@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.63

package/dist/adapters/http/controllers/workflows/token/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","skipActiveCheck","sub","sub_kind","identityInvalid","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","identity","resolve","claimsBuilder","claims","fromIdentity","active","jti","isInactive","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","ignoreExpiry","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2GrantTypeError, OAuth2RequestError, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n            const payload = await this.tokenVerifier.verify(token, { skipActiveCheck: true });\n            if (!payload.sub || !payload.sub_kind) {\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            let active : boolean;\n            if (payload.jti) {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive;\n            } else {\n                active = false;\n            }\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.clientId,\n                                realm_id: binding.permission.realmId,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            event.response.status = 202;\n            return null;\n        } catch (e) {\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAoCD,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdvB,iBAAiByB,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBmC,qBAAqB,IAAI1B,2BAA2B;IAClEQ,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiBoC,WAAW,IAAIxB,kBAAkB;IAC/CK,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbkB,sBAAsBhB,IAAIgB;IAC1BC,0BAA0BjB,IAAIiB;IAC9BC,iBAAiBlB,IAAIkB;IACrBC,QAAQnB,IAAImB;IACZT,mBAAmBV,IAAIU;GAC3B,CAAA;IACClC,iBAAiB4C,gBAAgB,IAAIjC,4BAA4B;IAC9DM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB2B,iBAAiBrB,IAAIqB;IACrBC,wBAAwBtB,IAAIsB;IAC5Bf,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbqB,QAAQnB,IAAImB;IACZI,SAAS,EAAEC,aAAaxB,IAAIyB,wBAAwB;IACpDf,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMgB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAC5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO,EAAEG,iBAAiB,KAAK,CAAA;GAC/E,IAAI,CAACF,QAAQG,OAAO,CAACH,QAAQI,UACzB,MAAM3D,mBAAmB4D,gBAAe;GAI5C,MAAMC,cAAc,MAAM,KAAKvC,2BAA2BwC,OAAO;IAC7DC,IAAIR,QAAQG;IACZM,MAAMT,QAAQI;IACdM,UAAUV,QAAQW;IAClBC,SAASZ,QAAQa;GACrB,CAAA;GAEA,MAAMC,WAAW,MAAM,KAAKhD,iBAAiBiD,QAAQf,QAAQI,UAAUJ,QAAQG,GAAG;GAClF,IAAI,CAACW,UAED,MAAMrE,mBAAmB4D,gBAAe;GAI5C,MAAMY,SAASD,IADW9D,0BACX8D,CAAAA,CAAcE,aAAaJ,QAAAA;GAE1C,IAAIK;GACJ,IAAInB,QAAQoB,KAERD,SAAS,CAACE,MADe,KAAKzD,cAAcyD,WAAWrB,QAAQoB,GAAG;QAGlED,SAAS;GAGb,OAAO;IACHA;IAEAb,aAAagB,OAAOC,OAChBjB,YAAYkB,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM3E,mBAAmB0E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBlB,WAAWe,QAAQE,WAAWlB;MAC9BG,UAAUa,QAAQE,WAAWhB;KACjC;KAEJ,OAAOa;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAGzB;IACH,GAAGiB;GACP;EACJ,SAASa,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMhC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDiC,cAAc;IACd9B,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKrC,aAAaoE,OAAOjC,OAAAA;GAE/BH,MAAMqC,SAASC,SAAS;GACxB,OAAO;EACX,SAASL,GAAG;GACR,MAAM7E,cAAc6E,CAAAA;EACxB;CACJ;CAIA,MACMM,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAM9E,8BAA8BsC,KAAAA;EACtD,IAAI,CAACwC,WACD,MAAM7F,qBAAqB8F,YAAW;EAG1C,MAAMC,QAAQ,KAAKtE,YAAYoE;EAC/B,IAAI,CAACE,OACD,MAAM/F,qBAAqB8F,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe3C,KAAAA;EAE5C,KAAK7B,SAASyE,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantTypeError","OAuth2RequestError","OAuth2TokenGrant","isJWTError","DContext","DController","DGet","DPost","DTags","buildPermissionKey","toOAuth2Error","OAuth2OpenIDClaimsBuilder","HTTPClientCredentialsGrant","HTTPOAuth2AuthorizeGrant","HTTPOAuth2RefreshTokenGrant","HTTPPasswordGrant","guessOauth2GrantTypeByRequest","extractTokenFromRequest","TokenController","refreshTokenIssuer","accessTokenIssuer","tokenVerifier","tokenRevoker","identityResolver","identityPermissionProvider","metrics","tokenGrants","ctx","AUTHORIZATION_CODE","codeVerifier","clientAuthenticator","oauth2ClientAuthenticator","openIdTokenIssuer","keyStore","sessionManager","realmRepository","accessPolicyEvaluator","certificateSource","CLIENT_CREDENTIALS","PASSWORD","authenticator","userAuthenticator","eventService","loginThrottleService","userAuthenticatorService","mfaLoginService","logger","REFRESH_TOKEN","tokenRepository","sessionTokenRepository","options","gracePeriod","tokenRefreshGracePeriod","getIntrospect","event","postIntrospect","token","payload","verify","ignoreExpiry","skipActiveCheck","sub","sub_kind","identityInvalid","active","jti","exp","isInactive","Date","now","identity","resolve","claimsBuilder","claims","fromIdentity","permissions","getFor","id","type","clientId","client_id","realmId","realm_id","Object","values","reduce","acc","binding","key","permission","name","e","revokeToken","revoke","response","status","createToken","grantType","unsupported","grant","runWithRequest","recordTokenGrant"],"sources":["../../../../../../src/adapters/http/controllers/workflows/token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenIntrospectionResponse, OAuth2TokenPermission } from '@authup/specs';\nimport { \n    OAuth2GrantTypeError, \n    OAuth2RequestError, \n    OAuth2TokenGrant, \n    isJWTError, \n} from '@authup/specs';\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { buildPermissionKey } from '@authup/access';\nimport { toOAuth2Error } from '../../../../../core/oauth2/helpers/index.ts';\nimport type { TokenControllerContext } from './types.ts';\nimport type {\n    IAuthFlowMetrics,\n    IIdentityPermissionProvider,\n    IIdentityResolver,\n    IOAuth2TokenIssuer,\n    IOAuth2TokenRevoker,\n    IOAuth2TokenVerifier,\n} from '../../../../../core/index.ts';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../../../core/index.ts';\nimport type { IHTTPOAuth2Grant } from '../../../adapters/index.ts';\nimport {\n    HTTPClientCredentialsGrant,\n    HTTPOAuth2AuthorizeGrant,\n    HTTPOAuth2RefreshTokenGrant,\n    HTTPPasswordGrant,\n    guessOauth2GrantTypeByRequest,\n} from '../../../adapters/index.ts';\nimport { extractTokenFromRequest } from './utils/index.ts';\n\n@DTags('auth')\n@DController('/token')\nexport class TokenController {\n    protected refreshTokenIssuer: IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer: IOAuth2TokenIssuer;\n\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected tokenRevoker: IOAuth2TokenRevoker;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected identityPermissionProvider : IIdentityPermissionProvider;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    protected tokenGrants : Record<`${OAuth2TokenGrant}`, IHTTPOAuth2Grant>;\n\n    // -------------------------------------------\n\n    constructor(ctx: TokenControllerContext) {\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.metrics = ctx.metrics;\n\n        this.tokenGrants = {\n            [OAuth2TokenGrant.AUTHORIZATION_CODE]: new HTTPOAuth2AuthorizeGrant({\n                codeVerifier: ctx.codeVerifier,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                openIdTokenIssuer: ctx.openIdTokenIssuer,\n                keyStore: ctx.keyStore,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.CLIENT_CREDENTIALS]: new HTTPClientCredentialsGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.PASSWORD]: new HTTPPasswordGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                authenticator: ctx.userAuthenticator,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                sessionManager: ctx.sessionManager,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                loginThrottleService: ctx.loginThrottleService,\n                userAuthenticatorService: ctx.userAuthenticatorService,\n                mfaLoginService: ctx.mfaLoginService,\n                logger: ctx.logger,\n                certificateSource: ctx.certificateSource,\n            }),\n            [OAuth2TokenGrant.REFRESH_TOKEN]: new HTTPOAuth2RefreshTokenGrant({\n                accessTokenIssuer: ctx.accessTokenIssuer,\n                refreshTokenIssuer: ctx.refreshTokenIssuer,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRepository: ctx.tokenRepository,\n                sessionTokenRepository: ctx.sessionTokenRepository,\n                sessionManager: ctx.sessionManager,\n                clientAuthenticator: ctx.oauth2ClientAuthenticator,\n                realmRepository: ctx.realmRepository,\n                eventService: ctx.eventService,\n                metrics: ctx.metrics,\n                logger: ctx.logger,\n                options: { gracePeriod: ctx.tokenRefreshGracePeriod },\n                certificateSource: ctx.certificateSource,\n            }),\n        };\n    }\n\n    // -------------------------------------------\n\n    @DGet('/introspect', [])\n    async getIntrospect(@DContext() event: IAppEvent): Promise<OAuth2TokenIntrospectionResponse> {\n        return this.postIntrospect(event);\n    }\n\n    @DPost('/introspect', [])\n    async postIntrospect(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // `ignoreExpiry`, so an expired token still reports WHOSE it was:\n            // a third-party app can say \"your session ended, <name>\" instead\n            // of only \"no\". Everything the caller could act on - the subject,\n            // its claims - is in a token we did issue and can still read.\n            //\n            // `active` is derived below and NEVER from this call. The\n            // signature-keyed cache returns a hit without re-checking `exp`\n            // (verifier/module.ts), so relying on the verify to reject an\n            // expired token would report one as active for as long as its\n            // entry survives. The verifier deliberately skips WRITING the\n            // cache on this path, so no expired payload can enter it here.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n            if (!payload.sub || !payload.sub_kind) {\n                // Not a report about a token this server ever issued: authup\n                // mints every one with a subject, so a verifying token without\n                // one was never valid. `active: false` would claim we knew it\n                // and let it lapse.