionable error.\n        const authConsoleDistPath = resolveAuthConsoleDistPath();\n        if (authConsoleDistPath) {\n            router.use('public', createHandler(\n                path.posix.join(authConsoleDistPath, 'client'),\n                {\n                    fallthrough: false,\n                    scan: false,\n                },\n            ));\n        }\n        return undefined;\n    }\n\n    // JIT (dev) mode serves the auth console straight from the package\n    // SOURCE directory (the workspace symlink carries index.html + src/ +\n    // vite.config.ts; a published install has no JIT). Vite auto-loads the\n    // package's own vite.config.ts from the root.\n    const authConsolePackagePath = resolveAuthConsolePackagePath();\n    if (!authConsolePackagePath) {\n        throw new InternalError(\n            'The auth console package (@authup/client-auth-console) is not installed.',\n        );\n    }\n\n    const vite = await read('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: authConsolePackagePath,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n\n    return server;\n}\n\n/**\n * Load the operator theme and mount its `assets/` directory at /theme.\n *\n * A missing directory disables the feature entirely: no provider is\n * created, no middleware is registered, and both console serve paths keep\n * returning byte-identical un-themed pages. So the default configuration\n * pays nothing, not even a per-request core handler.\n */\nasync function registerThemeAssets(router: App, options: AssetsMiddlewareOptions) : Promise<void> {\n    const { themeDirectoryPath } = options;\n    if (!themeDirectoryPath || !fs.existsSync(themeDirectoryPath)) {\n        return;\n    }\n\n    const provider = new ThemeProvider({\n        directoryPath: themeDirectoryPath,\n        fragmentsEnabled: options.themeFragmentsEnabled,\n        logger: options.logger,\n    });\n\n    await provider.load();\n\n    registerThemeMiddleware(router, provider);\n\n    router.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(provider));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAaiB,wBAAwBC,OAAO,YAAA;;;;;GAO5C,eAAsBC,yBAClBC,QACAC,UAAmC,CAAC,GAAC;CAKrC,MAAMC,oBAAoBF,QAAQC,OAAAA;CAMlC,MAAME,kBAAkBb,8BAAAA;CACxB,IAAIa,iBACAH,OAAOI,IAAI,kBAAkBpB,cACzBE,KAAKmB,MAAMC,KAAKH,iBAAiB,QAAA,GACjC;EACII,aAAa;EACbC,MAAM;CACV,CAAA,CAAA;CAIR,IAAI,CAACzB,qBAAqBD,mBAAmB2B,YAAY,GAAG;EACxDT,OAAOI,IAAI,UAAUpB,cACjBE,KAAKmB,MAAMC,KAAKjB,cAAc,QAAA,GAC9B;GACIkB,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAMJ,MAAME,sBAAsBnB,2BAAAA;EAC5B,IAAImB,qBACAV,OAAOI,IAAI,UAAUpB,cACjBE,KAAKmB,MAAMC,KAAKI,qBAAqB,QAAA,GACrC;GACIH,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGR;CACJ;CAMA,MAAMI,yBAAyBpB,8BAAAA;CAC/B,IAAI,CAACoB,wBACD,MAAM,IAAIhC,cACN,0EAAA;CAMR,MAAMkC,SAAwB,OAAMD,MAFjBhC,KAAK,MAAA,EAAA,CAEiBkC,aAAa;EAClDC,MAAMJ;EACNK,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAvB,OAAOI,IAAI,UAAUhB,mBAAmB0B,OAAOU,WAAW,CAAA;CAC1DxB,OAAOI,IAAIjB,mBAAmBsC,UAAAA;EAC1BA,MAAMC,MAAM7B,yBAAyBiB;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;CAEA,OAAOb;AACX;;;;;;;;GAUA,eAAeZ,oBAAoBF,QAAaC,SAAgC;CAC5E,MAAM,EAAE2B,uBAAuB3B;CAC/B,IAAI,CAAC2B,sBAAsB,CAAC3C,GAAG4C,WAAWD,kBAAAA,GACtC;CAGJ,MAAME,WAAW,IAAIpC,cAAc;EAC/BqC,eAAeH;EACfI,kBAAkB/B,QAAQgC;EAC1BC,QAAQjC,QAAQiC;CACpB,CAAA;CAEA,MAAMJ,SAASK,KAAI;CAEnBvC,wBAAwBI,QAAQ8B,QAAAA;CAEhC9B,OAAOI,IAAIX,wBAAwBE,yBAAyBmC,QAAAA,CAAAA;AAChE"}

package/dist/adapters/http/middleware/built-in/authorization/module.mjs

@@ -52,7 +52,8 @@ var AuthorizationMiddleware = class {
 		return promise;
 	}
 	async runInner(event) {
-		setRequestPermissionEvaluator(event, new RequestPermissionEvaluator(event, this.permissionEvaluator));
+		const requestAccessContext = new RequestPermissionEvaluator(event, this.permissionEvaluator);
+		setRequestPermissionEvaluator(event, requestAccessContext);
 		const headerValue = event.headers.get("authorization");
 		if (!headerValue) return;
 		const header = parseAuthorizationHeader(headerValue);

