@dudousxd/nestjs-media-dashboard 0.1.3 → 0.2.1

package/dist/server/index.js

@@ -5,14 +5,256 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 import { Module as Module2 } from "@nestjs/common";
 import { RouterModule } from "@nestjs/core";
 
+// src/server/auth/config.ts
+var DEFAULT_TTL_MS = 8 * 60 * 60 * 1e3;
+var DURATION_UNITS = {
+  s: 1e3,
+  m: 60 * 1e3,
+  h: 60 * 60 * 1e3,
+  d: 24 * 60 * 60 * 1e3
+};
+function durationToMs(ttl) {
+  if (ttl === void 0) return DEFAULT_TTL_MS;
+  const match = /^(\d+)([smhd])$/.exec(ttl.trim());
+  if (!match) return DEFAULT_TTL_MS;
+  const unit = DURATION_UNITS[match[2] ?? ""];
+  if (unit === void 0) return DEFAULT_TTL_MS;
+  return Number(match[1]) * unit;
+}
+__name(durationToMs, "durationToMs");
+function resolveConsoleAuth(options) {
+  if (!options) return null;
+  if (!options.secret) {
+    throw new Error("MediaDashboardModule: auth.secret is required when `auth` is configured.");
+  }
+  const modes = [];
+  if (options.session) modes.push("session");
+  if (options.login) modes.push("login");
+  if (modes.length === 0) {
+    throw new Error("MediaDashboardModule: auth needs a `login` and/or `session` hook.");
+  }
+  return {
+    secret: options.secret,
+    ttlMs: durationToMs(options.ttl),
+    modes,
+    ...options.session ? {
+      session: options.session
+    } : {},
+    ...options.login ? {
+      login: options.login
+    } : {}
+  };
+}
+__name(resolveConsoleAuth, "resolveConsoleAuth");
+
 // src/server/media-console-api.module.ts
 import { Module } from "@nestjs/common";
 
 // src/server/media-console-actions.controller.ts
-import { Body, Controller, Delete, HttpCode, Inject as Inject2, Param, Post, Query, Req } from "@nestjs/common";
+import { Body, Controller, Delete, HttpCode, Inject as Inject3, Param, Post, Query, Req, UseGuards } from "@nestjs/common";
 
-// src/server/media-console.service.ts
-import { BadRequestException, Inject, Injectable, NotFoundException, Optional } from "@nestjs/common";
+// src/server/media-console.guard.ts
+import { Inject, Injectable, Optional, UnauthorizedException } from "@nestjs/common";
+
+// src/server/auth/cookie-header.ts
+function parseCookieHeader(header) {
+  const cookies = {};
+  if (typeof header !== "string" || header === "") return cookies;
+  for (const segment of header.split(";")) {
+    const eq = segment.indexOf("=");
+    if (eq <= 0) continue;
+    const name = segment.slice(0, eq).trim();
+    if (name === "") continue;
+    let rawValue = segment.slice(eq + 1).trim();
+    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
+      rawValue = rawValue.slice(1, -1);
+    }
+    if (name in cookies) continue;
+    try {
+      cookies[name] = decodeURIComponent(rawValue);
+    } catch {
+      cookies[name] = rawValue;
+    }
+  }
+  return cookies;
+}
+__name(parseCookieHeader, "parseCookieHeader");
+function serializeSetCookie(name, value, options) {
+  const parts = [
+    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
+  ];
+  parts.push(`Path=${options.path}`);
+  parts.push("HttpOnly");
+  parts.push("SameSite=Lax");
+  if (options.secure) parts.push("Secure");
+  if (options.clear) {
+    parts.push("Max-Age=0");
+    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+  } else {
+    parts.push(`Max-Age=${options.maxAgeSeconds}`);
+  }
+  return parts.join("; ");
+}
+__name(serializeSetCookie, "serializeSetCookie");
+
+// src/server/auth/request.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord, "isRecord");
+function readHeaders(request) {
+  if (!isRecord(request)) return {};
+  const headers = request.headers;
+  return isRecord(headers) ? headers : {};
+}
+__name(readHeaders, "readHeaders");
+function headerToString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
+    return value.join(",");
+  }
+  return void 0;
+}
+__name(headerToString, "headerToString");
+function readCookieHeader(request) {
+  return headerToString(readHeaders(request).cookie);
+}
+__name(readCookieHeader, "readCookieHeader");
