@dudousxd/nestjs-media-dashboard 0.1.2 → 0.2.0

package/dist/server/index.cjs

@@ -35,18 +35,260 @@ var getImportMetaUrl = /* @__PURE__ */ __name(() => typeof document === "undefin
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/server/media-dashboard.module.ts
-var import_common6 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
 
+// src/server/auth/config.ts
+var DEFAULT_TTL_MS = 8 * 60 * 60 * 1e3;
+var DURATION_UNITS = {
+  s: 1e3,
+  m: 60 * 1e3,
+  h: 60 * 60 * 1e3,
+  d: 24 * 60 * 60 * 1e3
+};
+function durationToMs(ttl) {
+  if (ttl === void 0) return DEFAULT_TTL_MS;
+  const match = /^(\d+)([smhd])$/.exec(ttl.trim());
+  if (!match) return DEFAULT_TTL_MS;
+  const unit = DURATION_UNITS[match[2] ?? ""];
+  if (unit === void 0) return DEFAULT_TTL_MS;
+  return Number(match[1]) * unit;
+}
+__name(durationToMs, "durationToMs");
+function resolveConsoleAuth(options) {
+  if (!options) return null;
+  if (!options.secret) {
+    throw new Error("MediaDashboardModule: auth.secret is required when `auth` is configured.");
+  }
+  const modes = [];
+  if (options.session) modes.push("session");
+  if (options.login) modes.push("login");
+  if (modes.length === 0) {
+    throw new Error("MediaDashboardModule: auth needs a `login` and/or `session` hook.");
+  }
+  return {
+    secret: options.secret,
+    ttlMs: durationToMs(options.ttl),
+    modes,
+    ...options.session ? {
+      session: options.session
+    } : {},
+    ...options.login ? {
+      login: options.login
+    } : {}
+  };
+}
+__name(resolveConsoleAuth, "resolveConsoleAuth");
+
 // src/server/media-console-api.module.ts
-var import_common4 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 
 // src/server/media-console-actions.controller.ts
-var import_common2 = require("@nestjs/common");
+var import_common3 = require("@nestjs/common");
 
-// src/server/media-console.service.ts
+// src/server/media-console.guard.ts
 var import_common = require("@nestjs/common");
 
+// src/server/auth/cookie-header.ts
+function parseCookieHeader(header) {
+  const cookies = {};
+  if (typeof header !== "string" || header === "") return cookies;
+  for (const segment of header.split(";")) {
+    const eq = segment.indexOf("=");
+    if (eq <= 0) continue;
+    const name = segment.slice(0, eq).trim();
+    if (name === "") continue;
+    let rawValue = segment.slice(eq + 1).trim();
+    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
+      rawValue = rawValue.slice(1, -1);
+    }
+    if (name in cookies) continue;
+    try {
+      cookies[name] = decodeURIComponent(rawValue);
+    } catch {
+      cookies[name] = rawValue;
+    }
+  }
+  return cookies;
+}
+__name(parseCookieHeader, "parseCookieHeader");
+function serializeSetCookie(name, value, options) {
+  const parts = [
+    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
+  ];
+  parts.push(`Path=${options.path}`);
+  parts.push("HttpOnly");
+  parts.push("SameSite=Lax");
+  if (options.secure) parts.push("Secure");
+  if (options.clear) {
+    parts.push("Max-Age=0");
+    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+  } else {
+    parts.push(`Max-Age=${options.maxAgeSeconds}`);
+  }
+  return parts.join("; ");
+}
+__name(serializeSetCookie, "serializeSetCookie");
+
+// src/server/auth/request.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord, "isRecord");
+function readHeaders(request) {
+  if (!isRecord(request)) return {};
+  const headers = request.headers;
+  return isRecord(headers) ? headers : {};
+}
+__name(readHeaders, "readHeaders");
+function headerToString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
+    return value.join(",");
+  }
+  return void 0;
+}
+__name(headerToString, "headerToString");
+function readCookieHeader(request) {
+  return headerToString(readHeaders(request).cookie);
+}
+__name(readCookieHeader, "readCookieHeader");
+function isHttpsRequest(request) {
+  if (isRecord(request) && request.protocol === "https") return true;
+  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
+  if (forwarded === void 0) return false;
+  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
+}
+__name(isHttpsRequest, "isHttpsRequest");
+function attachSession(request, session) {
+  if (!isRecord(request)) return;
+  request.consoleSession = session;
+}
+__name(attachSession, "attachSession");
+
