@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/app/builder.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"builder.mjs","names":["Application","AuthenticationModule","CacheModule","ComponentsModule","ConfigModule","DatabaseModule","HTTPModule","IdentityModule","LdapModule","LoggerModule","MailModule","ModuleName","OAuth2Module","ProvisionerModule","RuntimeModule","defaultFactories","CONFIG","LOGGER","CACHE","MAIL","RUNTIME","DATABASE","PROVISIONING","LDAP","AUTHENTICATION","IDENTITY","OAUTH2","COMPONENTS","HTTP","ApplicationBuilder","slots","Map","withConfig","instance","set","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","buildModules","modules","forEach","slot","name","push","factory","build","undefined"],"sources":["../../src/app/builder.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    Application,\n    type IApplication,\n    type IModule,\n} from 'orkos';\nimport {\n    AuthenticationModule,\n    CacheModule,\n    ComponentsModule,\n    ConfigModule,\n    DatabaseModule,\n    HTTPModule,\n    IdentityModule,\n    LdapModule,\n    LoggerModule,\n    MailModule,\n    ModuleName,\n    OAuth2Module,\n    ProvisionerModule,\n    RuntimeModule,\n} from './modules/index.ts';\n\ntype ModuleSlot = IModule | false | undefined;\n\ntype ModuleFactory = () => IModule;\n\nconst defaultFactories: Record<string, ModuleFactory> = {\n    [ModuleName.CONFIG]: () => new ConfigModule(),\n    [ModuleName.LOGGER]: () => new LoggerModule(),\n    [ModuleName.CACHE]: () => new CacheModule(),\n    [ModuleName.MAIL]: () => new MailModule(),\n    [ModuleName.RUNTIME]: () => new RuntimeModule(),\n    [ModuleName.DATABASE]: () => new DatabaseModule(),\n    [ModuleName.PROVISIONING]: () => new ProvisionerModule(),\n    [ModuleName.LDAP]: () => new LdapModule(),\n    [ModuleName.AUTHENTICATION]: () => new AuthenticationModule(),\n    [ModuleName.IDENTITY]: () => new IdentityModule(),\n    [ModuleName.OAUTH2]: () => new OAuth2Module(),\n    [ModuleName.COMPONENTS]: () => new ComponentsModule(),\n    [ModuleName.HTTP]: () => new HTTPModule(),\n};\n\nexport class ApplicationBuilder {\n    protected slots: Map<string, ModuleSlot>;\n\n    constructor() {\n        this.slots = new Map();\n    }\n\n    // ----------------------------------------------------\n\n    withConfig(instance?: ConfigModule | false): this {\n        return this.set(ModuleName.CONFIG, instance);\n    }\n\n    withLogger(instance?: LoggerModule | false): this {\n        return this.set(ModuleName.LOGGER, instance);\n    }\n\n    withCache(instance?: CacheModule | false): this {\n        return this.set(ModuleName.CACHE, instance);\n    }\n\n    withMail(instance?: MailModule | false): this {\n        return this.set(ModuleName.MAIL, instance);\n    }\n\n    withRuntime(instance?: RuntimeModule | false): this {\n        return this.set(ModuleName.RUNTIME, instance);\n    }\n\n    withDatabase(instance?: DatabaseModule | false): this {\n        return this.set(ModuleName.DATABASE, instance);\n    }\n\n    withProvisioning(instance?: ProvisionerModule | false): this {\n        return this.set(ModuleName.PROVISIONING, instance);\n    }\n\n    withLdap(instance?: LdapModule | false): this {\n        return this.set(ModuleName.LDAP, instance);\n    }\n\n    withAuthentication(instance?: AuthenticationModule | false): this {\n        return this.set(ModuleName.AUTHENTICATION, instance);\n    }\n\n    withIdentity(instance?: IdentityModule | false): this {\n        return this.set(ModuleName.IDENTITY, instance);\n    }\n\n    withOAuth2(instance?: OAuth2Module | false): this {\n        return this.set(ModuleName.OAUTH2, instance);\n    }\n\n    withComponents(instance?: ComponentsModule | false): this {\n        return this.set(ModuleName.COMPONENTS, instance);\n    }\n\n    withHTTP(instance?: HTTPModule | false): this {\n        return this.set(ModuleName.HTTP, instance);\n    }\n\n    // ----------------------------------------------------\n\n    buildModules(): IModule[] {\n        const modules: IModule[] = [];\n\n        this.slots.forEach((slot, name) => {\n            if (slot === false) {\n                return;\n            }\n\n            if (slot) {\n                modules.push(slot);\n                return;\n            }\n\n            const factory = defaultFactories[name];\n            if (factory) {\n                modules.push(factory());\n            }\n        });\n\n        return modules;\n    }\n\n    build(): IApplication {\n        return new Application({ modules: this.buildModules() });\n    }\n\n    // ----------------------------------------------------\n\n    protected set(name: string, instance?: IModule | false): this {\n        if (instance === false) {\n            this.slots.set(name, false);\n        } else if (instance) {\n            this.slots.set(name, instance);\n        } else {\n            this.slots.set(name, undefined);\n        }\n\n        return this;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAiCA,MAAMe,mBAAkD;EACnDJ,WAAWK,eAAe,IAAIZ,aAAAA;EAC9BO,WAAWM,eAAe,IAAIR,aAAAA;EAC9BE,WAAWO,cAAc,IAAIhB,YAAAA;EAC7BS,WAAWQ,aAAa,IAAIT,WAAAA;EAC5BC,WAAWS,gBAAgB,IAAIN,cAAAA;EAC/BH,WAAWU,iBAAiB,IAAIhB,eAAAA;EAChCM,WAAWW,qBAAqB,IAAIT,kBAAAA;EACpCF,WAAWY,aAAa,IAAIf,WAAAA;EAC5BG,WAAWa,uBAAuB,IAAIvB,qBAAAA;EACtCU,WAAWc,iBAAiB,IAAIlB,eAAAA;EAChCI,WAAWe,eAAe,IAAId,aAAAA;EAC9BD,WAAWgB,mBAAmB,IAAIxB,iBAAAA;EAClCQ,WAAWiB,aAAa,IAAItB,WAAAA;AACjC;AAEA,IAAauB,qBAAb,MAAaA;CACCC;CAEV,cAAc;EACV,KAAKA,wBAAQ,IAAIC,IAAAA;CACrB;CAIAC,WAAWC,UAAuC;EAC9C,OAAO,KAAKC,IAAIvB,WAAWK,QAAQiB,QAAAA;CACvC;CAEAE,WAAWF,UAAuC;EAC9C,OAAO,KAAKC,IAAIvB,WAAWM,QAAQgB,QAAAA;CACvC;CAEAG,UAAUH,UAAsC;EAC5C,OAAO,KAAKC,IAAIvB,WAAWO,OAAOe,QAAAA;CACtC;CAEAI,SAASJ,UAAqC;EAC1C,OAAO,KAAKC,IAAIvB,WAAWQ,MAAMc,QAAAA;CACrC;CAEAK,YAAYL,UAAwC;EAChD,OAAO,KAAKC,IAAIvB,WAAWS,SAASa,QAAAA;CACxC;CAEAM,aAAaN,UAAyC;EAClD,OAAO,KAAKC,IAAIvB,WAAWU,UAAUY,QAAAA;CACzC;CAEAO,iBAAiBP,UAA4C;EACzD,OAAO,KAAKC,IAAIvB,WAAWW,cAAcW,QAAAA;CAC7C;CAEAQ,SAASR,UAAqC;EAC1C,OAAO,KAAKC,IAAIvB,WAAWY,MAAMU,QAAAA;CACrC;CAEAS,mBAAmBT,UAA+C;EAC9D,OAAO,KAAKC,IAAIvB,WAAWa,gBAAgBS,QAAAA;CAC/C;CAEAU,aAAaV,UAAyC;EAClD,OAAO,KAAKC,IAAIvB,WAAWc,UAAUQ,QAAAA;CACzC;CAEAW,WAAWX,UAAuC;EAC9C,OAAO,KAAKC,IAAIvB,WAAWe,QAAQO,QAAAA;CACvC;CAEAY,eAAeZ,UAA2C;EACtD,OAAO,KAAKC,IAAIvB,WAAWgB,YAAYM,QAAAA;CAC3C;CAEAa,SAASb,UAAqC;EAC1C,OAAO,KAAKC,IAAIvB,WAAWiB,MAAMK,QAAAA;CACrC;CAIAc,eAA0B;EACtB,MAAMC,UAAqB,CAAA;EAE3B,KAAKlB,MAAMmB,SAASC,MAAMC,SAAAA;GACtB,IAAID,SAAS,OACT;GAGJ,IAAIA,MAAM;IACNF,QAAQI,KAAKF,IAAAA;IACb;GACJ;GAEA,MAAMG,UAAUtC,iBAAiBoC;GACjC,IAAIE,SACAL,QAAQI,KAAKC,QAAAA,CAAAA;EAErB,CAAA;EAEA,OAAOL;CACX;CAEAM,QAAsB;EAClB,OAAO,IAAItD,YAAY,EAAEgD,SAAS,KAAKD,aAAY,EAAG,CAAA;CAC1D;CAIUb,IAAIiB,MAAclB,UAAkC;EAC1D,IAAIA,aAAa,OACb,KAAKH,MAAMI,IAAIiB,MAAM,KAAA;OAClB,IAAIlB,UACP,KAAKH,MAAMI,IAAIiB,MAAMlB,QAAAA;OAErB,KAAKH,MAAMI,IAAIiB,MAAMI,KAAAA,CAAAA;EAGzB,OAAO;CACX;AACJ"}