package/dist/adapters/http/middleware/built-in/authorization/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","runSymbol","Symbol","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","pending","store","promise","runInner","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nconst runSymbol = Symbol('RAuthorizationMiddlewareRun');\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent): Promise<void> {\n        // routup's dispatch walk re-enters earlier middlewares once per\n        // remaining match when no handler produces a response — exponentially\n        // (routup/routup#946), so an unmatched authenticated request re-ran\n        // this middleware ~100+ times, re-verifying Basic credentials (bcrypt)\n        // on every re-entry (~4s per 404). Authorization is a pure function of\n        // the request: the first run's settlement — including a rejection —\n        // is authoritative, so memoize the promise on the request store (the\n        // store is shared by every re-entry of the same request).\n        const pending = event.store[runSymbol] as Promise<void> | undefined;\n        if (pending) {\n            return pending;\n        }\n\n        const promise = this.runInner(event);\n        event.store[runSymbol] = promise;\n        return promise;\n    }\n\n    protected async runInner(event: IAppEvent): Promise<void> {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,MAAMuB,YAAYC,OAAO,6BAAA;AAEzB,IAAaC,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAIrB,oBAAoBuB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIpB,kBAAkBqB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI5B,oBAAoB;GAC/CkC,UAAUD,IAAIE;GACdC,cAAc,IAAIzB,eAAasB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAiC;EASvC,MAAMC,UAAUD,MAAME,MAAMpB;EAC5B,IAAImB,SACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,SAASJ,KAAAA;EAC9BA,MAAME,MAAMpB,aAAaqB;EACzB,OAAOA;CACX;CAEA,MAAgBC,SAASJ,OAAiC;EAKtDtB,8BAA8BsB,OAAOK,IAJJ/B,2BAC7B0B,OACA,KAAKb,mBAE4BkB,CAAAA;EAErC,MAAMC,cAAcN,MAAMO,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASzC,yBAAyBsC,WAAAA;EAExC,IAAIG,OAAOC,SAAS3C,wBAAwB4C,QAAQ;GAChD,MAAM,KAAKC,gCAAgCZ,OAAOS,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAAS3C,wBAAwB8C,OAAO;GAC/C,MAAM,KAAKC,+BAA+Bd,OAAOS,MAAAA;GACjD;EACJ;EAEA,MAAM/C,gBAAgBqD,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZZ,OACAS,QACF;EACE,MAAMO,UAAU,MAAM,KAAK9B,oBAAoB+B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBnB,OAAOgB,OAAAA;EAC3C,IAAIA,QAAQI,SAASvD,gBAAgBwD,KAAK;GACtC,MAAM,KAAKC,qBAAqBtB,OAAOgB,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASvD,gBAAgB0D,QACjC,MAAM5D,SAAS6D,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C3C,gBAAgBmB,OAAOS,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACR/C,iBAAiBqB,OAAOlC,uBAAuBkD,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAEA,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/BhD,oBAAoBoB,OAAOgB,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAMrE,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACA1D,mBAAmBwB,OAAOkC,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBnB,OAAkBgB,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAM3E,SAAS4E,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAMjE,iCACnByB,OACA,KAAKf,QAAQwD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAM1E,SAAS4E,QAAO;GAG1BnE,+CAA+CoE,QAAAA;EACnD,QAAQ;GACJ,MAAM7E,SAAS4E,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZtB,OACAgB,SACF;EACE,IAAIA,QAAQgB,aAAapE,cAAc+E,MACnC,MAAMhF,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAYpF,aAAamF,MAEjC,MAAMhF,SAASmE,QAAO;EAG1B,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMvE,SAASmE,QAAO;EAG1BrD,yBAAyBuB,OAAO;GAC5BkC,UAAU,IAAI7D,gBAAgB6D,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZd,OACAS,QACF;EACE,IAAI,KAAKxB,QAAQ4D,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKxD,oBAAoByD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAa4F;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKpE,QAAQqE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhE,kBAAkBwD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAamF;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEvaluator","IdentityType","ScopeName","AuthHeaderError","JWTError","OAuth2SubKind","OAuth2TokenKind","deserializeOAuth2Scope","AuthorizationHeaderType","parseAuthorizationHeader","ClientAuthenticator","PolicyEngine","UserAuthenticator","assertClientCertificateEvidenceValidForBinding","RequestIdentity","RequestPermissionEvaluator","extractClientCertificateEvidence","setRequestIdentity","setRequestMfaLoginTicket","setRequestPermissionEvaluator","setRequestScopes","setRequestSessionId","setRequestToken","runSymbol","Symbol","AuthorizationMiddleware","options","oauth2TokenVerifier","permissionEvaluator","identityResolver","sessionManager","clientAuthenticator","userAuthenticator","ctx","provider","permissionProvider","policyEngine","identityPermissionProvider","realmId","clientId","run","event","pending","store","promise","runInner","requestAccessContext","headerValue","headers","get","header","type","BEARER","verifyBearerAuthorizationHeader","BASIC","verifyBasicAuthorizationHeader","unsupportedType","payload","verify","token","verifyCertificateBinding","kind","MFA","verifyMfaLoginTicket","ACCESS","payloadPropertyInvalid","realm_id","scope","session_id","session","findOneById","expired","ping","sub_kind","sub","identity","resolve","cnf","expectedThumbprint","length","invalid","evidence","certificateSource","thumbprint","USER","subKind","clientAuthBasic","authenticator","safeAuthenticate","username","password","success","GLOBAL","CLIENT","data","userAuthBasic","authenticated"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IPermissionEvaluator } from '@authup/access';\nimport { PermissionEvaluator } from '@authup/access';\nimport type { Client, User } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { AuthHeaderError } from '@authup/errors';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWTError,\n    OAuth2SubKind,\n    OAuth2TokenKind,\n    deserializeOAuth2Scope,\n} from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport {\n    AuthorizationHeaderType,\n    type BasicAuthorizationHeader,\n    