@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.59

package/dist/app/index.mjs

@@ -57,6 +57,8 @@ import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
 import { IdentityModule } from "./modules/identity/module.mjs";
 import { OAuth2Module } from "./modules/oauth2/module.mjs";
+import { ProvisioningInjectionKey } from "./modules/provisioning/constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./modules/provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./modules/mail/constants.mjs";
 import { MailModule } from "./modules/mail/module.mjs";
 import { HTTPModule } from "./modules/http/module.mjs";
@@ -68,4 +70,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/config/constants.d.ts

@@ -4,6 +4,10 @@ export declare const ConfigInjectionKey: TypedToken<Config>;
 export declare enum ConfigEnvironmentVariableName {
     NODE_ENV = "NODE_ENV",
     WRITABLE_DIRECTORY_PATH = "WRITABLE_DIRECTORY_PATH",
+    THEME_DIRECTORY_PATH = "THEME_DIRECTORY_PATH",
+    THEME_FRAGMENTS_ENABLED = "THEME_FRAGMENTS_ENABLED",
+    AUTH_CONSOLE_PATH = "AUTH_CONSOLE_PATH",
+    ACCOUNT_CONSOLE_PATH = "ACCOUNT_CONSOLE_PATH",
     REDIS = "REDIS",
     SMTP = "SMTP",
     HOST = "HOST",
@@ -22,6 +26,7 @@ export declare enum ConfigEnvironmentVariableName {
     EMAIL_VERIFICATION_ENABLED = "EMAIL_VERIFICATION_ENABLED",
     PASSWORD_RECOVERY_ENABLED = "PASSWORD_RECOVERY_ENABLED",
     PASSWORD_MIN_LENGTH = "PASSWORD_MIN_LENGTH",
+    ACCOUNT_CONSOLE_ENABLED = "ACCOUNT_CONSOLE_ENABLED",
     EVENT_LOG_ENABLED = "EVENT_LOG_ENABLED",
     EVENT_LOG_RETENTION_DAYS = "EVENT_LOG_RETENTION_DAYS",
     EVENT_LOG_ENTITY_ENABLED = "EVENT_LOG_ENTITY_ENABLED",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAC7C,uBAAuB,4BAA4B;IACnD,iBAAiB,sBAAsB;IACvC,oBAAoB,yBAAyB;IAE7C,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAC3C,uBAAuB,4BAA4B;IAEnD,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -7,6 +7,10 @@ const ConfigInjectionKey = new TypedToken("Config");
 var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVariableName) {
 	ConfigEnvironmentVariableName["NODE_ENV"] = "NODE_ENV";
 	ConfigEnvironmentVariableName["WRITABLE_DIRECTORY_PATH"] = "WRITABLE_DIRECTORY_PATH";
+	ConfigEnvironmentVariableName["THEME_DIRECTORY_PATH"] = "THEME_DIRECTORY_PATH";
+	ConfigEnvironmentVariableName["THEME_FRAGMENTS_ENABLED"] = "THEME_FRAGMENTS_ENABLED";
+	ConfigEnvironmentVariableName["AUTH_CONSOLE_PATH"] = "AUTH_CONSOLE_PATH";
+	ConfigEnvironmentVariableName["ACCOUNT_CONSOLE_PATH"] = "ACCOUNT_CONSOLE_PATH";
 	ConfigEnvironmentVariableName["REDIS"] = "REDIS";
 	ConfigEnvironmentVariableName["SMTP"] = "SMTP";
 	ConfigEnvironmentVariableName["HOST"] = "HOST";
@@ -25,6 +29,7 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["EMAIL_VERIFICATION_ENABLED"] = "EMAIL_VERIFICATION_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_RECOVERY_ENABLED"] = "PASSWORD_RECOVERY_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_MIN_LENGTH"] = "PASSWORD_MIN_LENGTH";
+	ConfigEnvironmentVariableName["ACCOUNT_CONSOLE_ENABLED"] = "ACCOUNT_CONSOLE_ENABLED";
 	ConfigEnvironmentVariableName["EVENT_LOG_ENABLED"] = "EVENT_LOG_ENABLED";
 	ConfigEnvironmentVariableName["EVENT_LOG_RETENTION_DAYS"] = "EVENT_LOG_RETENTION_DAYS";
 	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_ENABLED"] = "EVENT_LOG_ENTITY_ENABLED";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUST_PROXY = 'TRUST_PROXY',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAmDX,EAAA,CAAA,CAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n    THEME_DIRECTORY_PATH = 'THEME_DIRECTORY_PATH',\n    THEME_FRAGMENTS_ENABLED = 'THEME_FRAGMENTS_ENABLED',\n    AUTH_CONSOLE_PATH = 'AUTH_CONSOLE_PATH',\n    ACCOUNT_CONSOLE_PATH = 'ACCOUNT_CONSOLE_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUST_PROXY = 'TRUST_PROXY',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n    ACCOUNT_CONSOLE_ENABLED = 'ACCOUNT_CONSOLE_ENABLED',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAwDX,EAAA,CAAA,CAAA"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiK9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0L9E"}

package/dist/app/modules/config/normalize.mjs

@@ -39,6 +39,10 @@ async function normalizeConfig(input = {}) {
 		env,
 		rootPath: process.cwd(),
 		writableDirectoryPath,
+		themeDirectoryPath: "",
+		themeFragmentsEnabled: false,
+		authConsolePath: "",
+		accountConsolePath: "",
 		logger: true,
 		redis: false,
 		smtp: false,
@@ -64,6 +68,7 @@ async function normalizeConfig(input = {}) {
 		emailVerificationEnabled: false,
 		passwordRecoveryEnabled: false,
 		passwordMinLength: USER_PASSWORD_MIN_LENGTH,
+		accountConsoleEnabled: true,
 		eventLogEnabled: true,
 		eventLogRetentionDays: 90,
 		eventLogEntityEnabled: true,
@@ -89,6 +94,9 @@ async function normalizeConfig(input = {}) {
 		...parsed,
 		trustedOrigins
 	};
+	if (config.themeDirectoryPath) config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);
+	if (config.authConsolePath) config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);
+	if (config.accountConsolePath) config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);
 	if (typeof config.trustProxy === "string") config.trustProxy = canonicalizeTrustProxy(config.trustProxy);
 	else if (Array.isArray(config.trustProxy)) config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);
 	if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) throw new AuthupError("loginAttemptThrottleEnabled requires eventLogEnabled.");

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAEAmB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENlB;EACAC;EACAC;EACAiB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBrD;EAEnBsD,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG/D;EAIHW;CACJ;CAMA,IAAI,OAAOO,OAAOO,eAAe,UAC7BP,OAAOO,aAAa7B,uBAAuBsB,OAAOO,UAAU;MACzD,IAAIuC,MAAMC,QAAQ/C,OAAOO,UAAU,GACtCP,OAAOO,aAAaP,OAAOO,WAAWyC,IAAIrE,+BAAAA;CAK9C,IAAIqB,OAAO4B,+BAA+B,CAAC5B,OAAOwB,iBAC9C,MAAM,IAAIrD,YAAY,uDAAA;CAG1B,IAAI6B,OAAOiC,eAAe,CAACjC,OAAOgC,YAC9B,MAAM,IAAI7D,YAAY,kCAAA;CAG1B,IAAI6B,OAAOK,iBAAiBL,OAAOM,sBAAsB,YACrD,MAAM,IAAInC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAO+B,sBAAsB;EAC7B,IAAIkB,aAAa;EACjB,IAAI;GACAA,aAAa5E,oBAAoB2B,OAAO+B,qBAAqBmB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAI9E,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","resolve","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-admin-console runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n        // '' = theming disabled. Deliberately NOT defaulted under\n        // writableDirectoryPath: that directory is process-writable, and\n        // pairing \"process-writable\" with \"content injected into the login\n        // page\" would turn any write primitive landing there into\n        // persistent branding control on the IdP origin.\n        themeDirectoryPath: '',\n        themeFragmentsEnabled: false,\n        authConsolePath: '',\n        accountConsolePath: '',\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n        accountConsoleEnabled: true,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // After the spread, so a relative value supplied by any config surface\n    // is resolved. Every consumer then receives an absolute path and none\n    // of them has to care what the process cwd was.\n    if (config.themeDirectoryPath) {\n        config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);\n    }\n\n    if (config.authConsolePath) {\n        config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);\n    }\n\n    if (config.accountConsolePath) {\n        config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);\n    }\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAMAmB,oBAAoB;EACpBC,uBAAuB;EACvBC,iBAAiB;EACjBC,oBAAoB;EAEpBC,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENtB;EACAC;EACAC;EACAqB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBzD;EACnB0D,uBAAuB;EAEvBC,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGpE;EAIHW;CACJ;CAKA,IAAIO,OAAOE,oBACPF,OAAOE,qBAAqBlC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOE,kBAAkB;CAGvF,IAAIF,OAAOI,iBACPJ,OAAOI,kBAAkBpC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOI,eAAe;CAGjF,IAAIJ,OAAOK,oBACPL,OAAOK,qBAAqBrC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOK,kBAAkB;CAOvF,IAAI,OAAOL,OAAOW,eAAe,UAC7BX,OAAOW,aAAajC,uBAAuBsB,OAAOW,UAAU;MACzD,IAAIyC,MAAMC,QAAQrD,OAAOW,UAAU,GACtCX,OAAOW,aAAaX,OAAOW,WAAW2C,IAAI3E,+BAAAA;CAK9C,IAAIqB,OAAOiC,+BAA+B,CAACjC,OAAO6B,iBAC9C,MAAM,IAAI1D,YAAY,uDAAA;CAG1B,IAAI6B,OAAOsC,eAAe,CAACtC,OAAOqC,YAC9B,MAAM,IAAIlE,YAAY,kCAAA;CAG1B,IAAI6B,OAAOS,iBAAiBT,OAAOU,sBAAsB,YACrD,MAAM,IAAIvC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAOoC,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAalF,oBAAoB2B,OAAOoC,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAIpF,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}