+function isHttpsRequest(request) {
+  if (isRecord(request) && request.protocol === "https") return true;
+  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
+  if (forwarded === void 0) return false;
+  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
+}
+__name(isHttpsRequest, "isHttpsRequest");
+function attachSession(request, session) {
+  if (!isRecord(request)) return;
+  request.consoleSession = session;
+}
+__name(attachSession, "attachSession");
+
+// src/server/auth/response.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord2, "isRecord");
+function isRawNodeResponse(value) {
+  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
+}
+__name(isRawNodeResponse, "isRawNodeResponse");
+function resolveRawResponse(response) {
+  if (isRawNodeResponse(response)) return response;
+  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveRawResponse, "resolveRawResponse");
+function existingSetCookies(response) {
+  const current = response.getHeader("set-cookie");
+  if (Array.isArray(current)) return current;
+  if (typeof current === "string") return [
+    current
+  ];
+  return [];
+}
+__name(existingSetCookies, "existingSetCookies");
+function appendSetCookie(response, cookie) {
+  const raw = resolveRawResponse(response);
+  if (!raw) return;
+  raw.setHeader("set-cookie", [
+    ...existingSetCookies(raw),
+    cookie
+  ]);
+}
+__name(appendSetCookie, "appendSetCookie");
+
+// src/server/auth/session-cookie.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+var EXP_GRACE_MS = 3e4;
+function base64urlEncode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+__name(base64urlEncode, "base64urlEncode");
+function base64urlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+__name(base64urlDecode, "base64urlDecode");
+function hmac(secret, payload) {
+  return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+__name(hmac, "hmac");
+function signSessionCookie(user, options) {
+  const issuedAt = options.now ?? Date.now();
+  const session = {
+    sub: user.id,
+    ...user.name !== void 0 ? {
+      name: user.name
+    } : {},
+    roles: user.roles ?? [],
+    iat: issuedAt,
+    exp: issuedAt + options.ttlMs
+  };
+  const encodedPayload = base64urlEncode(JSON.stringify(session));
+  return `${encodedPayload}.${hmac(options.secret, encodedPayload)}`;
+}
+__name(signSessionCookie, "signSessionCookie");
+function isSessionPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  if (typeof record.sub !== "string") return false;
+  if (record.name !== void 0 && typeof record.name !== "string") return false;
+  if (!Array.isArray(record.roles)) return false;
+  if (!record.roles.every((role) => typeof role === "string")) return false;
+  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
+  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
+  return true;
+}
+__name(isSessionPayload, "isSessionPayload");
+function verifySessionCookie(value, options) {
+  try {
+    const dot = value.indexOf(".");
+    if (dot <= 0 || dot === value.length - 1) return null;
+    const encodedPayload = value.slice(0, dot);
+    const provided = Buffer.from(value.slice(dot + 1), "base64url");
+    const expected = Buffer.from(hmac(options.secret, encodedPayload), "base64url");
+    if (provided.length !== expected.length) return null;
+    if (!timingSafeEqual(provided, expected)) return null;
+    const decoded = JSON.parse(base64urlDecode(encodedPayload));
+    if (!isSessionPayload(decoded)) return null;
+    const now = options.now ?? Date.now();
+    if (now > decoded.exp + EXP_GRACE_MS) return null;
+    return decoded;
+  } catch {
+    return null;
+  }
+}
+__name(verifySessionCookie, "verifySessionCookie");
+
+// src/server/auth/session-cookie-io.ts
+var SESSION_COOKIE_NAME = "media_console_session";
+function issueSessionCookie(user, context) {
+  const value = signSessionCookie(user, {
+    secret: context.auth.secret,
+    ttlMs: context.auth.ttlMs,
+    ...context.now !== void 0 ? {
+      now: context.now