+// src/server/auth/response.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord2, "isRecord");
+function isRawNodeResponse(value) {
+  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
+}
+__name(isRawNodeResponse, "isRawNodeResponse");
+function resolveRawResponse(response) {
+  if (isRawNodeResponse(response)) return response;
+  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveRawResponse, "resolveRawResponse");
+function existingSetCookies(response) {
+  const current = response.getHeader("set-cookie");
+  if (Array.isArray(current)) return current;
+  if (typeof current === "string") return [
+    current
+  ];
+  return [];
+}
+__name(existingSetCookies, "existingSetCookies");
+function appendSetCookie(response, cookie) {
+  const raw = resolveRawResponse(response);
+  if (!raw) return;
+  raw.setHeader("set-cookie", [
+    ...existingSetCookies(raw),
+    cookie
+  ]);
+}
+__name(appendSetCookie, "appendSetCookie");
+
+// src/server/auth/session-cookie.ts
+var import_node_crypto = require("crypto");
+var EXP_GRACE_MS = 3e4;
+function base64urlEncode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+__name(base64urlEncode, "base64urlEncode");
+function base64urlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+__name(base64urlDecode, "base64urlDecode");
+function hmac(secret, payload) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("base64url");
+}
+__name(hmac, "hmac");
+function signSessionCookie(user, options) {
+  const issuedAt = options.now ?? Date.now();
+  const session = {
+    sub: user.id,
+    ...user.name !== void 0 ? {
+      name: user.name
+    } : {},
+    roles: user.roles ?? [],
+    iat: issuedAt,
+    exp: issuedAt + options.ttlMs
+  };
+  const encodedPayload = base64urlEncode(JSON.stringify(session));
+  return `${encodedPayload}.${hmac(options.secret, encodedPayload)}`;
+}
+__name(signSessionCookie, "signSessionCookie");
+function isSessionPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  if (typeof record.sub !== "string") return false;
+  if (record.name !== void 0 && typeof record.name !== "string") return false;
+  if (!Array.isArray(record.roles)) return false;
+  if (!record.roles.every((role) => typeof role === "string")) return false;
+  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
+  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
+  return true;
+}
+__name(isSessionPayload, "isSessionPayload");
+function verifySessionCookie(value, options) {
+  try {
+    const dot = value.indexOf(".");
+    if (dot <= 0 || dot === value.length - 1) return null;
+    const encodedPayload = value.slice(0, dot);
+    const provided = Buffer.from(value.slice(dot + 1), "base64url");
+    const expected = Buffer.from(hmac(options.secret, encodedPayload), "base64url");
+    if (provided.length !== expected.length) return null;
+    if (!(0, import_node_crypto.timingSafeEqual)(provided, expected)) return null;
+    const decoded = JSON.parse(base64urlDecode(encodedPayload));
+    if (!isSessionPayload(decoded)) return null;
+    const now = options.now ?? Date.now();
+    if (now > decoded.exp + EXP_GRACE_MS) return null;
+    return decoded;
+  } catch {
+    return null;
+  }
+}
+__name(verifySessionCookie, "verifySessionCookie");
+
+// src/server/auth/session-cookie-io.ts
+var SESSION_COOKIE_NAME = "media_console_session";
+function issueSessionCookie(user, context) {
+  const value = signSessionCookie(user, {
+    secret: context.auth.secret,
+    ttlMs: context.auth.ttlMs,
+    ...context.now !== void 0 ? {
+      now: context.now
+    } : {}
+  });
+  appendSetCookie(context.response, serializeSetCookie(SESSION_COOKIE_NAME, value, {
+    path: context.cookiePath,
+    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
+    secure: isHttpsRequest(context.request)
+  }));
+}
+__name(issueSessionCookie, "issueSessionCookie");
+function clearSessionCookie(context) {
+  appendSetCookie(context.response, serializeSetCookie(SESSION_COOKIE_NAME, "", {
+    path: context.cookiePath,
+    maxAgeSeconds: 0,
+    secure: isHttpsRequest(context.request),
+    clear: true
+  }));
+}
+__name(clearSessionCookie, "clearSessionCookie");
+
 // src/server/tokens.ts
 var MEDIA_STORE = Symbol.for("nestjs-media:store");
 var MEDIA_UPLOAD_SESSIONS = Symbol.for("nestjs-media:upload-sessions");
@@ -54,8 +296,10 @@ var MEDIA_STORAGE_SHARED = Symbol.for("nestjs-media:storage");