package/dist/app/modules/config/origins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAcvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}

package/dist/app/modules/config/origins.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { patternHasGlobstarInAuthority } from "@authup/kit";
 import { URL } from "node:url";
 //#region src/app/modules/config/origins.ts
 const SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\/\//i;
@@ -19,6 +20,7 @@ const ALLOWED_PROTOCOLS = ["http:", "https:"];
 *
 * Throws on values that don't parse as a URL/host or use another scheme.
 */ function expandToOrigins(value) {
+	if (patternHasGlobstarInAuthority(value)) throw new Error(`A trusted origin must not use ** in the host, it would match every origin. Use a single * for a host wildcard, got: ${value}`);
 	if (SCHEME_REGEX.test(value)) {
 		const url = new URL(value);
 		if (!ALLOWED_PROTOCOLS.includes(url.protocol)) throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);

package/dist/app/modules/config/origins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"origins.mjs","names":["URL","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","test","url","includes","protocol","Error","origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/**\n * Expand a configured trusted-origin value to its canonical origin(s).\n *\n * A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n *\n * Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n *\n * Throws on values that don't parse as a URL/host or use another scheme.\n */\nexport function expandToOrigins(value: string): string[] {\n    if (SCHEME_REGEX.test(value)) {\n        const url = new URL(value);\n        if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n            throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n        }\n\n        return [url.origin];\n    }\n\n    return [\n        new URL(`http://${value}`).origin,\n        new URL(`https://${value}`).origin,\n    ];\n}\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[] {\n    const origins = new Set<string>();\n    origins.add(new URL(config.publicUrl).origin);\n\n    for (const origin of config.trustedOrigins ?? []) {\n        origins.add(origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;AAUA,MAAMC,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAS;;;;;;;;;;;;;;GAgB7C,SAAgBC,gBAAgBC,OAAa;CACzC,IAAIH,aAAaI,KAAKD,KAAAA,GAAQ;EAC1B,MAAME,MAAM,IAAIN,IAAII,KAAAA;EACpB,IAAI,CAACF,kBAAkBK,SAASD,IAAIE,QAAQ,GACxC,MAAM,IAAIC,MAAM,8DAA8DH,IAAIE,UAAU;EAGhG,OAAO,CAACF,IAAII,MAAO;CACvB;CAEA,OAAO,CACH,IAAIV,IAAI,UAAUI,OAAO,CAAA,CAAEM,QAC3B,IAAIV,IAAI,WAAWI,OAAO,CAAA,CAAEM,MAC/B;AACL;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIf,IAAIY,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}
+{"version":3,"file":"origins.mjs","names":["URL","patternHasGlobstarInAuthority","SCHEME_REGEX","ALLOWED_PROTOCOLS","expandToOrigins","value","Error","test","url","includes","protocol","origin","getAppOrigins","config","origins","Set","add","publicUrl","trustedOrigins","Array","from"],"sources":["../../../../src/app/modules/config/origins.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { URL } from 'node:url';\nimport { patternHasGlobstarInAuthority } from '@authup/kit';\nimport type { Config } from './types.ts';\n\nconst SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\nconst ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\n/**\n * Expand a configured trusted-origin value to its canonical origin(s).\n *\n * A value with an explicit scheme contributes exactly that origin —\n * the way to restrict a host to https only. A bare host[:port]\n * (e.g. `hub.local`) contributes both the http and https origin.\n *\n * Only http(s) is accepted: other schemes either have no usable web\n * origin (`new URL('myapp://x').origin` is the literal string \"null\")\n * or are meaningless as a redirect target for the web client — letting\n * them through would put garbage into a security-sensitive allowlist.\n *\n * Throws on values that don't parse as a URL/host or use another scheme.\n */\nexport function expandToOrigins(value: string): string[] {\n    // `new URL()` accepts `*` and `**` as a hostname, and every trusted origin\n    // becomes an `<origin>/**` redirect pattern for the system clients. A `**`\n    // there matches the rest of the value outright, so a single typo would\n    // turn the redirect allowlist of every realm's console clients into\n    // allow-any-origin. A single `*` is a supported host wildcard.\n    if (patternHasGlobstarInAuthority(value)) {\n        throw new Error(`A trusted origin must not use ** in the host, it would match every origin. Use a single * for a host wildcard, got: ${value}`);\n    }\n\n    if (SCHEME_REGEX.test(value)) {\n        const url = new URL(value);\n        if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n            throw new Error(`A trusted origin must use the http or https protocol, got: ${url.protocol}`);\n        }\n\n        return [url.origin];\n    }\n\n    return [\n        new URL(`http://${value}`).origin,\n        new URL(`https://${value}`).origin,\n    ];\n}\n\n/**\n * Derive the set of trusted application origins (scheme://host[:port]).\n *\n * publicUrl may carry a path, so its origin is extracted; trustedOrigins\n * entries are canonical origins — normalizeConfig owns that invariant\n * (expansion + dedupe via expandToOrigins) — and are merged verbatim.\n */\nexport function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[] {\n    const origins = new Set<string>();\n    origins.add(new URL(config.publicUrl).origin);\n\n    for (const origin of config.trustedOrigins ?? []) {\n        origins.add(origin);\n    }\n\n    return Array.from(origins);\n}\n"],"mappings":";;;;;;AAWA,MAAME,eAAe;AAErB,MAAMC,oBAAoB,CAAC,SAAS,QAAS;;;;;;;;;;;;;;GAgB7C,SAAgBC,gBAAgBC,OAAa;CAMzC,IAAIJ,8BAA8BI,KAAAA,GAC9B,MAAM,IAAIC,MAAM,uHAAuHD,OAAO;CAGlJ,IAAIH,aAAaK,KAAKF,KAAAA,GAAQ;EAC1B,MAAMG,MAAM,IAAIR,IAAIK,KAAAA;EACpB,IAAI,CAACF,kBAAkBM,SAASD,IAAIE,QAAQ,GACxC,MAAM,IAAIJ,MAAM,8DAA8DE,IAAIE,UAAU;EAGhG,OAAO,CAACF,IAAIG,MAAO;CACvB;CAEA,OAAO,CACH,IAAIX,IAAI,UAAUK,OAAO,CAAA,CAAEM,QAC3B,IAAIX,IAAI,WAAWK,OAAO,CAAA,CAAEM,MAC/B;AACL;;;;;;;GASA,SAAgBC,cAAcC,QAAoD;CAC9E,MAAMC,0BAAU,IAAIC,IAAAA;CACpBD,QAAQE,IAAI,IAAIhB,IAAIa,OAAOI,SAAS,CAAA,CAAEN,MAAM;CAE5C,KAAK,MAAMA,UAAUE,OAAOK,kBAAkB,CAAA,GAC1CJ,QAAQE,IAAIL,MAAAA;CAGhB,OAAOQ,MAAMC,KAAKN,OAAAA;AACtB"}

package/dist/app/modules/config/read/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CAmPnD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/config/read/env.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C,wBAAgB,oBAAoB,IAAK,WAAW,CA4QnD"}

package/dist/app/modules/config/read/env.mjs

@@ -40,6 +40,14 @@ function readConfigRawFromEnv() {
 	if (env) options.env = env;
 	const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);
 	if (writableDirectoryPath) options.writableDirectoryPath = writableDirectoryPath;
+	const themeDirectoryPath = read(ConfigEnvironmentVariableName.THEME_DIRECTORY_PATH);
+	if (themeDirectoryPath) options.themeDirectoryPath = themeDirectoryPath;
+	const themeFragmentsEnabled = readBool(ConfigEnvironmentVariableName.THEME_FRAGMENTS_ENABLED);
+	if (typeof themeFragmentsEnabled !== "undefined") options.themeFragmentsEnabled = themeFragmentsEnabled;
+	const authConsolePath = read(ConfigEnvironmentVariableName.AUTH_CONSOLE_PATH);
+	if (authConsolePath) options.authConsolePath = authConsolePath;
+	const accountConsolePath = read(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_PATH);
+	if (accountConsolePath) options.accountConsolePath = accountConsolePath;
 	if (hasEnvDataSourceOptions()) options.db = readDataSourceOptionsFromEnv();
 	const redis = oneOf([readBool(ConfigEnvironmentVariableName.REDIS), read(ConfigEnvironmentVariableName.REDIS)]);
 	if (typeof redis !== "undefined") options.redis = redis;
@@ -77,6 +85,8 @@ function readConfigRawFromEnv() {
 	if (typeof passwordRecoveryEnabled !== "undefined") options.passwordRecoveryEnabled = passwordRecoveryEnabled;
 	const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);
 	if (typeof passwordMinLength !== "undefined") options.passwordMinLength = passwordMinLength;
+	const accountConsoleEnabled = readBool(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_ENABLED);
+	if (typeof accountConsoleEnabled !== "undefined") options.accountConsoleEnabled = accountConsoleEnabled;
 	const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);
 	if (typeof eventLogEnabled !== "undefined") options.eventLogEnabled = eventLogEnabled;
 	const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);