\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            // Both halves, fail-closed on a missing claim: a token carrying no\n            // `jti` cannot be checked against the revocation list, and one\n            // carrying no `exp` cannot be shown to be current. Authup mints\n            // every token with both. Derived BEFORE the permission read so a\n            // dead token never pays for one.\n            let active : boolean;\n            if (payload.jti && typeof payload.exp === 'number') {\n                const isInactive = await this.tokenVerifier.isInactive(payload.jti);\n                active = !isInactive && payload.exp * 1000 > Date.now();\n            } else {\n                active = false;\n            }\n\n            const identity = await this.identityResolver.resolve(payload.sub_kind, payload.sub);\n            if (!identity) {\n                // todo: differentiate between client & user\n                throw OAuth2RequestError.identityInvalid();\n            }\n\n            const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n            const claims = claimsBuilder.fromIdentity(identity);\n\n            // An inactive token reports WHO it belonged to and nothing about\n            // what they may do. The endpoint requires no authorization (#3489),\n            // so anyone holding a lapsed token string - out of a log, browser\n            // history, a proxy trace - reaches this answer; naming the subject\n            // is the point of reading an expired token at all, handing over\n            // their authorization set is not. It also skips resolving that set\n            // for a token nobody can use.\n            if (!active) {\n                return {\n                    active,\n                    ...payload,\n                    ...claims,\n                };\n            }\n\n            // todo: only receive client specific permissions\n            const permissions = await this.identityPermissionProvider.getFor({\n                id: payload.sub,\n                type: payload.sub_kind,\n                clientId: payload.client_id,\n                realmId: payload.realm_id,\n            });\n\n            return {\n                active,\n                // todo: permissions property should be removed.\n                permissions: Object.values(\n                    permissions.reduce((acc, binding) => {\n                        const key = buildPermissionKey(binding.permission);\n                        if (!acc[key]) {\n                            acc[key] = {\n                                name: binding.permission.name,\n                                client_id: binding.permission.clientId,\n                                realm_id: binding.permission.realmId,\n                            } as OAuth2TokenPermission;\n                        }\n                        return acc;\n                    }, {} as Record<string, OAuth2TokenPermission>),\n                ),\n                ...payload,\n                ...claims,\n            };\n        } catch (e) {\n            // RFC 7662 §2.2: a token that \"is not active, does not exist on\n            // this server, or the protected resource is not allowed to\n            // introspect\" MUST be answered with `active: false`. A token this\n            // server cannot read does not exist on it, so it is reported like\n            // any other rather than raised - which is what §2.2 asks for and\n            // what keeps this endpoint from telling a caller whether a string\n            // was signed by a key we hold.\n            //\n            // The report is BARE, no payload: §2.2 and §4 both say not to\n            // disclose more about an inactive token, and there is nothing to\n            // disclose here anyway. The expired case is the deliberate\n            // exception, and it never reaches this catch - it is verified\n            // above and reported with its claims.\n            if (isJWTError(e)) {\n                return { active: false };\n            }\n\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('/revoke', [])\n    async revokeToken(\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        try {\n            const token = await extractTokenFromRequest(event);\n\n            // RFC 7009 §2.2: revoking an invalid token — here one that is expired\n            // or already inactive — MUST still succeed. The client cannot act on\n            // an error, and the token's invalidation (the point of the request)\n            // is already achieved. Signature + kind still anchor the token, so a\n            // forged/garbage token is rejected; `ignoreExpiry` additionally keeps\n            // this exp-bypass out of the shared claims cache (see\n            // OAuth2TokenVerifier). Without this, revoking a stale refresh token\n            // threw `expired_token`, so the caller's revoke-then-clear-cookie\n            // flow aborted, the durable row was never soft-revoked, and the stale\n            // refresh cookie survived into the next login.\n            const payload = await this.tokenVerifier.verify(token, {\n                ignoreExpiry: true,\n                skipActiveCheck: true,\n            });\n\n            await this.tokenRevoker.revoke(payload);\n\n            // RFC 7009 §2.2 names 200 for a successful revocation. This was a\n            // 202 - within the 2xx family, so a client reading the class was\n            // unaffected, but not the status the spec asks for.\n            event.response.status = 200;\n            return null;\n        } catch (e) {\n            // Same clause, the other half: \"invalid tokens do not cause an\n            // error response since the client cannot handle such an error in a\n            // reasonable way\". Expiry is already bypassed above, so this covers\n            // a malformed or unverifiable token, which answered 401/404. The\n            // answer is the one a valid token gets - the point is that the two\n            // are indistinguishable.\n            if (isJWTError(e)) {\n                event.response.status = 200;\n                return null;\n            }\n\n            throw toOAuth2Error(e);\n        }\n    }\n\n    // ----------------------------------------------------------\n\n    @DPost('', [])\n    async createToken(@DContext() event: IAppEvent): Promise<OAuth2TokenGrantResponse> {\n        const grantType = await guessOauth2GrantTypeByRequest(event);\n        if (!grantType) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const grant = this.tokenGrants[grantType];\n        if (!grant) {\n            throw OAuth2GrantTypeError.unsupported();\n        }\n\n        const response = await grant.runWithRequest(event);\n\n        this.metrics?.recordTokenGrant(grantType);\n\n        return response;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AAyCD,IAAakB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAA6B;EACrC,KAAKR,qBAAqBQ,IAAIR;EAC9B,KAAKC,oBAAoBO,IAAIP;EAC7B,KAAKC,gBAAgBM,IAAIN;EACzB,KAAKC,eAAeK,IAAIL;EACxB,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,6BAA6BG,IAAIH;EACtC,KAAKC,UAAUE,IAAIF;EAEnB,KAAKC,cAAc;IACdxB,iBAAiB0B,qBAAqB,IAAIf,yBAAyB;IAChEgB,cAAcF,IAAIE;IAClBC,qBAAqBH,IAAII;IACzBX,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBa,mBAAmBL,IAAIK;IACvBC,UAAUN,IAAIM;IACdC,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBC,uBAAuBT,IAAIS;IAC3BC,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBoC,qBAAqB,IAAI1B,2BAA2B;IAClEQ,mBAAmBO,IAAIP;IACvBU,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBG,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiBqC,WAAW,IAAIxB,kBAAkB;IAC/CK,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBqB,eAAeb,IAAIc;IACnBX,qBAAqBH,IAAII;IACzBG,gBAAgBP,IAAIO;IACpBC,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbkB,sBAAsBhB,IAAIgB;IAC1BC,0BAA0BjB,IAAIiB;IAC9BC,iBAAiBlB,IAAIkB;IACrBC,QAAQnB,IAAImB;IACZT,mBAAmBV,IAAIU;GAC3B,CAAA;IACCnC,iBAAiB6C,gBAAgB,IAAIjC,4BAA4B;IAC9DM,mBAAmBO,IAAIP;IACvBD,oBAAoBQ,IAAIR;IACxBE,eAAeM,IAAIN;IACnB2B,iBAAiBrB,IAAIqB;IACrBC,wBAAwBtB,IAAIsB;IAC5Bf,gBAAgBP,IAAIO;IACpBJ,qBAAqBH,IAAII;IACzBI,iBAAiBR,IAAIQ;IACrBO,cAAcf,IAAIe;IAClBjB,SAASE,IAAIF;IACbqB,QAAQnB,IAAImB;IACZI,SAAS,EAAEC,aAAaxB,IAAIyB,wBAAwB;IACpDf,mBAAmBV,IAAIU;GAC3B,CAAA;EACJ;CACJ;CAIA,MACMgB,cAAc,OAAyE;EACzF,OAAO,KAAKE,eAAeD,KAAAA;CAC/B;CAEA,MACMC,eACF,OACyC;EACzC,IAAI;GACA,MAAMC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAa5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDG,cAAc;IACdC,iBAAiB;GACrB,CAAA;GACA,IAAI,CAACH,QAAQI,OAAO,CAACJ,QAAQK,UAKzB,MAAM7D,mBAAmB8D,gBAAe;GAQ5C,IAAIC;GACJ,IAAIP,QAAQQ,OAAO,OAAOR,QAAQS,QAAQ,UAEtCF,SAAS,CAACG,MADe,KAAK9C,cAAc8C,WAAWV,QAAQQ,GAAG,KAC1CR,QAAQS,MAAM,MAAOE,KAAKC,IAAG;QAErDL,SAAS;GAGb,MAAMM,WAAW,MAAM,KAAK/C,iBAAiBgD,QAAQd,QAAQK,UAAUL,QAAQI,GAAG;GAClF,IAAI,CAACS,UAED,MAAMrE,mBAAmB8D,gBAAe;GAI5C,MAAMU,SAASD,IADW7D,0BACX6D,CAAAA,CAAcE,aAAaJ,QAAAA;GAS1C,IAAI,CAACN,QACD,OAAO;IACHA;IACA,GAAGP;IACH,GAAGgB;GACP;GAIJ,MAAME,cAAc,MAAM,KAAKnD,2BAA2BoD,OAAO;IAC7DC,IAAIpB,QAAQI;IACZiB,MAAMrB,QAAQK;IACdiB,UAAUtB,QAAQuB;IAClBC,SAASxB,QAAQyB;GACrB,CAAA;GAEA,OAAO;IACHlB;IAEAW,aAAaQ,OAAOC,OAChBT,YAAYU,QAAQC,KAAKC,YAAAA;KACrB,MAAMC,MAAM/E,mBAAmB8E,QAAQE,UAAU;KACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;MACPE,MAAMH,QAAQE,WAAWC;MACzBV,WAAWO,QAAQE,WAAWV;MAC9BG,UAAUK,QAAQE,WAAWR;KACjC;KAEJ,OAAOK;IACX,GAAG,CAAC,CAAA,CAAA;IAER,GAAG7B;IACH,GAAGgB;GACP;EACJ,SAASkB,GAAG;GAcR,IAAIxF,WAAWwF,CAAAA,GACX,OAAO,EAAE3B,QAAQ,MAAM;GAG3B,MAAMtD,cAAciF,CAAAA;EACxB;CACJ;CAIA,MACMC,YACF,OACa;EACb,IAAI;GACA,MAAMpC,QAAQ,MAAMvC,wBAAwBqC,KAAAA;GAY5C,MAAMG,UAAU,MAAM,KAAKpC,cAAcqC,OAAOF,OAAO;IACnDG,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAEA,MAAM,KAAKtC,aAAauE,OAAOpC,OAAAA;GAK/BH,MAAMwC,SAASC,SAAS;GACxB,OAAO;EACX,SAASJ,GAAG;GAOR,IAAIxF,WAAWwF,CAAAA,GAAI;IACfrC,MAAMwC,SAASC,SAAS;IACxB,OAAO;GACX;GAEA,MAAMrF,cAAciF,CAAAA;EACxB;CACJ;CAIA,MACMK,YAAY,OAAiE;EAC/E,MAAMC,YAAY,MAAMjF,8BAA8BsC,KAAAA;EACtD,IAAI,CAAC2C,WACD,MAAMjG,qBAAqBkG,YAAW;EAG1C,MAAMC,QAAQ,KAAKzE,YAAYuE;EAC/B,IAAI,CAACE,OACD,MAAMnG,qBAAqBkG,YAAW;EAG1C,MAAMJ,WAAW,MAAMK,MAAMC,eAAe9C,KAAAA;EAE5C,KAAK7B,SAAS4E,iBAAiBJ,SAAAA;EAE/B,OAAOH;CACX;AACJ"}