type BearerAuthorizationHeader,\n    parseAuthorizationHeader,\n} from 'hapic';\nimport {\n    ClientAuthenticator,\n    PolicyEngine,\n    UserAuthenticator,\n    assertClientCertificateEvidenceValidForBinding,\n} from '../../../../../core/index.ts';\nimport type {\n    ICredentialsAuthenticator,\n    IIdentityResolver,\n    IOAuth2TokenVerifier,\n    ISessionManager,\n} from '../../../../../core/index.ts';\nimport {\n    RequestIdentity,\n    RequestPermissionEvaluator,\n    extractClientCertificateEvidence,\n    setRequestIdentity,\n    setRequestMfaLoginTicket,\n    setRequestPermissionEvaluator,\n    setRequestScopes,\n    setRequestSessionId,\n    setRequestToken,\n} from '../../../request/index.ts';\nimport type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';\n\nconst runSymbol = Symbol('RAuthorizationMiddlewareRun');\n\nexport class AuthorizationMiddleware {\n    protected options: HTTPAuthorizationMiddlewareOptions;\n\n    // --------------------------------------\n\n    protected oauth2TokenVerifier: IOAuth2TokenVerifier;\n\n    protected permissionEvaluator: IPermissionEvaluator;\n\n    // --------------------------------------\n\n    protected identityResolver: IIdentityResolver;\n\n    protected sessionManager : ISessionManager;\n\n    // --------------------------------------\n\n    protected clientAuthenticator : ICredentialsAuthenticator<Client>;\n\n    protected userAuthenticator : ICredentialsAuthenticator<User>;\n\n    // --------------------------------------\n\n    constructor(ctx: HTTPAuthorizationMiddlewareContext) {\n        this.options = ctx.options || {};\n\n        this.identityResolver = ctx.identityResolver;\n        this.sessionManager = ctx.sessionManager;\n\n        this.clientAuthenticator = new ClientAuthenticator(ctx.identityResolver);\n        this.userAuthenticator = new UserAuthenticator(ctx.identityResolver);\n\n        this.oauth2TokenVerifier = ctx.oauth2TokenVerifier;\n\n        this.permissionEvaluator = new PermissionEvaluator({\n            provider: ctx.permissionProvider,\n            policyEngine: new PolicyEngine(ctx.identityPermissionProvider),\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    // --------------------------------------\n\n    async run(event: IAppEvent): Promise<void> {\n        // routup's dispatch walk re-enters earlier middlewares once per\n        // remaining match when no handler produces a response — exponentially\n        // (routup/routup#946), so an unmatched authenticated request re-ran\n        // this middleware ~100+ times, re-verifying Basic credentials (bcrypt)\n        // on every re-entry (~4s per 404). Authorization is a pure function of\n        // the request: the first run's settlement — including a rejection —\n        // is authoritative, so memoize the promise on the request store (the\n        // store is shared by every re-entry of the same request).\n        const pending = event.store[runSymbol] as Promise<void> | undefined;\n        if (pending) {\n            return pending;\n        }\n\n        const promise = this.runInner(event);\n        event.store[runSymbol] = promise;\n        return promise;\n    }\n\n    protected async runInner(event: IAppEvent): Promise<void> {\n        const requestAccessContext = new RequestPermissionEvaluator(\n            event,\n            this.permissionEvaluator,\n        );\n        setRequestPermissionEvaluator(event, requestAccessContext);\n\n        const headerValue = event.headers.get('authorization');\n        if (!headerValue) {\n            return;\n        }\n\n        const header = parseAuthorizationHeader(headerValue);\n\n        if (header.type === AuthorizationHeaderType.BEARER) {\n            await this.verifyBearerAuthorizationHeader(event, header);\n            return;\n        }\n\n        if (header.type === AuthorizationHeaderType.BASIC) {\n            await this.verifyBasicAuthorizationHeader(event, header);\n            return;\n        }\n\n        throw AuthHeaderError.unsupportedType(header.type);\n    }\n\n    /**\n     * @throws JWTError\n     */\n    protected async verifyBearerAuthorizationHeader(\n        event: IAppEvent,\n        header: BearerAuthorizationHeader,\n    ) {\n        const payload = await this.oauth2TokenVerifier.verify(header.token);\n        await this.verifyCertificateBinding(event, payload);\n        if (payload.kind === OAuth2TokenKind.MFA) {\n            await this.verifyMfaLoginTicket(event, payload);\n            return;\n        }\n\n        if (payload.kind !== OAuth2TokenKind.ACCESS) {\n            throw JWTError.payloadPropertyInvalid('kind');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        setRequestToken(event, header.token);\n\n        if (payload.scope) {\n            setRequestScopes(event, deserializeOAuth2Scope(payload.scope));\n        }\n\n        // -------------------------------------------------------\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        setRequestSessionId(event, payload.session_id);\n\n        // -------------------------------------------------------\n\n        if (!payload.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n\n        if (identity) {\n            setRequestIdentity(event, identity);\n        }\n    }\n\n    protected async verifyCertificateBinding(event: IAppEvent, payload: OAuth2TokenPayload): Promise<void> {\n        if (!payload.cnf) {\n            return;\n        }\n\n        const expectedThumbprint = payload.cnf['x5t#S256'];\n        if (typeof expectedThumbprint !== 'string' || expectedThumbprint.length === 0) {\n            throw JWTError.invalid();\n        }\n\n        try {\n            const evidence = await extractClientCertificateEvidence(\n                event,\n                this.options.certificateSource ?? 'disabled',\n            );\n            if (!evidence || evidence.thumbprint !