npm - @authup/server-core - Versions diffs - 1.0.0-beta.57 → 1.0.0-beta.59 - Mend

@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (416) hide show

package/dist/app/modules/config/normalize.mjs CHANGED Viewed

@@ -39,6 +39,10 @@ async function normalizeConfig(input = {}) {
 		env,
 		rootPath: process.cwd(),
 		writableDirectoryPath,
+		themeDirectoryPath: "",
+		themeFragmentsEnabled: false,
+		authConsolePath: "",
+		accountConsolePath: "",
 		logger: true,
 		redis: false,
 		smtp: false,
@@ -64,6 +68,7 @@ async function normalizeConfig(input = {}) {
 		emailVerificationEnabled: false,
 		passwordRecoveryEnabled: false,
 		passwordMinLength: USER_PASSWORD_MIN_LENGTH,
+		accountConsoleEnabled: true,
 		eventLogEnabled: true,
 		eventLogRetentionDays: 90,
 		eventLogEntityEnabled: true,
@@ -89,6 +94,9 @@ async function normalizeConfig(input = {}) {
 		...parsed,
 		trustedOrigins
 	};
+	if (config.themeDirectoryPath) config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);
+	if (config.authConsolePath) config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);
+	if (config.accountConsolePath) config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);
 	if (typeof config.trustProxy === "string") config.trustProxy = canonicalizeTrustProxy(config.trustProxy);
 	else if (Array.isArray(config.trustProxy)) config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);
 	if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) throw new AuthupError("loginAttemptThrottleEnabled requires eventLogEnabled.");

package/dist/app/modules/config/normalize.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/\n Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n const parsed = await parseConfig(input);\n\n const writableDirectoryPath = parsed.writableDirectoryPath \|\|\n path.join(process.cwd(), 'writable');\n\n const port = parsed.port ?? 3001;\n let host = parsed.host \|\| '0.0.0.0';\n\n let publicUrl : string;\n if (parsed.publicUrl) {\n publicUrl = parsed.publicUrl;\n } else {\n const regex = /^([^:]+)(?::(\\d+))?$/;\n const match = host.match(regex);\n if (match) {\n [, host] = match;\n publicUrl = `http://${toPublicHost(host)}:${match[2] \|\| port}`;\n } else {\n publicUrl = `http://${toPublicHost(host)}:${port}`;\n }\n }\n\n const env = parsed.env \|\| read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n // entry (e.g. `hub.local`) expands to both its http and https origin.\n // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n // every entry being a full origin. Building a fresh array also keeps a\n // repeated normalizeConfig() on the same input from accumulating the\n // dev origin into a security-sensitive allowlist.\n const trustedOrigins: string[] = [];\n for (const value of parsed.trustedOrigins ?? []) {\n for (const origin of expandToOrigins(value)) {\n if (!trustedOrigins.includes(origin)) {\n trustedOrigins.push(origin);\n }\n }\n }\n\n // In non-production (development & test) client-web runs on :3000 while\n // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n // so the redirect allowlist (<origin>/*) and CORS accept logins from the\n // dev UI out of the box; otherwise the realm-selection login is dead on\n // first run.\n if (env !== EnvironmentName.PRODUCTION) {\n const devOrigin = 'http://localhost:3000';\n if (!trustedOrigins.includes(devOrigin)) {\n trustedOrigins.push(devOrigin);\n }\n }\n\n const config : Config = {\n env,\n rootPath: process.cwd(),\n writableDirectoryPath,\n\n logger: true,\n redis: false,\n smtp: false,\n\n port,\n host,\n publicUrl,\n mtlsPublicUrl: null,\n certificateSource: 'disabled',\n trustProxy: true,\n\n middlewareBody: true,\n middlewareCookie: true,\n middlewareCors: true,\n middlewarePrometheus: true,\n middlewareQuery: true,\n middlewareRateLimit: true,\n middlewareSwagger: true,\n tokenRefreshMaxAge: 259_200,\n tokenAccessMaxAge: 900,\n tokenRefreshGracePeriod: 0,\n promptLoginMaxAge: 60,\n endSessionHintGracePeriod: 0,\n registrationEnabled: false,\n emailVerificationEnabled: false,\n passwordRecoveryEnabled: false,\n passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n eventLogEnabled: true,\n eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n eventLogEntityEnabled: true,\n eventLogEntityRetentionDays: 7,\n loginAttemptThrottleEnabled: false,\n loginAttemptThreshold: 5,\n loginAttemptWindow: 900,\n\n secretsEncryptionKey: '',\n\n mfaEnabled: false,\n mfaRequired: false,\n mfaFreshnessMaxAge: 60,\n mfaTicketMaxAge: 600,\n\n clientAuthBasic: false,\n clientSystemEnabled: false,\n clientSystemSecret: 'start123',\n clientSystemSecretReset: false,\n\n userAuthBasic: false,\n userAdminEnabled: true,\n userAdminPassword: 'start123',\n userAdminPasswordReset: false,\n\n permissions: [],\n permissionsDefaultPolicyAssignment: true,\n ...parsed,\n\n // After the spread so the canonicalized + dev-seeded list wins over\n // the raw parsed list (parsed.trustedOrigins is merged in above).\n trustedOrigins,\n };\n\n // Canonicalize the string form on EVERY config surface (env, .conf,\n // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n if (typeof config.trustProxy === 'string') {\n config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n } else if (Array.isArray(config.trustProxy)) {\n config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n }\n\n // fail loud at boot: the throttle counts loginFailed rows in\n // auth_events — with the audit log disabled it would silently no-op.\n if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n }\n\n if (config.mfaRequired && !config.mfaEnabled) {\n throw new AuthupError('mfaRequired requires mfaEnabled.');\n }\n\n if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n }\n\n // fail loud at boot rather than at first key-store access: wrapped key\n // material must never be minted under a malformed KEK. Validate the\n // DECODED length here (not just base64 shape) so a whitespace / invalid /\n // wrong-length key fails at config time, not asynchronously inside the\n // cipher at first wrap/unwrap.\n if (config.secretsEncryptionKey) {\n let byteLength = -1;\n try {\n byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n } catch {\n // fall through — treated as invalid below\n }\n if (byteLength !== 32) {\n throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n }\n }\n\n return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBrD;EAEnBsD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/D;EAIHW;CACJ;CAMA,IAAI,OAAOO,OAAOO,eAAe,UAC7BP,OAAOO,aAAa7B,uBAAuBsB,OAAOO,UAAU;MACzD,IAAIuC,MAAMC,QAAQ/C,OAAOO,UAAU,GACtCP,OAAOO,aAAaP,OAAOO,WAAWyC,IAAIrE,+BAAAA;CAK9C,IAAIqB,OAAO4B,+BAA+B,CAAC5B,OAAOwB,iBAC9C,MAAM,IAAIrD,YAAY,uDAAA;CAG1B,IAAI6B,OAAOiC,eAAe,CAACjC,OAAOgC,YAC9B,MAAM,IAAI7D,YAAY,kCAAA;CAG1B,IAAI6B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAInC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAO+B,sBAAsB;EAC7B,IAAIkB,aAAa;EACjB,IAAI;GACAA,aAAa5E,oBAAoB2B,OAAO+B,qBAAqBmB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAI9E,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}
1	+ {"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","resolve","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/\n Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n const parsed = await parseConfig(input);\n\n const writableDirectoryPath = parsed.writableDirectoryPath \|\|\n path.join(process.cwd(), 'writable');\n\n const port = parsed.port ?? 3001;\n let host = parsed.host \|\| '0.0.0.0';\n\n let publicUrl : string;\n if (parsed.publicUrl) {\n publicUrl = parsed.publicUrl;\n } else {\n const regex = /^([^:]+)(?::(\\d+))?$/;\n const match = host.match(regex);\n if (match) {\n [, host] = match;\n publicUrl = `http://${toPublicHost(host)}:${match[2] \|\| port}`;\n } else {\n publicUrl = `http://${toPublicHost(host)}:${port}`;\n }\n }\n\n const env = parsed.env \|\| read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n // entry (e.g. `hub.local`) expands to both its http and https origin.\n // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n // every entry being a full origin. Building a fresh array also keeps a\n // repeated normalizeConfig() on the same input from accumulating the\n // dev origin into a security-sensitive allowlist.\n const trustedOrigins: string[] = [];\n for (const value of parsed.trustedOrigins ?? []) {\n for (const origin of expandToOrigins(value)) {\n if (!trustedOrigins.includes(origin)) {\n trustedOrigins.push(origin);\n }\n }\n }\n\n // In non-production (development & test) client-admin-console runs on :3000 while\n // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n // so the redirect allowlist (<origin>/*) and CORS accept logins from the\n // dev UI out of the box; otherwise the realm-selection login is dead on\n // first run.\n if (env !== EnvironmentName.PRODUCTION) {\n const devOrigin = 'http://localhost:3000';\n if (!trustedOrigins.includes(devOrigin)) {\n trustedOrigins.push(devOrigin);\n }\n }\n\n const config : Config = {\n env,\n rootPath: process.cwd(),\n writableDirectoryPath,\n // '' = theming disabled. Deliberately NOT defaulted under\n // writableDirectoryPath: that directory is process-writable, and\n // pairing \"process-writable\" with \"content injected into the login\n // page\" would turn any write primitive landing there into\n // persistent branding control on the IdP origin.\n themeDirectoryPath: '',\n themeFragmentsEnabled: false,\n authConsolePath: '',\n accountConsolePath: '',\n\n logger: true,\n redis: false,\n smtp: false,\n\n port,\n host,\n publicUrl,\n mtlsPublicUrl: null,\n certificateSource: 'disabled',\n trustProxy: true,\n\n middlewareBody: true,\n middlewareCookie: true,\n middlewareCors: true,\n middlewarePrometheus: true,\n middlewareQuery: true,\n middlewareRateLimit: true,\n middlewareSwagger: true,\n tokenRefreshMaxAge: 259_200,\n tokenAccessMaxAge: 900,\n tokenRefreshGracePeriod: 0,\n promptLoginMaxAge: 60,\n endSessionHintGracePeriod: 0,\n registrationEnabled: false,\n emailVerificationEnabled: false,\n passwordRecoveryEnabled: false,\n passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n accountConsoleEnabled: true,\n\n eventLogEnabled: true,\n eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n eventLogEntityEnabled: true,\n eventLogEntityRetentionDays: 7,\n loginAttemptThrottleEnabled: false,\n loginAttemptThreshold: 5,\n loginAttemptWindow: 900,\n\n secretsEncryptionKey: '',\n\n mfaEnabled: false,\n mfaRequired: false,\n mfaFreshnessMaxAge: 60,\n mfaTicketMaxAge: 600,\n\n clientAuthBasic: false,\n clientSystemEnabled: false,\n clientSystemSecret: 'start123',\n clientSystemSecretReset: false,\n\n userAuthBasic: false,\n userAdminEnabled: true,\n userAdminPassword: 'start123',\n userAdminPasswordReset: false,\n\n permissions: [],\n permissionsDefaultPolicyAssignment: true,\n ...parsed,\n\n // After the spread so the canonicalized + dev-seeded list wins over\n // the raw parsed list (parsed.trustedOrigins is merged in above).\n trustedOrigins,\n };\n\n // After the spread, so a relative value supplied by any config surface\n // is resolved. Every consumer then receives an absolute path and none\n // of them has to care what the process cwd was.\n if (config.themeDirectoryPath) {\n config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);\n }\n\n if (config.authConsolePath) {\n config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);\n }\n\n if (config.accountConsolePath) {\n config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);\n }\n\n // Canonicalize the string form on EVERY config surface (env, .conf,\n // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n if (typeof config.trustProxy === 'string') {\n config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n } else if (Array.isArray(config.trustProxy)) {\n config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n }\n\n // fail loud at boot: the throttle counts loginFailed rows in\n // auth_events — with the audit log disabled it would silently no-op.\n if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n }\n\n if (config.mfaRequired && !config.mfaEnabled) {\n throw new AuthupError('mfaRequired requires mfaEnabled.');\n }\n\n if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n }\n\n // fail loud at boot rather than at first key-store access: wrapped key\n // material must never be minted under a malformed KEK. Validate the\n // DECODED length here (not just base64 shape) so a whitespace / invalid /\n // wrong-length key fails at config time, not asynchronously inside the\n // cipher at first wrap/unwrap.\n if (config.secretsEncryptionKey) {\n let byteLength = -1;\n try {\n byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n } catch {\n // fall through — treated as invalid below\n }\n if (byteLength !== 32) {\n throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n }\n }\n\n return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAMAmB,oBAAoB;EACpBC,uBAAuB;EACvBC,iBAAiB;EACjBC,oBAAoB;EAEpBC,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENtB;EACAC;EACAC;EACAqB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBzD;EACnB0D,uBAAuB;EAEvBC,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGpE;EAIHW;CACJ;CAKA,IAAIO,OAAOE,oBACPF,OAAOE,qBAAqBlC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOE,kBAAkB;CAGvF,IAAIF,OAAOI,iBACPJ,OAAOI,kBAAkBpC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOI,eAAe;CAGjF,IAAIJ,OAAOK,oBACPL,OAAOK,qBAAqBrC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOK,kBAAkB;CAOvF,IAAI,OAAOL,OAAOW,eAAe,UAC7BX,OAAOW,aAAajC,uBAAuBsB,OAAOW,UAAU;MACzD,IAAIyC,MAAMC,QAAQrD,OAAOW,UAAU,GACtCX,OAAOW,aAAaX,OAAOW,WAAW2C,IAAI3E,+BAAAA;CAK9C,IAAIqB,OAAOiC,+BAA+B,CAACjC,OAAO6B,iBAC9C,MAAM,IAAI1D,YAAY,uDAAA;CAG1B,IAAI6B,OAAOsC,eAAe,CAACtC,OAAOqC,YAC9B,MAAM,IAAIlE,YAAY,kCAAA;CAG1B,IAAI6B,OAAOS,iBAAiBT,OAAOU,sBAAsB,YACrD,MAAM,IAAIvC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAOoC,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAalF,oBAAoB2B,OAAOoC,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAIpF,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}