package/dist/adapters/http/middleware/built-in/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QA2BtE"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,QAmCtE"}

package/dist/adapters/http/middleware/built-in/cors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. All authentication is header-based\n        // (Bearer/Basic) — no cookie-authenticated endpoint exists — so an\n        // origin allowlist would add no security, only break dynamically\n        // registered browser clients. Operators can still pass an explicit\n        // `origin` via the middlewareCors config options.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAQZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACD,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"cors.mjs","names":["cors","registerCorsMiddleware","router","input","use","origin","credentials","exposeHeaders"],"sources":["../../../../../src/adapters/http/middleware/built-in/cors.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Options as CorsOptions } from '@routup/cors';\nimport { cors } from '@routup/cors';\nimport type { App } from 'routup';\n\nexport function registerCorsMiddleware(router: App, input?: CorsOptions) {\n    router.use(cors({\n        // Reflect any origin by default: OAuth2 clients (and their UIs) are\n        // registered at runtime on arbitrary domains, so a startup-time\n        // allowlist cannot know them. Authentication is header-based\n        // (Bearer/Basic), so an origin allowlist would add no security here,\n        // only break dynamically registered browser clients. Operators can\n        // still pass an explicit `origin` via the middlewareCors config\n        // options.\n        //\n        // ONE endpoint authenticates on a cookie: the federated login's\n        // `POST /identity-providers/:id/login-complete` (plan 094). Reflecting\n        // an origin WITH credentials would let any same-site origin read the\n        // token pair it answers with, since `SameSite` is scoped to the\n        // registrable domain rather than the origin, so that route checks\n        // `Origin` against publicUrl itself. A second cookie-authenticated\n        // endpoint must do the same, or this default has to change.\n        origin: true,\n        credentials: true,\n        // `credentials: true` is incompatible with the `*` wildcard for\n        // exposeHeaders, so enumerate the response headers JS clients need.\n        exposeHeaders: [\n            'ratelimit-limit',\n            'ratelimit-remaining',\n            'ratelimit-reset',\n            'retry-after',\n            'etag',\n            'content-disposition',\n            'content-range',\n            'accept-ranges',\n            'location',\n            'www-authenticate',\n        ],\n        ...(input ?? {}),\n    }));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,uBAAuBC,QAAaC,OAAmB;CACnED,OAAOE,IAAIJ,KAAK;EAgBZK,QAAQ;EACRC,aAAa;EAGbC,eAAe;GACX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACD,GAAIJ,SAAS,CAAC;CAClB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAyBxF"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAyDxF"}

package/dist/adapters/http/middleware/built-in/error.mjs

@@ -3,7 +3,8 @@ import "node:url";
 import.meta.url;
 import { describeError, sanitizeError } from "../../../../utils/error.mjs";
 import "../../../../utils/index.mjs";
-import { httpStatusFromCode, serializeError } from "@authup/errors";
+import { ErrorCode, httpStatusFromCode, serializeError } from "@authup/errors";
+import { isJWTErrorCode } from "@authup/specs";
 import { defineErrorHandler } from "routup";
 //#region src/adapters/http/middleware/built-in/error.ts
 function registerErrorMiddleware(router, options = {}) {
@@ -16,6 +17,14 @@ function registerErrorMiddleware(router, options = {}) {
 			if (options.logger) options.logger.error(describeError(original));
 			payload.message = "An internal server error occurred.";
 		}
+		if (status === 401) {
+			const authorization = event.headers.get("authorization");
+			if (typeof authorization === "string" && authorization.toLowerCase().startsWith("bearer ")) {
+				const description = String(payload.message ?? "").replace(/[^\x20-\x21\x23-\x5B\x5D-\x7E]/g, "");
+				const code = isJWTErrorCode(next.code) ? "invalid_token" : "invalid_request";
+				event.response.headers.set("www-authenticate", `Bearer error="${code}", error_description="${description}"`);
+			} else if (!authorization && next.code === ErrorCode.IDENTITY_UNAUTHORIZED) event.response.headers.set("www-authenticate", "Bearer");
+		}
 		event.response.status = status;
 		return payload;
 	}));