package/dist/app/modules/config/read/env.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    // canonicalized again in normalizeConfig for every config surface; the\n    // env read keeps the raw string, the shared canonicalizer decides.\n    const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n    if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n        options.trustProxy = trustProxy;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAKpC,IAAIpB,wBAAAA,GAEAiB,QAAQK,KAAKrB,6BAAAA;CAKjB,MAAMsB,QAAQ5B,MAAM,CAChBG,SAASI,8BAA8BsB,KAAK,GAC5C5B,KAAKM,8BAA8BsB,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBN,QAAQM,QAAQA;CAGpB,MAAME,OAAO9B,MAAM,CACfG,SAASI,8BAA8BwB,IAAI,GAC3C9B,KAAKM,8BAA8BwB,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBR,QAAQQ,OAAOA;CAKnB,MAAME,OAAO/B,KAAKM,8BAA8B0B,IAAI;CACpD,IAAID,MACAV,QAAQU,OAAOA;CAGnB,MAAME,OAAO9B,QAAQG,8BAA8B4B,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBZ,QAAQY,OAAOA;CAGnB,MAAME,YAAYnC,KAAKM,8BAA8B8B,UAAU;CAC/D,IAAID,WACAd,QAAQgB,YAAYF;CAGxB,MAAMG,gBAAgBtC,KAAKM,8BAA8BiC,eAAe;CACxE,IAAID,eACAjB,QAAQmB,gBAAgBF;CAG5B,MAAMG,oBAAoBzC,KAAKM,8BAA8BoC,kBAAkB;CAC/E,IAAID,mBACApB,QAAQoB,oBAAoBA;CAKhC,MAAME,aAAa3C,KAAKM,8BAA8BsC,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAW9B,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQsB,aAAaA;CAGzB,MAAME,iBAAiB5C,UAAUK,8BAA8BwC,eAAe;CAC9E,IAAID,kBAAkBA,eAAe/B,SAAS,GAC1CO,QAAQwB,iBAAiBA;CAG7B,MAAME,oBAAoB5C,QAAQG,8BAA8B0C,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7B1B,QAAQ0B,oBAAoBA;CAGhC,MAAME,qBAAqB9C,QAAQG,8BAA8B4C,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B5B,QAAQ4B,qBAAqBA;CAGjC,MAAME,0BAA0BhD,QAAQG,8BAA8B8C,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnC9B,QAAQ8B,0BAA0BA;CAGtC,MAAME,oBAAoBlD,QAAQG,8BAA8BgD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BhC,QAAQgC,oBAAoBA;CAGhC,MAAME,4BAA4BpD,QAAQG,8BAA8BkD,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrClC,QAAQkC,4BAA4BA;CAGxC,MAAME,sBAAsBvD,SAASI,8BAA8BoD,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/BpC,QAAQoC,sBAAsBA;CAGlC,MAAME,2BAA2BzD,SAASI,8BAA8BsD,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpCtC,QAAQsC,2BAA2BA;CAGvC,MAAME,0BAA0B3D,SAASI,8BAA8BwD,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnCxC,QAAQwC,0BAA0BA;CAGtC,MAAME,oBAAoB5D,QAAQG,8BAA8B0D,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7B1C,QAAQ0C,oBAAoBA;CAKhC,MAAME,kBAAkBvD,eAAeJ,8BAA8B4D,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3B5C,QAAQ4C,kBAAkBA;CAG9B,MAAME,wBAAwBhE,QAAQG,8BAA8B8D,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjC9C,QAAQ8C,wBAAwBA;CAGpC,MAAME,wBAAwB3D,eAAeJ,8BAA8BgE,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjChD,QAAQgD,wBAAwBA;CAGpC,MAAME,8BAA8BpE,QAAQG,8BAA8BkE,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvClD,QAAQkD,8BAA8BA;CAG1C,MAAME,8BAA8B/D,eAAeJ,8BAA8BoE,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvCpD,QAAQoD,8BAA8BA;CAG1C,MAAME,wBAAwBxE,QAAQG,8BAA8BsE,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjCtD,QAAQsD,wBAAwBA;CAGpC,MAAME,qBAAqB1E,QAAQG,8BAA8BwE,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BxD,QAAQwD,qBAAqBA;CAKjC,MAAME,aAAarE,eAAeJ,8BAA8B0E,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtB1D,QAAQ0D,aAAaA;CAGzB,MAAME,cAAcvE,eAAeJ,8BAA8B4E,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvB5D,QAAQ4D,cAAcA;CAG1B,MAAME,qBAAqBhF,QAAQG,8BAA8B8E,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9B9D,QAAQ8D,qBAAqBA;CAGjC,MAAME,kBAAkBlF,QAAQG,8BAA8BgF,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BhE,QAAQgE,kBAAkBA;CAG9B,MAAME,uBAAuBvF,KAAKM,8BAA8BkF,sBAAsB;CACtF,IAAID,sBACAlE,QAAQkE,uBAAuBA;CAKnC,MAAME,kBAAkBvF,SAASI,8BAA8BoF,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3BpE,QAAQsE,kBAAkBF;CAG9B,MAAMG,sBAAsB1F,SAASI,8BAA8BuF,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BvE,QAAQuE,sBAAsBA;CAGlC,MAAME,oBAAoB9F,KAAKM,8BAA8ByF,oBAAoB;CACjF,IAAID,mBACAzE,QAAQ2E,qBAAqBF;CAGjC,MAAMG,yBAAyB/F,SAASI,8BAA8B4F,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClC5E,QAAQ8E,0BAA0BF;CAKtC,MAAMG,gBAAgBlG,SAASI,8BAA8B+F,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzB/E,QAAQiF,gBAAgBF;CAG5B,MAAMG,mBAAmBrG,SAASI,8BAA8BkG,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5BlF,QAAQkF,mBAAmBA;CAG/B,MAAME,oBAAoBzG,KAAKM,8BAA8BoG,mBAAmB;CAChF,IAAID,mBACApF,QAAQoF,oBAAoBA;CAGhC,MAAME,yBAAyBzG,SAASI,8BAA8BsG,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQsF,yBAAyBA;CAKrC,MAAME,cAAc5G,UAAUK,8BAA8BwG,WAAW;CACvE,IAAID,eAAeA,YAAY/F,SAAS,GACpCO,QAAQwF,cAAcA;CAG1B,MAAME,qCAAqC7G,SAASI,8BAA8B0G,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9C1F,QAAQ0F,qCAAqCA;CAGjD,OAAO1F;AACX"}
+{"version":3,"file":"env.mjs","names":["oneOf","read","readArray","readBool","readInt","hasEnvDataSourceOptions","readDataSourceOptionsFromEnv","ConfigEnvironmentVariableName","BOOLEAN_TRUE_VALUES","Set","BOOLEAN_FALSE_VALUES","readBoolStrict","name","raw","trim","length","undefined","normalized","toLowerCase","has","Error","readConfigRawFromEnv","options","env","NODE_ENV","writableDirectoryPath","WRITABLE_DIRECTORY_PATH","themeDirectoryPath","THEME_DIRECTORY_PATH","themeFragmentsEnabled","THEME_FRAGMENTS_ENABLED","authConsolePath","AUTH_CONSOLE_PATH","accountConsolePath","ACCOUNT_CONSOLE_PATH","db","redis","REDIS","smtp","SMTP","host","HOST","port","PORT","publicURL","PUBLIC_URL","publicUrl","mtlsPublicURL","MTLS_PUBLIC_URL","mtlsPublicUrl","certificateSource","CERTIFICATE_SOURCE","trustProxy","TRUST_PROXY","trustedOrigins","TRUSTED_ORIGINS","tokenAccessMaxAge","TOKEN_ACCESS_MAX_AGE","tokenRefreshMaxAge","TOKEN_REFRESH_MAX_AGE","tokenRefreshGracePeriod","TOKEN_REFRESH_GRACE_PERIOD","promptLoginMaxAge","PROMPT_LOGIN_MAX_AGE","endSessionHintGracePeriod","END_SESSION_HINT_GRACE_PERIOD","registrationEnabled","REGISTRATION_ENABLED","emailVerificationEnabled","EMAIL_VERIFICATION_ENABLED","passwordRecoveryEnabled","PASSWORD_RECOVERY_ENABLED","passwordMinLength","PASSWORD_MIN_LENGTH","accountConsoleEnabled","ACCOUNT_CONSOLE_ENABLED","eventLogEnabled","EVENT_LOG_ENABLED","eventLogRetentionDays","EVENT_LOG_RETENTION_DAYS","eventLogEntityEnabled","EVENT_LOG_ENTITY_ENABLED","eventLogEntityRetentionDays","EVENT_LOG_ENTITY_RETENTION_DAYS","loginAttemptThrottleEnabled","LOGIN_ATTEMPT_THROTTLE_ENABLED","loginAttemptThreshold","LOGIN_ATTEMPT_THRESHOLD","loginAttemptWindow","LOGIN_ATTEMPT_WINDOW","mfaEnabled","MFA_ENABLED","mfaRequired","MFA_REQUIRED","mfaFreshnessMaxAge","MFA_FRESHNESS_MAX_AGE","mfaTicketMaxAge","MFA_TICKET_MAX_AGE","secretsEncryptionKey","SECRETS_ENCRYPTION_KEY","clientBasicAuth","CLIENT_AUTH_BASIC","clientAuthBasic","clientSystemEnabled","CLIENT_SYSTEM_ENABLED","clientAdminSecret","CLIENT_SYSTEM_SECRET","clientSystemSecret","clientAdminSecretReset","CLIENT_SYSTEM_SECRET_RESET","clientSystemSecretReset","userBasicAuth","USER_AUTH_BASIC","userAuthBasic","userAdminEnabled","USER_ADMIN_ENABLED","userAdminPassword","USER_ADMIN_PASSWORD","userAdminPasswordReset","USER_ADMIN_PASSWORD_RESET","permissions","PERMISSIONS","permissionsDefaultPolicyAssignment","PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"],"sources":["../../../../../src/app/modules/config/read/env.