== expectedThumbprint) {\n                throw JWTError.invalid();\n            }\n\n            assertClientCertificateEvidenceValidForBinding(evidence);\n        } catch {\n            throw JWTError.invalid();\n        }\n    }\n\n    /**\n     * An \"MFA-pending\" login ticket (issue #3242). Verified with the same\n     * rigor as an access token (session existence + subject match), but\n     * stashed on a DEDICATED request slot — the main identity / scope /\n     * session slots stay empty, so every identity-gated route rejects a\n     * ticket bearer (default-deny); only the challenge routes opt in via\n     * useRequestMfaLoginTicket.\n     *\n     * @throws JWTError\n     */\n    protected async verifyMfaLoginTicket(\n        event: IAppEvent,\n        payload: OAuth2TokenPayload,\n    ) {\n        if (payload.sub_kind !== OAuth2SubKind.USER) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!payload.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        if (!payload.realm_id) {\n            throw JWTError.payloadPropertyInvalid('realm_id');\n        }\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.expired();\n        }\n\n        try {\n            await this.sessionManager.verify(session);\n        } catch {\n            throw JWTError.expired();\n        }\n\n        // defense in depth — the pending session must still belong to the\n        // ticket subject.\n        if (\n            session.sub !== payload.sub ||\n            session.subKind !== IdentityType.USER\n        ) {\n            throw JWTError.expired();\n        }\n\n        await this.sessionManager.ping(session);\n\n        const identity = await this.identityResolver.resolve(\n            payload.sub_kind,\n            payload.sub,\n        );\n        if (!identity) {\n            throw JWTError.expired();\n        }\n\n        setRequestMfaLoginTicket(event, {\n            identity: new RequestIdentity(identity),\n            payload,\n        });\n    }\n\n    protected async verifyBasicAuthorizationHeader(\n        event: IAppEvent,\n        header: BasicAuthorizationHeader,\n    ) {\n        if (this.options.clientAuthBasic) {\n            const authenticator = await this.clientAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n            if (authenticator.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.CLIENT,\n                    data: authenticator.data,\n                });\n            }\n        }\n\n        if (this.options.userAuthBasic) {\n            const authenticated = await this.userAuthenticator.safeAuthenticate(\n                header.username,\n                header.password,\n            );\n\n            if (authenticated.success) {\n                setRequestScopes(event, [ScopeName.GLOBAL]);\n                setRequestIdentity(event, {\n                    type: IdentityType.USER,\n                    data: authenticated.data,\n                });\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,MAAMuB,YAAYC,OAAO,6BAAA;AAEzB,IAAaC,0BAAb,MAAaA;CACCC;CAIAC;CAEAC;CAIAC;CAEAC;CAIAC;CAEAC;CAIV,YAAYC,KAAyC;EACjD,KAAKP,UAAUO,IAAIP,WAAW,CAAC;EAE/B,KAAKG,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAE1B,KAAKC,sBAAsB,IAAIrB,oBAAoBuB,IAAIJ,gBAAgB;EACvE,KAAKG,oBAAoB,IAAIpB,kBAAkBqB,IAAIJ,gBAAgB;EAEnE,KAAKF,sBAAsBM,IAAIN;EAE/B,KAAKC,sBAAsB,IAAI5B,oBAAoB;GAC/CkC,UAAUD,IAAIE;GACdC,cAAc,IAAIzB,eAAasB,IAAII,0BAA0B;GAC7DC,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAIA,MAAMC,IAAIC,OAAiC;EASvC,MAAMC,UAAUD,MAAME,MAAMpB;EAC5B,IAAImB,SACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,SAASJ,KAAAA;EAC9BA,MAAME,MAAMpB,aAAaqB;EACzB,OAAOA;CACX;CAEA,MAAgBC,SAASJ,OAAiC;EACtD,MAAMK,uBAAuB,IAAI/B,2BAC7B0B,OACA,KAAKb,mBAAmB;EAE5BT,8BAA8BsB,OAAOK,oBAAAA;EAErC,MAAMC,cAAcN,MAAMO,QAAQC,IAAI,eAAA;EACtC,IAAI,CAACF,aACD;EAGJ,MAAMG,SAASzC,yBAAyBsC,WAAAA;EAExC,IAAIG,OAAOC,SAAS3C,wBAAwB4C,QAAQ;GAChD,MAAM,KAAKC,gCAAgCZ,OAAOS,MAAAA;GAClD;EACJ;EAEA,IAAIA,OAAOC,SAAS3C,wBAAwB8C,OAAO;GAC/C,MAAM,KAAKC,+BAA+Bd,OAAOS,MAAAA;GACjD;EACJ;EAEA,MAAM/C,gBAAgBqD,gBAAgBN,OAAOC,IAAI;CACrD;;;IAKA,MAAgBE,gCACZZ,OACAS,QACF;EACE,MAAMO,UAAU,MAAM,KAAK9B,oBAAoB+B,OAAOR,OAAOS,KAAK;EAClE,MAAM,KAAKC,yBAAyBnB,OAAOgB,OAAAA;EAC3C,IAAIA,QAAQI,SAASvD,gBAAgBwD,KAAK;GACtC,MAAM,KAAKC,qBAAqBtB,OAAOgB,OAAAA;GACvC;EACJ;EAEA,IAAIA,QAAQI,SAASvD,gBAAgB0D,QACjC,MAAM5D,SAAS6D,uBAAuB,MAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C3C,gBAAgBmB,OAAOS,OAAOS,KAAK;EAEnC,IAAIF,QAAQU,OACR/C,iBAAiBqB,OAAOlC,uBAAuBkD,QAAQU,KAAK,CAAA;EAKhE,IAAI,CAACV,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAEA,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/BhD,oBAAoBoB,OAAOgB,QAAQW,UAAU;EAI7C,IAAI,CAACX,QAAQgB,UACT,MAAMrE,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,MAAMU,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAGf,IAAIC,UACA1D,mBAAmBwB,OAAOkC,QAAAA;CAElC;CAEA,MAAgBf,yBAAyBnB,OAAkBgB,SAA4C;EACnG,IAAI,CAACA,QAAQoB,KACT;EAGJ,MAAMC,qBAAqBrB,QAAQoB,IAAI;EACvC,IAAI,OAAOC,uBAAuB,YAAYA,mBAAmBC,WAAW,GACxE,MAAM3E,SAAS4E,QAAO;EAG1B,IAAI;GACA,MAAMC,WAAW,MAAMjE,iCACnByB,OACA,KAAKf,QAAQwD,qBAAqB,UAAA;GAEtC,IAAI,CAACD,YAAYA,SAASE,eAAeL,oBACrC,MAAM1E,SAAS4E,QAAO;GAG1BnE,+CAA+CoE,QAAAA;EACnD,QAAQ;GACJ,MAAM7E,SAAS4E,QAAO;EAC1B;CACJ;;;;;;;;;;IAYA,MAAgBjB,qBACZtB,OACAgB,SACF;EACE,IAAIA,QAAQgB,aAAapE,cAAc+E,MACnC,MAAMhF,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQiB,KACT,MAAMtE,SAAS6D,uBAAuB,KAAA;EAG1C,IAAI,CAACR,QAAQS,UACT,MAAM9D,SAAS6D,uBAAuB,UAAA;EAG1C,IAAI,CAACR,QAAQW,YACT,MAAMhE,SAAS6D,uBAAuB,YAAA;EAG1C,MAAMI,UAAU,MAAM,KAAKvC,eAAewC,YAAYb,QAAQW,UAAU;EACxE,IAAI,CAACC,SACD,MAAMjE,SAASmE,QAAO;EAG1B,IAAI;GACA,MAAM,KAAKzC,eAAe4B,OAAOW,OAAAA;EACrC,QAAQ;GACJ,MAAMjE,SAASmE,QAAO;EAC1B;EAIA,IACIF,QAAQK,QAAQjB,QAAQiB,OACxBL,QAAQgB,YAAYpF,aAAamF,MAEjC,MAAMhF,SAASmE,QAAO;EAG1B,MAAM,KAAKzC,eAAe0C,KAAKH,OAAAA;EAE/B,MAAMM,WAAW,MAAM,KAAK9C,iBAAiB+C,QACzCnB,QAAQgB,UACRhB,QAAQiB,GAAG;EAEf,IAAI,CAACC,UACD,MAAMvE,SAASmE,QAAO;EAG1BrD,yBAAyBuB,OAAO;GAC5BkC,UAAU,IAAI7D,gBAAgB6D,QAAAA;GAC9BlB;EACJ,CAAA;CACJ;CAEA,MAAgBF,+BACZd,OACAS,QACF;EACE,IAAI,KAAKxB,QAAQ4D,iBAAiB;GAC9B,MAAMC,gBAAgB,MAAM,KAAKxD,oBAAoByD,iBACjDtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAEnB,IAAIH,cAAcI,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAa4F;KACnBC,MAAMP,cAAcO;IACxB,CAAA;GACJ;EACJ;EAEA,IAAI,KAAKpE,QAAQqE,eAAe;GAC5B,MAAMC,gBAAgB,MAAM,KAAKhE,kBAAkBwD,iBAC/CtC,OAAOuC,UACPvC,OAAOwC,QAAQ;GAGnB,IAAIM,cAAcL,SAAS;IACvBvE,iBAAiBqB,OAAO,CAACvC,UAAU0F,MAAO,CAAA;IAC1C3E,mBAAmBwB,OAAO;KACtBU,MAAMlD,aAAamF;KACnBU,MAAME,cAAcF;IACxB,CAAA;GACJ;EACJ;CACJ;AACJ"}