package/dist/adapters/http/middleware/built-in/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["defineErrorHandler","httpStatusFromCode","serializeError","describeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","original","cause","next","status","code","payload","logger","message","response"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { httpStatusFromCode, serializeError } from '@authup/errors';\nimport { describeError, sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        // routup wraps whatever a handler threw into an AppError carrying it\n        // as `cause`, so this is the error as it was actually raised.\n        const original = error.cause ?? error;\n\n        const next = sanitizeError(original);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                // The ORIGINAL error, never the sanitized copy. Sanitizing\n                // discards the transport reason and the upstream response\n                // body on purpose, and those are the only things that make\n                // an outbound failure diagnosable.\n                options.logger.error(describeError(original));\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;AAiBA,SAAgBK,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIR,oBAAoBS,OAAOC,UAAAA;EAGlC,MAAMC,WAAWF,MAAMG,SAASH;EAEhC,MAAMI,OAAOT,cAAcO,QAAAA;EAC3B,MAAMG,SAASb,mBAAmBY,KAAKE,IAAI;EAE3C,MAAMC,UAAUd,eAAeW,IAAAA;EAE/B,IAAIC,UAAU,KAAK;GACf,IAAIP,QAAQU,QAKRV,QAAQU,OAAOR,MAAMN,cAAcQ,QAAAA,CAAAA;GAEvCK,QAAQE,UAAU;EACtB;EAEAR,MAAMS,SAASL,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}
+{"version":3,"file":"error.mjs","names":["defineErrorHandler","ErrorCode","httpStatusFromCode","serializeError","isJWTErrorCode","describeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","original","cause","next","status","code","payload","logger","message","authorization","headers","get","toLowerCase","startsWith","description","String","replace","response","set","IDENTITY_UNAUTHORIZED"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { ErrorCode, httpStatusFromCode, serializeError } from '@authup/errors';\nimport { isJWTErrorCode } from '@authup/specs';\nimport { describeError, sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        // routup wraps whatever a handler threw into an AppError carrying it\n        // as `cause`, so this is the error as it was actually raised.\n        const original = error.cause ?? error;\n\n        const next = sanitizeError(original);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                // The ORIGINAL error, never the sanitized copy. Sanitizing\n                // discards the transport reason and the upstream response\n                // body on purpose, and those are the only things that make\n                // an outbound failure diagnosable.\n                options.logger.error(describeError(original));\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        // RFC 6750 §3: a 401 from a protected resource carries the Bearer\n        // challenge, which nothing here emitted. Gated on the request actually\n        // being one - the token endpoint answers 401 for a bad client secret\n        // (RFC 6749 §5.2) and that is not a bearer failure, so it must not be\n        // stamped.\n        if (status === 401) {\n            const authorization = event.headers.get('authorization');\n\n            if (typeof authorization === 'string' && authorization.toLowerCase().startsWith('bearer ')) {\n                // RFC 6750 §3 defines the value as a quoted-string over\n                // `%x20-21 / %x23-5B / %x5D-7E`, so everything outside that set\n                // goes: a quote or a backslash would break out of the\n                // quoting, and a control character (a CR or LF in a\n                // third-party JWT library's\n                // message, which `JWTError.payloadInvalid` forwards verbatim)\n                // makes the header assignment itself throw, turning a 401\n                // into a 500.\n                const description = String(payload.message ?? '')\n                    .replace(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]/g, '');\n                const code = isJWTErrorCode(next.code) ? 'invalid_token' : 'invalid_request';\n\n                event.response.headers.set(\n                    'www-authenticate',\n                    `Bearer error=\"${code}\", error_description=\"${description}\"`,\n                );\n            } else if (!authorization && next.code === ErrorCode.IDENTITY_UNAUTHORIZED) {\n                // §3 again: a request that presented no credentials at all gets\n                // the bare challenge, with no error code to report.\n                event.response.headers.set('www-authenticate', 'Bearer');\n            }\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;;AAkBA,SAAgBO,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIV,oBAAoBW,OAAOC,UAAAA;EAGlC,MAAMC,WAAWF,MAAMG,SAASH;EAEhC,MAAMI,OAAOT,cAAcO,QAAAA;EAC3B,MAAMG,SAASd,mBAAmBa,KAAKE,IAAI;EAE3C,MAAMC,UAAUf,eAAeY,IAAAA;EAE/B,IAAIC,UAAU,KAAK;GACf,IAAIP,QAAQU,QAKRV,QAAQU,OAAOR,MAAMN,cAAcQ,QAAAA,CAAAA;GAEvCK,QAAQE,UAAU;EACtB;EAOA,IAAIJ,WAAW,KAAK;GAChB,MAAMK,gBAAgBT,MAAMU,QAAQC,IAAI,eAAA;GAExC,IAAI,OAAOF,kBAAkB,YAAYA,cAAcG,YAAW,CAAA,CAAGC,WAAW,SAAA,GAAY;IASxF,MAAMC,cAAcC,OAAOT,QAAQE,WAAW,EAAA,CAAA,CACzCQ,QAAQ,mCAAmC,EAAA;IAChD,MAAMX,OAAOb,eAAeW,KAAKE,IAAI,IAAI,kBAAkB;IAE3DL,MAAMiB,SAASP,QAAQQ,IACnB,oBACA,iBAAiBb,KAAK,wBAAwBS,YAAY,EAAE;GAEpE,OAAO,IAAI,CAACL,iBAAiBN,KAAKE,SAAShB,UAAU8B,uBAGjDnB,MAAMiB,SAASP,QAAQQ,IAAI,oBAAoB,QAAA;EAEvD;EAEAlB,MAAMiB,SAASb,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}

package/dist/adapters/http/ui/console-packages/module.d.ts

@@ -6,7 +6,7 @@ import type { ConsolePackageOptions } from './types.ts';
  * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a
  * change breaks a package built against the previous shape.
  */
-export declare const AUTH_CONSOLE_CONTRACT_VERSION = 2;
+export declare const AUTH_CONSOLE_CONTRACT_VERSION = 3;
 /**
  * The marker the account console's index.html must carry. It is that
  * console's entire runtime contract: without it the injected

package/dist/adapters/http/ui/console-packages/module.mjs

@@ -16,7 +16,7 @@ import fs from "node:fs";
 *
 * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a
 * change breaks a package built against the previous shape.
-*/ const AUTH_CONSOLE_CONTRACT_VERSION = 2;
+*/ const AUTH_CONSOLE_CONTRACT_VERSION = 3;
 /**
 * The marker the account console's index.html must carry. It is that
 * console's entire runtime contract: without it the injected
@@ -56,7 +56,7 @@ async function assertAuthConsoleContract(packagePath) {
 	}
 	if (typeof module.render !== "function") throw new AuthupError(`The auth console bundle "${entry}" does not export a render() function.`);
 	const version = typeof module.CONTRACT_VERSION === "undefined" ? 1 : module.CONTRACT_VERSION;
-	if (version !== 2) throw new AuthupError(`The auth console package at "${packagePath}" implements render-contract version ${version}, but this authup requires 2. Rebuild it against the current @authup/client-auth-console contract.`);
+	if (version !== 3) throw new AuthupError(`The auth console package at "${packagePath}" implements render-contract version ${version}, but this authup requires 3. Rebuild it against the current @authup/client-auth-console contract.`);
 }
 function assertAccountConsoleContract(packagePath) {
 	const distPath = resolveAccountConsoleDistPath();