 var MEDIA_DASHBOARD_BASE_PATH = Symbol("MEDIA_DASHBOARD_BASE_PATH");
 var MEDIA_DASHBOARD_API_PATH = Symbol("MEDIA_DASHBOARD_API_PATH");
 var MEDIA_DASHBOARD_ACTIONS = Symbol("MEDIA_DASHBOARD_ACTIONS");
+var MEDIA_CONSOLE_AUTH = Symbol("MEDIA_CONSOLE_AUTH");
+var MEDIA_CONSOLE_COOKIE_PATH = Symbol("MEDIA_CONSOLE_COOKIE_PATH");
 
-// src/server/media-console.service.ts
+// src/server/media-console.guard.ts
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -73,6 +317,89 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
+var MediaConsoleGuard = class {
+  static {
+    __name(this, "MediaConsoleGuard");
+  }
+  auth;
+  cookiePath;
+  constructor(auth, cookiePath) {
+    this.auth = auth;
+    this.cookiePath = cookiePath;
+  }
+  canActivate(context) {
+    if (!this.auth) return true;
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const session = this.verifyRequestSession(request);
+    if (!session) throw new import_common.UnauthorizedException();
+    attachSession(request, session);
+    this.maybeRenew(http.getResponse(), request, session);
+    return true;
+  }
+  verifyRequestSession(request) {
+    if (!this.auth) return null;
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return null;
+    return verifySessionCookie(cookieValue, {
+      secret: this.auth.secret
+    });
+  }
+  /**
+  * Sliding renewal: when a valid cookie is past half its TTL, re-issue a fresh one so active users
+  * never get logged out mid-session. Appends a new Set-Cookie (preserving any others already set).
+  */
+  maybeRenew(response, request, session) {
+    if (!this.auth) return;
+    const now = Date.now();
+    if (now - session.iat <= this.auth.ttlMs / 2) return;
+    issueSessionCookie({
+      id: session.sub,
+      ...session.name !== void 0 ? {
+        name: session.name
+      } : {},
+      roles: session.roles
+    }, {
+      auth: this.auth,
+      cookiePath: this.cookiePath ?? "/",
+      request,
+      response,
+      now
+    });
+  }
+};
+MediaConsoleGuard = _ts_decorate([
+  (0, import_common.Injectable)(),
+  _ts_param(0, (0, import_common.Optional)()),
+  _ts_param(0, (0, import_common.Inject)(MEDIA_CONSOLE_AUTH)),
+  _ts_param(1, (0, import_common.Optional)()),
+  _ts_param(1, (0, import_common.Inject)(MEDIA_CONSOLE_COOKIE_PATH)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    Object,
+    Object
+  ])
+], MediaConsoleGuard);
+
+// src/server/media-console.service.ts
+var import_common2 = require("@nestjs/common");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var URL_TTL_SECONDS = 300;
 var DEFAULT_PAGE_LIMIT = 50;
 function lastSegment(prefix) {
@@ -130,7 +457,7 @@ var MediaConsoleService = class {
   }
   diskOrThrow(disk) {
     if (!this.storage || !this.storage.diskNames().includes(disk)) {
-      throw new import_common.NotFoundException(`Unknown disk: ${disk}`);
+      throw new import_common2.NotFoundException(`Unknown disk: ${disk}`);
     }
     return this.storage.disk(disk);
   }
@@ -219,7 +546,7 @@ var MediaConsoleService = class {
   *  as a navigable folder. Normalizes to exactly one trailing slash; rejects an empty prefix. */
   async createFolder(disk, prefix) {
     const normalized = prefix.replace(/^\/+/, "").replace(/\/+$/, "");
-    if (normalized === "") throw new import_common.BadRequestException("Folder name is required");
+    if (normalized === "") throw new import_common2.BadRequestException("Folder name is required");
     await this.diskOrThrow(disk).put(`${normalized}/`, Buffer.alloc(0));
   }
   async deleteObject(disk, key) {
@@ -248,9 +575,9 @@ var MediaConsoleService = class {
     };
   }
   async uploadDetail(id) {
-    if (!this.uploads) throw new import_common.NotFoundException("No upload store configured");
+    if (!this.uploads) throw new import_common2.NotFoundException("No upload store configured");
     const session = await this.uploads.get(id);
-    if (!session) throw new import_common.NotFoundException(`Unknown upload: ${id}`);
+    if (!session) throw new import_common2.NotFoundException(`Unknown upload: ${id}`);
     const parts = this.uploads.listParts ? await this.uploads.listParts(id) : [];
     return {
       upload: mapUpload(session),
@@ -265,7 +592,7 @@ var MediaConsoleService = class {
   * multipart is reaped by the bucket's lifecycle policy. Surfaced as "Cancel session" in the UI.