+{"version":3,"file":"builder.mjs","names":["Application","AuthenticationModule","CacheModule","ComponentsModule","ConfigModule","DatabaseModule","HTTPModule","IdentityModule","LdapModule","LoggerModule","MailModule","ModuleName","OAuth2Module","ProvisionerModule","RuntimeModule","defaultFactories","CONFIG","LOGGER","CACHE","MAIL","RUNTIME","DATABASE","PROVISIONING","LDAP","AUTHENTICATION","IDENTITY","OAUTH2","COMPONENTS","HTTP","ApplicationBuilder","slots","Map","withConfig","instance","set","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","buildModules","modules","forEach","slot","name","push","factory","build","ctx","undefined"],"sources":["../../src/app/builder.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ApplicationContext, IApplication, IModule } from 'orkos';\nimport { Application } from 'orkos';\nimport {\n    AuthenticationModule,\n    CacheModule,\n    ComponentsModule,\n    ConfigModule,\n    DatabaseModule,\n    HTTPModule,\n    IdentityModule,\n    LdapModule,\n    LoggerModule,\n    MailModule,\n    ModuleName,\n    OAuth2Module,\n    ProvisionerModule,\n    RuntimeModule,\n} from './modules/index.ts';\n\ntype ModuleSlot = IModule | false | undefined;\n\ntype ModuleFactory = () => IModule;\n\nconst defaultFactories: Record<string, ModuleFactory> = {\n    [ModuleName.CONFIG]: () => new ConfigModule(),\n    [ModuleName.LOGGER]: () => new LoggerModule(),\n    [ModuleName.CACHE]: () => new CacheModule(),\n    [ModuleName.MAIL]: () => new MailModule(),\n    [ModuleName.RUNTIME]: () => new RuntimeModule(),\n    [ModuleName.DATABASE]: () => new DatabaseModule(),\n    [ModuleName.PROVISIONING]: () => new ProvisionerModule(),\n    [ModuleName.LDAP]: () => new LdapModule(),\n    [ModuleName.AUTHENTICATION]: () => new AuthenticationModule(),\n    [ModuleName.IDENTITY]: () => new IdentityModule(),\n    [ModuleName.OAUTH2]: () => new OAuth2Module(),\n    [ModuleName.COMPONENTS]: () => new ComponentsModule(),\n    [ModuleName.HTTP]: () => new HTTPModule(),\n};\n\nexport class ApplicationBuilder {\n    protected slots: Map<string, ModuleSlot>;\n\n    constructor() {\n        this.slots = new Map();\n    }\n\n    // ----------------------------------------------------\n\n    withConfig(instance?: ConfigModule | false): this {\n        return this.set(ModuleName.CONFIG, instance);\n    }\n\n    withLogger(instance?: LoggerModule | false): this {\n        return this.set(ModuleName.LOGGER, instance);\n    }\n\n    withCache(instance?: CacheModule | false): this {\n        return this.set(ModuleName.CACHE, instance);\n    }\n\n    withMail(instance?: MailModule | false): this {\n        return this.set(ModuleName.MAIL, instance);\n    }\n\n    withRuntime(instance?: RuntimeModule | false): this {\n        return this.set(ModuleName.RUNTIME, instance);\n    }\n\n    withDatabase(instance?: DatabaseModule | false): this {\n        return this.set(ModuleName.DATABASE, instance);\n    }\n\n    withProvisioning(instance?: ProvisionerModule | false): this {\n        return this.set(ModuleName.PROVISIONING, instance);\n    }\n\n    withLdap(instance?: LdapModule | false): this {\n        return this.set(ModuleName.LDAP, instance);\n    }\n\n    withAuthentication(instance?: AuthenticationModule | false): this {\n        return this.set(ModuleName.AUTHENTICATION, instance);\n    }\n\n    withIdentity(instance?: IdentityModule | false): this {\n        return this.set(ModuleName.IDENTITY, instance);\n    }\n\n    withOAuth2(instance?: OAuth2Module | false): this {\n        return this.set(ModuleName.OAUTH2, instance);\n    }\n\n    withComponents(instance?: ComponentsModule | false): this {\n        return this.set(ModuleName.COMPONENTS, instance);\n    }\n\n    withHTTP(instance?: IModule | false): this {\n        return this.set(ModuleName.HTTP, instance);\n    }\n\n    // ----------------------------------------------------\n\n    buildModules(): IModule[] {\n        const modules: IModule[] = [];\n\n        this.slots.forEach((slot, name) => {\n            if (slot === false) {\n                return;\n            }\n\n            if (slot) {\n                modules.push(slot);\n                return;\n            }\n\n            const factory = defaultFactories[name];\n            if (factory) {\n                modules.push(factory());\n            }\n        });\n\n        return modules;\n    }\n\n    build(ctx: ApplicationContext = {}): IApplication {\n        return new Application({ modules: this.buildModules(), ...ctx });\n    }\n\n    // ----------------------------------------------------\n\n    protected set(name: string, instance?: IModule | false): this {\n        if (instance === false) {\n            this.slots.set(name, false);\n        } else if (instance) {\n            this.slots.set(name, instance);\n        } else {\n            this.slots.set(name, undefined);\n        }\n\n        return this;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA8BA,MAAMe,mBAAkD;EACnDJ,WAAWK,eAAe,IAAIZ,aAAAA;EAC9BO,WAAWM,eAAe,IAAIR,aAAAA;EAC9BE,WAAWO,cAAc,IAAIhB,YAAAA;EAC7BS,WAAWQ,aAAa,IAAIT,WAAAA;EAC5BC,WAAWS,gBAAgB,IAAIN,cAAAA;EAC/BH,WAAWU,iBAAiB,IAAIhB,eAAAA;EAChCM,WAAWW,qBAAqB,IAAIT,kBAAAA;EACpCF,WAAWY,aAAa,IAAIf,WAAAA;EAC5BG,WAAWa,uBAAuB,IAAIvB,qBAAAA;EACtCU,WAAWc,iBAAiB,IAAIlB,eAAAA;EAChCI,WAAWe,eAAe,IAAId,aAAAA;EAC9BD,WAAWgB,mBAAmB,IAAIxB,iBAAAA;EAClCQ,WAAWiB,aAAa,IAAItB,WAAAA;AACjC;AAEA,IAAauB,qBAAb,MAAaA;CACCC;CAEV,cAAc;EACV,KAAKA,wBAAQ,IAAIC,IAAAA;CACrB;CAIAC,WAAWC,UAAuC;EAC9C,OAAO,KAAKC,IAAIvB,WAAWK,QAAQiB,QAAAA;CACvC;CAEAE,WAAWF,UAAuC;EAC9C,OAAO,KAAKC,IAAIvB,WAAWM,QAAQgB,QAAAA;CACvC;CAEAG,UAAUH,UAAsC;EAC5C,OAAO,KAAKC,IAAIvB,WAAWO,OAAOe,QAAAA;CACtC;CAEAI,SAASJ,UAAqC;EAC1C,OAAO,KAAKC,IAAIvB,WAAWQ,MAAMc,QAAAA;CACrC;CAEAK,YAAYL,UAAwC;EAChD,OAAO,KAAKC,IAAIvB,WAAWS,SAASa,QAAAA;CACxC;CAEAM,aAAaN,UAAyC;EAClD,OAAO,KAAKC,IAAIvB,WAAWU,UAAUY,QAAAA;CACzC;CAEAO,iBAAiBP,UAA4C;EACzD,OAAO,KAAKC,IAAIvB,WAAWW,cAAcW,QAAAA;CAC7C;CAEAQ,SAASR,UAAqC;EAC1C,OAAO,KAAKC,IAAIvB,WAAWY,MAAMU,QAAAA;CACrC;CAEAS,mBAAmBT,UAA+C;EAC9D,OAAO,KAAKC,IAAIvB,WAAWa,gBAAgBS,QAAAA;CAC/C;CAEAU,aAAaV,UAAyC;EAClD,OAAO,KAAKC,IAAIvB,WAAWc,UAAUQ,QAAAA;CACzC;CAEAW,WAAWX,UAAuC;EAC9C,OAAO,KAAKC,IAAIvB,WAAWe,QAAQO,QAAAA;CACvC;CAEAY,eAAeZ,UAA2C;EACtD,OAAO,KAAKC,IAAIvB,WAAWgB,YAAYM,QAAAA;CAC3C;CAEAa,SAASb,UAAkC;EACvC,OAAO,KAAKC,IAAIvB,WAAWiB,MAAMK,QAAAA;CACrC;CAIAc,eAA0B;EACtB,MAAMC,UAAqB,CAAA;EAE3B,KAAKlB,MAAMmB,SAASC,MAAMC,SAAAA;GACtB,IAAID,SAAS,OACT;GAGJ,IAAIA,MAAM;IACNF,QAAQI,KAAKF,IAAAA;IACb;GACJ;GAEA,MAAMG,UAAUtC,iBAAiBoC;GACjC,IAAIE,SACAL,QAAQI,KAAKC,QAAAA,CAAAA;EAErB,CAAA;EAEA,OAAOL;CACX;CAEAM,MAAMC,MAA0B,CAAC,GAAiB;EAC9C,OAAO,IAAIvD,YAAY;GAAEgD,SAAS,KAAKD,aAAY;GAAI,GAAGQ;EAAI,CAAA;CAClE;CAIUrB,IAAIiB,MAAclB,UAAkC;EAC1D,IAAIA,aAAa,OACb,KAAKH,MAAMI,IAAIiB,MAAM,KAAA;OAClB,IAAIlB,UACP,KAAKH,MAAMI,IAAIiB,MAAMlB,QAAAA;OAErB,KAAKH,MAAMI,IAAIiB,MAAMK,KAAAA,CAAAA;EAGzB,OAAO;CACX;AACJ"}