package/dist/app/modules/config/origins.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"~~AAQA~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,~~CAcvD~~;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}
1	+ {"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}

package/dist/app/modules/config/origins.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { patternHasGlobstarInAuthority } from "@authup/kit";
 import { URL } from "node:url";
 //#region src/app/modules/config/origins.ts
 const SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\/\//i;
@@ -19,6 +20,7 @@ const ALLOWED_PROTOCOLS = ["http:", "https:"];
 *
 * Throws on values that don't parse as a URL/host or use another scheme.
 */ function expandToOrigins(value) {
+	if (patternHasGlobstarInAuthority(value)) throw new Error(`A trusted origin must not use ** in the host, it would match every origin. Use a single * for a host wildcard, got: ${value}`);
 	if (SCHEME_REGEX.test(value)) {
 		const url = new URL(value);
 		if (!ALLOWED_PROTOCOLS.includes(url.protocol)) throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);

package/dist/app/modules/config/origins.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"origins.mjs","names":["URL","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","test","url","includes","protocol","~~Error","~~origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { URL } from 'node:url';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/*\n Expand a configured trusted-origin value to its canonical origin(s).\n \n A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n \n Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n \n Throws on values that don't parse as a URL/host or use another scheme.\n /\nexport function expandToOrigins(value: string): string[] {\n if (SCHEME_REGEX.test(value)) {\n const url = new URL(value);\n if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n }\n\n return [url.origin];\n }\n\n return [\n new URL(`http://${value}`).origin,\n new URL(`https://${value}`).origin,\n ];\n}\n\n/\n Derive the set of trusted application origins (scheme://host[:port]).\n \n publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' \| 'trustedOrigins'>): string[] {\n const origins = new Set<string>();\n origins.add(new URL(config.publicUrl).origin);\n\n for (const origin of config.trustedOrigins ?? []) {\n origins.add(origin);\n }\n\n return Array.from(origins);\n}\n"],"mappings":"~~;;;;;AAUA~~,~~MAAMC~~,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAS;;;;;;;;;;;;;;GAgB7C,SAAgBC,gBAAgBC,OAAa;~~CACzC~~,IAAIH,~~aAAaI~~,~~KAAKD~~,KAAAA,GAAQ;EAC1B,~~MAAME~~,MAAM,~~IAAIN~~,~~IAAII~~,KAAAA;EACpB,IAAI,CAACF,~~kBAAkBK~~,SAASD,IAAIE,QAAQ,GACxC,MAAM,~~IAAIC~~,MAAM,~~8DAA8DH~~,IAAIE,UAAU;EAGhG,OAAO,CAACF,~~IAAII~~,MAAO;CACvB;CAEA,OAAO,CACH,~~IAAIV~~,IAAI,~~UAAUI~~,OAAO,CAAA,CAAEM,QAC3B,~~IAAIV~~,IAAI,~~WAAWI~~,OAAO,CAAA,CAAEM,MAC/B;AACL;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,~~IAAIf~~,~~IAAIY~~,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}
1	+ {"version":3,"file":"origins.mjs","names":["URL","patternHasGlobstarInAuthority","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","Error","test","url","includes","protocol","origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { URL } from 'node:url';\nimport { patternHasGlobstarInAuthority } from '@authup/kit';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/*\n Expand a configured trusted-origin value to its canonical origin(s).\n \n A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n \n Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n \n Throws on values that don't parse as a URL/host or use another scheme.\n /\nexport function expandToOrigins(value: string): string[] {\n // `new URL()` accepts `` and `` as a hostname, and every trusted origin\n // becomes an `<origin>/` redirect pattern for the system clients. A `*`\n // there matches the rest of the value outright, so a single typo would\n // turn the redirect allowlist of every realm's console clients into\n // allow-any-origin. A single `` is a supported host wildcard.\n if (patternHasGlobstarInAuthority(value)) {\n throw new Error(`A trusted origin must not use ** in the host, it would match every origin. Use a single * for a host wildcard, got: ${value}`);\n }\n\n if (SCHEME_REGEX.test(value)) {\n const url = new URL(value);\n if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n }\n\n return [url.origin];\n }\n\n return [\n new URL(`http://${value}`).origin,\n new URL(`https://${value}`).origin,\n ];\n}\n\n/*\n Derive the set of trusted application origins (scheme://host[:port]).\n \n publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' \| 'trustedOrigins'>): string[] {\n const origins = new Set<string>();\n origins.add(new URL(config.publicUrl).origin);\n\n for (const origin of config.trustedOrigins ?? []) {\n origins.add(origin);\n }\n\n return Array.from(origins);\n}\n"],"mappings":";;;;;;AAWA,MAAME,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAS;;;;;;;;;;;;;;GAgB7C,SAAgBC,gBAAgBC,OAAa;CAMzC,IAAIJ,8BAA8BI,KAAAA,GAC9B,MAAM,IAAIC,MAAM,uHAAuHD,OAAO;CAGlJ,IAAIH,aAAaK,KAAKF,KAAAA,GAAQ;EAC1B,MAAMG,MAAM,IAAIR,IAAIK,KAAAA;EACpB,IAAI,CAACF,kBAAkBM,SAASD,IAAIE,QAAQ,GACxC,MAAM,IAAIJ,MAAM,8DAA8DE,IAAIE,UAAU;EAGhG,OAAO,CAACF,IAAIG,MAAO;CACvB;CAEA,OAAO,CACH,IAAIX,IAAI,UAAUK,OAAO,CAAA,CAAEM,QAC3B,IAAIX,IAAI,WAAWK,OAAO,CAAA,CAAEM,MAC/B;AACL;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIhB,IAAIa,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}

package/dist/app/modules/config/read/env.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,~~CAmPnD~~"}
1	+ {"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CA4QnD"}

package/dist/app/modules/config/read/env.mjs CHANGED Viewed

@@ -40,6 +40,14 @@ function readConfigRawFromEnv() {
 	if (env) options.env = env;
 	const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);
 	if (writableDirectoryPath) options.writableDirectoryPath = writableDirectoryPath;
+	const themeDirectoryPath = read(ConfigEnvironmentVariableName.THEME_DIRECTORY_PATH);
+	if (themeDirectoryPath) options.themeDirectoryPath = themeDirectoryPath;
+	const themeFragmentsEnabled = readBool(ConfigEnvironmentVariableName.THEME_FRAGMENTS_ENABLED);
+	if (typeof themeFragmentsEnabled !== "undefined") options.themeFragmentsEnabled = themeFragmentsEnabled;
+	const authConsolePath = read(ConfigEnvironmentVariableName.AUTH_CONSOLE_PATH);
+	if (authConsolePath) options.authConsolePath = authConsolePath;
+	const accountConsolePath = read(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_PATH);
+	if (accountConsolePath) options.accountConsolePath = accountConsolePath;
 	if (hasEnvDataSourceOptions()) options.db = readDataSourceOptionsFromEnv();
 	const redis = oneOf([readBool(ConfigEnvironmentVariableName.REDIS), read(ConfigEnvironmentVariableName.REDIS)]);
 	if (typeof redis !== "undefined") options.redis = redis;
@@ -77,6 +85,8 @@ function readConfigRawFromEnv() {
 	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
 	const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);
 	if (typeof passwordMinLength !== "undefined") options.passwordMinLength = passwordMinLength;
+	const accountConsoleEnabled = readBool(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_ENABLED);
+	if (typeof accountConsoleEnabled !== "undefined") options.accountConsoleEnabled = accountConsoleEnabled;
 	const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);
 	if (typeof eventLogEnabled !== "undefined") options.eventLogEnabled = eventLogEnabled;
 	const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);

