@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/app/modules/http/constants.mjs

@@ -4,18 +4,19 @@ import.meta.url;
 import { TypedToken } from "eldin";
 //#region src/app/modules/http/constants.ts
 const HTTPInjectionKey = {
+	App: new TypedToken("IApp"),
 	Server: new TypedToken("Server"),
 	/**
 	* HTTP client for the SSR'd UI pages. `HTTPModule.setup` registers a
 	* default whose transport dispatches against the server's own listen
-	* address (see `createInternalUIHttpClient`); a registration made
+	* address (see `createInternalHttpClient`); a registration made
 	* BEFORE setup wins (test injection). Register it with a
 	* `useFactory` provider and `lifetime: 'transient'` so every
 	* resolve yields a FRESH client: client-web-kit's authentication
 	* hook writes per-user Authorization state onto the client it
 	* attaches to, so a singleton-lifetime instance shared across
 	* concurrent renders would leak tokens between sessions.
-	*/ UIHttpClient: new TypedToken("UIHttpClient")
+	*/ InternalHttpClient: new TypedToken("InternalHttpClient")
 };
 //#endregion
 export { HTTPInjectionKey };

package/dist/app/modules/http/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","HTTPInjectionKey","Server","UIHttpClient"],"sources":["../../../../src/app/modules/http/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport { TypedToken } from 'eldin';\nimport type { serve } from 'routup/node';\n\nexport type HTTPServer = ReturnType<typeof serve>;\n\nexport const HTTPInjectionKey : {\n    Server: TypedToken<HTTPServer>,\n    UIHttpClient: TypedToken<IClient>,\n} = {\n    Server: new TypedToken<HTTPServer>('Server'),\n    /**\n     * HTTP client for the SSR'd UI pages. `HTTPModule.setup` registers a\n     * default whose transport dispatches against the server's own listen\n     * address (see `createInternalUIHttpClient`); a registration made\n     * BEFORE setup wins (test injection). Register it with a\n     * `useFactory` provider and `lifetime: 'transient'` so every\n     * resolve yields a FRESH client: client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client it\n     * attaches to, so a singleton-lifetime instance shared across\n     * concurrent renders would leak tokens between sessions.\n     */\n    UIHttpClient: new TypedToken<IClient>('UIHttpClient'),\n} as const;\n"],"mappings":";;;;;AAaA,MAAaC,mBAGT;CACAC,QAAQ,IAAIF,WAAuB,QAAA;;;;;;;;;;;IAYnCG,cAAc,IAAIH,WAAoB,cAAA;AAC1C"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","HTTPInjectionKey","App","Server","InternalHttpClient"],"sources":["../../../../src/app/modules/http/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport { TypedToken } from 'eldin';\nimport type { serve } from 'routup/node';\nimport type { IApp } from 'routup';\n\nexport type HTTPServer = ReturnType<typeof serve>;\n\nexport const HTTPInjectionKey : {\n    App: TypedToken<IApp>,\n    Server: TypedToken<HTTPServer>,\n    InternalHttpClient: TypedToken<IClient>,\n} = {\n    App: new TypedToken<IApp>('IApp'),\n    Server: new TypedToken<HTTPServer>('Server'),\n    /**\n     * HTTP client for the SSR'd UI pages. `HTTPModule.setup` registers a\n     * default whose transport dispatches against the server's own listen\n     * address (see `createInternalHttpClient`); a registration made\n     * BEFORE setup wins (test injection). Register it with a\n     * `useFactory` provider and `lifetime: 'transient'` so every\n     * resolve yields a FRESH client: client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client it\n     * attaches to, so a singleton-lifetime instance shared across\n     * concurrent renders would leak tokens between sessions.\n     */\n    InternalHttpClient: new TypedToken<IClient>('InternalHttpClient'),\n} as const;\n"],"mappings":";;;;;AAcA,MAAaC,mBAIT;CACAC,KAAK,IAAIF,WAAiB,MAAA;CAC1BG,QAAQ,IAAIH,WAAuB,QAAA;;;;;;;;;;;IAYnCI,oBAAoB,IAAIJ,WAAoB,oBAAA;AAChD"}

package/dist/app/modules/http/module.d.ts

@@ -1,25 +1,46 @@
+import type { IApp } from 'routup';
 import type { IModule } from 'orkos';
 import type { HTTPServer } from './constants.ts';
 import type { IContainer } from 'eldin';
 import { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';
+export type HTTPModuleOptions = {
+    /**
+     * Anything else that rides this listener, mounted in the one window where
+     * it belongs.
+     *
+     * A callback rather than a list, because the ORDER is not negotiable and
+     * is this module's business: it runs AFTER the controllers, so nothing it
+     * carries can shadow a protocol route (every console declares a wildcard
+     * shell route, and `/console/<name>/login/start` is server-core's), and
+     * BEFORE the error middleware, so it inherits the error handling every
+     * other route has. A caller mounting on the resolved app after `setup()`
+     * lands after both, on an already-listening server.
+     *
+     * server-core learns nothing from this: it hands over the app and the
+     * caller composes. A controller for a console appearing in this package
+     * is the smell the hook exists to prevent (plan 101 D2).
+     */
+    mount?: (app: IApp) => Promise<void> | void;
+};
 export declare class HTTPModule implements IModule {
     readonly name: string;
     readonly dependencies: string[];
     protected instance: HTTPServer | undefined;
     protected middleware: HTTPMiddlewareModule;
     protected controller: HTTPControllerModule;
-    protected uiHttpClientRegistered: boolean;
-    constructor();
+    protected internalHttpClientRegistered: boolean;
+    protected options: HTTPModuleOptions;
+    constructor(options?: HTTPModuleOptions);
     setup(container: IContainer): Promise<void>;
     /**
-     * Default HTTP client for the SSR'd UI pages: dispatches against the
-     * server's own listen address instead of round-tripping through the
-     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).
-     * Skipped when the token is already bound (test injection wins).
-     * Transient lifetime is mandatory — client-web-kit's authentication
-     * hook writes per-user Authorization state onto the client.
+     * Default HTTP client for this server's calls to its own API: dispatches
+     * against the server's own listen address instead of round-tripping
+     * through the reverse proxy at `publicUrl` (see
+     * `createInternalHttpClient`). Skipped when the token is already bound
+     * (test injection wins). Transient lifetime is mandatory: the
+     * authentication hook writes per-user Authorization state onto a client.