+    } : {}
+  });
+  appendSetCookie(context.response, serializeSetCookie(SESSION_COOKIE_NAME, value, {
+    path: context.cookiePath,
+    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
+    secure: isHttpsRequest(context.request)
+  }));
+}
+__name(issueSessionCookie, "issueSessionCookie");
+function clearSessionCookie(context) {
+  appendSetCookie(context.response, serializeSetCookie(SESSION_COOKIE_NAME, "", {
+    path: context.cookiePath,
+    maxAgeSeconds: 0,
+    secure: isHttpsRequest(context.request),
+    clear: true
+  }));
+}
+__name(clearSessionCookie, "clearSessionCookie");
 
 // src/server/tokens.ts
 var MEDIA_STORE = Symbol.for("nestjs-media:store");
@@ -21,8 +263,10 @@ var MEDIA_STORAGE_SHARED = Symbol.for("nestjs-media:storage");
 var MEDIA_DASHBOARD_BASE_PATH = Symbol("MEDIA_DASHBOARD_BASE_PATH");
 var MEDIA_DASHBOARD_API_PATH = Symbol("MEDIA_DASHBOARD_API_PATH");
 var MEDIA_DASHBOARD_ACTIONS = Symbol("MEDIA_DASHBOARD_ACTIONS");
+var MEDIA_CONSOLE_AUTH = Symbol("MEDIA_CONSOLE_AUTH");
+var MEDIA_CONSOLE_COOKIE_PATH = Symbol("MEDIA_CONSOLE_COOKIE_PATH");
 
-// src/server/media-console.service.ts
+// src/server/media-console.guard.ts
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -40,6 +284,89 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
+var MediaConsoleGuard = class {
+  static {
+    __name(this, "MediaConsoleGuard");
+  }
+  auth;
+  cookiePath;
+  constructor(auth, cookiePath) {
+    this.auth = auth;
+    this.cookiePath = cookiePath;
+  }
+  canActivate(context) {
+    if (!this.auth) return true;
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const session = this.verifyRequestSession(request);
+    if (!session) throw new UnauthorizedException();
+    attachSession(request, session);
+    this.maybeRenew(http.getResponse(), request, session);
+    return true;
+  }
+  verifyRequestSession(request) {
+    if (!this.auth) return null;
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return null;
+    return verifySessionCookie(cookieValue, {
+      secret: this.auth.secret
+    });
+  }
+  /**
+  * Sliding renewal: when a valid cookie is past half its TTL, re-issue a fresh one so active users
+  * never get logged out mid-session. Appends a new Set-Cookie (preserving any others already set).
+  */
+  maybeRenew(response, request, session) {
+    if (!this.auth) return;
+    const now = Date.now();
+    if (now - session.iat <= this.auth.ttlMs / 2) return;
+    issueSessionCookie({
+      id: session.sub,
+      ...session.name !== void 0 ? {
+        name: session.name
+      } : {},
+      roles: session.roles
+    }, {
+      auth: this.auth,
+      cookiePath: this.cookiePath ?? "/",
+      request,
+      response,
+      now
+    });
+  }
+};
+MediaConsoleGuard = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Optional()),
+  _ts_param(0, Inject(MEDIA_CONSOLE_AUTH)),
+  _ts_param(1, Optional()),
+  _ts_param(1, Inject(MEDIA_CONSOLE_COOKIE_PATH)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    Object,
+    Object
+  ])
+], MediaConsoleGuard);
+
+// src/server/media-console.service.ts
+import { BadRequestException, Inject as Inject2, Injectable as Injectable2, NotFoundException, Optional as Optional2 } from "@nestjs/common";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var URL_TTL_SECONDS = 300;
 var DEFAULT_PAGE_LIMIT = 50;
 function lastSegment(prefix) {
@@ -144,9 +471,7 @@ var MediaConsoleService = class {
   }
   async objectDetail(disk, key) {
     const driver = this.diskOrThrow(disk);
-    const stat = driver.stat ? await driver.stat(key) : {
-      size: await driver.size(key)
-    };
+    const stat = await driver.stat(key);
     const url = driver.capabilities.presign ? await driver.temporaryUrl(key, URL_TTL_SECONDS) : await driver.url(key);
     return {
       key,
@@ -165,9 +490,7 @@ var MediaConsoleService = class {
   *  (and so a CORS-locked bucket is still previewable). */
   async objectStream(disk, key) {
     const driver = this.diskOrThrow(disk);