package/dist/app/modules/config/read/env.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/\n Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n oneOf,\n read,\n readArray,\n readBool,\n readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/\n Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean \| undefined {\n const raw = read(name);\n if (typeof raw !== 'string' \|\| raw.trim().length === 0) {\n return undefined;\n }\n\n const normalized = raw.trim().toLowerCase();\n if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n return true;\n }\n if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n return false;\n }\n\n throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n const options : ConfigInput = {};\n\n const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n if (env) {\n options.env = env;\n }\n\n const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n if (writableDirectoryPath) {\n options.writableDirectoryPath = writableDirectoryPath;\n }\n\n // -------------------------------------------------------------\n\n if (hasEnvDataSourceOptions()) {\n // todo: type casting should be avoided\n options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions \|\n PostgresDataSourceOptions \|\n BetterSqlite3DataSourceOptions;\n }\n\n const redis = oneOf([\n readBool(ConfigEnvironmentVariableName.REDIS),\n read(ConfigEnvironmentVariableName.REDIS),\n ]);\n if (typeof redis !== 'undefined') {\n options.redis = redis;\n }\n\n const smtp = oneOf([\n readBool(ConfigEnvironmentVariableName.SMTP),\n read(ConfigEnvironmentVariableName.SMTP),\n ]);\n if (typeof smtp !== 'undefined') {\n options.smtp = smtp;\n }\n\n // -------------------------------------------------------------\n\n const host = read(ConfigEnvironmentVariableName.HOST);\n if (host) {\n options.host = host;\n }\n\n const port = readInt(ConfigEnvironmentVariableName.PORT);\n if (typeof port !== 'undefined') {\n options.port = port;\n }\n\n const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n if (publicURL) {\n options.publicUrl = publicURL;\n }\n\n const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n if (mtlsPublicURL) {\n options.mtlsPublicUrl = mtlsPublicURL;\n }\n\n const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n if (certificateSource) {\n options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n }\n\n // canonicalized again in normalizeConfig for every config surface; the\n // env read keeps the raw string, the shared canonicalizer decides.\n const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n options.trustProxy = trustProxy;\n }\n\n const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n if (trustedOrigins && trustedOrigins.length > 0) {\n options.trustedOrigins = trustedOrigins;\n }\n\n const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n if (typeof tokenAccessMaxAge !== 'undefined') {\n options.tokenAccessMaxAge = tokenAccessMaxAge;\n }\n\n const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n if (typeof tokenRefreshMaxAge !== 'undefined') {\n options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n }\n\n const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n if (typeof tokenRefreshGracePeriod !== 'undefined') {\n options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n }\n\n const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n if (typeof promptLoginMaxAge !== 'undefined') {\n options.promptLoginMaxAge = promptLoginMaxAge;\n }\n\n const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n if (typeof endSessionHintGracePeriod !== 'undefined') {\n options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n }\n\n const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n if (typeof registrationEnabled !== 'undefined') {\n options.registrationEnabled = registrationEnabled;\n }\n\n const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n if (typeof emailVerificationEnabled !== 'undefined') {\n options.emailVerificationEnabled = emailVerificationEnabled;\n }\n\n const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n if (typeof passwordRecoveryEnabled !== 'undefined') {\n options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n }\n\n const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n if (typeof passwordMinLength !== 'undefined') {\n options.passwordMinLength = passwordMinLength;\n }\n\n // ---------------------------------------------------------------\n\n const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n if (typeof eventLogEnabled !== 'undefined') {\n options.eventLogEnabled = eventLogEnabled;\n }\n\n const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n if (typeof eventLogRetentionDays !== 'undefined') {\n options.eventLogRetentionDays = eventLogRetentionDays;\n }\n\n const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n if (typeof eventLogEntityEnabled !== 'undefined') {\n options.eventLogEntityEnabled = eventLogEntityEnabled;\n }\n\n const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n if (typeof eventLogEntityRetentionDays !== 'undefined') {\n options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n }\n\n const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n }\n\n const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n if (typeof loginAttemptThreshold !== 'undefined') {\n options.loginAttemptThreshold = loginAttemptThreshold;\n }\n\n const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n if (typeof loginAttemptWindow !== 'undefined') {\n options.loginAttemptWindow = loginAttemptWindow;\n }\n\n // ---------------------------------------------------------------\n\n const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n if (typeof mfaEnabled !== 'undefined') {\n options.mfaEnabled = mfaEnabled;\n }\n\n const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n if (typeof mfaRequired !== 'undefined') {\n options.mfaRequired = mfaRequired;\n }\n\n const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n if (typeof mfaFreshnessMaxAge !== 'undefined') {\n options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n }\n\n const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n if (typeof mfaTicketMaxAge !== 'undefined') {\n options.mfaTicketMaxAge = mfaTicketMaxAge;\n }\n\n const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n if (secretsEncryptionKey) {\n options.secretsEncryptionKey = secretsEncryptionKey;\n }\n\n // ---------------------------------------------------------------\n\n const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n if (typeof clientBasicAuth !== 'undefined') {\n options.clientAuthBasic = clientBasicAuth;\n }\n\n const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n if (typeof clientSystemEnabled !== 'undefined') {\n options.clientSystemEnabled = clientSystemEnabled;\n }\n\n const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n if (clientAdminSecret) {\n options.clientSystemSecret = clientAdminSecret;\n }\n\n const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n if (typeof clientAdminSecretReset !== 'undefined') {\n options.clientSystemSecretReset = clientAdminSecretReset;\n }\n\n // ---------------------------------------------------------------\n\n const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n if (typeof userBasicAuth !== 'undefined') {\n options.userAuthBasic = userBasicAuth;\n }\n\n const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n if (typeof userAdminEnabled !== 'undefined') {\n options.userAdminEnabled = userAdminEnabled;\n }\n\n const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n if (userAdminPassword) {\n options.userAdminPassword = userAdminPassword;\n }\n\n const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n if (typeof userAdminPasswordReset !== 'undefined') {\n options.userAdminPasswordReset = userAdminPasswordReset;\n }\n\n // ---------------------------------------------------------------\n\n const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n if (permissions && permissions.length > 0) {\n options.permissions = permissions;\n }\n\n const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n }\n\n return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAKhC,MAAME,aAAa3C,KAAKM,8BAA8BsC,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAW9B,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQsB,aAAaA;CAGzB,MAAME,iBAAiB5C,UAAUK,8BAA8BwC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe/B,SAAS,GAC1CO,QAAQwB,iBAAiBA;CAG7B,MAAME,oBAAoB5C,QAAQG,8BAA8B0C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B1B,QAAQ0B,oBAAoBA;CAGhC,MAAME,qBAAqB9C,QAAQG,8BAA8B4C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5B,QAAQ4B,qBAAqBA;CAGjC,MAAME,0BAA0BhD,QAAQG,8BAA8B8C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC9B,QAAQ8B,0BAA0BA;CAGtC,MAAME,oBAAoBlD,QAAQG,8BAA8BgD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BhC,QAAQgC,oBAAoBA;CAGhC,MAAME,4BAA4BpD,QAAQG,8BAA8BkD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrClC,QAAQkC,4BAA4BA;CAGxC,MAAME,sBAAsBvD,SAASI,8BAA8BoD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BpC,QAAQoC,sBAAsBA;CAGlC,MAAME,2BAA2BzD,SAASI,8BAA8BsD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCtC,QAAQsC,2BAA2BA;CAGvC,MAAME,0BAA0B3D,SAASI,8BAA8BwD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCxC,QAAQwC,0BAA0BA;CAGtC,MAAME,oBAAoB5D,QAAQG,8BAA8B0D,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7B1C,QAAQ0C,oBAAoBA;CAKhC,MAAME,kBAAkBvD,eAAeJ,8BAA8B4D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B5C,QAAQ4C,kBAAkBA;CAG9B,MAAME,wBAAwBhE,QAAQG,8BAA8B8D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,wBAAwB3D,eAAeJ,8BAA8BgE,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjChD,QAAQgD,wBAAwBA;CAGpC,MAAME,8BAA8BpE,QAAQG,8BAA8BkE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,8BAA8B/D,eAAeJ,8BAA8BoE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvCpD,QAAQoD,8BAA8BA;CAG1C,MAAME,wBAAwBxE,QAAQG,8BAA8BsE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCtD,QAAQsD,wBAAwBA;CAGpC,MAAME,qBAAqB1E,QAAQG,8BAA8BwE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BxD,QAAQwD,qBAAqBA;CAKjC,MAAME,aAAarE,eAAeJ,8BAA8B0E,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtB1D,QAAQ0D,aAAaA;CAGzB,MAAME,cAAcvE,eAAeJ,8BAA8B4E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB5D,QAAQ4D,cAAcA;CAG1B,MAAME,qBAAqBhF,QAAQG,8BAA8B8E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B9D,QAAQ8D,qBAAqBA;CAGjC,MAAME,kBAAkBlF,QAAQG,8BAA8BgF,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BhE,QAAQgE,kBAAkBA;CAG9B,MAAME,uBAAuBvF,KAAKM,8BAA8BkF,sBAAsB;CACtF,IAAID,sBACAlE,QAAQkE,uBAAuBA;CAKnC,MAAME,kBAAkBvF,SAASI,8BAA8BoF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BpE,QAAQsE,kBAAkBF;CAG9B,MAAMG,sBAAsB1F,SAASI,8BAA8BuF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BvE,QAAQuE,sBAAsBA;CAGlC,MAAME,oBAAoB9F,KAAKM,8BAA8ByF,oBAAoB;CACjF,IAAID,mBACAzE,QAAQ2E,qBAAqBF;CAGjC,MAAMG,yBAAyB/F,SAASI,8BAA8B4F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC5E,QAAQ8E,0BAA0BF;CAKtC,MAAMG,gBAAgBlG,SAASI,8BAA8B+F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB/E,QAAQiF,gBAAgBF;CAG5B,MAAMG,mBAAmBrG,SAASI,8BAA8BkG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BlF,QAAQkF,mBAAmBA;CAG/B,MAAME,oBAAoBzG,KAAKM,8BAA8BoG,mBAAmB;CAChF,IAAID,mBACApF,QAAQoF,oBAAoBA;CAGhC,MAAME,yBAAyBzG,SAASI,8BAA8BsG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQsF,yBAAyBA;CAKrC,MAAME,cAAc5G,UAAUK,8BAA8BwG,WAAW;CACvE,IAAID,eAAeA,YAAY/F,SAAS,GACpCO,QAAQwF,cAAcA;CAG1B,MAAME,qCAAqC7G,SAASI,8BAA8B0G,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C1F,QAAQ0F,qCAAqCA;CAGjD,OAAO1F;AACX"}
1	+ {"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","themeDirectoryPath","THEME_DIRECTORY_PATH","themeFragmentsEnabled","THEME_FRAGMENTS_ENABLED","authConsolePath","AUTH_CONSOLE_PATH","accountConsolePath","ACCOUNT_CONSOLE_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","accountConsoleEnabled","ACCOUNT_CONSOLE_ENABLED","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/\n Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n oneOf,\n read,\n readArray,\n readBool,\n readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/\n Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean \| undefined {\n const raw = read(name);\n if (typeof raw !== 'string' \|\| raw.trim().length === 0) {\n return undefined;\n }\n\n const normalized = raw.trim().toLowerCase();\n if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n return true;\n }\n if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n return false;\n }\n\n throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n const options : ConfigInput = {};\n\n const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n if (env) {\n options.env = env;\n }\n\n const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n if (writableDirectoryPath) {\n options.writableDirectoryPath = writableDirectoryPath;\n }\n\n const themeDirectoryPath = read(ConfigEnvironmentVariableName.THEME_DIRECTORY_PATH);\n if (themeDirectoryPath) {\n options.themeDirectoryPath = themeDirectoryPath;\n }\n\n const themeFragmentsEnabled = readBool(ConfigEnvironmentVariableName.THEME_FRAGMENTS_ENABLED);\n if (typeof themeFragmentsEnabled !== 'undefined') {\n options.themeFragmentsEnabled = themeFragmentsEnabled;\n }\n\n const authConsolePath = read(ConfigEnvironmentVariableName.AUTH_CONSOLE_PATH);\n if (authConsolePath) {\n options.authConsolePath = authConsolePath;\n }\n\n const accountConsolePath = read(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_PATH);\n if (accountConsolePath) {\n options.accountConsolePath = accountConsolePath;\n }\n\n // -------------------------------------------------------------\n\n if (hasEnvDataSourceOptions()) {\n // todo: type casting should be avoided\n options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions \|\n PostgresDataSourceOptions \|\n BetterSqlite3DataSourceOptions;\n }\n\n const redis = oneOf([\n readBool(ConfigEnvironmentVariableName.REDIS),\n read(ConfigEnvironmentVariableName.REDIS),\n ]);\n if (typeof redis !== 'undefined') {\n options.redis = redis;\n }\n\n const smtp = oneOf([\n readBool(ConfigEnvironmentVariableName.SMTP),\n read(ConfigEnvironmentVariableName.SMTP),\n ]);\n if (typeof smtp !== 'undefined') {\n options.smtp = smtp;\n }\n\n // -------------------------------------------------------------\n\n const host = read(ConfigEnvironmentVariableName.HOST);\n if (host) {\n options.host = host;\n }\n\n const port = readInt(ConfigEnvironmentVariableName.PORT);\n if (typeof port !== 'undefined') {\n options.port = port;\n }\n\n const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n if (publicURL) {\n options.publicUrl = publicURL;\n }\n\n const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n if (mtlsPublicURL) {\n options.mtlsPublicUrl = mtlsPublicURL;\n }\n\n const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n if (certificateSource) {\n options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n }\n\n // canonicalized again in normalizeConfig for every config surface; the\n // env read keeps the raw string, the shared canonicalizer decides.\n const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n options.trustProxy = trustProxy;\n }\n\n const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n if (trustedOrigins && trustedOrigins.length > 0) {\n options.trustedOrigins = trustedOrigins;\n }\n\n const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n if (typeof tokenAccessMaxAge !== 'undefined') {\n options.tokenAccessMaxAge = tokenAccessMaxAge;\n }\n\n const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n if (typeof tokenRefreshMaxAge !== 'undefined') {\n options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n }\n\n const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n if (typeof tokenRefreshGracePeriod !== 'undefined') {\n options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n }\n\n const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n if (typeof promptLoginMaxAge !== 'undefined') {\n options.promptLoginMaxAge = promptLoginMaxAge;\n }\n\n const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n if (typeof endSessionHintGracePeriod !== 'undefined') {\n options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n }\n\n const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n if (typeof registrationEnabled !== 'undefined') {\n options.registrationEnabled = registrationEnabled;\n }\n\n const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n if (typeof emailVerificationEnabled !== 'undefined') {\n options.emailVerificationEnabled = emailVerificationEnabled;\n }\n\n const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n if (typeof passwordRecoveryEnabled !== 'undefined') {\n options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n }\n\n const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n if (typeof passwordMinLength !== 'undefined') {\n options.passwordMinLength = passwordMinLength;\n }\n\n const accountConsoleEnabled = readBool(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_ENABLED);\n if (typeof accountConsoleEnabled !== 'undefined') {\n options.accountConsoleEnabled = accountConsoleEnabled;\n }\n\n // ---------------------------------------------------------------\n\n const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n if (typeof eventLogEnabled !== 'undefined') {\n options.eventLogEnabled = eventLogEnabled;\n }\n\n const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n if (typeof eventLogRetentionDays !== 'undefined') {\n options.eventLogRetentionDays = eventLogRetentionDays;\n }\n\n const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n if (typeof eventLogEntityEnabled !== 'undefined') {\n options.eventLogEntityEnabled = eventLogEntityEnabled;\n }\n\n const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n if (typeof eventLogEntityRetentionDays !== 'undefined') {\n options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n }\n\n const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n }\n\n const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n if (typeof loginAttemptThreshold !== 'undefined') {\n options.loginAttemptThreshold = loginAttemptThreshold;\n }\n\n const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n if (typeof loginAttemptWindow !== 'undefined') {\n options.loginAttemptWindow = loginAttemptWindow;\n }\n\n // ---------------------------------------------------------------\n\n const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n if (typeof mfaEnabled !== 'undefined') {\n options.mfaEnabled = mfaEnabled;\n }\n\n const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n if (typeof mfaRequired !== 'undefined') {\n options.mfaRequired = mfaRequired;\n }\n\n const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n if (typeof mfaFreshnessMaxAge !== 'undefined') {\n options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n }\n\n const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n if (typeof mfaTicketMaxAge !== 'undefined') {\n options.mfaTicketMaxAge = mfaTicketMaxAge;\n }\n\n const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n if (secretsEncryptionKey) {\n options.secretsEncryptionKey = secretsEncryptionKey;\n }\n\n // ---------------------------------------------------------------\n\n const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n if (typeof clientBasicAuth !== 'undefined') {\n options.clientAuthBasic = clientBasicAuth;\n }\n\n const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n if (typeof clientSystemEnabled !== 'undefined') {\n options.clientSystemEnabled = clientSystemEnabled;\n }\n\n const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n if (clientAdminSecret) {\n options.clientSystemSecret = clientAdminSecret;\n }\n\n const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n if (typeof clientAdminSecretReset !== 'undefined') {\n options.clientSystemSecretReset = clientAdminSecretReset;\n }\n\n // ---------------------------------------------------------------\n\n const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n if (typeof userBasicAuth !== 'undefined') {\n options.userAuthBasic = userBasicAuth;\n }\n\n const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n if (typeof userAdminEnabled !== 'undefined') {\n options.userAdminEnabled = userAdminEnabled;\n }\n\n const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n if (userAdminPassword) {\n options.userAdminPassword = userAdminPassword;\n }\n\n const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n if (typeof userAdminPasswordReset !== 'undefined') {\n options.userAdminPasswordReset = userAdminPasswordReset;\n }\n\n // ---------------------------------------------------------------\n\n const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n if (permissions && permissions.length > 0) {\n options.permissions = permissions;\n }\n\n const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n }\n\n return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAGpC,MAAME,qBAAqB1B,KAAKM,8BAA8BqB,oBAAoB;CAClF,IAAID,oBACAL,QAAQK,qBAAqBA;CAGjC,MAAME,wBAAwB1B,SAASI,8BAA8BuB,uBAAuB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCP,QAAQO,wBAAwBA;CAGpC,MAAME,kBAAkB9B,KAAKM,8BAA8ByB,iBAAiB;CAC5E,IAAID,iBACAT,QAAQS,kBAAkBA;CAG9B,MAAME,qBAAqBhC,KAAKM,8BAA8B2B,oBAAoB;CAClF,IAAID,oBACAX,QAAQW,qBAAqBA;CAKjC,IAAI5B,wBAAAA,GAEAiB,QAAQa,KAAK7B,6BAAAA;CAKjB,MAAM8B,QAAQpC,MAAM,CAChBG,SAASI,8BAA8B8B,KAAK,GAC5CpC,KAAKM,8BAA8B8B,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBd,QAAQc,QAAQA;CAGpB,MAAME,OAAOtC,MAAM,CACfG,SAASI,8BAA8BgC,IAAI,GAC3CtC,KAAKM,8BAA8BgC,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBhB,QAAQgB,OAAOA;CAKnB,MAAME,OAAOvC,KAAKM,8BAA8BkC,IAAI;CACpD,IAAID,MACAlB,QAAQkB,OAAOA;CAGnB,MAAME,OAAOtC,QAAQG,8BAA8BoC,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBpB,QAAQoB,OAAOA;CAGnB,MAAME,YAAY3C,KAAKM,8BAA8BsC,UAAU;CAC/D,IAAID,WACAtB,QAAQwB,YAAYF;CAGxB,MAAMG,gBAAgB9C,KAAKM,8BAA8ByC,eAAe;CACxE,IAAID,eACAzB,QAAQ2B,gBAAgBF;CAG5B,MAAMG,oBAAoBjD,KAAKM,8BAA8B4C,kBAAkB;CAC/E,IAAID,mBACA5B,QAAQ4B,oBAAoBA;CAKhC,MAAME,aAAanD,KAAKM,8BAA8B8C,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAWtC,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQ8B,aAAaA;CAGzB,MAAME,iBAAiBpD,UAAUK,8BAA8BgD,eAAe;CAC9E,IAAID,kBAAkBA,eAAevC,SAAS,GAC1CO,QAAQgC,iBAAiBA;CAG7B,MAAME,oBAAoBpD,QAAQG,8BAA8BkD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BlC,QAAQkC,oBAAoBA;CAGhC,MAAME,qBAAqBtD,QAAQG,8BAA8BoD,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BpC,QAAQoC,qBAAqBA;CAGjC,MAAME,0BAA0BxD,QAAQG,8BAA8BsD,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAGhC,MAAME,4BAA4B5D,QAAQG,8BAA8B0D,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrC1C,QAAQ0C,4BAA4BA;CAGxC,MAAME,sBAAsB/D,SAASI,8BAA8B4D,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/B5C,QAAQ4C,sBAAsBA;CAGlC,MAAME,2BAA2BjE,SAASI,8BAA8B8D,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC9C,QAAQ8C,2BAA2BA;CAGvC,MAAME,0BAA0BnE,SAASI,8BAA8BgE,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnChD,QAAQgD,0BAA0BA;CAGtC,MAAME,oBAAoBpE,QAAQG,8BAA8BkE,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BlD,QAAQkD,oBAAoBA;CAGhC,MAAME,wBAAwBvE,SAASI,8BAA8BoE,uBAAuB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAKpC,MAAME,kBAAkBjE,eAAeJ,8BAA8BsE,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3BtD,QAAQsD,kBAAkBA;CAG9B,MAAME,wBAAwB1E,QAAQG,8BAA8BwE,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCxD,QAAQwD,wBAAwBA;CAGpC,MAAME,wBAAwBrE,eAAeJ,8BAA8B0E,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC1D,QAAQ0D,wBAAwBA;CAGpC,MAAME,8BAA8B9E,QAAQG,8BAA8B4E,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvC5D,QAAQ4D,8BAA8BA;CAG1C,MAAME,8BAA8BzE,eAAeJ,8BAA8B8E,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvC9D,QAAQ8D,8BAA8BA;CAG1C,MAAME,wBAAwBlF,QAAQG,8BAA8BgF,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjChE,QAAQgE,wBAAwBA;CAGpC,MAAME,qBAAqBpF,QAAQG,8BAA8BkF,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BlE,QAAQkE,qBAAqBA;CAKjC,MAAME,aAAa/E,eAAeJ,8BAA8BoF,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBpE,QAAQoE,aAAaA;CAGzB,MAAME,cAAcjF,eAAeJ,8BAA8BsF,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvBtE,QAAQsE,cAAcA;CAG1B,MAAME,qBAAqB1F,QAAQG,8BAA8BwF,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BxE,QAAQwE,qBAAqBA;CAGjC,MAAME,kBAAkB5F,QAAQG,8BAA8B0F,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B1E,QAAQ0E,kBAAkBA;CAG9B,MAAME,uBAAuBjG,KAAKM,8BAA8B4F,sBAAsB;CACtF,IAAID,sBACA5E,QAAQ4E,uBAAuBA;CAKnC,MAAME,kBAAkBjG,SAASI,8BAA8B8F,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9E,QAAQgF,kBAAkBF;CAG9B,MAAMG,sBAAsBpG,SAASI,8BAA8BiG,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjF,QAAQiF,sBAAsBA;CAGlC,MAAME,oBAAoBxG,KAAKM,8BAA8BmG,oBAAoB;CACjF,IAAID,mBACAnF,QAAQqF,qBAAqBF;CAGjC,MAAMG,yBAAyBzG,SAASI,8BAA8BsG,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQwF,0BAA0BF;CAKtC,MAAMG,gBAAgB5G,SAASI,8BAA8ByG,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzF,QAAQ2F,gBAAgBF;CAG5B,MAAMG,mBAAmB/G,SAASI,8BAA8B4G,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5F,QAAQ4F,mBAAmBA;CAG/B,MAAME,oBAAoBnH,KAAKM,8BAA8B8G,mBAAmB;CAChF,IAAID,mBACA9F,QAAQ8F,oBAAoBA;CAGhC,MAAME,yBAAyBnH,SAASI,8BAA8BgH,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChG,QAAQgG,yBAAyBA;CAKrC,MAAME,cAActH,UAAUK,8BAA8BkH,WAAW;CACvE,IAAID,eAAeA,YAAYzG,SAAS,GACpCO,QAAQkG,cAAcA;CAG1B,MAAME,qCAAqCvH,SAASI,8BAA8BoH,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CpG,QAAQoG,qCAAqCA;CAGjD,OAAOpG;AACX"}

