@getpara/shared 1.30.0 → 1.32.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/index.js +1 -0
- package/dist/cjs/schemas/permissionsV2.js +1 -0
- package/dist/cjs/schemas/permissionsV2Lifecycle.js +163 -0
- package/dist/cjs/types/authFactor.js +9 -7
- package/dist/cjs/types/authState.js +15 -16
- package/dist/esm/index.js +1 -0
- package/dist/esm/schemas/permissionsV2.js +1 -0
- package/dist/esm/schemas/permissionsV2Lifecycle.js +160 -0
- package/dist/esm/types/authFactor.js +9 -7
- package/dist/esm/types/authState.js +15 -16
- package/dist/types/index.d.ts +1 -0
- package/dist/types/index.d.ts.map +1 -1
- package/dist/types/schemas/permissionsV2.d.ts +3 -0
- package/dist/types/schemas/permissionsV2.d.ts.map +1 -1
- package/dist/types/schemas/permissionsV2Lifecycle.d.ts +15551 -0
- package/dist/types/schemas/permissionsV2Lifecycle.d.ts.map +1 -0
- package/dist/types/types/auth.d.ts +46 -0
- package/dist/types/types/auth.d.ts.map +1 -1
- package/dist/types/types/authFactor.d.ts +57 -23
- package/dist/types/types/authFactor.d.ts.map +1 -1
- package/dist/types/types/authState.d.ts +237 -88
- package/dist/types/types/authState.d.ts.map +1 -1
- package/dist/types/types/permissions.d.ts +18 -0
- package/dist/types/types/permissions.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -1,28 +1,25 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Status-model auth envelope returned by
|
|
3
|
-
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
* This is the canonical auth contract — new SDKs consume it directly instead of
|
|
9
|
-
* a parallel client mirror. (ENG-6910)
|
|
2
|
+
* Status-model auth envelope returned by `/v2/auth`, consumed by the backend and new SDKs.
|
|
3
|
+
* Clerk-style: a single `status` drives the client, with typed per-status fields. Statuses are added
|
|
4
|
+
* additively; an unrecognized one is treated as not-yet-complete (show generic / hand off), never an
|
|
5
|
+
* error (forward-compat). The canonical auth contract — new SDKs consume it directly, not a parallel
|
|
6
|
+
* client mirror. (ENG-6910)
|
|
10
7
|
*/
|
|
11
|
-
import type {
|
|
8
|
+
import type { AuthFactorView } from './authFactor.js';
|
|
9
|
+
import type { MfaChallenge, TAuthMethod, TelegramAuthResponse, TOAuthMethod } from './auth.js';
|
|
12
10
|
import type { DeliveryChannel } from './otp.js';
|
|
13
11
|
import type { TWalletType } from './wallet.js';
|
|
14
12
|
/**
|
|
15
|
-
* Flow statuses. Only `needs_verification` and `authenticated` are emitted today;
|
|
16
|
-
*
|
|
17
|
-
* slices that emit them land (credential setup, cross-method link prompt).
|
|
13
|
+
* Flow statuses. Only `needs_verification` and `authenticated` are emitted today; the rest are
|
|
14
|
+
* reserved for forward-stability, emitted as their slices land (credential setup, link prompt).
|
|
18
15
|
*/
|
|
19
|
-
export declare const AUTH_STATUSES: readonly ["needs_verification", "needs_credential", "needs_link", "needs_second_factor", "authenticated"];
|
|
16
|
+
export declare const AUTH_STATUSES: readonly ["needs_verification", "needs_credential", "needs_link", "needs_second_factor", "authenticated", "linked", "needs_step_up", "unlinked"];
|
|
20
17
|
export type TAuthStatus = (typeof AUTH_STATUSES)[number];
|
|
21
18
|
/**
|
|
22
|
-
* First-factor methods
|
|
23
|
-
*
|
|
24
|
-
*
|
|
25
|
-
*
|
|
19
|
+
* First-factor methods `/v2/auth` handles: email/phone via a delivered one-time code; external-wallet
|
|
20
|
+
* via a SIWE signature; passkey via a WebAuthn assertion (usernameless — resolved from the credential at
|
|
21
|
+
* `continue`); oauth via a provider redirect (provider rides on the flow, account resolved at
|
|
22
|
+
* `continue`). (ENG-6911)
|
|
26
23
|
*/
|
|
27
24
|
export declare const AUTH_FLOW_METHODS: readonly ["EMAIL", "PHONE", "EXTERNAL_WALLET", "PASSKEY", "OAUTH"];
|
|
28
25
|
export type TAuthFlowMethod = (typeof AUTH_FLOW_METHODS)[number];
|
|
@@ -36,134 +33,258 @@ export type AuthVerification = {
|
|
|
36
33
|
/** Expected code length, so the client can size its input. */
|
|
37
34
|
codeLength?: number;
|
|
38
35
|
};
|
|
36
|
+
/**
|
|
37
|
+
* One login method the existing account holds, for display only. `label` is present for a partner-configured
|
|
38
|
+
* connection (CUSTOM_OIDC / CUSTOM_OAUTH / BYO social) whose human name the partner stored — the client shows
|
|
39
|
+
* it instead of the generic provider name. Never carries an identifier.
|
|
40
|
+
*/
|
|
41
|
+
export type LinkAccountMethod = {
|
|
42
|
+
method: TAuthFlowMethod | TOAuthMethod;
|
|
43
|
+
label?: string;
|
|
44
|
+
};
|
|
45
|
+
/**
|
|
46
|
+
* Coarse summary of the EXISTING account on a `needs_link` collision — enough for the linking UI to show the
|
|
47
|
+
* value-prop ("link to reuse these N wallets") without exposing the account's id or identifier. Ships only once
|
|
48
|
+
* the incoming identity is proven (the needs_link prompt is post-proof). (ENG-7075)
|
|
49
|
+
*/
|
|
50
|
+
export type LinkExistingAccountSummary = {
|
|
51
|
+
/** How many wallets the existing account holds. */
|
|
52
|
+
walletCount: number;
|
|
53
|
+
/** EVERY login method the account holds — OAuth providers (incl. Telegram/Farcaster/custom connections),
|
|
54
|
+
* EMAIL/PHONE, EXTERNAL_WALLET and PASSKEY — drawn from auth_factors with the legacy tables as fallback for
|
|
55
|
+
* accounts that predate the backfill. Display only: which of these can be RE-PROVED is `StepUpOption`'s job.