package/dist/adapters/http/middleware/built-in/index.d.ts

@@ -9,5 +9,7 @@ export * from './logger.ts';
 export * from './prometheus.ts';
 export * from './rate-limit.ts';
 export * from './swagger.ts';
+export * from './theme.ts';
+export * from './types.ts';
 export * from './ui-http-client.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/middleware/built-in/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}

package/dist/adapters/http/middleware/built-in/index.mjs

@@ -10,6 +10,7 @@ import "./loggedin/index.mjs";
 import { RealmResolverMiddleware } from "./realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./realm-resolver/factory.mjs";
 import "./realm-resolver/index.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./assets.mjs";
 import { registerBasicMiddleware } from "./basic.mjs";
 import { registerCorsMiddleware } from "./cors.mjs";
@@ -19,4 +20,4 @@ import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "
 import { registerRateLimitMiddleware } from "./rate-limit.mjs";
 import { createSwaggerMiddleware } from "./swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./ui-http-client.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, THEME_STORE_KEY, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, useRequestTheme };

package/dist/adapters/http/middleware/built-in/rate-limit.mjs

@@ -14,11 +14,11 @@ function registerRateLimitMiddleware(router, input) {
 			const identity = useRequestIdentity(event);
 			if (!identity) return 1200;
 			switch (identity.type) {
-				case "client": return 60 * 5e3;
+				case "client": return 3e5;
 				default: return 6e3;
 			}
 		},
-		windowMs: 60 * 1e3
+		windowMs: 6e4
 	};
 	options = merge(input || {}, options);
 	router.use(rateLimit(options));

package/dist/adapters/http/middleware/built-in/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":["rateLimit","getRequestIP","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","keyGenerator","event","max","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { getRequestIP } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        // @routup/rate-limit's default keyGenerator hardcodes\n        // `{ trustProxy: true }`; deriving the key here instead lets it\n        // follow the app-level trust contract (config `trustProxy`).\n        keyGenerator: (event) => getRequestIP(event) || '127.0.0.1',\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EAIzBC,eAAeC,UAAUR,aAAaQ,KAAAA,KAAU;EAChDC,IAAID,OAAK;GACL,MAAME,WAAWR,mBAAmBM,KAAAA;GACpC,IAAI,CAACE,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAN,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOS,IAAId,UAAUO,OAAAA,CAAAA;AACzB"}
+{"version":3,"file":"rate-limit.mjs","names":["rateLimit","getRequestIP","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","keyGenerator","event","max","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { getRequestIP } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        // @routup/rate-limit's default keyGenerator hardcodes\n        // `{ trustProxy: true }`; deriving the key here instead lets it\n        // follow the app-level trust contract (config `trustProxy`).\n        keyGenerator: (event) => getRequestIP(event) || '127.0.0.1',\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EAIzBC,eAAeC,UAAUR,aAAaQ,KAAAA,KAAU;EAChDC,IAAID,OAAK;GACL,MAAME,WAAWR,mBAAmBM,KAAAA;GACpC,IAAI,CAACE,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO;IAGX,SACI,OAAO;GAEf;EACJ;EACAC,UAAU;CACd;CAEAN,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOS,IAAId,UAAUO,OAAAA,CAAAA;AACzB"}

package/dist/adapters/http/middleware/built-in/theme.d.ts

@@ -0,0 +1,15 @@
+import type { App, IAppEvent } from 'routup';
+import type { IThemeProvider } from '../../ui/theme/index.ts';
+/**
+ * Per-request handoff of the operator theme into the two console serve
+ * paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.
+ *
+ * A store handoff rather than module-scope state, so two applications in
+ * one process (the test suite) never share a theme, and rather than
+ * threading the provider through seven workflow controllers, which is a
+ * lot of plumbing for decoration.
+ */
+export declare const THEME_STORE_KEY: unique symbol;
+export declare function registerThemeMiddleware(router: App, provider: IThemeProvider): void;
+export declare function useRequestTheme(event: IAppEvent): IThemeProvider | undefined;
+//# sourceMappingURL=theme.d.ts.map

