@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/adapters/http/middleware/built-in/prometheus.mjs

@@ -52,8 +52,9 @@ function buildRouteTemplates(router) {
 * labeled by the registered route template (`/users/:id`), read from the
 * router's own route table (child apps are flattened into the root with full
 * patterns, and all routes are registered before `listen`, so a snapshot at
-* first request is complete). Method-agnostic mounts (`/docs`, `/public`)
-* label as `<mount>/**`; anything else collapses into one unmatched bucket.
+* first request is complete). Method-agnostic mounts (`/docs`,
+* `/console/auth/assets`) label as `<mount>/**`; anything else collapses into
+* one unmatched bucket.
 */ function createRouteTemplateNormalizePath(router) {
 	let templates;
 	return (path, event) => {

package/dist/adapters/http/middleware/built-in/prometheus.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"prometheus.mjs","names":["prometheus","PATH_LABEL_UNMATCHED","toPathSegments","path","split","filter","segment","length","isParameterSegment","startsWith","matchSegments","templateSegments","segments","prefix","i","templateSegment","entries","buildRouteTemplates","router","exact","seen","Set","route","routes","label","join","key","method","has","add","push","sort","a","b","createRouteTemplateNormalizePath","templates","event","toUpperCase","template","registerPrometheusMiddleware","input","options","normalizePath","skip","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/prometheus';\nimport { prometheus } from '@routup/prometheus';\nimport type { App, IAppEvent } from 'routup';\n\nconst PATH_LABEL_UNMATCHED = '/{unmatched}';\n\ntype RouteTemplate = {\n    method?: string,\n    segments: string[],\n    label: string,\n};\n\ntype RouteTemplates = {\n    exact: RouteTemplate[],\n    prefix: RouteTemplate[],\n};\n\nfunction toPathSegments(path: string): string[] {\n    return path.split('/').filter((segment) => segment.length > 0);\n}\n\nfunction isParameterSegment(segment: string): boolean {\n    return segment.startsWith(':') || segment === '*';\n}\n\nfunction matchSegments(\n    templateSegments: string[],\n    segments: string[],\n    prefix: boolean,\n): boolean {\n    if (\n        prefix ?\n            segments.length < templateSegments.length :\n            segments.length !== templateSegments.length\n    ) {\n        return false;\n    }\n\n    for (const [i, templateSegment] of templateSegments.entries()) {\n        if (isParameterSegment(templateSegment)) {\n            continue;\n        }\n\n        if (templateSegment !== segments[i]) {\n            return false;\n        }\n    }\n\n    return true;\n}\n\nfunction buildRouteTemplates(router: App): RouteTemplates {\n    const exact: RouteTemplate[] = [];\n    const prefix: RouteTemplate[] = [];\n    const seen = new Set<string>();\n\n    for (const route of router.routes) {\n        if (typeof route.path !== 'string') {\n            continue;\n        }\n\n        const segments = toPathSegments(route.path);\n        const label = `/${segments.join('/')}`;\n        const key = `${route.method || ''} ${label}`;\n        if (seen.has(key)) {\n            continue;\n        }\n        seen.add(key);\n\n        if (route.method) {\n            exact.push({\n                method: route.method, \n                segments, \n                label, \n            });\n        } else if (segments.length > 0) {\n            prefix.push({ segments, label });\n        }\n    }\n\n    prefix.sort((a, b) => b.segments.length - a.segments.length);\n\n    return { exact, prefix };\n}\n\n/**\n * The `path` label must stay bounded: labeling by the raw request path lets\n * every probed id (`/users/<random-uuid>`, even on 401/404) mint a new\n * prom-client time-series — unbounded registry growth. Requests are instead\n * labeled by the registered route template (`/users/:id`), read from the\n * router's own route table (child apps are flattened into the root with full\n * patterns, and all routes are registered before `listen`, so a snapshot at\n * first request is complete). Method-agnostic mounts (`/docs`, `/public`)\n * label as `<mount>/**`; anything else collapses into one unmatched bucket.\n */\nexport function createRouteTemplateNormalizePath(\n    router: App,\n): (path: string, event: IAppEvent) => string {\n    let templates : RouteTemplates | undefined;\n\n    return (path, event) => {\n        if (!templates) {\n            templates = buildRouteTemplates(router);\n        }\n\n        const segments = toPathSegments(path);\n        const method = `${event.method}`.toUpperCase();\n\n        for (const template of templates.exact) {\n            if (\n                template.method !== method &&\n                !(method === 'HEAD' && template.method === 'GET')\n            ) {\n                continue;\n            }\n\n            if (matchSegments(template.segments, segments, false)) {\n                return template.label;\n            }\n        }\n\n        for (const template of templates.exact) {\n            if (matchSegments(template.segments, segments, false)) {\n                return template.label;\n            }\n        }\n\n        for (const template of templates.prefix) {\n            if (matchSegments(template.segments, segments, true)) {\n                return `${template.label}/**`;\n            }\n        }\n\n        return PATH_LABEL_UNMATCHED;\n    };\n}\n\nexport function registerPrometheusMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        normalizePath: createRouteTemplateNormalizePath(router),\n        skip(event) {\n            let { path } = event;\n            if (!path.startsWith('/')) {\n                path = `/${path}`;\n            }\n\n            return path.startsWith('/metrics') ||\n                path === '/';\n        },\n    };\n\n    if (input) {\n        options = {\n            ...options,\n            ...input,\n        };\n    }\n\n    router.use(prometheus(options));\n}\n"],"mappings":";;;;;AAWA,MAAMC,uBAAuB;AAa7B,SAASC,eAAeC,MAAY;CAChC,OAAOA,KAAKC,MAAM,GAAA,CAAA,CAAKC,QAAQC,YAAYA,QAAQC,SAAS,CAAA;AAChE;AAEA,SAASC,mBAAmBF,SAAe;CACvC,OAAOA,QAAQG,WAAW,GAAA,KAAQH,YAAY;AAClD;AAEA,SAASI,cACLC,kBACAC,UACAC,QAAe;CAEf,IACIA,SACID,SAASL,SAASI,iBAAiBJ,SACnCK,SAASL,WAAWI,iBAAiBJ,QAEzC,OAAO;CAGX,KAAK,MAAM,CAACO,GAAGC,oBAAoBJ,iBAAiBK,QAAO,GAAI;EAC3D,IAAIR,mBAAmBO,eAAAA,GACnB;EAGJ,IAAIA,oBAAoBH,SAASE,IAC7B,OAAO;CAEf;CAEA,OAAO;AACX;AAEA,SAASG,oBAAoBC,QAAW;CACpC,MAAMC,QAAyB,CAAA;CAC/B,MAAMN,SAA0B,CAAA;CAChC,MAAMO,uBAAO,IAAIC,IAAAA;CAEjB,KAAK,MAAMC,SAASJ,OAAOK,QAAQ;EAC/B,IAAI,OAAOD,MAAMnB,SAAS,UACtB;EAGJ,MAAMS,WAAWV,eAAeoB,MAAMnB,IAAI;EAC1C,MAAMqB,QAAQ,IAAIZ,SAASa,KAAK,GAAA;EAChC,MAAMC,MAAM,GAAGJ,MAAMK,UAAU,GAAG,GAAGH;EACrC,IAAIJ,KAAKQ,IAAIF,GAAAA,GACT;EAEJN,KAAKS,IAAIH,GAAAA;EAET,IAAIJ,MAAMK,QACNR,MAAMW,KAAK;GACPH,QAAQL,MAAMK;GACdf;GACAY;EACJ,CAAA;OACG,IAAIZ,SAASL,SAAS,GACzBM,OAAOiB,KAAK;GAAElB;GAAUY;EAAM,CAAA;CAEtC;CAEAX,OAAOkB,MAAMC,GAAGC,MAAMA,EAAErB,SAASL,SAASyB,EAAEpB,SAASL,MAAM;CAE3D,OAAO;EAAEY;EAAON;CAAO;AAC3B;;;;;;;;;;GAYA,SAAgBqB,iCACZhB,QAAW;CAEX,IAAIiB;CAEJ,QAAQhC,MAAMiC,UAAAA;EACV,IAAI,CAACD,WACDA,YAAYlB,oBAAoBC,MAAAA;EAGpC,MAAMN,WAAWV,eAAeC,IAAAA;EAChC,MAAMwB,SAAS,GAAGS,MAAMT,SAASU,YAAW;EAE5C,KAAK,MAAMC,YAAYH,UAAUhB,OAAO;GACpC,IACImB,SAASX,WAAWA,UACpB,EAAEA,WAAW,UAAUW,SAASX,WAAW,QAE3C;GAGJ,IAAIjB,cAAc4B,SAAS1B,UAAUA,UAAU,KAAA,GAC3C,OAAO0B,SAASd;EAExB;EAEA,KAAK,MAAMc,YAAYH,UAAUhB,OAC7B,IAAIT,cAAc4B,SAAS1B,UAAUA,UAAU,KAAA,GAC3C,OAAO0B,SAASd;EAIxB,KAAK,MAAMc,YAAYH,UAAUtB,QAC7B,IAAIH,cAAc4B,SAAS1B,UAAUA,UAAU,IAAA,GAC3C,OAAO,GAAG0B,SAASd,MAAM;EAIjC,OAAOvB;CACX;AACJ;AAEA,SAAgBsC,6BAA6BrB,QAAasB,OAAoB;CAC1E,IAAIC,UAAyB;EACzBC,eAAeR,iCAAiChB,MAAAA;EAChDyB,KAAKP,OAAK;GACN,IAAI,EAAEjC,SAASiC;GACf,IAAI,CAACjC,KAAKM,WAAW,GAAA,GACjBN,OAAO,IAAIA;GAGf,OAAOA,KAAKM,WAAW,UAAA,KACnBN,SAAS;EACjB;CACJ;CAEA,IAAIqC,OACAC,UAAU;EACN,GAAGA;EACH,GAAGD;CACP;CAGJtB,OAAO0B,IAAI5C,WAAWyC,OAAAA,CAAAA;AAC1B"}
+{"version":3,"file":"prometheus.mjs","names":["prometheus","PATH_LABEL_UNMATCHED","toPathSegments","path","split","filter","segment","length","isParameterSegment","startsWith","matchSegments","templateSegments","segments","prefix","i","templateSegment","entries","buildRouteTemplates","router","exact","seen","Set","route","routes","label","join","key","method","has","add","push","sort","a","b","createRouteTemplateNormalizePath","templates","event","toUpperCase","template","registerPrometheusMiddleware","input","options","normalizePath","skip","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/prometheus';\nimport { prometheus } from '@routup/prometheus';\nimport type { IApp, IAppEvent } from 'routup';\n\nconst PATH_LABEL_UNMATCHED = '/{unmatched}';\n\ntype RouteTemplate = {\n    method?: string,\n    segments: string[],\n    label: string,\n};\n\ntype RouteTemplates = {\n    exact: RouteTemplate[],\n    prefix: RouteTemplate[],\n};\n\nfunction toPathSegments(path: string): string[] {\n    return path.split('/').filter((segment) => segment.length > 0);\n}\n\nfunction isParameterSegment(segment: string): boolean {\n    return segment.startsWith(':') || segment === '*';\n}\n\nfunction matchSegments(\n    templateSegments: string[],\n    segments: string[],\n    prefix: boolean,\n): boolean {\n    if (\n        prefix ?\n            segments.length < templateSegments.length :\n            segments.length !== templateSegments.length\n    ) {\n        return false;\n    }\n\n    for (const [i, templateSegment] of templateSegments.entries()) {\n        if (isParameterSegment(templateSegment)) {\n            continue;\n        }\n\n        if (templateSegment !== segments[i]) {\n            return false;\n        }\n    }\n\n    return true;\n}\n\nfunction buildRouteTemplates(router: IApp): RouteTemplates {\n    const exact: RouteTemplate[] = [];\n    const prefix: RouteTemplate[] = [];\n    const seen = new Set<string>();\n\n    for (const route of router.routes) {\n        if (typeof route.path !== 'string') {\n            continue;\n        }\n\n        const segments = toPathSegments(route.path);\n        const label = `/${segments.join('/')}`;\n        const key = `${route.method || ''} ${label}`;\n        if (seen.has(key)) {\n            continue;\n        }\n        seen.add(key);\n\n        if (route.method) {\n            exact.push({\n                method: route.method,\n                segments,\n                label,\n            });\n        } else if (segments.length > 0) {\n            prefix.push({ segments, label });\n        }\n    }\n\n    prefix.sort((a, b) => b.segments.length - a.segments.length);\n\n    return { exact, prefix };\n}\n\n/**\n * The `path` label must stay bounded: labeling by the raw request path lets\n * every probed id (`/users/<random-uuid>`, even on 401/404) mint a new\n * prom-client time-series — unbounded registry growth. Requests are instead\n * labeled by the registered route template (`/users/:id`), read from the\n * router's own route table (child apps are flattened into the root with full\n * patterns, and all routes are registered before `listen`, so a snapshot at\n * first request is complete). Method-agnostic mounts (`/docs`,\n * `/console/auth/assets`) label as `<mount>/**`; anything else collapses into\n * one unmatched bucket.\n */\nexport function createRouteTemplateNormalizePath(\n    router: IApp,\n): (path: string, event: IAppEvent) => string {\n    let templates : RouteTemplates | undefined;\n\n    return (path, event) => {\n        if (!templates) {\n            templates = buildRouteTemplates(router);\n        }\n\n        const segments = toPathSegments(path);\n        const method = `${event.method}`.toUpperCase();\n\n        for (const template of templates.exact) {\n            if (\n                template.method !== method &&\n                !(method === 'HEAD' && template.method === 'GET')\n            ) {\n                continue;\n            }\n\n            if (matchSegments(template.segments, segments, false)) {\n                return template.label;\n            }\n        }\n\n        for (const template of templates.exact) {\n            if (matchSegments(template.segments, segments, false)) {\n                return template.label;\n            }\n        }\n\n        for (const template of templates.prefix) {\n            if (matchSegments(template.segments, segments, true)) {\n                return `${template.label}/**`;\n            }\n        }\n\n        return PATH_LABEL_UNMATCHED;\n    };\n}\n\nexport function registerPrometheusMiddleware(router: IApp, input?: OptionsInput) {\n    let options : OptionsInput = {\n        normalizePath: createRouteTemplateNormalizePath(router),\n        skip(event) {\n            let { path } = event;\n            if (!path.startsWith('/')) {\n                path = `/${path}`;\n            }\n\n            return path.startsWith('/metrics') ||\n                path === '/';\n        },\n    };\n\n    if (input) {\n        options = {\n            ...options,\n            ...input,\n        };\n    }\n\n    router.use(prometheus(options));\n}\n"],"mappings":";;;;;AAWA,MAAMC,uBAAuB;AAa7B,SAASC,eAAeC,MAAY;CAChC,OAAOA,KAAKC,MAAM,GAAA,CAAA,CAAKC,QAAQC,YAAYA,QAAQC,SAAS,CAAA;AAChE;AAEA,SAASC,mBAAmBF,SAAe;CACvC,OAAOA,QAAQG,WAAW,GAAA,KAAQH,YAAY;AAClD;AAEA,SAASI,cACLC,kBACAC,UACAC,QAAe;CAEf,IACIA,SACID,SAASL,SAASI,iBAAiBJ,SACnCK,SAASL,WAAWI,iBAAiBJ,QAEzC,OAAO;CAGX,KAAK,MAAM,CAACO,GAAGC,oBAAoBJ,iBAAiBK,QAAO,GAAI;EAC3D,IAAIR,mBAAmBO,eAAAA,GACnB;EAGJ,IAAIA,oBAAoBH,SAASE,IAC7B,OAAO;CAEf;CAEA,OAAO;AACX;AAEA,SAASG,oBAAoBC,QAAY;CACrC,MAAMC,QAAyB,CAAA;CAC/B,MAAMN,SAA0B,CAAA;CAChC,MAAMO,uBAAO,IAAIC,IAAAA;CAEjB,KAAK,MAAMC,SAASJ,OAAOK,QAAQ;EAC/B,IAAI,OAAOD,MAAMnB,SAAS,UACtB;EAGJ,MAAMS,WAAWV,eAAeoB,MAAMnB,IAAI;EAC1C,MAAMqB,QAAQ,IAAIZ,SAASa,KAAK,GAAA;EAChC,MAAMC,MAAM,GAAGJ,MAAMK,UAAU,GAAG,GAAGH;EACrC,IAAIJ,KAAKQ,IAAIF,GAAAA,GACT;EAEJN,KAAKS,IAAIH,GAAAA;EAET,IAAIJ,MAAMK,QACNR,MAAMW,KAAK;GACPH,QAAQL,MAAMK;GACdf;GACAY;EACJ,CAAA;OACG,IAAIZ,SAASL,SAAS,GACzBM,OAAOiB,KAAK;GAAElB;GAAUY;EAAM,CAAA;CAEtC;CAEAX,OAAOkB,MAAMC,GAAGC,MAAMA,EAAErB,SAASL,SAASyB,EAAEpB,SAASL,MAAM;CAE3D,OAAO;EAAEY;EAAON;CAAO;AAC3B;;;;;;;;;;;GAaA,SAAgBqB,iCACZhB,QAAY;CAEZ,IAAIiB;CAEJ,QAAQhC,MAAMiC,UAAAA;EACV,IAAI,CAACD,WACDA,YAAYlB,oBAAoBC,MAAAA;EAGpC,MAAMN,WAAWV,eAAeC,IAAAA;EAChC,MAAMwB,SAAS,GAAGS,MAAMT,SAASU,YAAW;EAE5C,KAAK,MAAMC,YAAYH,UAAUhB,OAAO;GACpC,IACImB,SAASX,WAAWA,UACpB,EAAEA,WAAW,UAAUW,SAASX,WAAW,QAE3C;GAGJ,IAAIjB,cAAc4B,SAAS1B,UAAUA,UAAU,KAAA,GAC3C,OAAO0B,SAASd;EAExB;EAEA,KAAK,MAAMc,YAAYH,UAAUhB,OAC7B,IAAIT,cAAc4B,SAAS1B,UAAUA,UAAU,KAAA,GAC3C,OAAO0B,SAASd;EAIxB,KAAK,MAAMc,YAAYH,UAAUtB,QAC7B,IAAIH,cAAc4B,SAAS1B,UAAUA,UAAU,IAAA,GAC3C,OAAO,GAAG0B,SAASd,MAAM;EAIjC,OAAOvB;CACX;AACJ;AAEA,SAAgBsC,6BAA6BrB,QAAcsB,OAAoB;CAC3E,IAAIC,UAAyB;EACzBC,eAAeR,iCAAiChB,MAAAA;EAChDyB,KAAKP,OAAK;GACN,IAAI,EAAEjC,SAASiC;GACf,IAAI,CAACjC,KAAKM,WAAW,GAAA,GACjBN,OAAO,IAAIA;GAGf,OAAOA,KAAKM,WAAW,UAAA,KACnBN,SAAS;EACjB;CACJ;CAEA,IAAIqC,OACAC,UAAU;EACN,GAAGA;EACH,GAAGD;CACP;CAGJtB,OAAO0B,IAAI5C,WAAWyC,OAAAA,CAAAA;AAC1B"}

