alepha 0.13.5 → 0.13.7

package/dist/server-auth/index.d.ts

@@ -1,4 +1,4 @@
-import * as alepha147 from "alepha";
+import * as alepha188 from "alepha";
 import { Alepha, Async, KIND, Primitive, Static } from "alepha";
 import * as alepha_server_cookies0 from "alepha/server/cookies";
 import { Cookies, ServerCookiesProvider } from "alepha/server/cookies";
@@ -20,82 +20,82 @@ declare const alephaServerAuthRoutes: {
 };
 //#endregion
 //#region ../../src/server-auth/schemas/authenticationProviderSchema.d.ts
-declare const authenticationProviderSchema: alepha147.TObject<{
-  name: alepha147.TString;
-  type: alepha147.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+declare const authenticationProviderSchema: alepha188.TObject<{
+  name: alepha188.TString;
+  type: alepha188.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
 }>;
 type AuthenticationProvider = Static<typeof authenticationProviderSchema>;
 //#endregion
 //#region ../../src/server-auth/schemas/tokenResponseSchema.d.ts
-declare const tokenResponseSchema: alepha147.TObject<{
-  provider: alepha147.TString;
-  access_token: alepha147.TString;
-  issued_at: alepha147.TNumber;
-  expires_in: alepha147.TOptional<alepha147.TNumber>;
-  refresh_token: alepha147.TOptional<alepha147.TString>;
-  refresh_token_expires_in: alepha147.TOptional<alepha147.TNumber>;
-  refresh_expires_in: alepha147.TOptional<alepha147.TNumber>;
-  id_token: alepha147.TOptional<alepha147.TString>;
-  scope: alepha147.TOptional<alepha147.TString>;
-  user: alepha147.TObject<{
-    id: alepha147.TString;
-    name: alepha147.TOptional<alepha147.TString>;
-    email: alepha147.TOptional<alepha147.TString>;
-    username: alepha147.TOptional<alepha147.TString>;
-    picture: alepha147.TOptional<alepha147.TString>;
-    sessionId: alepha147.TOptional<alepha147.TString>;
-    organizations: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
-    roles: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
+declare const tokenResponseSchema: alepha188.TObject<{
+  provider: alepha188.TString;
+  access_token: alepha188.TString;
+  issued_at: alepha188.TNumber;
+  expires_in: alepha188.TOptional<alepha188.TNumber>;
+  refresh_token: alepha188.TOptional<alepha188.TString>;
+  refresh_token_expires_in: alepha188.TOptional<alepha188.TNumber>;
+  refresh_expires_in: alepha188.TOptional<alepha188.TNumber>;
+  id_token: alepha188.TOptional<alepha188.TString>;
+  scope: alepha188.TOptional<alepha188.TString>;
+  user: alepha188.TObject<{
+    id: alepha188.TString;
+    name: alepha188.TOptional<alepha188.TString>;
+    email: alepha188.TOptional<alepha188.TString>;
+    username: alepha188.TOptional<alepha188.TString>;
+    picture: alepha188.TOptional<alepha188.TString>;
+    sessionId: alepha188.TOptional<alepha188.TString>;
+    organizations: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
+    roles: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
   }>;
-  api: alepha147.TObject<{
-    prefix: alepha147.TOptional<alepha147.TString>;
-    links: alepha147.TArray<alepha147.TObject<{
-      name: alepha147.TString;
-      group: alepha147.TOptional<alepha147.TString>;
-      path: alepha147.TString;
-      method: alepha147.TOptional<alepha147.TString>;
-      requestBodyType: alepha147.TOptional<alepha147.TString>;