|
|
56
|
+
* The card composes them into one label ("Google + Wallet") so an account owning several reads as ONE. */
|
|
57
|
+
methods: LinkAccountMethod[];
|
|
58
|
+
};
|
|
59
|
+
/**
|
|
60
|
+
* One selectable account when a `needs_link` email is vouched by MORE THAN ONE existing account. `handle` is an
|
|
61
|
+
* opaque, flow-scoped reference (never the account id) the client passes back as `link.handle` to choose which
|
|
62
|
+
* account to link into; the server maps it to the real account. (ENG-7075)
|
|
63
|
+
*/
|
|
64
|
+
export type LinkCandidate = LinkExistingAccountSummary & {
|
|
65
|
+
handle: string;
|
|
66
|
+
};
|
|
67
|
+
/**
|
|
68
|
+
* One step-up option for proving the existing account. OAuth providers carry only `method` (the redirect
|
|
69
|
+
* handshake identifies the account). EMAIL/PHONE carry a per-factor `handle` (opaque factor reference — never the
|
|
70
|
+
* row id's meaning) the client passes back as `link.handle` to pick THAT specific address/number, plus a
|
|
71
|
+
* `maskedIdentifier` for display (e.g. "t•••@gmail.com", "•••1234") — the full value never leaves the backend.
|
|
72
|
+
* An account with several emails/phones surfaces one option per factor so the user chooses which to verify.
|
|
73
|
+
* `handle`/`maskedIdentifier` are present only when the INCOMING identity is itself proven (a trusted+verified
|
|
74
|
+
* provider email, or an OTP the caller passed); an unverifiable claim gets bare method names. (ENG-6911)
|
|
75
|
+
*/
|
|
76
|
+
export type StepUpOption = {
|
|
77
|
+
method: TAuthFlowMethod | TOAuthMethod;
|
|
78
|
+
handle?: string;
|
|
79
|
+
maskedIdentifier?: string;
|
|
80
|
+
/**
|
|
81
|
+
* The real identifier, present ONLY on the authenticated factor-link rail (`needs_step_up`), where the caller
|
|
82
|
+
* is already signed in AS this factor — masking there hides nothing they cannot already see, and makes "where
|
|
83
|
+
* did the code go" needlessly unclear. Never sent on a `needs_link` collision: there the caller may not own
|
|
84
|
+
* the account, so `maskedIdentifier` is all they get. Prefer this for display when present. (ENG-7075)
|
|
85
|
+
*/
|
|
86
|
+
identifier?: string;
|
|
87
|
+
};
|
|
39
88
|
/**
|
|
40
89
|
* The auth-flow envelope. `flowId` + `expiresAt` are the resumable handle
|
|
41
|
-
* (`GET /v2/auth/flows/{flowId}`). `accountId` stays null until `authenticated`
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
* `Set-Cookie` is the signal, so there is no token in the body.
|
|
90
|
+
* (`GET /v2/auth/flows/{flowId}`). `accountId` stays null until `authenticated`/`linked` so a pending
|
|
91
|
+
* flow never reveals whether the account already existed (enumeration-safe). Session is cookie-based —
|
|
92
|
+
* `authenticated` + the `Set-Cookie` is the signal, so no token in the body.
|
|
45
93
|
*/
|
|
46
94
|
export type AuthState = {
|
|
47
95
|
status: TAuthStatus;
|
|
48
96
|
flowId: string;
|
|
49
97
|
/**
|
|
50
|
-
* ISO-8601 expiry of the flow handle. Present while
|
|
51
|
-
*
|
|
98
|
+
* ISO-8601 expiry of the flow handle. Present while pending; omitted once `authenticated` (the flow
|
|
99
|
+
* is gone, the session has its own lifetime).
|
|
52
100
|
*/
|
|
53
101
|
expiresAt?: string;
|
|
54
|
-
/** Resolved account id; null until `status
|
|
102
|
+
/** Resolved account id; null until `status` is `'authenticated'` or `'linked'`. */
|
|
55
103
|
accountId?: string | null;
|
|
56
104
|
/**
|
|
57
105
|
* Whether this `/start` (or `authenticated`) *created a new account row* vs resumed an existing one. v2
|
|
58
|
-
* never discards an account, so a resumed
|
|
59
|
-
*
|
|
60
|
-
*
|
|
61
|
-
*
|
|
62
|
-
*
|
|
106
|
+
* never discards an account, so a resumed one — even a never-verified stub — reads `false`. CLIENT: decide
|
|
107
|
+
* setup-vs-unlock from **empty `authMethods`** (no credential ⇒ setup), not `isNewUser` alone — a
|
|
108
|
+
* resumed-but-unset-up account is `isNewUser: false` with no methods. Present on `authenticated` and, for
|
|
109
|
+
* account-resolved-at-start flows (email/phone, external wallet), on `needs_verification`. See the exposure
|
|
110
|
+
* note on `authMethods`. (ENG-7075)
|
|
63
111
|
*/
|
|
64
112
|
isNewUser?: boolean;
|
|
65
113
|
/**
|
|
66
114
|
* Whether the account's MPC user-share IS or WILL BE enclave-custodied (basic-login) vs credential-protected.