package/dist/app/modules/config/read/module.mjs CHANGED Viewed

@@ -7,10 +7,15 @@ import { merge } from "smob";
 //#region src/app/modules/config/read/module.ts
 async function readConfigRaw(options = {}) {
 	if (options.fs && options.env) {
-		const fs = await readConfigRawFromFS(boolableToObject(options.fs));
-		return merge(readConfigRawFromEnv(), fs);
+		const fsOptions = boolableToObject(options.fs);
+		const fs = await readConfigRawFromFS(fsOptions);
+		const env = readConfigRawFromEnv();
+		return merge(env, fs);
+	}
+	if (options.fs) {
+		const fsOptions = boolableToObject(options.fs);
+		return readConfigRawFromFS(fsOptions);
 	}
-	if (options.fs) return readConfigRawFromFS(boolableToObject(options.fs));
 	if (options.env) return readConfigRawFromEnv();
 	return {};
 }

package/dist/app/modules/config/read/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["merge","readConfigRawFromEnv","readConfigRawFromFS","readConfigRaw","options","fs","env","fsOptions","boolableToObject","input"],"sources":["../../../../../src/app/modules/config/read/module.ts"],"sourcesContent":["/\n Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport { readConfigRawFromEnv } from './env.ts';\nimport { readConfigRawFromFS } from './fs.ts';\nimport type { ConfigRawReadOptions } from './types.ts';\n\nexport async function readConfigRaw(options: ConfigRawReadOptions = {}) : Promise<ConfigInput> {\n if (options.fs && options.env) {\n const fsOptions = boolableToObject(options.fs);\n const fs = await readConfigRawFromFS(fsOptions);\n const env = readConfigRawFromEnv();\n\n return merge(env, fs);\n }\n\n if (options.fs) {\n const fsOptions = boolableToObject(options.fs);\n return readConfigRawFromFS(fsOptions);\n }\n\n if (options.env) {\n return readConfigRawFromEnv();\n }\n\n return {};\n}\n\nfunction boolableToObject<T>(input: T \| boolean) : T {\n if (typeof input === 'boolean') {\n return {} as T;\n }\n\n return input;\n}\n"],"mappings":";;;;;;;AAaA,eAAsBG,cAAcC,UAAgC,CAAC,GAAC;CAClE,IAAIA,QAAQC,MAAMD,QAAQE,KAAK;~~EAE3B~~,~~MAAMD~~,KAAK,MAAMH,~~oBADCM~~,~~iBAAiBJ~~,~~QAAQC~~,~~EACNE~~,~~CAAAA~~;~~EAGrC~~,~~OAAOP~~,~~MAFKC~~,~~qBAECK~~,~~GAAKD,~~EAAAA;CACtB;CAEA,IAAID,QAAQC,~~IAER~~,~~OAAOH~~,~~oBADWM~~,iBAAiBJ,QAAQC,~~EAChBE~~,~~CAAAA~~;~~CAG~~/B,IAAIH,QAAQE,KACR,OAAOL,qBAAAA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASO,iBAAoBC,OAAkB;CAC3C,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;CAGZ,OAAOA;AACX"}
1	+ {"version":3,"file":"module.mjs","names":["merge","readConfigRawFromEnv","readConfigRawFromFS","readConfigRaw","options","fs","env","fsOptions","boolableToObject","input"],"sources":["../../../../../src/app/modules/config/read/module.ts"],"sourcesContent":["/\n Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { merge } from 'smob';\nimport type { ConfigInput } from '../types.ts';\nimport { readConfigRawFromEnv } from './env.ts';\nimport { readConfigRawFromFS } from './fs.ts';\nimport type { ConfigRawReadOptions } from './types.ts';\n\nexport async function readConfigRaw(options: ConfigRawReadOptions = {}) : Promise<ConfigInput> {\n if (options.fs && options.env) {\n const fsOptions = boolableToObject(options.fs);\n const fs = await readConfigRawFromFS(fsOptions);\n const env = readConfigRawFromEnv();\n\n return merge(env, fs);\n }\n\n if (options.fs) {\n const fsOptions = boolableToObject(options.fs);\n return readConfigRawFromFS(fsOptions);\n }\n\n if (options.env) {\n return readConfigRawFromEnv();\n }\n\n return {};\n}\n\nfunction boolableToObject<T>(input: T \| boolean) : T {\n if (typeof input === 'boolean') {\n return {} as T;\n }\n\n return input;\n}\n"],"mappings":";;;;;;;AAaA,eAAsBG,cAAcC,UAAgC,CAAC,GAAC;CAClE,IAAIA,QAAQC,MAAMD,QAAQE,KAAK;EAC3B,MAAMC,YAAYC,iBAAiBJ,QAAQC,EAAE;EAC7C,MAAMA,KAAK,MAAMH,oBAAoBK,SAAAA;EACrC,MAAMD,MAAML,qBAAAA;EAEZ,OAAOD,MAAMM,KAAKD,EAAAA;CACtB;CAEA,IAAID,QAAQC,IAAI;EACZ,MAAME,YAAYC,iBAAiBJ,QAAQC,EAAE;EAC7C,OAAOH,oBAAoBK,SAAAA;CAC/B;CAEA,IAAIH,QAAQE,KACR,OAAOL,qBAAAA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASO,iBAAoBC,OAAkB;CAC3C,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;CAGZ,OAAOA;AACX"}

package/dist/app/modules/config/types.d.ts CHANGED Viewed

@@ -26,6 +26,59 @@ export type Config = {
      * default: writable
      */
     writableDirectoryPath: string;
+    /**
+     * EXPERIMENTAL. May change in a minor release: per-realm themes are
+     * likely to reshape the directory into `<root>/<theme name>/`. The
+     * manifest's `version` field makes a breaking change detectable.
+     *
+     * Directory holding the operator theme applied to the served consoles
+     * (the auth console and the account console). Relative paths resolve
+     * against the rootPath.
+     *
+     * The directory is operator trust, exactly like the config file: its
+     * `assets/` sub-directory is served verbatim at `/theme`, and its
+     * `theme.json` injects CSS custom properties into both consoles.
+     * Mount it read-only and never from a source a tenant can write.
+     *
+     * default: '' (theming disabled)
+     */
+    themeDirectoryPath: string;
+    /**
+     * EXPERIMENTAL, alongside themeDirectoryPath.
+     *
+     * Opt in to reading `fragments/head.html` from the theme directory and
+     * splicing it into the `<head>` of both served consoles.
+     *
+     * The fragment is raw, unsanitized markup running on the IdP origin,
+     * so it must be a deliberate operator decision and never a consequence
+     * of a file appearing in the mounted directory.
+     *
+     * default: false
+     */
+    themeFragmentsEnabled: boolean;
+    /**
+     * EXPERIMENTAL. The render contract it verifies is itself versioned
+     * (CONTRACT_VERSION), but this key and the boot-time assert may change.
+     *
+     * Package directory of a substituted `@authup/client-auth-console`
+     * (the directory holding its package.json and dist/). Consulted before
+     * the node_modules resolution walk.
+     *
+     * This replaces the login/consent IMPLEMENTATION, not its styling: the
+     * substituted package owns the prompt ladder, PKCE and state handling,
+     * MFA ordering and redirect gating. Use the theme directory for
+     * branding.
+     *
+     * default: '' (resolve @authup/client-auth-console from node_modules)
+     */
+    authConsolePath: string;
+    /**
+     * Package directory of a substituted
+     * `@authup/client-account-console`. Same contract as authConsolePath.
+     *
+     * default: '' (resolve @authup/client-account-console from node_modules)
+     */
+    accountConsolePath: string;
     /**
      * default: true
      */
@@ -91,7 +144,7 @@ export type Config = {
     trustProxy: boolean | number | string | string[];
     /**
      * Trusted first-party app origins (besides publicUrl) — used as
-     * redirect targets for the per-realm public `web` client. Does NOT
+     * redirect targets for the per-realm public system clients. Does NOT
      * drive CORS (the API reflects any origin by default; an explicit
      * CORS allowlist goes through middlewareCors), and does not affect
      * UIs using their own registered OAuth2 client. Input entries may be
@@ -99,10 +152,10 @@ export type Config = {
      * rejected) or bare hosts (host[:port]) — a bare host expands to
      * both its http and https origin during normalization, so the
      * normalized config always holds full origins (scheme://host[:port],
-     * no path); each is stored as `<origin>/**` in the web client's
+     * no path); each is stored as `<origin>/**` in the system clients'
      * redirect_uri set.
      *
-     * SECURITY: the `web` client is built_in (auto-consent + `global`
+     * SECURITY: the system clients are built_in (auto-consent + `global`
      * scope), so any origin listed here can obtain a full-permission user
      * token once a user logs in. Adding an origin grants it full login
      * capability for every realm.
@@ -200,6 +253,13 @@ export type Config = {
      * default: 10
      */
     passwordMinLength: number;
+    /**
+     * Serve the account self-service surface (`/account`: profile, password,
+     * authenticators, sessions, applications). Operators with their own
+     * self-service portal can disable authup's.
+     * default: true
+     */
+    accountConsoleEnabled: boolean;
     /**
      * Persist security audit events (login, authorize, replay detection, ...)
      * to the auth_events table. When disabled only the structured log line