   */
   async abortUpload(id) {
-    if (!this.uploads) throw new import_common.NotFoundException("No upload store configured");
+    if (!this.uploads) throw new import_common2.NotFoundException("No upload store configured");
     await this.uploads.delete(id);
   }
   async listCollections() {
@@ -305,9 +632,9 @@ var MediaConsoleService = class {
     };
   }
   async libraryDetail(id) {
-    if (!this.store) throw new import_common.NotFoundException("No media store configured");
+    if (!this.store) throw new import_common2.NotFoundException("No media store configured");
     const record = await this.store.find(id);
-    if (!record) throw new import_common.NotFoundException(`Unknown media record: ${id}`);
+    if (!record) throw new import_common2.NotFoundException(`Unknown media record: ${id}`);
     const variants = await Promise.all(Object.entries(record.conversions).map(async ([name, conversion]) => {
       const driver = this.storage?.diskNames().includes(conversion.disk) ? this.storage.disk(conversion.disk) : null;
       const url = driver?.capabilities.presign ? await driver.temporaryUrl(conversion.path, URL_TTL_SECONDS) : await driver?.url(conversion.path) ?? "";
@@ -322,7 +649,7 @@ var MediaConsoleService = class {
     };
   }
   async deleteLibraryRecord(id) {
-    if (!this.store) throw new import_common.NotFoundException("No media store configured");
+    if (!this.store) throw new import_common2.NotFoundException("No media store configured");
     await this.store.delete(id);
   }
   topology() {
@@ -334,18 +661,18 @@ var MediaConsoleService = class {
     };
   }
 };
-MediaConsoleService = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Optional)()),
-  _ts_param(0, (0, import_common.Inject)(MEDIA_STORAGE_SHARED)),
-  _ts_param(1, (0, import_common.Optional)()),
-  _ts_param(1, (0, import_common.Inject)(MEDIA_STORE)),
-  _ts_param(2, (0, import_common.Optional)()),
-  _ts_param(2, (0, import_common.Inject)(MEDIA_UPLOAD_SESSIONS)),
-  _ts_param(3, (0, import_common.Optional)()),
-  _ts_param(3, (0, import_common.Inject)(MEDIA_DASHBOARD_ACTIONS)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+MediaConsoleService = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_param2(0, (0, import_common2.Optional)()),
+  _ts_param2(0, (0, import_common2.Inject)(MEDIA_STORAGE_SHARED)),
+  _ts_param2(1, (0, import_common2.Optional)()),
+  _ts_param2(1, (0, import_common2.Inject)(MEDIA_STORE)),
+  _ts_param2(2, (0, import_common2.Optional)()),
+  _ts_param2(2, (0, import_common2.Inject)(MEDIA_UPLOAD_SESSIONS)),
+  _ts_param2(3, (0, import_common2.Optional)()),
+  _ts_param2(3, (0, import_common2.Inject)(MEDIA_DASHBOARD_ACTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     Object,
     Object,
     Object,
@@ -354,23 +681,23 @@ MediaConsoleService = _ts_decorate([
 ], MediaConsoleService);
 
 // src/server/media-console-actions.controller.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var MediaConsoleActionsController = class {
   static {
     __name(this, "MediaConsoleActionsController");
@@ -406,118 +733,303 @@ var MediaConsoleActionsController = class {
     return this.service.deleteLibraryRecord(id);
   }
 };
-_ts_decorate2([
-  (0, import_common2.Delete)("disks/:disk/object"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("disk")),
-  _ts_param2(1, (0, import_common2.Query)("key")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Delete)("disks/:disk/object"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("disk")),
+  _ts_param3(1, (0, import_common3.Query)("key")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "deleteObject", null);
-_ts_decorate2([
-  (0, import_common2.Post)("disks/:disk/copy"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("disk")),
-  _ts_param2(1, (0, import_common2.Body)()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Post)("disks/:disk/copy"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("disk")),
+  _ts_param3(1, (0, import_common3.Body)()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     typeof CopyMoveBody === "undefined" ? Object : CopyMoveBody
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "copyObject", null);
-_ts_decorate2([
-  (0, import_common2.Post)("disks/:disk/move"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("disk")),
-  _ts_param2(1, (0, import_common2.Body)()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Post)("disks/:disk/move"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("disk")),
+  _ts_param3(1, (0, import_common3.Body)()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     typeof CopyMoveBody === "undefined" ? Object : CopyMoveBody
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "moveObject", null);
-_ts_decorate2([
-  (0, import_common2.Post)("disks/:disk/upload"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("disk")),
-  _ts_param2(1, (0, import_common2.Query)("key")),