|
|
67
|
-
* The authoritative key-share-path signal —
|
|
68
|
-
* "`BASIC_LOGIN` ⇒ enclave" rule. For a not-yet-set-up account
|
|
69
|
-
*
|
|
70
|
-
* the
|
|
71
|
-
*
|
|
72
|
-
*
|
|
73
|
-
* (email/phone, external wallet). (ENG-7075)
|
|
115
|
+
* The authoritative key-share-path signal — backend-asserted so the SDK doesn't re-encode the
|
|
116
|
+
* "`BASIC_LOGIN` ⇒ enclave" rule. For a not-yet-set-up account on a BASIC_LOGIN partner this predicts `true`
|
|
117
|
+
* from the CURRENT partner's methods (so the first wallet is minted enclave-custodied) — hence partner-scoped:
|
|
118
|
+
* the same account can read differently across partners. Present on `authenticated` (mirrors the session
|
|
119
|
+
* stamp) and, for account-resolved-at-start flows (email/phone, external wallet), on `needs_verification`
|
|
120
|
+
* (emitted at `/start`, before any mint). (ENG-7075)
|
|
74
121
|
*/
|
|
75
122
|
isEnclaveUser?: boolean;
|
|
76
123
|
/**
|
|
77
|
-
* The account's enrolled auth methods
|
|
78
|
-
* (`PASSKEY`/`PASSWORD`/`PIN`); the enclave decision itself comes from `isEnclaveUser
|
|
79
|
-
*
|
|
80
|
-
* account-resolved-at-start flows (email/phone, external wallet)
|
|
81
|
-
* pre-verification screen (which method to offer).
|
|
124
|
+
* The account's enrolled auth methods, read by the SDK for the credential/method UI
|
|
125
|
+
* (`PASSKEY`/`PASSWORD`/`PIN`); the enclave decision itself comes from `isEnclaveUser`. Mirrors the legacy
|
|
126
|
+
* `done` stage's `authMethods`. Present on `authenticated`, and on `needs_verification` for
|
|
127
|
+
* account-resolved-at-start flows (email/phone, external wallet) to personalize the pre-verification screen.
|
|
82
128
|
*
|
|
83
|
-
* EXPOSURE NOTE: emitting this (
|
|
84
|
-
* `needs_verification` is pre-ownership-proof, so it discloses account existence + auth posture
|
|
85
|
-
*
|
|
86
|
-
*
|
|
87
|
-
*
|
|
88
|
-
*
|
|
89
|
-
*
|
|
90
|
-
* (
|
|
91
|
-
*
|
|
92
|
-
*
|
|
129
|
+
* EXPOSURE NOTE: emitting this (plus `isNewUser`/`isEnclaveUser`/`hasPasswordWithoutPIN`) on
|
|
130
|
+
* `needs_verification` is pre-ownership-proof, so it discloses account existence + auth posture. The caller
|
|
131
|
+
* set is effectively PUBLIC, not partner-only: the `x-external-api-key` gating `/internal/v1/auth/start` is a
|
|
132
|
+
* publishable key shipped in every partner's frontend bundle and CORS is open, so anyone can lift it and
|
|
133
|
+
* probe `does this address have a Para account / how is it protected`. Deliberate: the client needs it to
|
|
134
|
+
* render the pre-verification screen, and the same data is already visible on any Para-integrated site. We
|
|
135
|
+
* still withhold `accountId`/PII (null until `authenticated`/`linked`) — STRICTER than legacy
|
|
136
|
+
* (`/users/init`'s login stage returned `userId`); "parity with legacy" is only directional (legacy emits a
|
|
137
|
+
* method list only for accounts passing `userIsComplete`). SIGNED OFF (security review, 2026-09-16): measured
|
|
138
|
+
* against `/users/exists` (keyed calls from any origin) and the legacy `stage:'login'` response (which returns
|
|
139
|
+
* `userId` + `loginAuthMethods` pre-OTP), v2 discloses at or below that level, behind `userCreateRateLimiter`.
|
|
140
|
+
* (ENG-7075)
|
|
93
141
|
*/
|
|
94
142
|
authMethods?: TAuthMethod[];
|
|
95
143
|
/**
|
|
96
|
-
* Whether the account has a real (non-PIN) password. `authMethods` reports `PASSWORD` even for a
|
|
97
|
-
*
|
|
98
|
-
*
|
|
99
|
-
*
|
|
144
|
+
* Whether the account has a real (non-PIN) password. `authMethods` reports `PASSWORD` even for a PIN-only
|
|
145
|
+
* account (legacy-SDK compat), so the SDK needs this to distinguish password from PIN. Mirrors the legacy
|
|
146
|
+
* `login` stage's field. Present on `authenticated`, and on `needs_verification` for
|
|
147
|
+
* account-resolved-at-start flows (email/phone, external wallet). (ENG-7075)
|
|
100
148
|
*/
|
|
101
149
|
hasPasswordWithoutPIN?: boolean;
|
|
102
150
|
verification?: AuthVerification;
|
|
103
151
|
/** The login-time MFA challenge in flight (present while `needs_second_factor`). (ENG-6906) */
|
|
104
152
|
secondFactor?: MfaChallenge;
|
|
105
153
|
/**
|
|
106
|
-
* Present while `needs_verification` for a signature-based
|
|
107
|
-
*
|
|
154
|
+
* Present while `needs_verification` for a signature-based proof: the external-wallet SIWE message, the
|
|
155
|
+
* passkey WebAuthn challenge, or (email/phone, returning account holding a PASSKEY) the assertion challenge
|
|
156
|
+
* the portal's passkey-unlock signs. Sent back to `continue`. (ENG-6911, ENG-7075)
|
|
108
157
|
*/
|
|
109
158
|
challenge?: {
|
|
110
159
|
message: string;
|
|
111
160
|
};
|
|
112
161
|
/**
|
|
113
|
-
* Present while `needs_verification` for OAuth: the provider authorization URL
|
|
114
|
-
*
|
|
115
|
-
* with the `flowId` to finish. (ENG-6911)
|
|
162
|
+
* Present while `needs_verification` for OAuth: the provider authorization URL to navigate to. The
|
|
163
|
+
* provider calls our callback out-of-band; the client polls `continue` with the `flowId` to finish. (ENG-6911)
|
|
116
164
|
*/
|
|
117
165
|
redirect?: {
|
|
118
166
|
url: string;
|
|
119
167
|
};
|
|
120
168
|
/**
|
|
121
|
-
* Present when `status === 'needs_link'`:
|
|
122
|
-
*
|
|
123
|
-
*
|
|
124
|
-
*
|
|
125
|
-
*
|
|
126
|
-
*
|
|
127
|
-
*
|
|
128
|
-
*
|
|
129
|
-
*
|
|
169
|
+
* Present when `status === 'needs_link'`: this login's identifier collides with an account established by a
|
|
170
|
+
* different method. The account's id/identifier are never exposed — only a coarse, post-proof
|
|
171
|
+
* `existingAccount` summary (wallet count + a representative method) for the linking card. `mode` makes the
|
|
172
|
+
* required action explicit:
|
|
173
|
+
* - `{ mode: 'step_up', methods }` — ALWAYS the first prompt for a single candidate: prove the existing account by re-proving
|
|
174
|
+
* ONE of `methods` (each passed back as `link.method`): an OTP method (`EMAIL`/`PHONE`) or an OAuth provider
|
|
175
|
+
* (re-runs that handshake). Empty `methods` ⇒ no step-up available, client can only create separate.
