@hilbras/keystone 1.9.0 → 2.6.0

package/dist/services/trustedProxies.d.ts

@@ -0,0 +1,90 @@
+import type { FastifyRequest } from "fastify";
+/**
+ * Trusted-proxy model.
+ *
+ * ```text
+ * Internet  →  trusted reverse proxy  →  Keystone
+ * ```
+ *
+ * Two rules follow from that diagram, and everything else in this module exists
+ * to enforce them:
+ *
+ *  1. Only a request whose **peer** address is a configured trusted proxy may
+ *     have its forwarded headers believed. `request.ip` cannot be used for this
+ *     decision, because Fastify derives it from `x-forwarded-for` when
+ *     `trustProxy` is on — which is exactly the attacker-controlled value.
+ *  2. The peer address is the only value that cannot be spoofed. Forwarded
+ *     headers are only consulted when (1) holds.
+ *
+ * With no trusted proxies configured, nothing is trusted: the peer address is
+ * used for rate limiting and client-certificate headers are ignored entirely.
+ * The default is therefore fail-closed.
+ */
+/** Headers that carry client identity and must never be believed from an untrusted peer. */
+export declare const IDENTITY_HEADERS: readonly ["x-forwarded-client-cert", "x-client-cert-fingerprint", "x-service-account-id", "x-forwarded-client-cert-chain"];
+/**
+ * Normalize an address so every spelling of the same host compares equal.
+ *
+ * IPv4-mapped IPv6 arrives in two forms — the dotted form `::ffff:127.0.0.1`
+ * and the hex form `::ffff:7f00:1`. Both must collapse to `127.0.0.1`,
+ * otherwise a mapped address slips past an IPv4 CIDR allowlist.
+ */
+export declare function normalizeAddress(address: string | undefined): string;
+/** Does `address` fall inside `cidr`? Supports IPv4 CIDR and exact IPv6. */
+export declare function addressInCidr(address: string, cidr: string): boolean;
+/** Reset the parse cache. Exists for tests that change configuration. */
+export declare function resetTrustedProxyCache(): void;
+/**
+ * Is at least one trusted proxy configured? False means client-identity headers
+ * are stripped from every request and rate limits key on the peer address.
+ */
+export declare function hasTrustedProxies(): boolean;
+export declare function isTrustedProxy(address: string | undefined): boolean;
+/**
+ * The socket's peer address. This is the only value a client cannot forge,
+ * because it is established by the TCP connection rather than by a header.
+ */
+export declare function peerAddress(request: FastifyRequest): string;
+/** True when the immediate peer is a configured trusted proxy. */
+export declare function isFromTrustedProxy(request: FastifyRequest): boolean;
+/**
+ * The client address to use for rate limiting and logging.
+ *
+ * Behind a trusted proxy this is the left-most forwarded address, because the
+ * proxy is the one that appended it. From any other peer the forwarded headers
+ * are ignored, so a client cannot rotate `x-forwarded-for` to obtain a fresh
+ * rate-limit budget.
+ */
+export declare function clientAddress(request: FastifyRequest): string;
+/**
+ * Remove identity and forwarded headers from a request that did not arrive via
+ * a trusted proxy. Stripping rather than merely ignoring means no downstream
+ * route, plugin, or future feature can accidentally read them.
+ *
+ * @returns whether the request was trusted (and therefore kept its headers)
+ */
+export declare function stripUntrustedHeaders(request: FastifyRequest): boolean;
+/** The value Fastify's `trustProxy` option should be given. */
+export declare function fastifyTrustProxySetting(): boolean | string[];
+/**
+ * Does this address look like infrastructure rather than a public client?
+ *
+ * Loopback, RFC 1918, link-local, and unique-local ranges are where reverse
+ * proxies, load balancers, and service meshes live. A request arriving from one
+ * of these while no trusted proxy is configured is the signature of a proxied
+ * deployment that forgot `KEYSTONE_TRUSTED_PROXIES` — which fails silently, as
+ * every client collapsing into a single rate-limit budget.
+ */
+export declare function isInfrastructureAddress(address: string): boolean;
+/**
+ * Why no forwarded headers were believed, or `null` when the peer was trusted.
+ *
+ * Returned so the caller can log a warning only in the case that indicates a
+ * misconfiguration, rather than on every stripped request.