package/dist/adapters/http/middleware/built-in/theme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/theme.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,eAAkB,CAAC;AAE/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,QAM5E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc,GAAG,SAAS,CAE7E"}

package/dist/adapters/http/middleware/built-in/theme.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { defineCoreHandler } from "routup";
+//#region src/adapters/http/middleware/built-in/theme.ts
+/**
+* Per-request handoff of the operator theme into the two console serve
+* paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.
+*
+* A store handoff rather than module-scope state, so two applications in
+* one process (the test suite) never share a theme, and rather than
+* threading the provider through seven workflow controllers, which is a
+* lot of plumbing for decoration.
+*/ const THEME_STORE_KEY = Symbol("Theme");
+function registerThemeMiddleware(router, provider) {
+	router.use(defineCoreHandler((event) => {
+		event.store[THEME_STORE_KEY] = provider;
+		return event.next();
+	}));
+}
+function useRequestTheme(event) {
+	return event.store[THEME_STORE_KEY];
+}
+//#endregion
+export { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme };
+
+//# sourceMappingURL=theme.mjs.map

package/dist/adapters/http/middleware/built-in/theme.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme.mjs","names":["defineCoreHandler","THEME_STORE_KEY","Symbol","registerThemeMiddleware","router","provider","use","event","store","next","useRequestTheme"],"sources":["../../../../../src/adapters/http/middleware/built-in/theme.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App, IAppEvent } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport type { IThemeProvider } from '../../ui/theme/index.ts';\n\n/**\n * Per-request handoff of the operator theme into the two console serve\n * paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.\n *\n * A store handoff rather than module-scope state, so two applications in\n * one process (the test suite) never share a theme, and rather than\n * threading the provider through seven workflow controllers, which is a\n * lot of plumbing for decoration.\n */\nexport const THEME_STORE_KEY = Symbol('Theme');\n\nexport function registerThemeMiddleware(router: App, provider: IThemeProvider) {\n    router.use(defineCoreHandler((event) => {\n        event.store[THEME_STORE_KEY] = provider;\n\n        return event.next();\n    }));\n}\n\nexport function useRequestTheme(event: IAppEvent) : IThemeProvider | undefined {\n    return event.store[THEME_STORE_KEY] as IThemeProvider | undefined;\n}\n"],"mappings":";;;;;;;;;;;;;GAoBA,MAAaC,kBAAkBC,OAAO,OAAA;AAEtC,SAAgBC,wBAAwBC,QAAaC,UAAwB;CACzED,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,mBAAmBI;EAE/B,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ;AAEA,SAAgBC,gBAAgBH,OAAgB;CAC5C,OAAOA,MAAMC,MAAMP;AACvB"}

package/dist/adapters/http/middleware/built-in/types.d.ts

@@ -0,0 +1,14 @@
+import type { Logger } from '@authup/server-kit';
+export type AssetsMiddlewareOptions = {
+    /**
+     * Absolute path of the operator theme directory. Empty or missing
+     * disables theming entirely.
+     */
+    themeDirectoryPath?: string;
+    /**
+     * Opt in to reading the theme's `fragments/head.html`. Default off.
+     */
+    themeFragmentsEnabled?: boolean;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/middleware/built-in/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,uBAAuB,GAAG;IAClC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/middleware/built-in/ui-http-client.d.ts

@@ -1,7 +1,7 @@
 import type { IClient } from '@authup/core-http-kit';
 import type { App } from 'routup';
 /**
- * Per-request handoff of an HTTP-client factory into renderUIPage —
+ * Per-request handoff of an HTTP-client factory into renderAuthConsolePage —
  * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk
  * over the DI container (`() => container.resolve(UIHttpClient)`)
  * whose registration carries `lifetime: 'transient'`, so every SSR

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { defineCoreHandler } from "routup";
 //#region src/adapters/http/middleware/built-in/ui-http-client.ts
 /**
-* Per-request handoff of an HTTP-client factory into renderUIPage —
+* Per-request handoff of an HTTP-client factory into renderAuthConsolePage —
 * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk
 * over the DI container (`() => container.resolve(UIHttpClient)`)
 * whose registration carries `lifetime: 'transient'`, so every SSR

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ui-http-client.mjs","names":["defineCoreHandler","UI_HTTP_CLIENT_FACTORY_STORE_KEY","Symbol","registerUIHttpClientMiddleware","router","httpClientFactory","use","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/ui-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\n\n/**\n * Per-request handoff of an HTTP-client factory into renderUIPage —\n * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk\n * over the DI container (`() => container.resolve(UIHttpClient)`)\n * whose registration carries `lifetime: 'transient'`, so every SSR\n * render resolves a fresh client — never share one client instance\n * across renders (the authentication hook writes per-user state onto\n * it). Production binds the internal loopback client by default\n * (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.\n */\nexport const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol('UIHttpClientFactory');\n\nexport function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient) {\n    router.use(defineCoreHandler((event) => {\n        event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;;;;GAqBA,MAAaC,mCAAmCC,OAAO,qBAAA;AAEvD,SAAgBC,+BAA+BC,QAAaC,mBAAgC;CACxFD,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,oCAAoCI;EAChD,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"ui-http-client.mjs","names":["defineCoreHandler","UI_HTTP_CLIENT_FACTORY_STORE_KEY","Symbol","registerUIHttpClientMiddleware","router","httpClientFactory","use","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/ui-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\n\n/**\n * Per-request handoff of an HTTP-client factory into renderAuthConsolePage —\n * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk\n * over the DI container (`() => container.resolve(UIHttpClient)`)\n * whose registration carries `lifetime: 'transient'`, so every SSR\n * render resolves a fresh client — never share one client instance\n * across renders (the authentication hook writes per-user state onto\n * it). Production binds the internal loopback client by default\n * (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.\n */\nexport const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol('UIHttpClientFactory');\n\nexport function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient) {\n    router.use(defineCoreHandler((event) => {\n        event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;;;;GAqBA,MAAaC,mCAAmCC,OAAO,qBAAA;AAEvD,SAAgBC,+BAA+BC,QAAaC,mBAAgC;CACxFD,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,oCAAoCI;EAChD,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/index.mjs