package/dist/app/factory.d.ts

@@ -1,3 +1,13 @@
 import type { CreateApplicationContext } from './types.ts';
 export declare function createApplication(context?: CreateApplicationContext): import("orkos").IApplication;
+/**
+ * Worker mode: the background components and the modules they stand on,
+ * and nothing else. No http, oauth2, identity, authentication, ldap, mail or
+ * provisioning module, so the process serves no request and writes no
+ * provisioning graph.
+ *
+ * `core.worker.enabled` is REQUIRED here: a process started for nothing but
+ * the sweeps refuses to boot with them off, rather than coming up idle.
+ */
+export declare function createWorkerApplication(context?: CreateApplicationContext): import("orkos").IApplication;
 //# sourceMappingURL=factory.d.ts.map

package/dist/app/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/app/factory.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,gCAkBvE"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/app/factory.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,gCAkBvE;AAYD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B,gCAQ7E"}

package/dist/app/factory.mjs

@@ -1,15 +1,39 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
+import { verifySchemaOrSynchronize } from "./modules/database/migration.mjs";
+import { DatabaseModule } from "./modules/database/module.mjs";
+import { ComponentsModule } from "./modules/components/module.mjs";
+import { HTTPModule } from "./modules/http/module.mjs";
 import { DefaultProvisioningSource } from "./modules/provisioning/sources/default/module.mjs";
 import { ProvisionerModule } from "./modules/provisioning/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 //#region src/app/factory.ts
 function createApplication(context = {}) {
-	return new ApplicationBuilder().withConfig(context.config).withLogger().withCache().withMail().withRuntime().withDatabase().withProvisioning(new ProvisionerModule([new DefaultProvisioningSource()])).withLdap().withAuthentication().withIdentity().withOAuth2().withComponents().withHTTP().build();
+	return new ApplicationBuilder().withConfig(context.config).withLogger().withCache().withMail().withRuntime().withDatabase().withProvisioning(new ProvisionerModule([new DefaultProvisioningSource()])).withLdap().withAuthentication().withIdentity().withOAuth2().withComponents().withHTTP(context.http || new HTTPModule()).build({ container: context.container });
+}
+/**
+* The worker never applies migrations, whatever `migrationEnabled` says: a
+* deployment lets one process own that DDL, and it is not this one. It does
+* still create a schema nobody migrates, which is the sqlite shape the shared
+* helper falls through to.
+*/ async function migrateWorkerSchema(container, dataSource) {
+	await verifySchemaOrSynchronize(container.resolve(LoggerInjectionKey), dataSource);
+}
+/**
+* Worker mode: the background components and the modules they stand on,
+* and nothing else. No http, oauth2, identity, authentication, ldap, mail or
+* provisioning module, so the process serves no request and writes no
+* provisioning graph.
+*
+* `core.worker.enabled` is REQUIRED here: a process started for nothing but
+* the sweeps refuses to boot with them off, rather than coming up idle.
+*/ function createWorkerApplication(context = {}) {
+	return new ApplicationBuilder().withConfig(context.config).withLogger().withCache().withDatabase(new DatabaseModule({ migrate: migrateWorkerSchema })).withComponents(new ComponentsModule({ required: true })).build({ container: context.container });
 }
 //#endregion
-export { createApplication };
+export { createApplication, createWorkerApplication };
 
 //# sourceMappingURL=factory.mjs.map

package/dist/app/factory.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"factory.mjs","names":["ApplicationBuilder","DefaultProvisioningSource","ProvisionerModule","createApplication","context","withConfig","config","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","build"],"sources":["../../src/app/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ApplicationBuilder } from './builder.ts';\nimport {\n    DefaultProvisioningSource,\n    ProvisionerModule,\n} from './modules/index.ts';\nimport type { CreateApplicationContext } from './types.ts';\n\nexport function createApplication(context: CreateApplicationContext = {}) {\n    return new ApplicationBuilder()\n        .withConfig(context.config)\n        .withLogger()\n        .withCache()\n        .withMail()\n        .withRuntime()\n        .withDatabase()\n        .withProvisioning(new ProvisionerModule([\n            new DefaultProvisioningSource(),\n        ]))\n        .withLdap()\n        .withAuthentication()\n        .withIdentity()\n        .withOAuth2()\n        .withComponents()\n        .withHTTP()\n        .build();\n}\n"],"mappings":";;;;;;;;AAcA,SAAgBG,kBAAkBC,UAAoC,CAAC,GAAC;CACpE,OAAO,IAAIJ,mBAAAA,CAAAA,CACNK,WAAWD,QAAQE,MAAM,CAAA,CACzBC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTC,SAAQ,CAAA,CACRC,YAAW,CAAA,CACXC,aAAY,CAAA,CACZC,iBAAiB,IAAIV,kBAAkB,CACpC,IAAID,0BAAAA,CACP,CAAA,CAAA,CAAA,CACAY,SAAQ,CAAA,CACRC,mBAAkB,CAAA,CAClBC,aAAY,CAAA,CACZC,WAAU,CAAA,CACVC,eAAc,CAAA,CACdC,SAAQ,CAAA,CACRC,MAAK;AACd"}
+{"version":3,"file":"factory.mjs","names":["ApplicationBuilder","ComponentsModule","DatabaseModule","DefaultProvisioningSource","HTTPModule","LoggerInjectionKey","ProvisionerModule","verifySchemaOrSynchronize","createApplication","context","withConfig","config","withLogger","withCache","withMail","withRuntime","withDatabase","withProvisioning","withLdap","withAuthentication","withIdentity","withOAuth2","withComponents","withHTTP","http","build","container","migrateWorkerSchema","dataSource","resolve","createWorkerApplication","migrate","required"],"sources":["../../src/app/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IContainer } from 'eldin';\nimport type { DataSource } from 'typeorm';\nimport { ApplicationBuilder } from './builder.ts';\nimport {\n    ComponentsModule,\n    DatabaseModule,\n    DefaultProvisioningSource,\n    HTTPModule,\n    LoggerInjectionKey,\n    ProvisionerModule,\n    verifySchemaOrSynchronize,\n} from './modules/index.ts';\nimport type { CreateApplicationContext } from './types.ts';\n\nexport function createApplication(context: CreateApplicationContext = {}) {\n    return new ApplicationBuilder()\n        .withConfig(context.config)\n        .withLogger()\n        .withCache()\n        .withMail()\n        .withRuntime()\n        .withDatabase()\n        .withProvisioning(new ProvisionerModule([\n            new DefaultProvisioningSource(),\n        ]))\n        .withLdap()\n        .withAuthentication()\n        .withIdentity()\n        .withOAuth2()\n        .withComponents()\n        .withHTTP(context.http || new HTTPModule())\n        .build({ container: context.container });\n}\n\n/**\n * The worker never applies migrations, whatever `migrationEnabled` says: a\n * deployment lets one process own that DDL, and it is not this one. It does\n * still create a schema nobody migrates, which is the sqlite shape the shared\n * helper falls through to.\n */\nasync function migrateWorkerSchema(container: IContainer, dataSource: DataSource): Promise<void> {\n    await verifySchemaOrSynchronize(container.resolve(LoggerInjectionKey), dataSource);\n}\n\n/**\n * Worker mode: the background components and the modules they stand on,\n * and nothing else. No http, oauth2, identity, authentication, ldap, mail or\n * provisioning module, so the process serves no request and writes no\n * provisioning graph.\n *\n * `core.worker.enabled` is REQUIRED here: a process started for nothing but\n * the sweeps refuses to boot with them off, rather than coming up idle.\n */\nexport function createWorkerApplication(context: CreateApplicationContext = {}) {\n    return new ApplicationBuilder()\n        .withConfig(context.config)\n        .withLogger()\n        .withCache()\n        .withDatabase(new DatabaseModule({ migrate: migrateWorkerSchema }))\n        .withComponents(new ComponentsModule({ required: true }))\n        .build({ container: context.container });\n}\n"],"mappings":";;;;;;;;;;;;;AAqBA,SAAgBQ,kBAAkBC,UAAoC,CAAC,GAAC;CACpE,OAAO,IAAIT,mBAAAA,CAAAA,CACNU,WAAWD,QAAQE,MAAM,CAAA,CACzBC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTC,SAAQ,CAAA,CACRC,YAAW,CAAA,CACXC,aAAY,CAAA,CACZC,iBAAiB,IAAIX,kBAAkB,CACpC,IAAIH,0BAAAA,CACP,CAAA,CAAA,CAAA,CACAe,SAAQ,CAAA,CACRC,mBAAkB,CAAA,CAClBC,aAAY,CAAA,CACZC,WAAU,CAAA,CACVC,eAAc,CAAA,CACdC,SAASd,QAAQe,QAAQ,IAAIpB,WAAAA,CAAAA,CAAAA,CAC7BqB,MAAM,EAAEC,WAAWjB,QAAQiB,UAAU,CAAA;AAC9C;;;;;;GAQA,eAAeC,oBAAoBD,WAAuBE,YAAsB;CAC5E,MAAMrB,0BAA0BmB,UAAUG,QAAQxB,kBAAAA,GAAqBuB,UAAAA;AAC3E;;;;;;;;;GAWA,SAAgBE,wBAAwBrB,UAAoC,CAAC,GAAC;CAC1E,OAAO,IAAIT,mBAAAA,CAAAA,CACNU,WAAWD,QAAQE,MAAM,CAAA,CACzBC,WAAU,CAAA,CACVC,UAAS,CAAA,CACTG,aAAa,IAAId,eAAe,EAAE6B,SAASJ,oBAAoB,CAAA,CAAA,CAAA,CAC/DL,eAAe,IAAIrB,iBAAiB,EAAE+B,UAAU,KAAK,CAAA,CAAA,CAAA,CACrDP,MAAM,EAAEC,WAAWjB,QAAQiB,UAAU,CAAA;AAC9C"}