+ */
+export declare function describeUntrustedPeer(address: string): string | null;
+/** A SHA-256 fingerprint, in hex or the colon-separated form AWS ALB emits. */
+export declare function isValidFingerprint(value: string | undefined): value is string;
+/** Canonical fingerprint form used for storage and comparison. */
+export declare function canonicalFingerprint(value: string): string;
+//# sourceMappingURL=trustedProxies.d.ts.map

package/dist/services/trustedProxies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxies.d.ts","sourceRoot":"","sources":["../../src/services/trustedProxies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,YAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,+BAA+B,CACvB,CAAC;AAKX;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAwBpE;AAeD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAwCpE;AAoBD,yEAAyE;AACzE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMnE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE3D;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAW7D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAMtE;AAED,+DAA+D;AAC/D,wBAAgB,wBAAwB,IAAI,OAAO,GAAG,MAAM,EAAE,CAG7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASpE;AAKD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAI7E;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/services/trustedProxies.js

@@ -0,0 +1,283 @@
+import { config } from "../config.js";
+/**
+ * Trusted-proxy model.
+ *
+ * ```text
+ * Internet  →  trusted reverse proxy  →  Keystone
+ * ```
+ *
+ * Two rules follow from that diagram, and everything else in this module exists
+ * to enforce them:
+ *
+ *  1. Only a request whose **peer** address is a configured trusted proxy may
+ *     have its forwarded headers believed. `request.ip` cannot be used for this
+ *     decision, because Fastify derives it from `x-forwarded-for` when
+ *     `trustProxy` is on — which is exactly the attacker-controlled value.
+ *  2. The peer address is the only value that cannot be spoofed. Forwarded
+ *     headers are only consulted when (1) holds.
+ *
+ * With no trusted proxies configured, nothing is trusted: the peer address is
+ * used for rate limiting and client-certificate headers are ignored entirely.
+ * The default is therefore fail-closed.
+ */
+/** Headers that carry client identity and must never be believed from an untrusted peer. */
+export const IDENTITY_HEADERS = [
+    "x-forwarded-client-cert",
+    "x-client-cert-fingerprint",
+    "x-service-account-id",
+    "x-forwarded-client-cert-chain",
+];
+/** Headers that influence the apparent client address. */
+const FORWARDED_HEADERS = ["x-forwarded-for", "x-real-ip", "forwarded"];
+/**
+ * Normalize an address so every spelling of the same host compares equal.
+ *
+ * IPv4-mapped IPv6 arrives in two forms — the dotted form `::ffff:127.0.0.1`
+ * and the hex form `::ffff:7f00:1`. Both must collapse to `127.0.0.1`,
+ * otherwise a mapped address slips past an IPv4 CIDR allowlist.
+ */
+export function normalizeAddress(address) {
+    if (!address)
+        return "";
+    let value = address.trim().toLowerCase();
+    if (value.startsWith("[") && value.endsWith("]"))
+        value = value.slice(1, -1);
+    // Strip a zone index and any port suffix on bare IPv6.
+    const zone = value.indexOf("%");
+    if (zone !== -1)
+        value = value.slice(0, zone);
+    if (value.startsWith("::ffff:")) {
+        const tail = value.slice(7);
+        if (tail.includes("."))
+            return tail;
+        // Hex form: the final two hextets are the IPv4 address.
+        const hextets = tail.split(":");
+        if (hextets.length === 2 && hextets.every((h) => /^[0-9a-f]{1,4}$/.test(h))) {
+            const high = parseInt(hextets[0], 16);
+            const low = parseInt(hextets[1], 16);
+            if (Number.isInteger(high) && Number.isInteger(low)) {
+                return [high >> 8, high & 0xff, low >> 8, low & 0xff].join(".");
+            }
+        }
+        return tail;
+    }
+    return value;
+}
+function toIPv4Octets(address) {
+    const parts = address.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n < 0 || n > 255)
+            return null;
+        octets.push(n);
+    }
+    return octets;
+}
+/** Does `address` fall inside `cidr`? Supports IPv4 CIDR and exact IPv6. */
+export function addressInCidr(address, cidr) {
+    const target = normalizeAddress(address);
+    const range = cidr.trim().toLowerCase();
+    if (!target || !range)
+        return false;
+    if (!range.includes("/"))
+        return target === normalizeAddress(range);
+    const [network, bitsRaw] = range.split("/");
+    const bits = Number(bitsRaw);
+    if (!Number.isInteger(bits))
+        return false;
+    const targetOctets = toIPv4Octets(normalizeAddress(network));
+    const boundOctets = toIPv4Octets(normalizeAddress(network));
+    if (!targetOctets || !boundOctets) {
+        // IPv6: compare the leading `bits` of the hextets. Anything not an exact
+        // or prefix match is treated as outside the range.