package/dist/app/modules/config/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;~~IAI9B~~;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;~~IAI1B~~;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;OAWG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;~~CAyHhC~~"}
1	+ {"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CA8HhC"}

package/dist/app/modules/config/validator.mjs CHANGED Viewed

@@ -24,6 +24,10 @@ var ConfigValidator = class extends Container {
 			env: stringValidator,
 			rootPath: stringValidator,
 			writableDirectoryPath: stringValidator,
+			themeDirectoryPath: stringValidator,
+			themeFragmentsEnabled: booleanValidator,
+			authConsolePath: stringValidator,
+			accountConsolePath: stringValidator,
 			logger: booleanValidator,
 			db: createValidator(z.custom((value) => isObject(value))),
 			redis: serviceValidator,
@@ -63,6 +67,7 @@ var ConfigValidator = class extends Container {
 			emailVerificationEnabled: booleanValidator,
 			passwordRecoveryEnabled: booleanValidator,
 			passwordMinLength: createValidator(z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH)),
+			accountConsoleEnabled: booleanValidator,
 			eventLogEnabled: booleanValidator,
 			eventLogRetentionDays: nonNegativeNumberValidator,
 			eventLogEntityEnabled: booleanValidator,

package/dist/app/modules/config/validator.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n protected override initialize() {\n super.initialize();\n\n const stringValidator = createValidator(z.string());\n const booleanValidator = createValidator(z.boolean());\n const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n const secretValidator = createValidator(z.string().min(3).max(256));\n const middlewareValidator = createValidator(\n z.boolean().or(z.record(z.string(), z.any())),\n );\n const serviceValidator = createValidator(\n z.string()\n .or(z.boolean())\n .or(z.custom<Record<string, any>>((value) => isObject(value))),\n );\n\n // Record<keyof Config, ...> is the compile-time exhaustiveness\n // guard: a Config key without a validator here fails the build\n // instead of being silently stripped by run().\n const validators: Record<keyof Config, ValidatorDescriptor> = {\n env: stringValidator,\n rootPath: stringValidator,\n writableDirectoryPath: stringValidator,\n\n logger: booleanValidator,\n db: createValidator(\n z.custom<MysqlDataSourceOptions \| PostgresDataSourceOptions \| BetterSqlite3DataSourceOptions>(\n (value) => isObject(value),\n ),\n ),\n redis: serviceValidator,\n smtp: serviceValidator,\n\n port: nonNegativeNumberValidator,\n host: stringValidator,\n publicUrl: createValidator(z.url()),\n mtlsPublicUrl: createValidator(z.url().nullable()),\n certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n trustProxy: createValidator(z.union([\n z.boolean(),\n z.number().int().nonnegative(),\n // scalar strings are canonicalized in normalizeConfig\n // (integer/boolean words → their semantic type)\n z.string(),\n // the explicit allowlist form: an integer-string or boolean\n // word entry is a mis-typed scalar and must fail loud —\n // proxy-addr would silently compile '1' to 0.0.0.1\n z.array(z.string().refine(\n isValidTrustProxyListEntry,\n 'must be an IP, CIDR, or proxy-addr preset',\n )),\n ])),\n trustedOrigins: createValidator(\n z.array(z.string().refine((value) => {\n try {\n expandToOrigins(value);\n return true;\n } catch {\n return false;\n }\n }, 'must be a http(s) origin or a bare host[:port]')),\n ),\n\n middlewareBody: middlewareValidator,\n middlewareCors: middlewareValidator,\n middlewareCookie: middlewareValidator,\n middlewareQuery: middlewareValidator,\n middlewarePrometheus: middlewareValidator,\n middlewareRateLimit: middlewareValidator,\n middlewareSwagger: booleanValidator,\n\n tokenAccessMaxAge: nonNegativeNumberValidator,\n tokenRefreshMaxAge: nonNegativeNumberValidator,\n tokenRefreshGracePeriod: nonNegativeNumberValidator,\n promptLoginMaxAge: nonNegativeNumberValidator,\n endSessionHintGracePeriod: nonNegativeNumberValidator,\n registrationEnabled: booleanValidator,\n emailVerificationEnabled: booleanValidator,\n passwordRecoveryEnabled: booleanValidator,\n passwordMinLength: createValidator(\n z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n ),\n\n eventLogEnabled: booleanValidator,\n eventLogRetentionDays: nonNegativeNumberValidator,\n eventLogEntityEnabled: booleanValidator,\n eventLogEntityRetentionDays: nonNegativeNumberValidator,\n loginAttemptThrottleEnabled: booleanValidator,\n loginAttemptThreshold: createValidator(z.number().int().positive()),\n loginAttemptWindow: createValidator(z.number().int().positive()),\n\n // '' = unset; otherwise a base64 string (normalizeConfig enforces\n // the decoded 32-byte length at boot).\n secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n mfaEnabled: booleanValidator,\n mfaRequired: booleanValidator,\n mfaFreshnessMaxAge: nonNegativeNumberValidator,\n mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n clientAuthBasic: booleanValidator,\n clientSystemEnabled: booleanValidator,\n clientSystemSecret: secretValidator,\n clientSystemSecretReset: booleanValidator,\n\n userAuthBasic: booleanValidator,\n userAdminEnabled: booleanValidator,\n userAdminPassword: secretValidator,\n userAdminPasswordReset: booleanValidator,\n\n permissions: createValidator(\n z.string().or(z.array(z.string())),\n ),\n permissionsDefaultPolicyAssignment: booleanValidator,\n };\n\n const keys = Object.keys(validators) as (keyof Config)[];\n for (const key of keys) {\n this.mount(key, { optional: true }, validators[key]);\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI9B,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWnC,gBAAgBE,EAAEkC,IAAG,CAAA;GAChCC,eAAerC,gBAAgBE,EAAEkC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBvC,gBAAgBE,EAAEsC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,YAAYzC,gBAAgBE,EAAEwC,MAAM;IAChCxC,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAG7B,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,OACfzC,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD0C,gBAAgB9C,gBACZE,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,QAAQrB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPuB,gBAAgB7B;GAChB8B,gBAAgB9B;GAChB+B,kBAAkB/B;GAClBgC,iBAAiBhC;GACjBiC,sBAAsBjC;GACtBkC,qBAAqBlC;GACrBmC,mBAAmB3C;GAEnB4C,mBAAmB1C;GACnB2C,oBAAoB3C;GACpB4C,yBAAyB5C;GACzB6C,mBAAmB7C;GACnB8C,2BAA2B9C;GAC3B+C,qBAAqBjD;GACrBkD,0BAA0BlD;GAC1BmD,yBAAyBnD;GACzBoD,mBAAmB9D,gBACfE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAG9C,IAAInB,wBAAAA,CAAAA;GAGpCkE,iBAAiBtD;GACjBuD,uBAAuBrD;GACvBsD,uBAAuBxD;GACvByD,6BAA6BvD;GAC7BwD,6BAA6B1D;GAC7B2D,uBAAuBrE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEO,oBAAoBtE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DQ,sBAAsBvE,gBAAgBE,EAAEwC,MAAM,CAACxC,EAAEsE,QAAQ,EAAA,GAAKtE,EAAEuE,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYhE;GACZiE,aAAajE;GACbkE,oBAAoBhE;GACpBiE,iBAAiB7E,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1De,iBAAiBpE;GACjBqE,qBAAqBrE;GACrBsE,oBAAoBjE;GACpBkE,yBAAyBvE;GAEzBwE,eAAexE;GACfyE,kBAAkBzE;GAClB0E,mBAAmBrE;GACnBsE,wBAAwB3E;GAExB4E,aAAatF,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElC8E,oCAAoC7E;EACxC;EAEA,MAAM8E,OAAOC,OAAOD,KAAK/D,UAAAA;EACzB,KAAK,MAAMiE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGnE,WAAWiE,IAAI;CAE3D;AACJ"}
1	+ {"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n protected override initialize() {\n super.initialize();\n\n const stringValidator = createValidator(z.string());\n const booleanValidator = createValidator(z.boolean());\n const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n const secretValidator = createValidator(z.string().min(3).max(256));\n const middlewareValidator = createValidator(\n z.boolean().or(z.record(z.string(), z.any())),\n );\n const serviceValidator = createValidator(\n z.string()\n .or(z.boolean())\n .or(z.custom<Record<string, any>>((value) => isObject(value))),\n );\n\n // Record<keyof Config, ...> is the compile-time exhaustiveness\n // guard: a Config key without a validator here fails the build\n // instead of being silently stripped by run().\n const validators: Record<keyof Config, ValidatorDescriptor> = {\n env: stringValidator,\n rootPath: stringValidator,\n writableDirectoryPath: stringValidator,\n themeDirectoryPath: stringValidator,\n themeFragmentsEnabled: booleanValidator,\n authConsolePath: stringValidator,\n accountConsolePath: stringValidator,\n\n logger: booleanValidator,\n db: createValidator(\n z.custom<MysqlDataSourceOptions \| PostgresDataSourceOptions \| BetterSqlite3DataSourceOptions>(\n (value) => isObject(value),\n ),\n ),\n redis: serviceValidator,\n smtp: serviceValidator,\n\n port: nonNegativeNumberValidator,\n host: stringValidator,\n publicUrl: createValidator(z.url()),\n mtlsPublicUrl: createValidator(z.url().nullable()),\n certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n trustProxy: createValidator(z.union([\n z.boolean(),\n z.number().int().nonnegative(),\n // scalar strings are canonicalized in normalizeConfig\n // (integer/boolean words → their semantic type)\n z.string(),\n // the explicit allowlist form: an integer-string or boolean\n // word entry is a mis-typed scalar and must fail loud —\n // proxy-addr would silently compile '1' to 0.0.0.1\n z.array(z.string().refine(\n isValidTrustProxyListEntry,\n 'must be an IP, CIDR, or proxy-addr preset',\n )),\n ])),\n trustedOrigins: createValidator(\n z.array(z.string().refine((value) => {\n try {\n expandToOrigins(value);\n return true;\n } catch {\n return false;\n }\n }, 'must be a http(s) origin or a bare host[:port]')),\n ),\n\n middlewareBody: middlewareValidator,\n middlewareCors: middlewareValidator,\n middlewareCookie: middlewareValidator,\n middlewareQuery: middlewareValidator,\n middlewarePrometheus: middlewareValidator,\n middlewareRateLimit: middlewareValidator,\n middlewareSwagger: booleanValidator,\n\n tokenAccessMaxAge: nonNegativeNumberValidator,\n tokenRefreshMaxAge: nonNegativeNumberValidator,\n tokenRefreshGracePeriod: nonNegativeNumberValidator,\n promptLoginMaxAge: nonNegativeNumberValidator,\n endSessionHintGracePeriod: nonNegativeNumberValidator,\n registrationEnabled: booleanValidator,\n emailVerificationEnabled: booleanValidator,\n passwordRecoveryEnabled: booleanValidator,\n passwordMinLength: createValidator(\n z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n ),\n accountConsoleEnabled: booleanValidator,\n\n eventLogEnabled: booleanValidator,\n eventLogRetentionDays: nonNegativeNumberValidator,\n eventLogEntityEnabled: booleanValidator,\n eventLogEntityRetentionDays: nonNegativeNumberValidator,\n loginAttemptThrottleEnabled: booleanValidator,\n loginAttemptThreshold: createValidator(z.number().int().positive()),\n loginAttemptWindow: createValidator(z.number().int().positive()),\n\n // '' = unset; otherwise a base64 string (normalizeConfig enforces\n // the decoded 32-byte length at boot).\n secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n mfaEnabled: booleanValidator,\n mfaRequired: booleanValidator,\n mfaFreshnessMaxAge: nonNegativeNumberValidator,\n mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n clientAuthBasic: booleanValidator,\n clientSystemEnabled: booleanValidator,\n clientSystemSecret: secretValidator,\n clientSystemSecretReset: booleanValidator,\n\n userAuthBasic: booleanValidator,\n userAdminEnabled: booleanValidator,\n userAdminPassword: secretValidator,\n userAdminPasswordReset: booleanValidator,\n\n permissions: createValidator(\n z.string().or(z.array(z.string())),\n ),\n permissionsDefaultPolicyAssignment: booleanValidator,\n };\n\n const keys = Object.keys(validators) as (keyof Config)[];\n for (const key of keys) {\n this.mount(key, { optional: true }, validators[key]);\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GACvBqB,oBAAoBrB;GACpBsB,uBAAuBpB;GACvBqB,iBAAiBvB;GACjBwB,oBAAoBxB;GAEpByB,QAAQvB;GACRwB,IAAIlC,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BW,OAAOb;GACPc,MAAMd;GAENe,MAAMzB;GACN0B,MAAM9B;GACN+B,WAAWvC,gBAAgBE,EAAEsC,IAAG,CAAA;GAChCC,eAAezC,gBAAgBE,EAAEsC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmB3C,gBAAgBE,EAAE0C,KAAKvC,mBAAAA,CAAAA;GAC1CwC,YAAY7C,gBAAgBE,EAAE4C,MAAM;IAChC5C,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGjC,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAGwC,OACf7C,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD8C,gBAAgBlD,gBACZE,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAGwC,QAAQzB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGP2B,gBAAgBjC;GAChBkC,gBAAgBlC;GAChBmC,kBAAkBnC;GAClBoC,iBAAiBpC;GACjBqC,sBAAsBrC;GACtBsC,qBAAqBtC;GACrBuC,mBAAmB/C;GAEnBgD,mBAAmB9C;GACnB+C,oBAAoB/C;GACpBgD,yBAAyBhD;GACzBiD,mBAAmBjD;GACnBkD,2BAA2BlD;GAC3BmD,qBAAqBrD;GACrBsD,0BAA0BtD;GAC1BuD,yBAAyBvD;GACzBwD,mBAAmBlE,gBACfE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAGlD,IAAInB,wBAAAA,CAAAA;GAEpCsE,uBAAuB1D;GAEvB2D,iBAAiB3D;GACjB4D,uBAAuB1D;GACvB2D,uBAAuB7D;GACvB8D,6BAA6B5D;GAC7B6D,6BAA6B/D;GAC7BgE,uBAAuB1E,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEQ,oBAAoB3E,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DS,sBAAsB5E,gBAAgBE,EAAE4C,MAAM,CAAC5C,EAAE2E,QAAQ,EAAA,GAAK3E,EAAE4E,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYrE;GACZsE,aAAatE;GACbuE,oBAAoBrE;GACpBsE,iBAAiBlF,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1DgB,iBAAiBzE;GACjB0E,qBAAqB1E;GACrB2E,oBAAoBtE;GACpBuE,yBAAyB5E;GAEzB6E,eAAe7E;GACf8E,kBAAkB9E;GAClB+E,mBAAmB1E;GACnB2E,wBAAwBhF;GAExBiF,aAAa3F,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElCmF,oCAAoClF;EACxC;EAEA,MAAMmF,OAAOC,OAAOD,KAAKpE,UAAAA;EACzB,KAAK,MAAMsE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGxE,WAAWsE,IAAI;CAE3D;AACJ"}