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    oneOf,\n    read,\n    readArray,\n    readBool,\n    readInt,\n} from 'envix';\nimport { hasEnvDataSourceOptions, readDataSourceOptionsFromEnv } from 'typeorm-extension';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\n\nimport { ConfigEnvironmentVariableName } from '../constants.ts';\nimport type { ConfigInput } from '../types.ts';\n\nconst BOOLEAN_TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);\nconst BOOLEAN_FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);\n\n/**\n * Boolean env reader that FAILS LOUD on a set-but-unrecognized value instead\n * of silently falling back to the default (envix's `readBool` swallows e.g.\n * `MFA_REQUIRED=yes`). Reserved for security-relevant toggles where a silent\n * default is a weakened posture. Returns `undefined` when the var is unset.\n */\nfunction readBoolStrict(name: ConfigEnvironmentVariableName) : boolean | undefined {\n    const raw = read(name);\n    if (typeof raw !== 'string' || raw.trim().length === 0) {\n        return undefined;\n    }\n\n    const normalized = raw.trim().toLowerCase();\n    if (BOOLEAN_TRUE_VALUES.has(normalized)) {\n        return true;\n    }\n    if (BOOLEAN_FALSE_VALUES.has(normalized)) {\n        return false;\n    }\n\n    throw new Error(`The environment variable ${name} must be a boolean value (received \"${raw}\").`);\n}\n\nexport function readConfigRawFromEnv() : ConfigInput {\n    const options : ConfigInput = {};\n\n    const env = read(ConfigEnvironmentVariableName.NODE_ENV);\n    if (env) {\n        options.env = env;\n    }\n\n    const writableDirectoryPath = read(ConfigEnvironmentVariableName.WRITABLE_DIRECTORY_PATH);\n    if (writableDirectoryPath) {\n        options.writableDirectoryPath = writableDirectoryPath;\n    }\n\n    const themeDirectoryPath = read(ConfigEnvironmentVariableName.THEME_DIRECTORY_PATH);\n    if (themeDirectoryPath) {\n        options.themeDirectoryPath = themeDirectoryPath;\n    }\n\n    const themeFragmentsEnabled = readBool(ConfigEnvironmentVariableName.THEME_FRAGMENTS_ENABLED);\n    if (typeof themeFragmentsEnabled !== 'undefined') {\n        options.themeFragmentsEnabled = themeFragmentsEnabled;\n    }\n\n    const authConsolePath = read(ConfigEnvironmentVariableName.AUTH_CONSOLE_PATH);\n    if (authConsolePath) {\n        options.authConsolePath = authConsolePath;\n    }\n\n    const accountConsolePath = read(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_PATH);\n    if (accountConsolePath) {\n        options.accountConsolePath = accountConsolePath;\n    }\n\n    // -------------------------------------------------------------\n\n    if (hasEnvDataSourceOptions()) {\n        // todo: type casting should be avoided\n        options.db = readDataSourceOptionsFromEnv() as MysqlDataSourceOptions |\n        PostgresDataSourceOptions |\n        BetterSqlite3DataSourceOptions;\n    }\n\n    const redis = oneOf([\n        readBool(ConfigEnvironmentVariableName.REDIS),\n        read(ConfigEnvironmentVariableName.REDIS),\n    ]);\n    if (typeof redis !== 'undefined') {\n        options.redis = redis;\n    }\n\n    const smtp = oneOf([\n        readBool(ConfigEnvironmentVariableName.SMTP),\n        read(ConfigEnvironmentVariableName.SMTP),\n    ]);\n    if (typeof smtp !== 'undefined') {\n        options.smtp = smtp;\n    }\n\n    // -------------------------------------------------------------\n\n    const host = read(ConfigEnvironmentVariableName.HOST);\n    if (host) {\n        options.host = host;\n    }\n\n    const port = readInt(ConfigEnvironmentVariableName.PORT);\n    if (typeof port !== 'undefined') {\n        options.port = port;\n    }\n\n    const publicURL = read(ConfigEnvironmentVariableName.PUBLIC_URL);\n    if (publicURL) {\n        options.publicUrl = publicURL;\n    }\n\n    const mtlsPublicURL = read(ConfigEnvironmentVariableName.MTLS_PUBLIC_URL);\n    if (mtlsPublicURL) {\n        options.mtlsPublicUrl = mtlsPublicURL;\n    }\n\n    const certificateSource = read(ConfigEnvironmentVariableName.CERTIFICATE_SOURCE);\n    if (certificateSource) {\n        options.certificateSource = certificateSource as ConfigInput['certificateSource'];\n    }\n\n    // canonicalized again in normalizeConfig for every config surface; the\n    // env read keeps the raw string, the shared canonicalizer decides.\n    const trustProxy = read(ConfigEnvironmentVariableName.TRUST_PROXY);\n    if (typeof trustProxy === 'string' && trustProxy.trim().length > 0) {\n        options.trustProxy = trustProxy;\n    }\n\n    const trustedOrigins = readArray(ConfigEnvironmentVariableName.TRUSTED_ORIGINS);\n    if (trustedOrigins && trustedOrigins.length > 0) {\n        options.trustedOrigins = trustedOrigins;\n    }\n\n    const tokenAccessMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_ACCESS_MAX_AGE);\n    if (typeof tokenAccessMaxAge !== 'undefined') {\n        options.tokenAccessMaxAge = tokenAccessMaxAge;\n    }\n\n    const tokenRefreshMaxAge = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_MAX_AGE);\n    if (typeof tokenRefreshMaxAge !== 'undefined') {\n        options.tokenRefreshMaxAge = tokenRefreshMaxAge;\n    }\n\n    const tokenRefreshGracePeriod = readInt(ConfigEnvironmentVariableName.TOKEN_REFRESH_GRACE_PERIOD);\n    if (typeof tokenRefreshGracePeriod !== 'undefined') {\n        options.tokenRefreshGracePeriod = tokenRefreshGracePeriod;\n    }\n\n    const promptLoginMaxAge = readInt(ConfigEnvironmentVariableName.PROMPT_LOGIN_MAX_AGE);\n    if (typeof promptLoginMaxAge !== 'undefined') {\n        options.promptLoginMaxAge = promptLoginMaxAge;\n    }\n\n    const endSessionHintGracePeriod = readInt(ConfigEnvironmentVariableName.END_SESSION_HINT_GRACE_PERIOD);\n    if (typeof endSessionHintGracePeriod !== 'undefined') {\n        options.endSessionHintGracePeriod = endSessionHintGracePeriod;\n    }\n\n    const registrationEnabled = readBool(ConfigEnvironmentVariableName.REGISTRATION_ENABLED);\n    if (typeof registrationEnabled !== 'undefined') {\n        options.registrationEnabled = registrationEnabled;\n    }\n\n    const emailVerificationEnabled = readBool(ConfigEnvironmentVariableName.EMAIL_VERIFICATION_ENABLED);\n    if (typeof emailVerificationEnabled !== 'undefined') {\n        options.emailVerificationEnabled = emailVerificationEnabled;\n    }\n\n    const passwordRecoveryEnabled = readBool(ConfigEnvironmentVariableName.PASSWORD_RECOVERY_ENABLED);\n    if (typeof passwordRecoveryEnabled !== 'undefined') {\n        options.passwordRecoveryEnabled = passwordRecoveryEnabled;\n    }\n\n    const passwordMinLength = readInt(ConfigEnvironmentVariableName.PASSWORD_MIN_LENGTH);\n    if (typeof passwordMinLength !== 'undefined') {\n        options.passwordMinLength = passwordMinLength;\n    }\n\n    const accountConsoleEnabled = readBool(ConfigEnvironmentVariableName.ACCOUNT_CONSOLE_ENABLED);\n    if (typeof accountConsoleEnabled !