package/dist/app/index.mjs

@@ -4,16 +4,14 @@ import.meta.url;
 import { AuthenticationInjectionKey } from "./modules/authentication/constants.mjs";
 import { CacheInjectionKey } from "./modules/cache/constants.mjs";
 import { ModuleName } from "./modules/constants.mjs";
-import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./modules/config/constants.mjs";
-import { expandToOrigins, getAppOrigins } from "./modules/config/origins.mjs";
-import { readConfigRawFromEnv } from "./modules/config/read/env.mjs";
-import { readConfigRawFromFS } from "./modules/config/read/fs.mjs";
-import { readConfigRaw } from "./modules/config/read/module.mjs";
-import { readConfig } from "./modules/config/helpers.mjs";
+import { CONFIG_SCHEMA, ConfigInjectionKey } from "./modules/config/constants.mjs";
+import { normalizeConfig, readConfig } from "./modules/config/read.mjs";
 import { ConfigModule } from "./modules/config/module.mjs";
+import { getAppOrigins } from "./modules/config/app-origins.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
-import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
-import { AuthenticationModule } from "./modules/authentication/module.mjs";
+import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
+import { LoggerModule } from "./modules/logger/module.mjs";
+import { OAuth2InjectionToken } from "./modules/oauth2/constants.mjs";
 import { RealmRepositoryAdapter } from "./modules/database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./modules/database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "./modules/database/repositories/client-permission/repository.mjs";
@@ -38,15 +36,6 @@ import { UserAuthenticatorRepositoryAdapter } from "./modules/database/repositor
 import { UserPermissionRepositoryAdapter } from "./modules/database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "./modules/database/repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./modules/database/repositories/identity-provider-role-mapping/repository.mjs";
-import { DatabaseInjectionKey } from "./modules/database/constants.mjs";
-import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
-import { LoggerModule } from "./modules/logger/module.mjs";
-import { DatabaseModule } from "./modules/database/module.mjs";
-import { ComponentsModule } from "./modules/components/module.mjs";
-import { HTTPInjectionKey } from "./modules/http/constants.mjs";
-import { MetricsInjectionKey } from "./modules/metrics/constants.mjs";
-import { PromAuthFlowMetrics } from "./modules/metrics/prom.mjs";
-import { OAuth2InjectionToken } from "./modules/oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./modules/identity/constants.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./modules/identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./modules/identity/repositories/provider/mapper/permission.mjs";
@@ -55,10 +44,19 @@ import { CacheIdentityPrefix } from "./modules/identity/repositories/constants.m
 import { IdentityProviderAccountLinkStore } from "./modules/identity/repositories/provider/link.mjs";
 import { ClientIdentityRepository } from "./modules/identity/repositories/client.mjs";
 import { UserIdentityRepository } from "./modules/identity/repositories/user.mjs";
+import { DatabaseInjectionKey } from "./modules/database/constants.mjs";
+import { assertNoPendingMigrations, verifySchemaOrSynchronize } from "./modules/database/migration.mjs";
+import { DatabaseModule } from "./modules/database/module.mjs";
 import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
 import { IdentityModule } from "./modules/identity/module.mjs";
 import { OAuth2Module } from "./modules/oauth2/module.mjs";
+import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
+import { AuthenticationModule } from "./modules/authentication/module.mjs";
+import { ComponentsModule } from "./modules/components/module.mjs";
+import { HTTPInjectionKey } from "./modules/http/constants.mjs";
+import { MetricsInjectionKey } from "./modules/metrics/constants.mjs";
+import { PromAuthFlowMetrics } from "./modules/metrics/prom.mjs";
 import { ProvisioningInjectionKey } from "./modules/provisioning/constants.mjs";
 import { LazyWildcardRealmProvisioner } from "./modules/provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./modules/mail/constants.mjs";
@@ -71,5 +69,5 @@ import { ProvisionerModule } from "./modules/provisioning/module.mjs";
 import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
-import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheIdentityPrefix, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountLinkStore, IdentityProviderAccountRepositoryAdapter, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+import { createApplication, createWorkerApplication } from "./factory.mjs";
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CONFIG_SCHEMA, CacheIdentityPrefix, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountLinkStore, IdentityProviderAccountRepositoryAdapter, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, assertNoPendingMigrations, createApplication, createWorkerApplication, getAppOrigins, normalizeConfig, readConfig, verifySchemaOrSynchronize };

package/dist/app/modules/authentication/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/authentication/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAKrC,qBAAa,oBAAqB,YAAW,OAAO;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/authentication/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAOxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAKrC,qBAAa,oBAAqB,YAAW,OAAO;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAe1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA8BpD"}

package/dist/app/modules/authentication/module.mjs

@@ -5,12 +5,17 @@ import { AuthenticationInjectionKey } from "./constants.mjs";
 import { SessionEntity } from "../../../adapters/database/domains/session/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
 import { SessionManager } from "../../../core/authentication/session/module.mjs";
+import { OAuth2BackchannelLogoutNotifier } from "../../../core/oauth2/backchannel-logout/module.mjs";
 import "../../../core/index.mjs";
 import { CacheInjectionKey } from "../cache/constants.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import "../config/index.mjs";
 import "../cache/index.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
+import { OAuth2InjectionToken } from "../oauth2/constants.mjs";
+import "../oauth2/index.mjs";
 import { SessionRepository } from "./repositories/session.mjs";
 import "./repositories/index.mjs";
 //#region src/app/modules/authentication/module.ts
@@ -22,7 +27,8 @@ var AuthenticationModule = class {
 		this.dependencies = [
 			ModuleName.DATABASE,
 			ModuleName.CACHE,
-			ModuleName.CONFIG
+			ModuleName.CONFIG,
+			ModuleName.OAUTH2
 		];
 	}
 	async setup(container) {
@@ -39,7 +45,14 @@ var AuthenticationModule = class {
 			const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);
 			return new SessionManager({
 				repository,
-				options: { maxAge: config.tokenRefreshMaxAge + 3600 }
+				options: { maxAge: config.tokenRefreshMaxAge + 3600 },
+				revokeNotifier: new OAuth2BackchannelLogoutNotifier({
+					signer: c.resolve(OAuth2InjectionToken.TokenSigner),
+					sessionTokenRepository: c.resolve(OAuth2InjectionToken.SessionTokenRepository),
+					clientRepository: c.resolve(OAuth2InjectionToken.ClientRepository),
+					options: { issuer: config.publicUrl },
+					logger: c.resolve(LoggerInjectionKey)
+				})
 			});
 		} });
 	}