      */
-    protected registerUIHttpClient(container: IContainer): void;
+    protected registerInternalHttpClient(container: IContainer): void;
     /**
      * Auth-flow metric counters for the emit points (plan 058 Part 2).
      * Registered before the controllers are built — the factories resolve the

package/dist/app/modules/http/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4DjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBvD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAInC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,MAAM,MAAM,iBAAiB,GAAG;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC/C,CAAC;AAEF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,4BAA4B,EAAG,OAAO,CAAC;IAEjD,SAAS,CAAC,OAAO,EAAG,iBAAiB,CAAC;gBAE1B,OAAO,GAAE,iBAAsB;IAWrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DjD;;;;;;;OAOG;IACH,SAAS,CAAC,0BAA0B,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+BjE;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAevD"}

package/dist/app/modules/http/module.mjs

@@ -9,9 +9,8 @@ import "../config/index.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import { HTTPInjectionKey } from "./constants.mjs";
-import { createInternalUIHttpClient } from "../../../adapters/http/ui/auth-console/http-client.mjs";
-import { bindConsolePackages } from "../../../adapters/http/ui/console-packages/module.mjs";
-import "../../../adapters/http/ui/index.mjs";
+import { createInternalHttpClient } from "../../../adapters/http/internal-client/module.mjs";
+import "../../../adapters/http/internal-client/index.mjs";
 import { MetricsInjectionKey } from "../metrics/constants.mjs";
 import { PromAuthFlowMetrics } from "../metrics/prom.mjs";
 import "../metrics/index.mjs";
@@ -29,8 +28,10 @@ var HTTPModule = class {
 	instance;
 	middleware;
 	controller;
-	uiHttpClientRegistered;
-	constructor() {
+	internalHttpClientRegistered;
+	options;
+	constructor(options = {}) {
+		this.options = options;
 		this.name = ModuleName.HTTP;
 		this.dependencies = [
 			ModuleName.CONFIG,
@@ -41,28 +42,25 @@ var HTTPModule = class {
 		];
 		this.controller = new HTTPControllerModule();
 		this.middleware = new HTTPMiddlewareModule();
-		this.uiHttpClientRegistered = false;
+		this.internalHttpClientRegistered = false;
 	}
 	async setup(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		const logger = container.resolve(LoggerInjectionKey);
 		logger.debug("Starting http server...");
-		let router;
+		let app;
 		try {
-			router = new App({ options: { trustProxy: config.trustProxy } });
+			app = new App({ options: { trustProxy: config.trustProxy } });
 		} catch (e) {
 			throw new AuthupError(`Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`);
 		}
-		await bindConsolePackages({
-			authConsolePath: config.authConsolePath,
-			accountConsolePath: config.accountConsolePath
-		});
-		this.registerUIHttpClient(container);
+		this.registerInternalHttpClient(container);
 		this.registerMetrics(container);
-		await this.middleware.mountBefore(router, container);
-		await this.controller.mount(router, container);
-		await this.middleware.mountAfter(router, container);
-		const server = serve(router, {
+		await this.middleware.mountBefore(app, container);
+		await this.controller.mount(app, container);
+		if (this.options.mount) await this.options.mount(app);
+		await this.middleware.mountAfter(app, container);
+		const server = serve(app, {
 			port: config.port,
 			hostname: config.host,
 			silent: true,
@@ -71,28 +69,29 @@ var HTTPModule = class {
 		await server.ready();
 		this.instance = server;
 		if (server.url) logger.debug(`Listening on ${server.url}`);
-		container.register(HTTPInjectionKey.Server, { useValue: server });
 		logger.debug("Started http server.");
+		container.register(HTTPInjectionKey.App, { useValue: app });
+		container.register(HTTPInjectionKey.Server, { useValue: server });
 	}
 	/**
-	* Default HTTP client for the SSR'd UI pages: dispatches against the
-	* server's own listen address instead of round-tripping through the
-	* reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).
-	* Skipped when the token is already bound (test injection wins).
-	* Transient lifetime is mandatory — client-web-kit's authentication
-	* hook writes per-user Authorization state onto the client.
-	*/ registerUIHttpClient(container) {
-		if (container.has(HTTPInjectionKey.UIHttpClient)) return;
-		container.register(HTTPInjectionKey.UIHttpClient, { useFactory: (c) => {
+	* Default HTTP client for this server's calls to its own API: dispatches
+	* against the server's own listen address instead of round-tripping
+	* through the reverse proxy at `publicUrl` (see
+	* `createInternalHttpClient`). Skipped when the token is already bound
+	* (test injection wins). Transient lifetime is mandatory: the
+	* authentication hook writes per-user Authorization state onto a client.
+	*/ registerInternalHttpClient(container) {
+		if (container.has(HTTPInjectionKey.InternalHttpClient)) return;
+		container.register(HTTPInjectionKey.InternalHttpClient, { useFactory: (c) => {
 			const config = c.resolve(ConfigInjectionKey);
 			const server = c.has(HTTPInjectionKey.Server) ? c.resolve(HTTPInjectionKey.Server) : void 0;
-			if (server && server.url) return createInternalUIHttpClient({
+			if (server && server.url) return createInternalHttpClient({
 				publicURL: config.publicUrl,
 				internalURL: server.url
 			});
 			return new Client({ baseURL: config.publicUrl });
 		} }, { lifetime: "transient" });
-		this.uiHttpClientRegistered = true;
+		this.internalHttpClientRegistered = true;
 	}
 	/**
 	* Auth-flow metric counters for the emit points (plan 058 Part 2).