package/dist/adapters/http/ui/console-packages/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","resolveAccountConsoleDistPath","setAccountConsolePackagePath","resolveAuthConsoleDistPath","setAuthConsolePackagePath","AUTH_CONSOLE_CONTRACT_VERSION","AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC","ACCOUNT_CONSOLE_CONFIG_MARKER","bindConsolePackages","options","authConsolePath","accountConsolePath","assertAuthConsoleContract","assertAccountConsoleContract","packagePath","distPath","entry","join","module","e","reason","message","render","version","CONTRACT_VERSION","html","readFileSync","includes"],"sources":["../../../../../src/adapters/http/ui/console-packages/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport {\n    resolveAccountConsoleDistPath,\n    setAccountConsolePackagePath,\n} from '../account-console/index.ts';\nimport { resolveAuthConsoleDistPath, setAuthConsolePackagePath } from '../auth-console/index.ts';\n// Type position only (see AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC below), so\n// the runtime stays a dist-file read and the layering rule holds.\nimport type { CONTRACT_VERSION as AuthConsoleContractVersion } from '@authup/client-auth-console';\nimport type { ConsolePackageOptions } from './types.ts';\n\n/**\n * The render-contract version server-core compiles against. Must match the\n * `CONTRACT_VERSION` the auth console bundle exports.\n *\n * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a\n * change breaks a package built against the previous shape.\n */\nexport const AUTH_CONSOLE_CONTRACT_VERSION = 2;\n\n/**\n * Compile-time link to the value this constant mirrors.\n *\n * The runtime assert below only fires for a SUBSTITUTED package, so a bump\n * on one side and not the other would otherwise go unnoticed until a\n * substituted console failed at boot in someone else's deployment. The\n * annotation costs nothing at runtime (types are erased) and fails this\n * package's build the moment the two drift.\n */\ntype AuthConsoleContractVersionInSync =    typeof AuthConsoleContractVersion extends typeof AUTH_CONSOLE_CONTRACT_VERSION ?\n    true :\n    never;\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nconst AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC : AuthConsoleContractVersionInSync = true;\n\n/**\n * The marker the account console's index.html must carry. It is that\n * console's entire runtime contract: without it the injected\n * `window.__AUTHUP__` never lands and the SPA silently falls back to\n * deriving its API URL from the origin.\n */\nexport const ACCOUNT_CONSOLE_CONFIG_MARKER = '<!--account-config-->';\n\n/**\n * Bind the substituted console packages and verify they still fulfill the\n * contracts, before the first request rather than per render.\n *\n * Only runs for a package the operator actually substituted. With the\n * default resolution the console packages ship from this repo with linked\n * versions, so the assert would compare a constant against itself, and\n * loading the SSR bundle at boot would turn a missing build into a failed\n * start instead of an actionable error on the page.\n *\n * Fail-closed on a mismatch: the operator replaced the login and consent\n * IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA\n * ordering, redirect gating), so a contract drift must stop the container\n * rather than render subtly wrong auth pages.\n */\nexport async function bindConsolePackages(options: ConsolePackageOptions = {}) : Promise<void> {\n    setAuthConsolePackagePath(options.authConsolePath);\n    setAccountConsolePackagePath(options.accountConsolePath);\n\n    if (options.authConsolePath) {\n        await assertAuthConsoleContract(options.authConsolePath);\n    }\n\n    if (options.accountConsolePath) {\n        assertAccountConsoleContract(options.accountConsolePath);\n    }\n}\n\nasync function assertAuthConsoleContract(packagePath: string) : Promise<void> {\n    const distPath = resolveAuthConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" carries no built bundle (expected dist/client/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'server', 'server.js');\n\n    let module : Record<string, any>;\n    try {\n        module = await read(entry) as Record<string, any>;\n    } catch (e) {\n        const reason = normalizeError(e).message;\n\n        throw new AuthupError(`The auth console render entry \"${entry}\" could not be loaded.\\n  ${reason}`);\n    }\n\n    if (typeof module.render !== 'function') {\n        throw new AuthupError(`The auth console bundle \"${entry}\" does not export a render() function.`);\n    }\n\n    // A bundle predating the export counts as version 1, the shape every\n    // package built before the constant existed implements.\n    const version = typeof module.CONTRACT_VERSION === 'undefined' ?\n        1 :\n        module.CONTRACT_VERSION;\n\n    if (version !== AUTH_CONSOLE_CONTRACT_VERSION) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" implements render-contract version ${version}, but this authup requires ${AUTH_CONSOLE_CONTRACT_VERSION}. Rebuild it against the current @authup/client-auth-console contract.`,\n        );\n    }\n}\n\nfunction assertAccountConsoleContract(packagePath: string) : void {\n    const distPath = resolveAccountConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The account console package at \"${packagePath}\" carries no built bundle (expected dist/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'index.html');\n    const html = fs.readFileSync(entry, 'utf-8');\n\n    if (!html.includes(ACCOUNT_CONSOLE_CONFIG_MARKER)) {\n        throw new AuthupError(\n            `The account console shell \"${entry}\" carries no ${ACCOUNT_CONSOLE_CONFIG_MARKER} marker, so its runtime configuration cannot be injected.`,\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;GA4BA,MAAaS,gCAAgC;;;;;;GAuB7C,MAAaE,gCAAgC;;;;;;;;;;;;;;;GAiB7C,eAAsBC,oBAAoBC,UAAiC,CAAC,GAAC;CACzEL,0BAA0BK,QAAQC,eAAe;CACjDR,6BAA6BO,QAAQE,kBAAkB;CAEvD,IAAIF,QAAQC,iBACR,MAAME,0BAA0BH,QAAQC,eAAe;CAG3D,IAAID,QAAQE,oBACRE,6BAA6BJ,QAAQE,kBAAkB;AAE/D;AAEA,eAAeC,0BAA0BE,aAAmB;CACxD,MAAMC,WAAWZ,2BAAAA;CACjB,IAAI,CAACY,UACD,MAAM,IAAInB,YACN,gCAAgCkB,YAAY,6DAA6D;CAIjH,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,UAAU,WAAA;CAE5C,IAAIG;CACJ,IAAI;EACAA,SAAS,MAAMpB,KAAKkB,KAAAA;CACxB,SAASG,GAAG;EACR,MAAMC,SAASvB,eAAesB,CAAAA,CAAAA,CAAGE;EAEjC,MAAM,IAAIzB,YAAY,kCAAkCoB,MAAM,4BAA4BI,QAAQ;CACtG;CAEA,IAAI,OAAOF,OAAOI,WAAW,YACzB,MAAM,IAAI1B,YAAY,4BAA4BoB,MAAM,uCAAuC;CAKnG,MAAMO,UAAU,OAAOL,OAAOM,qBAAqB,cAC/C,IACAN,OAAOM;CAEX,IAAID,YAAAA,GACA,MAAM,IAAI3B,YACN,gCAAgCkB,YAAY,uCAAuCS,QAAQ,mGAAkI;AAGzO;AAEA,SAASV,6BAA6BC,aAAmB;CACrD,MAAMC,WAAWd,8BAAAA;CACjB,IAAI,CAACc,UACD,MAAM,IAAInB,YACN,mCAAmCkB,YAAY,sDAAsD;CAI7G,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,YAAA;CAGlC,IAAI,CAFShB,GAAG2B,aAAaV,OAAO,OAE/BS,CAAAA,CAAKE,SAAAA,uBAASpB,GACf,MAAM,IAAIX,YACN,8BAA8BoB,MAAM,eAAeT,8BAA8B,0DAA0D;AAGvJ"}
+{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","resolveAccountConsoleDistPath","setAccountConsolePackagePath","resolveAuthConsoleDistPath","setAuthConsolePackagePath","AUTH_CONSOLE_CONTRACT_VERSION","AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC","ACCOUNT_CONSOLE_CONFIG_MARKER","bindConsolePackages","options","authConsolePath","accountConsolePath","assertAuthConsoleContract","assertAccountConsoleContract","packagePath","distPath","entry","join","module","e","reason","message","render","version","CONTRACT_VERSION","html","readFileSync","includes"],"sources":["../../../../../src/adapters/http/ui/console-packages/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport {\n    resolveAccountConsoleDistPath,\n    setAccountConsolePackagePath,\n} from '../account-console/index.ts';\nimport { resolveAuthConsoleDistPath, setAuthConsolePackagePath } from '../auth-console/index.ts';\n// Type position only (see AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC below), so\n// the runtime stays a dist-file read and the layering rule holds.\nimport type { CONTRACT_VERSION as AuthConsoleContractVersion } from '@authup/client-auth-console';\nimport type { ConsolePackageOptions } from './types.ts';\n\n/**\n * The render-contract version server-core compiles against. Must match the\n * `CONTRACT_VERSION` the auth console bundle exports.\n *\n * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a\n * change breaks a package built against the previous shape.\n */\nexport const AUTH_CONSOLE_CONTRACT_VERSION = 3;\n\n/**\n * Compile-time link to the value this constant mirrors.\n *\n * The runtime assert below only fires for a SUBSTITUTED package, so a bump\n * on one side and not the other would otherwise go unnoticed until a\n * substituted console failed at boot in someone else's deployment. The\n * annotation costs nothing at runtime (types are erased) and fails this\n * package's build the moment the two drift.\n */\ntype AuthConsoleContractVersionInSync =    typeof AuthConsoleContractVersion extends typeof AUTH_CONSOLE_CONTRACT_VERSION ?\n    true :\n    never;\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nconst AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC : AuthConsoleContractVersionInSync = true;\n\n/**\n * The marker the account console's index.html must carry. It is that\n * console's entire runtime contract: without it the injected\n * `window.__AUTHUP__` never lands and the SPA silently falls back to\n * deriving its API URL from the origin.\n */\nexport const ACCOUNT_CONSOLE_CONFIG_MARKER = '<!--account-config-->';\n\n/**\n * Bind the substituted console packages and verify they still fulfill the\n * contracts, before the first request rather than per render.\n *\n * Only runs for a package the operator actually substituted. With the\n * default resolution the console packages ship from this repo with linked\n * versions, so the assert would compare a constant against itself, and\n * loading the SSR bundle at boot would turn a missing build into a failed\n * start instead of an actionable error on the page.\n *\n * Fail-closed on a mismatch: the operator replaced the login and consent\n * IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA\n * ordering, redirect gating), so a contract drift must stop the container\n * rather than render subtly wrong auth pages.\n */\nexport async function bindConsolePackages(options: ConsolePackageOptions = {}) : Promise<void> {\n    setAuthConsolePackagePath(options.authConsolePath);\n    setAccountConsolePackagePath(options.accountConsolePath);\n\n    if (options.authConsolePath) {\n        await assertAuthConsoleContract(options.authConsolePath);\n    }\n\n    if (options.accountConsolePath) {\n        assertAccountConsoleContract(options.accountConsolePath);\n    }\n}\n\nasync function assertAuthConsoleContract(packagePath: string) : Promise<void> {\n    const distPath = resolveAuthConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" carries no built bundle (expected dist/client/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'server', 'server.js');\n\n    let module : Record<string, any>;\n    try {\n        module = await read(entry) as Record<string, any>;\n    } catch (e) {\n        const reason = normalizeError(e).message;\n\n        throw new AuthupError(`The auth console render entry \"${entry}\" could not be loaded.\\n  ${reason}`);\n    }\n\n    if (typeof module.render !== 'function') {\n        throw new AuthupError(`The auth console bundle \"${entry}\" does not export a render() function.`);\n    }\n\n    // A bundle predating the export counts as version 1, the shape every\n    // package built before the constant existed implements.\n    const version = typeof module.CONTRACT_VERSION === 'undefined' ?\n        1 :\n        module.CONTRACT_VERSION;\n\n    if (version !== AUTH_CONSOLE_CONTRACT_VERSION) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" implements render-contract version ${version}, but this authup requires ${AUTH_CONSOLE_CONTRACT_VERSION}. Rebuild it against the current @authup/client-auth-console contract.`,\n        );\n    }\n}\n\nfunction assertAccountConsoleContract(packagePath: string) : void {\n    const distPath = resolveAccountConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The account console package at \"${packagePath}\" carries no built bundle (expected dist/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'index.html');\n    const html = fs.readFileSync(entry, 'utf-8');\n\n    if (!html.includes(ACCOUNT_CONSOLE_CONFIG_MARKER)) {\n        throw new AuthupError(\n            `The account console shell \"${entry}\" carries no ${ACCOUNT_CONSOLE_CONFIG_MARKER} marker, so its runtime configuration cannot be injected.`,\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;GA4BA,MAAaS,gCAAgC;;;;;;GAuB7C,MAAaE,gCAAgC;;;;;;;;;;;;;;;GAiB7C,eAAsBC,oBAAoBC,UAAiC,CAAC,GAAC;CACzEL,0BAA0BK,QAAQC,eAAe;CACjDR,6BAA6BO,QAAQE,kBAAkB;CAEvD,IAAIF,QAAQC,iBACR,MAAME,0BAA0BH,QAAQC,eAAe;CAG3D,IAAID,QAAQE,oBACRE,6BAA6BJ,QAAQE,kBAAkB;AAE/D;AAEA,eAAeC,0BAA0BE,aAAmB;CACxD,MAAMC,WAAWZ,2BAAAA;CACjB,IAAI,CAACY,UACD,MAAM,IAAInB,YACN,gCAAgCkB,YAAY,6DAA6D;CAIjH,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,UAAU,WAAA;CAE5C,IAAIG;CACJ,IAAI;EACAA,SAAS,MAAMpB,KAAKkB,KAAAA;CACxB,SAASG,GAAG;EACR,MAAMC,SAASvB,eAAesB,CAAAA,CAAAA,CAAGE;EAEjC,MAAM,IAAIzB,YAAY,kCAAkCoB,MAAM,4BAA4BI,QAAQ;CACtG;CAEA,IAAI,OAAOF,OAAOI,WAAW,YACzB,MAAM,IAAI1B,YAAY,4BAA4BoB,MAAM,uCAAuC;CAKnG,MAAMO,UAAU,OAAOL,OAAOM,qBAAqB,cAC/C,IACAN,OAAOM;CAEX,IAAID,YAAAA,GACA,MAAM,IAAI3B,YACN,gCAAgCkB,YAAY,uCAAuCS,QAAQ,mGAAkI;AAGzO;AAEA,SAASV,6BAA6BC,aAAmB;CACrD,MAAMC,WAAWd,8BAAAA;CACjB,IAAI,CAACc,UACD,MAAM,IAAInB,YACN,mCAAmCkB,YAAY,sDAAsD;CAI7G,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,YAAA;CAGlC,IAAI,CAFShB,GAAG2B,aAAaV,OAAO,OAE/BS,CAAAA,CAAKE,SAAAA,uBAASpB,GACf,MAAM,IAAIX,YACN,8BAA8BoB,MAAM,eAAeT,8BAA8B,0DAA0D;AAGvJ"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0L9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4L9E"}

