@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/app/modules/http/module.mjs

@@ -9,7 +9,8 @@ import "../config/index.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import { HTTPInjectionKey } from "./constants.mjs";
-import { createInternalUIHttpClient } from "../../../adapters/http/ui/internal-http-client.mjs";
+import { createInternalUIHttpClient } from "../../../adapters/http/ui/auth-console/http-client.mjs";
+import { bindConsolePackages } from "../../../adapters/http/ui/console-packages/module.mjs";
 import "../../../adapters/http/ui/index.mjs";
 import { MetricsInjectionKey } from "../metrics/constants.mjs";
 import { PromAuthFlowMetrics } from "../metrics/prom.mjs";
@@ -52,6 +53,10 @@ var HTTPModule = class {
 		} catch (e) {
 			throw new AuthupError(`Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`);
 		}
+		await bindConsolePackages({
+			authConsolePath: config.authConsolePath,
+			accountConsolePath: config.accountConsolePath
+		});
 		this.registerUIHttpClient(container);
 		this.registerMetrics(container);
 		await this.middleware.mountBefore(router, container);
@@ -106,6 +111,7 @@ var HTTPModule = class {
 			this.uiHttpClientRegistered = false;
 		}
 		container.unregister(MetricsInjectionKey);
+		await this.middleware.teardown();
 		if (!this.instance) return;
 		container.unregister(HTTPInjectionKey.Server);
 		await this.instance.close();

package/dist/app/modules/http/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["Client","AuthupError","App","serve","ConfigInjectionKey","createInternalUIHttpClient","NoopAuthFlowMetrics","ModuleName","HTTPInjectionKey","MetricsInjectionKey","PromAuthFlowMetrics","HTTPControllerModule","HTTPMiddlewareModule","LoggerInjectionKey","HTTPModule","name","dependencies","instance","middleware","controller","uiHttpClientRegistered","HTTP","CONFIG","LOGGER","AUTHENTICATION","IDENTITY","OAUTH2","setup","container","config","resolve","logger","debug","router","options","trustProxy","e","Error","message","String","registerUIHttpClient","registerMetrics","mountBefore","mount","mountAfter","server","port","hostname","host","silent","gracefulShutdown","ready","url","register","Server","useValue","has","UIHttpClient","useFactory","c","undefined","publicURL","publicUrl","internalURL","baseURL","lifetime","enabled","middlewarePrometheus","teardown","unregister","close"],"sources":["../../../../src/app/modules/http/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport { AuthupError } from '@authup/errors';\nimport { App } from 'routup';\nimport { serve } from 'routup/node';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IModule } from 'orkos';\nimport { createInternalUIHttpClient } from '../../../adapters/http/ui/index.ts';\nimport { NoopAuthFlowMetrics } from '../../../core/index.ts';\nimport { ModuleName } from '../constants.ts';\nimport type { HTTPServer } from './constants.ts';\nimport { HTTPInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { MetricsInjectionKey, PromAuthFlowMetrics } from '../metrics/index.ts';\nimport { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport class HTTPModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected instance : HTTPServer | undefined;\n\n    protected middleware : HTTPMiddlewareModule;\n\n    protected controller : HTTPControllerModule;\n\n    protected uiHttpClientRegistered : boolean;\n\n    constructor() {\n        this.name = ModuleName.HTTP;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.AUTHENTICATION, ModuleName.IDENTITY, ModuleName.OAUTH2];\n        this.controller = new HTTPControllerModule();\n        this.middleware = new HTTPMiddlewareModule();\n        this.uiHttpClientRegistered = false;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Starting http server...');\n\n        // Every request helper deriving proxy-dependent request facts\n        // (getRequestIP, hostname, protocol) resolves the trust contract from\n        // the app options — call sites must NOT pass their own `trustProxy`.\n        let router : App;\n        try {\n            router = new App({ options: { trustProxy: config.trustProxy } });\n        } catch (e) {\n            // proxy-addr compiles the allowlist form inside the App\n            // constructor; its error (\"invalid IP address: …\") does not name\n            // the offending config key — attribute it.\n            throw new AuthupError(\n                `Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`,\n            );\n        }\n\n        this.registerUIHttpClient(container);\n        this.registerMetrics(container);\n\n        await this.middleware.mountBefore(router, container);\n        await this.controller.mount(router, container);\n        await this.middleware.mountAfter(router, container);\n\n        const server = serve(router, {\n            port: config.port,\n            hostname: config.host,\n            silent: true,\n            // Shutdown is driven by the orkos teardown chain (see cli/commands/start.ts);\n            // srvx's plugin would only close the HTTP server, leaving DB / cache / etc. open.\n            gracefulShutdown: false,\n        });\n\n        await server.ready();\n\n        this.instance = server;\n\n        if (server.url) {\n            logger.debug(`Listening on ${server.url}`);\n        }\n\n        container.register(HTTPInjectionKey.Server, { useValue: server });\n\n        logger.debug('Started http server.');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Default HTTP client for the SSR'd UI pages: dispatches against the\n     * server's own listen address instead of round-tripping through the\n     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).\n     * Skipped when the token is already bound (test injection wins).