-      service: alepha147.TOptional<alepha147.TString>;
+  api: alepha188.TObject<{
+    prefix: alepha188.TOptional<alepha188.TString>;
+    links: alepha188.TArray<alepha188.TObject<{
+      name: alepha188.TString;
+      group: alepha188.TOptional<alepha188.TString>;
+      path: alepha188.TString;
+      method: alepha188.TOptional<alepha188.TString>;
+      requestBodyType: alepha188.TOptional<alepha188.TString>;
+      service: alepha188.TOptional<alepha188.TString>;
     }>>;
   }>;
 }>;
 type TokenResponse = Static<typeof tokenResponseSchema>;
 //#endregion
 //#region ../../src/server-auth/schemas/tokensSchema.d.ts
-declare const tokensSchema: alepha147.TObject<{
-  provider: alepha147.TString;
-  access_token: alepha147.TString;
-  issued_at: alepha147.TNumber;
-  expires_in: alepha147.TOptional<alepha147.TNumber>;
-  refresh_token: alepha147.TOptional<alepha147.TString>;
-  refresh_token_expires_in: alepha147.TOptional<alepha147.TNumber>;
-  refresh_expires_in: alepha147.TOptional<alepha147.TNumber>;
-  id_token: alepha147.TOptional<alepha147.TString>;
-  scope: alepha147.TOptional<alepha147.TString>;
+declare const tokensSchema: alepha188.TObject<{
+  provider: alepha188.TString;
+  access_token: alepha188.TString;
+  issued_at: alepha188.TNumber;
+  expires_in: alepha188.TOptional<alepha188.TNumber>;
+  refresh_token: alepha188.TOptional<alepha188.TString>;
+  refresh_token_expires_in: alepha188.TOptional<alepha188.TNumber>;
+  refresh_expires_in: alepha188.TOptional<alepha188.TNumber>;
+  id_token: alepha188.TOptional<alepha188.TString>;
+  scope: alepha188.TOptional<alepha188.TString>;
 }>;
 type Tokens = Static<typeof tokensSchema>;
 //#endregion
 //#region ../../src/server-auth/schemas/userinfoResponseSchema.d.ts
-declare const userinfoResponseSchema: alepha147.TObject<{
-  user: alepha147.TOptional<alepha147.TObject<{
-    id: alepha147.TString;
-    name: alepha147.TOptional<alepha147.TString>;
-    email: alepha147.TOptional<alepha147.TString>;
-    username: alepha147.TOptional<alepha147.TString>;
-    picture: alepha147.TOptional<alepha147.TString>;
-    sessionId: alepha147.TOptional<alepha147.TString>;
-    organizations: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
-    roles: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
+declare const userinfoResponseSchema: alepha188.TObject<{
+  user: alepha188.TOptional<alepha188.TObject<{
+    id: alepha188.TString;
+    name: alepha188.TOptional<alepha188.TString>;
+    email: alepha188.TOptional<alepha188.TString>;
+    username: alepha188.TOptional<alepha188.TString>;
+    picture: alepha188.TOptional<alepha188.TString>;
+    sessionId: alepha188.TOptional<alepha188.TString>;
+    organizations: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
+    roles: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
   }>>;
-  api: alepha147.TObject<{
-    prefix: alepha147.TOptional<alepha147.TString>;
-    links: alepha147.TArray<alepha147.TObject<{
-      name: alepha147.TString;
-      group: alepha147.TOptional<alepha147.TString>;
-      path: alepha147.TString;
-      method: alepha147.TOptional<alepha147.TString>;
-      requestBodyType: alepha147.TOptional<alepha147.TString>;
-      service: alepha147.TOptional<alepha147.TString>;
+  api: alepha188.TObject<{
+    prefix: alepha188.TOptional<alepha188.TString>;