+        if (bits < 0 || bits > 128)
+            return false;
+        const left = normalizeAddress(network).split(":");
+        const right = normalizeAddress(target).split(":");
+        if (left.length !== right.length)
+            return false;
+        const hextets = bits / 16;
+        for (let i = 0; i < Math.floor(hextets); i++) {
+            if (left[i] !== right[i])
+                return false;
+        }
+        return true;
+    }
+    if (bits < 0 || bits > 32)
+        return false;
+    const targetV4 = toIPv4Octets(normalizeAddress(target));
+    if (!targetV4)
+        return false;
+    let remaining = bits;
+    for (let i = 0; i < 4; i++) {
+        if (remaining <= 0)
+            break;
+        const take = Math.min(8, remaining);
+        const mask = take === 0 ? 0 : (0xff << (8 - take)) & 0xff;
+        if ((targetV4[i] & mask) !== (boundOctets[i] & mask))
+            return false;
+        remaining -= take;
+    }
+    return true;
+}
+let cachedConfig = null;
+/**
+ * Read the setting at call time rather than from the `config` snapshot, which
+ * is built once at import. Cached on the raw string, so this is cheap while
+ * still picking up a reload.
+ */
+function trustedEntries() {
+    const raw = (process.env.KEYSTONE_TRUSTED_PROXIES ?? config.TRUSTED_PROXIES ?? "").trim();
+    if (cachedConfig?.raw === raw)
+        return cachedConfig.entries;
+    const entries = raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    cachedConfig = { raw, entries };
+    return entries;
+}
+/** Reset the parse cache. Exists for tests that change configuration. */
+export function resetTrustedProxyCache() {
+    cachedConfig = null;
+}
+/**
+ * Is at least one trusted proxy configured? False means client-identity headers
+ * are stripped from every request and rate limits key on the peer address.
+ */
+export function hasTrustedProxies() {
+    return trustedEntries().length > 0;
+}
+export function isTrustedProxy(address) {
+    const entries = trustedEntries();
+    if (entries.length === 0)
+        return false;
+    const target = normalizeAddress(address);
+    if (!target)
+        return false;
+    return entries.some((entry) => addressInCidr(target, entry));
+}
+/**
+ * The socket's peer address. This is the only value a client cannot forge,
+ * because it is established by the TCP connection rather than by a header.
+ */
+export function peerAddress(request) {
+    return normalizeAddress(request.socket?.remoteAddress ?? request.ip);
+}
+/** True when the immediate peer is a configured trusted proxy. */
+export function isFromTrustedProxy(request) {
+    return isTrustedProxy(peerAddress(request));
+}
+/**
+ * The client address to use for rate limiting and logging.
+ *
+ * Behind a trusted proxy this is the left-most forwarded address, because the
+ * proxy is the one that appended it. From any other peer the forwarded headers
+ * are ignored, so a client cannot rotate `x-forwarded-for` to obtain a fresh
+ * rate-limit budget.
+ */
+export function clientAddress(request) {
+    if (!isFromTrustedProxy(request))
+        return peerAddress(request);
+    const xff = request.headers["x-forwarded-for"];
+    if (typeof xff === "string" && xff.trim()) {
+        const first = xff.split(",")[0]?.trim();
+        if (first)
+            return normalizeAddress(first);
+    }
+    const realIp = request.headers["x-real-ip"];
+    if (typeof realIp === "string" && realIp.trim())
+        return normalizeAddress(realIp);
+    return peerAddress(request);
+}
+/**
+ * Remove identity and forwarded headers from a request that did not arrive via
+ * a trusted proxy. Stripping rather than merely ignoring means no downstream
+ * route, plugin, or future feature can accidentally read them.