|
|
176
|
+
* - `{ mode: 'select', candidates }` — the identifier is vouched by MORE THAN ONE existing account; the client
|
|
177
|
+
* picks one (`link: { action: 'select', handle }`), then the flow re-surfaces `step_up` for that account.
|
|
178
|
+
* The client either links by stepping up, selects a candidate, or creates a separate account
|
|
179
|
+
* (`{ action: 'create_separate' }`). Never auto-merge. `existingAccount` is ABSENT on `step_up` when the
|
|
180
|
+
* incoming identity is unproven (an untrusted provider's email claim): nothing about the colliding account is
|
|
181
|
+
* disclosed until the caller proves something. (ENG-6911, ENG-7075)
|
|
130
182
|
*/
|
|
131
183
|
link?: {
|
|
132
|
-
|
|
184
|
+
mode: 'step_up';
|
|
185
|
+
methods: StepUpOption[];
|
|
186
|
+
existingAccount?: LinkExistingAccountSummary;
|
|
187
|
+
/**
|
|
188
|
+
* Present on the flow READ once an OAuth step-up handshake has recorded its verdict but no `continue`
|
|
189
|
+
* has consumed it yet. Lets a client poll the (unthrottled) read endpoint while the provider popup is
|
|
190
|
+
* open and call `continue` exactly once when the verdict lands, instead of hammering `continue`.
|
|
191
|
+
* `verified` → the next continue links + authenticates; `mismatch` → the next continue 401s.
|
|
192
|
+
*/
|
|
193
|
+
stepUpVerdict?: 'verified' | 'mismatch';
|
|
194
|
+
} | {
|
|
195
|
+
mode: 'select';
|
|
196
|
+
candidates: LinkCandidate[];
|
|
133
197
|
};
|
|
134
198
|
/**
|
|
135
|
-
* Present on `
|
|
136
|
-
*
|
|
137
|
-
*
|
|
138
|
-
*
|
|
199
|
+
* Present on `needs_step_up`: the ways the caller may prove the account they are adding a factor TO. One
|
|
200
|
+
* option per usable FIRST-tier factor the account actually holds — email/phone (OTP, `handle` = factor id),
|
|
201
|
+
* an OAuth provider (redirect), or an external wallet (SIWE, `handle` = factor id).
|
|
202
|
+
*
|
|
203
|
+
* Distinct from `link.mode === 'step_up'`, which proves a COLLIDING account the caller has not logged into.
|
|
204
|
+
* Here the caller already holds a session for the account; the proof exists because a session alone must not
|
|
205
|
+
* authorize binding a new login factor — otherwise a stolen session becomes permanent access. Identifiers are
|
|
206
|
+
* masked for display only; the server picks the factor a proof is judged against. (ENG-7075)
|
|
207
|
+
*/
|
|
208
|
+
stepUp?: {
|
|
209
|
+
methods: StepUpOption[];
|
|
210
|
+
};
|
|
211
|
+
/**
|
|
212
|
+
* Present on `authenticated` for an OAuth/OIDC login: which provider authenticated the user (plus, for a
|
|
213
|
+
* partner-configured connection, its stable `configHandle` + human `label`) — so the client renders "via
|
|
214
|
+
* Acme SSO" and offers per-connection revoke. `configHandle`/`label` absent on Para-global creds. (ENG-7008)
|
|
139
215
|
*/
|
|
140
216
|
attribution?: {
|
|
141
217
|
provider: TOAuthMethod;
|
|
142
218
|
configHandle?: string;
|
|
143
219
|
label?: string;
|
|
144
220
|
};
|
|
221
|
+
/**
|
|
222
|
+
* Present on `linked`: the display-ready view of the factor the link flow just attached, so the client
|
|
223
|
+
* updates its factor list without a refetch. (ENG-7075)
|
|
224
|
+
*/
|
|
225
|
+
factor?: AuthFactorView<string>;
|
|
226
|
+
/**
|
|
227
|
+
* Present on `unlinked`: the account's factor list AFTER the revoke, so the client re-renders without a
|
|
228
|
+
* second round-trip — the same courtesy `linked` does with `factor`. (ENG-7075)
|
|
229
|
+
*/
|
|
230
|
+
factors?: AuthFactorView<string>[];
|
|
231
|
+
/**
|
|
232
|
+
* Present on `authenticated`: the initiating SDK session's lookup id — the session the backend bridged this
|
|
233
|
+
* login onto. The portal completes post-login (sessionAuth / share access) off THIS session, not a
|
|
234
|
+
* URL-threaded one, so the flow stays flowId-only (no sessionId on the OAuth callback URL). Omitted if the
|
|
235
|
+
* flow carried no initiating lookup (start always self-mints one). (ENG-7075)
|
|
236
|
+
*/
|
|
237
|
+
sessionLookupId?: string;
|
|
238
|
+
/**
|
|
239
|
+
* Present on `authenticated` for an EXTERNAL_WALLET login: full-Para-auth (mint an embedded Para wallet) vs
|
|
240
|
+
* verify-only (prove ownership, no wallet), carried from the `/start` body. The portal reads this to SKIP the
|
|
241
|
+
* post-login wallet tail (all-wallets fetch / keyshare / migration) for verify-only — the flowId-only v2
|
|
242
|
+
* portal URL never seeds the client's `authInfo.externalWallet`, so this is the portal's only
|
|
243
|
+
* server-authoritative verify-vs-full signal. (ENG-7075)
|
|
244
|
+
*/
|
|
245
|
+
externalWallet?: {
|
|
246
|
+
withFullParaAuth: boolean;
|
|
247
|
+
};
|
|
145
248
|
};
|
|
146
249
|
/**
|
|
147
|
-
* Request bodies for the method-agnostic `/v2/auth` surface —
|
|
148
|
-
*
|
|
149
|
-
*
|
|
150
|
-
*
|
|
151
|
-
|
|
250
|
+
* Request bodies for the method-agnostic `/v2/auth` surface — counterpart to the `AuthState` response,
|
|
251
|
+
* kept here so the request+response contract is single-source across the backend handlers (which validate
|
|
252
|
+
* `req.body`) and the SDK client (which constructs them). The backend still runtime-validates every field;
|
|
253
|
+
* these types are the compile-time contract, not the trust boundary. (ENG-6910 / ENG-6911)
|
|
254
|
+
*/
|
|
255
|
+
/**
|
|
256
|
+
* `start` body — discriminated by `method`; each carries only the fields its flow needs.