-  _ts_param2(2, (0, import_common2.Req)()),
-  _ts_param2(3, (0, import_common2.Query)("type")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Post)("disks/:disk/upload"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("disk")),
+  _ts_param3(1, (0, import_common3.Query)("key")),
+  _ts_param3(2, (0, import_common3.Req)()),
+  _ts_param3(3, (0, import_common3.Query)("type")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     typeof Readable === "undefined" ? Object : Readable,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "uploadObject", null);
-_ts_decorate2([
-  (0, import_common2.Post)("disks/:disk/folder"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("disk")),
-  _ts_param2(1, (0, import_common2.Body)()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Post)("disks/:disk/folder"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("disk")),
+  _ts_param3(1, (0, import_common3.Body)()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     typeof CreateFolderBody === "undefined" ? Object : CreateFolderBody
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "createFolder", null);
-_ts_decorate2([
-  (0, import_common2.Post)("uploads/:id/abort"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("id")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Post)("uploads/:id/abort"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "abortUpload", null);
-_ts_decorate2([
-  (0, import_common2.Delete)("library/:id"),
-  (0, import_common2.HttpCode)(204),
-  _ts_param2(0, (0, import_common2.Param)("id")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common3.Delete)("library/:id"),
+  (0, import_common3.HttpCode)(204),
+  _ts_param3(0, (0, import_common3.Param)("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "deleteLibraryRecord", null);
-MediaConsoleActionsController = _ts_decorate2([
-  (0, import_common2.Controller)(),
-  _ts_param2(0, (0, import_common2.Inject)(MediaConsoleService)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+MediaConsoleActionsController = _ts_decorate3([
+  (0, import_common3.UseGuards)(MediaConsoleGuard),
+  (0, import_common3.Controller)(),
+  _ts_param3(0, (0, import_common3.Inject)(MediaConsoleService)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof MediaConsoleService === "undefined" ? Object : MediaConsoleService
   ])
 ], MediaConsoleActionsController);
 
+// src/server/media-console-auth.controller.ts
+var import_common4 = require("@nestjs/common");
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var MediaConsoleAuthController = class _MediaConsoleAuthController {
+  static {
+    __name(this, "MediaConsoleAuthController");
+  }
+  auth;
+  cookiePath;
+  logger = new import_common4.Logger(_MediaConsoleAuthController.name);
+  /** One warn per hook kind, so a flaky hook doesn't spam logs every request. */
+  warnedHooks = /* @__PURE__ */ new Set();
+  constructor(auth, cookiePath) {
+    this.auth = auth;
+    this.cookiePath = cookiePath;
+  }
+  me(request) {
+    if (!this.auth) return {
+      authRequired: false
+    };
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    const session = cookieValue !== void 0 ? verifySessionCookie(cookieValue, {
+      secret: this.auth.secret
+    }) : null;
+    if (!session) throw new import_common4.UnauthorizedException({
+      auth: {
+        modes: this.auth.modes
+      }
+    });
+    return {
+      user: {
+        id: session.sub,
+        ...session.name !== void 0 ? {
+          name: session.name
+        } : {},
+        roles: session.roles
+      }
+    };
+  }
+  async login(body, request, response) {
+    const auth = this.requireAuth();
+    if (!auth.login) throw new import_common4.NotFoundException();
+    if (typeof body?.username !== "string" || typeof body?.password !== "string") {
+      throw new import_common4.BadRequestException("Body must include string `username` and `password`.");
+    }
+    const username = body.username;
+    const password = body.password;
+    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
+    if (!user) throw new import_common4.UnauthorizedException({
+      message: "Invalid credentials"
+    });
+    return this.mint(user, request, response);
+  }
+  async session(request, response) {
+    const auth = this.requireAuth();
+    if (!auth.session) throw new import_common4.NotFoundException();
+    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
+    if (!user) throw new import_common4.UnauthorizedException();
+    return this.mint(user, request, response);
+  }
+  logout(request, response) {
+    clearSessionCookie({
+      cookiePath: this.cookiePath ?? "/",
+      request,
+      response
+    });
+  }
+  requireAuth() {
+    if (!this.auth) throw new import_common4.NotFoundException();
+    return this.auth;
+  }
+  mint(user, request, response) {
+    const auth = this.requireAuth();