package/dist/app/modules/authentication/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["SessionEntity","SessionManager","CacheInjectionKey","ConfigInjectionKey","ModuleName","AuthenticationInjectionKey","SessionRepository","AuthenticationModule","name","dependencies","AUTHENTICATION","DATABASE","CACHE","CONFIG","setup","container","register","useFactory","c","cache","resolve","repository","config","options","maxAge","tokenRefreshMaxAge"],"sources":["../../../../src/app/modules/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport { SessionEntity } from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport { SessionManager } from '../../../core/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { AuthenticationInjectionKey } from './constants.ts';\nimport { SessionRepository } from './repositories/index.ts';\n\nexport class AuthenticationModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.AUTHENTICATION;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        container.register(AuthenticationInjectionKey.SessionRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                const repository = c.resolve<Repository<Session>>(SessionEntity);\n                return new SessionRepository({\n                    cache,\n                    repository,\n                });\n            },\n        });\n\n        container.register(AuthenticationInjectionKey.SessionManager, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n                const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);\n                return new SessionManager({\n                    repository,\n                    options: { maxAge: config.tokenRefreshMaxAge + 3_600 },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,IAAaO,uBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe;GAACL,WAAWO;GAAUP,WAAWQ;GAAOR,WAAWS;EAAO;CAClF;CAEA,MAAMC,MAAMC,WAAsC;EAC9CA,UAAUC,SAASX,2BAA2BC,mBAAmB,EAC7DW,aAAaC,MAAAA;GACT,MAAMC,QAAQD,EAAEE,QAAQlB,iBAAAA;GACxB,MAAMmB,aAAaH,EAAEE,QAA6BpB,aAAAA;GAClD,OAAO,IAAIM,kBAAkB;IACzBa;IACAE;GACJ,CAAA;EACJ,EACJ,CAAA;EAEAN,UAAUC,SAASX,2BAA2BJ,gBAAgB,EAC1DgB,aAAaC,MAAAA;GACT,MAAMI,SAASJ,EAAEE,QAAQjB,kBAAAA;GACzB,MAAMkB,aAAaH,EAAEE,QAAQf,2BAA2BC,iBAAiB;GACzE,OAAO,IAAIL,eAAe;IACtBoB;IACAE,SAAS,EAAEC,QAAQF,OAAOG,qBAAqB,KAAM;GACzD,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SessionEntity","OAuth2BackchannelLogoutNotifier","SessionManager","CacheInjectionKey","ConfigInjectionKey","LoggerInjectionKey","OAuth2InjectionToken","ModuleName","AuthenticationInjectionKey","SessionRepository","AuthenticationModule","name","dependencies","AUTHENTICATION","DATABASE","CACHE","CONFIG","OAUTH2","setup","container","register","useFactory","c","cache","resolve","repository","config","options","maxAge","tokenRefreshMaxAge","revokeNotifier","signer","TokenSigner","sessionTokenRepository","SessionTokenRepository","clientRepository","ClientRepository","issuer","publicUrl","logger"],"sources":["../../../../src/app/modules/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport { SessionEntity } from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport { OAuth2BackchannelLogoutNotifier, SessionManager } from '../../../core/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { OAuth2InjectionToken } from '../oauth2/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { AuthenticationInjectionKey } from './constants.ts';\nimport { SessionRepository } from './repositories/index.ts';\n\nexport class AuthenticationModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.AUTHENTICATION;\n        // OAUTH2 for the back-channel logout notifier the manager pushes\n        // through (signer, token inventory, client repository). No cycle:\n        // OAUTH2 stands on DATABASE, CACHE, CONFIG and IDENTITY only.\n        this.dependencies = [\n            ModuleName.DATABASE,\n            ModuleName.CACHE,\n            ModuleName.CONFIG,\n            ModuleName.OAUTH2,\n        ];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        container.register(AuthenticationInjectionKey.SessionRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                const repository = c.resolve<Repository<Session>>(SessionEntity);\n                return new SessionRepository({\n                    cache,\n                    repository,\n                });\n            },\n        });\n\n        container.register(AuthenticationInjectionKey.SessionManager, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n                const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);\n                return new SessionManager({\n                    repository,\n                    options: { maxAge: config.tokenRefreshMaxAge + 3_600 },\n                    revokeNotifier: new OAuth2BackchannelLogoutNotifier({\n                        signer: c.resolve(OAuth2InjectionToken.TokenSigner),\n                        sessionTokenRepository: c.resolve(OAuth2InjectionToken.SessionTokenRepository),\n                        clientRepository: c.resolve(OAuth2InjectionToken.ClientRepository),\n                        options: { issuer: config.publicUrl },\n                        logger: c.resolve(LoggerInjectionKey),\n                    }),\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,IAAaU,uBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EAIvB,KAAKD,eAAe;GAChBL,WAAWO;GACXP,WAAWQ;GACXR,WAAWS;GACXT,WAAWU;EACd;CACL;CAEA,MAAMC,MAAMC,WAAsC;EAC9CA,UAAUC,SAASZ,2BAA2BC,mBAAmB,EAC7DY,aAAaC,MAAAA;GACT,MAAMC,QAAQD,EAAEE,QAAQrB,iBAAAA;GACxB,MAAMsB,aAAaH,EAAEE,QAA6BxB,aAAAA;GAClD,OAAO,IAAIS,kBAAkB;IACzBc;IACAE;GACJ,CAAA;EACJ,EACJ,CAAA;EAEAN,UAAUC,SAASZ,2BAA2BN,gBAAgB,EAC1DmB,aAAaC,MAAAA;GACT,MAAMI,SAASJ,EAAEE,QAAQpB,kBAAAA;GACzB,MAAMqB,aAAaH,EAAEE,QAAQhB,2BAA2BC,iBAAiB;GACzE,OAAO,IAAIP,eAAe;IACtBuB;IACAE,SAAS,EAAEC,QAAQF,OAAOG,qBAAqB,KAAM;IACrDC,gBAAgB,IAAI7B,gCAAgC;KAChD8B,QAAQT,EAAEE,QAAQlB,qBAAqB0B,WAAW;KAClDC,wBAAwBX,EAAEE,QAAQlB,qBAAqB4B,sBAAsB;KAC7EC,kBAAkBb,EAAEE,QAAQlB,qBAAqB8B,gBAAgB;KACjET,SAAS,EAAEU,QAAQX,OAAOY,UAAU;KACpCC,QAAQjB,EAAEE,QAAQnB,kBAAAA;IACtB,CAAA;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/authentication/repositories/session.d.ts

@@ -2,7 +2,7 @@ import type { Session } from '@authup/core-kit';
 import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
 import type { Repository } from 'typeorm';
-import type { ISessionRepository, SessionFindManyOptions, SessionOwner } from '../../../../core/index.ts';
+import type { ISessionRepository, SessionDeleteExpiredOptions, SessionFindManyOptions, SessionOwner } from '../../../../core/index.ts';
 type SessionRepositoryContext = {
     repository: Repository<Session>;
     cache: ICache;
@@ -12,12 +12,15 @@ export declare class SessionRepository implements ISessionRepository {
     protected repository: Repository<Session>;
     constructor(ctx: SessionRepositoryContext);
     findOneById(id: string): Promise<Session | null>;
+    findOneBySecret(secret: string): Promise<Session | null>;
+    updateSecret(id: string, secret: string | null): Promise<void>;
     findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
     findAllByOwner(owner: SessionOwner): Promise<Session[]>;
     findAllByQuery(query: IQuery): Promise<Session[]>;
     save(input: Partial<Session>): Promise<Session>;
     remove(session: Session): Promise<void>;
     removeById(id: string): Promise<void>;
+    deleteExpired(before: string, options?: SessionDeleteExpiredOptions): Promise<number>;
 }
 export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/app/modules/authentication/repositories/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EACR,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAInC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,QAAQ,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IA0B7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgBjD,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EACR,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAQnC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAehD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAexD,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9D,QAAQ,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IA0B7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgBjD,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAevC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrC,aAAa,CACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,MAAM,CAAC;CAYrB"}