\n     * Transient lifetime is mandatory — client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client.\n     */\n    protected registerUIHttpClient(container: IContainer): void {\n        if (container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        container.register(HTTPInjectionKey.UIHttpClient, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                // The server token is registered after listen; a resolve can\n                // only happen on a request, so it is present by then. The\n                // guards keep an edge case on the previous (public URL)\n                // dispatch behavior instead of failing the render.\n                const server = c.has(HTTPInjectionKey.Server) ?\n                    c.resolve(HTTPInjectionKey.Server) :\n                    undefined;\n\n                if (server && server.url) {\n                    return createInternalUIHttpClient({\n                        publicURL: config.publicUrl,\n                        internalURL: server.url,\n                    });\n                }\n\n                return new Client({ baseURL: config.publicUrl });\n            },\n        }, { lifetime: 'transient' });\n\n        this.uiHttpClientRegistered = true;\n    }\n\n    /**\n     * Auth-flow metric counters for the emit points (plan 058 Part 2).\n     * Registered before the controllers are built — the factories resolve the\n     * token. Prometheus-backed iff the prometheus middleware is enabled\n     * (mirrors HTTPMiddlewareModule.isEnabled: boolean|object, false = off),\n     * otherwise a noop so emit sites never need a guard beyond `?.`.\n     */\n    protected registerMetrics(container: IContainer): void {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const enabled = typeof config.middlewarePrometheus !== 'boolean' ||\n            config.middlewarePrometheus === true;\n\n        container.register(MetricsInjectionKey, {\n            useValue: enabled ?\n                new PromAuthFlowMetrics() :\n                new NoopAuthFlowMetrics(),\n        });\n    }\n\n    // ----------------------------------------------------\n\n    async teardown(container: IContainer): Promise<void> {\n        if (this.uiHttpClientRegistered) {\n            container.unregister(HTTPInjectionKey.UIHttpClient);\n            this.uiHttpClientRegistered = false;\n        }\n\n        container.unregister(MetricsInjectionKey);\n\n        if (!this.instance) return;\n\n        container.unregister(HTTPInjectionKey.Server);\n\n        await this.instance.close();\n        this.instance = undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAac,aAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKL,OAAOR,WAAWc;EACvB,KAAKL,eAAe;GAACT,WAAWe;GAAQf,WAAWgB;GAAQhB,WAAWiB;GAAgBjB,WAAWkB;GAAUlB,WAAWmB;EAAO;EAC7H,KAAKP,aAAa,IAAIR,qBAAAA;EACtB,KAAKO,aAAa,IAAIN,qBAAAA;EACtB,KAAKQ,yBAAyB;CAClC;CAIA,MAAMO,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQ1B,kBAAAA;EACjC,MAAM2B,SAASH,UAAUE,QAAQjB,kBAAAA;EAEjCkB,OAAOC,MAAM,yBAAA;EAKb,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAI/B,IAAI,EAAEgC,SAAS,EAAEC,YAAYN,OAAOM,WAAW,EAAE,CAAA;EAClE,SAASC,GAAG;GAIR,MAAM,IAAInC,YACN,mDAAmDmC,aAAaC,QAAQD,EAAEE,UAAUC,OAAOH,CAAAA,GAAI;EAEvG;EAEA,KAAKI,qBAAqBZ,SAAAA;EAC1B,KAAKa,gBAAgBb,SAAAA;EAErB,MAAM,KAAKV,WAAWwB,YAAYT,QAAQL,SAAAA;EAC1C,MAAM,KAAKT,WAAWwB,MAAMV,QAAQL,SAAAA;EACpC,MAAM,KAAKV,WAAW0B,WAAWX,QAAQL,SAAAA;EAEzC,MAAMiB,SAAS1C,MAAM8B,QAAQ;GACzBa,MAAMjB,OAAOiB;GACbC,UAAUlB,OAAOmB;GACjBC,QAAQ;GAGRC,kBAAkB;EACtB,CAAA;EAEA,MAAML,OAAOM,MAAK;EAElB,KAAKlC,WAAW4B;EAEhB,IAAIA,OAAOO,KACPrB,OAAOC,MAAM,gBAAgBa,OAAOO,KAAK;EAG7CxB,UAAUyB,SAAS7C,iBAAiB8C,QAAQ,EAAEC,UAAUV,OAAO,CAAA;EAE/Dd,OAAOC,MAAM,sBAAA;CACjB;;;;;;;;IAYA,qBAA+BJ,WAA6B;EACxD,IAAIA,UAAU4B,IAAIhD,iBAAiBiD,YAAY,GAC3C;EAGJ7B,UAAUyB,SAAS7C,iBAAiBiD,cAAc,EAC9CC,aAAaC,MAAAA;GACT,MAAM9B,SAAS8B,EAAE7B,QAAQ1B,kBAAAA;GAMzB,MAAMyC,SAASc,EAAEH,IAAIhD,iBAAiB8C,MAAM,IACxCK,EAAE7B,QAAQtB,iBAAiB8C,MAAM,IACjCM,KAAAA;GAEJ,IAAIf,UAAUA,OAAOO,KACjB,OAAO/C,2BAA2B;IAC9BwD,WAAWhC,OAAOiC;IAClBC,aAAalB,OAAOO;GACxB,CAAA;GAGJ,OAAO,IAAIpD,OAAO,EAAEgE,SAASnC,OAAOiC,UAAU,CAAA;EAClD,EACJ,GAAG,EAAEG,UAAU,YAAY,CAAA;EAE3B,KAAK7C,yBAAyB;CAClC;;;;;;;IASA,gBAA0BQ,WAA6B;EACnD,MAAMC,SAASD,UAAUE,QAAQ1B,kBAAAA;EAEjC,MAAM8D,UAAU,OAAOrC,OAAOsC,yBAAyB,aACnDtC,OAAOsC,yBAAyB;EAEpCvC,UAAUyB,SAAS5C,qBAAqB,EACpC8C,UAAUW,UACN,IAAIxD,oBAAAA,IACJ,IAAIJ,oBAAAA,EACZ,CAAA;CACJ;CAIA,MAAM8D,SAASxC,WAAsC;EACjD,IAAI,KAAKR,wBAAwB;GAC7BQ,UAAUyC,WAAW7D,iBAAiBiD,YAAY;GAClD,KAAKrC,yBAAyB;EAClC;EAEAQ,UAAUyC,WAAW5D,mBAAAA;EAErB,IAAI,CAAC,KAAKQ,UAAU;EAEpBW,UAAUyC,WAAW7D,iBAAiB8C,MAAM;EAE5C,MAAM,KAAKrC,SAASqD,MAAK;EACzB,KAAKrD,WAAW2C,KAAAA;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["Client","AuthupError","App","serve","ConfigInjectionKey","bindConsolePackages","createInternalUIHttpClient","NoopAuthFlowMetrics","ModuleName","HTTPInjectionKey","MetricsInjectionKey","PromAuthFlowMetrics","HTTPControllerModule","HTTPMiddlewareModule","LoggerInjectionKey","HTTPModule","name","dependencies","instance","middleware","controller","uiHttpClientRegistered","HTTP","CONFIG","LOGGER","AUTHENTICATION","IDENTITY","OAUTH2","setup","container","config","resolve","logger","debug","router","options","trustProxy","e","Error","message","String","authConsolePath","accountConsolePath","registerUIHttpClient","registerMetrics","mountBefore","mount","mountAfter","server","port","hostname","host","silent","gracefulShutdown","ready","url","register","Server","useValue","has","UIHttpClient","useFactory","c","undefined","publicURL","publicUrl","internalURL","baseURL","lifetime","enabled","middlewarePrometheus","teardown","unregister","close"],"sources":["../../../../src/app/modules/http/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport { AuthupError } from '@authup/errors';\nimport { App } from 'routup';\nimport { serve } from 'routup/node';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IModule } from 'orkos';\nimport { bindConsolePackages, createInternalUIHttpClient } from '../../../adapters/http/ui/index.ts';\nimport { NoopAuthFlowMetrics } from '../../../core/index.ts';\nimport { ModuleName } from '../constants.ts';\nimport type { HTTPServer } from './constants.ts';\nimport { HTTPInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { MetricsInjectionKey, PromAuthFlowMetrics } from '../metrics/index.ts';\nimport { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport class HTTPModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected instance : HTTPServer | undefined;\n\n    protected middleware : HTTPMiddlewareModule;\n\n    protected controller : HTTPControllerModule;\n\n    protected uiHttpClientRegistered : boolean;\n\n    constructor() {\n        this.name = ModuleName.HTTP;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.AUTHENTICATION, ModuleName.IDENTITY, ModuleName.OAUTH2];\n        this.controller = new HTTPControllerModule();\n        this.middleware = new HTTPMiddlewareModule();\n        this.uiHttpClientRegistered = false;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Starting http server...');\n\n        // Every request helper deriving proxy-dependent request facts\n        // (getRequestIP, hostname, protocol) resolves the trust contract from\n        // the app options — call sites must NOT pass their own `trustProxy`.\n        let router : App;\n        try {\n            router = new App({ options: { trustProxy: config.trustProxy } });\n        } catch (e) {\n            // proxy-addr compiles the allowlist form inside the App\n            // constructor; its error (\"invalid IP address: …\") does not name\n            // the offending config key — attribute it.\n            throw new AuthupError(\n                `Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`,\n            );\n        }\n\n        // Before any route is mounted: a substituted console package that\n        // no longer fulfills its contract must stop the boot, not surface\n        // as a confusing per-request failure on /authorize.\n        await bindConsolePackages({\n            authConsolePath: config.authConsolePath,\n            accountConsolePath: config.accountConsolePath,\n        });\n\n        this.registerUIHttpClient(container);\n        this.registerMetrics(container);\n\n        await this.middleware.mountBefore(router, container);\n        await this.controller.mount(router, container);\n        await this.middleware.mountAfter(router, container);\n\n        const server = serve(router, {\n            port: config.port,\n            hostname: config.host,\n            silent: true,\n            // Shutdown is driven by the orkos teardown chain (see cli/commands/start.ts);\n            // srvx's plugin would only close the HTTP server, leaving DB / cache / etc. open.\n            gracefulShutdown: false,\n        });\n\n        await server.ready();\n\n        this.instance = server;\n\n        if (server.url) {\n            logger.debug(`Listening on ${server.url}`);\n        }\n\n        container.register(HTTPInjectionKey.Server, { useValue: server });\n\n        logger.debug('Started http server.');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Default HTTP client for the SSR'd UI pages: dispatches against the\n     * server's own listen address instead of round-tripping through the\n     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).\n     * Skipped when the token is already bound (test injection wins).\n     * Transient lifetime is mandatory — client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client.\n     */\n    protected registerUIHttpClient(container: IContainer): void {\n        if (container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        container.register(HTTPInjectionKey.UIHttpClient, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                // The server token is registered after listen; a resolve can\n                // only happen on a request, so it is present by then. The\n                // guards keep an edge case on the previous (public URL)\n                // dispatch behavior instead of failing the render.\n                const server = c.has(HTTPInjectionKey.Server) ?\n                    c.resolve(HTTPInjectionKey.Server) :\n                    undefined;\n\n                if (server && server.url) {\n                    return createInternalUIHttpClient({\n                        publicURL: config.publicUrl,\n                        internalURL: server.url,\n                    });\n                }\n\n                return new Client({ baseURL: config.publicUrl });\n            },\n        }, { lifetime: 'transient' });\n\n        this.uiHttpClientRegistered = true;\n    }\n\n    /**\n     * Auth-flow metric counters for the emit points (plan 058 Part 2).\n     * Registered before the controllers are built — the factories resolve the\n     * token. Prometheus-backed iff the prometheus middleware is enabled\n     * (mirrors HTTPMiddlewareModule.isEnabled: boolean|object, false = off),\n     * otherwise a noop so emit sites never need a guard beyond `?.`.\n     */\n    protected registerMetrics(container: IContainer): void {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const enabled = typeof config.middlewarePrometheus !== 'boolean' ||\n            config.middlewarePrometheus === true;\n\n        container.register(MetricsInjectionKey, {\n            useValue: enabled ?