== 'undefined') {\n        options.accountConsoleEnabled = accountConsoleEnabled;\n    }\n\n    // ---------------------------------------------------------------\n\n    const eventLogEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENABLED);\n    if (typeof eventLogEnabled !== 'undefined') {\n        options.eventLogEnabled = eventLogEnabled;\n    }\n\n    const eventLogRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_RETENTION_DAYS);\n    if (typeof eventLogRetentionDays !== 'undefined') {\n        options.eventLogRetentionDays = eventLogRetentionDays;\n    }\n\n    const eventLogEntityEnabled = readBoolStrict(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_ENABLED);\n    if (typeof eventLogEntityEnabled !== 'undefined') {\n        options.eventLogEntityEnabled = eventLogEntityEnabled;\n    }\n\n    const eventLogEntityRetentionDays = readInt(ConfigEnvironmentVariableName.EVENT_LOG_ENTITY_RETENTION_DAYS);\n    if (typeof eventLogEntityRetentionDays !== 'undefined') {\n        options.eventLogEntityRetentionDays = eventLogEntityRetentionDays;\n    }\n\n    const loginAttemptThrottleEnabled = readBoolStrict(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THROTTLE_ENABLED);\n    if (typeof loginAttemptThrottleEnabled !== 'undefined') {\n        options.loginAttemptThrottleEnabled = loginAttemptThrottleEnabled;\n    }\n\n    const loginAttemptThreshold = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_THRESHOLD);\n    if (typeof loginAttemptThreshold !== 'undefined') {\n        options.loginAttemptThreshold = loginAttemptThreshold;\n    }\n\n    const loginAttemptWindow = readInt(ConfigEnvironmentVariableName.LOGIN_ATTEMPT_WINDOW);\n    if (typeof loginAttemptWindow !== 'undefined') {\n        options.loginAttemptWindow = loginAttemptWindow;\n    }\n\n    // ---------------------------------------------------------------\n\n    const mfaEnabled = readBoolStrict(ConfigEnvironmentVariableName.MFA_ENABLED);\n    if (typeof mfaEnabled !== 'undefined') {\n        options.mfaEnabled = mfaEnabled;\n    }\n\n    const mfaRequired = readBoolStrict(ConfigEnvironmentVariableName.MFA_REQUIRED);\n    if (typeof mfaRequired !== 'undefined') {\n        options.mfaRequired = mfaRequired;\n    }\n\n    const mfaFreshnessMaxAge = readInt(ConfigEnvironmentVariableName.MFA_FRESHNESS_MAX_AGE);\n    if (typeof mfaFreshnessMaxAge !== 'undefined') {\n        options.mfaFreshnessMaxAge = mfaFreshnessMaxAge;\n    }\n\n    const mfaTicketMaxAge = readInt(ConfigEnvironmentVariableName.MFA_TICKET_MAX_AGE);\n    if (typeof mfaTicketMaxAge !== 'undefined') {\n        options.mfaTicketMaxAge = mfaTicketMaxAge;\n    }\n\n    const secretsEncryptionKey = read(ConfigEnvironmentVariableName.SECRETS_ENCRYPTION_KEY);\n    if (secretsEncryptionKey) {\n        options.secretsEncryptionKey = secretsEncryptionKey;\n    }\n\n    // ---------------------------------------------------------------\n\n    const clientBasicAuth = readBool(ConfigEnvironmentVariableName.CLIENT_AUTH_BASIC);\n    if (typeof clientBasicAuth !== 'undefined') {\n        options.clientAuthBasic = clientBasicAuth;\n    }\n\n    const clientSystemEnabled = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_ENABLED);\n    if (typeof clientSystemEnabled !== 'undefined') {\n        options.clientSystemEnabled = clientSystemEnabled;\n    }\n\n    const clientAdminSecret = read(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET);\n    if (clientAdminSecret) {\n        options.clientSystemSecret = clientAdminSecret;\n    }\n\n    const clientAdminSecretReset = readBool(ConfigEnvironmentVariableName.CLIENT_SYSTEM_SECRET_RESET);\n    if (typeof clientAdminSecretReset !== 'undefined') {\n        options.clientSystemSecretReset = clientAdminSecretReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const userBasicAuth = readBool(ConfigEnvironmentVariableName.USER_AUTH_BASIC);\n    if (typeof userBasicAuth !== 'undefined') {\n        options.userAuthBasic = userBasicAuth;\n    }\n\n    const userAdminEnabled = readBool(ConfigEnvironmentVariableName.USER_ADMIN_ENABLED);\n    if (typeof userAdminEnabled !== 'undefined') {\n        options.userAdminEnabled = userAdminEnabled;\n    }\n\n    const userAdminPassword = read(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD);\n    if (userAdminPassword) {\n        options.userAdminPassword = userAdminPassword;\n    }\n\n    const userAdminPasswordReset = readBool(ConfigEnvironmentVariableName.USER_ADMIN_PASSWORD_RESET);\n    if (typeof userAdminPasswordReset !== 'undefined') {\n        options.userAdminPasswordReset = userAdminPasswordReset;\n    }\n\n    // ---------------------------------------------------------------\n\n    const permissions = readArray(ConfigEnvironmentVariableName.PERMISSIONS);\n    if (permissions && permissions.length > 0) {\n        options.permissions = permissions;\n    }\n\n    const permissionsDefaultPolicyAssignment = readBool(ConfigEnvironmentVariableName.PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT);\n    if (typeof permissionsDefaultPolicyAssignment !== 'undefined') {\n        options.permissionsDefaultPolicyAssignment = permissionsDefaultPolicyAssignment;\n    }\n\n    return options;\n}\n"],"mappings":";;;;;;;AAsBA,MAAMQ,sCAAsB,IAAIC,IAAI;CAAC;CAAQ;CAAK;CAAK;CAAO;CAAK;AAAK,CAAA;AACxE,MAAMC,uCAAuB,IAAID,IAAI;CAAC;CAAS;CAAK;CAAK;CAAM;CAAK;AAAM,CAAA;;;;;;GAQ1E,SAASE,eAAeC,MAAmC;CACvD,MAAMC,MAAMZ,KAAKW,IAAAA;CACjB,IAAI,OAAOC,QAAQ,YAAYA,IAAIC,KAAI,CAAA,CAAGC,WAAW,GACjD;CAGJ,MAAME,aAAaJ,IAAIC,KAAI,CAAA,CAAGI,YAAW;CACzC,IAAIV,oBAAoBW,IAAIF,UAAAA,GACxB,OAAO;CAEX,IAAIP,qBAAqBS,IAAIF,UAAAA,GACzB,OAAO;CAGX,MAAM,IAAIG,MAAM,4BAA4BR,KAAK,sCAAsCC,IAAI,IAAI;AACnG;AAEA,SAAgBQ,uBAAAA;CACZ,MAAMC,UAAwB,CAAC;CAE/B,MAAMC,MAAMtB,KAAKM,8BAA8BiB,QAAQ;CACvD,IAAID,KACAD,QAAQC,MAAMA;CAGlB,MAAME,wBAAwBxB,KAAKM,8BAA8BmB,uBAAuB;CACxF,IAAID,uBACAH,QAAQG,wBAAwBA;CAGpC,MAAME,qBAAqB1B,KAAKM,8BAA8BqB,oBAAoB;CAClF,IAAID,oBACAL,QAAQK,qBAAqBA;CAGjC,MAAME,wBAAwB1B,SAASI,8BAA8BuB,uBAAuB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCP,QAAQO,wBAAwBA;CAGpC,MAAME,kBAAkB9B,KAAKM,8BAA8ByB,iBAAiB;CAC5E,IAAID,iBACAT,QAAQS,kBAAkBA;CAG9B,MAAME,qBAAqBhC,KAAKM,8BAA8B2B,oBAAoB;CAClF,IAAID,oBACAX,QAAQW,qBAAqBA;CAKjC,IAAI5B,wBAAAA,GAEAiB,QAAQa,KAAK7B,6BAAAA;CAKjB,MAAM8B,QAAQpC,MAAM,CAChBG,SAASI,8BAA8B8B,KAAK,GAC5CpC,KAAKM,8BAA8B8B,KAAK,CAC3C,CAAA;CACD,IAAI,OAAOD,UAAU,aACjBd,QAAQc,QAAQA;CAGpB,MAAME,OAAOtC,MAAM,CACfG,SAASI,8BAA8BgC,IAAI,GAC3CtC,KAAKM,8BAA8BgC,IAAI,CAC1C,CAAA;CACD,IAAI,OAAOD,SAAS,aAChBhB,QAAQgB,OAAOA;CAKnB,MAAME,OAAOvC,KAAKM,8BAA8BkC,IAAI;CACpD,IAAID,MACAlB,QAAQkB,OAAOA;CAGnB,MAAME,OAAOtC,QAAQG,8BAA8BoC,IAAI;CACvD,IAAI,OAAOD,SAAS,aAChBpB,QAAQoB,OAAOA;CAGnB,MAAME,YAAY3C,KAAKM,8BAA8BsC,UAAU;CAC/D,IAAID,WACAtB,QAAQwB,YAAYF;CAGxB,MAAMG,gBAAgB9C,KAAKM,8BAA8ByC,eAAe;CACxE,IAAID,eACAzB,QAAQ2B,gBAAgBF;CAG5B,MAAMG,oBAAoBjD,KAAKM,8BAA8B4C,kBAAkB;CAC/E,IAAID,mBACA5B,QAAQ4B,oBAAoBA;CAKhC,MAAME,aAAanD,KAAKM,8BAA8B8C,WAAW;CACjE,IAAI,OAAOD,eAAe,YAAYA,WAAWtC,KAAI,CAAA,CAAGC,SAAS,GAC7DO,QAAQ8B,aAAaA;CAGzB,MAAME,iBAAiBpD,UAAUK,8BAA8BgD,eAAe;CAC9E,IAAID,kBAAkBA,eAAevC,SAAS,GAC1CO,QAAQgC,iBAAiBA;CAG7B,MAAME,oBAAoBpD,QAAQG,8BAA8BkD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BlC,QAAQkC,oBAAoBA;CAGhC,MAAME,qBAAqBtD,QAAQG,8BAA