package/dist/adapters/http/middleware/built-in/rate-limit.d.ts

@@ -1,4 +1,4 @@
 import type { OptionsInput } from '@routup/rate-limit';
-import type { App } from 'routup';
-export declare function registerRateLimitMiddleware(router: App, input?: OptionsInput): void;
+import type { IApp } from 'routup';
+export declare function registerRateLimitMiddleware(router: IApp, input?: OptionsInput): void;
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/adapters/http/middleware/built-in/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAKlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QA4B5E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,IAAI,EAAa,MAAM,QAAQ,CAAC;AA0B9C,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,YAAY,QAmC7E"}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs

@@ -7,9 +7,24 @@ import { merge } from "smob";
 import { getRequestIP } from "routup";
 import { rateLimit } from "@routup/rate-limit";
 //#region src/adapters/http/middleware/built-in/rate-limit.ts
+const LOOPBACK_IP = /^(?:::1|(?:::ffff:)?127(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3})$/i;
+/**
+* Whether the request originated inside the deployment itself.
+*
+* BOTH addresses must be loopback, and each rules out the other's failure.
+* The socket address (`trustProxy: false`) cannot be forged by a header, so
+* a directly exposed server cannot be handed `X-Forwarded-For: 127.0.0.1`
+* and skipped. The trust-contract address cannot be assumed loopback just
+* because the connection was: a reverse proxy on the same host reaches the
+* server over loopback for every visitor, and skipping on the socket alone
+* would turn the limiter off deployment-wide there.
+*/ function isLoopbackRequest(event) {
+	return LOOPBACK_IP.test(getRequestIP(event, { trustProxy: false }) || "") && LOOPBACK_IP.test(getRequestIP(event) || "");
+}
 function registerRateLimitMiddleware(router, input) {
 	let options = {
 		keyGenerator: (event) => getRequestIP(event) || "127.0.0.1",
+		skip: isLoopbackRequest,
 		max(event) {
 			const identity = useRequestIdentity(event);
 			if (!identity) return 1200;

package/dist/adapters/http/middleware/built-in/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":["rateLimit","getRequestIP","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","keyGenerator","event","max","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { getRequestIP } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        // @routup/rate-limit's default keyGenerator hardcodes\n        // `{ trustProxy: true }`; deriving the key here instead lets it\n        // follow the app-level trust contract (config `trustProxy`).\n        keyGenerator: (event) => getRequestIP(event) || '127.0.0.1',\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EAIzBC,eAAeC,UAAUR,aAAaQ,KAAAA,KAAU;EAChDC,IAAID,OAAK;GACL,MAAME,WAAWR,mBAAmBM,KAAAA;GACpC,IAAI,CAACE,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO;IAGX,SACI,OAAO;GAEf;EACJ;EACAC,UAAU;CACd;CAEAN,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOS,IAAId,UAAUO,OAAAA,CAAAA;AACzB"}
+{"version":3,"file":"rate-limit.mjs","names":["rateLimit","getRequestIP","merge","useRequestIdentity","LOOPBACK_IP","isLoopbackRequest","event","test","trustProxy","registerRateLimitMiddleware","router","input","options","keyGenerator","skip","max","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { IApp, IAppEvent } from 'routup';\nimport { getRequestIP } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\n// IPv4 127.0.0.0/8, `::1`, and the IPv4-mapped form a dual-stack socket\n// reports. Anchored and octet-checked rather than a `127.` prefix test: a\n// sloppy match here is a way past the limiter, not a cosmetic detail.\nconst LOOPBACK_IP = /^(?:::1|(?:::ffff:)?127(?:\\.(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)){3})$/i;\n\n/**\n * Whether the request originated inside the deployment itself.\n *\n * BOTH addresses must be loopback, and each rules out the other's failure.\n * The socket address (`trustProxy: false`) cannot be forged by a header, so\n * a directly exposed server cannot be handed `X-Forwarded-For: 127.0.0.1`\n * and skipped. The trust-contract address cannot be assumed loopback just\n * because the connection was: a reverse proxy on the same host reaches the\n * server over loopback for every visitor, and skipping on the socket alone\n * would turn the limiter off deployment-wide there.\n */\nfunction isLoopbackRequest(event: IAppEvent) : boolean {\n    return LOOPBACK_IP.test(getRequestIP(event, { trustProxy: false }) || '') &&\n        LOOPBACK_IP.test(getRequestIP(event) || '');\n}\n\nexport function registerRateLimitMiddleware(router: IApp, input?: OptionsInput) {\n    let options : OptionsInput = {\n        // @routup/rate-limit's default keyGenerator hardcodes\n        // `{ trustProxy: true }`; deriving the key here instead lets it\n        // follow the app-level trust contract (config `trustProxy`).\n        keyGenerator: (event) => getRequestIP(event) || '127.0.0.1',\n        // A loopback source is by construction the deployment itself: the\n        // hosted auth pages render through the auth console's internal\n        // client and server-core's own self-calls ride the same address, so\n        // counting them collapses the whole deployment onto one anonymous\n        // bucket of 1200/min -- 20 page renders per second, however many\n        // distinct visitors there are.\n        skip: isLoopbackRequest,\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAMI,cAAc;;;;;;;;;;;GAapB,SAASC,kBAAkBC,OAAgB;CACvC,OAAOF,YAAYG,KAAKN,aAAaK,OAAO,EAAEE,YAAY,MAAM,CAAA,KAAM,EAAA,KAClEJ,YAAYG,KAAKN,aAAaK,KAAAA,KAAU,EAAA;AAChD;AAEA,SAAgBG,4BAA4BC,QAAcC,OAAoB;CAC1E,IAAIC,UAAyB;EAIzBC,eAAeP,UAAUL,aAAaK,KAAAA,KAAU;EAOhDQ,MAAMT;EACNU,IAAIT,OAAK;GACL,MAAMU,WAAWb,mBAAmBG,KAAAA;GACpC,IAAI,CAACU,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO;IAGX,SACI,OAAO;GAEf;EACJ;EACAC,UAAU;CACd;CAEAN,UAAUV,MAAMS,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOS,IAAInB,UAAUY,OAAAA,CAAAA;AACzB"}

package/dist/adapters/http/middleware/index.mjs

@@ -1,14 +1,13 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAUTH2_ISSUANCE_PATHS, isOAuth2IssuancePath, normalizeRequestPath } from "./built-in/authorization/issuance.mjs";
 import { AuthorizationMiddleware } from "./built-in/authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./built-in/authorization/factory.mjs";
 import { ForceLoggedInMiddleware } from "./built-in/loggedin/module.mjs";
 import { ForceUserLoggedInMiddleware } from "./built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./built-in/realm-resolver/factory.mjs";
-import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./built-in/theme.mjs";
-import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./built-in/assets.mjs";
 import { registerBasicMiddleware } from "./built-in/basic.mjs";
 import { registerCorsMiddleware } from "./built-in/cors.mjs";
 import { registerErrorMiddleware } from "./built-in/error.mjs";
@@ -16,6 +15,6 @@ import { createLoggerMiddleware, redactSensitiveURLParams } from "./built-in/log
 import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./built-in/swagger.mjs";
-import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./built-in/ui-http-client.mjs";
+import { INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, registerInternalHttpClientMiddleware } from "./built-in/internal-http-client.mjs";
 import "./built-in/index.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, THEME_STORE_KEY, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, useRequestTheme };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, OAUTH2_ISSUANCE_PATHS, RealmResolverMiddleware, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, isOAuth2IssuancePath, normalizeRequestPath, redactSensitiveURLParams, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerInternalHttpClientMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware };

package/dist/adapters/http/request/constants.d.ts

@@ -5,5 +5,5 @@ export declare enum RequestHandlerOperation {
     UPDATE = "update",
     DELETE = "delete"
 }
-export declare const CERTIFICATE_SOURCES: readonly ["disabled", "standard", "forwarded"];
+export { CERTIFICATE_SOURCES } from '@authup/server-config';
 //# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/request/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB;AAED,eAAO,MAAM,mBAAmB,gDAItB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB;AAMD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/adapters/http/request/constants.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CERTIFICATE_SOURCES } from "@authup/server-config";
 //#region src/adapters/http/request/constants.ts
 var RequestHandlerOperation = /*#__PURE__*/ function(RequestHandlerOperation) {
 	RequestHandlerOperation["COMMAND"] = "command";
@@ -10,11 +11,6 @@ var RequestHandlerOperation = /*#__PURE__*/ function(RequestHandlerOperation) {
 	RequestHandlerOperation["DELETE"] = "delete";
 	return RequestHandlerOperation;
 }({});
-const CERTIFICATE_SOURCES = [
-	"disabled",
-	"standard",
-	"forwarded"
-];
 //#endregion
 export { CERTIFICATE_SOURCES, RequestHandlerOperation };
 

package/dist/adapters/http/request/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n    'disabled',\n    'standard',\n    'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;CAAAA,OAAAA;AAMX,EAAA,CAAA,CAAA;AAED,MAAaC,sBAAsB;CAC/B;CACA;CACA;AACH"}
+{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\n// The certificate-source vocabulary is declared with the `certificateSource`\n// key it is the vocabulary of (in `@authup/server-config`), because the\n// configuration document has to be describable without importing this\n// service. Re-exported here so the request layer keeps one import path.\nexport { CERTIFICATE_SOURCES } from '@authup/server-config';\n"],"mappings":";;;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;CAAAA,OAAAA;AAMX,EAAA,CAAA,CAAA"}

package/dist/adapters/http/request/helpers/index.d.ts

@@ -6,7 +6,7 @@ export * from './locations.ts';
 export * from './mfa-login-ticket.ts';
 export * from './param-id.ts';
 export * from './realm-id.ts';
-export * from './redirect.ts';
+export * from './same-origin.ts';
 export * from './scopes.ts';
 export * from './session-id.ts';
 export * from './token.ts';

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -9,8 +9,8 @@ import { readFromLocations } from "./locations.mjs";
 import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
-import { sanitizeRelativeRedirect } from "./redirect.mjs";
+import { isSameOriginRequest } from "./same-origin.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./session-id.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isSameOriginRequest, readFromLocations, setRequestIdentity, setRequestMfaLoginTicket, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/helpers/locale.d.ts