package/dist/app/modules/database/module.mjs CHANGED Viewed

@@ -135,7 +135,8 @@ var DatabaseModule = class {
 	}
 	registerEventPublisher(container, dataSource) {
 		const config = container.resolve(ConfigInjectionKey);
-		const publisher = new DomainEventPublisher({ logger: container.resolve(LoggerInjectionKey) });
+		const logger = container.resolve(LoggerInjectionKey);
+		const publisher = new DomainEventPublisher({ logger });
 		this.eventPublisher = publisher;
 		if (config.redis) {
 			const client = createRedisClient(config.redis);

package/dist/app/modules/database/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["DomainEventPublisher","DomainEventRedisHandler","DomainEventSocketHandler","createRedisClient","AuthupError","DataSource","InstanceChecker","checkDatabase","createDatabase","synchronizeDatabaseSchema","DataSourceOptionsBuilder","DatabaseQueryResultCache","EntitySubscriber","EventEntity","isDatabaseTypeSupported","isDatabaseTypeSupportedForEnvironment","EntityEventHandler","EventService","useRequestEventContext","EventRepositoryAdapter","validateEntitySchemas","CacheInjectionKey","ModuleName","DatabaseInjectionKey","ConfigInjectionKey","LoggerInjectionKey","DatabaseModule","name","dependencies","optionsBuilder","options","eventRedisClient","eventPublisher","DATABASE","CONFIG","LOGGER","setup","container","logger","resolve","prepareBuild","dataSourceOptions","buildDataSourceOptions","setupDatabase","dataSource","debug","initialize","migrate","registerRepositories","registerEvents","registerEventPublisher","register","useValue","e","isInitialized","destroy","disposeEventPublisher","cleanupError","warn","teardown","tryResolve","success","data","unregister","EventRepository","dispose","undefined","disconnect","check","exists","synchronize","ifNotExist","config","db","buildWith","buildWithEnv","type","env","cacheResult","Object","assign","cache","provider","entities","Array","isArray","entity","isEntitySchema","useFactory","getRepository","publisher","redis","client","eventLogEnabled","eventLogEntityEnabled","eventService","requestContext","retentionDays","eventLogEntityRetentionDays","i","subscribers","length","subscriber","setPublisher","repository","service","enabled","eventLogRetentionDays"],"sources":["../../../../src/app/modules/database/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n DomainEventPublisher,\n DomainEventRedisHandler,\n DomainEventSocketHandler,\n createRedisClient,\n} from '@authup/server-kit';\nimport type { RedisClient } from '@authup/server-kit';\nimport { AuthupError } from '@authup/errors';\nimport type { DataSourceOptions } from 'typeorm';\nimport { DataSource, InstanceChecker } from 'typeorm';\nimport {\n checkDatabase,\n createDatabase,\n synchronizeDatabaseSchema,\n} from 'typeorm-extension';\nimport {\n DataSourceOptionsBuilder,\n DatabaseQueryResultCache,\n EntitySubscriber,\n EventEntity,\n isDatabaseTypeSupported,\n isDatabaseTypeSupportedForEnvironment,\n} from '../../../adapters/database/index.ts';\nimport type { Event } from '@authup/core-kit';\nimport { EntityEventHandler, EventService } from '../../../core/index.ts';\nimport { useRequestEventContext } from '../../../adapters/http/request/index.ts';\nimport { EventRepositoryAdapter } from './repositories/index.ts';\nimport { validateEntitySchemas } from './repositories/schema-validation.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { DatabaseInjectionKey } from './constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport type DatabaseModuleOptions = {\n prepareBuild?: (container: IContainer) => Promise<void>;\n setup?: (container: IContainer, options: DataSourceOptions) => Promise<void>;\n migrate?: (container: IContainer, dataSource: DataSource) => Promise<void>;\n};\n\nexport class DatabaseModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected optionsBuilder : DataSourceOptionsBuilder;\n\n protected options: DatabaseModuleOptions;\n\n protected eventRedisClient? : RedisClient;\n\n protected eventPublisher? : DomainEventPublisher;\n\n constructor(options: DatabaseModuleOptions = {}) {\n this.name = ModuleName.DATABASE;\n this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n\n this.optionsBuilder = new DataSourceOptionsBuilder();\n this.options = options;\n }\n\n async setup(container: IContainer): Promise<void> {\n const logger = container.resolve(LoggerInjectionKey);\n\n if (this.options.prepareBuild) {\n await this.options.prepareBuild(container);\n }\n\n const dataSourceOptions = await this.buildDataSourceOptions(container);\n\n if (this.options.setup) {\n await this.options.setup(container, dataSourceOptions);\n } else {\n await this.setupDatabase(container, dataSourceOptions);\n }\n\n const dataSource = new DataSource(dataSourceOptions);\n\n logger.debug('Establishing database connection...');\n await dataSource.initialize();\n logger.debug('Established database connection.');\n\n try {\n if (this.options.migrate) {\n await this.options.migrate(container, dataSource);\n } else {\n await this.migrate(container, dataSource);\n }\n\n validateEntitySchemas(dataSource);\n this.registerRepositories(container, dataSource);\n // the event service must exist before the publisher wiring — the\n // entity-CRUD bridge handler resolves it from the container.\n this.registerEvents(container, dataSource);\n this.registerEventPublisher(container, dataSource);\n\n container.register(DatabaseInjectionKey.DataSource, { useValue: dataSource });\n } catch (e) {\n // teardown() is skipped for a module that fails its own setup(),\n // so release the connection pool and any event-publisher handles\n // here. Guard cleanup so it can never mask the original error.\n try {\n if (dataSource.isInitialized) {\n await dataSource.destroy();\n }\n\n await this.disposeEventPublisher();\n } catch (cleanupError) {\n logger.warn(`Failed to clean up database resources after setup error: ${cleanupError}`);\n }\n\n throw e;\n }\n }\n\n async teardown(container: IContainer): Promise<void> {\n const dataSource = container.tryResolve(DatabaseInjectionKey.DataSource);\n if (dataSource.success) {\n if (dataSource.data.isInitialized) {\n await dataSource.data.destroy();\n }\n\n container.unregister(DatabaseInjectionKey.DataSource);\n }\n\n container.unregister(DatabaseInjectionKey.DomainEventPublisher);\n container.unregister(DatabaseInjectionKey.EventRepository);\n container.unregister(DatabaseInjectionKey.EventService);\n\n await this.disposeEventPublisher();\n }\n\n protected async disposeEventPublisher(): Promise<void> {\n if (this.eventPublisher) {\n await this.eventPublisher.dispose();\n this.eventPublisher = undefined;\n }\n\n if (this.eventRedisClient) {\n this.eventRedisClient.disconnect();\n this.eventRedisClient = undefined;\n }\n }\n\n // ----------------------------------------------------\n\n protected async setupDatabase(container: IContainer, options: DataSourceOptions): Promise<void> {\n const logger = container.resolve(LoggerInjectionKey);\n\n const check = await checkDatabase({ options });\n\n if (!check.exists) {\n logger.debug('Creating database...');\n await createDatabase({\n options,\n synchronize: false,\n ifNotExist: true, \n });\n logger.debug('Created database');\n }\n }\n\n protected async migrate(container: IContainer, dataSource: DataSource): Promise<void> {\n const logger = container.resolve(LoggerInjectionKey);\n\n logger.debug('Migrating database...');\n await synchronizeDatabaseSchema(dataSource);\n logger.debug('Migrated database');\n }\n\n // ----------------------------------------------------\n\n /\n Load data source options for connection.\n \n @protected\n */\n protected async buildDataSourceOptions(container: IContainer) : Promise<DataSourceOptions> {\n const config = container.resolve(ConfigInjectionKey);\n\n let options : DataSourceOptions \| undefined;\n if (config.db) {\n options = this.optionsBuilder.buildWith(config.db);\n } else {\n options = this.optionsBuilder.buildWithEnv();\n }\n\n if (!isDatabaseTypeSupported(options.type)) {\n throw new AuthupError(`Database type ${options.type} is not supported (only: mysql, better-sqlite3 and postgres).`);\n }\n\n if (!isDatabaseTypeSupportedForEnvironment(options.type, config.env)) {\n throw new AuthupError(`Database type ${options.type} is not supported for ${config.env}.`);\n }\n\n const cacheResult = container.tryResolve(CacheInjectionKey);\n if (cacheResult.success) {\n Object.assign(options, {\n cache: {\n provider() {\n return new DatabaseQueryResultCache(cacheResult.data);\n },\n },\n } satisfies Partial<DataSourceOptions>);\n }\n\n return options;\n }\n\n protected registerRepositories(container: IContainer, dataSource: DataSource) : void {\n const entities = dataSource.options.entities \|\| [];\n if (!Array.isArray(entities)) {\n return;\n }\n\n for (const entity of entities) {\n if (InstanceChecker.isEntitySchema(entity)) {\n continue;\n }\n\n // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n // @ts-expect-error\n container.register(entity, { useFactory: () => dataSource.getRepository(entity) });\n }\n }\n\n protected registerEventPublisher(container: IContainer, dataSource: DataSource) {\n const config = container.resolve(ConfigInjectionKey);\n const logger = container.resolve(LoggerInjectionKey);\n\n const publisher = new DomainEventPublisher({ logger });\n this.eventPublisher = publisher;\n if (config.redis) {\n const client = createRedisClient(config.redis);\n if (client !