package/dist/app/modules/authentication/repositories/session.mjs

@@ -1,9 +1,13 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { SESSION_EXPIRY_SWEEP_BATCH_SIZE } from "../../../../core/authentication/session/constants.mjs";
+import { hashSessionSecret } from "../../../../core/oauth2/session-credential/module.mjs";
+import "../../../../core/index.mjs";
 import { applyQuery, redactFieldConditions } from "../../database/repositories/query.mjs";
-import { applyRealmScopeSelect } from "../../database/repositories/helpers.mjs";
+import { applyRealmScopeSelect, deleteInBatches, resolveSweepBatchSize } from "../../database/repositories/helpers.mjs";
 import { AuthenticationCachePrefix } from "./constants.mjs";
+import { LessThan } from "typeorm";
 import { buildCacheKey } from "@authup/server-kit";
 //#region src/app/modules/authentication/repositories/session.ts
 var SessionRepository = class {
@@ -21,6 +25,13 @@ var SessionRepository = class {
 		if (session) return session;
 		return this.repository.findOneBy({ id });
 	}
+	async findOneBySecret(secret) {
+		if (!secret) return null;
+		return this.repository.findOneBy({ secret: hashSessionSecret(secret) });
+	}
+	async updateSecret(id, secret) {
+		await this.repository.update({ id }, { secret: secret === null ? null : hashSessionSecret(secret) });
+	}
 	async findMany(query, options = {}) {
 		const qb = this.repository.createQueryBuilder("session");
 		const { pagination } = applyQuery(qb, query);
@@ -53,23 +64,29 @@ var SessionRepository = class {
 	async save(input) {
 		const session = this.repository.create(input);
 		await this.repository.save(session);
+		const cacheable = { ...session };
+		delete cacheable.secret;
 		await this.cache.set(buildCacheKey({
 			prefix: AuthenticationCachePrefix.SESSION,
 			key: session.id
-		}), session, { ttl: new Date(session.expiresAt).getTime() - Date.now() });
+		}), cacheable, { ttl: new Date(session.expiresAt).getTime() - Date.now() });
 		return session;
 	}
 	async remove(session) {
+		const { id } = session;
 		await this.repository.remove(session);
 		await this.cache.drop(buildCacheKey({
 			prefix: AuthenticationCachePrefix.SESSION,
-			key: session.id
+			key: id
 		}));
 	}
 	async removeById(id) {
 		const session = await this.findOneById(id);
 		if (session) await this.remove(session);
 	}
+	async deleteExpired(before, options = {}) {
+		return deleteInBatches(this.repository, { expiresAt: LessThan(before) }, resolveSweepBatchSize(options.batchSize, SESSION_EXPIRY_SWEEP_BATCH_SIZE));
+	}
 };
 //#endregion
 export { SessionRepository };

package/dist/app/modules/authentication/repositories/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","redactFieldConditions","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expiresAt","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../database/repositories/query.ts';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: IQuery,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.subKind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: `parameters: ['filters']` — a bulk revoke must reach every\n        // matching row. Applying the schema's `pagination.maxLimit` would\n        // default the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expiresAt).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;AA0BA,IAAaK,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BZ,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAerB,WAAWmB,IAAIF,KAAAA;EAEtCf,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,IAAID,QAAQI,OAERH,GAAGI,SAAS,+DAA+D;GACvEC,UAAUN,QAAQI,MAAMG;GACxBC,cAAcR,QAAQI,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMV,GAAGW,gBAAe;EAElD,OAAO;GACHC,MAAM9B,sBAAsBgB,OAAOW,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,eAAeX,OAAyC;EAC1D,OAAO,KAAKhB,WAAWc,mBAAmB,SAAA,CAAA,CACrCc,MAAM,qDAAqD;GACxDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAenB,OAAmC;EACpD,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CpB,WAAWmB,IAAIF,KAAAA;EAEff,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,OAAOA,GAAGgB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAM5B,UAAU,KAAKJ,WAAWiC,OAAOD,KAAAA;EACvC,MAAM,KAAKhC,WAAW+B,KAAK3B,OAAAA;EAE3B,MAAM,KAAKL,MAAMmC,IACbzC,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAE+B,KAAK,IAAIC,KAAKhC,QAAQiC,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG9D,OAAOnC;CACX;CAIA,MAAMoC,OAAOpC,SAAiC;EAC1C,MAAM,KAAKJ,WAAWwC,OAAOpC,OAAAA;EAC7B,MAAM,KAAKL,MAAM0C,KACbhD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAMuC,WAAWvC,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKoC,OAAOpC,OAAAA;CAE1B;AACJ"}
+{"version":3,"file":"session.mjs","names":["buildCacheKey","LessThan","applyQuery","redactFieldConditions","SESSION_EXPIRY_SWEEP_BATCH_SIZE","hashSessionSecret","applyRealmScopeSelect","deleteInBatches","resolveSweepBatchSize","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findOneBySecret","secret","updateSecret","update","findMany","query","options","qb","createQueryBuilder","pagination","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","cacheable","set","ttl","Date","expiresAt","getTime","now","remove","drop","removeById","deleteExpired","before","batchSize"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../database/repositories/query.ts';\nimport { SESSION_EXPIRY_SWEEP_BATCH_SIZE, hashSessionSecret } from '../../../../core/index.ts';\nimport type {\n    ISessionRepository,\n    SessionDeleteExpiredOptions,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport {\n    applyRealmScopeSelect,\n    deleteInBatches,\n    resolveSweepBatchSize,\n} from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    async findOneBySecret(secret: string): Promise<Session | null> {\n        if (!secret) {\n            // A blank handle must never become a query: the column is\n            // nullable, so an empty match is meaningless, and refusing it here\n            // keeps a missing cookie from reaching the database at all.\n            return null;\n        }\n\n        // Deliberately not cached: the session cache is id-keyed, and the\n        // credential is a multi-day one, so the row is the authority (a cache\n        // a replica never saw would answer anonymous in steady state).\n        // The column holds a digest, never the credential itself.\n        return this.repository.findOneBy({ secret: hashSessionSecret(secret) });\n    }\n\n    async updateSecret(id: string, secret: string | null): Promise<void> {\n        await this.repository.update({ id }, { secret: secret === null ? null : hashSessionSecret(secret) });\n\n        // The cached copy never carries the secret (see `save`), so nothing\n        // cached goes stale here. `auth_sessions` has no entity subscriber, so\n        // a targeted update publishes nothing either.\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: IQuery,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.subKind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: `parameters: ['filters']` — a bulk revoke must reach every\n        // matching row. Applying the schema's `pagination.maxLimit` would\n        // default the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        // The cookie handle must never enter the cache. `findOneById` serves\n        // the cached object verbatim, and an owner reads its own session\n        // through `GET /sessions/:id` with no permission at all, so a cached\n        // secret would be published where a `select: false` column is\n        // otherwise absent by construction. Omitted rather than nulled: a\n        // cached `secret: null` fed back through `save()` (ping / refresh both\n        // do exactly that) would clear the column and kill a live console\n        // session on its first request.\n        const cacheable : Session = { ...session };\n        delete cacheable.secret;\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id,\n            }),\n            cacheable,\n            { ttl: new Date(session.expiresAt).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        // TypeORM unsets the primary key on the entity it removed, so the id\n        // has to be read first or the cache drop misses and the revoked\n        // session stays readable until its entry expires.\n        const { id } = session;\n\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id,\n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n\n    async deleteExpired(\n        before: string,\n        options: SessionDeleteExpiredOptions = {},\n    ): Promise<number> {\n        // Deliberately bypasses the cache, unlike `remove`. A cached session\n        // is written with `ttl = expiresAt - now` on every save (creation and\n        // every refresh alike), so an entry has always lapsed by the time its\n        // row matches this predicate. Dropping the keys would mean reading\n        // each row back only to evict something that is already gone.\n        return deleteInBatches(\n            this.repository,\n            { expiresAt: LessThan(before) },\n            resolveSweepBatchSize(options.batchSize, SESSION_EXPIRY_SWEEP_BATCH_SIZE),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiCA,IAAaU,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BjB,cAAc;GACVkB,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAEA,MAAMO,gBAAgBC,QAAyC;EAC3D,IAAI,CAACA,QAID,OAAO;EAOX,OAAO,KAAKX,WAAWS,UAAU,EAAEE,QAAQlB,kBAAkBkB,MAAAA,EAAQ,CAAA;CACzE;CAEA,MAAMC,aAAaT,IAAYQ,QAAsC;EACjE,MAAM,KAAKX,WAAWa,OAAO,EAAEV,GAAG,GAAG,EAAEQ,QAAQA,WAAW,OAAO,OAAOlB,kBAAkBkB,MAAAA,EAAQ,CAAA;CAKtG;CAIA,MAAMG,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKjB,WAAWkB,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAe7B,WAAW2B,IAAIF,KAAAA;EAEtCrB,sBAAsBuB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,IAAID,QAAQI,OAERH,GAAGI,SAAS,+DAA+D;GACvEC,UAAUN,QAAQI,MAAMG;GACxBC,cAAcR,QAAQI,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMV,GAAGW,gBAAe;EAElD,OAAO;GACHC,MAAMtC,sBAAsBwB,OAAOW,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,eAAeX,OAAyC;EAC1D,OAAO,KAAKpB,WAAWkB,mBAAmB,SAAA,CAAA,CACrCc,MAAM,qDAAqD;GACxDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAenB,OAAmC;EACpD,MAAME,KAAK,KAAKjB,WAAWkB,mBAAmB,SAAA;EAM9C5B,WAAW2B,IAAIF,KAAAA;EAEfrB,sBAAsBuB,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAEvD,OAAOA,GAAGgB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAMhC,UAAU,KAAKJ,WAAWqC,OAAOD,KAAAA;EACvC,MAAM,KAAKpC,WAAWmC,KAAK/B,OAAAA;EAU3B,MAAMkC,YAAsB,EAAE,GAAGlC,QAAQ;EACzC,OAAOkC,UAAU3B;EAEjB,MAAM,KAAKZ,MAAMwC,IACbnD,cAAc;GACVkB,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAmC,WACA,EAAEE,KAAK,IAAIC,KAAKrC,QAAQsC,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG9D,OAAOxC;CACX;CAIA,MAAMyC,OAAOzC,SAAiC;EAI1C,MAAM,EAAED,OAAOC;EAEf,MAAM,KAAKJ,WAAW6C,OAAOzC,OAAAA;EAC7B,MAAM,KAAKL,MAAM+C,KACb1D,cAAc;GACVkB,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;CAER;CAEA,MAAM4C,WAAW5C,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKyC,OAAOzC,OAAAA;CAE1B;CAEA,MAAM4C,cACFC,QACAjC,UAAuC,CAAC,GACzB;EAMf,OAAOrB,gBACH,KAAKK,YACL,EAAE0C,WAAWrD,SAAS4D,MAAAA,EAAQ,GAC9BrD,sBAAsBoB,QAAQkC,WAAW1D,+BAAAA,CAAAA;CAEjD;AACJ"}