+    links: alepha188.TArray<alepha188.TObject<{
+      name: alepha188.TString;
+      group: alepha188.TOptional<alepha188.TString>;
+      path: alepha188.TString;
+      method: alepha188.TOptional<alepha188.TString>;
+      requestBodyType: alepha188.TOptional<alepha188.TString>;
+      service: alepha188.TOptional<alepha188.TString>;
     }>>;
   }>;
 }>;
@@ -108,34 +108,35 @@ declare class ServerAuthProvider {
   protected readonly serverCookiesProvider: ServerCookiesProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly serverLinksProvider: ServerLinksProvider;
-  protected readonly authorizationCode: alepha_server_cookies0.AbstractCookiePrimitive<alepha147.TObject<{
-    provider: alepha147.TString;
-    codeVerifier: alepha147.TOptional<alepha147.TString>;
-    redirectUri: alepha147.TOptional<alepha147.TString>;
-    state: alepha147.TOptional<alepha147.TString>;
-    nonce: alepha147.TOptional<alepha147.TString>;
+  protected readonly authorizationCode: alepha_server_cookies0.AbstractCookiePrimitive<alepha188.TObject<{
+    provider: alepha188.TString;
+    realm: alepha188.TOptional<alepha188.TString>;
+    codeVerifier: alepha188.TOptional<alepha188.TString>;
+    redirectUri: alepha188.TOptional<alepha188.TString>;
+    state: alepha188.TOptional<alepha188.TString>;
+    nonce: alepha188.TOptional<alepha188.TString>;
   }>>;
-  readonly tokens: alepha_server_cookies0.AbstractCookiePrimitive<alepha147.TObject<{
-    provider: alepha147.TString;
-    access_token: alepha147.TString;
-    issued_at: alepha147.TNumber;
-    expires_in: alepha147.TOptional<alepha147.TNumber>;
-    refresh_token: alepha147.TOptional<alepha147.TString>;
-    refresh_token_expires_in: alepha147.TOptional<alepha147.TNumber>;
-    refresh_expires_in: alepha147.TOptional<alepha147.TNumber>;
-    id_token: alepha147.TOptional<alepha147.TString>;
-    scope: alepha147.TOptional<alepha147.TString>;
+  readonly tokens: alepha_server_cookies0.AbstractCookiePrimitive<alepha188.TObject<{
+    provider: alepha188.TString;
+    access_token: alepha188.TString;
+    issued_at: alepha188.TNumber;
+    expires_in: alepha188.TOptional<alepha188.TNumber>;
+    refresh_token: alepha188.TOptional<alepha188.TString>;
+    refresh_token_expires_in: alepha188.TOptional<alepha188.TNumber>;
+    refresh_expires_in: alepha188.TOptional<alepha188.TNumber>;
+    id_token: alepha188.TOptional<alepha188.TString>;
+    scope: alepha188.TOptional<alepha188.TString>;
   }>>;
   get identities(): Array<AuthPrimitive>;
   getAuthenticationProviders(filters?: {
     realmName?: string;
   }): AuthenticationProvider[];
-  protected readonly configure: alepha147.HookPrimitive<"configure">;
+  protected readonly configure: alepha188.HookPrimitive<"configure">;
   protected getAccessTokens(tokens: Tokens): string | undefined;
   /**
    * Fill request headers with access token from cookies or fallback to provider's fallback function.
    */
-  protected readonly onRequest: alepha147.HookPrimitive<"server:onRequest">;
+  protected readonly onRequest: alepha188.HookPrimitive<"server:onRequest">;
   /**
    * Convert cookies to tokens.
    * If the tokens are expired, try to refresh them using the refresh token.
@@ -146,26 +147,26 @@ declare class ServerAuthProvider {
    * Get user information.