@@ -106,12 +105,11 @@ var HTTPModule = class {
 		container.register(MetricsInjectionKey, { useValue: enabled ? new PromAuthFlowMetrics() : new NoopAuthFlowMetrics() });
 	}
 	async teardown(container) {
-		if (this.uiHttpClientRegistered) {
-			container.unregister(HTTPInjectionKey.UIHttpClient);
-			this.uiHttpClientRegistered = false;
+		if (this.internalHttpClientRegistered) {
+			container.unregister(HTTPInjectionKey.InternalHttpClient);
+			this.internalHttpClientRegistered = false;
 		}
 		container.unregister(MetricsInjectionKey);
-		await this.middleware.teardown();
 		if (!this.instance) return;
 		container.unregister(HTTPInjectionKey.Server);
 		await this.instance.close();

package/dist/app/modules/http/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["Client","AuthupError","App","serve","ConfigInjectionKey","bindConsolePackages","createInternalUIHttpClient","NoopAuthFlowMetrics","ModuleName","HTTPInjectionKey","MetricsInjectionKey","PromAuthFlowMetrics","HTTPControllerModule","HTTPMiddlewareModule","LoggerInjectionKey","HTTPModule","name","dependencies","instance","middleware","controller","uiHttpClientRegistered","HTTP","CONFIG","LOGGER","AUTHENTICATION","IDENTITY","OAUTH2","setup","container","config","resolve","logger","debug","router","options","trustProxy","e","Error","message","String","authConsolePath","accountConsolePath","registerUIHttpClient","registerMetrics","mountBefore","mount","mountAfter","server","port","hostname","host","silent","gracefulShutdown","ready","url","register","Server","useValue","has","UIHttpClient","useFactory","c","undefined","publicURL","publicUrl","internalURL","baseURL","lifetime","enabled","middlewarePrometheus","teardown","unregister","close"],"sources":["../../../../src/app/modules/http/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport { AuthupError } from '@authup/errors';\nimport { App } from 'routup';\nimport { serve } from 'routup/node';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IModule } from 'orkos';\nimport { bindConsolePackages, createInternalUIHttpClient } from '../../../adapters/http/ui/index.ts';\nimport { NoopAuthFlowMetrics } from '../../../core/index.ts';\nimport { ModuleName } from '../constants.ts';\nimport type { HTTPServer } from './constants.ts';\nimport { HTTPInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { MetricsInjectionKey, PromAuthFlowMetrics } from '../metrics/index.ts';\nimport { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport class HTTPModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected instance : HTTPServer | undefined;\n\n    protected middleware : HTTPMiddlewareModule;\n\n    protected controller : HTTPControllerModule;\n\n    protected uiHttpClientRegistered : boolean;\n\n    constructor() {\n        this.name = ModuleName.HTTP;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.AUTHENTICATION, ModuleName.IDENTITY, ModuleName.OAUTH2];\n        this.controller = new HTTPControllerModule();\n        this.middleware = new HTTPMiddlewareModule();\n        this.uiHttpClientRegistered = false;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Starting http server...');\n\n        // Every request helper deriving proxy-dependent request facts\n        // (getRequestIP, hostname, protocol) resolves the trust contract from\n        // the app options — call sites must NOT pass their own `trustProxy`.\n        let router : App;\n        try {\n            router = new App({ options: { trustProxy: config.trustProxy } });\n        } catch (e) {\n            // proxy-addr compiles the allowlist form inside the App\n            // constructor; its error (\"invalid IP address: …\") does not name\n            // the offending config key — attribute it.\n            throw new AuthupError(\n                `Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`,\n            );\n        }\n\n        // Before any route is mounted: a substituted console package that\n        // no longer fulfills its contract must stop the boot, not surface\n        // as a confusing per-request failure on /authorize.\n        await bindConsolePackages({\n            authConsolePath: config.authConsolePath,\n            accountConsolePath: config.accountConsolePath,\n        });\n\n        this.registerUIHttpClient(container);\n        this.registerMetrics(container);\n\n        await this.middleware.mountBefore(router, container);\n        await this.controller.mount(router, container);\n        await this.middleware.mountAfter(router, container);\n\n        const server = serve(router, {\n            port: config.port,\n            hostname: config.host,\n            silent: true,\n            // Shutdown is driven by the orkos teardown chain (see cli/commands/start.ts);\n            // srvx's plugin would only close the HTTP server, leaving DB / cache / etc. open.\n            gracefulShutdown: false,\n        });\n\n        await server.ready();\n\n        this.instance = server;\n\n        if (server.url) {\n            logger.debug(`Listening on ${server.url}`);\n        }\n\n        container.register(HTTPInjectionKey.Server, { useValue: server });\n\n        logger.debug('Started http server.');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Default HTTP client for the SSR'd UI pages: dispatches against the\n     * server's own listen address instead of round-tripping through the\n     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).\n     * Skipped when the token is already bound (test injection wins).\n     * Transient lifetime is mandatory — client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client.\n     */\n    protected registerUIHttpClient(container: IContainer): void {\n        if (container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        container.register(HTTPInjectionKey.UIHttpClient, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                // The server token is registered after listen; a resolve can\n                // only happen on a request, so it is present by then. The\n                // guards keep an edge case on the previous (public URL)\n                // dispatch behavior instead of failing the render.\n                const server = c.has(HTTPInjectionKey.Server) ?