-    const stat = driver.stat ? await driver.stat(key) : {
-      size: await driver.size(key)
-    };
+    const stat = await driver.stat(key);
     const stream = await driver.stream(key);
     return {
       stream,
@@ -301,18 +624,18 @@ var MediaConsoleService = class {
     };
   }
 };
-MediaConsoleService = _ts_decorate([
-  Injectable(),
-  _ts_param(0, Optional()),
-  _ts_param(0, Inject(MEDIA_STORAGE_SHARED)),
-  _ts_param(1, Optional()),
-  _ts_param(1, Inject(MEDIA_STORE)),
-  _ts_param(2, Optional()),
-  _ts_param(2, Inject(MEDIA_UPLOAD_SESSIONS)),
-  _ts_param(3, Optional()),
-  _ts_param(3, Inject(MEDIA_DASHBOARD_ACTIONS)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+MediaConsoleService = _ts_decorate2([
+  Injectable2(),
+  _ts_param2(0, Optional2()),
+  _ts_param2(0, Inject2(MEDIA_STORAGE_SHARED)),
+  _ts_param2(1, Optional2()),
+  _ts_param2(1, Inject2(MEDIA_STORE)),
+  _ts_param2(2, Optional2()),
+  _ts_param2(2, Inject2(MEDIA_UPLOAD_SESSIONS)),
+  _ts_param2(3, Optional2()),
+  _ts_param2(3, Inject2(MEDIA_DASHBOARD_ACTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     Object,
     Object,
     Object,
@@ -321,23 +644,23 @@ MediaConsoleService = _ts_decorate([
 ], MediaConsoleService);
 
 // src/server/media-console-actions.controller.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var MediaConsoleActionsController = class {
   static {
     __name(this, "MediaConsoleActionsController");
@@ -373,118 +696,303 @@ var MediaConsoleActionsController = class {
     return this.service.deleteLibraryRecord(id);
   }
 };
-_ts_decorate2([
+_ts_decorate3([
   Delete("disks/:disk/object"),
   HttpCode(204),
-  _ts_param2(0, Param("disk")),
-  _ts_param2(1, Query("key")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("disk")),
+  _ts_param3(1, Query("key")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "deleteObject", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("disks/:disk/copy"),
   HttpCode(204),
-  _ts_param2(0, Param("disk")),
-  _ts_param2(1, Body()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("disk")),
+  _ts_param3(1, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     typeof CopyMoveBody === "undefined" ? Object : CopyMoveBody
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "copyObject", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("disks/:disk/move"),
   HttpCode(204),
-  _ts_param2(0, Param("disk")),
-  _ts_param2(1, Body()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("disk")),
+  _ts_param3(1, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     typeof CopyMoveBody === "undefined" ? Object : CopyMoveBody
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "moveObject", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("disks/:disk/upload"),
   HttpCode(204),
-  _ts_param2(0, Param("disk")),
-  _ts_param2(1, Query("key")),
-  _ts_param2(2, Req()),
-  _ts_param2(3, Query("type")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("disk")),
+  _ts_param3(1, Query("key")),
+  _ts_param3(2, Req()),
+  _ts_param3(3, Query("type")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     typeof Readable === "undefined" ? Object : Readable,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "uploadObject", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("disks/:disk/folder"),
   HttpCode(204),
-  _ts_param2(0, Param("disk")),
-  _ts_param2(1, Body()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("disk")),
+  _ts_param3(1, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     typeof CreateFolderBody === "undefined" ? Object : CreateFolderBody
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "createFolder", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("uploads/:id/abort"),
   HttpCode(204),
-  _ts_param2(0, Param("id")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "abortUpload", null);
-_ts_decorate2([
+_ts_decorate3([
   Delete("library/:id"),
   HttpCode(204),
-  _ts_param2(0, Param("id")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "deleteLibraryRecord", null);