@@ -7,6 +7,7 @@ import { ForceLoggedInMiddleware } from "./built-in/loggedin/module.mjs";
 import { ForceUserLoggedInMiddleware } from "./built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./built-in/realm-resolver/factory.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./built-in/theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./built-in/assets.mjs";
 import { registerBasicMiddleware } from "./built-in/basic.mjs";
 import { registerCorsMiddleware } from "./built-in/cors.mjs";
@@ -17,4 +18,4 @@ import { registerRateLimitMiddleware } from "./built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./built-in/ui-http-client.mjs";
 import "./built-in/index.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, THEME_STORE_KEY, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, useRequestTheme };

package/dist/adapters/http/request/client-certificate.mjs

@@ -8,7 +8,7 @@ import { base64ToArrayBuffer } from "@authup/kit";
 import { BadRequestError } from "@authup/errors";
 import { X509Certificate } from "@peculiar/x509";
 //#region src/adapters/http/request/client-certificate.ts
-const MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;
+const MAX_CERTIFICATE_HEADER_LENGTH = 131072;
 const MAX_CERTIFICATE_CHAIN_LENGTH = 10;
 const STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;
 async function extractClientCertificateEvidence(event, source) {

package/dist/adapters/http/request/client-certificate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport '../../../core/client-certificate/reflect.ts';\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n    buildClientCertificateThumbprint,\n    parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    if (source === 'disabled') {\n        return undefined;\n    }\n\n    let result: Omit<ClientCertificateEvidence, 'thumbprint'> | undefined;\n    if (source === 'standard') {\n        result = extractStandardEvidence(event);\n    } else if (source === 'forwarded') {\n        result = extractForwardedEvidence(event);\n    } else {\n        throw new BadRequestError('The client certificate source is not configured correctly.');\n    }\n    if (!result) {\n        return undefined;\n    }\n\n    return {\n        ...result,\n        thumbprint: await buildClientCertificateThumbprint(result.certificate),\n    };\n}\n\nfunction extractStandardEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const leafHeader = event.headers.get('client-cert');\n    const chainHeader = event.headers.get('client-cert-chain');\n\n    if (!leafHeader) {\n        if (chainHeader) {\n            throw certificateHeaderError();\n        }\n        return undefined;\n    }\n\n    assertHeaderLength(leafHeader);\n    const certificate = parseStructuredCertificate(leafHeader);\n    const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n    return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const value = event.headers.get('x-forwarded-tls-client-cert');\n    if (!value) {\n        return undefined;\n    }\n\n    assertHeaderLength(value);\n\n    let pem: string;\n    try {\n        // Native raw PEM is useful in tests and a few proxy integrations. The\n        // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n        // space, while literal base64 plus signs arrive as `%2B`.\n        pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n            value :\n            decodeURIComponent(value.replace(/\\+/g, '%20'));\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    let certificates: X509Certificate[];\n    try {\n        certificates = parseClientCertificateChain(pem);\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    if (certificates.length !== 1 || !certificates[0]) {\n        throw certificateHeaderError();\n    }\n\n    return {\n        certificate: certificates[0],\n        chain: [],\n    };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n    assertHeaderLength(value);\n    const items = value.split(',').map((item) => item.trim());\n    if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) {\n        throw certificateHeaderError();\n    }\n\n    return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n    const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n    if (!match?.[1]) {\n        throw certificateHeaderError();\n    }\n\n    try {\n        const raw = base64ToArrayBuffer(match[1]);\n        if (raw.byteLength === 0) {\n            throw certificateHeaderError();\n        }\n\n        const certificate = new X509Certificate(raw);\n        if (\n            certificate.toString('base64').replace(/=+$/, '') !==\n            match[1].replace(/=+$/, '')\n        ) {\n            throw certificateHeaderError();\n        }\n\n        return certificate;\n    } catch {\n        throw certificateHeaderError();\n    }\n}\n\nfunction assertHeaderLength(value: string): void {\n    if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n        throw certificateHeaderError();\n    }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n    return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}
+{"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport '../../../core/client-certificate/reflect.ts';\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n    buildClientCertificateThumbprint,\n    parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    if (source === 'disabled') {\n        return undefined;\n    }\n\n    let result: Omit<ClientCertificateEvidence, 'thumbprint'> | undefined;\n    if (source === 'standard') {\n        result = extractStandardEvidence(event);\n    } else if (source === 'forwarded') {\n        result = extractForwardedEvidence(event);\n    } else {\n        throw new BadRequestError('The client certificate source is not configured correctly.');\n    }\n    if (!result) {\n        return undefined;\n    }\n\n    return {\n        ...result,\n        thumbprint: await buildClientCertificateThumbprint(result.certificate),\n    };\n}\n\nfunction extractStandardEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const leafHeader = event.headers.get('client-cert');\n    const chainHeader = event.headers.get('client-cert-chain');\n\n    if (!leafHeader) {\n        if (chainHeader) {\n            throw certificateHeaderError();\n        }\n        return undefined;\n    }\n\n    assertHeaderLength(leafHeader);\n    const certificate = parseStructuredCertificate(leafHeader);\n    const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n    return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const value = event.headers.get('x-forwarded-tls-client-cert');\n    if (!value) {\n        return undefined;\n    }\n\n    assertHeaderLength(value);\n\n    let pem: string;\n    try {\n        // Native raw PEM is useful in tests and a few proxy integrations. The\n        // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n        // space, while literal base64 plus signs arrive as `%2B`.\n        pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n            value :\n            decodeURIComponent(value.replace(/\\+/g, '%20'));\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    let certificates: X509Certificate[];\n    try {\n        certificates = parseClientCertificateChain(pem);\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    if (certificates.length !== 1 || !certificates[0]) {\n        throw certificateHeaderError();\n    }\n\n    return {\n        certificate: certificates[0],\n        chain: [],\n    };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n    assertHeaderLength(value);\n    const items = value.split(',').map((item) => item.trim());\n    if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) {\n        throw certificateHeaderError();\n    }\n\n    return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n    const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n    if (!match?.[1]) {\n        throw certificateHeaderError();\n    }\n\n    try {\n        const raw = base64ToArrayBuffer(match[1]);\n        if (raw.byteLength === 0) {\n            throw certificateHeaderError();\n        }\n\n        const certificate = new X509Certificate(raw);\n        if (\n            certificate.toString('base64').replace(/=+$/, '') !==\n            match[1].replace(/=+$/, '')\n        ) {\n            throw certificateHeaderError();\n        }\n\n        return certificate;\n    } catch {\n        throw certificateHeaderError();\n    }\n}\n\nfunction assertHeaderLength(value: string): void {\n    if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n        throw certificateHeaderError();\n    }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n    return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAMK,gCAAgC;AACtC,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}