    */
   readonly userinfo: alepha_server0.RoutePrimitive<{
-    response: alepha147.TObject<{
-      user: alepha147.TOptional<alepha147.TObject<{
-        id: alepha147.TString;
-        name: alepha147.TOptional<alepha147.TString>;
-        email: alepha147.TOptional<alepha147.TString>;
-        username: alepha147.TOptional<alepha147.TString>;
-        picture: alepha147.TOptional<alepha147.TString>;
-        sessionId: alepha147.TOptional<alepha147.TString>;
-        organizations: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
-        roles: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
+    response: alepha188.TObject<{
+      user: alepha188.TOptional<alepha188.TObject<{
+        id: alepha188.TString;
+        name: alepha188.TOptional<alepha188.TString>;
+        email: alepha188.TOptional<alepha188.TString>;
+        username: alepha188.TOptional<alepha188.TString>;
+        picture: alepha188.TOptional<alepha188.TString>;
+        sessionId: alepha188.TOptional<alepha188.TString>;
+        organizations: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
+        roles: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
       }>>;
-      api: alepha147.TObject<{
-        prefix: alepha147.TOptional<alepha147.TString>;
-        links: alepha147.TArray<alepha147.TObject<{
-          name: alepha147.TString;
-          group: alepha147.TOptional<alepha147.TString>;
-          path: alepha147.TString;
-          method: alepha147.TOptional<alepha147.TString>;
-          requestBodyType: alepha147.TOptional<alepha147.TString>;
-          service: alepha147.TOptional<alepha147.TString>;
+      api: alepha188.TObject<{
+        prefix: alepha188.TOptional<alepha188.TString>;
+        links: alepha188.TArray<alepha188.TObject<{
+          name: alepha188.TString;
+          group: alepha188.TOptional<alepha188.TString>;
+          path: alepha188.TString;
+          method: alepha188.TOptional<alepha188.TString>;
+          requestBodyType: alepha188.TOptional<alepha188.TString>;
+          service: alepha188.TOptional<alepha188.TString>;
         }>>;
       }>;
     }>;
@@ -174,65 +175,66 @@ declare class ServerAuthProvider {
    * Refresh a token for internal providers.
    */
   readonly refresh: alepha_server0.RoutePrimitive<{
-    query: alepha147.TObject<{
-      provider: alepha147.TString;
+    query: alepha188.TObject<{
+      provider: alepha188.TString;
     }>;
-    body: alepha147.TObject<{
-      refresh_token: alepha147.TString;
-      access_token: alepha147.TOptional<alepha147.TString>;
+    body: alepha188.TObject<{
+      refresh_token: alepha188.TString;
+      access_token: alepha188.TOptional<alepha188.TString>;
     }>;
-    response: alepha147.TObject<{
-      provider: alepha147.TString;
-      access_token: alepha147.TString;
-      issued_at: alepha147.TNumber;
-      expires_in: alepha147.TOptional<alepha147.TNumber>;
-      refresh_token: alepha147.TOptional<alepha147.TString>;
-      refresh_token_expires_in: alepha147.TOptional<alepha147.TNumber>;
-      refresh_expires_in: alepha147.TOptional<alepha147.TNumber>;
-      id_token: alepha147.TOptional<alepha147.TString>;
-      scope: alepha147.TOptional<alepha147.TString>;
+    response: alepha188.TObject<{
+      provider: alepha188.TString;
+      access_token: alepha188.TString;
+      issued_at: alepha188.TNumber;
+      expires_in: alepha188.TOptional<alepha188.TNumber>;
+      refresh_token: alepha188.TOptional<alepha188.TString>;
+      refresh_token_expires_in: alepha188.TOptional<alepha188.TNumber>;
+      refresh_expires_in: alepha188.TOptional<alepha188.TNumber>;
+      id_token: alepha188.TOptional<alepha188.TString>;
+      scope: alepha188.TOptional<alepha188.TString>;
     }>;
   }>;
   /**
    * Login for local password-based authentication.