8BoD,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BpC,QAAQoC,qBAAqBA;CAGjC,MAAME,0BAA0BxD,QAAQG,8BAA8BsD,0BAA0B;CAChG,IAAI,OAAOD,4BAA4B,aACnCtC,QAAQsC,0BAA0BA;CAGtC,MAAME,oBAAoB1D,QAAQG,8BAA8BwD,oBAAoB;CACpF,IAAI,OAAOD,sBAAsB,aAC7BxC,QAAQwC,oBAAoBA;CAGhC,MAAME,4BAA4B5D,QAAQG,8BAA8B0D,6BAA6B;CACrG,IAAI,OAAOD,8BAA8B,aACrC1C,QAAQ0C,4BAA4BA;CAGxC,MAAME,sBAAsB/D,SAASI,8BAA8B4D,oBAAoB;CACvF,IAAI,OAAOD,wBAAwB,aAC/B5C,QAAQ4C,sBAAsBA;CAGlC,MAAME,2BAA2BjE,SAASI,8BAA8B8D,0BAA0B;CAClG,IAAI,OAAOD,6BAA6B,aACpC9C,QAAQ8C,2BAA2BA;CAGvC,MAAME,0BAA0BnE,SAASI,8BAA8BgE,yBAAyB;CAChG,IAAI,OAAOD,4BAA4B,aACnChD,QAAQgD,0BAA0BA;CAGtC,MAAME,oBAAoBpE,QAAQG,8BAA8BkE,mBAAmB;CACnF,IAAI,OAAOD,sBAAsB,aAC7BlD,QAAQkD,oBAAoBA;CAGhC,MAAME,wBAAwBvE,SAASI,8BAA8BoE,uBAAuB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCpD,QAAQoD,wBAAwBA;CAKpC,MAAME,kBAAkBjE,eAAeJ,8BAA8BsE,iBAAiB;CACtF,IAAI,OAAOD,oBAAoB,aAC3BtD,QAAQsD,kBAAkBA;CAG9B,MAAME,wBAAwB1E,QAAQG,8BAA8BwE,wBAAwB;CAC5F,IAAI,OAAOD,0BAA0B,aACjCxD,QAAQwD,wBAAwBA;CAGpC,MAAME,wBAAwBrE,eAAeJ,8BAA8B0E,wBAAwB;CACnG,IAAI,OAAOD,0BAA0B,aACjC1D,QAAQ0D,wBAAwBA;CAGpC,MAAME,8BAA8B9E,QAAQG,8BAA8B4E,+BAA+B;CACzG,IAAI,OAAOD,gCAAgC,aACvC5D,QAAQ4D,8BAA8BA;CAG1C,MAAME,8BAA8BzE,eAAeJ,8BAA8B8E,8BAA8B;CAC/G,IAAI,OAAOD,gCAAgC,aACvC9D,QAAQ8D,8BAA8BA;CAG1C,MAAME,wBAAwBlF,QAAQG,8BAA8BgF,uBAAuB;CAC3F,IAAI,OAAOD,0BAA0B,aACjChE,QAAQgE,wBAAwBA;CAGpC,MAAME,qBAAqBpF,QAAQG,8BAA8BkF,oBAAoB;CACrF,IAAI,OAAOD,uBAAuB,aAC9BlE,QAAQkE,qBAAqBA;CAKjC,MAAME,aAAa/E,eAAeJ,8BAA8BoF,WAAW;CAC3E,IAAI,OAAOD,eAAe,aACtBpE,QAAQoE,aAAaA;CAGzB,MAAME,cAAcjF,eAAeJ,8BAA8BsF,YAAY;CAC7E,IAAI,OAAOD,gBAAgB,aACvBtE,QAAQsE,cAAcA;CAG1B,MAAME,qBAAqB1F,QAAQG,8BAA8BwF,qBAAqB;CACtF,IAAI,OAAOD,uBAAuB,aAC9BxE,QAAQwE,qBAAqBA;CAGjC,MAAME,kBAAkB5F,QAAQG,8BAA8B0F,kBAAkB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B1E,QAAQ0E,kBAAkBA;CAG9B,MAAME,uBAAuBjG,KAAKM,8BAA8B4F,sBAAsB;CACtF,IAAID,sBACA5E,QAAQ4E,uBAAuBA;CAKnC,MAAME,kBAAkBjG,SAASI,8BAA8B8F,iBAAiB;CAChF,IAAI,OAAOD,oBAAoB,aAC3B9E,QAAQgF,kBAAkBF;CAG9B,MAAMG,sBAAsBpG,SAASI,8BAA8BiG,qBAAqB;CACxF,IAAI,OAAOD,wBAAwB,aAC/BjF,QAAQiF,sBAAsBA;CAGlC,MAAME,oBAAoBxG,KAAKM,8BAA8BmG,oBAAoB;CACjF,IAAID,mBACAnF,QAAQqF,qBAAqBF;CAGjC,MAAMG,yBAAyBzG,SAASI,8BAA8BsG,0BAA0B;CAChG,IAAI,OAAOD,2BAA2B,aAClCtF,QAAQwF,0BAA0BF;CAKtC,MAAMG,gBAAgB5G,SAASI,8BAA8ByG,eAAe;CAC5E,IAAI,OAAOD,kBAAkB,aACzBzF,QAAQ2F,gBAAgBF;CAG5B,MAAMG,mBAAmB/G,SAASI,8BAA8B4G,kBAAkB;CAClF,IAAI,OAAOD,qBAAqB,aAC5B5F,QAAQ4F,mBAAmBA;CAG/B,MAAME,oBAAoBnH,KAAKM,8BAA8B8G,mBAAmB;CAChF,IAAID,mBACA9F,QAAQ8F,oBAAoBA;CAGhC,MAAME,yBAAyBnH,SAASI,8BAA8BgH,yBAAyB;CAC/F,IAAI,OAAOD,2BAA2B,aAClChG,QAAQgG,yBAAyBA;CAKrC,MAAME,cAActH,UAAUK,8BAA8BkH,WAAW;CACvE,IAAID,eAAeA,YAAYzG,SAAS,GACpCO,QAAQkG,cAAcA;CAG1B,MAAME,qCAAqCvH,SAASI,8BAA8BoH,qCAAqC;CACvH,IAAI,OAAOD,uCAAuC,aAC9CpG,QAAQoG,qCAAqCA;CAGjD,OAAOpG;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -26,6 +26,59 @@ export type Config = {
      * default: writable
      */
     writableDirectoryPath: string;
+    /**
+     * EXPERIMENTAL. May change in a minor release: per-realm themes are
+     * likely to reshape the directory into `<root>/<theme name>/`. The
+     * manifest's `version` field makes a breaking change detectable.
+     *
+     * Directory holding the operator theme applied to the served consoles
+     * (the auth console and the account console). Relative paths resolve
+     * against the rootPath.
+     *
+     * The directory is operator trust, exactly like the config file: its
+     * `assets/` sub-directory is served verbatim at `/theme`, and its
+     * `theme.json` injects CSS custom properties into both consoles.
+     * Mount it read-only and never from a source a tenant can write.
+     *
+     * default: '' (theming disabled)
+     */
+    themeDirectoryPath: string;
+    /**
+     * EXPERIMENTAL, alongside themeDirectoryPath.
+     *
+     * Opt in to reading `fragments/head.html` from the theme directory and
+     * splicing it into the `<head>` of both served consoles.
+     *
+     * The fragment is raw, unsanitized markup running on the IdP origin,
+     * so it must be a deliberate operator decision and never a consequence
+     * of a file appearing in the mounted directory.
+     *
+     * default: false
+     */
+    themeFragmentsEnabled: boolean;
+    /**
+     * EXPERIMENTAL. The render contract it verifies is itself versioned
+     * (CONTRACT_VERSION), but this key and the boot-time assert may change.
+     *
+     * Package directory of a substituted `@authup/client-auth-console`
+     * (the directory holding its package.json and dist/). Consulted before
+     * the node_modules resolution walk.
+     *
+     * This replaces the login/consent IMPLEMENTATION, not its styling: the
+     * substituted package owns the prompt ladder, PKCE and state handling,
+     * MFA ordering and redirect gating. Use the theme directory for
+     * branding.
+     *
+     * default: '' (resolve @authup/client-auth-console from node_modules)
+     */
+    authConsolePath: string;
+    /**
+     * Package directory of a substituted
+     * `@authup/client-account-console`. Same contract as authConsolePath.
+     *
+     * default: '' (resolve @authup/client-account-console from node_modules)
+     */
+    accountConsolePath: string;
     /**
      * default: true
      */
@@ -91,7 +144,7 @@ export type Config = {
     trustProxy: boolean | number | string | string[];
     /**
      * Trusted first-party app origins (besides publicUrl) — used as
-     * redirect targets for the per-realm public `web` client. Does NOT
+     * redirect targets for the per-realm public system clients. Does NOT
      * drive CORS (the API reflects any origin by default; an explicit
      * CORS allowlist goes through middlewareCors), and does not affect
      * UIs using their own registered OAuth2 client. Input entries may be
@@ -99,10 +152,10 @@ export type Config = {
      * rejected) or bare hosts (host[:port]) — a bare host expands to
      * both its http and https origin during normalization, so the
      * normalized config always holds full origins (scheme://host[:port],
-     * no path); each is stored as `<origin>/**` in the web client's
+     * no path); each is stored as `<origin>/**` in the system clients'
      * redirect_uri set.
      *
-     * SECURITY: the `web` client is built_in (auto-consent + `global`
+     * SECURITY: the system clients are built_in (auto-consent + `global`
      * scope), so any origin listed here can obtain a full-permission user
      * token once a user logs in. Adding an origin grants it full login
      * capability for every realm.
@@ -200,6 +253,13 @@ export type Config = {
      * default: 10
      */
     passwordMinLength: number;
+    /**
+     * Serve the account self-service surface (`/account`: profile, password,
+     * authenticators, sessions, applications). Operators with their own
+     * self-service portal can disable authup's.
+     * default: true
+     */
+    accountConsoleEnabled: boolean;
     /**
      * Persist security audit events (login, authorize, replay detection, ...)
      * to the auth_events table. When disabled only the structured log line