== config.redis) {\n this.eventRedisClient = client;\n }\n\n publisher.register(new DomainEventRedisHandler(client));\n publisher.register(new DomainEventSocketHandler(client));\n }\n\n if (config.eventLogEnabled && config.eventLogEntityEnabled) {\n publisher.register(new EntityEventHandler({\n eventService: container.resolve(DatabaseInjectionKey.EventService),\n requestContext: useRequestEventContext,\n options: { retentionDays: config.eventLogEntityRetentionDays },\n }));\n }\n\n container.register(DatabaseInjectionKey.DomainEventPublisher, { useValue: publisher });\n\n for (let i = 0; i < dataSource.subscribers.length; i++) {\n const subscriber = dataSource.subscribers[i];\n if (subscriber instanceof EntitySubscriber) {\n subscriber.setPublisher(publisher);\n }\n }\n }\n\n protected registerEvents(container: IContainer, dataSource: DataSource) {\n const config = container.resolve(ConfigInjectionKey);\n const logger = container.resolve(LoggerInjectionKey);\n\n const repository = new EventRepositoryAdapter(\n dataSource.getRepository<Event>(EventEntity),\n );\n container.register(DatabaseInjectionKey.EventRepository, { useValue: repository });\n\n const service = new EventService({\n repository,\n options: {\n enabled: config.eventLogEnabled,\n retentionDays: config.eventLogRetentionDays,\n },\n logger,\n });\n container.register(DatabaseInjectionKey.EventService, { useValue: service });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa0B,iBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,YAAYF,UAAiC,CAAC,GAAG;EAC7C,KAAKH,OAAOL,WAAWW;EACvB,KAAKL,eAAe,CAACN,WAAWY,QAAQZ,WAAWa,MAAO;EAE1D,KAAKN,iBAAiB,IAAInB,yBAAAA;EAC1B,KAAKoB,UAAUA;CACnB;CAEA,MAAMM,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,IAAI,KAAKK,QAAQU,cACb,MAAM,KAAKV,QAAQU,aAAaH,SAAAA;EAGpC,MAAMI,oBAAoB,MAAM,KAAKC,uBAAuBL,SAAAA;EAE5D,IAAI,KAAKP,QAAQM,OACb,MAAM,KAAKN,QAAQM,MAAMC,WAAWI,iBAAAA;OAEpC,MAAM,KAAKE,cAAcN,WAAWI,iBAAAA;EAGxC,MAAMG,aAAa,IAAIvC,WAAWoC,iBAAAA;EAElCH,OAAOO,MAAM,qCAAA;EACb,MAAMD,WAAWE,WAAU;EAC3BR,OAAOO,MAAM,kCAAA;EAEb,IAAI;GACA,IAAI,KAAKf,QAAQiB,SACb,MAAM,KAAKjB,QAAQiB,QAAQV,WAAWO,UAAAA;QAEtC,MAAM,KAAKG,QAAQV,WAAWO,UAAAA;GAGlCxB,sBAAsBwB,UAAAA;GACtB,KAAKI,qBAAqBX,WAAWO,UAAAA;GAGrC,KAAKK,eAAeZ,WAAWO,UAAAA;GAC/B,KAAKM,uBAAuBb,WAAWO,UAAAA;GAEvCP,UAAUc,SAAS5B,qBAAqBlB,YAAY,EAAE+C,UAAUR,WAAW,CAAA;EAC/E,SAASS,GAAG;GAIR,IAAI;IACA,IAAIT,WAAWU,eACX,MAAMV,WAAWW,QAAO;IAG5B,MAAM,KAAKC,sBAAqB;GACpC,SAASC,cAAc;IACnBnB,OAAOoB,KAAK,4DAA4DD,cAAc;GAC1F;GAEA,MAAMJ;EACV;CACJ;CAEA,MAAMM,SAAStB,WAAsC;EACjD,MAAMO,aAAaP,UAAUuB,WAAWrC,qBAAqBlB,UAAU;EACvE,IAAIuC,WAAWiB,SAAS;GACpB,IAAIjB,WAAWkB,KAAKR,eAChB,MAAMV,WAAWkB,KAAKP,QAAO;GAGjClB,UAAU0B,WAAWxC,qBAAqBlB,UAAU;EACxD;EAEAgC,UAAU0B,WAAWxC,qBAAqBvB,oBAAoB;EAC9DqC,UAAU0B,WAAWxC,qBAAqByC,eAAe;EACzD3B,UAAU0B,WAAWxC,qBAAqBN,YAAY;EAEtD,MAAM,KAAKuC,sBAAqB;CACpC;CAEA,MAAgBA,wBAAuC;EACnD,IAAI,KAAKxB,gBAAgB;GACrB,MAAM,KAAKA,eAAeiC,QAAO;GACjC,KAAKjC,iBAAiBkC,KAAAA;EAC1B;EAEA,IAAI,KAAKnC,kBAAkB;GACvB,KAAKA,iBAAiBoC,WAAU;GAChC,KAAKpC,mBAAmBmC,KAAAA;EAC5B;CACJ;CAIA,MAAgBvB,cAAcN,WAAuBP,SAA2C;EAC5F,MAAMQ,SAASD,UAAUE,QAAQd,kBAAAA;EAIjC,IAAI,EAAC2C,MAFe7D,cAAc,EAAEuB,QAAQ,CAAA,EAAA,CAEjCuC,QAAQ;GACf/B,OAAOO,MAAM,sBAAA;GACb,MAAMrC,eAAe;IACjBsB;IACAwC,aAAa;IACbC,YAAY;GAChB,CAAA;GACAjC,OAAOO,MAAM,kBAAA;EACjB;CACJ;CAEA,MAAgBE,QAAQV,WAAuBO,YAAuC;EAClF,MAAMN,SAASD,UAAUE,QAAQd,kBAAAA;EAEjCa,OAAOO,MAAM,uBAAA;EACb,MAAMpC,0BAA0BmC,UAAAA;EAChCN,OAAOO,MAAM,mBAAA;CACjB;;;;;IASA,MAAgBH,uBAAuBL,WAAoD;EACvF,MAAMmC,SAASnC,UAAUE,QAAQf,kBAAAA;EAEjC,IAAIM;EACJ,IAAI0C,OAAOC,IACP3C,UAAU,KAAKD,eAAe6C,UAAUF,OAAOC,EAAE;OAEjD3C,UAAU,KAAKD,eAAe8C,aAAY;EAG9C,IAAI,CAAC7D,wBAAwBgB,QAAQ8C,IAAI,GACrC,MAAM,IAAIxE,YAAY,iBAAiB0B,QAAQ8C,KAAK,8DAA8D;EAGtH,IAAI,CAAC7D,sCAAsCe,QAAQ8C,MAAMJ,OAAOK,GAAG,GAC/D,MAAM,IAAIzE,YAAY,iBAAiB0B,QAAQ8C,KAAK,wBAAwBJ,OAAOK,IAAI,EAAE;EAG7F,MAAMC,cAAczC,UAAUuB,WAAWvC,iBAAAA;EACzC,IAAIyD,YAAYjB,SACZkB,OAAOC,OAAOlD,SAAS,EACnBmD,OAAO,EACHC,WAAAA;GACI,OAAO,IAAIvE,yBAAyBmE,YAAYhB,IAAI;EACxD,EACJ,EACJ,CAAA;EAGJ,OAAOhC;CACX;CAEUkB,qBAAqBX,WAAuBO,YAA+B;EACjF,MAAMuC,WAAWvC,WAAWd,QAAQqD,YAAY,CAAA;EAChD,IAAI,CAACC,MAAMC,QAAQF,QAAAA,GACf;EAGJ,KAAK,MAAMG,UAAUH,UAAU;GAC3B,IAAI7E,gBAAgBiF,eAAeD,MAAAA,GAC/B;GAKJjD,UAAUc,SAASmC,QAAQ,EAAEE,kBAAkB5C,WAAW6C,cAAcH,MAAAA,EAAQ,CAAA;EACpF;CACJ;CAEUpC,uBAAuBb,WAAuBO,YAAwB;EAC5E,MAAM4B,SAASnC,UAAUE,QAAQf,kBAAAA;EAGjC,MAAMkE,YAAY,IAAI1F,qBAAqB,EAAEsC,QAF9BD,UAAUE,QAAQd,kBAEYa,EAAO,CAAA;EACpD,KAAKN,iBAAiB0D;EACtB,IAAIlB,OAAOmB,OAAO;GACd,MAAMC,SAASzF,kBAAkBqE,OAAOmB,KAAK;GAC7C,IAAIC,WAAWpB,OAAOmB,OAClB,KAAK5D,mBAAmB6D;GAG5BF,UAAUvC,SAAS,IAAIlD,wBAAwB2F,MAAAA,CAAAA;GAC/CF,UAAUvC,SAAS,IAAIjD,yBAAyB0F,MAAAA,CAAAA;EACpD;EAEA,IAAIpB,OAAOqB,mBAAmBrB,OAAOsB,uBACjCJ,UAAUvC,SAAS,IAAInC,mBAAmB;GACtC+E,cAAc1D,UAAUE,QAAQhB,qBAAqBN,YAAY;GACjE+E,gBAAgB9E;GAChBY,SAAS,EAAEmE,eAAezB,OAAO0B,4BAA4B;EACjE,CAAA,CAAA;EAGJ7D,UAAUc,SAAS5B,qBAAqBvB,sBAAsB,EAAEoD,UAAUsC,UAAU,CAAA;EAEpF,KAAK,IAAIS,IAAI,GAAGA,IAAIvD,WAAWwD,YAAYC,QAAQF,KAAK;GACpD,MAAMG,aAAa1D,WAAWwD,YAAYD;GAC1C,IAAIG,sBAAsB1F,kBACtB0F,WAAWC,aAAab,SAAAA;EAEhC;CACJ;CAEUzC,eAAeZ,WAAuBO,YAAwB;EACpE,MAAM4B,SAASnC,UAAUE,QAAQf,kBAAAA;EACjC,MAAMc,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,MAAM+E,aAAa,IAAIrF,uBACnByB,WAAW6C,cAAqB5E,WAAAA,CAAAA;EAEpCwB,UAAUc,SAAS5B,qBAAqByC,iBAAiB,EAAEZ,UAAUoD,WAAW,CAAA;EAEhF,MAAMC,UAAU,IAAIxF,aAAa;GAC7BuF;GACA1E,SAAS;IACL4E,SAASlC,OAAOqB;IAChBI,eAAezB,OAAOmC;GAC1B;GACArE;EACJ,CAAA;EACAD,UAAUc,SAAS5B,qBAAqBN,cAAc,EAAEmC,UAAUqD,QAAQ,CAAA;CAC9E;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["DomainEventPublisher","DomainEventRedisHandler","DomainEventSocketHandler","createRedisClient","AuthupError","DataSource","InstanceChecker","checkDatabase","createDatabase","synchronizeDatabaseSchema","DataSourceOptionsBuilder","DatabaseQueryResultCache","EntitySubscriber","EventEntity","isDatabaseTypeSupported","isDatabaseTypeSupportedForEnvironment","EntityEventHandler","EventService","useRequestEventContext","EventRepositoryAdapter","validateEntitySchemas","CacheInjectionKey","ModuleName","DatabaseInjectionKey","ConfigInjectionKey","LoggerInjectionKey","DatabaseModule","name","dependencies","optionsBuilder","options","eventRedisClient","eventPublisher","DATABASE","CONFIG","LOGGER","setup","container","logger","resolve","prepareBuild","dataSourceOptions","buildDataSourceOptions","setupDatabase","dataSource","debug","initialize","migrate","registerRepositories","registerEvents","registerEventPublisher","register","useValue","e","isInitialized","destroy","disposeEventPublisher","cleanupError","warn","teardown","tryResolve","success","data","unregister","EventRepository","dispose","undefined","disconnect","check","exists","synchronize","ifNotExist","config","db","buildWith","buildWithEnv","type","env","cacheResult","Object","assign","cache","provider","entities","Array","isArray","entity","isEntitySchema","useFactory","getRepository","publisher","redis","client","eventLogEnabled","eventLogEntityEnabled","eventService","requestContext","retentionDays","eventLogEntityRetentionDays","i","subscribers","length","subscriber","setPublisher","repository","service","enabled","eventLogRetentionDays"],"sources":["../../../../src/app/modules/database/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n DomainEventPublisher,\n DomainEventRedisHandler,\n DomainEventSocketHandler,\n createRedisClient,\n} from '@authup/server-kit';\nimport type { RedisClient } from '@authup/server-kit';\nimport { AuthupError } from '@authup/errors';\nimport type { DataSourceOptions } from 'typeorm';\nimport { DataSource, InstanceChecker } from 'typeorm';\nimport {\n checkDatabase,\n createDatabase,\n synchronizeDatabaseSchema,\n} from 'typeorm-extension';\nimport {\n DataSourceOptionsBuilder,\n DatabaseQueryResultCache,\n EntitySubscriber,\n EventEntity,\n isDatabaseTypeSupported,\n isDatabaseTypeSupportedForEnvironment,\n} from '../../../adapters/database/index.ts';\nimport type { Event } from '@authup/core-kit';\nimport { EntityEventHandler, EventService } from '../../../core/index.ts';\nimport { useRequestEventContext } from '../../../adapters/http/request/index.ts';\nimport { EventRepositoryAdapter } from './repositories/index.ts';\nimport { validateEntitySchemas } from './repositories/schema-validation.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { DatabaseInjectionKey } from './constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport type DatabaseModuleOptions = {\n prepareBuild?: (container: IContainer) => Promise<void>;\n setup?: (container: IContainer, options: DataSourceOptions) => Promise<void>;\n migrate?: (container: IContainer, dataSource: DataSource) => Promise<void>;\n};\n\nexport class DatabaseModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected optionsBuilder : DataSourceOptionsBuilder;\n\n protected options: DatabaseModuleOptions;\n\n protected eventRedisClient? : RedisClient;\n\n protected eventPublisher? : DomainEventPublisher;\n\n constructor(options: DatabaseModuleOptions = {}) {\n this.name = ModuleName.DATABASE;\n this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n\n this.optionsBuilder = new DataSourceOptionsBuilder();\n this.options = options;\n }\n\n async setup(container: IContainer): Promise<void> {\n const logger = container.resolve(LoggerInjectionKey);\n\n if (this.options.prepareBuild) {\n await this.options.prepareBuild(container);\n }\n\n const dataSourceOptions = await this.buildDataSourceOptions(container);\n\n if (this.options.setup) {\n await this.options.setup(container, dataSourceOptions);\n } else {\n await this.setupDatabase(container, dataSourceOptions);\n }\n\n const dataSource = new DataSource(dataSourceOptions);\n\n logger.debug('Establishing database connection...');\n await dataSource.initialize();\n logger.debug('Established database connection.');\n\n try {\n if (this.options.migrate) {\n await this.options.migrate(container, dataSource);\n } else {\n await this.migrate(container, dataSource);\n }\n\n validateEntitySchemas(dataSource);\n this.registerRepositories(container, dataSource);\n // the event service must exist before the publisher wiring — the\n // entity-CRUD bridge handler resolves it from the container.