@fonderie/auth 7.13.0 → 7.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/brain/signatures.md +1 -1
- package/dist/index.cjs +32 -11
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +32 -11
- package/dist/index.js.map +1 -1
- package/env.json +154 -0
- package/package.json +7 -5
package/env.json
ADDED
|
@@ -0,0 +1,154 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$comment": "Environment variables this brick depends on. Read by `fonderie env`, the admin console and check:env-declarations — docs/ENV-DECLARATIONS-DESIGN.md",
|
|
3
|
+
"brick": "@fonderie/auth",
|
|
4
|
+
"vars": [
|
|
5
|
+
{
|
|
6
|
+
"name": "NODE_ENV",
|
|
7
|
+
"source": "direct",
|
|
8
|
+
"required": "production",
|
|
9
|
+
"secret": false,
|
|
10
|
+
"kind": "enum:development|test|production",
|
|
11
|
+
"dev": "development",
|
|
12
|
+
"description": "Runtime mode. production arms secure cookies and turns weak-secret warnings into boot errors."
|
|
13
|
+
},
|
|
14
|
+
{
|
|
15
|
+
"name": "JWT_SECRET",
|
|
16
|
+
"source": "option",
|
|
17
|
+
"required": "always",
|
|
18
|
+
"secret": true,
|
|
19
|
+
"kind": "secret32",
|
|
20
|
+
"feeds": "jwtSecret",
|
|
21
|
+
"generate": "base64-32",
|
|
22
|
+
"enforcedBy": "readiness:JWT_SECRET_TOO_SHORT|JWT_SECRET_PLACEHOLDER (error in production)",
|
|
23
|
+
"description": "Signs session tokens. At least 32 characters, no placeholder words."
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
"name": "MFA_SECRET_KEY",
|
|
27
|
+
"source": "option",
|
|
28
|
+
"required": "feature",
|
|
29
|
+
"secret": true,
|
|
30
|
+
"kind": "hex64",
|
|
31
|
+
"feeds": "mfaSecretKey",
|
|
32
|
+
"generate": "hex-32",
|
|
33
|
+
"feature": "mfa",
|
|
34
|
+
"enforcedBy": "readiness:MFA_KEY_MISSING|MFA_KEY_INVALID (error in production)",
|
|
35
|
+
"description": "Encrypts TOTP secrets at rest. Exactly 64 hex characters."
|
|
36
|
+
},
|
|
37
|
+
{
|
|
38
|
+
"name": "PASSWORD_RESET_URL",
|
|
39
|
+
"source": "option",
|
|
40
|
+
"required": "never",
|
|
41
|
+
"secret": false,
|
|
42
|
+
"kind": "url",
|
|
43
|
+
"feeds": "passwordResetUrl",
|
|
44
|
+
"description": "Link placed in password-reset emails. Unset: reset works by PIN only."
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"name": "GOOGLE_CLIENT_ID",
|
|
48
|
+
"source": "option",
|
|
49
|
+
"required": "feature",
|
|
50
|
+
"secret": false,
|
|
51
|
+
"kind": "string",
|
|
52
|
+
"feeds": "google.clientId",
|
|
53
|
+
"feature": "google",
|
|
54
|
+
"description": "OAuth client ID from Google Cloud Console."
|
|
55
|
+
},
|
|
56
|
+
{
|
|
57
|
+
"name": "GOOGLE_CLIENT_SECRET",
|
|
58
|
+
"source": "option",
|
|
59
|
+
"required": "feature",
|
|
60
|
+
"secret": true,
|
|
61
|
+
"kind": "string",
|
|
62
|
+
"feeds": "google.clientSecret",
|
|
63
|
+
"feature": "google",
|
|
64
|
+
"description": "OAuth client secret from Google Cloud Console."
|
|
65
|
+
},
|
|
66
|
+
{
|
|
67
|
+
"name": "GOOGLE_REDIRECT_URI",
|
|
68
|
+
"source": "option",
|
|
69
|
+
"required": "feature",
|
|
70
|
+
"secret": false,
|
|
71
|
+
"kind": "url",
|
|
72
|
+
"feeds": "google.redirectUri",
|
|
73
|
+
"feature": "google",
|
|
74
|
+
"deprecatedNames": [
|
|
75
|
+
"GOOGLE_CALLBACK_URL"
|
|
76
|
+
],
|
|
77
|
+
"description": "Callback URL registered with Google, ending in /auth/oauth/google/callback."
|
|
78
|
+
},
|
|
79
|
+
{
|
|
80
|
+
"name": "APPLE_CLIENT_ID",
|
|
81
|
+
"source": "option",
|
|
82
|
+
"required": "feature",
|
|
83
|
+
"secret": false,
|
|
84
|
+
"kind": "string",
|
|
85
|
+
"feeds": "apple.clientId",
|
|
86
|
+
"feature": "apple",
|
|
87
|
+
"description": "Services ID for web sign-in."
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
"name": "APPLE_TEAM_ID",
|
|
91
|
+
"source": "option",
|
|
92
|
+
"required": "feature",
|
|
93
|
+
"secret": false,
|
|
94
|
+
"kind": "string",
|
|
95
|
+
"feeds": "apple.teamId",
|
|
96
|
+
"feature": "apple",
|
|
97
|
+
"description": "Apple Developer team ID."
|
|
98
|
+
},
|
|
99
|
+
{
|
|
100
|
+
"name": "APPLE_KEY_ID",
|
|
101
|
+
"source": "option",
|
|
102
|
+
"required": "feature",
|
|
103
|
+
"secret": false,
|
|
104
|
+
"kind": "string",
|
|
105
|
+
"feeds": "apple.keyId",
|
|
106
|
+
"feature": "apple",
|
|
107
|
+
"description": "ID of the Sign in with Apple key."
|
|
108
|
+
},
|
|
109
|
+
{
|
|
110
|
+
"name": "APPLE_PRIVATE_KEY",
|
|
111
|
+
"source": "option",
|
|
112
|
+
"required": "feature",
|
|
113
|
+
"secret": true,
|
|
114
|
+
"kind": "pem",
|
|
115
|
+
"feeds": "apple.privateKey",
|
|
116
|
+
"feature": "apple",
|
|
117
|
+
"description": "Contents of the .p8 key file, PEM with its BEGIN/END lines."
|
|
118
|
+
},
|
|
119
|
+
{
|
|
120
|
+
"name": "APPLE_REDIRECT_URI",
|
|
121
|
+
"source": "option",
|
|
122
|
+
"required": "feature",
|
|
123
|
+
"secret": false,
|
|
124
|
+
"kind": "url",
|
|
125
|
+
"feeds": "apple.redirectUri",
|
|
126
|
+
"feature": "apple",
|
|
127
|
+
"deprecatedNames": [
|
|
128
|
+
"APPLE_CALLBACK_URL"
|
|
129
|
+
],
|
|
130
|
+
"description": "Return URL registered for the Services ID."
|
|
131
|
+
},
|
|
132
|
+
{
|
|
133
|
+
"name": "APPLE_NATIVE_CLIENT_IDS",
|
|
134
|
+
"source": "option",
|
|
135
|
+
"required": "feature",
|
|
136
|
+
"secret": false,
|
|
137
|
+
"kind": "csv",
|
|
138
|
+
"feeds": "apple.nativeClientIds",
|
|
139
|
+
"feature": "apple",
|
|
140
|
+
"description": "Bundle IDs of native apps allowed to sign in, comma-separated."
|
|
141
|
+
}
|
|
142
|
+
],
|
|
143
|
+
"features": {
|
|
144
|
+
"mfa": {
|
|
145
|
+
"description": "TOTP multi-factor authentication (config.mfa)"
|
|
146
|
+
},
|
|
147
|
+
"google": {
|
|
148
|
+
"description": "Sign in with Google — all or none (readiness GOOGLE_INCOMPLETE)"
|
|
149
|
+
},
|
|
150
|
+
"apple": {
|
|
151
|
+
"description": "Sign in with Apple — all or none (readiness APPLE_INCOMPLETE)"
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@fonderie/auth",
|
|
3
|
-
"version": "7.
|
|
3
|
+
"version": "7.14.1",
|
|
4
4
|
"fonderie": { "stability": "stable" },
|
|
5
5
|
"description": "Drop-in auth for SaaS — email/password, phone OTP, Google OAuth, stateless JWT sessions, TOTP-based MFA with backup codes, and self-service password recovery.",
|
|
6
6
|
"keywords": [
|
|
@@ -40,7 +40,8 @@
|
|
|
40
40
|
"./migrations": {
|
|
41
41
|
"types": "./dist/migrations/index.d.ts",
|
|
42
42
|
"import": "./dist/migrations/index.js"
|
|
43
|
-
}
|
|
43
|
+
},
|
|
44
|
+
"./env.json": "./env.json"
|
|
44
45
|
},
|
|
45
46
|
"main": "./dist/index.cjs",
|
|
46
47
|
"module": "./dist/index.js",
|
|
@@ -59,10 +60,10 @@
|
|
|
59
60
|
"jsonwebtoken": "^9.0.3",
|
|
60
61
|
"qrcode": "^1.5.4",
|
|
61
62
|
"zod": "^4.6.5",
|
|
62
|
-
"@fonderie/rate-limit": "^4.0.
|
|
63
|
+
"@fonderie/rate-limit": "^4.0.26"
|
|
63
64
|
},
|
|
64
65
|
"peerDependencies": {
|
|
65
|
-
"@fonderie/core": "^0.
|
|
66
|
+
"@fonderie/core": "^0.23.0",
|
|
66
67
|
"@fonderie/events": "^5.0.0",
|
|
67
68
|
"@fonderie/store": "^0.7.0"
|
|
68
69
|
},
|
|
@@ -90,7 +91,8 @@
|
|
|
90
91
|
"dist",
|
|
91
92
|
"brain",
|
|
92
93
|
"LICENSE",
|
|
93
|
-
"README.md"
|
|
94
|
+
"README.md",
|
|
95
|
+
"env.json"
|
|
94
96
|
],
|
|
95
97
|
"repository": {
|
|
96
98
|
"type": "git",
|