+ *
+ * @returns whether the request was trusted (and therefore kept its headers)
+ */
+export function stripUntrustedHeaders(request) {
+    if (isFromTrustedProxy(request))
+        return true;
+    for (const header of [...IDENTITY_HEADERS, ...FORWARDED_HEADERS]) {
+        delete request.headers[header];
+    }
+    return false;
+}
+/** The value Fastify's `trustProxy` option should be given. */
+export function fastifyTrustProxySetting() {
+    const entries = trustedEntries();
+    return entries.length > 0 ? entries : false;
+}
+/**
+ * Does this address look like infrastructure rather than a public client?
+ *
+ * Loopback, RFC 1918, link-local, and unique-local ranges are where reverse
+ * proxies, load balancers, and service meshes live. A request arriving from one
+ * of these while no trusted proxy is configured is the signature of a proxied
+ * deployment that forgot `KEYSTONE_TRUSTED_PROXIES` — which fails silently, as
+ * every client collapsing into a single rate-limit budget.
+ */
+export function isInfrastructureAddress(address) {
+    const target = normalizeAddress(address);
+    if (!target)
+        return false;
+    if (target === "127.0.0.1" || target === "::1" || target === "0.0.0.0" || target === "::") {
+        return true;
+    }
+    if (target.startsWith("10."))
+        return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(target))
+        return true;
+    if (target.startsWith("192.168."))
+        return true;
+    if (target.startsWith("169.254."))
+        return true;
+    // IPv6: fe80::/10 link-local, fc00::/7 unique-local. Compare the first
+    // hextet regardless of how many there are, so a fully expanded address
+    // (`fe80:0000:...:0001`) is classified the same as the compressed form.
+    const first = parseInt(target.split(":")[0] ?? "", 16);
+    if (Number.isInteger(first)) {
+        if ((first & 0xffc0) === 0xfe80)
+            return true;
+        if ((first & 0xfe00) === 0xfc00)
+            return true;
+    }
+    return false;
+}
+/**
+ * Why no forwarded headers were believed, or `null` when the peer was trusted.
+ *
+ * Returned so the caller can log a warning only in the case that indicates a
+ * misconfiguration, rather than on every stripped request.
+ */
+export function describeUntrustedPeer(address) {
+    if (hasTrustedProxies())
+        return null;
+    if (!isInfrastructureAddress(address))
+        return null;
+    return ("client-identity headers were stripped from an infrastructure address while " +
+        "KEYSTONE_TRUSTED_PROXIES is unset. If Keystone is behind a reverse proxy, " +
+        "set it to the proxy's address: until then every client shares one rate-limit " +
+        "budget and forwarded client addresses are ignored. See docs/security/proxy-security.md");
+}
+const FINGERPRINT_HEX = /^[0-9a-f]{64}$/i;
+const FINGERPRINT_COLON = /^(?:[0-9a-f]{2}:){31}[0-9a-f]{2}$/i;
+/** A SHA-256 fingerprint, in hex or the colon-separated form AWS ALB emits. */
+export function isValidFingerprint(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim();
+    return FINGERPRINT_HEX.test(normalized) || FINGERPRINT_COLON.test(normalized);
+}
+/** Canonical fingerprint form used for storage and comparison. */
+export function canonicalFingerprint(value) {
+    return value.trim().replace(/:/g, "").toLowerCase();
+}
+//# sourceMappingURL=trustedProxies.js.map

package/dist/services/trustedProxies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxies.js","sourceRoot":"","sources":["../../src/services/trustedProxies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,+BAA+B;CACvB,CAAC;AAEX,0DAA0D;AAC1D,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,uDAAuD;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,YAAY,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,SAAS,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,YAAY,GAA8C,IAAI,CAAC;AAEnE;;;;GAIG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,YAAY,EAAE,GAAG,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,YAAY,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB;IACpC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACjF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,gBAAgB,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,CACL,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wFAAwF,CACzF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAChF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/setup-server.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { fastifyTrustProxySetting } from "./services/trustedProxies.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import fs from "node:fs/promises";
 import fastify from "fastify";
@@ -10,7 +11,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 async function buildSetupApp() {
     const app = fastify({
         logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
-        trustProxy: true,
+        trustProxy: fastifyTrustProxySetting(),
         genReqId: () => crypto.randomUUID(),
     });
     await app.register(cors, {

package/dist/setup-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-server.js","sourceRoot":"","sources":["../src/setup-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;gBACtC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,eAAe,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}
+{"version":3,"file":"setup-server.js","sourceRoot":"","sources":["../src/setup-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,UAAU,EAAE,wBAAwB,EAAE;QACtC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;gBACtC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,eAAe,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}