-MediaConsoleActionsController = _ts_decorate2([
+MediaConsoleActionsController = _ts_decorate3([
+  UseGuards(MediaConsoleGuard),
   Controller(),
-  _ts_param2(0, Inject2(MediaConsoleService)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Inject3(MediaConsoleService)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof MediaConsoleService === "undefined" ? Object : MediaConsoleService
   ])
 ], MediaConsoleActionsController);
 
+// src/server/media-console-auth.controller.ts
+import { BadRequestException as BadRequestException2, Body as Body2, Controller as Controller2, Get, HttpCode as HttpCode2, Inject as Inject4, Logger, NotFoundException as NotFoundException2, Optional as Optional3, Post as Post2, Req as Req2, Res, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var MediaConsoleAuthController = class _MediaConsoleAuthController {
+  static {
+    __name(this, "MediaConsoleAuthController");
+  }
+  auth;
+  cookiePath;
+  logger = new Logger(_MediaConsoleAuthController.name);
+  /** One warn per hook kind, so a flaky hook doesn't spam logs every request. */
+  warnedHooks = /* @__PURE__ */ new Set();
+  constructor(auth, cookiePath) {
+    this.auth = auth;
+    this.cookiePath = cookiePath;
+  }
+  me(request) {
+    if (!this.auth) return {
+      authRequired: false
+    };
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    const session = cookieValue !== void 0 ? verifySessionCookie(cookieValue, {
+      secret: this.auth.secret
+    }) : null;
+    if (!session) throw new UnauthorizedException2({
+      auth: {
+        modes: this.auth.modes
+      }
+    });
+    return {
+      user: {
+        id: session.sub,
+        ...session.name !== void 0 ? {
+          name: session.name
+        } : {},
+        roles: session.roles
+      }
+    };
+  }
+  async login(body, request, response) {
+    const auth = this.requireAuth();
+    if (!auth.login) throw new NotFoundException2();
+    if (typeof body?.username !== "string" || typeof body?.password !== "string") {
+      throw new BadRequestException2("Body must include string `username` and `password`.");
+    }
+    const username = body.username;
+    const password = body.password;
+    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
+    if (!user) throw new UnauthorizedException2({
+      message: "Invalid credentials"
+    });
+    return this.mint(user, request, response);
+  }
+  async session(request, response) {
+    const auth = this.requireAuth();
+    if (!auth.session) throw new NotFoundException2();
+    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
+    if (!user) throw new UnauthorizedException2();
+    return this.mint(user, request, response);
+  }
+  logout(request, response) {
+    clearSessionCookie({
+      cookiePath: this.cookiePath ?? "/",
+      request,
+      response
+    });
+  }
+  requireAuth() {
+    if (!this.auth) throw new NotFoundException2();
+    return this.auth;
+  }
+  mint(user, request, response) {
+    const auth = this.requireAuth();
+    issueSessionCookie(user, {
+      auth,
+      cookiePath: this.cookiePath ?? "/",
+      request,
+      response
+    });
+    return {
+      user: {
+        id: user.id,
+        ...user.name !== void 0 ? {
+          name: user.name
+        } : {},
+        roles: user.roles ?? []
+      }
+    };
+  }
+  /** Run a host hook defensively: a throw is a denial (null), warn-logged once per kind. */
+  async runHook(kind, run) {
+    try {
+      return await run() ?? null;
+    } catch (error) {
+      if (!this.warnedHooks.has(kind)) {
+        this.warnedHooks.add(kind);
+        this.logger.warn(`Console auth ${kind} hook threw; treating as denial. ${String(error)}`);
+      }
+      return null;
+    }
+  }
+};
+_ts_decorate4([
+  Get("me"),
+  _ts_param4(0, Req2()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object
+  ]),
+  _ts_metadata4("design:returntype", typeof MeResponse === "undefined" ? Object : MeResponse)
+], MediaConsoleAuthController.prototype, "me", null);