+    issueSessionCookie(user, {
+      auth,
+      cookiePath: this.cookiePath ?? "/",
+      request,
+      response
+    });
+    return {
+      user: {
+        id: user.id,
+        ...user.name !== void 0 ? {
+          name: user.name
+        } : {},
+        roles: user.roles ?? []
+      }
+    };
+  }
+  /** Run a host hook defensively: a throw is a denial (null), warn-logged once per kind. */
+  async runHook(kind, run) {
+    try {
+      return await run() ?? null;
+    } catch (error) {
+      if (!this.warnedHooks.has(kind)) {
+        this.warnedHooks.add(kind);
+        this.logger.warn(`Console auth ${kind} hook threw; treating as denial. ${String(error)}`);
+      }
+      return null;
+    }
+  }
+};
+_ts_decorate4([
+  (0, import_common4.Get)("me"),
+  _ts_param4(0, (0, import_common4.Req)()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object
+  ]),
+  _ts_metadata4("design:returntype", typeof MeResponse === "undefined" ? Object : MeResponse)
+], MediaConsoleAuthController.prototype, "me", null);
+_ts_decorate4([
+  (0, import_common4.Post)("login"),
+  (0, import_common4.HttpCode)(200),
+  _ts_param4(0, (0, import_common4.Body)()),
+  _ts_param4(1, (0, import_common4.Req)()),
+  _ts_param4(2, (0, import_common4.Res)({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof LoginBody === "undefined" ? Object : LoginBody,
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], MediaConsoleAuthController.prototype, "login", null);
+_ts_decorate4([
+  (0, import_common4.Post)("session"),
+  (0, import_common4.HttpCode)(200),
+  _ts_param4(0, (0, import_common4.Req)()),
+  _ts_param4(1, (0, import_common4.Res)({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], MediaConsoleAuthController.prototype, "session", null);
+_ts_decorate4([
+  (0, import_common4.Post)("logout"),
+  (0, import_common4.HttpCode)(204),
+  _ts_param4(0, (0, import_common4.Req)()),
+  _ts_param4(1, (0, import_common4.Res)({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", void 0)
+], MediaConsoleAuthController.prototype, "logout", null);
+MediaConsoleAuthController = _ts_decorate4([
+  (0, import_common4.Controller)(),
+  _ts_param4(0, (0, import_common4.Optional)()),
+  _ts_param4(0, (0, import_common4.Inject)(MEDIA_CONSOLE_AUTH)),
+  _ts_param4(1, (0, import_common4.Optional)()),
+  _ts_param4(1, (0, import_common4.Inject)(MEDIA_CONSOLE_COOKIE_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ])
+], MediaConsoleAuthController);
+
 // src/server/media-console-read.controller.ts
-var import_common3 = require("@nestjs/common");
-function _ts_decorate3(decorators, target, key, desc) {
+var import_common5 = require("@nestjs/common");
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param5, "_ts_param");
 function toLimit(value) {
   if (value === void 0) return void 0;
   const parsed = Number(value);
@@ -556,7 +1068,7 @@ var MediaConsoleReadController = class {
   *  can render text/PDF previews the browser would otherwise download, and read text past CORS. */
   async objectRaw(disk, key) {
     const { stream, contentType, size } = await this.service.objectStream(disk, key);
-    return new import_common3.StreamableFile(stream, {
+    return new import_common5.StreamableFile(stream, {
       type: contentType,
       disposition: "inline",
       ...Number.isFinite(size) ? {
@@ -604,141 +1116,150 @@ var MediaConsoleReadController = class {
     return this.service.topology();
   }
 };
-_ts_decorate3([
-  (0, import_common3.Get)("disks"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof DiskListResponse === "undefined" ? Object : DiskListResponse)
+_ts_decorate5([
+  (0, import_common5.Get)("disks"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof DiskListResponse === "undefined" ? Object : DiskListResponse)
 ], MediaConsoleReadController.prototype, "disks", null);
-_ts_decorate3([
-  (0, import_common3.Get)("disks/:disk/objects"),
-  _ts_param3(0, (0, import_common3.Param)("disk")),
-  _ts_param3(1, (0, import_common3.Query)("prefix")),
-  _ts_param3(2, (0, import_common3.Query)("cursor")),
-  _ts_param3(3, (0, import_common3.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("disks/:disk/objects"),
+  _ts_param5(0, (0, import_common5.Param)("disk")),
+  _ts_param5(1, (0, import_common5.Query)("prefix")),
+  _ts_param5(2, (0, import_common5.Query)("cursor")),
+  _ts_param5(3, (0, import_common5.Query)("limit")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "objects", null);
-_ts_decorate3([
-  (0, import_common3.Get)("disks/:disk/object"),
-  _ts_param3(0, (0, import_common3.Param)("disk")),
-  _ts_param3(1, (0, import_common3.Query)("key")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("disks/:disk/object"),
+  _ts_param5(0, (0, import_common5.Param)("disk")),
+  _ts_param5(1, (0, import_common5.Query)("key")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "object", null);
-_ts_decorate3([