\n this.registerEvents(container, dataSource);\n this.registerEventPublisher(container, dataSource);\n\n container.register(DatabaseInjectionKey.DataSource, { useValue: dataSource });\n } catch (e) {\n // teardown() is skipped for a module that fails its own setup(),\n // so release the connection pool and any event-publisher handles\n // here. Guard cleanup so it can never mask the original error.\n try {\n if (dataSource.isInitialized) {\n await dataSource.destroy();\n }\n\n await this.disposeEventPublisher();\n } catch (cleanupError) {\n logger.warn(`Failed to clean up database resources after setup error: ${cleanupError}`);\n }\n\n throw e;\n }\n }\n\n async teardown(container: IContainer): Promise<void> {\n const dataSource = container.tryResolve(DatabaseInjectionKey.DataSource);\n if (dataSource.success) {\n if (dataSource.data.isInitialized) {\n await dataSource.data.destroy();\n }\n\n container.unregister(DatabaseInjectionKey.DataSource);\n }\n\n container.unregister(DatabaseInjectionKey.DomainEventPublisher);\n container.unregister(DatabaseInjectionKey.EventRepository);\n container.unregister(DatabaseInjectionKey.EventService);\n\n await this.disposeEventPublisher();\n }\n\n protected async disposeEventPublisher(): Promise<void> {\n if (this.eventPublisher) {\n await this.eventPublisher.dispose();\n this.eventPublisher = undefined;\n }\n\n if (this.eventRedisClient) {\n this.eventRedisClient.disconnect();\n this.eventRedisClient = undefined;\n }\n }\n\n // ----------------------------------------------------\n\n protected async setupDatabase(container: IContainer, options: DataSourceOptions): Promise<void> {\n const logger = container.resolve(LoggerInjectionKey);\n\n const check = await checkDatabase({ options });\n\n if (!check.exists) {\n logger.debug('Creating database...');\n await createDatabase({\n options,\n synchronize: false,\n ifNotExist: true, \n });\n logger.debug('Created database');\n }\n }\n\n protected async migrate(container: IContainer, dataSource: DataSource): Promise<void> {\n const logger = container.resolve(LoggerInjectionKey);\n\n logger.debug('Migrating database...');\n await synchronizeDatabaseSchema(dataSource);\n logger.debug('Migrated database');\n }\n\n // ----------------------------------------------------\n\n /\n Load data source options for connection.\n \n @protected\n */\n protected async buildDataSourceOptions(container: IContainer) : Promise<DataSourceOptions> {\n const config = container.resolve(ConfigInjectionKey);\n\n let options : DataSourceOptions \| undefined;\n if (config.db) {\n options = this.optionsBuilder.buildWith(config.db);\n } else {\n options = this.optionsBuilder.buildWithEnv();\n }\n\n if (!isDatabaseTypeSupported(options.type)) {\n throw new AuthupError(`Database type ${options.type} is not supported (only: mysql, better-sqlite3 and postgres).`);\n }\n\n if (!isDatabaseTypeSupportedForEnvironment(options.type, config.env)) {\n throw new AuthupError(`Database type ${options.type} is not supported for ${config.env}.`);\n }\n\n const cacheResult = container.tryResolve(CacheInjectionKey);\n if (cacheResult.success) {\n Object.assign(options, {\n cache: {\n provider() {\n return new DatabaseQueryResultCache(cacheResult.data);\n },\n },\n } satisfies Partial<DataSourceOptions>);\n }\n\n return options;\n }\n\n protected registerRepositories(container: IContainer, dataSource: DataSource) : void {\n const entities = dataSource.options.entities \|\| [];\n if (!Array.isArray(entities)) {\n return;\n }\n\n for (const entity of entities) {\n if (InstanceChecker.isEntitySchema(entity)) {\n continue;\n }\n\n // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n // @ts-expect-error\n container.register(entity, { useFactory: () => dataSource.getRepository(entity) });\n }\n }\n\n protected registerEventPublisher(container: IContainer, dataSource: DataSource) {\n const config = container.resolve(ConfigInjectionKey);\n const logger = container.resolve(LoggerInjectionKey);\n\n const publisher = new DomainEventPublisher({ logger });\n this.eventPublisher = publisher;\n if (config.redis) {\n const client = createRedisClient(config.redis);\n if (client !== config.redis) {\n this.eventRedisClient = client;\n }\n\n publisher.register(new DomainEventRedisHandler(client));\n publisher.register(new DomainEventSocketHandler(client));\n }\n\n if (config.eventLogEnabled && config.eventLogEntityEnabled) {\n publisher.register(new EntityEventHandler({\n eventService: container.resolve(DatabaseInjectionKey.EventService),\n requestContext: useRequestEventContext,\n options: { retentionDays: config.eventLogEntityRetentionDays },\n }));\n }\n\n container.register(DatabaseInjectionKey.DomainEventPublisher, { useValue: publisher });\n\n for (let i = 0; i < dataSource.subscribers.length; i++) {\n const subscriber = dataSource.subscribers[i];\n if (subscriber instanceof EntitySubscriber) {\n subscriber.setPublisher(publisher);\n }\n }\n }\n\n protected registerEvents(container: IContainer, dataSource: DataSource) {\n const config = container.resolve(ConfigInjectionKey);\n const logger = container.resolve(LoggerInjectionKey);\n\n const repository = new EventRepositoryAdapter(\n dataSource.getRepository<Event>(EventEntity),\n );\n container.register(DatabaseInjectionKey.EventRepository, { useValue: repository });\n\n const service = new EventService({\n repository,\n options: {\n enabled: config.eventLogEnabled,\n retentionDays: config.eventLogRetentionDays,\n },\n logger,\n });\n container.register(DatabaseInjectionKey.EventService, { useValue: service });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAa0B,iBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,YAAYF,UAAiC,CAAC,GAAG;EAC7C,KAAKH,OAAOL,WAAWW;EACvB,KAAKL,eAAe,CAACN,WAAWY,QAAQZ,WAAWa,MAAO;EAE1D,KAAKN,iBAAiB,IAAInB,yBAAAA;EAC1B,KAAKoB,UAAUA;CACnB;CAEA,MAAMM,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,IAAI,KAAKK,QAAQU,cACb,MAAM,KAAKV,QAAQU,aAAaH,SAAAA;EAGpC,MAAMI,oBAAoB,MAAM,KAAKC,uBAAuBL,SAAAA;EAE5D,IAAI,KAAKP,QAAQM,OACb,MAAM,KAAKN,QAAQM,MAAMC,WAAWI,iBAAAA;OAEpC,MAAM,KAAKE,cAAcN,WAAWI,iBAAAA;EAGxC,MAAMG,aAAa,IAAIvC,WAAWoC,iBAAAA;EAElCH,OAAOO,MAAM,qCAAA;EACb,MAAMD,WAAWE,WAAU;EAC3BR,OAAOO,MAAM,kCAAA;EAEb,IAAI;GACA,IAAI,KAAKf,QAAQiB,SACb,MAAM,KAAKjB,QAAQiB,QAAQV,WAAWO,UAAAA;QAEtC,MAAM,KAAKG,QAAQV,WAAWO,UAAAA;GAGlCxB,sBAAsBwB,UAAAA;GACtB,KAAKI,qBAAqBX,WAAWO,UAAAA;GAGrC,KAAKK,eAAeZ,WAAWO,UAAAA;GAC/B,KAAKM,uBAAuBb,WAAWO,UAAAA;GAEvCP,UAAUc,SAAS5B,qBAAqBlB,YAAY,EAAE+C,UAAUR,WAAW,CAAA;EAC/E,SAASS,GAAG;GAIR,IAAI;IACA,IAAIT,WAAWU,eACX,MAAMV,WAAWW,QAAO;IAG5B,MAAM,KAAKC,sBAAqB;GACpC,SAASC,cAAc;IACnBnB,OAAOoB,KAAK,4DAA4DD,cAAc;GAC1F;GAEA,MAAMJ;EACV;CACJ;CAEA,MAAMM,SAAStB,WAAsC;EACjD,MAAMO,aAAaP,UAAUuB,WAAWrC,qBAAqBlB,UAAU;EACvE,IAAIuC,WAAWiB,SAAS;GACpB,IAAIjB,WAAWkB,KAAKR,eAChB,MAAMV,WAAWkB,KAAKP,QAAO;GAGjClB,UAAU0B,WAAWxC,qBAAqBlB,UAAU;EACxD;EAEAgC,UAAU0B,WAAWxC,qBAAqBvB,oBAAoB;EAC9DqC,UAAU0B,WAAWxC,qBAAqByC,eAAe;EACzD3B,UAAU0B,WAAWxC,qBAAqBN,YAAY;EAEtD,MAAM,KAAKuC,sBAAqB;CACpC;CAEA,MAAgBA,wBAAuC;EACnD,IAAI,KAAKxB,gBAAgB;GACrB,MAAM,KAAKA,eAAeiC,QAAO;GACjC,KAAKjC,iBAAiBkC,KAAAA;EAC1B;EAEA,IAAI,KAAKnC,kBAAkB;GACvB,KAAKA,iBAAiBoC,WAAU;GAChC,KAAKpC,mBAAmBmC,KAAAA;EAC5B;CACJ;CAIA,MAAgBvB,cAAcN,WAAuBP,SAA2C;EAC5F,MAAMQ,SAASD,UAAUE,QAAQd,kBAAAA;EAIjC,IAAI,EAAC2C,MAFe7D,cAAc,EAAEuB,QAAQ,CAAA,EAAA,CAEjCuC,QAAQ;GACf/B,OAAOO,MAAM,sBAAA;GACb,MAAMrC,eAAe;IACjBsB;IACAwC,aAAa;IACbC,YAAY;GAChB,CAAA;GACAjC,OAAOO,MAAM,kBAAA;EACjB;CACJ;CAEA,MAAgBE,QAAQV,WAAuBO,YAAuC;EAClF,MAAMN,SAASD,UAAUE,QAAQd,kBAAAA;EAEjCa,OAAOO,MAAM,uBAAA;EACb,MAAMpC,0BAA0BmC,UAAAA;EAChCN,OAAOO,MAAM,mBAAA;CACjB;;;;;IASA,MAAgBH,uBAAuBL,WAAoD;EACvF,MAAMmC,SAASnC,UAAUE,QAAQf,kBAAAA;EAEjC,IAAIM;EACJ,IAAI0C,OAAOC,IACP3C,UAAU,KAAKD,eAAe6C,UAAUF,OAAOC,EAAE;OAEjD3C,UAAU,KAAKD,eAAe8C,aAAY;EAG9C,IAAI,CAAC7D,wBAAwBgB,QAAQ8C,IAAI,GACrC,MAAM,IAAIxE,YAAY,iBAAiB0B,QAAQ8C,KAAK,8DAA8D;EAGtH,IAAI,CAAC7D,sCAAsCe,QAAQ8C,MAAMJ,OAAOK,GAAG,GAC/D,MAAM,IAAIzE,YAAY,iBAAiB0B,QAAQ8C,KAAK,wBAAwBJ,OAAOK,IAAI,EAAE;EAG7F,MAAMC,cAAczC,UAAUuB,WAAWvC,iBAAAA;EACzC,IAAIyD,YAAYjB,SACZkB,OAAOC,OAAOlD,SAAS,EACnBmD,OAAO,EACHC,WAAAA;GACI,OAAO,IAAIvE,yBAAyBmE,YAAYhB,IAAI;EACxD,EACJ,EACJ,CAAA;EAGJ,OAAOhC;CACX;CAEUkB,qBAAqBX,WAAuBO,YAA+B;EACjF,MAAMuC,WAAWvC,WAAWd,QAAQqD,YAAY,CAAA;EAChD,IAAI,CAACC,MAAMC,QAAQF,QAAAA,GACf;EAGJ,KAAK,MAAMG,UAAUH,UAAU;GAC3B,IAAI7E,gBAAgBiF,eAAeD,MAAAA,GAC/B;GAKJjD,UAAUc,SAASmC,QAAQ,EAAEE,kBAAkB5C,WAAW6C,cAAcH,MAAAA,EAAQ,CAAA;EACpF;CACJ;CAEUpC,uBAAuBb,WAAuBO,YAAwB;EAC5E,MAAM4B,SAASnC,UAAUE,QAAQf,kBAAAA;EACjC,MAAMc,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,MAAMiE,YAAY,IAAI1F,qBAAqB,EAAEsC,OAAO,CAAA;EACpD,KAAKN,iBAAiB0D;EACtB,IAAIlB,OAAOmB,OAAO;GACd,MAAMC,SAASzF,kBAAkBqE,OAAOmB,KAAK;GAC7C,IAAIC,WAAWpB,OAAOmB,OAClB,KAAK5D,mBAAmB6D;GAG5BF,UAAUvC,SAAS,IAAIlD,wBAAwB2F,MAAAA,CAAAA;GAC/CF,UAAUvC,SAAS,IAAIjD,yBAAyB0F,MAAAA,CAAAA;EACpD;EAEA,IAAIpB,OAAOqB,mBAAmBrB,OAAOsB,uBACjCJ,UAAUvC,SAAS,IAAInC,mBAAmB;GACtC+E,cAAc1D,UAAUE,QAAQhB,qBAAqBN,YAAY;GACjE+E,gBAAgB9E;GAChBY,SAAS,EAAEmE,eAAezB,OAAO0B,4BAA4B;EACjE,CAAA,CAAA;EAGJ7D,UAAUc,SAAS5B,qBAAqBvB,sBAAsB,EAAEoD,UAAUsC,UAAU,CAAA;EAEpF,KAAK,IAAIS,IAAI,GAAGA,IAAIvD,WAAWwD,YAAYC,QAAQF,KAAK;GACpD,MAAMG,aAAa1D,WAAWwD,YAAYD;GAC1C,IAAIG,sBAAsB1F,kBACtB0F,WAAWC,aAAab,SAAAA;EAEhC;CACJ;CAEUzC,eAAeZ,WAAuBO,YAAwB;EACpE,MAAM4B,SAASnC,UAAUE,QAAQf,kBAAAA;EACjC,MAAMc,SAASD,UAAUE,QAAQd,kBAAAA;EAEjC,MAAM+E,aAAa,IAAIrF,uBACnByB,WAAW6C,cAAqB5E,WAAAA,CAAAA;EAEpCwB,UAAUc,SAAS5B,qBAAqByC,iBAAiB,EAAEZ,UAAUoD,WAAW,CAAA;EAEhF,MAAMC,UAAU,IAAIxF,aAAa;GAC7BuF;GACA1E,SAAS;IACL4E,SAASlC,OAAOqB;IAChBI,eAAezB,OAAOmC;GAC1B;GACArE;EACJ,CAAA;EACAD,UAAUc,SAAS5B,qBAAqBN,cAAc,EAAEmC,UAAUqD,QAAQ,CAAA;CAC9E;AACJ"}

package/dist/app/modules/http/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;~~IAoDjD~~;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;~~CAevD~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4DjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBvD"}