|
|
257
|
+
*
|
|
258
|
+
* `intent: 'link'` turns a start into an authenticated-user ADD-factor flow instead of a login: it binds to
|
|
259
|
+
* the CALLING SESSION's account (session cookie required), runs the same proof screen (OTP / SIWE / OAuth
|
|
260
|
+
* redirect), and `continue` ATTACHES the proven factor to that account (status `linked`) unless the identity
|
|
261
|
+
* already belongs to another account (409). PASSKEY does not participate in linking. Absent intent = normal
|
|
262
|
+
* login (unchanged). (ENG-7075)
|
|
152
263
|
*/
|
|
153
|
-
/** `start` body — discriminated by `method`. Each method carries only the fields its flow needs. */
|
|
154
264
|
export type AuthStartBody = {
|
|
155
265
|
method: 'EMAIL';
|
|
156
266
|
email: string;
|
|
267
|
+
intent?: 'link';
|
|
157
268
|
} | {
|
|
158
269
|
method: 'PHONE';
|
|
159
270
|
phone: string;
|
|
160
271
|
countryCode?: string;
|
|
272
|
+
intent?: 'link';
|
|
161
273
|
} | {
|
|
162
274
|
method: 'EXTERNAL_WALLET';
|
|
163
275
|
address: string;
|
|
164
276
|
chainType: TWalletType;
|
|
165
277
|
uri: string;
|
|
166
278
|
chainId?: string;
|
|
279
|
+
/**
|
|
280
|
+
* Full-Para-auth (mint an embedded Para wallet) vs verify-only (prove ownership, no wallet). Carried
|
|
281
|
+
* onto the flow at `/start` and mirrored back on the `authenticated` envelope
|
|
282
|
+
* (`externalWallet.withFullParaAuth`) so the portal can skip the wallet tail for verify-only — the
|
|
283
|
+
* flowId-only v2 portal URL never seeds `authInfo.externalWallet`, so this is its only
|
|
284
|
+
* server-authoritative signal. Absent ⇒ verify-only. (ENG-7075)
|
|
285
|
+
*/
|
|
286
|
+
withFullParaAuth?: boolean;
|
|
287
|
+
intent?: 'link';
|
|
167
288
|
} | {
|
|
168
289
|
method: 'PASSKEY';
|
|
169
290
|
} | {
|
|
@@ -171,13 +292,18 @@ export type AuthStartBody = {
|
|
|
171
292
|
provider: TOAuthMethod;
|
|
172
293
|
returnUrl?: string;
|
|
173
294
|
providerConfigHandle?: string;
|
|
295
|
+
/** Farcaster (POLL) only: the mobile app scheme baked into the SIWF channel's redirect for deeplink-back. */
|
|
296
|
+
appScheme?: string;
|
|
297
|
+
intent?: 'link';
|
|
174
298
|
};
|
|
175
|
-
/** How a `needs_link` collision is resolved: step up to the existing account, or fork a separate one. */
|
|
176
|
-
export type AuthLinkAction = 'link' | 'create_separate';
|
|
177
299
|
/**
|
|
178
|
-
* `
|
|
179
|
-
*
|
|
180
|
-
|
|
300
|
+
* How a `needs_link` collision is resolved: `select` a candidate (multi-account), `link` (step up to
|
|
301
|
+
* into the existing account), or `create_separate` (fork a new one).
|
|
302
|
+
*/
|
|
303
|
+
export type AuthLinkAction = 'link' | 'create_separate' | 'select';
|
|
304
|
+
/**
|
|
305
|
+
* `continue` body — always the `flowId` plus the per-state proof. The endpoint is overloaded by the flow's
|
|
306
|
+
* server-side state, not a body discriminant, so each proof field is optional and only the relevant one is sent.
|
|
181
307
|
*/
|
|
182
308
|
export type AuthContinueBody = {
|
|
183
309
|
flowId: string;
|
|
@@ -187,14 +313,37 @@ export type AuthContinueBody = {
|
|
|
187
313
|
signature?: string;
|
|
188
314
|
cosmosSigner?: string;
|
|
189
315
|
cosmosPublicKeyHex?: string;
|
|
190
|
-
/** Passkey: the WebAuthn assertion
|
|
316
|
+
/** Passkey: the WebAuthn assertion — for a PASSKEY flow, or as a returning account's credential completion
|
|
317
|
+
* of an EMAIL/PHONE flow (signs the challenge the start envelope carried). */
|
|
191
318
|
credentialId?: string;
|
|
192
319
|
clientDataJSON?: string;
|
|
193
320
|
authenticatorData?: string;
|
|
194
|
-
/**
|
|
321
|
+
/**
|
|
322
|
+
* Password/PIN credential completion of an EMAIL/PHONE flow (returning non-enclave account): the
|
|
323
|
+
* RSA-challenge signature over the portal session's web challenge, plus the signing key's stored public key
|
|
324
|
+
* (selects among the ACCOUNT's own password rows server-side — never trusted as an identity). (ENG-7075)
|
|
325
|
+
*/
|
|
326
|
+
credentialSignature?: string;
|
|
327
|
+
credentialPublicKey?: string;
|
|
328
|
+
/** Telegram (WIDGET mechanism): the signed Login Widget payload, HMAC-verified server-side. (ENG-7075) */
|
|
329
|
+
telegramAuthResponse?: TelegramAuthResponse;
|
|
330
|
+
/** Cross-method linking: resolve a `needs_link` collision. `method` is the step-up method being proved — an
|
|
331
|
+
* OTP method (`EMAIL`/`PHONE`) or an OAuth provider. `handle` picks a candidate account in `select` mode. */
|
|
195
332
|
link?: {
|
|
196
333
|
action: AuthLinkAction;
|
|
197
|
-
method?: TOAuthMethod;
|
|
334
|
+
method?: TAuthFlowMethod | TOAuthMethod;
|
|
335
|
+
handle?: string;
|
|
336
|
+
};
|
|
337
|
+
/**
|
|
338
|
+
* Factor-link step-up (`needs_step_up`): which of the session account's own factors is being proved.
|
|
339
|
+
* `method` is an OTP method (`EMAIL`/`PHONE`), `EXTERNAL_WALLET`, or an OAuth provider; `handle` picks the
|
|
340
|
+
* exact factor when the account holds several of that type. Sending it with no proof STARTS the step-up
|
|
341
|
+
* (delivers the code / issues the challenge / returns the redirect); the proof itself then arrives in the
|
|
342
|
+
* matching field (`code`, `signature`) or via the provider callback. (ENG-7075)
|
|
343
|
+
*/
|
|
344
|
+
stepUp?: {
|
|
345
|
+
method: TAuthFlowMethod | TOAuthMethod;
|
|
346
|
+
handle?: string;
|
|
198
347
|
};
|
|
199
348
|
/** OAuth step-up (during linking): where the provider callback returns to. */
|
|
200
349
|
returnUrl?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authState.d.ts","sourceRoot":"","sources":["../../../src/types/authState.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"authState.d.ts","sourceRoot":"","sources":["../../../src/types/authState.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,aAAa,kJAShB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oEAAqE,CAAC;AAEpG,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,eAAe,GAAG,YAAY,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;+GAG2G;IAC3G,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,0BAA0B,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,eAAe,GAAG,YAAY,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,+FAA+F;IAC/F,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EACD;QACE,IAAI,EAAE,SAAS,CAAC;QAChB,OAAO,EAAE,YAAY,EAAE,CAAC;QACxB,eAAe,CAAC,EAAE,0BAA0B,CAAC;QAC7C;;;;;WAKG;QACH,aAAa,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;KACzC,GACD;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IACE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;mFAC+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;kHAC8G;IAC9G,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5F;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,eAAe,GAAG,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAA;CAAE,CAAC"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { z } from 'zod';
|
|
2
2
|
import type { permissionsV2AggregateOperatorSchema, permissionsV2CompareOperatorSchema, permissionsV2ConditionSchema, permissionsV2ConditionalApprovalCaseStatusSchema, permissionsV2ConditionalApprovalCaseListSchema, permissionsV2ConditionalApprovalCaseViewSchema, permissionsV2ConditionalApprovalDecisionSchema, permissionsV2ConditionalApprovalSignatureSchema, permissionsV2TransactionSignatureCollectionSchema, permissionsV2ConditionalApprovalDecisionCapabilitySchema, permissionsV2ConditionalApprovalDecisionUnavailableReasonSchema, permissionsV2ConditionalApprovalEligibilitySchema, permissionsV2ConditionalApprovalRequirementIdentitySchema, permissionsV2ConditionalApprovalRequirementSchema, permissionsV2ConditionalApprovalSafeKnobSchema, permissionsV2ConditionalApprovalStageSchema, permissionsV2AuthorityAssignmentSchema, permissionsV2AuthoritySetViewSchema, permissionsV2AuthoritySetWriteSchema, permissionsV2AuthorizationConfigurationViewSchema, permissionsV2AuthorizationConfigurationWriteSchema, permissionsV2AuthorizationScopeBindingViewSchema, permissionsV2AuthorizationScopeBindingWriteSchema, permissionsV2DelegationConsentApiStatusSchema, permissionsV2DelegationConsentDiscoveryResponseSchema, permissionsV2DelegationConsentMutationSchema, permissionsV2DelegationConsentNativeStandingMutationSchema, permissionsV2DelegationConsentRequestSchema, permissionsV2DelegationConsentStandingMutationSchema, permissionsV2DelegationConsentSubmissionSchema, permissionsV2DelegationConsentSubmissionResponseSchema, permissionsV2DelegationConsentViewSchema, permissionsV2DelegationPolicyDefinitionSchema, permissionsV2PartnerAuthoredPolicyDefinitionSchema, permissionsV2PartnerAuthoredPolicySelectorSchema, permissionsV2PartnerPolicyCandidateSchema, permissionsV2PolicyEffectSchema, permissionsV2PolicyLayerSchema, permissionsV2PolicyMetadataSchema, permissionsV2PolicyModeSchema, permissionsV2PolicyRuleSchema, permissionsV2SigningRequestTypes, permissionsV2ValidationErrorSchema, policyAuthoringJsonObjectSchema, policyAuthoringJsonPrimitiveSchema, policyAuthoringJsonValueSchema, policyAuthoringSigningRequestRoutes, policyAuthoringSigningWalletTypes } from '../schemas/permissionsV2.js';
|
|
3
|
+
import type { permissionsV2AuthorizationConfigurationHistorySchema, permissionsV2AuthorizationScopeBindingHistorySchema, permissionsV2AuthorizationScopeCapabilitiesSchema, permissionsV2AuthorizationScopeMembersSchema, permissionsV2AuthoritySetHistorySchema, permissionsV2ConditionalApprovalCaseSummarySchema, permissionsV2ConditionalApprovalPartnerCaseListSchema, permissionsV2ConditionalRequirementListSchema, permissionsV2ConditionalRequirementViewSchema, permissionsV2EffectiveAuthorizationConfigurationSchema, permissionsV2PolicyListResponseSchema, permissionsV2PolicyResponseSchema, permissionsV2PolicyUsageMeterSchema, permissionsV2PolicyUsageSchema, permissionsV2PolicyVersionsResponseSchema, permissionsV2PolicyViewSchema, permissionsV2ResolvedConditionalApprovalRequirementSchema } from '../schemas/permissionsV2Lifecycle.js';
|
|
3
4
|
export type PolicyAuthoringLayer = z.infer<typeof permissionsV2PolicyLayerSchema>;
|
|
4
5
|
export type PolicyAuthoringEffect = z.infer<typeof permissionsV2PolicyEffectSchema>;
|
|
5
6
|
export type PolicyAuthoringConditionKind = 'compare' | 'aggregate' | 'all' | 'any' | 'not';
|
|
@@ -60,6 +61,23 @@ export type PermissionsV2DelegationConsentSubmission = z.infer<typeof permission
|
|
|
60
61
|
export type PermissionsV2DelegationConsentSubmissionResponse = z.infer<typeof permissionsV2DelegationConsentSubmissionResponseSchema>;
|
|
61
62
|
export type PermissionsV2DelegationConsentRequest = z.infer<typeof permissionsV2DelegationConsentRequestSchema>;
|
|
62
63
|
export type PermissionsV2DelegationConsentDiscoveryResponse = z.infer<typeof permissionsV2DelegationConsentDiscoveryResponseSchema>;
|
|
64
|
+
export type PermissionsV2PolicyView = z.infer<typeof permissionsV2PolicyViewSchema>;
|
|
65
|
+
export type PermissionsV2PolicyListResponse = z.infer<typeof permissionsV2PolicyListResponseSchema>;
|
|
66
|
+
export type PermissionsV2PolicyResponse = z.infer<typeof permissionsV2PolicyResponseSchema>;
|
|
67
|
+
export type PermissionsV2PolicyVersionsResponse = z.infer<typeof permissionsV2PolicyVersionsResponseSchema>;
|
|
68
|
+
export type PermissionsV2PolicyUsageMeter = z.infer<typeof permissionsV2PolicyUsageMeterSchema>;
|
|
69
|
+
export type PermissionsV2PolicyUsage = z.infer<typeof permissionsV2PolicyUsageSchema>;
|
|
70
|
+
export type PermissionsV2ConditionalApprovalCaseSummary = z.infer<typeof permissionsV2ConditionalApprovalCaseSummarySchema>;
|
|
71
|
+
export type PermissionsV2ConditionalApprovalPartnerCaseList = z.infer<typeof permissionsV2ConditionalApprovalPartnerCaseListSchema>;
|
|
72
|
+
export type PermissionsV2ConditionalRequirementView = z.infer<typeof permissionsV2ConditionalRequirementViewSchema>;
|
|
73
|
+
export type PermissionsV2ConditionalRequirementList = z.infer<typeof permissionsV2ConditionalRequirementListSchema>;
|
|
74
|
+
export type PermissionsV2ResolvedConditionalApprovalRequirement = z.infer<typeof permissionsV2ResolvedConditionalApprovalRequirementSchema>;
|
|
75
|
+
export type PermissionsV2EffectiveAuthorizationConfiguration = z.infer<typeof permissionsV2EffectiveAuthorizationConfigurationSchema>;
|
|
76
|
+
export type PermissionsV2AuthorizationScopeCapabilities = z.infer<typeof permissionsV2AuthorizationScopeCapabilitiesSchema>;
|
|
77
|
+
export type PermissionsV2AuthorizationScopeMembers = z.infer<typeof permissionsV2AuthorizationScopeMembersSchema>;
|
|
78
|
+
export type PermissionsV2AuthoritySetHistory = z.infer<typeof permissionsV2AuthoritySetHistorySchema>;
|
|
79
|
+
export type PermissionsV2AuthorizationScopeBindingHistory = z.infer<typeof permissionsV2AuthorizationScopeBindingHistorySchema>;
|
|
80
|
+
export type PermissionsV2AuthorizationConfigurationHistory = z.infer<typeof permissionsV2AuthorizationConfigurationHistorySchema>;
|
|
63
81
|
export type PolicyAuthoringFactEligibility = {
|
|
64
82
|
walletTypes: PolicyAuthoringWalletType[];
|
|
65
83
|
requestRoutes: PolicyAuthoringRequestRoute[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/types/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EACV,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,gDAAgD,EAChD,8CAA8C,EAC9C,8CAA8C,EAC9C,8CAA8C,EAC9C,+CAA+C,EAC/C,iDAAiD,EACjD,wDAAwD,EACxD,+DAA+D,EAC/D,iDAAiD,EACjD,yDAAyD,EACzD,iDAAiD,EACjD,8CAA8C,EAC9C,2CAA2C,EAC3C,sCAAsC,EACtC,mCAAmC,EACnC,oCAAoC,EACpC,iDAAiD,EACjD,kDAAkD,EAClD,gDAAgD,EAChD,iDAAiD,EACjD,6CAA6C,EAC7C,qDAAqD,EACrD,4CAA4C,EAC5C,0DAA0D,EAC1D,2CAA2C,EAC3C,oDAAoD,EACpD,8CAA8C,EAC9C,sDAAsD,EACtD,wCAAwC,EACxC,6CAA6C,EAC7C,kDAAkD,EAClD,gDAAgD,EAChD,yCAAyC,EACzC,+BAA+B,EAC/B,8BAA8B,EAC9B,iCAAiC,EACjC,6BAA6B,EAC7B,6BAA6B,EAC7B,gCAAgC,EAChC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,mCAAmC,EACnC,iCAAiC,EAClC,MAAM,6BAA6B,CAAC;