package/dist/types.d.ts

@@ -52,9 +52,9 @@ export declare function toPublicSamlConnection(connection: SamlConnection): Publ
 export declare function toPublicOidcConnection(connection: OidcConnection): PublicOidcConnection;
 export declare function toPublicApiKey(apiKey: ApiKey): PublicApiKey;
 export declare function toPublicApplication(application: Application | (PublicApplication & {
-    clientSecret?: string;
+    clientSecret?: string | null;
 })): PublicApplication & {
-    clientSecret?: string;
+    clientSecret?: string | null;
 };
 export interface PublicUser {
     id: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,gFAAgF;QAChF,UAAU,CAAC,EAAE,WAAW,CAAC;QACzB,KAAK,EAAE;YACL,GAAG,CAAC,EAAE,WAAW,CAAC;YAClB,GAAG,CAAC,EAAE,YAAY,CAAC;YACnB,UAAU,CAAC,EAAE,aAAa,CAAC;YAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gEAAgE;YAChE,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,6EAA6E;YAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH;IAED,UAAU,eAAe;QACvB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;QAC7C,SAAS,EAAE,SAAS,CAAC;KACtB;CACF;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AACxE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAE1E,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,cAAc,GAAG,oBAAoB,CAGvF;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,cAAc,GAAG,oBAAoB,CAGvF;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAG3D;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,GAAG,CAAC,iBAAiB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACzE,iBAAiB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAK/C;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,GAAG,UAAU,CAgBhE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAM1D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,gFAAgF;QAChF,UAAU,CAAC,EAAE,WAAW,CAAC;QACzB,KAAK,EAAE;YACL,GAAG,CAAC,EAAE,WAAW,CAAC;YAClB,GAAG,CAAC,EAAE,YAAY,CAAC;YACnB,UAAU,CAAC,EAAE,aAAa,CAAC;YAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gEAAgE;YAChE,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,6EAA6E;YAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH;IAED,UAAU,eAAe;QACvB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;QAC7C,SAAS,EAAE,SAAS,CAAC;KACtB;CACF;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACnD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AACxE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAE1E,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,cAAc,GAAG,oBAAoB,CAGvF;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,cAAc,GAAG,oBAAoB,CAGvF;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAG3D;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,GAAG,CAAC,iBAAiB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,GAChF,iBAAiB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAKtD;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,GAAG,UAAU,CAgBhE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAM1D"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAwDA,MAAM,UAAU,sBAAsB,CAAC,UAA0B;IAC/D,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC;IAC1E,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAA0B;IAC/D,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC;IACtE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA0E;IAE1E,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,eAAe,EAAE,GAAG,WAEnE,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAsBD,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAqB;IAC9C,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO;QACL,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,QAAQ,EAAE,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAoC,CAAC,CAAC,CAAC,EAAE;KAChG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAwDA,MAAM,UAAU,sBAAsB,CAAC,UAA0B;IAC/D,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC;IAC1E,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAA0B;IAC/D,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC;IACtE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAAiF;IAEjF,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,eAAe,EAAE,GAAG,WAEnE,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AAsBD,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAqB;IAC9C,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO;QACL,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,QAAQ,EAAE,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAoC,CAAC,CAAC,CAAC,EAAE;KAChG,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@hilbras/keystone",
-  "version": "1.9.0",
+  "version": "2.6.0",
+  "license": "MIT",
   "description": "Hilbras Keystone — standalone identity platform: authentication, MFA, authorization, enterprise SSO, SCIM, and token issuance.",
   "repository": {
     "type": "git",
@@ -12,10 +13,7 @@
   },
   "type": "module",
   "overrides": {
-    "@xmldom/xmldom": "0.8.15",
-    "fast-uri@3.0.0 - 3.1.5": "3.1.8",
-    "fast-uri@4.0.0 - 4.1.2": "4.2.1",
-    "find-my-way": "9.9.0"
+    "esbuild": ">=0.25.0"
   },
   "files": [
     "dist",
@@ -38,6 +36,7 @@
     "start:setup": "KEYSTONE_SETUP_MODE=true node dist/setup-server.js",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint src --deny-warnings",
+    "verify:release": "node scripts/verify-release-metadata.mjs",
     "typecheck:all": "npm run typecheck && cd frontend && npm run build",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",