package/dist/app/modules/config/normalize.mjs

@@ -16,7 +16,6 @@ import process from "node:process";
 //#region src/app/modules/config/normalize.ts
 async function normalizeConfig(input = {}) {
 	const parsed = await parseConfig(input);
-	const writableDirectoryPath = parsed.writableDirectoryPath || path.join(process.cwd(), "writable");
 	const port = parsed.port ?? 3001;
 	let host = parsed.host || "0.0.0.0";
 	let publicUrl;
@@ -38,7 +37,7 @@ async function normalizeConfig(input = {}) {
 	const config = {
 		env,
 		rootPath: process.cwd(),
-		writableDirectoryPath,
+		writableDirectoryPath: "writable",
 		themeDirectoryPath: "",
 		themeFragmentsEnabled: false,
 		authConsolePath: "",
@@ -94,6 +93,7 @@ async function normalizeConfig(input = {}) {
 		...parsed,
 		trustedOrigins
 	};
+	config.writableDirectoryPath = path.resolve(config.rootPath, config.writableDirectoryPath || "writable");
 	if (config.themeDirectoryPath) config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);
 	if (config.authConsolePath) config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);
 	if (config.accountConsolePath) config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","resolve","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-admin-console runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n        // '' = theming disabled. Deliberately NOT defaulted under\n        // writableDirectoryPath: that directory is process-writable, and\n        // pairing \"process-writable\" with \"content injected into the login\n        // page\" would turn any write primitive landing there into\n        // persistent branding control on the IdP origin.\n        themeDirectoryPath: '',\n        themeFragmentsEnabled: false,\n        authConsolePath: '',\n        accountConsolePath: '',\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n        accountConsoleEnabled: true,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // After the spread, so a relative value supplied by any config surface\n    // is resolved. Every consumer then receives an absolute path and none\n    // of them has to care what the process cwd was.\n    if (config.themeDirectoryPath) {\n        config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);\n    }\n\n    if (config.authConsolePath) {\n        config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);\n    }\n\n    if (config.accountConsolePath) {\n        config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);\n    }\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,wBAAwBD,OAAOC,yBACjCf,KAAKgB,KAAKf,QAAQgB,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUb,aAAaY,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMT,OAAOS,OAAOxB,KAAK,YAAYK,gBAAgBoB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAASZ,OAAOW,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUnB,gBAAgBkB,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQnB,gBAAgB0B,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAUhC,QAAQgB,IAAG;EACrBF;EAMAmB,oBAAoB;EACpBC,uBAAuB;EACvBC,iBAAiB;EACjBC,oBAAoB;EAEpBC,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENtB;EACAC;EACAC;EACAqB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBzD;EACnB0D,uBAAuB;EAEvBC,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGpE;EAIHW;CACJ;CAKA,IAAIO,OAAOE,oBACPF,OAAOE,qBAAqBlC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOE,kBAAkB;CAGvF,IAAIF,OAAOI,iBACPJ,OAAOI,kBAAkBpC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOI,eAAe;CAGjF,IAAIJ,OAAOK,oBACPL,OAAOK,qBAAqBrC,KAAKmF,QAAQnD,OAAOC,UAAUD,OAAOK,kBAAkB;CAOvF,IAAI,OAAOL,OAAOW,eAAe,UAC7BX,OAAOW,aAAajC,uBAAuBsB,OAAOW,UAAU;MACzD,IAAIyC,MAAMC,QAAQrD,OAAOW,UAAU,GACtCX,OAAOW,aAAaX,OAAOW,WAAW2C,IAAI3E,+BAAAA;CAK9C,IAAIqB,OAAOiC,+BAA+B,CAACjC,OAAO6B,iBAC9C,MAAM,IAAI1D,YAAY,uDAAA;CAG1B,IAAI6B,OAAOsC,eAAe,CAACtC,OAAOqC,YAC9B,MAAM,IAAIlE,YAAY,kCAAA;CAG1B,IAAI6B,OAAOS,iBAAiBT,OAAOU,sBAAsB,YACrD,MAAM,IAAIvC,YAAY,yDAAA;CAQ1B,IAAI6B,OAAOoC,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAalF,oBAAoB2B,OAAOoC,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAIpF,YAAY,gEAAA;CAE9B;CAEA,OAAO6B;AACX"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","cwd","writableDirectoryPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","resolve","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-admin-console runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath: 'writable',\n        // '' = theming disabled. Deliberately NOT defaulted under\n        // writableDirectoryPath: that directory is process-writable, and\n        // pairing \"process-writable\" with \"content injected into the login\n        // page\" would turn any write primitive landing there into\n        // persistent branding control on the IdP origin.\n        themeDirectoryPath: '',\n        themeFragmentsEnabled: false,\n        authConsolePath: '',\n        accountConsolePath: '',\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n        accountConsoleEnabled: true,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // After the spread, so a relative value supplied by any config surface\n    // is resolved. Every consumer then receives an absolute path and none\n    // of them has to care what the process cwd was.\n    config.writableDirectoryPath = path.resolve(\n        config.rootPath,\n        config.writableDirectoryPath || 'writable',\n    );\n\n    if (config.themeDirectoryPath) {\n        config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);\n    }\n\n    if (config.authConsolePath) {\n        config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);\n    }\n\n    if (config.accountConsolePath) {\n        config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);\n    }\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,OAAOD,OAAOC,QAAQ;CAC5B,IAAIC,OAAOF,OAAOE,QAAQ;CAE1B,IAAIC;CACJ,IAAIH,OAAOG,WACPA,YAAYH,OAAOG;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMN,OAAOM,OAAOrB,KAAK,YAAYK,gBAAgBiB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAAST,OAAOQ,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUhB,gBAAgBe,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQhB,gBAAgBuB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU7B,QAAQ8B,IAAG;EACrBC,uBAAuB;EAMvBC,oBAAoB;EACpBC,uBAAuB;EACvBC,iBAAiB;EACjBC,oBAAoB;EAEpBC,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENxB;EACAC;EACAC;EACAuB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBxD;EACnByD,uBAAuB;EAEvBC,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGnE;EAIHQ;CACJ;CAKAO,OAAOG,wBAAwBhC,KAAKkF,QAChCrD,OAAOC,UACPD,OAAOG,yBAAyB,UAAA;CAGpC,IAAIH,OAAOI,oBACPJ,OAAOI,qBAAqBjC,KAAKkF,QAAQrD,OAAOC,UAAUD,OAAOI,kBAAkB;CAGvF,IAAIJ,OAAOM,iBACPN,OAAOM,kBAAkBnC,KAAKkF,QAAQrD,OAAOC,UAAUD,OAAOM,eAAe;CAGjF,IAAIN,OAAOO,oBACPP,OAAOO,qBAAqBpC,KAAKkF,QAAQrD,OAAOC,UAAUD,OAAOO,kBAAkB;CAOvF,IAAI,OAAOP,OAAOa,eAAe,UAC7Bb,OAAOa,aAAahC,uBAAuBmB,OAAOa,UAAU;MACzD,IAAIyC,MAAMC,QAAQvD,OAAOa,UAAU,GACtCb,OAAOa,aAAab,OAAOa,WAAW2C,IAAI1E,+BAAAA;CAK9C,IAAIkB,OAAOmC,+BAA+B,CAACnC,OAAO+B,iBAC9C,MAAM,IAAIzD,YAAY,uDAAA;CAG1B,IAAI0B,OAAOwC,eAAe,CAACxC,OAAOuC,YAC9B,MAAM,IAAIjE,YAAY,kCAAA;CAG1B,IAAI0B,OAAOW,iBAAiBX,OAAOY,sBAAsB,YACrD,MAAM,IAAItC,YAAY,yDAAA;CAQ1B,IAAI0B,OAAOsC,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAajF,oBAAoBwB,OAAOsC,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAInF,YAAY,gEAAA;CAE9B;CAEA,OAAO0B;AACX"}