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAI9B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAI1B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;OAWG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/config/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CAyHhC"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/validator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,MAAM,CAAC;cAC/B,UAAU;CA8HhC"}

package/dist/app/modules/config/validator.mjs

@@ -24,6 +24,10 @@ var ConfigValidator = class extends Container {
 			env: stringValidator,
 			rootPath: stringValidator,
 			writableDirectoryPath: stringValidator,
+			themeDirectoryPath: stringValidator,
+			themeFragmentsEnabled: booleanValidator,
+			authConsolePath: stringValidator,
+			accountConsolePath: stringValidator,
 			logger: booleanValidator,
 			db: createValidator(z.custom((value) => isObject(value))),
 			redis: serviceValidator,
@@ -63,6 +67,7 @@ var ConfigValidator = class extends Container {
 			emailVerificationEnabled: booleanValidator,
 			passwordRecoveryEnabled: booleanValidator,
 			passwordMinLength: createValidator(z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH)),
+			accountConsoleEnabled: booleanValidator,
 			eventLogEnabled: booleanValidator,
 			eventLogRetentionDays: nonNegativeNumberValidator,
 			eventLogEntityEnabled: booleanValidator,

package/dist/app/modules/config/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlDataSourceOptions | PostgresDataSourceOptions | BetterSqlite3DataSourceOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustProxy: createValidator(z.union([\n                z.boolean(),\n                z.number().int().nonnegative(),\n                // scalar strings are canonicalized in normalizeConfig\n                // (integer/boolean words → their semantic type)\n                z.string(),\n                // the explicit allowlist form: an integer-string or boolean\n                // word entry is a mis-typed scalar and must fail loud —\n                // proxy-addr would silently compile '1' to 0.0.0.1\n                z.array(z.string().refine(\n                    isValidTrustProxyListEntry,\n                    'must be an IP, CIDR, or proxy-addr preset',\n                )),\n            ])),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GAEvBqB,QAAQnB;GACRoB,IAAI9B,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BO,OAAOT;GACPU,MAAMV;GAENW,MAAMrB;GACNsB,MAAM1B;GACN2B,WAAWnC,gBAAgBE,EAAEkC,IAAG,CAAA;GAChCC,eAAerC,gBAAgBE,EAAEkC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmBvC,gBAAgBE,EAAEsC,KAAKnC,mBAAAA,CAAAA;GAC1CoC,YAAYzC,gBAAgBE,EAAEwC,MAAM;IAChCxC,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAG7B,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,OACfzC,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD0C,gBAAgB9C,gBACZE,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAGoC,QAAQrB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGPuB,gBAAgB7B;GAChB8B,gBAAgB9B;GAChB+B,kBAAkB/B;GAClBgC,iBAAiBhC;GACjBiC,sBAAsBjC;GACtBkC,qBAAqBlC;GACrBmC,mBAAmB3C;GAEnB4C,mBAAmB1C;GACnB2C,oBAAoB3C;GACpB4C,yBAAyB5C;GACzB6C,mBAAmB7C;GACnB8C,2BAA2B9C;GAC3B+C,qBAAqBjD;GACrBkD,0BAA0BlD;GAC1BmD,yBAAyBnD;GACzBoD,mBAAmB9D,gBACfE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAG9C,IAAInB,wBAAAA,CAAAA;GAGpCkE,iBAAiBtD;GACjBuD,uBAAuBrD;GACvBsD,uBAAuBxD;GACvByD,6BAA6BvD;GAC7BwD,6BAA6B1D;GAC7B2D,uBAAuBrE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEO,oBAAoBtE,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DQ,sBAAsBvE,gBAAgBE,EAAEwC,MAAM,CAACxC,EAAEsE,QAAQ,EAAA,GAAKtE,EAAEuE,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYhE;GACZiE,aAAajE;GACbkE,oBAAoBhE;GACpBiE,iBAAiB7E,gBAAgBE,EAAEW,OAAM,CAAA,CAAG8B,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1De,iBAAiBpE;GACjBqE,qBAAqBrE;GACrBsE,oBAAoBjE;GACpBkE,yBAAyBvE;GAEzBwE,eAAexE;GACfyE,kBAAkBzE;GAClB0E,mBAAmBrE;GACnBsE,wBAAwB3E;GAExB4E,aAAatF,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE0C,MAAM1C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElC8E,oCAAoC7E;EACxC;EAEA,MAAM8E,OAAOC,OAAOD,KAAK/D,UAAAA;EACzB,KAAK,MAAMiE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGnE,WAAWiE,IAAI;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["USER_PASSWORD_MAX_LENGTH","isObject","createValidator","Container","z","expandToOrigins","isValidTrustProxyListEntry","CERTIFICATE_SOURCES","ConfigValidator","initialize","stringValidator","string","booleanValidator","boolean","nonNegativeNumberValidator","number","nonnegative","secretValidator","min","max","middlewareValidator","or","record","any","serviceValidator","custom","value","validators","env","rootPath","writableDirectoryPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","db","redis","smtp","port","host","publicUrl","url","mtlsPublicUrl","nullable","certificateSource","enum","trustProxy","union","int","array","refine","trustedOrigins","middlewareBody","middlewareCors","middlewareCookie","middlewareQuery","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","tokenAccessMaxAge","tokenRefreshMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","positive","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","literal","base64","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","keys","Object","key","mount","optional"],"sources":["../../../../src/app/modules/config/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport { createValidator } from '@validup/zod';\nimport type { BetterSqlite3DataSourceOptions } from 'typeorm/driver/better-sqlite3/BetterSqlite3DataSourceOptions.js';\nimport type { MysqlDataSourceOptions } from 'typeorm/driver/mysql/MysqlDataSourceOptions.js';\nimport type { PostgresDataSourceOptions } from 'typeorm/driver/postgres/PostgresDataSourceOptions.js';\nimport type { ValidatorDescriptor } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { expandToOrigins } from './origins.ts';\nimport { isValidTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config } from './types.ts';\nimport { CERTIFICATE_SOURCES } from '../../../adapters/http/request/index.ts';\n\nexport class ConfigValidator extends Container<Config> {\n    protected override initialize() {\n        super.initialize();\n\n        const stringValidator = createValidator(z.string());\n        const booleanValidator = createValidator(z.boolean());\n        const nonNegativeNumberValidator = createValidator(z.number().nonnegative());\n        const secretValidator = createValidator(z.string().min(3).max(256));\n        const middlewareValidator = createValidator(\n            z.boolean().or(z.record(z.string(), z.any())),\n        );\n        const serviceValidator = createValidator(\n            z.string()\n                .or(z.boolean())\n                .or(z.custom<Record<string, any>>((value) => isObject(value))),\n        );\n\n        // Record<keyof Config, ...> is the compile-time exhaustiveness\n        // guard: a Config key without a validator here fails the build\n        // instead of being silently stripped by run().