-  (0, import_common3.Get)("disks/:disk/object/raw"),
-  _ts_param3(0, (0, import_common3.Param)("disk")),
-  _ts_param3(1, (0, import_common3.Query)("key")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("disks/:disk/object/raw"),
+  _ts_param5(0, (0, import_common5.Param)("disk")),
+  _ts_param5(1, (0, import_common5.Query)("key")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], MediaConsoleReadController.prototype, "objectRaw", null);
-_ts_decorate3([
-  (0, import_common3.Get)("uploads"),
-  _ts_param3(0, (0, import_common3.Query)("disk")),
-  _ts_param3(1, (0, import_common3.Query)("prefix")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("uploads"),
+  _ts_param5(0, (0, import_common5.Query)("disk")),
+  _ts_param5(1, (0, import_common5.Query)("prefix")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "uploads", null);
-_ts_decorate3([
-  (0, import_common3.Get)("uploads/:id"),
-  _ts_param3(0, (0, import_common3.Param)("id")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("uploads/:id"),
+  _ts_param5(0, (0, import_common5.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "upload", null);
-_ts_decorate3([
-  (0, import_common3.Get)("library/collections"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+_ts_decorate5([
+  (0, import_common5.Get)("library/collections"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "collections", null);
-_ts_decorate3([
-  (0, import_common3.Get)("library"),
-  _ts_param3(0, (0, import_common3.Query)("collection")),
-  _ts_param3(1, (0, import_common3.Query)("disk")),
-  _ts_param3(2, (0, import_common3.Query)("cursor")),
-  _ts_param3(3, (0, import_common3.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("library"),
+  _ts_param5(0, (0, import_common5.Query)("collection")),
+  _ts_param5(1, (0, import_common5.Query)("disk")),
+  _ts_param5(2, (0, import_common5.Query)("cursor")),
+  _ts_param5(3, (0, import_common5.Query)("limit")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "library", null);
-_ts_decorate3([
-  (0, import_common3.Get)("library/:id"),
-  _ts_param3(0, (0, import_common3.Param)("id")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  (0, import_common5.Get)("library/:id"),
+  _ts_param5(0, (0, import_common5.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "libraryRecord", null);
-_ts_decorate3([
-  (0, import_common3.Get)("topology"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Topology === "undefined" ? Object : Topology)
+_ts_decorate5([
+  (0, import_common5.Get)("topology"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof Topology === "undefined" ? Object : Topology)
 ], MediaConsoleReadController.prototype, "topology", null);
-MediaConsoleReadController = _ts_decorate3([
-  (0, import_common3.Controller)(),
-  _ts_param3(0, (0, import_common3.Inject)(MediaConsoleService)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+MediaConsoleReadController = _ts_decorate5([
+  (0, import_common5.UseGuards)(MediaConsoleGuard),
+  (0, import_common5.Controller)(),
+  _ts_param5(0, (0, import_common5.Inject)(MediaConsoleService)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof MediaConsoleService === "undefined" ? Object : MediaConsoleService
   ])
 ], MediaConsoleReadController);
 
 // src/server/media-console-api.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 var MediaConsoleApiModule = class _MediaConsoleApiModule {
   static {
     __name(this, "MediaConsoleApiModule");
   }
-  static register(actions) {
+  static register(options) {
     return {
       module: _MediaConsoleApiModule,
-      controllers: actions ? [
+      imports: options.imports ?? [],
+      controllers: [
         MediaConsoleReadController,
-        MediaConsoleActionsController
-      ] : [
-        MediaConsoleReadController
+        MediaConsoleAuthController,
+        ...options.actions ? [
+          MediaConsoleActionsController
+        ] : []
       ],
       providers: [
         MediaConsoleService,
+        MediaConsoleGuard,
         {
           provide: MEDIA_DASHBOARD_ACTIONS,
-          useValue: actions
-        }
+          useValue: options.actions
+        },
+        {
+          provide: MEDIA_CONSOLE_COOKIE_PATH,
+          useValue: options.cookiePath
+        },
+        options.authProvider
       ],
       exports: [
         MediaConsoleService
@@ -746,32 +1267,32 @@ var MediaConsoleApiModule = class _MediaConsoleApiModule {
     };
   }
 };
-MediaConsoleApiModule = _ts_decorate4([
-  (0, import_common4.Module)({})
+MediaConsoleApiModule = _ts_decorate6([
+  (0, import_common6.Module)({})
 ], MediaConsoleApiModule);
 
 // src/server/media-dashboard-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common5 = require("@nestjs/common");
-function _ts_decorate5(decorators, target, key, desc) {
+var import_common7 = require("@nestjs/common");
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param6, "_ts_param");