\n                new PromAuthFlowMetrics() :\n                new NoopAuthFlowMetrics(),\n        });\n    }\n\n    // ----------------------------------------------------\n\n    async teardown(container: IContainer): Promise<void> {\n        if (this.uiHttpClientRegistered) {\n            container.unregister(HTTPInjectionKey.UIHttpClient);\n            this.uiHttpClientRegistered = false;\n        }\n\n        container.unregister(MetricsInjectionKey);\n\n        await this.middleware.teardown();\n\n        if (!this.instance) return;\n\n        container.unregister(HTTPInjectionKey.Server);\n\n        await this.instance.close();\n        this.instance = undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAae,aAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKL,OAAOR,WAAWc;EACvB,KAAKL,eAAe;GAACT,WAAWe;GAAQf,WAAWgB;GAAQhB,WAAWiB;GAAgBjB,WAAWkB;GAAUlB,WAAWmB;EAAO;EAC7H,KAAKP,aAAa,IAAIR,qBAAAA;EACtB,KAAKO,aAAa,IAAIN,qBAAAA;EACtB,KAAKQ,yBAAyB;CAClC;CAIA,MAAMO,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EACjC,MAAM4B,SAASH,UAAUE,QAAQjB,kBAAAA;EAEjCkB,OAAOC,MAAM,yBAAA;EAKb,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIhC,IAAI,EAAEiC,SAAS,EAAEC,YAAYN,OAAOM,WAAW,EAAE,CAAA;EAClE,SAASC,GAAG;GAIR,MAAM,IAAIpC,YACN,mDAAmDoC,aAAaC,QAAQD,EAAEE,UAAUC,OAAOH,CAAAA,GAAI;EAEvG;EAKA,MAAMhC,oBAAoB;GACtBoC,iBAAiBX,OAAOW;GACxBC,oBAAoBZ,OAAOY;EAC/B,CAAA;EAEA,KAAKC,qBAAqBd,SAAAA;EAC1B,KAAKe,gBAAgBf,SAAAA;EAErB,MAAM,KAAKV,WAAW0B,YAAYX,QAAQL,SAAAA;EAC1C,MAAM,KAAKT,WAAW0B,MAAMZ,QAAQL,SAAAA;EACpC,MAAM,KAAKV,WAAW4B,WAAWb,QAAQL,SAAAA;EAEzC,MAAMmB,SAAS7C,MAAM+B,QAAQ;GACzBe,MAAMnB,OAAOmB;GACbC,UAAUpB,OAAOqB;GACjBC,QAAQ;GAGRC,kBAAkB;EACtB,CAAA;EAEA,MAAML,OAAOM,MAAK;EAElB,KAAKpC,WAAW8B;EAEhB,IAAIA,OAAOO,KACPvB,OAAOC,MAAM,gBAAgBe,OAAOO,KAAK;EAG7C1B,UAAU2B,SAAS/C,iBAAiBgD,QAAQ,EAAEC,UAAUV,OAAO,CAAA;EAE/DhB,OAAOC,MAAM,sBAAA;CACjB;;;;;;;;IAYA,qBAA+BJ,WAA6B;EACxD,IAAIA,UAAU8B,IAAIlD,iBAAiBmD,YAAY,GAC3C;EAGJ/B,UAAU2B,SAAS/C,iBAAiBmD,cAAc,EAC9CC,aAAaC,MAAAA;GACT,MAAMhC,SAASgC,EAAE/B,QAAQ3B,kBAAAA;GAMzB,MAAM4C,SAASc,EAAEH,IAAIlD,iBAAiBgD,MAAM,IACxCK,EAAE/B,QAAQtB,iBAAiBgD,MAAM,IACjCM,KAAAA;GAEJ,IAAIf,UAAUA,OAAOO,KACjB,OAAOjD,2BAA2B;IAC9B0D,WAAWlC,OAAOmC;IAClBC,aAAalB,OAAOO;GACxB,CAAA;GAGJ,OAAO,IAAIvD,OAAO,EAAEmE,SAASrC,OAAOmC,UAAU,CAAA;EAClD,EACJ,GAAG,EAAEG,UAAU,YAAY,CAAA;EAE3B,KAAK/C,yBAAyB;CAClC;;;;;;;IASA,gBAA0BQ,WAA6B;EACnD,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EAEjC,MAAMiE,UAAU,OAAOvC,OAAOwC,yBAAyB,aACnDxC,OAAOwC,yBAAyB;EAEpCzC,UAAU2B,SAAS9C,qBAAqB,EACpCgD,UAAUW,UACN,IAAI1D,oBAAAA,IACJ,IAAIJ,oBAAAA,EACZ,CAAA;CACJ;CAIA,MAAMgE,SAAS1C,WAAsC;EACjD,IAAI,KAAKR,wBAAwB;GAC7BQ,UAAU2C,WAAW/D,iBAAiBmD,YAAY;GAClD,KAAKvC,yBAAyB;EAClC;EAEAQ,UAAU2C,WAAW9D,mBAAAA;EAErB,MAAM,KAAKS,WAAWoD,SAAQ;EAE9B,IAAI,CAAC,KAAKrD,UAAU;EAEpBW,UAAU2C,WAAW/D,iBAAiBgD,MAAM;EAE5C,MAAM,KAAKvC,SAASuD,MAAK;EACzB,KAAKvD,WAAW6C,KAAAA;CACpB;AACJ"}

package/dist/app/modules/http/modules/controller.d.ts

@@ -1,6 +1,6 @@
 import type { App } from 'routup';
 import { ClientController, ClientPermissionController, ClientRoleController, ClientScopeController, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyController, RealmController, RoleAttributeController, RoleController, RolePermissionController, ScopeController, SessionController, TrustAnchorController, UserAttributeController, UserAuthenticatorController, UserController, UserPermissionController, UserRoleController } from '../../../../adapters/http/index.ts';
-import { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController } from '../../../../adapters/http/controllers/index.ts';
+import { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController } from '../../../../adapters/http/controllers/index.ts';
 import type { IContainer } from 'eldin';
 import { ConsentService, OAuth2AccessPolicyEvaluator, OAuth2MfaLoginService, PasswordRecoveryService, RegistrationService, UserAuthenticatorService, UserService } from '../../../../core/index.ts';
 import type { StatusResponseFeatures } from '@authup/core-http-kit';
@@ -17,6 +17,7 @@ export declare class HTTPControllerModule {
     createRegisterController(container: IContainer): RegisterController;
     createLogoutController(container: IContainer): LogoutController;
     createStatusController(container: IContainer): StatusController;
+    createAccountController(container: IContainer): AccountController;
     buildUIFeatures(config: Config): StatusResponseFeatures;
     createRegistrationService(container: IContainer): RegistrationService;
     createIdentityProvider(container: IContainer): IdentityProviderController;

package/dist/app/modules/http/modules/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAmElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAMd,2BAA2B,EAG3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EASnB,wBAAwB,EAGxB,WAAW,EAEd,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuE9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IAQxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAoC5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAsD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CA8C9C"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAmElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAMd,2BAA2B,EAG3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAUnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwE9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAY7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IASxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAoC5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAsD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}

package/dist/app/modules/http/modules/controller.mjs

@@ -29,7 +29,7 @@ import { LoginThrottleService } from "../../../../core/authentication/login-thro