+_ts_decorate4([
+  Post2("login"),
+  HttpCode2(200),
+  _ts_param4(0, Body2()),
+  _ts_param4(1, Req2()),
+  _ts_param4(2, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof LoginBody === "undefined" ? Object : LoginBody,
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], MediaConsoleAuthController.prototype, "login", null);
+_ts_decorate4([
+  Post2("session"),
+  HttpCode2(200),
+  _ts_param4(0, Req2()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], MediaConsoleAuthController.prototype, "session", null);
+_ts_decorate4([
+  Post2("logout"),
+  HttpCode2(204),
+  _ts_param4(0, Req2()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", void 0)
+], MediaConsoleAuthController.prototype, "logout", null);
+MediaConsoleAuthController = _ts_decorate4([
+  Controller2(),
+  _ts_param4(0, Optional3()),
+  _ts_param4(0, Inject4(MEDIA_CONSOLE_AUTH)),
+  _ts_param4(1, Optional3()),
+  _ts_param4(1, Inject4(MEDIA_CONSOLE_COOKIE_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ])
+], MediaConsoleAuthController);
+
 // src/server/media-console-read.controller.ts
-import { Controller as Controller2, Get, Inject as Inject3, Param as Param2, Query as Query2, StreamableFile } from "@nestjs/common";
-function _ts_decorate3(decorators, target, key, desc) {
+import { Controller as Controller3, Get as Get2, Inject as Inject5, Param as Param2, Query as Query2, StreamableFile, UseGuards as UseGuards2 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param5, "_ts_param");
 function toLimit(value) {
   if (value === void 0) return void 0;
   const parsed = Number(value);
@@ -571,141 +1079,150 @@ var MediaConsoleReadController = class {
     return this.service.topology();
   }
 };
-_ts_decorate3([
-  Get("disks"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof DiskListResponse === "undefined" ? Object : DiskListResponse)
+_ts_decorate5([
+  Get2("disks"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof DiskListResponse === "undefined" ? Object : DiskListResponse)
 ], MediaConsoleReadController.prototype, "disks", null);
-_ts_decorate3([
-  Get("disks/:disk/objects"),
-  _ts_param3(0, Param2("disk")),
-  _ts_param3(1, Query2("prefix")),
-  _ts_param3(2, Query2("cursor")),
-  _ts_param3(3, Query2("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("disks/:disk/objects"),
+  _ts_param5(0, Param2("disk")),
+  _ts_param5(1, Query2("prefix")),
+  _ts_param5(2, Query2("cursor")),
+  _ts_param5(3, Query2("limit")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "objects", null);
-_ts_decorate3([
-  Get("disks/:disk/object"),
-  _ts_param3(0, Param2("disk")),
-  _ts_param3(1, Query2("key")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("disks/:disk/object"),
+  _ts_param5(0, Param2("disk")),
+  _ts_param5(1, Query2("key")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "object", null);
-_ts_decorate3([
-  Get("disks/:disk/object/raw"),
-  _ts_param3(0, Param2("disk")),
-  _ts_param3(1, Query2("key")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("disks/:disk/object/raw"),
+  _ts_param5(0, Param2("disk")),
+  _ts_param5(1, Query2("key")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], MediaConsoleReadController.prototype, "objectRaw", null);
-_ts_decorate3([
-  Get("uploads"),
-  _ts_param3(0, Query2("disk")),
-  _ts_param3(1, Query2("prefix")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("uploads"),
+  _ts_param5(0, Query2("disk")),
+  _ts_param5(1, Query2("prefix")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "uploads", null);
-_ts_decorate3([
-  Get("uploads/:id"),
-  _ts_param3(0, Param2("id")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("uploads/:id"),
+  _ts_param5(0, Param2("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "upload", null);
-_ts_decorate3([
-  Get("library/collections"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+_ts_decorate5([
+  Get2("library/collections"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "collections", null);
-_ts_decorate3([