package/dist/app/modules/components/index.d.ts

@@ -1,2 +1,3 @@
 export * from './module.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/components/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/app/modules/components/module.d.ts

@@ -1,11 +1,13 @@
 import type { Component } from '../../../components/index.ts';
 import type { IModule } from 'orkos';
 import type { IContainer } from 'eldin';
+import type { ComponentsModuleOptions } from './types.ts';
 export declare class ComponentsModule implements IModule {
     readonly name: string;
     readonly dependencies: string[];
+    protected options: ComponentsModuleOptions;
     protected components: Component[];
-    constructor();
+    constructor(options?: ComponentsModuleOptions);
     setup(container: IContainer): Promise<void>;
     teardown(container: IContainer): Promise<void>;
 }

package/dist/app/modules/components/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAQ9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;;IAQ5B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBvD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAS9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE3C,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;gBAEtB,OAAO,GAAE,uBAA4B;IAY3C,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D3C,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBvD"}

package/dist/app/modules/components/module.mjs

@@ -1,38 +1,56 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CacheInjectionKey } from "../cache/constants.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import "../config/index.mjs";
-import { createEventCleanerComponent } from "../../../components/event-cleaner/module.mjs";
-import { createOAuth2CleanerComponent } from "../../../components/oauth2-cleaner/module.mjs";
-import "../../../components/index.mjs";
-import { DatabaseInjectionKey } from "../database/constants.mjs";
+import "../cache/index.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
+import { DatabaseInjectionKey } from "../database/constants.mjs";
 import "../database/index.mjs";
+import { createEventCleanerComponent } from "../../../components/event-cleaner/module.mjs";
+import { createOAuth2CleanerComponent } from "../../../components/oauth2-cleaner/module.mjs";
+import "../../../components/index.mjs";
 //#region src/app/modules/components/module.ts
 var ComponentsModule = class {
 	name;
 	dependencies;
+	options;
 	components;
-	constructor() {
+	constructor(options = {}) {
 		this.name = ModuleName.COMPONENTS;
 		this.dependencies = [
 			ModuleName.CONFIG,
 			ModuleName.LOGGER,
+			ModuleName.CACHE,
 			ModuleName.DATABASE
 		];
+		this.options = options;
 		this.components = [];
 	}
 	async setup(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const logger = container.resolve(LoggerInjectionKey);
-		const components = [createOAuth2CleanerComponent(dataSource, logger)];
+		if (!config.worker.enabled) {
+			if (this.options.required) throw new Error("This process runs in worker mode, but core.worker.enabled is false. Set it to true for this process (WORKER_ENABLED=true), or start the API instead (`authup start` or `authup start core`), which runs the worker in process while the key is true.");
+			logger.info("The worker is disabled by configuration (core.worker.enabled: false).");
+			return;
+		}
+		const cache = container.resolve(CacheInjectionKey);
+		const registry = [{
+			name: "oauth2-cleaner",
+			component: createOAuth2CleanerComponent(dataSource, cache, logger)
+		}];
 		const securitySweep = config.eventLogRetentionDays > 0;
 		const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;
-		if (config.eventLogEnabled && (securitySweep || entitySweep)) components.push(createEventCleanerComponent(dataSource, logger));
+		if (config.eventLogEnabled && (securitySweep || entitySweep)) registry.push({
+			name: "event-cleaner",
+			component: createEventCleanerComponent(dataSource, logger)
+		});
+		const components = registry.map((entry) => entry.component);
 		this.components = components;
 		components.forEach((component) => {
 			component.start().catch((e) => {
@@ -40,6 +58,7 @@ var ComponentsModule = class {
 				logger.error(e);
 			});
 		});
+		logger.info(`Background components started: ${registry.map((entry) => entry.name).join(", ")}.`);
 	}
 	async teardown(container) {
 		const logger = container.tryResolve(LoggerInjectionKey);