 import { CredentialsAuthenticator } from "../../../../core/authentication/module.mjs";
 import { ClientCertificateValidator } from "../../../../core/client-certificate/module.mjs";
 import { ClientService } from "../../../../core/entities/client/service.mjs";
-import { WebClientProvisioner } from "../../../../core/entities/client/web-client.mjs";
+import { SystemClientProvisioner } from "../../../../core/entities/client/system-clients.mjs";
 import { ClientPermissionService } from "../../../../core/entities/client-permission/service.mjs";
 import { ClientRoleService } from "../../../../core/entities/client-role/service.mjs";
 import { ClientScopeService } from "../../../../core/entities/client-scope/service.mjs";
@@ -107,6 +107,7 @@ import { IdentityProviderRoleMappingController } from "../../../../adapters/http
 import { KeyController } from "../../../../adapters/http/controllers/entities/key/module.mjs";
 import { PermissionController } from "../../../../adapters/http/controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "../../../../adapters/http/controllers/entities/permission-policy/module.mjs";
+import { AccountController } from "../../../../adapters/http/controllers/workflows/account/module.mjs";
 import { ActivateController } from "../../../../adapters/http/controllers/workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "../../../../adapters/http/controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "../../../../adapters/http/controllers/workflows/authorize/module.mjs";
@@ -138,6 +139,7 @@ import { OAuth2InjectionToken } from "../../oauth2/constants.mjs";
 import { IdentityInjectionKey } from "../../identity/constants.mjs";
 import "../../identity/index.mjs";
 import "../../oauth2/index.mjs";
+import { LazyWildcardRealmProvisioner } from "../../provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "../../mail/constants.mjs";
 import "../../mail/index.mjs";
 import { decorators } from "@routup/decorators";
@@ -179,6 +181,7 @@ var HTTPControllerModule = class {
 			this.createLogoutController(container),
 			this.createAuthenticatorChallengeController(container),
 			this.createUserInfoController(container),
+			this.createAccountController(container),
 			this.createStatusController(container),
 			clientController,
 			clientPermissionController,
@@ -253,6 +256,16 @@ var HTTPControllerModule = class {
 			identityResolver,
 			certificateValidator: new ClientCertificateValidator({ trustAnchorRepository: new TrustAnchorRepositoryAdapter(dataSource) })
 		});
+		const eventService = container.resolve(DatabaseInjectionKey.EventService);
+		const metrics = container.resolve(MetricsInjectionKey);
+		const loginThrottleService = new LoginThrottleService({
+			repository: container.resolve(DatabaseInjectionKey.EventRepository),
+			options: {
+				enabled: config.loginAttemptThrottleEnabled,
+				threshold: config.loginAttemptThreshold,
+				windowSeconds: config.loginAttemptWindow
+			}
+		});
 		return new TokenController({
 			codeVerifier,
 			accessTokenIssuer,
@@ -263,16 +276,9 @@ var HTTPControllerModule = class {
 			tokenRevoker,
 			tokenRepository,
 			sessionTokenRepository,
-			eventService: container.resolve(DatabaseInjectionKey.EventService),
-			metrics: container.resolve(MetricsInjectionKey),
-			loginThrottleService: new LoginThrottleService({
-				repository: container.resolve(DatabaseInjectionKey.EventRepository),
-				options: {
-					enabled: config.loginAttemptThrottleEnabled,
-					threshold: config.loginAttemptThreshold,
-					windowSeconds: config.loginAttemptWindow
-				}
-			}),
+			eventService,
+			metrics,
+			loginThrottleService,
 			userAuthenticatorService: this.resolveUserAuthenticatorService(container),
 			mfaLoginService: this.resolveMfaLoginService(container),
 			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),
@@ -288,7 +294,8 @@ var HTTPControllerModule = class {
 		});
 	}
 	createOpenIDController(container) {
-		return new OpenIDController({ baseURL: container.resolve(ConfigInjectionKey).publicUrl });
+		const config = container.resolve(ConfigInjectionKey);
+		return new OpenIDController({ baseURL: config.publicUrl });
 	}
 	createActivateController(container) {
 		const config = container.resolve(ConfigInjectionKey);
@@ -328,9 +335,11 @@ var HTTPControllerModule = class {
 			repository: new UserRepository(dataSource),
 			realmRepository
 		});
+		const mailClient = container.resolve(MailInjectionKey);
+		const mailTemplateRenderer = container.resolve(MailTemplateRendererInjectionKey);
 		return new PasswordRecoveryService({
-			mailClient: container.resolve(MailInjectionKey),
-			mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),
+			mailClient,
+			mailTemplateRenderer,
 			repository,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
 			eventService: container.resolve(DatabaseInjectionKey.EventService),
@@ -354,11 +363,15 @@ var HTTPControllerModule = class {
 	}
 	createLogoutController(container) {
 		const config = container.resolve(ConfigInjectionKey);
+		const tokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);
+		const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);
+		const clientRepository = container.resolve(OAuth2InjectionToken.ClientRepository);
+		const realmRepository = new RealmRepositoryAdapter(container.resolve(RealmEntity));
 		const endSessionService = new OAuth2EndSessionService({
-			tokenVerifier: container.resolve(OAuth2InjectionToken.TokenVerifier),
-			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
-			clientRepository: container.resolve(OAuth2InjectionToken.ClientRepository),
-			realmRepository: new RealmRepositoryAdapter(container.resolve(RealmEntity)),
+			tokenVerifier,