    */
   readonly token: alepha_server0.RoutePrimitive<{
-    query: alepha147.TObject<{
-      provider: alepha147.TString;
+    query: alepha188.TObject<{
+      provider: alepha188.TString;
+      realm: alepha188.TOptional<alepha188.TString>;
     }>;
-    body: alepha147.TObject<{
-      username: alepha147.TString;
-      password: alepha147.TString;
+    body: alepha188.TObject<{
+      username: alepha188.TString;
+      password: alepha188.TString;
     }>;
-    response: alepha147.TObject<{
-      provider: alepha147.TString;
-      access_token: alepha147.TString;
-      issued_at: alepha147.TNumber;
-      expires_in: alepha147.TOptional<alepha147.TNumber>;
-      refresh_token: alepha147.TOptional<alepha147.TString>;
-      refresh_token_expires_in: alepha147.TOptional<alepha147.TNumber>;
-      refresh_expires_in: alepha147.TOptional<alepha147.TNumber>;
-      id_token: alepha147.TOptional<alepha147.TString>;
-      scope: alepha147.TOptional<alepha147.TString>;
-      user: alepha147.TObject<{
-        id: alepha147.TString;
-        name: alepha147.TOptional<alepha147.TString>;
-        email: alepha147.TOptional<alepha147.TString>;
-        username: alepha147.TOptional<alepha147.TString>;
-        picture: alepha147.TOptional<alepha147.TString>;
-        sessionId: alepha147.TOptional<alepha147.TString>;
-        organizations: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
-        roles: alepha147.TOptional<alepha147.TArray<alepha147.TString>>;
+    response: alepha188.TObject<{
+      provider: alepha188.TString;
+      access_token: alepha188.TString;
+      issued_at: alepha188.TNumber;
+      expires_in: alepha188.TOptional<alepha188.TNumber>;
+      refresh_token: alepha188.TOptional<alepha188.TString>;
+      refresh_token_expires_in: alepha188.TOptional<alepha188.TNumber>;
+      refresh_expires_in: alepha188.TOptional<alepha188.TNumber>;
+      id_token: alepha188.TOptional<alepha188.TString>;
+      scope: alepha188.TOptional<alepha188.TString>;
+      user: alepha188.TObject<{
+        id: alepha188.TString;
+        name: alepha188.TOptional<alepha188.TString>;
+        email: alepha188.TOptional<alepha188.TString>;
+        username: alepha188.TOptional<alepha188.TString>;
+        picture: alepha188.TOptional<alepha188.TString>;
+        sessionId: alepha188.TOptional<alepha188.TString>;
+        organizations: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
+        roles: alepha188.TOptional<alepha188.TArray<alepha188.TString>>;
       }>;
-      api: alepha147.TObject<{
-        prefix: alepha147.TOptional<alepha147.TString>;
-        links: alepha147.TArray<alepha147.TObject<{
-          name: alepha147.TString;
-          group: alepha147.TOptional<alepha147.TString>;
-          path: alepha147.TString;
-          method: alepha147.TOptional<alepha147.TString>;
-          requestBodyType: alepha147.TOptional<alepha147.TString>;
-          service: alepha147.TOptional<alepha147.TString>;
+      api: alepha188.TObject<{
+        prefix: alepha188.TOptional<alepha188.TString>;
+        links: alepha188.TArray<alepha188.TObject<{
+          name: alepha188.TString;
+          group: alepha188.TOptional<alepha188.TString>;
+          path: alepha188.TString;
+          method: alepha188.TOptional<alepha188.TString>;
+          requestBodyType: alepha188.TOptional<alepha188.TString>;
+          service: alepha188.TOptional<alepha188.TString>;
         }>>;
       }>;
     }>;
@@ -241,9 +243,10 @@ declare class ServerAuthProvider {
    * Oauth2/OIDC login route.
    */
   readonly login: alepha_server0.RoutePrimitive<{
-    query: alepha147.TObject<{
-      provider: alepha147.TString;
-      redirect_uri: alepha147.TOptional<alepha147.TString>;
+    query: alepha188.TObject<{
+      provider: alepha188.TString;
+      realm: alepha188.TOptional<alepha188.TString>;
+      redirect_uri: alepha188.TOptional<alepha188.TString>;
     }>;
   }>;
   /**
@@ -255,13 +258,20 @@ declare class ServerAuthProvider {
    * Logout route for OAuth2/OIDC providers.