package/dist/app/modules/config/types.d.ts

@@ -20,6 +20,14 @@ export type Config = {
      */
     rootPath: string;
     /**
+     * Directory the application writes to at runtime (log files in
+     * production) and reads file-based provisioning from
+     * (`<writableDirectoryPath>/provisioning`).
+     *
+     * The SQLite database is NOT placed here - its path comes from the
+     * database configuration (`db.database` / `DB_DATABASE`), resolved
+     * against the process working directory by typeorm-extension.
+     *
      * Relative or absolute path.
      * If the path is relative, the rootPath will be appended.
      *

package/dist/app/modules/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;OAWG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,MAAM,MAAM,MAAM,GAAG;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;OAWG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAE3D;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAIrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IAErC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IAIzB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC;IAE1C;;OAEG;IACH,oBAAoB,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAElD;;OAEG;IACH,eAAe,EAAE,OAAO,GAAG,YAAY,CAAC;IAExC;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAI9C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,yBAAyB,EAAE,MAAM,CAAC;IAIlC;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAI/B;;;;;OAKG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAI3B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IAIxB;;OAEG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAIjC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAIhC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;;;;OAMG;IACH,kCAAkC,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC"}

package/dist/app/modules/database/repositories/identity-provider/repository.d.ts

@@ -21,7 +21,9 @@ export declare class IdentityProviderRepositoryAdapter implements IIdentityProvi
     create(data: Partial<IdentityProvider>): IdentityProvider;
     merge(entity: IdentityProvider, data: Partial<IdentityProvider>): IdentityProvider;
     save(entity: IdentityProvider): Promise<IdentityProvider>;
-    saveWithEA(entity: IdentityProvider, attributes?: Record<string, any>): Promise<IdentityProvider>;
+    saveWithEA(entity: IdentityProvider, attributes?: Record<string, any>, options?: {
+        keepAll?: boolean;
+    }): Promise<IdentityProvider>;
     extendOneWithEA(entity: IdentityProvider): Promise<void>;
     remove(entity: IdentityProvider): Promise<void>;
     validateJoinColumns(data: Partial<IdentityProvider>): Promise<void>;

package/dist/app/modules/database/repositories/identity-provider/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/identity-provider/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,2BAA2B,EAAoB,MAAM,8BAA8B,CAAC;AAElG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAKpG,MAAM,MAAM,wCAAwC,GAAG;IACnD,UAAU,EAAE,0BAA0B,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,iCAAkC,YAAW,2BAA2B;IACjF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,wCAAwC;IAKnD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAiBlF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQzD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAmBhF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrF,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAInE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI7E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB;IAIzD,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB;IAI5E,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIzD,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKjG,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5F,cAAc,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAgB3G"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/identity-provider/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,2BAA2B,EAAoB,MAAM,8BAA8B,CAAC;AAElG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAKpG,MAAM,MAAM,wCAAwC,GAAG;IACnD,UAAU,EAAE,0BAA0B,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,iCAAkC,YAAW,2BAA2B;IACjF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,wCAAwC;IAKnD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAiBlF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQzD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAmBhF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrF,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAInE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI7E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB;IAIzD,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB;IAI5E,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIzD,UAAU,CACZ,MAAM,EAAE,gBAAgB,EACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChC,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAKtB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5F,cAAc,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAgB3G"}

package/dist/app/modules/database/repositories/identity-provider/repository.mjs

@@ -66,8 +66,8 @@ var IdentityProviderRepositoryAdapter = class {
 	async save(entity) {
 		return this.repository.save(entity);
 	}
-	async saveWithEA(entity, attributes) {
-		await this.repository.saveOneWithEA(entity, attributes);
+	async saveWithEA(entity, attributes, options) {
+		await this.repository.saveOneWithEA(entity, attributes, options);
 		return entity;
 	}
 	async extendOneWithEA(entity) {