+			sessionManager,
+			clientRepository,
+			realmRepository,
 			eventService: container.resolve(DatabaseInjectionKey.EventService),
 			hintGracePeriod: config.endSessionHintGracePeriod
 		});
@@ -371,11 +384,20 @@ var HTTPControllerModule = class {
 		const config = container.resolve(ConfigInjectionKey);
 		return new StatusController({ options: { features: this.buildUIFeatures(config) } });
 	}
+	createAccountController(container) {
+		const config = container.resolve(ConfigInjectionKey);
+		return new AccountController({ options: {
+			baseURL: config.publicUrl,
+			features: this.buildUIFeatures(config),
+			trustedOrigins: getAppOrigins(config)
+		} });
+	}
 	buildUIFeatures(config) {
 		return {
 			registration: config.registrationEnabled,
 			passwordRecovery: config.passwordRecoveryEnabled,
-			emailVerification: config.emailVerificationEnabled
+			emailVerification: config.emailVerificationEnabled,
+			accountConsole: config.accountConsoleEnabled
 		};
 	}
 	createRegistrationService(container) {
@@ -386,9 +408,11 @@ var HTTPControllerModule = class {
 			repository: new UserRepository(dataSource),
 			realmRepository
 		});
+		const mailClient = container.resolve(MailInjectionKey);
+		const mailTemplateRenderer = container.resolve(MailTemplateRendererInjectionKey);
 		return new RegistrationService({
-			mailClient: container.resolve(MailInjectionKey),
-			mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),
+			mailClient,
+			mailTemplateRenderer,
 			repository,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
 			eventService: container.resolve(DatabaseInjectionKey.EventService),
@@ -430,11 +454,13 @@ var HTTPControllerModule = class {
 			repository: container.resolve(ClientEntity),
 			realmRepository
 		});
+		const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);
+		const service = new ClientService({
+			repository,
+			realmRepository: realmRepositoryAdapter
+		});
 		return new ClientController({
-			service: new ClientService({
-				repository,
-				realmRepository: new RealmRepositoryAdapter(realmRepository)
-			}),
+			service,
 			repository
 		});
 	}
@@ -458,103 +484,137 @@ var HTTPControllerModule = class {
 			realmRepository
 		});
 		const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);
+		const roleRepository = new RoleRepositoryAdapter({
+			repository: container.resolve(RoleEntity),
+			realmRepository
+		});
+		const rolePermissionRepository = new RolePermissionRepositoryAdapter(container.resolve(RolePermissionEntity));
+		const policyRepository = new PolicyRepositoryAdapter({
+			repository: new PolicyRepository(dataSource),
+			realmRepository
+		});
+		const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity));
 		const service = new PermissionService({
 			repository,
 			realmRepository: realmRepositoryAdapter,
-			roleRepository: new RoleRepositoryAdapter({
-				repository: container.resolve(RoleEntity),
-				realmRepository
-			}),
-			rolePermissionRepository: new RolePermissionRepositoryAdapter(container.resolve(RolePermissionEntity)),
-			policyRepository: new PolicyRepositoryAdapter({
-				repository: new PolicyRepository(dataSource),
-				realmRepository
-			}),
-			permissionPolicyRepository: new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity))
+			roleRepository,
+			rolePermissionRepository,
+			policyRepository,
+			permissionPolicyRepository
 		});
 		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const permissionProvider = new PermissionDatabaseProvider(dataSource);
+		const checkerService = new PermissionCheckerService({
+			repository,
+			realmRepository: realmRepositoryAdapter,
+			permissionProvider,
+			identityPermissionProvider
+		});
 		return new PermissionController({
 			service,
-			checkerService: new PermissionCheckerService({
-				repository,
-				realmRepository: realmRepositoryAdapter,
-				permissionProvider: new PermissionDatabaseProvider(dataSource),
-				identityPermissionProvider
-			})
+			checkerService
 		});
 	}
 	createRoleController(container) {
 		const realmRepository = new RealmRepositoryAdapter(container.resolve(RealmEntity));
-		return new RoleController({ service: new RoleService({
-			repository: new RoleRepositoryAdapter({
-				repository: container.resolve(RoleEntity),
-				realmRepository: container.resolve(RealmEntity)
-			}),
+		const repository = new RoleRepositoryAdapter({
+			repository: container.resolve(RoleEntity),
+			realmRepository: container.resolve(RealmEntity)
+		});
+		const service = new RoleService({
+			repository,
 			realmRepository
-		}) });
+		});
+		return new RoleController({ service });
 	}
 	createClientPermissionController(container) {
-		return new ClientPermissionController({ service: new ClientPermissionService({
-			repository: new ClientPermissionRepositoryAdapter(container.resolve(ClientPermissionEntity)),
-			permissionRepository: this.createPermissionRepository(container),
-			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-		}) });
+		const repository = new ClientPermissionRepositoryAdapter(container.resolve(ClientPermissionEntity));
+		const permissionRepository = this.createPermissionRepository(container);
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const service = new ClientPermissionService({
+			repository,
+			permissionRepository,
+			identityPermissionProvider
+		});
+		return new ClientPermissionController({ service });
 	}
 	createClientRoleController(container) {
-		return new ClientRoleController({ service: new ClientRoleService({
-			repository: new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity)),
-			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-		}) });
+		const repository = new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity));