\n                    c.resolve(HTTPInjectionKey.Server) :\n                    undefined;\n\n                if (server && server.url) {\n                    return createInternalUIHttpClient({\n                        publicURL: config.publicUrl,\n                        internalURL: server.url,\n                    });\n                }\n\n                return new Client({ baseURL: config.publicUrl });\n            },\n        }, { lifetime: 'transient' });\n\n        this.uiHttpClientRegistered = true;\n    }\n\n    /**\n     * Auth-flow metric counters for the emit points (plan 058 Part 2).\n     * Registered before the controllers are built — the factories resolve the\n     * token. Prometheus-backed iff the prometheus middleware is enabled\n     * (mirrors HTTPMiddlewareModule.isEnabled: boolean|object, false = off),\n     * otherwise a noop so emit sites never need a guard beyond `?.`.\n     */\n    protected registerMetrics(container: IContainer): void {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const enabled = typeof config.middlewarePrometheus !== 'boolean' ||\n            config.middlewarePrometheus === true;\n\n        container.register(MetricsInjectionKey, {\n            useValue: enabled ?\n                new PromAuthFlowMetrics() :\n                new NoopAuthFlowMetrics(),\n        });\n    }\n\n    // ----------------------------------------------------\n\n    async teardown(container: IContainer): Promise<void> {\n        if (this.uiHttpClientRegistered) {\n            container.unregister(HTTPInjectionKey.UIHttpClient);\n            this.uiHttpClientRegistered = false;\n        }\n\n        container.unregister(MetricsInjectionKey);\n\n        await this.middleware.teardown();\n\n        if (!this.instance) return;\n\n        container.unregister(HTTPInjectionKey.Server);\n\n        await this.instance.close();\n        this.instance = undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAae,aAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKL,OAAOR,WAAWc;EACvB,KAAKL,eAAe;GAACT,WAAWe;GAAQf,WAAWgB;GAAQhB,WAAWiB;GAAgBjB,WAAWkB;GAAUlB,WAAWmB;EAAO;EAC7H,KAAKP,aAAa,IAAIR,qBAAAA;EACtB,KAAKO,aAAa,IAAIN,qBAAAA;EACtB,KAAKQ,yBAAyB;CAClC;CAIA,MAAMO,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EACjC,MAAM4B,SAASH,UAAUE,QAAQjB,kBAAAA;EAEjCkB,OAAOC,MAAM,yBAAA;EAKb,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIhC,IAAI,EAAEiC,SAAS,EAAEC,YAAYN,OAAOM,WAAW,EAAE,CAAA;EAClE,SAASC,GAAG;GAIR,MAAM,IAAIpC,YACN,mDAAmDoC,aAAaC,QAAQD,EAAEE,UAAUC,OAAOH,CAAAA,GAAI;EAEvG;EAKA,MAAMhC,oBAAoB;GACtBoC,iBAAiBX,OAAOW;GACxBC,oBAAoBZ,OAAOY;EAC/B,CAAA;EAEA,KAAKC,qBAAqBd,SAAAA;EAC1B,KAAKe,gBAAgBf,SAAAA;EAErB,MAAM,KAAKV,WAAW0B,YAAYX,QAAQL,SAAAA;EAC1C,MAAM,KAAKT,WAAW0B,MAAMZ,QAAQL,SAAAA;EACpC,MAAM,KAAKV,WAAW4B,WAAWb,QAAQL,SAAAA;EAEzC,MAAMmB,SAAS7C,MAAM+B,QAAQ;GACzBe,MAAMnB,OAAOmB;GACbC,UAAUpB,OAAOqB;GACjBC,QAAQ;GAGRC,kBAAkB;EACtB,CAAA;EAEA,MAAML,OAAOM,MAAK;EAElB,KAAKpC,WAAW8B;EAEhB,IAAIA,OAAOO,KACPvB,OAAOC,MAAM,gBAAgBe,OAAOO,KAAK;EAG7C1B,UAAU2B,SAAS/C,iBAAiBgD,QAAQ,EAAEC,UAAUV,OAAO,CAAA;EAE/DhB,OAAOC,MAAM,sBAAA;CACjB;;;;;;;;IAYA,qBAA+BJ,WAA6B;EACxD,IAAIA,UAAU8B,IAAIlD,iBAAiBmD,YAAY,GAC3C;EAGJ/B,UAAU2B,SAAS/C,iBAAiBmD,cAAc,EAC9CC,aAAaC,MAAAA;GACT,MAAMhC,SAASgC,EAAE/B,QAAQ3B,kBAAAA;GAMzB,MAAM4C,SAASc,EAAEH,IAAIlD,iBAAiBgD,MAAM,IACxCK,EAAE/B,QAAQtB,iBAAiBgD,MAAM,IACjCM,KAAAA;GAEJ,IAAIf,UAAUA,OAAOO,KACjB,OAAOjD,2BAA2B;IAC9B0D,WAAWlC,OAAOmC;IAClBC,aAAalB,OAAOO;GACxB,CAAA;GAGJ,OAAO,IAAIvD,OAAO,EAAEmE,SAASrC,OAAOmC,UAAU,CAAA;EAClD,EACJ,GAAG,EAAEG,UAAU,YAAY,CAAA;EAE3B,KAAK/C,yBAAyB;CAClC;;;;;;;IASA,gBAA0BQ,WAA6B;EACnD,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EAEjC,MAAMiE,UAAU,OAAOvC,OAAOwC,yBAAyB,aACnDxC,OAAOwC,yBAAyB;EAEpCzC,UAAU2B,SAAS9C,qBAAqB,EACpCgD,UAAUW,UACN,IAAI1D,oBAAAA,IACJ,IAAIJ,oBAAAA,EACZ,CAAA;CACJ;CAIA,MAAMgE,SAAS1C,WAAsC;EACjD,IAAI,KAAKR,wBAAwB;GAC7BQ,UAAU2C,WAAW/D,iBAAiBmD,YAAY;GAClD,KAAKvC,yBAAyB;EAClC;EAEAQ,UAAU2C,WAAW9D,mBAAAA;EAErB,MAAM,KAAKS,WAAWoD,SAAQ;EAE9B,IAAI,CAAC,KAAKrD,UAAU;EAEpBW,UAAU2C,WAAW/D,iBAAiBgD,MAAM;EAE5C,MAAM,KAAKvC,SAASuD,MAAK;EACzB,KAAKvD,WAAW6C,KAAAA;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["Client","AuthupError","App","serve","ConfigInjectionKey","createInternalHttpClient","NoopAuthFlowMetrics","ModuleName","HTTPInjectionKey","MetricsInjectionKey","PromAuthFlowMetrics","HTTPControllerModule","HTTPMiddlewareModule","LoggerInjectionKey","HTTPModule","name","dependencies","instance","middleware","controller","internalHttpClientRegistered","options","HTTP","CONFIG","LOGGER","AUTHENTICATION","IDENTITY","OAUTH2","setup","container","config","resolve","logger","debug","app","trustProxy","e","Error","message","String","registerInternalHttpClient","registerMetrics","mountBefore","mount","mountAfter","server","port","hostname","host","silent","gracefulShutdown","ready","url","register","useValue","Server","has","InternalHttpClient","useFactory","c","undefined","publicURL","publicUrl","internalURL","baseURL","lifetime","enabled","middlewarePrometheus","teardown","unregister","close"],"sources":["../../../../src/app/modules/http/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport { AuthupError } from '@authup/errors';\nimport type { IApp } from 'routup';\nimport { App } from 'routup';\nimport { serve } from 'routup/node';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IModule } from 'orkos';\nimport { createInternalHttpClient } from '../../../adapters/http/internal-client/index.ts';\nimport { NoopAuthFlowMetrics } from '../../../core/index.ts';\nimport { ModuleName } from '../constants.ts';\nimport type { HTTPServer } from './constants.ts';\nimport { HTTPInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { MetricsInjectionKey, PromAuthFlowMetrics } from '../metrics/index.ts';\nimport { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport type HTTPModuleOptions = {\n    /**\n     * Anything else that rides this listener, mounted in the one window where\n     * it belongs.\n     *\n     * A callback rather than a list, because the ORDER is not negotiable and\n     * is this module's business: it runs AFTER the controllers, so nothing it\n     * carries can shadow a protocol route (every console declares a wildcard\n     * shell route, and `/console/<name>/login/start` is server-core's), and\n     * BEFORE the error middleware, so it inherits the error handling every\n     * other route has. A caller mounting on the resolved app after `setup()`\n     * lands after both, on an already-listening server.\n     *\n     * server-core learns nothing from this: it hands over the app and the\n     * caller composes. A controller for a console appearing in this package\n     * is the smell the hook exists to prevent (plan 101 D2).\n     */\n    mount?: (app: IApp) => Promise<void> | void;\n};\n\nexport class HTTPModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected instance : HTTPServer | undefined;\n\n    protected middleware : HTTPMiddlewareModule;\n\n    protected controller : HTTPControllerModule;\n\n    protected internalHttpClientRegistered : boolean;\n\n    protected options : HTTPModuleOptions;\n\n    constructor(options: HTTPModuleOptions = {}) {\n        this.options = options;\n        this.name = ModuleName.HTTP;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.AUTHENTICATION, ModuleName.IDENTITY, ModuleName.OAUTH2];\n        this.controller = new HTTPControllerModule();\n        this.middleware = new HTTPMiddlewareModule();\n        this.internalHttpClientRegistered = false;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Starting http server...');\n\n        // Every request helper deriving proxy-dependent request facts\n        // (getRequestIP, hostname, protocol) resolves the trust contract from\n        // the app options — call sites must NOT pass their own `trustProxy`.\n        let app : IApp;\n        try {\n            app = new App({ options: { trustProxy: config.trustProxy } });\n        } catch (e) {\n            // proxy-addr compiles the allowlist form inside the App\n            // constructor; its error (\"invalid IP address: …\") does not name\n            // the offending config key — attribute it.\n            throw new AuthupError(\n                `Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`,\n            );\n        }\n\n        this.registerInternalHttpClient(container);\n        this.registerMetrics(container);\n\n        await this.middleware.mountBefore(app, container);\n\n        await this.controller.mount(app, container);\n        if (this.options.mount) {\n            await this.options.mount(app);\n        }\n\n        await this.middleware.mountAfter(app, container);\n\n        const server = serve(app, {\n            port: config.port,\n            hostname: config.host,\n            silent: true,\n            // Shutdown is driven by the orkos teardown chain (see cli/commands/start.ts);\n            // srvx's plugin would only close the HTTP server, leaving DB / cache / etc. open.\n            gracefulShutdown: false,\n        });\n\n        await server.ready();\n\n        this.instance = server;\n\n        if (server.url) {\n            logger.debug(`Listening on ${server.url}`);\n        }\n\n        logger.debug('Started http server.');\n\n        container.register(HTTPInjectionKey.App, { useValue: app });\n        container.register(HTTPInjectionKey.Server, { useValue: server });\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Default HTTP client for this server's calls to its own API: dispatches\n     * against the server's own listen address instead of round-tripping\n     * through the reverse proxy at `publicUrl` (see\n     * `createInternalHttpClient`). Skipped when the token is already bound\n     * (test injection wins). Transient lifetime is mandatory: the\n     * authentication hook writes per-user Authorization state onto a client.\n     */\n    protected registerInternalHttpClient(container: IContainer): void {\n        if (container.has(HTTPInjectionKey.InternalHttpClient)) {\n            return;\n        }\n\n        container.register(HTTPInjectionKey.InternalHttpClient, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                // The server token is registered after listen; a resolve can\n                // only happen on a request, so it is present by then. The\n                // guards keep an edge case on the previous (public URL)\n                // dispatch behavior instead of failing the render.\n                const server = c.has(HTTPInjectionKey.Server) ?\n                    c.resolve(HTTPInjectionKey.Server) :\n                    undefined;\n\n                if (server && server.url) {\n                    return createInternalHttpClient({\n                        publicURL: config.publicUrl,\n                        internalURL: server.url,\n                    });\n                }\n\n                return new Client({ baseURL: config.publicUrl });\n            },\n        }, { lifetime: 'transient' });\n\n        this.internalHttpClientRegistered = true;\n    }\n\n    /**\n     * Auth-flow metric counters for the emit points (plan 058 Part 2).\n     * Registered before the controllers are built — the factories resolve the\n     * token. Prometheus-backed iff the prometheus middleware is enabled\n     * (mirrors HTTPMiddlewareModule.isEnabled: boolean|object, false = off),\n     * otherwise a noop so emit sites never need a guard beyond `?.`.\n     */\n    protected registerMetrics(container: IContainer): void {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const enabled = typeof config.middlewarePrometheus !== 'boolean' ||\n            config.middlewarePrometheus === true;\n\n        container.register(MetricsInjectionKey, {\n            useValue: enabled ?\n                new PromAuthFlowMetrics() :\n                new NoopAuthFlowMetrics(),\n        });\n    }\n\n    // ----------------------------------------------------\n\n    async teardown(container: IContainer): Promise<void> {\n        if (this.internalHttpClientRegistered) {\n            container.unregister(HTTPInjectionKey.InternalHttpClient);\n            this.internalHttpClientRegistered = false;\n        }\n\n        container.unregister(MetricsInjectionKey);\n\n        if (!this.instance) return;\n\n        container.unregister(HTTPInjectionKey.Server);\n\n        await this.instance.close();\n        this.instance = undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAac,aAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,UAA6B,CAAC,GAAG;EACzC,KAAKA,UAAUA;EACf,KAAKN,OAAOR,WAAWe;EACvB,KAAKN,eAAe;GAACT,WAAWgB;GAAQhB,WAAWiB;GAAQjB,WAAWkB;GAAgBlB,WAAWmB;GAAUnB,WAAWoB;EAAO;EAC7H,KAAKR,aAAa,IAAIR,qBAAAA;EACtB,KAAKO,aAAa,IAAIN,qBAAAA;EACtB,KAAKQ,+BAA+B;CACxC;CAIA,MAAMQ,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EACjC,MAAM4B,SAASH,UAAUE,QAAQlB,kBAAAA;EAEjCmB,OAAOC,MAAM,yBAAA;EAKb,IAAIC;EACJ,IAAI;GACAA,MAAM,IAAIhC,IAAI,EAAEmB,SAAS,EAAEc,YAAYL,OAAOK,WAAW,EAAE,CAAA;EAC/D,SAASC,GAAG;GAIR,MAAM,IAAInC,YACN,mDAAmDmC,aAAaC,QAAQD,EAAEE,UAAUC,OAAOH,CAAAA,GAAI;EAEvG;EAEA,KAAKI,2BAA2BX,SAAAA;EAChC,KAAKY,gBAAgBZ,SAAAA;EAErB,MAAM,KAAKX,WAAWwB,YAAYR,KAAKL,SAAAA;EAEvC,MAAM,KAAKV,WAAWwB,MAAMT,KAAKL,SAAAA;EACjC,IAAI,KAAKR,QAAQsB,OACb,MAAM,KAAKtB,QAAQsB,MAAMT,GAAAA;EAG7B,MAAM,KAAKhB,WAAW0B,WAAWV,KAAKL,SAAAA;EAEtC,MAAMgB,SAAS1C,MAAM+B,KAAK;GACtBY,MAAMhB,OAAOgB;GACbC,UAAUjB,OAAOkB;GACjBC,QAAQ;GAGRC,kBAAkB;EACtB,CAAA;EAEA,MAAML,OAAOM,MAAK;EAElB,KAAKlC,WAAW4B;EAEhB,IAAIA,OAAOO,KACPpB,OAAOC,MAAM,gBAAgBY,OAAOO,KAAK;EAG7CpB,OAAOC,MAAM,sBAAA;EAEbJ,UAAUwB,SAAS7C,iBAAiBN,KAAK,EAAEoD,UAAUpB,IAAI,CAAA;EACzDL,UAAUwB,SAAS7C,iBAAiB+C,QAAQ,EAAED,UAAUT,OAAO,CAAA;CACnE;;;;;;;;IAYA,2BAAqChB,WAA6B;EAC9D,IAAIA,UAAU2B,IAAIhD,iBAAiBiD,kBAAkB,GACjD;EAGJ5B,UAAUwB,SAAS7C,iBAAiBiD,oBAAoB,EACpDC,aAAaC,MAAAA;GACT,MAAM7B,SAAS6B,EAAE5B,QAAQ3B,kBAAAA;GAMzB,MAAMyC,SAASc,EAAEH,IAAIhD,iBAAiB+C,MAAM,IACxCI,EAAE5B,QAAQvB,iBAAiB+C,MAAM,IACjCK,KAAAA;GAEJ,IAAIf,UAAUA,OAAOO,KACjB,OAAO/C,yBAAyB;IAC5BwD,WAAW/B,OAAOgC;IAClBC,aAAalB,OAAOO;GACxB,CAAA;GAGJ,OAAO,IAAIpD,OAAO,EAAEgE,SAASlC,OAAOgC,UAAU,CAAA;EAClD,EACJ,GAAG,EAAEG,UAAU,YAAY,CAAA;EAE3B,KAAK7C,+BAA+B;CACxC;;;;;;;IASA,gBAA0BS,WAA6B;EACnD,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EAEjC,MAAM8D,UAAU,OAAOpC,OAAOqC,yBAAyB,aACnDrC,OAAOqC,yBAAyB;EAEpCtC,UAAUwB,SAAS5C,qBAAqB,EACpC6C,UAAUY,UACN,IAAIxD,oBAAAA,IACJ,IAAIJ,oBAAAA,EACZ,CAAA;CACJ;CAIA,MAAM8D,SAASvC,WAAsC;EACjD,IAAI,KAAKT,8BAA8B;GACnCS,UAAUwC,WAAW7D,iBAAiBiD,kBAAkB;GACxD,KAAKrC,+BAA+B;EACxC;EAEAS,UAAUwC,WAAW5D,mBAAAA;EAErB,IAAI,CAAC,KAAKQ,UAAU;EAEpBY,UAAUwC,WAAW7D,iBAAiB+C,MAAM;EAE5C,MAAM,KAAKtC,SAASqD,MAAK;EACzB,KAAKrD,WAAW2C,KAAAA;CACpB;AACJ"}

package/dist/app/modules/http/modules/controller.d.ts

@@ -1,12 +1,12 @@
-import type { App } from 'routup';
+import type { IApp } from 'routup';
 import { ClientController, ClientPermissionController, ClientRoleController, ClientScopeController, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyController, RealmController, RoleAttributeController, RoleController, RolePermissionController, ScopeController, SessionController, SessionTokenController, TrustAnchorController, UserAttributeController, UserAuthenticatorController, UserController, UserPermissionController, UserRoleController } from '../../../../adapters/http/index.ts';
-import { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController } from '../../../../adapters/http/controllers/index.ts';
+import { AccountController, ActivateController, AdminController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController } from '../../../../adapters/http/controllers/index.ts';
 import type { IContainer } from 'eldin';
 import { ConsentService, OAuth2AccessPolicyEvaluator, OAuth2MfaLoginService, PasswordRecoveryService, RegistrationService, UserAuthenticatorService, UserService } from '../../../../core/index.ts';
 import type { StatusResponseFeatures } from '@authup/core-http-kit';
 import type { Config } from '../../config/index.ts';
 export declare class HTTPControllerModule {
-    mount(router: App, container: IContainer): Promise<void>;
+    mount(router: IApp, container: IContainer): Promise<void>;
     createAuthorize(container: IContainer): AuthorizeController;
     createToken(container: IContainer): TokenController;
     createOpenIDController(container: IContainer): OpenIDController;
@@ -17,6 +17,7 @@ export declare class HTTPControllerModule {
     createRegisterController(container: IContainer): RegisterController;
     createLogoutController(container: IContainer): LogoutController;
     createStatusController(container: IContainer): StatusController;
+    createAdminController(container: IContainer): AdminController;
     createAccountController(container: IContainer): AccountController;
     buildUIFeatures(config: Config): StatusResponseFeatures;
     createRegistrationService(container: IContainer): RegistrationService;

package/dist/app/modules/http/modules/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAoElC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iCAAiC,EACjC,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAOd,2BAA2B,EAI3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAWnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4E9D,eAAe,CAAC,SAAS,EAAE,UAAU;IAmCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAYpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAY9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAY7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IASxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAoD5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,4BAA4B,CAAC,SAAS,EAAE,UAAU;IAOlD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAM7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,uCAAuC,CAAC,SAAS,EAAE,UAAU;IAe7D,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAuD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/http/modules/controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAoEnC,OAAO,EACH,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iCAAiC,EACjC,0BAA0B,EAC1B,qCAAqC,EACrC,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,gCAAgC,EAChC,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EACrB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAMH,cAAc,EAOd,2BAA2B,EAI3B,qBAAqB,EACrB,uBAAuB,EAQvB,mBAAmB,EAWnB,wBAAwB,EAGxB,WAAW,EACd,MAAM,2BAA2B,CAAC;AAKnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,oBAAoB;IACvB,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA6E/D,eAAe,CAAC,SAAS,EAAE,UAAU;IAoCrC,WAAW,CAAC,SAAS,EAAE,UAAU;IAmFjC,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,8BAA8B,CAAC,SAAS,EAAE,UAAU;IASpD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IASnD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IA0BnD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAsB5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAM5C,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAkB3C,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAmB7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,sBAAsB;IAUxD,yBAAyB,CAAC,SAAS,EAAE,UAAU;IA0B/C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IA0D5C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAiB5C,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IAOtB,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAkDtD,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAe1C,gCAAgC,CAAC,SAAS,EAAE,UAAU;IActD,0BAA0B,CAAC,SAAS,EAAE,UAAU;IAShD,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAQjD,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,gCAAgC,CAAC,SAAS,EAAE,UAAU;IAQtD,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAe3C,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAWzC,2BAA2B,CAAC,SAAS,EAAE,UAAU;IAYjD,4BAA4B,CAAC,SAAS,EAAE,UAAU;IAOlD,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAoB7C,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAI,cAAc;IAKtE,uBAAuB,CAAC,SAAS,EAAE,UAAU;IAI7C,uCAAuC,CAAC,SAAS,EAAE,UAAU;IAe7D,OAAO,CAAC,qBAAqB,CAAC,CAA+B;IAE7D,SAAS,CAAC,4BAA4B,CAAC,SAAS,EAAE,UAAU,GAAI,2BAA2B;IAgB3F,OAAO,CAAC,wBAAwB,CAAC,CAA4B;IAE7D,SAAS,CAAC,+BAA+B,CAAC,SAAS,EAAE,UAAU,GAAI,wBAAwB;IAuD3F,iCAAiC,CAAC,SAAS,EAAE,UAAU;IAIvD,OAAO,CAAC,eAAe,CAAC,CAAyB;IAEjD,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,UAAU,GAAI,qBAAqB;IAkB/E,sCAAsC,CAAC,SAAS,EAAE,UAAU;IAQ5D,qBAAqB,CAAC,SAAS,EAAE,UAAU;IAK3C,iBAAiB,CAAC,SAAS,EAAE,UAAU;IAgBvC,oBAAoB,CAAC,SAAS,EAAE,UAAU;IAI1C,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAI9C,6BAA6B,CAAC,SAAS,EAAE,UAAU;IAYnD,8BAA8B,CAAC,SAAS,EAAE,UAAU;IAcpD,wBAAwB,CAAC,SAAS,EAAE,UAAU;IAS9C,sBAAsB,CAAC,SAAS,EAAE,UAAU;IAyB5C,oCAAoC,CAAC,SAAS,EAAE,UAAU;IAc1D,mBAAmB,CAAC,SAAS,EAAE,UAAU;IAMzC,qBAAqB,CAAC,SAAS,EAAE,UAAU;CAiD9C"}

package/dist/app/modules/http/modules/controller.mjs

@@ -67,11 +67,12 @@ import { RegistrationService } from "../../../../core/identity/registration/serv
 import "../../../../core/index.mjs";
 import { CacheInjectionKey } from "../../cache/constants.mjs";
 import { ConfigInjectionKey } from "../../config/constants.mjs";
-import { getAppOrigins } from "../../config/origins.mjs";
-import { useRequestEventContext } from "../../../../adapters/http/request/event-context.mjs";
+import { getAppOrigins } from "../../config/app-origins.mjs";
 import "../../config/index.mjs";
 import "../../cache/index.mjs";
-import "../../authentication/index.mjs";
+import { LoggerInjectionKey } from "../../logger/constants.mjs";
+import "../../logger/index.mjs";
+import { OAuth2InjectionToken } from "../../oauth2/constants.mjs";
 import { RealmRepositoryAdapter } from "../../database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "../../database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "../../database/repositories/client-permission/repository.mjs";
@@ -94,10 +95,14 @@ import { UserAuthenticatorRepositoryAdapter } from "../../database/repositories/
 import { UserPermissionRepositoryAdapter } from "../../database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "../../database/repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "../../database/repositories/identity-provider-role-mapping/repository.mjs";
+import { IdentityInjectionKey } from "../../identity/constants.mjs";
+import { UserIdentityRepository } from "../../identity/repositories/user.mjs";
 import { DatabaseInjectionKey } from "../../database/constants.mjs";
-import { LoggerInjectionKey } from "../../logger/constants.mjs";
-import "../../logger/index.mjs";
+import { useRequestEventContext } from "../../../../adapters/http/request/event-context.mjs";
 import "../../database/index.mjs";
+import "../../identity/index.mjs";
+import "../../oauth2/index.mjs";
+import "../../authentication/index.mjs";
 import { MetricsInjectionKey } from "../../metrics/constants.mjs";
 import "../../metrics/index.mjs";
 import { ClientController } from "../../../../adapters/http/controllers/entities/client/module.mjs";
@@ -114,6 +119,7 @@ import { PermissionController } from "../../../../adapters/http/controllers/enti
 import { PermissionPolicyController } from "../../../../adapters/http/controllers/entities/permission-policy/module.mjs";
 import { AccountController } from "../../../../adapters/http/controllers/workflows/account/module.mjs";
 import { ActivateController } from "../../../../adapters/http/controllers/workflows/activate/module.mjs";
+import { AdminController } from "../../../../adapters/http/controllers/workflows/admin/module.mjs";
 import { AuthenticatorChallengeController } from "../../../../adapters/http/controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "../../../../adapters/http/controllers/workflows/authorize/module.mjs";
 import { JwkController } from "../../../../adapters/http/controllers/workflows/jwks/module.mjs";
@@ -141,11 +147,6 @@ import { UserPermissionController } from "../../../../adapters/http/controllers/
 import { UserRoleController } from "../../../../adapters/http/controllers/entities/user-role/module.mjs";
 import "../../../../adapters/http/controllers/index.mjs";
 import "../../../../adapters/http/index.mjs";
-import { OAuth2InjectionToken } from "../../oauth2/constants.mjs";
-import { IdentityInjectionKey } from "../../identity/constants.mjs";
-import { UserIdentityRepository } from "../../identity/repositories/user.mjs";
-import "../../identity/index.mjs";
-import "../../oauth2/index.mjs";
 import { LazyWildcardRealmProvisioner } from "../../provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "../../mail/constants.mjs";
 import "../../mail/index.mjs";
@@ -191,6 +192,7 @@ var HTTPControllerModule = class {
 			this.createAuthenticatorChallengeController(container),
 			this.createUserInfoController(container),
 			this.createAccountController(container),
+			this.createAdminController(container),
 			this.createStatusController(container),
 			clientController,
 			clientPermissionController,
@@ -230,6 +232,7 @@ var HTTPControllerModule = class {
 		return new AuthorizeController({
 			options: {
 				baseURL: config.publicUrl,
+				authConsoleUrl: config.authConsole.url,
 				features: this.buildUIFeatures(config),
 				promptLoginMaxAge: config.promptLoginMaxAge,
 				mfaFreshnessMaxAge: config.mfaFreshnessMaxAge
@@ -311,30 +314,21 @@ var HTTPControllerModule = class {
 	createActivateController(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		return new ActivateController({
-			options: {
-				baseURL: config.publicUrl,
-				features: this.buildUIFeatures(config)
-			},
+			options: { authConsoleUrl: config.authConsole.url },
 			service: this.createRegistrationService(container)
 		});
 	}
 	createPasswordForgotController(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		return new PasswordForgotController({
-			options: {
-				baseURL: config.publicUrl,
-				features: this.buildUIFeatures(config)
-			},
+			options: { authConsoleUrl: config.authConsole.url },
 			service: this.createPasswordRecoveryService(container)
 		});
 	}
 	createPasswordResetController(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		return new PasswordResetController({
-			options: {
-				baseURL: config.publicUrl,
-				features: this.buildUIFeatures(config)
-			},
+			options: { authConsoleUrl: config.authConsole.url },
 			service: this.createPasswordRecoveryService(container)
 		});
 	}
@@ -365,10 +359,7 @@ var HTTPControllerModule = class {
 	createRegisterController(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		return new RegisterController({
-			options: {
-				baseURL: config.publicUrl,
-				features: this.buildUIFeatures(config)
-			},
+			options: { authConsoleUrl: config.authConsole.url },
 			service: this.createRegistrationService(container)
 		});
 	}
@@ -387,7 +378,7 @@ var HTTPControllerModule = class {
 			hintGracePeriod: config.endSessionHintGracePeriod
 		});
 		return new LogoutController({
-			options: { baseURL: config.publicUrl },
+			options: { authConsoleUrl: config.authConsole.url },
 			endSessionService
 		});
 	}
@@ -395,20 +386,45 @@ var HTTPControllerModule = class {
 		const config = container.resolve(ConfigInjectionKey);
 		return new StatusController({ options: { features: this.buildUIFeatures(config) } });
 	}
+	createAdminController(container) {
+		const config = container.resolve(ConfigInjectionKey);
+		return new AdminController({
+			options: {
+				baseURL: config.publicUrl,
+				consoleUrl: config.adminConsole.url,
+				enabled: config.adminConsole.enabled
+			},
+			loginStore: container.resolve(OAuth2InjectionToken.ConsoleLoginStore),
+			sessionRepository: container.resolve(AuthenticationInjectionKey.SessionRepository),
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
+			tokenVerifier: container.resolve(OAuth2InjectionToken.TokenVerifier),
+			tokenRevoker: container.resolve(OAuth2InjectionToken.TokenRevoker),
+			logger: container.resolve(LoggerInjectionKey)
+		});
+	}
 	createAccountController(container) {
 		const config = container.resolve(ConfigInjectionKey);
-		return new AccountController({ options: {
-			baseURL: config.publicUrl,
-			features: this.buildUIFeatures(config),
-			trustedOrigins: getAppOrigins(config)
-		} });
+		return new AccountController({
+			options: {
+				baseURL: config.publicUrl,
+				consoleUrl: config.accountConsole.url,
+				enabled: config.accountConsole.enabled
+			},
+			loginStore: container.resolve(OAuth2InjectionToken.ConsoleLoginStore),
+			sessionRepository: container.resolve(AuthenticationInjectionKey.SessionRepository),
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
+			tokenVerifier: container.resolve(OAuth2InjectionToken.TokenVerifier),
+			tokenRevoker: container.resolve(OAuth2InjectionToken.TokenRevoker),
+			logger: container.resolve(LoggerInjectionKey)
+		});
 	}
 	buildUIFeatures(config) {
 		return {
 			registration: config.registrationEnabled,
 			passwordRecovery: config.passwordRecoveryEnabled,
 			emailVerification: config.emailVerificationEnabled,
-			accountConsole: config.accountConsoleEnabled
+			accountConsole: config.accountConsole.enabled,
+			adminConsole: config.adminConsole.enabled
 		};
 	}
 	createRegistrationService(container) {
@@ -440,7 +456,6 @@ var HTTPControllerModule = class {
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const accountManager = container.resolve(IdentityInjectionKey.ProviderAccountManager);
 		const linkStore = container.resolve(IdentityInjectionKey.ProviderAccountLinkStore);
-		const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);
 		const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);
 		const stateManager = container.resolve(OAuth2InjectionToken.AuthorizationStateManager);
 		const realmRepository = container.resolve(RealmEntity);
@@ -455,13 +470,20 @@ var HTTPControllerModule = class {
 			accountManager,
 			realmRepository: new RealmRepositoryAdapter(realmRepository),
 			codeRequestVerifier,
-			codeIssuer,
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),
+			pendingLoginStore: container.resolve(OAuth2InjectionToken.FederatedLoginStore),
+			accessTokenIssuer: container.resolve(OAuth2InjectionToken.AccessTokenIssuer),
+			refreshTokenIssuer: container.resolve(OAuth2InjectionToken.RefreshTokenIssuer),
 			accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),
 			eventService,
+			metrics: container.resolve(MetricsInjectionKey),
 			logger
 		});
 		return new IdentityProviderController({
-			options: { baseURL: config.publicUrl },
+			options: {
+				baseURL: config.publicUrl,
+				accountConsoleUrl: config.accountConsole.url
+			},
 			repository,
 			accountManager,
 			linkStore,
@@ -642,8 +664,18 @@ var HTTPControllerModule = class {
 	}
 	createSessionController(container) {
 		const repository = container.resolve(AuthenticationInjectionKey.SessionRepository);
-		const service = new SessionService({ repository });
-		return new SessionController({ service });
+		const service = new SessionService({
+			repository,
+			sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager)
+		});
+		const config = container.resolve(ConfigInjectionKey);
+		return new SessionController({
+			service,
+			baseURL: config.publicUrl,
+			identityResolver: container.resolve(IdentityInjectionKey.Resolver),
+			identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider),
+			sessionRepository: repository
+		});
 	}
 	createConsentService(container) {
 		const repository = container.resolve(OAuth2InjectionToken.ConsentRepository);