package/dist/adapters/http/request/helpers/locations.mjs

@@ -19,9 +19,7 @@ async function readFromLocations(event, locations) {
 		case "params":
 			Object.assign(out, event.params);
 			break;
-		case "cookies":
-			Object.assign(out, useRequestCookies(event));
-			break;
+		case "cookies": Object.assign(out, useRequestCookies(event));
 	}
 	return out;
 }

package/dist/adapters/http/request/helpers/locations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"locations.mjs","names":["readRequestBody","useRequestCookies","useRequestQuery","readFromLocations","event","locations","out","loc","body","Object","assign","params"],"sources":["../../../../../src/adapters/http/request/helpers/locations.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestCookies } from '@routup/basic/cookie';\nimport { useRequestQuery } from '@routup/basic/query';\n\nexport type RequestDataLocation = 'body' | 'query' | 'params' | 'cookies';\n\nexport async function readFromLocations(\n    event: IAppEvent,\n    locations: RequestDataLocation[],\n): Promise<Record<string, any>> {\n    const out: Record<string, any> = {};\n    for (const loc of locations) {\n        switch (loc) {\n            case 'body': {\n                const body = await readRequestBody(event);\n                if (body && typeof body === 'object') {\n                    Object.assign(out, body);\n                }\n                break;\n            }\n            case 'query': {\n                Object.assign(out, useRequestQuery(event));\n                break;\n            }\n            case 'params': {\n                Object.assign(out, event.params);\n                break;\n            }\n            case 'cookies': {\n                Object.assign(out, useRequestCookies(event));\n                break;\n            }\n        }\n    }\n    return out;\n}\n"],"mappings":";;;;;;;AAcA,eAAsBG,kBAClBC,OACAC,WAAgC;CAEhC,MAAMC,MAA2B,CAAC;CAClC,KAAK,MAAMC,OAAOF,WACd,QAAQE,KAAR;EACI,KAAK,QAAQ;GACT,MAAMC,OAAO,MAAMR,gBAAgBI,KAAAA;GACnC,IAAII,QAAQ,OAAOA,SAAS,UACxBC,OAAOC,OAAOJ,KAAKE,IAAAA;GAEvB;EACJ;EACA,KAAK;GACDC,OAAOC,OAAOJ,KAAKJ,gBAAgBE,KAAAA,CAAAA;GACnC;EAEJ,KAAK;GACDK,OAAOC,OAAOJ,KAAKF,MAAMO,MAAM;GAC/B;EAEJ,KAAK;GACDF,OAAOC,OAAOJ,KAAKL,kBAAkBG,KAAAA,CAAAA;GACrC;CAER;CAEJ,OAAOE;AACX"}
+{"version":3,"file":"locations.mjs","names":["readRequestBody","useRequestCookies","useRequestQuery","readFromLocations","event","locations","out","loc","body","Object","assign","params"],"sources":["../../../../../src/adapters/http/request/helpers/locations.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestCookies } from '@routup/basic/cookie';\nimport { useRequestQuery } from '@routup/basic/query';\n\nexport type RequestDataLocation = 'body' | 'query' | 'params' | 'cookies';\n\nexport async function readFromLocations(\n    event: IAppEvent,\n    locations: RequestDataLocation[],\n): Promise<Record<string, any>> {\n    const out: Record<string, any> = {};\n    for (const loc of locations) {\n        switch (loc) {\n            case 'body': {\n                const body = await readRequestBody(event);\n                if (body && typeof body === 'object') {\n                    Object.assign(out, body);\n                }\n                break;\n            }\n            case 'query': {\n                Object.assign(out, useRequestQuery(event));\n                break;\n            }\n            case 'params': {\n                Object.assign(out, event.params);\n                break;\n            }\n            case 'cookies': {\n                Object.assign(out, useRequestCookies(event));\n                break;\n            }\n        }\n    }\n    return out;\n}\n"],"mappings":";;;;;;;AAcA,eAAsBG,kBAClBC,OACAC,WAAgC;CAEhC,MAAMC,MAA2B,CAAC;CAClC,KAAK,MAAMC,OAAOF,WACd,QAAQE,KAAR;EACI,KAAK,QAAQ;GACT,MAAMC,OAAO,MAAMR,gBAAgBI,KAAAA;GACnC,IAAII,QAAQ,OAAOA,SAAS,UACxBC,OAAOC,OAAOJ,KAAKE,IAAAA;GAEvB;EACJ;EACA,KAAK;GACDC,OAAOC,OAAOJ,KAAKJ,gBAAgBE,KAAAA,CAAAA;GACnC;EAEJ,KAAK;GACDK,OAAOC,OAAOJ,KAAKF,MAAMO,MAAM;GAC/B;EAEJ,KAAK,WACDF,OAAOC,OAAOJ,KAAKL,kBAAkBG,KAAAA,CAAAA;CAG7C;CAEJ,OAAOE;AACX"}

package/dist/adapters/http/ui/account-console/index.d.ts

@@ -0,0 +1,4 @@
+export * from './module.ts';
+export * from './ref.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/account-console/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/account-console/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/account-console/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleRef } from "./ref.mjs";
+import { resolveAccountConsoleDistPath, serveAccountConsolePage, setAccountConsolePackagePath } from "./module.mjs";
+export { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleDistPath, resolveAccountConsoleRef, serveAccountConsolePage, setAccountConsolePackagePath };