    */
   readonly logout: alepha_server0.RoutePrimitive<{
-    query: alepha147.TObject<{
-      post_logout_redirect_uri: alepha147.TOptional<alepha147.TString>;
+    query: alepha188.TObject<{
+      post_logout_redirect_uri: alepha188.TOptional<alepha188.TString>;
     }>;
   }>;
+  /**
+   * Find an auth provider by name and optionally by realm.
+   * When realm is specified, it filters providers by both name and realm.
+   * This enables multi-realm setups where multiple providers share the same name (e.g., "credentials").
+   */
   protected provider(opts: string | {
     provider: string;
+    realm?: string;
   }): AuthPrimitive;
+  protected getTokens(cookies?: Cookies): Tokens | undefined;
   protected setTokens(tokens: Tokens, cookies?: Cookies): void;
 }
 interface OAuth2Profile {
@@ -493,6 +503,7 @@ declare class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
   protected readonly dateTimeProvider: DateTimeProvider;
   oauth?: Configuration;
   get name(): string;
+  get realm(): RealmPrimitive | undefined;
   get jwks_uri(): string;
   get scope(): string | undefined;
   get redirect_uri(): string | undefined;
@@ -577,7 +588,7 @@ declare module "alepha" {
  * @see {@link ServerAuthProvider}
  * @module alepha.server.auth
  */
-declare const AlephaServerAuth: alepha147.Service<alepha147.Module>;
+declare const AlephaServerAuth: alepha188.Service<alepha188.Module>;
 //#endregion
 export { $auth, $authCredentials, $authGithub, $authGoogle, AccessToken, AlephaServerAuth, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, TokenResponse, Tokens, UserinfoResponse, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, authenticationProviderSchema, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
 //# sourceMappingURL=index.d.ts.map

package/dist/server-auth/index.js

@@ -1283,6 +1283,9 @@ var AuthPrimitive = class extends Primitive {
 	get name() {
 		return this.options.name ?? this.config.propertyKey;
 	}
+	get realm() {
+		if ("realm" in this.options) return this.options.realm;
+	}
 	get jwks_uri() {
 		const jwks = this.oauth?.serverMetadata().jwks_uri;
 		if (!jwks) throw new AlephaError("No JWKS URI available for the auth provider");
@@ -1424,6 +1427,7 @@ var ServerAuthProvider = class {
 		httpOnly: true,
 		schema: t.object({
 			provider: t.text(),
+			realm: t.optional(t.text()),
 			codeVerifier: t.optional(t.text({ size: "long" })),
 			redirectUri: t.optional(t.text({ size: "long" })),
 			state: t.optional(t.text()),
@@ -1499,7 +1503,7 @@ var ServerAuthProvider = class {
 	* If the tokens are expired, try to refresh them using the refresh token.
 	*/
 	async cookiesToTokens(cookies) {
-		const tokens = this.tokens.get({ cookies });
+		const tokens = this.getTokens(cookies);
 		if (!tokens) {
 			this.log.trace("No tokens found in cookies");
 			return;
@@ -1547,7 +1551,7 @@ var ServerAuthProvider = class {
 		path: alephaServerAuthRoutes.userinfo,
 		schema: { response: userinfoResponseSchema },
 		handler: async ({ user, headers: headers$1, cookies }) => {
-			const tokens = this.tokens.get({ cookies });
+			const tokens = this.getTokens(cookies);
 			if (tokens) {
 				const provider = this.provider(tokens);
 				if (!("realm" in provider.options)) {
@@ -1604,7 +1608,10 @@ var ServerAuthProvider = class {
 		path: alephaServerAuthRoutes.token,
 		method: "POST",
 		schema: {
-			query: t.object({ provider: t.text() }),
+			query: t.object({
+				provider: t.text(),
+				realm: t.optional(t.text({ description: "Realm name for multi-realm setups" }))
+			}),
 			body: t.object({
 				username: t.text(),
 				password: t.text()
@@ -1612,11 +1619,15 @@ var ServerAuthProvider = class {
 			response: tokenResponseSchema
 		},