-  Get("library"),
-  _ts_param3(0, Query2("collection")),
-  _ts_param3(1, Query2("disk")),
-  _ts_param3(2, Query2("cursor")),
-  _ts_param3(3, Query2("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("library"),
+  _ts_param5(0, Query2("collection")),
+  _ts_param5(1, Query2("disk")),
+  _ts_param5(2, Query2("cursor")),
+  _ts_param5(3, Query2("limit")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "library", null);
-_ts_decorate3([
-  Get("library/:id"),
-  _ts_param3(0, Param2("id")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate5([
+  Get2("library/:id"),
+  _ts_param5(0, Param2("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "libraryRecord", null);
-_ts_decorate3([
-  Get("topology"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Topology === "undefined" ? Object : Topology)
+_ts_decorate5([
+  Get2("topology"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof Topology === "undefined" ? Object : Topology)
 ], MediaConsoleReadController.prototype, "topology", null);
-MediaConsoleReadController = _ts_decorate3([
-  Controller2(),
-  _ts_param3(0, Inject3(MediaConsoleService)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+MediaConsoleReadController = _ts_decorate5([
+  UseGuards2(MediaConsoleGuard),
+  Controller3(),
+  _ts_param5(0, Inject5(MediaConsoleService)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof MediaConsoleService === "undefined" ? Object : MediaConsoleService
   ])
 ], MediaConsoleReadController);
 
 // src/server/media-console-api.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 var MediaConsoleApiModule = class _MediaConsoleApiModule {
   static {
     __name(this, "MediaConsoleApiModule");
   }
-  static register(actions) {
+  static register(options) {
     return {
       module: _MediaConsoleApiModule,
-      controllers: actions ? [
+      imports: options.imports ?? [],
+      controllers: [
         MediaConsoleReadController,
-        MediaConsoleActionsController
-      ] : [
-        MediaConsoleReadController
+        MediaConsoleAuthController,
+        ...options.actions ? [
+          MediaConsoleActionsController
+        ] : []
       ],
       providers: [
         MediaConsoleService,
+        MediaConsoleGuard,
         {
           provide: MEDIA_DASHBOARD_ACTIONS,
-          useValue: actions
-        }
+          useValue: options.actions
+        },
+        {
+          provide: MEDIA_CONSOLE_COOKIE_PATH,
+          useValue: options.cookiePath
+        },
+        options.authProvider
       ],
       exports: [
         MediaConsoleService
@@ -713,7 +1230,7 @@ var MediaConsoleApiModule = class _MediaConsoleApiModule {
     };
   }
 };
-MediaConsoleApiModule = _ts_decorate4([
+MediaConsoleApiModule = _ts_decorate6([
   Module({})
 ], MediaConsoleApiModule);
 
@@ -721,24 +1238,24 @@ MediaConsoleApiModule = _ts_decorate4([
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller3, Get as Get2, Header, Inject as Inject4, NotFoundException as NotFoundException2, Param as Param3, StreamableFile as StreamableFile2 } from "@nestjs/common";
-function _ts_decorate5(decorators, target, key, desc) {
+import { Controller as Controller4, Get as Get3, Header, Inject as Inject6, NotFoundException as NotFoundException3, Param as Param3, StreamableFile as StreamableFile2 } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param6, "_ts_param");
 var BUILD_BASE = "/media";
 function spaDir() {
   return fileURLToPath(new URL("../spa", import.meta.url));
@@ -769,7 +1286,7 @@ var MediaDashboardUiController = class {
   index() {
     const indexPath = join(this.dir, "index.html");
     if (!existsSync(indexPath)) {
-      throw new NotFoundException2("Console SPA is not built. Run the package build.");
+      throw new NotFoundException3("Console SPA is not built. Run the package build.");
     }
     const html = readFileSync(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__MEDIA_BASE__='${this.basePath}';window.__MEDIA_API__='${this.apiBasePath}';</script>`;