|
|
1
|
+
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/types/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EACV,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,gDAAgD,EAChD,8CAA8C,EAC9C,8CAA8C,EAC9C,8CAA8C,EAC9C,+CAA+C,EAC/C,iDAAiD,EACjD,wDAAwD,EACxD,+DAA+D,EAC/D,iDAAiD,EACjD,yDAAyD,EACzD,iDAAiD,EACjD,8CAA8C,EAC9C,2CAA2C,EAC3C,sCAAsC,EACtC,mCAAmC,EACnC,oCAAoC,EACpC,iDAAiD,EACjD,kDAAkD,EAClD,gDAAgD,EAChD,iDAAiD,EACjD,6CAA6C,EAC7C,qDAAqD,EACrD,4CAA4C,EAC5C,0DAA0D,EAC1D,2CAA2C,EAC3C,oDAAoD,EACpD,8CAA8C,EAC9C,sDAAsD,EACtD,wCAAwC,EACxC,6CAA6C,EAC7C,kDAAkD,EAClD,gDAAgD,EAChD,yCAAyC,EACzC,+BAA+B,EAC/B,8BAA8B,EAC9B,iCAAiC,EACjC,6BAA6B,EAC7B,6BAA6B,EAC7B,gCAAgC,EAChC,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,mCAAmC,EACnC,iCAAiC,EAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,oDAAoD,EACpD,mDAAmD,EACnD,iDAAiD,EACjD,4CAA4C,EAC5C,sCAAsC,EACtC,iDAAiD,EACjD,qDAAqD,EACrD,6CAA6C,EAC7C,6CAA6C,EAC7C,sDAAsD,EACtD,qCAAqC,EACrC,iCAAiC,EACjC,mCAAmC,EACnC,8BAA8B,EAC9B,yCAAyC,EACzC,6BAA6B,EAC7B,yDAAyD,EAC1D,MAAM,sCAAsC,CAAC;AAE9C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACpF,MAAM,MAAM,4BAA4B,GAAG,SAAS,GAAG,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAC3F,MAAM,MAAM,4BAA4B,GACpC,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,SAAS,GACT,QAAQ,GACR,WAAW,GACX,cAAc,CAAC;AACnB,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAClG,MAAM,MAAM,kCAAkC,GAAG,CAAC,OAAO,mCAAmC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtG,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAC/C,MAAM,MAAM,yBAAyB,GAAG,gCAAgC,GAAG,0BAA0B,CAAC;AACtG,MAAM,MAAM,2BAA2B,GAAG,kCAAkC,GAAG,0BAA0B,CAAC;AAC1G,MAAM,MAAM,0BAA0B,GAAG,gCAAgC,GAAG,0BAA0B,CAAC;AACvG,MAAM,MAAM,4BAA4B,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAC9G,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,0BAA0B,CAAC;AACnG,MAAM,MAAM,6BAA6B,GAAG,cAAc,GAAG,UAAU,CAAC;AACxE,MAAM,MAAM,gCAAgC,GAAG,cAAc,GAAG,UAAU,CAAC;AAC3E,MAAM,MAAM,4BAA4B,GAAG,SAAS,GAAG,aAAa,GAAG,cAAc,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE3H,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAChH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,yDAAyD,GAAG,CAAC,CAAC,KAAK,CAC7E,OAAO,+DAA+D,CACvE,CAAC;AACF,MAAM,MAAM,kDAAkD,GAAG,CAAC,CAAC,KAAK,CACtE,OAAO,wDAAwD,CAChE,CAAC;AACF,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CACvE,OAAO,yDAAyD,CACjE,CAAC;AACF,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;AACxH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAChE,OAAO,kDAAkD,CAC1D,CAAC;AACF,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gDAAgD,CAAC,CAAC;AAC1H,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,4CAA4C,GAAG,CAAC,CAAC,KAAK,CAChE,OAAO,kDAAkD,CAC1D,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAClH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAClE,OAAO,oDAAoD,CAC5D,CAAC;AACF,MAAM,MAAM,oDAAoD,GAAG,CAAC,CAAC,KAAK,CACxE,OAAO,0DAA0D,CAClE,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CACpE,OAAO,sDAAsD,CAC9D,CAAC;AACF,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAChH,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CACnE,OAAO,qDAAqD,CAC7D,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAC5G,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,+CAA+C,GAAG,CAAC,CAAC,KAAK,CACnE,OAAO,qDAAqD,CAC7D,CAAC;AACF,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6CAA6C,CAAC,CAAC;AACpH,MAAM,MAAM,mDAAmD,GAAG,CAAC,CAAC,KAAK,CACvE,OAAO,yDAAyD,CACjE,CAAC;AACF,MAAM,MAAM,gDAAgD,GAAG,CAAC,CAAC,KAAK,CACpE,OAAO,sDAAsD,CAC9D,CAAC;AACF,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAC5H,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAClH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,MAAM,MAAM,6CAA6C,GAAG,CAAC,CAAC,KAAK,CACjE,OAAO,mDAAmD,CAC3D,CAAC;AACF,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAClE,OAAO,oDAAoD,CAC5D,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,WAAW,EAAE,yBAAyB,EAAE,CAAC;IACzC,aAAa,EAAE,2BAA2B,EAAE,CAAC;IAC7C,aAAa,EAAE,0BAA0B,EAAE,CAAC;IAC5C,cAAc,EAAE,4BAA4B,EAAE,CAAC;IAC/C,cAAc,EAAE,4BAA4B,EAAE,CAAC;IAC/C,cAAc,EAAE,6BAA6B,CAAC;IAC9C,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,aAAa,EAAE,4BAA4B,CAAC;IAC5C,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,4BAA4B,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,wBAAwB,CAAC;IAClC,aAAa,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC/C,oBAAoB,EAAE,gCAAgC,EAAE,CAAC;IACzD,WAAW,EAAE,8BAA8B,CAAC;CAC7C;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,4BAA4B,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,wBAAwB,CAAC;IAClC,UAAU,EAAE,qBAAqB,CAAC;IAClC,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,iCAAiC,CAAC;IACjD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE;QACR,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,cAAc,EAAE,4BAA4B,EAAE,CAAC;IAC/C,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,cAAc,EAAE,qBAAqB,EAAE,CAAC;IACxC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,EAAE,yBAAyB,CAAC;CACvC"}
|