@@ -1,6 +1,7 @@
 import type { LocaleCode } from '@authup/i18n';
+import { LOCALE_COOKIE } from '@authup/server-console-kit';
 import type { IAppEvent } from 'routup';
-export declare const LOCALE_COOKIE = "vc-locale";
+export { LOCALE_COOKIE };
 /**
  * Resolve the requester's preferred **authored** locale. The explicit UI
  * locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps

package/dist/adapters/http/request/helpers/locale.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locale.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/locale.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAkBzE"}
+{"version":3,"file":"locale.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/locale.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAkBzE"}

package/dist/adapters/http/request/helpers/locale.mjs

@@ -3,9 +3,9 @@ import "node:url";
 import.meta.url;
 import { matchLocale } from "@authup/i18n";
 import { getRequestAcceptableLanguages } from "routup";
+import { LOCALE_COOKIE } from "@authup/server-console-kit";
 import { useRequestCookie } from "@routup/basic/cookie";
 //#region src/adapters/http/request/helpers/locale.ts
-const LOCALE_COOKIE = "vc-locale";
 /**
 * Resolve the requester's preferred **authored** locale. The explicit UI
 * locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps

package/dist/adapters/http/request/helpers/locale.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"locale.mjs","names":["matchLocale","useRequestCookie","getRequestAcceptableLanguages","LOCALE_COOKIE","useRequestLocale","event","cookie","matched","languages","language","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/locale.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LocaleCode } from '@authup/i18n';\nimport { matchLocale } from '@authup/i18n';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport type { IAppEvent } from 'routup';\nimport { getRequestAcceptableLanguages } from 'routup';\n\nexport const LOCALE_COOKIE = 'vc-locale';\n\n/**\n * Resolve the requester's preferred **authored** locale. The explicit UI\n * locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps\n * onto a supported catalog locale; `auto` and unsupported values fall\n * through to the Accept-Language chain (routup-negotiated, q-ordered),\n * which is walked for the first language authup ships — so\n * `pt-BR, de;q=0.8` resolves to `de`, not the default. Returns undefined\n * when nothing matches (callers fall back to the default locale).\n */\nexport function useRequestLocale(event: IAppEvent): LocaleCode | undefined {\n    const cookie = useRequestCookie(event, LOCALE_COOKIE);\n    if (typeof cookie === 'string') {\n        const matched = matchLocale(cookie);\n        if (matched) {\n            return matched;\n        }\n    }\n\n    const languages = getRequestAcceptableLanguages(event);\n    for (const language of languages) {\n        const matched = matchLocale(language);\n        if (matched) {\n            return matched;\n        }\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;AAaA,MAAaG,gBAAgB;;;;;;;;;GAW7B,SAAgBC,iBAAiBC,OAAgB;CAC7C,MAAMC,SAASL,iBAAiBI,OAAOF,aAAAA;CACvC,IAAI,OAAOG,WAAW,UAAU;EAC5B,MAAMC,UAAUP,YAAYM,MAAAA;EAC5B,IAAIC,SACA,OAAOA;CAEf;CAEA,MAAMC,YAAYN,8BAA8BG,KAAAA;CAChD,KAAK,MAAMI,YAAYD,WAAW;EAC9B,MAAMD,UAAUP,YAAYS,QAAAA;EAC5B,IAAIF,SACA,OAAOA;CAEf;AAGJ"}
+{"version":3,"file":"locale.mjs","names":["matchLocale","LOCALE_COOKIE","useRequestCookie","getRequestAcceptableLanguages","useRequestLocale","event","cookie","matched","languages","language","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/locale.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LocaleCode } from '@authup/i18n';\nimport { matchLocale } from '@authup/i18n';\nimport { LOCALE_COOKIE } from '@authup/server-console-kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport type { IAppEvent } from 'routup';\nimport { getRequestAcceptableLanguages } from 'routup';\n\n// The cookie name is owned by @authup/server-console-kit, which stamps the\n// served shells from it. Re-exported so this module stays the one place\n// server-core reads a request locale from.\nexport { LOCALE_COOKIE };\n\n/**\n * Resolve the requester's preferred **authored** locale. The explicit UI\n * locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps\n * onto a supported catalog locale; `auto` and unsupported values fall\n * through to the Accept-Language chain (routup-negotiated, q-ordered),\n * which is walked for the first language authup ships — so\n * `pt-BR, de;q=0.8` resolves to `de`, not the default. Returns undefined\n * when nothing matches (callers fall back to the default locale).\n */\nexport function useRequestLocale(event: IAppEvent): LocaleCode | undefined {\n    const cookie = useRequestCookie(event, LOCALE_COOKIE);\n    if (typeof cookie === 'string') {\n        const matched = matchLocale(cookie);\n        if (matched) {\n            return matched;\n        }\n    }\n\n    const languages = getRequestAcceptableLanguages(event);\n    for (const language of languages) {\n        const matched = matchLocale(language);\n        if (matched) {\n            return matched;\n        }\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;GA4BA,SAAgBI,iBAAiBC,OAAgB;CAC7C,MAAMC,SAASJ,iBAAiBG,OAAOJ,aAAAA;CACvC,IAAI,OAAOK,WAAW,UAAU;EAC5B,MAAMC,UAAUP,YAAYM,MAAAA;EAC5B,IAAIC,SACA,OAAOA;CAEf;CAEA,MAAMC,YAAYL,8BAA8BE,KAAAA;CAChD,KAAK,MAAMI,YAAYD,WAAW;EAC9B,MAAMD,UAAUP,YAAYS,QAAAA;EAC5B,IAAIF,SACA,OAAOA;CAEf;AAGJ"}

package/dist/adapters/http/request/helpers/same-origin.d.ts

@@ -0,0 +1,38 @@
+import type { Logger } from '@authup/server-kit';
+import type { IAppEvent } from 'routup';
+export type SameOriginRequestOptions = {
+    /**
+     * Reports an origin mismatch ONCE per process (see below). Omitted, the
+     * predicate is silent.
+     */
+    logger?: Logger;
+};
+/**
+ * Whether a request demonstrably originates from publicUrl's own origin. This
+ * is the gate every cookie-authenticated surface rides on (plan 088), where
+ * the credential is ambient and no header proves intent by itself.
+ *
+ * Three conditions, in order:
+ *
+ * 1. `Sec-Fetch-Site: same-origin`, **failing closed when the header is
+ *    absent**. This is the condition `SameSite` cannot carry: the attribute is
+ *    scoped to the registrable domain, so a hostile sibling subdomain is
+ *    *same-site* and its requests carry the cookie. A sibling sends
+ *    `same-site`, never `same-origin`. Fetch Metadata is universal across the
+ *    consoles' browser baseline (Chrome 111+, Safari 16.4+, Firefox 128+), so
+ *    an absent header means a non-browser client, which has no business
+ *    presenting a browser credential.
+ * 2. When `Origin` is present it must equal publicUrl's own origin.
+ * 3. When it is absent, only a safe method passes.
+ *
+ * A predicate rather than an assertion: the authorization middleware ignores a
+ * cookie that fails this and continues anonymous, while a route that acts on
+ * the cookie rejects.
+ *
+ * The mismatch in (2) is logged once, naming both values, because it is a
+ * deployment fault rather than an attack in every case that actually happens:
+ * a browser-facing host differing from `publicUrl` otherwise presents as a
+ * console that loads and then silently 401s every write.
+ */
+export declare function isSameOriginRequest(event: IAppEvent, baseURL: string, options?: SameOriginRequestOptions): boolean;
+//# sourceMappingURL=same-origin.d.ts.map

package/dist/adapters/http/request/helpers/same-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-origin.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/same-origin.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAUF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,wBAA6B,GACtC,OAAO,CAuBV"}

package/dist/adapters/http/request/helpers/same-origin.mjs

@@ -0,0 +1,68 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/same-origin.ts
+/**
+* Methods RFC 9110 §9.2.1 defines as safe. A browser omits `Origin` on a
+* same-origin request only for these; `fetch` / XHR set it on every other
+* method, so an absent header on a state-changing request is not a browser
+* doing what browsers do.
+*/ const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* Whether a request demonstrably originates from publicUrl's own origin. This
+* is the gate every cookie-authenticated surface rides on (plan 088), where
+* the credential is ambient and no header proves intent by itself.
+*
+* Three conditions, in order:
+*
+* 1. `Sec-Fetch-Site: same-origin`, **failing closed when the header is
+*    absent**. This is the condition `SameSite` cannot carry: the attribute is
+*    scoped to the registrable domain, so a hostile sibling subdomain is
+*    *same-site* and its requests carry the cookie. A sibling sends
+*    `same-site`, never `same-origin`. Fetch Metadata is universal across the
+*    consoles' browser baseline (Chrome 111+, Safari 16.4+, Firefox 128+), so
+*    an absent header means a non-browser client, which has no business
+*    presenting a browser credential.
+* 2. When `Origin` is present it must equal publicUrl's own origin.
+* 3. When it is absent, only a safe method passes.
+*
+* A predicate rather than an assertion: the authorization middleware ignores a
+* cookie that fails this and continues anonymous, while a route that acts on
+* the cookie rejects.
+*
+* The mismatch in (2) is logged once, naming both values, because it is a
+* deployment fault rather than an attack in every case that actually happens:
+* a browser-facing host differing from `publicUrl` otherwise presents as a
+* console that loads and then silently 401s every write.
+*/ function isSameOriginRequest(event, baseURL, options = {}) {
+	if (event.headers.get("sec-fetch-site") !== "same-origin") return false;
+	let expected;
+	try {
+		expected = new URL(baseURL).origin;
+	} catch {
+		return false;
+	}
+	const origin = event.headers.get("origin");
+	if (origin) {
+		if (origin !== expected) {
+			reportOriginMismatch(origin, expected, options.logger);
+			return false;
+		}
+		return true;
+	}
+	return SAFE_METHODS.has(`${event.method}`.toUpperCase());
+}
+let originMismatchReported = false;
+function reportOriginMismatch(origin, expected, logger) {
+	if (originMismatchReported || !logger) return;
+	originMismatchReported = true;
+	logger.warn(`A same-origin request carried the origin ${origin}, but publicUrl resolves to ${expected}. Cookie-authenticated requests from that origin are refused. Set publicUrl to the origin the browser actually reaches.`);
+}
+//#endregion
+export { isSameOriginRequest };
+
+//# sourceMappingURL=same-origin.mjs.map