 		handler: async ({ query, body, cookies }) => {
-			const provider = this.provider(query);
+			const provider = this.provider({
+				provider: query.provider,
+				realm: query.realm
+			});
 			const realm = "realm" in provider.options && provider.options.realm;
 			if (!realm) throw new SecurityError(`Auth provider '${query.provider}' does not support password grant`);
 			const credentials = "credentials" in provider.options && provider.options.credentials;
 			if (!credentials) throw new SecurityError(`Auth provider '${query.provider}' does not support password grant`);
+			console.log("->", body);
 			let user;
 			try {
 				user = await credentials.account(body);
@@ -1646,10 +1657,14 @@ var ServerAuthProvider = class {
 		path: alephaServerAuthRoutes.login,
 		schema: { query: t.object({
 			provider: t.text(),
+			realm: t.optional(t.text({ description: "Realm name for multi-realm setups" })),
 			redirect_uri: t.optional(t.text({ size: "rich" }))
 		}) },
 		handler: async ({ query, url, reply }) => {
-			const provider = this.provider(query);
+			const provider = this.provider({
+				provider: query.provider,
+				realm: query.realm
+			});
 			const oauth = provider.oauth;
 			if (!oauth) throw new SecurityError(`Auth provider '${query.provider}' does not support OAuth2`);
 			const scope = provider.scope;
@@ -1668,7 +1683,8 @@ var ServerAuthProvider = class {
 					state,
 					nonce: parameters$1.nonce,
 					redirectUri: query.redirect_uri ?? "/",
-					provider: query.provider
+					provider: query.provider,
+					realm: query.realm
 				});
 				reply.redirect(buildAuthorizationUrl(oauth, parameters$1).toString());
 				return;
@@ -1684,7 +1700,8 @@ var ServerAuthProvider = class {
 			this.authorizationCode.set({
 				codeVerifier,
 				redirectUri: query.redirect_uri ?? "/",
-				provider: query.provider
+				provider: query.provider,
+				realm: query.realm
 			});
 			reply.redirect(buildAuthorizationUrl(oauth, parameters).toString());
 		}
@@ -1740,7 +1757,7 @@ var ServerAuthProvider = class {
 		schema: { query: t.object({ post_logout_redirect_uri: t.optional(t.text()) }) },
 		handler: async ({ query, reply, cookies }) => {
 			const redirect = query.post_logout_redirect_uri ?? "/";
-			const tokens = this.tokens.get({ cookies });
+			const tokens = this.getTokens(cookies);
 			if (!tokens) {
 				reply.redirect(redirect);
 				return;
@@ -1776,12 +1793,25 @@ var ServerAuthProvider = class {
 			reply.redirect(buildEndSessionUrl(oauth, params).toString());
 		}
 	});
+	/**
+	* Find an auth provider by name and optionally by realm.
+	* When realm is specified, it filters providers by both name and realm.
+	* This enables multi-realm setups where multiple providers share the same name (e.g., "credentials").
+	*/
 	provider(opts) {
 		const name = typeof opts === "string" ? opts : opts.provider;
-		const identity = this.identities.find((identity$1) => identity$1.name === name);
-		if (!identity) throw new SecurityError(`Auth provider '${name}' not found`);
+		const realmName = typeof opts === "string" ? void 0 : opts.realm;
+		const identity = this.identities.find((identity$1) => {
+			if (identity$1.name !== name) return false;
+			if (realmName && identity$1.realm?.name !== realmName) return false;
+			return true;
+		});
+		if (!identity) throw new SecurityError(`Auth provider '${name}'${realmName ? ` for realm '${realmName}'` : ""} not found`);
 		return identity;
 	}
+	getTokens(cookies) {
+		return this.tokens.get({ cookies });
+	}
 	setTokens(tokens, cookies) {
 		const exp = tokens.refresh_token_expires_in || tokens.refresh_expires_in || tokens.expires_in;
 		const ttl = exp ? this.dateTimeProvider.duration(exp, "seconds") : void 0;