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const service = new ClientRoleService({
+			repository,
+			identityPermissionProvider
+		});
+		return new ClientRoleController({ service });
 	}
 	createClientScopeController(container) {
-		return new ClientScopeController({ service: new ClientScopeService({ repository: new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity)) }) });
+		const repository = new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity));
+		const service = new ClientScopeService({ repository });
+		return new ClientScopeController({ service });
 	}
 	createRoleAttributeController(container) {
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
-		return new RoleAttributeController({ service: new RoleAttributeService({
-			repository: new RoleAttributeRepositoryAdapter(container.resolve(RoleAttributeEntity)),
-			reservedNames: new Set(dataSource.getMetadata(RoleEntity).columns.map((c) => c.propertyName))
-		}) });
+		const repository = new RoleAttributeRepositoryAdapter(container.resolve(RoleAttributeEntity));
+		const reservedNames = new Set(dataSource.getMetadata(RoleEntity).columns.map((c) => c.propertyName));
+		const service = new RoleAttributeService({
+			repository,
+			reservedNames
+		});
+		return new RoleAttributeController({ service });
 	}
 	createRolePermissionController(container) {
-		return new RolePermissionController({ service: new RolePermissionService({
-			repository: new RolePermissionRepositoryAdapter(container.resolve(RolePermissionEntity)),
-			permissionRepository: this.createPermissionRepository(container),
-			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-		}) });
+		const repository = new RolePermissionRepositoryAdapter(container.resolve(RolePermissionEntity));
+		const permissionRepository = this.createPermissionRepository(container);
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const service = new RolePermissionService({
+			repository,
+			permissionRepository,
+			identityPermissionProvider
+		});
+		return new RolePermissionController({ service });
 	}
 	createPermissionPolicyController(container) {
-		return new PermissionPolicyController({ service: new PermissionPolicyService({ repository: new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity)) }) });
+		const repository = new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity));
+		const service = new PermissionPolicyService({ repository });
+		return new PermissionPolicyController({ service });
 	}
 	createScopeController(container) {
 		const realmRepository = new RealmRepositoryAdapter(container.resolve(RealmEntity));
-		return new ScopeController({ service: new ScopeService({
-			repository: new ScopeRepositoryAdapter({
-				repository: container.resolve(ScopeEntity),
-				realmRepository: container.resolve(RealmEntity)
-			}),
+		const repository = new ScopeRepositoryAdapter({
+			repository: container.resolve(ScopeEntity),
+			realmRepository: container.resolve(RealmEntity)
+		});
+		const service = new ScopeService({
+			repository,
 			realmRepository
-		}) });
+		});
+		return new ScopeController({ service });
 	}
 	createKeyController(container) {
-		return new KeyController({ service: new KeyService({
+		const service = new KeyService({
 			repository: container.resolve(OAuth2InjectionToken.KeyStore),
 			eventService: container.resolve(DatabaseInjectionKey.EventService),
 			requestContext: useRequestEventContext
-		}) });
+		});
+		return new KeyController({ service });
 	}
 	createTrustAnchorController(container) {
-		return new TrustAnchorController({ service: new TrustAnchorService({
-			repository: new TrustAnchorRepositoryAdapter(container.resolve(DatabaseInjectionKey.DataSource)),
+		const repository = new TrustAnchorRepositoryAdapter(container.resolve(DatabaseInjectionKey.DataSource));
+		const service = new TrustAnchorService({
+			repository,
 			eventService: container.resolve(DatabaseInjectionKey.EventService),
 			requestContext: useRequestEventContext
-		}) });
+		});
+		return new TrustAnchorController({ service });
 	}
 	createSessionController(container) {
-		return new SessionController({ service: new SessionService({ repository: container.resolve(AuthenticationInjectionKey.SessionRepository) }) });
+		const repository = container.resolve(AuthenticationInjectionKey.SessionRepository);
+		const service = new SessionService({ repository });
+		return new SessionController({ service });
 	}
 	createConsentService(container) {
-		return new ConsentService({ repository: container.resolve(OAuth2InjectionToken.ConsentRepository) });
+		const repository = container.resolve(OAuth2InjectionToken.ConsentRepository);
+		return new ConsentService({ repository });
 	}
 	createConsentController(container) {
 		return new ConsentController({ service: this.createConsentService(container) });
@@ -636,18 +696,21 @@ var HTTPControllerModule = class {
 		});
 	}
 	createEventController(container) {
-		return new EventController({ service: container.resolve(DatabaseInjectionKey.EventService) });
+		const service = container.resolve(DatabaseInjectionKey.EventService);
+		return new EventController({ service });
 	}
 	createUserService(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const realmRepository = container.resolve(RealmEntity);
+		const repository = new UserRepositoryAdapter({
+			repository: new UserRepository(dataSource),
+			realmRepository
+		});
+		const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);
 		return new UserService({
-			repository: new UserRepositoryAdapter({
-				repository: new UserRepository(dataSource),
-				realmRepository
-			}),
-			realmRepository: new RealmRepositoryAdapter(realmRepository),
+			repository,