\n        const validators: Record<keyof Config, ValidatorDescriptor> = {\n            env: stringValidator,\n            rootPath: stringValidator,\n            writableDirectoryPath: stringValidator,\n            themeDirectoryPath: stringValidator,\n            themeFragmentsEnabled: booleanValidator,\n            authConsolePath: stringValidator,\n            accountConsolePath: stringValidator,\n\n            logger: booleanValidator,\n            db: createValidator(\n                z.custom<MysqlDataSourceOptions | PostgresDataSourceOptions | BetterSqlite3DataSourceOptions>(\n                    (value) => isObject(value),\n                ),\n            ),\n            redis: serviceValidator,\n            smtp: serviceValidator,\n\n            port: nonNegativeNumberValidator,\n            host: stringValidator,\n            publicUrl: createValidator(z.url()),\n            mtlsPublicUrl: createValidator(z.url().nullable()),\n            certificateSource: createValidator(z.enum(CERTIFICATE_SOURCES)),\n            trustProxy: createValidator(z.union([\n                z.boolean(),\n                z.number().int().nonnegative(),\n                // scalar strings are canonicalized in normalizeConfig\n                // (integer/boolean words → their semantic type)\n                z.string(),\n                // the explicit allowlist form: an integer-string or boolean\n                // word entry is a mis-typed scalar and must fail loud —\n                // proxy-addr would silently compile '1' to 0.0.0.1\n                z.array(z.string().refine(\n                    isValidTrustProxyListEntry,\n                    'must be an IP, CIDR, or proxy-addr preset',\n                )),\n            ])),\n            trustedOrigins: createValidator(\n                z.array(z.string().refine((value) => {\n                    try {\n                        expandToOrigins(value);\n                        return true;\n                    } catch {\n                        return false;\n                    }\n                }, 'must be a http(s) origin or a bare host[:port]')),\n            ),\n\n            middlewareBody: middlewareValidator,\n            middlewareCors: middlewareValidator,\n            middlewareCookie: middlewareValidator,\n            middlewareQuery: middlewareValidator,\n            middlewarePrometheus: middlewareValidator,\n            middlewareRateLimit: middlewareValidator,\n            middlewareSwagger: booleanValidator,\n\n            tokenAccessMaxAge: nonNegativeNumberValidator,\n            tokenRefreshMaxAge: nonNegativeNumberValidator,\n            tokenRefreshGracePeriod: nonNegativeNumberValidator,\n            promptLoginMaxAge: nonNegativeNumberValidator,\n            endSessionHintGracePeriod: nonNegativeNumberValidator,\n            registrationEnabled: booleanValidator,\n            emailVerificationEnabled: booleanValidator,\n            passwordRecoveryEnabled: booleanValidator,\n            passwordMinLength: createValidator(\n                z.number().int().positive().max(USER_PASSWORD_MAX_LENGTH),\n            ),\n            accountConsoleEnabled: booleanValidator,\n\n            eventLogEnabled: booleanValidator,\n            eventLogRetentionDays: nonNegativeNumberValidator,\n            eventLogEntityEnabled: booleanValidator,\n            eventLogEntityRetentionDays: nonNegativeNumberValidator,\n            loginAttemptThrottleEnabled: booleanValidator,\n            loginAttemptThreshold: createValidator(z.number().int().positive()),\n            loginAttemptWindow: createValidator(z.number().int().positive()),\n\n            // '' = unset; otherwise a base64 string (normalizeConfig enforces\n            // the decoded 32-byte length at boot).\n            secretsEncryptionKey: createValidator(z.union([z.literal(''), z.base64()])),\n\n            mfaEnabled: booleanValidator,\n            mfaRequired: booleanValidator,\n            mfaFreshnessMaxAge: nonNegativeNumberValidator,\n            mfaTicketMaxAge: createValidator(z.number().int().positive()),\n\n            clientAuthBasic: booleanValidator,\n            clientSystemEnabled: booleanValidator,\n            clientSystemSecret: secretValidator,\n            clientSystemSecretReset: booleanValidator,\n\n            userAuthBasic: booleanValidator,\n            userAdminEnabled: booleanValidator,\n            userAdminPassword: secretValidator,\n            userAdminPasswordReset: booleanValidator,\n\n            permissions: createValidator(\n                z.string().or(z.array(z.string())),\n            ),\n            permissionsDefaultPolicyAssignment: booleanValidator,\n        };\n\n        const keys = Object.keys(validators) as (keyof Config)[];\n        for (const key of keys) {\n            this.mount(key, { optional: true }, validators[key]);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,IAAaQ,kBAAb,cAAqCL,UAAAA;CACdM,aAAa;EAC5B,MAAMA,WAAAA;EAEN,MAAMC,kBAAkBR,gBAAgBE,EAAEO,OAAM,CAAA;EAChD,MAAMC,mBAAmBV,gBAAgBE,EAAES,QAAO,CAAA;EAClD,MAAMC,6BAA6BZ,gBAAgBE,EAAEW,OAAM,CAAA,CAAGC,YAAW,CAAA;EACzE,MAAMC,kBAAkBf,gBAAgBE,EAAEO,OAAM,CAAA,CAAGO,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA;EAC9D,MAAMC,sBAAsBlB,gBACxBE,EAAES,QAAO,CAAA,CAAGQ,GAAGjB,EAAEkB,OAAOlB,EAAEO,OAAM,GAAIP,EAAEmB,IAAG,CAAA,CAAA,CAAA;EAE7C,MAAMC,mBAAmBtB,gBACrBE,EAAEO,OAAM,CAAA,CACHU,GAAGjB,EAAES,QAAO,CAAA,CAAA,CACZQ,GAAGjB,EAAEqB,QAA6BC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA,CAAAA;EAM9D,MAAMC,aAAwD;GAC1DC,KAAKlB;GACLmB,UAAUnB;GACVoB,uBAAuBpB;GACvBqB,oBAAoBrB;GACpBsB,uBAAuBpB;GACvBqB,iBAAiBvB;GACjBwB,oBAAoBxB;GAEpByB,QAAQvB;GACRwB,IAAIlC,gBACAE,EAAEqB,QACGC,UAAUzB,SAASyB,KAAAA,CAAAA,CAAAA;GAG5BW,OAAOb;GACPc,MAAMd;GAENe,MAAMzB;GACN0B,MAAM9B;GACN+B,WAAWvC,gBAAgBE,EAAEsC,IAAG,CAAA;GAChCC,eAAezC,gBAAgBE,EAAEsC,IAAG,CAAA,CAAGE,SAAQ,CAAA;GAC/CC,mBAAmB3C,gBAAgBE,EAAE0C,KAAKvC,mBAAAA,CAAAA;GAC1CwC,YAAY7C,gBAAgBE,EAAE4C,MAAM;IAChC5C,EAAES,QAAO;IACTT,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGjC,YAAW;IAG5BZ,EAAEO,OAAM;IAIRP,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAGwC,OACf7C,4BACA,2CAAA,CAAA;GAEP,CAAA,CAAA;GACD8C,gBAAgBlD,gBACZE,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAGwC,QAAQzB,UAAAA;IACvB,IAAI;KACArB,gBAAgBqB,KAAAA;KAChB,OAAO;IACX,QAAQ;KACJ,OAAO;IACX;GACJ,GAAG,gDAAA,CAAA,CAAA;GAGP2B,gBAAgBjC;GAChBkC,gBAAgBlC;GAChBmC,kBAAkBnC;GAClBoC,iBAAiBpC;GACjBqC,sBAAsBrC;GACtBsC,qBAAqBtC;GACrBuC,mBAAmB/C;GAEnBgD,mBAAmB9C;GACnB+C,oBAAoB/C;GACpBgD,yBAAyBhD;GACzBiD,mBAAmBjD;GACnBkD,2BAA2BlD;GAC3BmD,qBAAqBrD;GACrBsD,0BAA0BtD;GAC1BuD,yBAAyBvD;GACzBwD,mBAAmBlE,gBACfE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA,CAAGlD,IAAInB,wBAAAA,CAAAA;GAEpCsE,uBAAuB1D;GAEvB2D,iBAAiB3D;GACjB4D,uBAAuB1D;GACvB2D,uBAAuB7D;GACvB8D,6BAA6B5D;GAC7B6D,6BAA6B/D;GAC7BgE,uBAAuB1E,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAChEQ,oBAAoB3E,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAI7DS,sBAAsB5E,gBAAgBE,EAAE4C,MAAM,CAAC5C,EAAE2E,QAAQ,EAAA,GAAK3E,EAAE4E,OAAM,CAAG,CAAA,CAAA;GAEzEC,YAAYrE;GACZsE,aAAatE;GACbuE,oBAAoBrE;GACpBsE,iBAAiBlF,gBAAgBE,EAAEW,OAAM,CAAA,CAAGkC,IAAG,CAAA,CAAGoB,SAAQ,CAAA;GAE1DgB,iBAAiBzE;GACjB0E,qBAAqB1E;GACrB2E,oBAAoBtE;GACpBuE,yBAAyB5E;GAEzB6E,eAAe7E;GACf8E,kBAAkB9E;GAClB+E,mBAAmB1E;GACnB2E,wBAAwBhF;GAExBiF,aAAa3F,gBACTE,EAAEO,OAAM,CAAA,CAAGU,GAAGjB,EAAE8C,MAAM9C,EAAEO,OAAM,CAAA,CAAA,CAAA;GAElCmF,oCAAoClF;EACxC;EAEA,MAAMmF,OAAOC,OAAOD,KAAKpE,UAAAA;EACzB,KAAK,MAAMsE,OAAOF,MACd,KAAKG,MAAMD,KAAK,EAAEE,UAAU,KAAK,GAAGxE,WAAWsE,IAAI;CAE3D;AACJ"}

package/dist/app/modules/http/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoDjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAevD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4DjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBvD"}

package/dist/app/modules/http/module.mjs

@@ -9,7 +9,8 @@ import "../config/index.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import { HTTPInjectionKey } from "./constants.mjs";
-import { createInternalUIHttpClient } from "../../../adapters/http/ui/internal-http-client.mjs";
+import { createInternalUIHttpClient } from "../../../adapters/http/ui/auth-console/http-client.mjs";
+import { bindConsolePackages } from "../../../adapters/http/ui/console-packages/module.mjs";
 import "../../../adapters/http/ui/index.mjs";
 import { MetricsInjectionKey } from "../metrics/constants.mjs";
 import { PromAuthFlowMetrics } from "../metrics/prom.mjs";
@@ -52,6 +53,10 @@ var HTTPModule = class {
 		} catch (e) {
 			throw new AuthupError(`Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`);
 		}
+		await bindConsolePackages({
+			authConsolePath: config.authConsolePath,
+			accountConsolePath: config.accountConsolePath
+		});
 		this.registerUIHttpClient(container);
 		this.registerMetrics(container);
 		await this.middleware.mountBefore(router, container);
@@ -106,6 +111,7 @@ var HTTPModule = class {
 			this.uiHttpClientRegistered = false;
 		}
 		container.unregister(MetricsInjectionKey);
+		await this.middleware.teardown();
 		if (!this.instance) return;
 		container.unregister(HTTPInjectionKey.Server);
 		await this.instance.close();