package/dist/app/modules/components/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createEventCleanerComponent","createOAuth2CleanerComponent","ConfigInjectionKey","DatabaseInjectionKey","LoggerInjectionKey","ModuleName","ComponentsModule","name","dependencies","components","COMPONENTS","CONFIG","LOGGER","DATABASE","setup","container","config","resolve","dataSource","DataSource","logger","securitySweep","eventLogRetentionDays","entitySweep","eventLogEntityEnabled","eventLogEntityRetentionDays","eventLogEnabled","push","forEach","component","start","catch","e","error","teardown","tryResolve","stop","success","data","warn"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport {\n    createEventCleanerComponent,\n    createOAuth2CleanerComponent,\n} from '../../../components/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected components: Component[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.DATABASE];\n        this.components = [];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource, logger),\n        ];\n\n        // The sweep only exists when rows are written AND at least one row\n        // family carries an expiry — security events (eventLogRetentionDays)\n        // and entity-CRUD events (eventLogEntityRetentionDays) are stamped\n        // independently, so either non-zero retention needs the cleaner.\n        const securitySweep = config.eventLogRetentionDays > 0;\n        const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;\n        if (config.eventLogEnabled && (securitySweep || entitySweep)) {\n            components.push(createEventCleanerComponent(dataSource, logger));\n        }\n\n        this.components = components;\n\n        // start() is deliberately fire-and-forget, so a rejection must be\n        // caught here — an unhandled rejection is fatal on modern node.\n        components.forEach((component) => {\n            component.start().catch((e) => {\n                logger.error('Starting a background component failed.');\n                logger.error(e);\n            });\n        });\n    }\n\n    async teardown(container: IContainer): Promise<void> {\n        const logger = container.tryResolve(LoggerInjectionKey);\n\n        const { components } = this;\n        this.components = [];\n\n        for (const component of components) {\n            try {\n                await component.stop();\n            } catch (e) {\n                if (logger.success) {\n                    logger.data.warn('Stopping a background component failed.');\n                    logger.data.warn(e);\n                }\n            }\n        }\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,IAAaM,mBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,cAAc;EACV,KAAKF,OAAOF,WAAWK;EACvB,KAAKF,eAAe;GAACH,WAAWM;GAAQN,WAAWO;GAAQP,WAAWQ;EAAS;EAC/E,KAAKJ,aAAa,CAAA;CACtB;CAEA,MAAMK,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQf,kBAAAA;EACjC,MAAMgB,aAAaH,UAAUE,QAAQd,qBAAqBgB,UAAU;EACpE,MAAMC,SAASL,UAAUE,QAAQb,kBAAAA;EAEjC,MAAMK,aAA0B,CAC5BR,6BAA6BiB,YAAYE,MAAAA,CAC5C;EAMD,MAAMC,gBAAgBL,OAAOM,wBAAwB;EACrD,MAAMC,cAAcP,OAAOQ,yBAAyBR,OAAOS,8BAA8B;EACzF,IAAIT,OAAOU,oBAAoBL,iBAAiBE,cAC5Cd,WAAWkB,KAAK3B,4BAA4BkB,YAAYE,MAAAA,CAAAA;EAG5D,KAAKX,aAAaA;EAIlBA,WAAWmB,SAASC,cAAAA;GAChBA,UAAUC,MAAK,CAAA,CAAGC,OAAOC,MAAAA;IACrBZ,OAAOa,MAAM,yCAAA;IACbb,OAAOa,MAAMD,CAAAA;GACjB,CAAA;EACJ,CAAA;CACJ;CAEA,MAAME,SAASnB,WAAsC;EACjD,MAAMK,SAASL,UAAUoB,WAAW/B,kBAAAA;EAEpC,MAAM,EAAEK,eAAe;EACvB,KAAKA,aAAa,CAAA;EAElB,KAAK,MAAMoB,aAAapB,YACpB,IAAI;GACA,MAAMoB,UAAUO,KAAI;EACxB,SAASJ,GAAG;GACR,IAAIZ,OAAOiB,SAAS;IAChBjB,OAAOkB,KAAKC,KAAK,yCAAA;IACjBnB,OAAOkB,KAAKC,KAAKP,CAAAA;GACrB;EACJ;CAER;AAGJ"}
+{"version":3,"file":"module.mjs","names":["createEventCleanerComponent","createOAuth2CleanerComponent","CacheInjectionKey","ConfigInjectionKey","DatabaseInjectionKey","LoggerInjectionKey","ModuleName","ComponentsModule","name","dependencies","options","components","COMPONENTS","CONFIG","LOGGER","CACHE","DATABASE","setup","container","config","resolve","dataSource","DataSource","logger","worker","enabled","required","Error","info","cache","registry","component","securitySweep","eventLogRetentionDays","entitySweep","eventLogEntityEnabled","eventLogEntityRetentionDays","eventLogEnabled","push","map","entry","forEach","start","catch","e","error","join","teardown","tryResolve","stop","success","data","warn"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport {\n    createEventCleanerComponent,\n    createOAuth2CleanerComponent,\n} from '../../../components/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\nimport type { ComponentsModuleOptions } from './types.ts';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected options: ComponentsModuleOptions;\n\n    protected components: Component[];\n\n    constructor(options: ComponentsModuleOptions = {}) {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [\n            ModuleName.CONFIG,\n            ModuleName.LOGGER,\n            ModuleName.CACHE,\n            ModuleName.DATABASE,\n        ];\n        this.options = options;\n        this.components = [];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        // worker mode requires it; the default mode follows the config, so an\n        // API replica can hand the sweeps to a dedicated worker process.\n        if (!config.worker.enabled) {\n            if (this.options.required) {\n                throw new Error('This process runs in worker mode, but core.worker.enabled is false. Set it to true for this process (WORKER_ENABLED=true), or start the API instead (`authup start` or `authup start core`), which runs the worker in process while the key is true.');\n            }\n\n            logger.info('The worker is disabled by configuration (core.worker.enabled: false).');\n            return;\n        }\n\n        const cache = container.resolve(CacheInjectionKey);\n\n        // Name and component travel together so the boot log can never drift\n        // from what was actually registered.\n        const registry: { name: string, component: Component }[] = [\n            {\n                name: 'oauth2-cleaner',\n                component: createOAuth2CleanerComponent(dataSource, cache, logger),\n            },\n        ];\n\n        // The sweep only exists when rows are written AND at least one row\n        // family carries an expiry — security events (eventLogRetentionDays)\n        // and entity-CRUD events (eventLogEntityRetentionDays) are stamped\n        // independently, so either non-zero retention needs the cleaner.\n        const securitySweep = config.eventLogRetentionDays > 0;\n        const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;\n        if (config.eventLogEnabled && (securitySweep || entitySweep)) {\n            registry.push({\n                name: 'event-cleaner',\n                component: createEventCleanerComponent(dataSource, logger),\n            });\n        }\n\n        const components = registry.map((entry) => entry.component);\n        this.components = components;\n\n        // start() is deliberately fire-and-forget, so a rejection must be\n        // caught here — an unhandled rejection is fatal on modern node.\n        components.forEach((component) => {\n            component.start().catch((e) => {\n                logger.error('Starting a background component failed.');\n                logger.error(e);\n            });\n        });\n\n        // Info level, and the only line a healthy process writes about this:\n        // the sweeps log nothing per tick, the production console transport\n        // is info, and a worker whose whole job is these components would\n        // otherwise boot silent.\n        logger.info(`Background components started: ${registry.map((entry) => entry.name).join(', ')}.`);\n    }\n\n    async teardown(container: IContainer): Promise<void> {\n        const logger = container.tryResolve(LoggerInjectionKey);\n\n        const { components } = this;\n        this.components = [];\n\n        for (const component of components) {\n            try {\n                await component.stop();\n            } catch (e) {\n                if (logger.success) {\n                    logger.data.warn('Stopping a background component failed.');\n                    logger.data.warn(e);\n                }\n            }\n        }\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAqBA,IAAaO,mBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEV,YAAYD,UAAmC,CAAC,GAAG;EAC/C,KAAKF,OAAOF,WAAWM;EACvB,KAAKH,eAAe;GAChBH,WAAWO;GACXP,WAAWQ;GACXR,WAAWS;GACXT,WAAWU;EACd;EACD,KAAKN,UAAUA;EACf,KAAKC,aAAa,CAAA;CACtB;CAEA,MAAMM,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQjB,kBAAAA;EACjC,MAAMkB,aAAaH,UAAUE,QAAQhB,qBAAqBkB,UAAU;EACpE,MAAMC,SAASL,UAAUE,QAAQf,kBAAAA;EAIjC,IAAI,CAACc,OAAOK,OAAOC,SAAS;GACxB,IAAI,KAAKf,QAAQgB,UACb,MAAM,IAAIC,MAAM,sPAAA;GAGpBJ,OAAOK,KAAK,uEAAA;GACZ;EACJ;EAEA,MAAMC,QAAQX,UAAUE,QAAQlB,iBAAAA;EAIhC,MAAM4B,WAAqD,CACvD;GACItB,MAAM;GACNuB,WAAW9B,6BAA6BoB,YAAYQ,OAAON,MAAAA;EAC/D,CACH;EAMD,MAAMS,gBAAgBb,OAAOc,wBAAwB;EACrD,MAAMC,cAAcf,OAAOgB,yBAAyBhB,OAAOiB,8BAA8B;EACzF,IAAIjB,OAAOkB,oBAAoBL,iBAAiBE,cAC5CJ,SAASQ,KAAK;GACV9B,MAAM;GACNuB,WAAW/B,4BAA4BqB,YAAYE,MAAAA;EACvD,CAAA;EAGJ,MAAMZ,aAAamB,SAASS,KAAKC,UAAUA,MAAMT,SAAS;EAC1D,KAAKpB,aAAaA;EAIlBA,WAAW8B,SAASV,cAAAA;GAChBA,UAAUW,MAAK,CAAA,CAAGC,OAAOC,MAAAA;IACrBrB,OAAOsB,MAAM,yCAAA;IACbtB,OAAOsB,MAAMD,CAAAA;GACjB,CAAA;EACJ,CAAA;EAMArB,OAAOK,KAAK,kCAAkCE,SAASS,KAAKC,UAAUA,MAAMhC,IAAI,CAAA,CAAEsC,KAAK,IAAA,EAAM,EAAE;CACnG;CAEA,MAAMC,SAAS7B,WAAsC;EACjD,MAAMK,SAASL,UAAU8B,WAAW3C,kBAAAA;EAEpC,MAAM,EAAEM,eAAe;EACvB,KAAKA,aAAa,CAAA;EAElB,KAAK,MAAMoB,aAAapB,YACpB,IAAI;GACA,MAAMoB,UAAUkB,KAAI;EACxB,SAASL,GAAG;GACR,IAAIrB,OAAO2B,SAAS;IAChB3B,OAAO4B,KAAKC,KAAK,yCAAA;IACjB7B,OAAO4B,KAAKC,KAAKR,CAAAA;GACrB;EACJ;CAER;AAGJ"}

package/dist/app/modules/components/types.d.ts

@@ -0,0 +1,11 @@
+export type ComponentsModuleOptions = {
+    /**
+     * Refuse to boot when `core.worker.enabled` is false instead of skipping
+     * the components. Worker mode sets it: a process started for nothing but
+     * the sweeps must not come up doing nothing.
+     *
+     * default: false
+     */
+    required?: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/app/modules/components/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,uBAAuB,GAAG;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;CACrB,CAAC"}

package/dist/app/modules/config/app-origins.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from './types.ts';
+/**
+ * Derive the set of trusted application origins (scheme://host[:port]).
+ *
+ * publicUrl may carry a path, so its origin is extracted; trustedOrigins
+ * entries are canonical origins already (normalizeConfig owns that
+ * invariant, via `expandToOrigins`) and are merged verbatim.
+ */
+export declare function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[];
+//# sourceMappingURL=app-origins.d.ts.map

package/dist/app/modules/config/app-origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/app-origins.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}