+			realmRepository: realmRepositoryAdapter,
 			passwordMinLength: config.passwordMinLength
 		});
 	}
@@ -659,23 +722,33 @@ var HTTPControllerModule = class {
 	}
 	createUserAttributeController(container) {
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
-		return new UserAttributeController({ service: new UserAttributeService({
-			repository: new UserAttributeRepositoryAdapter(container.resolve(UserAttributeEntity)),
-			reservedNames: new Set(dataSource.getMetadata(UserEntity).columns.map((c) => c.propertyName))
-		}) });
+		const repository = new UserAttributeRepositoryAdapter(container.resolve(UserAttributeEntity));
+		const reservedNames = new Set(dataSource.getMetadata(UserEntity).columns.map((c) => c.propertyName));
+		const service = new UserAttributeService({
+			repository,
+			reservedNames
+		});
+		return new UserAttributeController({ service });
 	}
 	createUserPermissionController(container) {
-		return new UserPermissionController({ service: new UserPermissionService({
-			repository: new UserPermissionRepositoryAdapter(container.resolve(UserPermissionEntity)),
-			permissionRepository: this.createPermissionRepository(container),
-			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-		}) });
+		const repository = new UserPermissionRepositoryAdapter(container.resolve(UserPermissionEntity));
+		const permissionRepository = this.createPermissionRepository(container);
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const service = new UserPermissionService({
+			repository,
+			permissionRepository,
+			identityPermissionProvider
+		});
+		return new UserPermissionController({ service });
 	}
 	createUserRoleController(container) {
-		return new UserRoleController({ service: new UserRoleService({
-			repository: new UserRoleRepositoryAdapter(container.resolve(UserRoleEntity)),
-			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-		}) });
+		const repository = new UserRoleRepositoryAdapter(container.resolve(UserRoleEntity));
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const service = new UserRoleService({
+			repository,
+			identityPermissionProvider
+		});
+		return new UserRoleController({ service });
 	}
 	createPolicyController(container) {
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
@@ -685,27 +758,35 @@ var HTTPControllerModule = class {
 			realmRepository
 		});
 		const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);
+		const service = new PolicyService({
+			repository,
+			realmRepository: realmRepositoryAdapter
+		});
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const checkerService = new PolicyCheckerService({
+			repository,
+			realmRepository: realmRepositoryAdapter,
+			identityPermissionProvider
+		});
 		return new PolicyController({
-			service: new PolicyService({
-				repository,
-				realmRepository: realmRepositoryAdapter
-			}),
-			checkerService: new PolicyCheckerService({
-				repository,
-				realmRepository: realmRepositoryAdapter,
-				identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-			})
+			service,
+			checkerService
 		});
 	}
 	createIdentityProviderRoleController(container) {
-		return new IdentityProviderRoleMappingController({ service: new IdentityProviderRoleMappingService({
-			repository: new IdentityProviderRoleMappingRepositoryAdapter(container.resolve(IdentityProviderRoleMappingEntity)),
-			roleRepository: this.createRoleRepository(container),
-			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider)
-		}) });
+		const repository = new IdentityProviderRoleMappingRepositoryAdapter(container.resolve(IdentityProviderRoleMappingEntity));
+		const roleRepository = this.createRoleRepository(container);
+		const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);
+		const service = new IdentityProviderRoleMappingService({
+			repository,
+			roleRepository,
+			identityPermissionProvider
+		});
+		return new IdentityProviderRoleMappingController({ service });
 	}
 	createJwkController(container) {
-		return new JwkController({ repository: container.resolve(DatabaseInjectionKey.DataSource).getRepository(KeyEntity) });
+		const repository = container.resolve(DatabaseInjectionKey.DataSource).getRepository(KeyEntity);
+		return new JwkController({ repository });
 	}
 	createRealmController(container) {
 		const config = container.resolve(ConfigInjectionKey);
@@ -717,22 +798,27 @@ var HTTPControllerModule = class {
 			realmRepository
 		});
 		const logger = container.resolve(LoggerInjectionKey);
+		const systemClientProvisioner = new SystemClientProvisioner({
+			clientRepository,
+			scopeRepository: new ScopeRepositoryAdapter({
+				repository: container.resolve(ScopeEntity),
+				realmRepository
+			}),
+			clientScopeRepository: new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity)),
+			appOrigins: getAppOrigins(config),
+			logger
+		});
+		const keyProvisioner = new KeyProvisioner({
+			keyStore: container.resolve(OAuth2InjectionToken.KeyStore),
+			logger
+		});
 		const service = new RealmService({
 			repository,
-			webClientProvisioner: new WebClientProvisioner({
-				clientRepository,
-				scopeRepository: new ScopeRepositoryAdapter({
-					repository: container.resolve(ScopeEntity),
-					realmRepository
-				}),
-				clientScopeRepository: new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity)),
-				appOrigins: getAppOrigins(config),
-				logger
-			}),
-			keyProvisioner: new KeyProvisioner({
-				keyStore: container.resolve(OAuth2InjectionToken.KeyStore),
-				logger
-			}),
+			realmProvisioners: [
+				systemClientProvisioner,
+				keyProvisioner,
+				new LazyWildcardRealmProvisioner(container)
+			],
 			logger
 		});
 		const keyRepository = dataSource.getRepository(KeyEntity);