 var BUILD_BASE = "/media";
 function spaDir() {
   return (0, import_node_url.fileURLToPath)(new URL("../spa", importMetaUrl));
@@ -802,7 +1323,7 @@ var MediaDashboardUiController = class {
   index() {
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common5.NotFoundException("Console SPA is not built. Run the package build.");
+      throw new import_common7.NotFoundException("Console SPA is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__MEDIA_BASE__='${this.basePath}';window.__MEDIA_API__='${this.apiBasePath}';</script>`;
@@ -810,55 +1331,55 @@ var MediaDashboardUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common5.NotFoundException();
+    if (safe !== file) throw new import_common7.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common5.NotFoundException();
+      throw new import_common7.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common5.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common7.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate5([
-  (0, import_common5.Get)(),
-  (0, import_common5.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common5.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", String)
+_ts_decorate7([
+  (0, import_common7.Get)(),
+  (0, import_common7.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common7.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", String)
 ], MediaDashboardUiController.prototype, "index", null);
-_ts_decorate5([
-  (0, import_common5.Get)("assets/:file"),
-  (0, import_common5.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param4(0, (0, import_common5.Param)("file")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate7([
+  (0, import_common7.Get)("assets/:file"),
+  (0, import_common7.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param6(0, (0, import_common7.Param)("file")),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", typeof import_common5.StreamableFile === "undefined" ? Object : import_common5.StreamableFile)
+  _ts_metadata6("design:returntype", typeof import_common7.StreamableFile === "undefined" ? Object : import_common7.StreamableFile)
 ], MediaDashboardUiController.prototype, "asset", null);
-MediaDashboardUiController = _ts_decorate5([
-  (0, import_common5.Controller)(),
-  _ts_param4(0, (0, import_common5.Inject)(MEDIA_DASHBOARD_BASE_PATH)),
-  _ts_param4(1, (0, import_common5.Inject)(MEDIA_DASHBOARD_API_PATH)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+MediaDashboardUiController = _ts_decorate7([
+  (0, import_common7.Controller)(),
+  _ts_param6(0, (0, import_common7.Inject)(MEDIA_DASHBOARD_BASE_PATH)),
+  _ts_param6(1, (0, import_common7.Inject)(MEDIA_DASHBOARD_API_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String,
     String
   ])
 ], MediaDashboardUiController);
 
 // src/server/media-dashboard.module.ts
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate8, "_ts_decorate");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
@@ -868,13 +1389,34 @@ var MediaDashboardModule = class _MediaDashboardModule {
     __name(this, "MediaDashboardModule");
   }
   static forRoot(options = {}) {
+    const apiBasePath = normalize(options.apiBasePath ?? `${normalize(options.basePath ?? "/media")}/api`);
+    return _MediaDashboardModule.build(options, apiBasePath, {
+      provide: MEDIA_CONSOLE_AUTH,
+      useValue: resolveConsoleAuth(options.auth)
+    });
+  }
+  static forRootAsync(options) {
+    const apiBasePath = normalize(options.apiBasePath ?? `${normalize(options.basePath ?? "/media")}/api`);
+    const authProvider = {
+      provide: MEDIA_CONSOLE_AUTH,
+      inject: options.inject ?? [],
+      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveConsoleAuth(await options.useAuth(...deps)), "useFactory")
+    };
+    return _MediaDashboardModule.build(options, apiBasePath, authProvider, options.imports);
+  }
+  /** Shared wiring: static routing + the API module, with `auth` supplied by the given provider. */
+  static build(options, apiBasePath, authProvider, imports) {
     const basePath = normalize(options.basePath ?? "/media");
-    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
     const actions = options.actions === true;
     return {
       module: _MediaDashboardModule,
       imports: [
-        MediaConsoleApiModule.register(actions),
+        MediaConsoleApiModule.register({
+          actions,
+          cookiePath: apiBasePath,
+          authProvider,
+          imports
+        }),
         import_core.RouterModule.register([
           {
             path: basePath,
@@ -906,8 +1448,8 @@ var MediaDashboardModule = class _MediaDashboardModule {
     };
   }
 };
-MediaDashboardModule = _ts_decorate6([
-  (0, import_common6.Module)({})
+MediaDashboardModule = _ts_decorate8([
+  (0, import_common8.Module)({})
 ], MediaDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {