@fonoster/identity 0.26.0 → 0.30.0

package/dist/server/config.d.ts

@@ -1,5 +1,12 @@
 import { z } from "zod";
-import { IdentityConfig } from "../exchanges/types";
+/**
+ * Configuration for the standalone Identity service: identity.json (or
+ * .jsonc/.yaml), found via --config, /opt/fonoster or ./config. Fields sit at
+ * the root of the file, as they always have; the same settings live under
+ * fonoster.yaml's `identity:` section when Identity is embedded in the API
+ * server. No environment variables, except ${VAR} in the database URL shared
+ * with the Postgres container.
+ */
 declare const identityServiceConfigSchema: z.ZodObject<{
     server: z.ZodDefault<z.ZodObject<{
         bindAddr: z.ZodDefault<z.ZodString>;
@@ -11,6 +18,60 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         bindAddr?: string;
         httpBridgePort?: number;
     }>>;
+    logs: z.ZodDefault<z.ZodEffects<z.ZodObject<{
+        level: z.ZodDefault<z.ZodEnum<["error", "warn", "info", "http", "verbose", "debug", "silly"]>>;
+        format: z.ZodDefault<z.ZodEnum<["json", "text"]>>;
+        transport: z.ZodDefault<z.ZodEnum<["console", "fluent"]>>;
+        fluent: z.ZodOptional<z.ZodObject<{
+            host: z.ZodString;
+            port: z.ZodDefault<z.ZodNumber>;
+            tagPrefix: z.ZodDefault<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        }, {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }>, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }>>;
     database: z.ZodObject<{
         url: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -20,8 +81,10 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     }>;
     encryptionKey: z.ZodString;
     issuer: z.ZodString;
-    audience: z.ZodString;
-    keys: z.ZodEffects<z.ZodObject<{
+    audience: z.ZodDefault<z.ZodString>;
+    /** Where the accept-invite bridge redirects. Defaults to the issuer. */
+    appUrl: z.ZodOptional<z.ZodString>;
+    keys: z.ZodEffects<z.ZodDefault<z.ZodObject<{
         privateKey: z.ZodOptional<z.ZodString>;
         publicKey: z.ZodOptional<z.ZodString>;
         privateKeyPath: z.ZodOptional<z.ZodString>;
@@ -36,11 +99,11 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         publicKey?: string;
         privateKeyPath?: string;
         publicKeyPath?: string;
-    }>, {
-        privateKey?: string;
-        publicKey?: string;
-        privateKeyPath?: string;
-        publicKeyPath?: string;
+    }>>, {
+        privateKey: string;
+        publicKey: string;
+        privateKeyPath: string;
+        publicKeyPath: string;
     }, {
         privateKey?: string;
         publicKey?: string;
@@ -49,15 +112,15 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     }>;
     tokens: z.ZodDefault<z.ZodObject<{
         accessTokenExpiresIn: z.ZodDefault<z.ZodString>;
-        refreshTokenExpiresIn: z.ZodDefault<z.ZodString>;
         idTokenExpiresIn: z.ZodDefault<z.ZodString>;
+        refreshTokenExpiresIn: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     }, {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     }>>;
     security: z.ZodDefault<z.ZodObject<{
@@ -71,8 +134,8 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         twoFactorAuthenticationRequired?: boolean;
     }>>;
     invite: z.ZodDefault<z.ZodObject<{
-        url: z.ZodDefault<z.ZodString>;
-        failUrl: z.ZodDefault<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+        failUrl: z.ZodOptional<z.ZodString>;
         expiration: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         url?: string;
@@ -83,12 +146,14 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         failUrl?: string;
         expiration?: string;
     }>>;
-    appUrl: z.ZodDefault<z.ZodString>;
-    smtp: z.ZodOptional<z.ZodObject<{
+    smtp: z.ZodOptional<z.ZodObject<Omit<{
         host: z.ZodString;
-        port: z.ZodNumber;
+        port: z.ZodDefault<z.ZodNumber>;
         secure: z.ZodDefault<z.ZodBoolean>;
         sender: z.ZodString;
+        user: z.ZodDefault<z.ZodString>;
+        password: z.ZodDefault<z.ZodString>;
+    }, "user" | "password"> & {
         auth: z.ZodDefault<z.ZodObject<{
             user: z.ZodDefault<z.ZodString>;
             pass: z.ZodDefault<z.ZodString>;
@@ -118,30 +183,64 @@ declare const identityServiceConfigSchema: z.ZodObject<{
             pass?: string;
         };
     }>>;
+    twilio: z.ZodOptional<z.ZodObject<{
+        phoneNumber: z.ZodString;
+        accountSid: z.ZodString;
+        authToken: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    }, {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    }>>;
     oauth2: z.ZodOptional<z.ZodObject<{
         github: z.ZodObject<{
             clientId: z.ZodString;
             clientSecret: z.ZodString;
+            url: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
+            apiUrl: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
         }, "strip", z.ZodTypeAny, {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         }, {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         }>;
     }, "strip", z.ZodTypeAny, {
         github?: {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         };
     }, {
         github?: {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         };
     }>>;
+    /** Sign-in methods and sign-up policy (`features.auth` in fonoster.yaml). */
+    auth: z.ZodDefault<z.ZodObject<{
+        methods: z.ZodDefault<z.ZodArray<z.ZodEnum<["password", "email_code", "github"]>, "atleastone">>;
+        signup: z.ZodDefault<z.ZodEnum<["invite", "open"]>>;
+    }, "strip", z.ZodTypeAny, {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    }, {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    }>>;
     defaultUser: z.ZodOptional<z.ZodObject<{
-        name: z.ZodString;
+        name: z.ZodDefault<z.ZodString>;
         email: z.ZodString;
         password: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -155,36 +254,38 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     keys?: {
-        privateKey?: string;
-        publicKey?: string;
-        privateKeyPath?: string;
-        publicKeyPath?: string;
+        privateKey: string;
+        publicKey: string;
+        privateKeyPath: string;
+        publicKeyPath: string;
     };
-    issuer?: string;
-    audience?: string;
-    server?: {
-        bindAddr?: string;
-        httpBridgePort?: number;
+    invite?: {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
     };
     database?: {
         url?: string;
     };
-    encryptionKey?: string;
+    issuer?: string;
+    audience?: string;
     tokens?: {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     };
     security?: {
         contactVerificationRequired?: boolean;
         twoFactorAuthenticationRequired?: boolean;
     };
-    invite?: {
-        url?: string;
-        failUrl?: string;
-        expiration?: string;
+    oauth2?: {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
     };
-    appUrl?: string;
     smtp?: {
         host?: string;
         port?: number;
@@ -195,12 +296,31 @@ declare const identityServiceConfigSchema: z.ZodObject<{
             pass?: string;
         };
     };
-    oauth2?: {
-        github?: {
-            clientId?: string;
-            clientSecret?: string;
+    twilio?: {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    };
+    auth?: {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    };
+    server?: {
+        bindAddr?: string;
+        httpBridgePort?: number;
+    };
+    logs?: {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
         };
+        transport?: "console" | "fluent";
     };
+    encryptionKey?: string;
+    appUrl?: string;
     defaultUser?: {
         name?: string;
         email?: string;
@@ -213,31 +333,33 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         privateKeyPath?: string;
         publicKeyPath?: string;
     };
-    issuer?: string;
-    audience?: string;
-    server?: {
-        bindAddr?: string;
-        httpBridgePort?: number;
+    invite?: {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
     };
     database?: {
         url?: string;
     };
-    encryptionKey?: string;
+    issuer?: string;
+    audience?: string;
     tokens?: {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     };
     security?: {
         contactVerificationRequired?: boolean;
         twoFactorAuthenticationRequired?: boolean;
     };
-    invite?: {
-        url?: string;
-        failUrl?: string;
-        expiration?: string;
+    oauth2?: {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
     };
-    appUrl?: string;
     smtp?: {
         host?: string;
         port?: number;
@@ -248,12 +370,31 @@ declare const identityServiceConfigSchema: z.ZodObject<{
             pass?: string;
         };
     };
-    oauth2?: {
-        github?: {
-            clientId?: string;
-            clientSecret?: string;
+    twilio?: {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    };
+    auth?: {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    };
+    server?: {
+        bindAddr?: string;
+        httpBridgePort?: number;
+    };
+    logs?: {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
         };
+        transport?: "console" | "fluent";
     };
+    encryptionKey?: string;
+    appUrl?: string;
     defaultUser?: {
         name?: string;
         email?: string;
@@ -261,16 +402,106 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     };
 }>;
 type IdentityServiceConfig = z.infer<typeof identityServiceConfigSchema>;
+/** Reads and validates the file only (no keys read), e.g. for provisioning. */
+declare function loadConfigFile(argv?: string[]): {
+    config: {
+        keys?: {
+            privateKey: string;
+            publicKey: string;
+            privateKeyPath: string;
+            publicKeyPath: string;
+        };
+        invite?: {
+            url?: string;
+            failUrl?: string;
+            expiration?: string;
+        };
+        database?: {
+            url?: string;
+        };
+        issuer?: string;
+        audience?: string;
+        tokens?: {
+            accessTokenExpiresIn?: string;
+            idTokenExpiresIn?: string;
+            refreshTokenExpiresIn?: string;
+        };
+        security?: {
+            contactVerificationRequired?: boolean;
+            twoFactorAuthenticationRequired?: boolean;
+        };
+        oauth2?: {
+            github?: {
+                url?: string;
+                clientId?: string;
+                clientSecret?: string;
+                apiUrl?: string;
+            };
+        };
+        smtp?: {
+            host?: string;
+            port?: number;
+            secure?: boolean;
+            sender?: string;
+            auth?: {
+                user?: string;
+                pass?: string;
+            };
+        };
+        twilio?: {
+            phoneNumber?: string;
+            accountSid?: string;
+            authToken?: string;
+        };
+        auth?: {
+            methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+            signup?: "invite" | "open";
+        };
+        server?: {
+            bindAddr?: string;
+            httpBridgePort?: number;
+        };
+        logs?: {
+            format?: "text" | "json";
+            level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+            fluent?: {
+                host?: string;
+                port?: number;
+                tagPrefix?: string;
+            };
+            transport?: "console" | "fluent";
+        };
+        encryptionKey?: string;
+        appUrl?: string;
+        defaultUser?: {
+            name?: string;
+            email?: string;
+            password?: string;
+        };
+    };
+    databaseUrl: string;
+};
 /** Loads and validates the service configuration from the file, failing fast. */
 declare function loadConfig(argv?: string[]): {
     bindAddr: string;
     httpBridgePort: number;
     appUrl: string;
+    logs: {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    };
+    databaseUrl: string;
     defaultUser: {
         name?: string;
         email?: string;
         password?: string;
     };
-    identityConfig: IdentityConfig;
+    identityConfig: import("..").IdentityConfig;
 };
-export { identityServiceConfigSchema, IdentityServiceConfig, loadConfig };
+export { identityServiceConfigSchema, IdentityServiceConfig, loadConfig, loadConfigFile };