package/dist/app/modules/database/repositories/identity-provider/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","IdentityProviderEntity","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","IdentityProviderRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","save","saveWithEA","attributes","saveOneWithEA","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","findByProtocol","protocol","getMany","extendManyWithEA"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProvider, IdentityProviderProtocol, Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IIdentityProviderRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { IdentityProviderRepository } from '../../../../../adapters/database/domains/index.ts';\nimport { IdentityProviderEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type IdentityProviderRepositoryAdapterContext = {\n    repository: IdentityProviderRepository,\n    realmRepository: Repository<Realm>,\n};\n\nexport class IdentityProviderRepositoryAdapter implements IIdentityProviderRepository {\n    private readonly repository: IdentityProviderRepository;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: IdentityProviderRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<IdentityProvider>> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.groupBy('provider.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProvider | null> {\n        const entity = await this.findOneBy({ id });\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<IdentityProvider | null> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('provider.realmId = :realmId', { realmId });\n        }\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<IdentityProvider | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<IdentityProvider[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<IdentityProvider | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.create(data);\n    }\n\n    merge(entity: IdentityProvider, data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: IdentityProvider): Promise<IdentityProvider> {\n        return this.repository.save(entity);\n    }\n\n    async saveWithEA(entity: IdentityProvider, attributes?: Record<string, any>): Promise<IdentityProvider> {\n        await this.repository.saveOneWithEA(entity, attributes);\n        return entity;\n    }\n\n    async extendOneWithEA(entity: IdentityProvider): Promise<void> {\n        await this.repository.extendOneWithEA(entity);\n    }\n\n    async remove(entity: IdentityProvider): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<IdentityProvider>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<IdentityProvider>, existing?: IdentityProvider): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async findByProtocol(protocol: IdentityProviderProtocol, realmKey?: string): Promise<IdentityProvider[]> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.protocol = :protocol', { protocol });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return [];\n            }\n            qb.andWhere('provider.realmId = :realmId', { realmId });\n        }\n\n        const entities = await qb.getMany();\n        await this.repository.extendManyWithEA(entities);\n        return entities;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,IAAaS,oCAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAA+C;EACvD,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGE,QAAQ,aAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMnB,sBAAsBW,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,YAAYC,IAA8C;EAC5D,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAKhB,WAAWkB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAAqD;EACnF,MAAMhB,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGiB,MAAM,yBAAyB,EAAEF,KAAK,CAAA;EAEzC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKtB,gBAAgBuB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXlB,GAAGoB,SAAS,+BAA+B,EAAEF,QAAQ,CAAA;EACzD;EAEA,MAAMP,SAAS,MAAMX,GAAGqB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKhB,WAAWkB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAkD;EACxF,OAAOvC,OAAOsC,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAAyD;EACtE,OAAO,KAAKtB,WAAW+B,OAAOlC,yBAAyByB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA8D;EAC1E,OAAO,KAAKtB,WAAWiB,UAAUpB,yBAAyByB,KAAAA,CAAAA;CAC9D;CAEAU,OAAOpB,MAAmD;EACtD,OAAO,KAAKZ,WAAWgC,OAAOpB,IAAAA;CAClC;CAEAqB,MAAMjB,QAA0BJ,MAAmD;EAC/E,OAAO,KAAKZ,WAAWiC,MAAMjB,QAAQJ,IAAAA;CACzC;CAEA,MAAMsB,KAAKlB,QAAqD;EAC5D,OAAO,KAAKhB,WAAWkC,KAAKlB,MAAAA;CAChC;CAEA,MAAMmB,WAAWnB,QAA0BoB,YAA6D;EACpG,MAAM,KAAKpC,WAAWqC,cAAcrB,QAAQoB,UAAAA;EAC5C,OAAOpB;CACX;CAEA,MAAME,gBAAgBF,QAAyC;EAC3D,MAAM,KAAKhB,WAAWkB,gBAAgBF,MAAAA;CAC1C;CAEA,MAAMsB,OAAOtB,QAAyC;EAClD,MAAM,KAAKhB,WAAWsC,OAAOtB,MAAAA;CACjC;CAEA,MAAMuB,oBAAoB3B,MAAgD;EACtE,MAAMrB,0BAA0BqB,MAAM;GAClC4B,YAAY,KAAKxC,WAAWyC,QAAQC;GACpCC,cAAchD;EAClB,CAAA;CACJ;CAEA,MAAMiD,gBAAgBhC,MAAiCiC,UAA4C;EAQ/F,IAAI,CAACC,MAPkBlD,eAAe;GAClC4C,YAAY,KAAKxC,WAAWyC,QAAQC;GACpCC,cAAchD;GACdqB,QAAQJ;GACRmC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAInD,sBAAAA;CAElB;CAEA,MAAMsD,eAAeC,UAAoC5B,UAAgD;EACrG,MAAMhB,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGiB,MAAM,iCAAiC,EAAE2B,SAAS,CAAA;EAErD,IAAI5B,UAAU;GACV,MAAME,UAAU,MAAM,KAAKtB,gBAAgBuB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO,CAAA;GAEXlB,GAAGoB,SAAS,+BAA+B,EAAEF,QAAQ,CAAA;EACzD;EAEA,MAAMd,WAAW,MAAMJ,GAAG6C,QAAO;EACjC,MAAM,KAAKlD,WAAWmD,iBAAiB1C,QAAAA;EACvC,OAAOA;CACX;AACJ"}
+{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","IdentityProviderEntity","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","IdentityProviderRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","save","saveWithEA","attributes","options","saveOneWithEA","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","findByProtocol","protocol","getMany","extendManyWithEA"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProvider, IdentityProviderProtocol, Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IIdentityProviderRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { IdentityProviderRepository } from '../../../../../adapters/database/domains/index.ts';\nimport { IdentityProviderEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type IdentityProviderRepositoryAdapterContext = {\n    repository: IdentityProviderRepository,\n    realmRepository: Repository<Realm>,\n};\n\nexport class IdentityProviderRepositoryAdapter implements IIdentityProviderRepository {\n    private readonly repository: IdentityProviderRepository;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: IdentityProviderRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<IdentityProvider>> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.groupBy('provider.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProvider | null> {\n        const entity = await this.findOneBy({ id });\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<IdentityProvider | null> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('provider.realmId = :realmId', { realmId });\n        }\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<IdentityProvider | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<IdentityProvider[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<IdentityProvider | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.create(data);\n    }\n\n    merge(entity: IdentityProvider, data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: IdentityProvider): Promise<IdentityProvider> {\n        return this.repository.save(entity);\n    }\n\n    async saveWithEA(\n        entity: IdentityProvider,\n        attributes?: Record<string, any>,\n        options?: { keepAll?: boolean },\n    ): Promise<IdentityProvider> {\n        await this.repository.saveOneWithEA(entity, attributes, options);\n        return entity;\n    }\n\n    async extendOneWithEA(entity: IdentityProvider): Promise<void> {\n        await this.repository.extendOneWithEA(entity);\n    }\n\n    async remove(entity: IdentityProvider): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<IdentityProvider>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<IdentityProvider>, existing?: IdentityProvider): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async findByProtocol(protocol: IdentityProviderProtocol, realmKey?: string): Promise<IdentityProvider[]> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.protocol = :protocol', { protocol });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return [];\n            }\n            qb.andWhere('provider.realmId = :realmId', { realmId });\n        }\n\n        const entities = await qb.getMany();\n        await this.repository.extendManyWithEA(entities);\n        return entities;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,IAAaS,oCAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAA+C;EACvD,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGE,QAAQ,aAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMnB,sBAAsBW,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,YAAYC,IAA8C;EAC5D,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAKhB,WAAWkB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAAqD;EACnF,MAAMhB,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGiB,MAAM,yBAAyB,EAAEF,KAAK,CAAA;EAEzC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKtB,gBAAgBuB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXlB,GAAGoB,SAAS,+BAA+B,EAAEF,QAAQ,CAAA;EACzD;EAEA,MAAMP,SAAS,MAAMX,GAAGqB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKhB,WAAWkB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAkD;EACxF,OAAOvC,OAAOsC,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAAyD;EACtE,OAAO,KAAKtB,WAAW+B,OAAOlC,yBAAyByB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA8D;EAC1E,OAAO,KAAKtB,WAAWiB,UAAUpB,yBAAyByB,KAAAA,CAAAA;CAC9D;CAEAU,OAAOpB,MAAmD;EACtD,OAAO,KAAKZ,WAAWgC,OAAOpB,IAAAA;CAClC;CAEAqB,MAAMjB,QAA0BJ,MAAmD;EAC/E,OAAO,KAAKZ,WAAWiC,MAAMjB,QAAQJ,IAAAA;CACzC;CAEA,MAAMsB,KAAKlB,QAAqD;EAC5D,OAAO,KAAKhB,WAAWkC,KAAKlB,MAAAA;CAChC;CAEA,MAAMmB,WACFnB,QACAoB,YACAC,SACyB;EACzB,MAAM,KAAKrC,WAAWsC,cAActB,QAAQoB,YAAYC,OAAAA;EACxD,OAAOrB;CACX;CAEA,MAAME,gBAAgBF,QAAyC;EAC3D,MAAM,KAAKhB,WAAWkB,gBAAgBF,MAAAA;CAC1C;CAEA,MAAMuB,OAAOvB,QAAyC;EAClD,MAAM,KAAKhB,WAAWuC,OAAOvB,MAAAA;CACjC;CAEA,MAAMwB,oBAAoB5B,MAAgD;EACtE,MAAMrB,0BAA0BqB,MAAM;GAClC6B,YAAY,KAAKzC,WAAW0C,QAAQC;GACpCC,cAAcjD;EAClB,CAAA;CACJ;CAEA,MAAMkD,gBAAgBjC,MAAiCkC,UAA4C;EAQ/F,IAAI,CAACC,MAPkBnD,eAAe;GAClC6C,YAAY,KAAKzC,WAAW0C,QAAQC;GACpCC,cAAcjD;GACdqB,QAAQJ;GACRoC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIpD,sBAAAA;CAElB;CAEA,MAAMuD,eAAeC,UAAoC7B,UAAgD;EACrG,MAAMhB,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGiB,MAAM,iCAAiC,EAAE4B,SAAS,CAAA;EAErD,IAAI7B,UAAU;GACV,MAAME,UAAU,MAAM,KAAKtB,gBAAgBuB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO,CAAA;GAEXlB,GAAGoB,SAAS,+BAA+B,EAAEF,QAAQ,CAAA;EACzD;EAEA,MAAMd,WAAW,MAAMJ,GAAG8C,QAAO;EACjC,MAAM,KAAKnD,WAAWoD,iBAAiB3C,QAAAA;EACvC,OAAOA;CACX;AACJ"}

package/dist/app/modules/http/modules/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAoElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iCAAiC,EACjC,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAOd,2BAA2B,EAI3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAWnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4E9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAY7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IASxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAoD5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,4BAA4B,CAAC,SAAS,EAAE,UAAU;IAOlD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,uCAAuC,CAAC,SAAS,EAAE,UAAU;IAe7D,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAuD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAoElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iCAAiC,EACjC,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAOd,2BAA2B,EAI3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAWnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4E9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAY7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IASxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAuD5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,4BAA4B,CAAC,SAAS,EAAE,UAAU;IAOlD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,uCAAuC,CAAC,SAAS,EAAE,UAAU;IAe7D,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAuD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}

package/dist/app/modules/http/modules/controller.mjs

@@ -440,7 +440,6 @@ var HTTPControllerModule = class {
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const accountManager = container.resolve(IdentityInjectionKey.ProviderAccountManager);
 		const linkStore = container.resolve(IdentityInjectionKey.ProviderAccountLinkStore);
-		const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);
 		const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);
 		const stateManager = container.resolve(OAuth2InjectionToken.AuthorizationStateManager);
 		const realmRepository = container.resolve(RealmEntity);
@@ -455,9 +454,13 @@ var HTTPControllerModule = class {
 			accountManager,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
 			codeRequestVerifier,
-			codeIssuer,
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
+			pendingLoginStore: container.resolve(OAuth2InjectionToken.FederatedLoginStore),
+			accessTokenIssuer: container.resolve(OAuth2InjectionToken.AccessTokenIssuer),
+			refreshTokenIssuer: container.resolve(OAuth2InjectionToken.RefreshTokenIssuer),
 			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),
 			eventService,
+			metrics: container.resolve(MetricsInjectionKey),
 			logger
 		});
 		return new IdentityProviderController({