@@ -777,11 +1294,11 @@ var MediaDashboardUiController = class {
   }
   asset(file) {
     const safe = basename(file);
-    if (safe !== file) throw new NotFoundException2();
+    if (safe !== file) throw new NotFoundException3();
     const root = resolve(this.dir, "assets");
     const assetPath = resolve(root, safe);
     if (!assetPath.startsWith(root + sep) || !existsSync(assetPath)) {
-      throw new NotFoundException2();
+      throw new NotFoundException3();
     }
     const type = CONTENT_TYPES[extname(safe)] ?? "application/octet-stream";
     return new StreamableFile2(readFileSync(assetPath), {
@@ -789,43 +1306,43 @@ var MediaDashboardUiController = class {
     });
   }
 };
-_ts_decorate5([
-  Get2(),
+_ts_decorate7([
+  Get3(),
   Header("Content-Type", "text/html; charset=utf-8"),
   Header("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", String)
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", String)
 ], MediaDashboardUiController.prototype, "index", null);
-_ts_decorate5([
-  Get2("assets/:file"),
+_ts_decorate7([
+  Get3("assets/:file"),
   Header("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param4(0, Param3("file")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param6(0, Param3("file")),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", typeof StreamableFile2 === "undefined" ? Object : StreamableFile2)
+  _ts_metadata6("design:returntype", typeof StreamableFile2 === "undefined" ? Object : StreamableFile2)
 ], MediaDashboardUiController.prototype, "asset", null);
-MediaDashboardUiController = _ts_decorate5([
-  Controller3(),
-  _ts_param4(0, Inject4(MEDIA_DASHBOARD_BASE_PATH)),
-  _ts_param4(1, Inject4(MEDIA_DASHBOARD_API_PATH)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+MediaDashboardUiController = _ts_decorate7([
+  Controller4(),
+  _ts_param6(0, Inject6(MEDIA_DASHBOARD_BASE_PATH)),
+  _ts_param6(1, Inject6(MEDIA_DASHBOARD_API_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String,
     String
   ])
 ], MediaDashboardUiController);
 
 // src/server/media-dashboard.module.ts
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate8, "_ts_decorate");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
@@ -835,13 +1352,34 @@ var MediaDashboardModule = class _MediaDashboardModule {
     __name(this, "MediaDashboardModule");
   }
   static forRoot(options = {}) {
+    const apiBasePath = normalize(options.apiBasePath ?? `${normalize(options.basePath ?? "/media")}/api`);
+    return _MediaDashboardModule.build(options, apiBasePath, {
+      provide: MEDIA_CONSOLE_AUTH,
+      useValue: resolveConsoleAuth(options.auth)
+    });
+  }
+  static forRootAsync(options) {
+    const apiBasePath = normalize(options.apiBasePath ?? `${normalize(options.basePath ?? "/media")}/api`);
+    const authProvider = {
+      provide: MEDIA_CONSOLE_AUTH,
+      inject: options.inject ?? [],
+      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveConsoleAuth(await options.useAuth(...deps)), "useFactory")
+    };
+    return _MediaDashboardModule.build(options, apiBasePath, authProvider, options.imports);
+  }
+  /** Shared wiring: static routing + the API module, with `auth` supplied by the given provider. */
+  static build(options, apiBasePath, authProvider, imports) {
     const basePath = normalize(options.basePath ?? "/media");
-    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
     const actions = options.actions === true;
     return {
       module: _MediaDashboardModule,
       imports: [
-        MediaConsoleApiModule.register(actions),
+        MediaConsoleApiModule.register({
+          actions,
+          cookiePath: apiBasePath,
+          authProvider,
+          imports
+        }),
         RouterModule.register([
           {
             path: basePath,
@@ -873,7 +1411,7 @@ var MediaDashboardModule = class _MediaDashboardModule {
     };
   }
 };
-MediaDashboardModule = _ts_decorate6([
+MediaDashboardModule = _ts_decorate8([
   Module2({})
 ], MediaDashboardModule);
 export {