package/dist/adapters/http/request/helpers/same-origin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-origin.mjs","names":["SAFE_METHODS","Set","isSameOriginRequest","event","baseURL","options","headers","get","expected","URL","origin","reportOriginMismatch","logger","has","method","toUpperCase","originMismatchReported","warn"],"sources":["../../../../../src/adapters/http/request/helpers/same-origin.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Logger } from '@authup/server-kit';\nimport type { IAppEvent } from 'routup';\n\nexport type SameOriginRequestOptions = {\n    /**\n     * Reports an origin mismatch ONCE per process (see below). Omitted, the\n     * predicate is silent.\n     */\n    logger?: Logger,\n};\n\n/**\n * Methods RFC 9110 §9.2.1 defines as safe. A browser omits `Origin` on a\n * same-origin request only for these; `fetch` / XHR set it on every other\n * method, so an absent header on a state-changing request is not a browser\n * doing what browsers do.\n */\nconst SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);\n\n/**\n * Whether a request demonstrably originates from publicUrl's own origin. This\n * is the gate every cookie-authenticated surface rides on (plan 088), where\n * the credential is ambient and no header proves intent by itself.\n *\n * Three conditions, in order:\n *\n * 1. `Sec-Fetch-Site: same-origin`, **failing closed when the header is\n *    absent**. This is the condition `SameSite` cannot carry: the attribute is\n *    scoped to the registrable domain, so a hostile sibling subdomain is\n *    *same-site* and its requests carry the cookie. A sibling sends\n *    `same-site`, never `same-origin`. Fetch Metadata is universal across the\n *    consoles' browser baseline (Chrome 111+, Safari 16.4+, Firefox 128+), so\n *    an absent header means a non-browser client, which has no business\n *    presenting a browser credential.\n * 2. When `Origin` is present it must equal publicUrl's own origin.\n * 3. When it is absent, only a safe method passes.\n *\n * A predicate rather than an assertion: the authorization middleware ignores a\n * cookie that fails this and continues anonymous, while a route that acts on\n * the cookie rejects.\n *\n * The mismatch in (2) is logged once, naming both values, because it is a\n * deployment fault rather than an attack in every case that actually happens:\n * a browser-facing host differing from `publicUrl` otherwise presents as a\n * console that loads and then silently 401s every write.\n */\nexport function isSameOriginRequest(\n    event: IAppEvent,\n    baseURL: string,\n    options: SameOriginRequestOptions = {},\n) : boolean {\n    if (event.headers.get('sec-fetch-site') !== 'same-origin') {\n        return false;\n    }\n\n    let expected : string;\n    try {\n        expected = new URL(baseURL).origin;\n    } catch {\n        return false;\n    }\n\n    const origin = event.headers.get('origin');\n    if (origin) {\n        if (origin !== expected) {\n            reportOriginMismatch(origin, expected, options.logger);\n            return false;\n        }\n\n        return true;\n    }\n\n    return SAFE_METHODS.has(`${event.method}`.toUpperCase());\n}\n\nlet originMismatchReported = false;\n\nfunction reportOriginMismatch(\n    origin: string,\n    expected: string,\n    logger?: Logger,\n) : void {\n    if (originMismatchReported || !logger) {\n        return;\n    }\n\n    originMismatchReported = true;\n\n    logger.warn(\n        `A same-origin request carried the origin ${origin}, but publicUrl resolves to ${expected}. ` +\n        'Cookie-authenticated requests from that origin are refused. ' +\n        'Set publicUrl to the origin the browser actually reaches.',\n    );\n}\n"],"mappings":";;;;;;;;;GAwBA,MAAMA,+BAAe,IAAIC,IAAI;CAAC;CAAO;CAAQ;AAAU,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BvD,SAAgBC,oBACZC,OACAC,SACAC,UAAoC,CAAC,GAAC;CAEtC,IAAIF,MAAMG,QAAQC,IAAI,gBAAA,MAAsB,eACxC,OAAO;CAGX,IAAIC;CACJ,IAAI;EACAA,WAAW,IAAIC,IAAIL,OAAAA,CAAAA,CAASM;CAChC,QAAQ;EACJ,OAAO;CACX;CAEA,MAAMA,SAASP,MAAMG,QAAQC,IAAI,QAAA;CACjC,IAAIG,QAAQ;EACR,IAAIA,WAAWF,UAAU;GACrBG,qBAAqBD,QAAQF,UAAUH,QAAQO,MAAM;GACrD,OAAO;EACX;EAEA,OAAO;CACX;CAEA,OAAOZ,aAAaa,IAAI,GAAGV,MAAMW,SAASC,YAAW,CAAA;AACzD;AAEA,IAAIC,yBAAyB;AAE7B,SAASL,qBACLD,QACAF,UACAI,QAAe;CAEf,IAAII,0BAA0B,CAACJ,QAC3B;CAGJI,yBAAyB;CAEzBJ,OAAOK,KACH,4CAA4CP,OAAO,8BAA8BF,SAAS,wHAE1F;AAER"}

package/dist/adapters/http/request/index.mjs

@@ -12,7 +12,7 @@ import { readFromLocations } from "./helpers/locations.mjs";
 import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
-import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
+import { isSameOriginRequest } from "./helpers/same-origin.mjs";
 import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
@@ -20,4 +20,4 @@ import "./helpers/index.mjs";
 import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./event-context.mjs";
 import { RequestPermissionEvaluator } from "./permission/module.mjs";
 import "./permission/index.mjs";
-export { CERTIFICATE_SOURCES, LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, createRequestEventContextMiddleware, extractClientCertificateEvidence, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { CERTIFICATE_SOURCES, LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, createRequestEventContextMiddleware, extractClientCertificateEvidence, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isSameOriginRequest, readFromLocations, runWithRequestEventContext, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/permission/module.mjs

@@ -32,7 +32,7 @@ var RequestPermissionEvaluator = class {
 	extendContext(ctx) {
 		const scopes = useRequestScopes(this.event);
 		const identity = useRequestIdentity(this.event);
-		if (scopes.includes(ScopeName.GLOBAL) && identity) {
+		if (identity && scopes.includes(ScopeName.GLOBAL)) {
 			ctx.data = ctx.data || new PolicyData();
 			ctx.data.set(BuiltInPolicyType.IDENTITY, identity);
 		}

package/dist/adapters/http/request/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","compile","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionCompileContext,\n    PermissionCompileResult,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async compile(ctx: PermissionCompileContext) : Promise<PermissionCompileResult> {\n        return this.evaluator.compile(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T) : T {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIA,MAAMK,QAAQL,KAAkE;EAC5E,OAAO,KAAKF,UAAUO,QAAQ,KAAKJ,cAAcD,GAAAA,CAAAA;CACrD;CAIUC,cAAgFD,KAAY;EAClG,MAAMM,SAASX,iBAAiB,KAAKE,KAAK;EAC1C,MAAMU,WAAWb,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIS,OAAOE,SAASjB,UAAUkB,MAAM,KAAKF,UAAU;GAC/CP,IAAIU,OAAOV,IAAIU,QAAQ,IAAIjB,WAAAA;GAC3BO,IAAIU,KAAKC,IAAInB,kBAAkBoB,UAAUL,QAAAA;EAC7C;EAEA,OAAOP;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","compile","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionCompileContext,\n    PermissionCompileResult,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async compile(ctx: PermissionCompileContext) : Promise<PermissionCompileResult> {\n        return this.evaluator.compile(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T) : T {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (identity && scopes.includes(ScopeName.GLOBAL)) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIA,MAAMK,QAAQL,KAAkE;EAC5E,OAAO,KAAKF,UAAUO,QAAQ,KAAKJ,cAAcD,GAAAA,CAAAA;CACrD;CAIUC,cAAgFD,KAAY;EAClG,MAAMM,SAASX,iBAAiB,KAAKE,KAAK;EAC1C,MAAMU,WAAWb,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIU,YAAYD,OAAOE,SAASjB,UAAUkB,MAAM,GAAG;GAC/CT,IAAIU,OAAOV,IAAIU,QAAQ,IAAIjB,WAAAA;GAC3BO,IAAIU,KAAKC,IAAInB,kBAAkBoB,UAAUL,QAAAA;EAC7C;EAEA,OAAOP;CACX;AACJ"}

package/dist/adapters/http/request/types.d.ts

@@ -1,3 +1,2 @@
-import type { CERTIFICATE_SOURCES } from './constants.ts';
-export type CertificateSource = typeof CERTIFICATE_SOURCES[number];
+export type { CertificateSource } from '@authup/server-config';
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/request/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/types.ts"],"names":[],"mappings":"AASA,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/adapters/shared/ldap/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/shared/ldap/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC5D,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,qBAAa,UAAW,YAAW,WAAW;IAC1C,SAAS,CAAC,OAAO,EAAG,iBAAiB,CAAC;IAEtC,SAAS,CAAC,MAAM,EAAG,MAAM,CAAC;gBAEd,OAAO,EAAE,iBAAiB;IAShC,OAAO,IAAK,OAAO,CAAC,IAAI,CAAC;IA2C/B,IAAI,SAAS,IAAK,OAAO,CAExB;IAEY,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAgC7D,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAaxB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAa3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAajC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC;IAa/D,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IA8ClF,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAI,MAAM;IA6BvC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,GAAI,OAAO;CAgB1C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/shared/ldap/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC5D,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,qBAAa,UAAW,YAAW,WAAW;IAC1C,SAAS,CAAC,OAAO,EAAG,iBAAiB,CAAC;IAEtC,SAAS,CAAC,MAAM,EAAG,MAAM,CAAC;gBAEd,OAAO,EAAE,iBAAiB;IAShC,OAAO,IAAK,OAAO,CAAC,IAAI,CAAC;IA4C/B,IAAI,SAAS,IAAK,OAAO,CAExB;IAEY,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAgC7D,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAaxB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAa3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;IAajC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,IAAI,CAAC;IAa/D,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IA8ClF,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAI,MAAM;IA6BvC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,GAAI,OAAO;CAgB1C"}

package/dist/adapters/shared/ldap/module.mjs

@@ -31,7 +31,10 @@ var LdapClient = class {
 				return;
 			}
 			const errorListener = (error) => {
-				if (error) reject(error);
+				if (error) {
+					reject(error);
+					return;
+				}
 				resolve();
 			};
 			this.driver.connect();

package/dist/adapters/shared/ldap/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ldap","LdapClient","options","driver","createClient","url","tlsOptions","tls","connectTimeout","connect","Promise","resolve","reject","listener","startTLS","starttls","err","connected","errorListener","error","once","bind","user","password","then","Error","catch","e","unbind","add","name","data","del","modify","change","search","dn","resolveDn","baseDn","scope","res","entries","on","searchEntry","entry","pojo","objectName","i","attributes","length","attribute","type","Array","isArray","values","map","el","trim","filter","Boolean","push","searchResult","status","input","output","parseDN","childOf","equals","SyntaxError","isDn","DN","isDN","fromString","test"],"sources":["../../../../src/adapters/shared/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Change, Client, SearchOptions } from 'ldapjs';\nimport ldap from 'ldapjs';\nimport type { ILdapClient } from '../../../core/index.ts';\nimport type { LdapClientOptions } from './types.ts';\n\nexport class LdapClient implements ILdapClient {\n    protected options : LdapClientOptions;\n\n    protected driver : Client;\n\n    constructor(options: LdapClientOptions) {\n        this.options = options;\n        this.driver = ldap.createClient({\n            url: options.url,\n            tlsOptions: options.tls,\n            connectTimeout: 3000,\n        });\n    }\n\n    async connect() : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            const listener = () => {\n                if (this.options.startTLS) {\n                    this.driver.starttls(\n                        this.options.tls || {},\n                        null,\n                        (err) => {\n                            if (err) {\n                                reject(err);\n                                return;\n                            }\n\n                            resolve();\n                        },\n                    );\n                } else {\n                    resolve();\n                }\n            };\n\n            if (this.driver.connected) {\n                listener();\n                return;\n            }\n\n            const errorListener = (error?: Error | null) => {\n                if (error) {\n                    reject(error);\n                }\n\n                resolve();\n            };\n\n            this.driver.connect();\n            this.driver.once('connect', listener);\n            this.driver.once('timeout', errorListener);\n            this.driver.once('connectTimeout', errorListener);\n            this.driver.once('error', errorListener);\n            this.driver.once('connectError', errorListener);\n        });\n    }\n\n    get connected() : boolean {\n        return this.driver.connected;\n    }\n\n    public async bind(user?: string, password?: string) : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.connect()\n                .then(() => {\n                    if (!user) {\n                        user = this.options.user;\n                        password = this.options.password;\n                    }\n\n                    if (!user) {\n                        reject(new Error('User name not defined.'));\n                        return;\n                    }\n\n                    if (!password) {\n                        reject(new Error('User password not defined.'));\n                        return;\n                    }\n\n                    this.driver.bind(user, password, (err) => {\n                        if (err) {\n                            reject(err);\n                            return;\n                        }\n\n                        resolve();\n                    });\n                })\n                .catch((e) => reject(e));\n        });\n    }\n\n    async unbind() : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.unbind((err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async add(name: string, data: Record<string, any>) {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.add(name, data, (err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async del(name: string) : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.del(name, (err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async modify(name: string, change: Change | Change[]) : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.modify(name, change, (err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async search(options: SearchOptions, dn?: string) : Promise<Record<string, any>[]> {\n        return new Promise((resolve, reject) => {\n            this.driver.search(\n                this.resolveDn(dn, this.options.baseDn),\n                {\n                    scope: 'sub',\n                    ...options,\n                },\n                (err, res) => {\n                    if (err) {\n                        reject(err);\n                        return;\n                    }\n\n                    const entries : Record<string, any>[] = [];\n\n                    res.on('searchEntry', (searchEntry) => {\n                        const entry : Record<string, any> = { dn: searchEntry.pojo.objectName };\n\n                        for (let i = 0; i < searchEntry.attributes.length; i++) {\n                            const attribute = searchEntry.attributes[i];\n\n                            entry[attribute.type] = Array.isArray(attribute.values) ?\n                                attribute.values.map((el: string) => el.trim()).filter(Boolean) :\n                                attribute.values;\n                        }\n\n                        entries.push(entry);\n                    });\n\n                    res.on('error', (err) => {\n                        reject(err);\n                    });\n\n                    res.on('end', (searchResult) => {\n                        if (!searchResult || searchResult.status !== 0) {\n                            reject(new Error('The ldap search was not successfully'));\n                        } else {\n                            resolve(entries);\n                        }\n                    });\n                },\n            );\n        });\n    }\n\n    resolveDn(...input: unknown[]) : string {\n        let output : string | undefined;\n\n        for (let i = 0; i <= input.length; i++) {\n            const el = input[i];\n            if (typeof el !== 'string') {\n                continue;\n            }\n\n            if (!output) {\n                output = el;\n                continue;\n            }\n\n            const dn = ldap.parseDN(output);\n            if (dn.childOf(el) || dn.equals(el)) {\n                continue;\n            }\n\n            output += `,${input[i]}`;\n        }\n\n        if (!output) {\n            throw new SyntaxError('Dn could not be resolved.');\n        }\n\n        return output;\n    }\n\n    isDn(input: string | ldap.DN) : boolean {\n        try {\n            if (typeof input !== 'string') {\n                return ldap.DN.isDN(input);\n            }\n\n            if (typeof (ldap.DN as Record<string, any>).fromString === 'function') {\n                const dn = (ldap.DN as Record<string, any>).fromString(input);\n                return typeof dn !== 'undefined';\n            }\n\n            return /^(?:(?:(?:[a-zA-Z0-9]+(?:[-._][a-zA-Z0-9]+)*)=(?:[\\s]*[^,+\\n=]+[\\s]*)*)(?:[,][\\s]*)?)+$/.test(input);\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,aAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA4B;EACpC,KAAKA,UAAUA;EACf,KAAKC,SAASH,KAAKI,aAAa;GAC5BC,KAAKH,QAAQG;GACbC,YAAYJ,QAAQK;GACpBC,gBAAgB;EACpB,CAAA;CACJ;CAEA,MAAMC,UAA0B;EAC5B,OAAO,IAAIC,SAAeC,SAASC,WAAAA;GAC/B,MAAMC,iBAAW;IACb,IAAI,KAAKX,QAAQY,UACb,KAAKX,OAAOY,SACR,KAAKb,QAAQK,OAAO,CAAC,GACrB,OACCS,QAAAA;KACG,IAAIA,KAAK;MACLJ,OAAOI,GAAAA;MACP;KACJ;KAEAL,QAAAA;IACJ,CAAA;SAGJA,QAAAA;GAER;GAEA,IAAI,KAAKR,OAAOc,WAAW;IACvBJ,SAAAA;IACA;GACJ;GAEA,MAAMK,iBAAiBC,UAAAA;IACnB,IAAIA,OACAP,OAAOO,KAAAA;IAGXR,QAAAA;GACJ;GAEA,KAAKR,OAAOM,QAAO;GACnB,KAAKN,OAAOiB,KAAK,WAAWP,QAAAA;GAC5B,KAAKV,OAAOiB,KAAK,WAAWF,aAAAA;GAC5B,KAAKf,OAAOiB,KAAK,kBAAkBF,aAAAA;GACnC,KAAKf,OAAOiB,KAAK,SAASF,aAAAA;GAC1B,KAAKf,OAAOiB,KAAK,gBAAgBF,aAAAA;EACrC,CAAA;CACJ;CAEA,IAAID,YAAsB;EACtB,OAAO,KAAKd,OAAOc;CACvB;CAEA,MAAaI,KAAKC,MAAeC,UAAmC;EAChE,OAAO,IAAIb,SAAeC,SAASC,WAAAA;GAC/B,KAAKH,QAAO,CAAA,CACPe,WAAK;IACF,IAAI,CAACF,MAAM;KACPA,OAAO,KAAKpB,QAAQoB;KACpBC,WAAW,KAAKrB,QAAQqB;IAC5B;IAEA,IAAI,CAACD,MAAM;KACPV,uBAAO,IAAIa,MAAM,wBAAA,CAAA;KACjB;IACJ;IAEA,IAAI,CAACF,UAAU;KACXX,uBAAO,IAAIa,MAAM,4BAAA,CAAA;KACjB;IACJ;IAEA,KAAKtB,OAAOkB,KAAKC,MAAMC,WAAWP,QAAAA;KAC9B,IAAIA,KAAK;MACLJ,OAAOI,GAAAA;MACP;KACJ;KAEAL,QAAAA;IACJ,CAAA;GACJ,CAAA,CAAA,CACCe,OAAOC,MAAMf,OAAOe,CAAAA,CAAAA;EAC7B,CAAA;CACJ;CAEA,MAAMC,SAAyB;EAC3B,OAAO,IAAIlB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAOyB,QAAQZ,QAAAA;IAChB,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMkB,IAAIC,MAAcC,MAA2B;EAC/C,OAAO,IAAIrB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAO0B,IAAIC,MAAMC,OAAOf,QAAAA;IACzB,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMqB,IAAIF,MAA8B;EACpC,OAAO,IAAIpB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAO6B,IAAIF,OAAOd,QAAAA;IACnB,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMsB,OAAOH,MAAcI,QAA2C;EAClE,OAAO,IAAIxB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAO8B,OAAOH,MAAMI,SAASlB,QAAAA;IAC9B,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMwB,OAAOjC,SAAwBkC,IAA8C;EAC/E,OAAO,IAAI1B,SAASC,SAASC,WAAAA;GACzB,KAAKT,OAAOgC,OACR,KAAKE,UAAUD,IAAI,KAAKlC,QAAQoC,MAAM,GACtC;IACIC,OAAO;IACP,GAAGrC;GACP,IACCc,KAAKwB,QAAAA;IACF,IAAIxB,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEA,MAAMyB,UAAkC,CAAA;IAExCD,IAAIE,GAAG,gBAAgBC,gBAAAA;KACnB,MAAMC,QAA8B,EAAER,IAAIO,YAAYE,KAAKC,WAAW;KAEtE,KAAK,IAAIC,IAAI,GAAGA,IAAIJ,YAAYK,WAAWC,QAAQF,KAAK;MACpD,MAAMG,YAAYP,YAAYK,WAAWD;MAEzCH,MAAMM,UAAUC,QAAQC,MAAMC,QAAQH,UAAUI,MAAM,IAClDJ,UAAUI,OAAOC,KAAKC,OAAeA,GAAGC,KAAI,CAAA,CAAA,CAAIC,OAAOC,OAAAA,IACvDT,UAAUI;KAClB;KAEAb,QAAQmB,KAAKhB,KAAAA;IACjB,CAAA;IAEAJ,IAAIE,GAAG,UAAU1B,QAAAA;KACbJ,OAAOI,GAAAA;IACX,CAAA;IAEAwB,IAAIE,GAAG,QAAQmB,iBAAAA;KACX,IAAI,CAACA,gBAAgBA,aAAaC,WAAW,GACzClD,uBAAO,IAAIa,MAAM,sCAAA,CAAA;UAEjBd,QAAQ8B,OAAAA;IAEhB,CAAA;GACJ,CAAA;EAER,CAAA;CACJ;CAEAJ,UAAU,GAAG0B,OAA2B;EACpC,IAAIC;EAEJ,KAAK,IAAIjB,IAAI,GAAGA,KAAKgB,MAAMd,QAAQF,KAAK;GACpC,MAAMS,KAAKO,MAAMhB;GACjB,IAAI,OAAOS,OAAO,UACd;GAGJ,IAAI,CAACQ,QAAQ;IACTA,SAASR;IACT;GACJ;GAEA,MAAMpB,KAAKpC,KAAKiE,QAAQD,MAAAA;GACxB,IAAI5B,GAAG8B,QAAQV,EAAAA,KAAOpB,GAAG+B,OAAOX,EAAAA,GAC5B;GAGJQ,UAAU,IAAID,MAAMhB;EACxB;EAEA,IAAI,CAACiB,QACD,MAAM,IAAII,YAAY,2BAAA;EAG1B,OAAOJ;CACX;CAEAK,KAAKN,OAAmC;EACpC,IAAI;GACA,IAAI,OAAOA,UAAU,UACjB,OAAO/D,KAAKsE,GAAGC,KAAKR,KAAAA;GAGxB,IAAI,OAAO,KAAMO,GAA2BE,eAAe,YAEvD,OAAO,OADI,KAAMF,GAA2BE,WAAWT,KACzC3B,MAAO;GAGzB,OAAO,0FAA0FqC,KAAKV,KAAAA;EAC1G,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ldap","LdapClient","options","driver","createClient","url","tlsOptions","tls","connectTimeout","connect","Promise","resolve","reject","listener","startTLS","starttls","err","connected","errorListener","error","once","bind","user","password","then","Error","catch","e","unbind","add","name","data","del","modify","change","search","dn","resolveDn","baseDn","scope","res","entries","on","searchEntry","entry","pojo","objectName","i","attributes","length","attribute","type","Array","isArray","values","map","el","trim","filter","Boolean","push","searchResult","status","input","output","parseDN","childOf","equals","SyntaxError","isDn","DN","isDN","fromString","test"],"sources":["../../../../src/adapters/shared/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Change, Client, SearchOptions } from 'ldapjs';\nimport ldap from 'ldapjs';\nimport type { ILdapClient } from '../../../core/index.ts';\nimport type { LdapClientOptions } from './types.ts';\n\nexport class LdapClient implements ILdapClient {\n    protected options : LdapClientOptions;\n\n    protected driver : Client;\n\n    constructor(options: LdapClientOptions) {\n        this.options = options;\n        this.driver = ldap.createClient({\n            url: options.url,\n            tlsOptions: options.tls,\n            connectTimeout: 3000,\n        });\n    }\n\n    async connect() : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            const listener = () => {\n                if (this.options.startTLS) {\n                    this.driver.starttls(\n                        this.options.tls || {},\n                        null,\n                        (err) => {\n                            if (err) {\n                                reject(err);\n                                return;\n                            }\n\n                            resolve();\n                        },\n                    );\n                } else {\n                    resolve();\n                }\n            };\n\n            if (this.driver.connected) {\n                listener();\n                return;\n            }\n\n            const errorListener = (error?: Error | null) => {\n                if (error) {\n                    reject(error);\n                    return;\n                }\n\n                resolve();\n            };\n\n            this.driver.connect();\n            this.driver.once('connect', listener);\n            this.driver.once('timeout', errorListener);\n            this.driver.once('connectTimeout', errorListener);\n            this.driver.once('error', errorListener);\n            this.driver.once('connectError', errorListener);\n        });\n    }\n\n    get connected() : boolean {\n        return this.driver.connected;\n    }\n\n    public async bind(user?: string, password?: string) : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.connect()\n                .then(() => {\n                    if (!user) {\n                        user = this.options.user;\n                        password = this.options.password;\n                    }\n\n                    if (!user) {\n                        reject(new Error('User name not defined.'));\n                        return;\n                    }\n\n                    if (!password) {\n                        reject(new Error('User password not defined.'));\n                        return;\n                    }\n\n                    this.driver.bind(user, password, (err) => {\n                        if (err) {\n                            reject(err);\n                            return;\n                        }\n\n                        resolve();\n                    });\n                })\n                .catch((e) => reject(e));\n        });\n    }\n\n    async unbind() : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.unbind((err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async add(name: string, data: Record<string, any>) {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.add(name, data, (err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async del(name: string) : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.del(name, (err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async modify(name: string, change: Change | Change[]) : Promise<void> {\n        return new Promise<void>((resolve, reject) => {\n            this.driver.modify(name, change, (err) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n\n                resolve();\n            });\n        });\n    }\n\n    async search(options: SearchOptions, dn?: string) : Promise<Record<string, any>[]> {\n        return new Promise((resolve, reject) => {\n            this.driver.search(\n                this.resolveDn(dn, this.options.baseDn),\n                {\n                    scope: 'sub',\n                    ...options,\n                },\n                (err, res) => {\n                    if (err) {\n                        reject(err);\n                        return;\n                    }\n\n                    const entries : Record<string, any>[] = [];\n\n                    res.on('searchEntry', (searchEntry) => {\n                        const entry : Record<string, any> = { dn: searchEntry.pojo.objectName };\n\n                        for (let i = 0; i < searchEntry.attributes.length; i++) {\n                            const attribute = searchEntry.attributes[i];\n\n                            entry[attribute.type] = Array.isArray(attribute.values) ?\n                                attribute.values.map((el: string) => el.trim()).filter(Boolean) :\n                                attribute.values;\n                        }\n\n                        entries.push(entry);\n                    });\n\n                    res.on('error', (err) => {\n                        reject(err);\n                    });\n\n                    res.on('end', (searchResult) => {\n                        if (!searchResult || searchResult.status !== 0) {\n                            reject(new Error('The ldap search was not successfully'));\n                        } else {\n                            resolve(entries);\n                        }\n                    });\n                },\n            );\n        });\n    }\n\n    resolveDn(...input: unknown[]) : string {\n        let output : string | undefined;\n\n        for (let i = 0; i <= input.length; i++) {\n            const el = input[i];\n            if (typeof el !== 'string') {\n                continue;\n            }\n\n            if (!output) {\n                output = el;\n                continue;\n            }\n\n            const dn = ldap.parseDN(output);\n            if (dn.childOf(el) || dn.equals(el)) {\n                continue;\n            }\n\n            output += `,${input[i]}`;\n        }\n\n        if (!output) {\n            throw new SyntaxError('Dn could not be resolved.');\n        }\n\n        return output;\n    }\n\n    isDn(input: string | ldap.DN) : boolean {\n        try {\n            if (typeof input !== 'string') {\n                return ldap.DN.isDN(input);\n            }\n\n            if (typeof (ldap.DN as Record<string, any>).fromString === 'function') {\n                const dn = (ldap.DN as Record<string, any>).fromString(input);\n                return typeof dn !== 'undefined';\n            }\n\n            return /^(?:(?:(?:[a-zA-Z0-9]+(?:[-._][a-zA-Z0-9]+)*)=(?:[\\s]*[^,+\\n=]+[\\s]*)*)(?:[,][\\s]*)?)+$/.test(input);\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,aAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA4B;EACpC,KAAKA,UAAUA;EACf,KAAKC,SAASH,KAAKI,aAAa;GAC5BC,KAAKH,QAAQG;GACbC,YAAYJ,QAAQK;GACpBC,gBAAgB;EACpB,CAAA;CACJ;CAEA,MAAMC,UAA0B;EAC5B,OAAO,IAAIC,SAAeC,SAASC,WAAAA;GAC/B,MAAMC,iBAAW;IACb,IAAI,KAAKX,QAAQY,UACb,KAAKX,OAAOY,SACR,KAAKb,QAAQK,OAAO,CAAC,GACrB,OACCS,QAAAA;KACG,IAAIA,KAAK;MACLJ,OAAOI,GAAAA;MACP;KACJ;KAEAL,QAAAA;IACJ,CAAA;SAGJA,QAAAA;GAER;GAEA,IAAI,KAAKR,OAAOc,WAAW;IACvBJ,SAAAA;IACA;GACJ;GAEA,MAAMK,iBAAiBC,UAAAA;IACnB,IAAIA,OAAO;KACPP,OAAOO,KAAAA;KACP;IACJ;IAEAR,QAAAA;GACJ;GAEA,KAAKR,OAAOM,QAAO;GACnB,KAAKN,OAAOiB,KAAK,WAAWP,QAAAA;GAC5B,KAAKV,OAAOiB,KAAK,WAAWF,aAAAA;GAC5B,KAAKf,OAAOiB,KAAK,kBAAkBF,aAAAA;GACnC,KAAKf,OAAOiB,KAAK,SAASF,aAAAA;GAC1B,KAAKf,OAAOiB,KAAK,gBAAgBF,aAAAA;EACrC,CAAA;CACJ;CAEA,IAAID,YAAsB;EACtB,OAAO,KAAKd,OAAOc;CACvB;CAEA,MAAaI,KAAKC,MAAeC,UAAmC;EAChE,OAAO,IAAIb,SAAeC,SAASC,WAAAA;GAC/B,KAAKH,QAAO,CAAA,CACPe,WAAK;IACF,IAAI,CAACF,MAAM;KACPA,OAAO,KAAKpB,QAAQoB;KACpBC,WAAW,KAAKrB,QAAQqB;IAC5B;IAEA,IAAI,CAACD,MAAM;KACPV,uBAAO,IAAIa,MAAM,wBAAA,CAAA;KACjB;IACJ;IAEA,IAAI,CAACF,UAAU;KACXX,uBAAO,IAAIa,MAAM,4BAAA,CAAA;KACjB;IACJ;IAEA,KAAKtB,OAAOkB,KAAKC,MAAMC,WAAWP,QAAAA;KAC9B,IAAIA,KAAK;MACLJ,OAAOI,GAAAA;MACP;KACJ;KAEAL,QAAAA;IACJ,CAAA;GACJ,CAAA,CAAA,CACCe,OAAOC,MAAMf,OAAOe,CAAAA,CAAAA;EAC7B,CAAA;CACJ;CAEA,MAAMC,SAAyB;EAC3B,OAAO,IAAIlB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAOyB,QAAQZ,QAAAA;IAChB,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMkB,IAAIC,MAAcC,MAA2B;EAC/C,OAAO,IAAIrB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAO0B,IAAIC,MAAMC,OAAOf,QAAAA;IACzB,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMqB,IAAIF,MAA8B;EACpC,OAAO,IAAIpB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAO6B,IAAIF,OAAOd,QAAAA;IACnB,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMsB,OAAOH,MAAcI,QAA2C;EAClE,OAAO,IAAIxB,SAAeC,SAASC,WAAAA;GAC/B,KAAKT,OAAO8B,OAAOH,MAAMI,SAASlB,QAAAA;IAC9B,IAAIA,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEAL,QAAAA;GACJ,CAAA;EACJ,CAAA;CACJ;CAEA,MAAMwB,OAAOjC,SAAwBkC,IAA8C;EAC/E,OAAO,IAAI1B,SAASC,SAASC,WAAAA;GACzB,KAAKT,OAAOgC,OACR,KAAKE,UAAUD,IAAI,KAAKlC,QAAQoC,MAAM,GACtC;IACIC,OAAO;IACP,GAAGrC;GACP,IACCc,KAAKwB,QAAAA;IACF,IAAIxB,KAAK;KACLJ,OAAOI,GAAAA;KACP;IACJ;IAEA,MAAMyB,UAAkC,CAAA;IAExCD,IAAIE,GAAG,gBAAgBC,gBAAAA;KACnB,MAAMC,QAA8B,EAAER,IAAIO,YAAYE,KAAKC,WAAW;KAEtE,KAAK,IAAIC,IAAI,GAAGA,IAAIJ,YAAYK,WAAWC,QAAQF,KAAK;MACpD,MAAMG,YAAYP,YAAYK,WAAWD;MAEzCH,MAAMM,UAAUC,QAAQC,MAAMC,QAAQH,UAAUI,MAAM,IAClDJ,UAAUI,OAAOC,KAAKC,OAAeA,GAAGC,KAAI,CAAA,CAAA,CAAIC,OAAOC,OAAAA,IACvDT,UAAUI;KAClB;KAEAb,QAAQmB,KAAKhB,KAAAA;IACjB,CAAA;IAEAJ,IAAIE,GAAG,UAAU1B,QAAAA;KACbJ,OAAOI,GAAAA;IACX,CAAA;IAEAwB,IAAIE,GAAG,QAAQmB,iBAAAA;KACX,IAAI,CAACA,gBAAgBA,aAAaC,WAAW,GACzClD,uBAAO,IAAIa,MAAM,sCAAA,CAAA;UAEjBd,QAAQ8B,OAAAA;IAEhB,CAAA;GACJ,CAAA;EAER,CAAA;CACJ;CAEAJ,UAAU,GAAG0B,OAA2B;EACpC,IAAIC;EAEJ,KAAK,IAAIjB,IAAI,GAAGA,KAAKgB,MAAMd,QAAQF,KAAK;GACpC,MAAMS,KAAKO,MAAMhB;GACjB,IAAI,OAAOS,OAAO,UACd;GAGJ,IAAI,CAACQ,QAAQ;IACTA,SAASR;IACT;GACJ;GAEA,MAAMpB,KAAKpC,KAAKiE,QAAQD,MAAAA;GACxB,IAAI5B,GAAG8B,QAAQV,EAAAA,KAAOpB,GAAG+B,OAAOX,EAAAA,GAC5B;GAGJQ,UAAU,IAAID,MAAMhB;EACxB;EAEA,IAAI,CAACiB,QACD,MAAM,IAAII,YAAY,2BAAA;EAG1B,OAAOJ;CACX;CAEAK,KAAKN,OAAmC;EACpC,IAAI;GACA,IAAI,OAAOA,UAAU,UACjB,OAAO/D,KAAKsE,GAAGC,KAAKR,KAAAA;GAGxB,IAAI,OAAO,KAAMO,GAA2BE,eAAe,YAEvD,OAAO,OADI,KAAMF,GAA2BE,WAAWT,KACzC3B,MAAO;GAGzB,OAAO,0FAA0FqC,KAAKV,KAAAA;EAC1G,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/app/builder.d.ts

@@ -1,5 +1,5 @@
-import { type IApplication, type IModule } from 'orkos';
-import { AuthenticationModule, CacheModule, ComponentsModule, ConfigModule, DatabaseModule, HTTPModule, IdentityModule, LdapModule, LoggerModule, MailModule, OAuth2Module, ProvisionerModule, RuntimeModule } from './modules/index.ts';
+import type { ApplicationContext, IApplication, IModule } from 'orkos';
+import { AuthenticationModule, CacheModule, ComponentsModule, ConfigModule, DatabaseModule, IdentityModule, LdapModule, LoggerModule, MailModule, OAuth2Module, ProvisionerModule, RuntimeModule } from './modules/index.ts';
 type ModuleSlot = IModule | false | undefined;
 export declare class ApplicationBuilder {
     protected slots: Map<string, ModuleSlot>;
@@ -16,9 +16,9 @@ export declare class ApplicationBuilder {
     withIdentity(instance?: IdentityModule | false): this;
     withOAuth2(instance?: OAuth2Module | false): this;
     withComponents(instance?: ComponentsModule | false): this;
-    withHTTP(instance?: HTTPModule | false): this;
+    withHTTP(instance?: IModule | false): this;
     buildModules(): IModule[];
-    build(): IApplication;
+    build(ctx?: ApplicationContext): IApplication;
     protected set(name: string, instance?: IModule | false): this;
 }
 export {};

package/dist/app/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/app/builder.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,KAAK,YAAY,EACjB,KAAK,OAAO,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EACH,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,UAAU,EACV,cAAc,EACd,UAAU,EACV,YAAY,EACZ,UAAU,EAEV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EAChB,MAAM,oBAAoB,CAAC;AAE5B,KAAK,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;AAoB9C,qBAAa,kBAAkB;IAC3B,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;;IAQzC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI;IAIjD,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI;IAIjD,SAAS,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,GAAG,IAAI;IAI/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,IAAI;IAI7C,WAAW,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,KAAK,GAAG,IAAI;IAInD,YAAY,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,KAAK,GAAG,IAAI;IAIrD,gBAAgB,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,KAAK,GAAG,IAAI;IAI5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,IAAI;IAI7C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,GAAG,IAAI;IAIjE,YAAY,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,KAAK,GAAG,IAAI;IAIrD,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI;IAIjD,cAAc,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,KAAK,GAAG,IAAI;IAIzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,IAAI;IAM7C,YAAY,IAAI,OAAO,EAAE;IAsBzB,KAAK,IAAI,YAAY;IAMrB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI;CAWhE"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/app/builder.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEvE,OAAO,EACH,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,cAAc,EAEd,cAAc,EACd,UAAU,EACV,YAAY,EACZ,UAAU,EAEV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EAChB,MAAM,oBAAoB,CAAC;AAE5B,KAAK,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;AAoB9C,qBAAa,kBAAkB;IAC3B,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;;IAQzC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI;IAIjD,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI;IAIjD,SAAS,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,GAAG,IAAI;IAI/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,IAAI;IAI7C,WAAW,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,KAAK,GAAG,IAAI;IAInD,YAAY,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,KAAK,GAAG,IAAI;IAIrD,gBAAgB,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,KAAK,GAAG,IAAI;IAI5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,IAAI;IAI7C,kBAAkB,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,GAAG,IAAI;IAIjE,YAAY,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,KAAK,GAAG,IAAI;IAIrD,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,IAAI;IAIjD,cAAc,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,KAAK,GAAG,IAAI;IAIzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI;IAM1C,YAAY,IAAI,OAAO,EAAE;IAsBzB,KAAK,CAAC,GAAG,GAAE,kBAAuB,GAAG,YAAY;IAMjD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI;CAWhE"}

package/dist/app/builder.mjs

@@ -4,13 +4,13 @@ import.meta.url;
 import { ModuleName } from "./modules/constants.mjs";
 import { ConfigModule } from "./modules/config/module.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
-import { AuthenticationModule } from "./modules/authentication/module.mjs";
 import { LoggerModule } from "./modules/logger/module.mjs";
 import { DatabaseModule } from "./modules/database/module.mjs";
-import { ComponentsModule } from "./modules/components/module.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
 import { IdentityModule } from "./modules/identity/module.mjs";
 import { OAuth2Module } from "./modules/oauth2/module.mjs";
+import { AuthenticationModule } from "./modules/authentication/module.mjs";
+import { ComponentsModule } from "./modules/components/module.mjs";
 import { MailModule } from "./modules/mail/module.mjs";
 import { HTTPModule } from "./modules/http/module.mjs";
 import { ProvisionerModule } from "./modules/provisioning/module.mjs";
@@ -90,8 +90,11 @@ var ApplicationBuilder = class {
 		});
 		return modules;
 	}
-	build() {
-		return new Application({ modules: this.buildModules() });
+	build(ctx = {}) {
+		return new Application({
+			modules: this.buildModules(),
+			...ctx
+		});
 	}
 	set(name, instance) {
 		if (instance === false) this.slots.set(name, false);