@k2b/cloud 0.6.0-rc.0

package/src/api/admin-lifecycle.ts

@@ -0,0 +1,206 @@
+import { ok } from "@k2b/stdlib";
+import { Hono } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { createPagination, ErrorResponseSchema, MessageResponseSchema, PaginationQuerySchema, parsePagination } from "../contracts";
+import { type AuthContext, auth, jsonResponse, requiresAdmin, respond, v } from "../server";
+import { accountLifecycle, lifecycleJobs } from "../services";
+
+const DeletedAccountSchema = z.object({
+  id: z.uuid(),
+  deletedUserId: z.uuid(),
+  uid: z.string(),
+  mail: z.string().nullable(),
+  displayName: z.string().nullable(),
+  previousProvider: z.string().nullable(),
+  previousProfile: z.string().nullable(),
+  reason: z.string(),
+  deletedAt: z.string().datetime(),
+  meta: z.record(z.string(), z.unknown()),
+});
+
+const ReminderAuditSchema = z.object({
+  id: z.uuid(),
+  userId: z.uuid().nullable(),
+  uid: z.string().nullable(),
+  mail: z.string().nullable(),
+  displayName: z.string().nullable(),
+  kind: z.enum(["account_expiry"]),
+  thresholdDays: z.number().int().positive(),
+  targetExpiryAt: z.string().datetime(),
+  status: z.enum(["pending", "sent", "error"]),
+  attemptCount: z.number().int().nonnegative(),
+  lastAttemptAt: z.string().datetime().nullable(),
+  sentAt: z.string().datetime().nullable(),
+  lastError: z.string().nullable(),
+  createdAt: z.string().datetime(),
+});
+
+const DeletedAccountsResponseSchema = z.object({
+  items: z.array(DeletedAccountSchema),
+  pagination: z.object({
+    page: z.number(),
+    per_page: z.number(),
+    total: z.number(),
+    total_pages: z.number(),
+    has_next: z.boolean(),
+  }),
+});
+
+const ReminderAuditResponseSchema = z.object({
+  items: z.array(ReminderAuditSchema),
+  pagination: z.object({
+    page: z.number(),
+    per_page: z.number(),
+    total: z.number(),
+    total_pages: z.number(),
+    has_next: z.boolean(),
+  }),
+});
+
+const TriggerJobResponseSchema = z.object({
+  message: z.string(),
+  jobId: z.string(),
+});
+
+const app = new Hono<AuthContext>()
+  .use(auth.requireRole("admin"))
+  .get(
+    "/deleted-accounts",
+    describeRoute({
+      tags: ["Admin Lifecycle"],
+      summary: "List deleted account lifecycle entries",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(DeletedAccountsResponseSchema, "Deleted account lifecycle entries"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+      },
+    }),
+    v(
+      "query",
+      z.object({
+        ...PaginationQuerySchema.shape,
+        reason: z.string().optional(),
+        search: z.string().optional(),
+      }),
+    ),
+    async (c) => {
+      const query = c.req.valid("query");
+      const pagination = parsePagination(query);
+      const result = await accountLifecycle.listDeletedAccounts({
+        page: pagination.page,
+        perPage: pagination.perPage,
+        reason: query.reason,
+        search: query.search,
+      });
+
+      return c.json({
+        items: result.items,
+        pagination: createPagination(pagination, result.total),
+      });
+    },
+  )
+  .get(
+    "/reminders",
+    describeRoute({
+      tags: ["Admin Lifecycle"],
+      summary: "List reminder history entries",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(ReminderAuditResponseSchema, "Reminder history entries"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+      },
+    }),
+    v(
+      "query",
+      z.object({
+        ...PaginationQuerySchema.shape,
+        status: z.enum(["pending", "sent", "error"]).optional(),
+        kind: z.enum(["account_expiry"]).optional(),
+        search: z.string().optional(),
+      }),
+    ),
+    async (c) => {
+      const query = c.req.valid("query");
+      const pagination = parsePagination(query);
+      const result = await accountLifecycle.listReminderAudit({
+        page: pagination.page,
+        perPage: pagination.perPage,
+        status: query.status,
+        kind: query.kind,
+        search: query.search,
+      });
+
+      return c.json({
+        items: result.items,
+        pagination: createPagination(pagination, result.total),
+      });
+    },
+  )
+  // Manual-only lifecycle jobs. Scheduled jobs such as IPA sync and reminders
+  // run from their broker schedules; Admin Observability Jobs can run them now.
+  .post(
+    "/jobs",
+    describeRoute({
+      tags: ["Admin Lifecycle"],
+      summary: "Submit a lifecycle job",
+      description:
+        "Dispatches one of the account-lifecycle backfill jobs. Scheduled lifecycle jobs are controlled from Admin Observability Jobs.",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(TriggerJobResponseSchema, "Job submitted"),
+        400: jsonResponse(ErrorResponseSchema, "Unknown job kind"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+      },
+    }),
+    v(
+      "json",
+      z.object({
+        kind: z.enum(["ipa-backfill", "local-user-backfill", "guest-backfill"]),
+      }),
+    ),
+    async (c) =>
+      respond(c, async () => {
+        const { kind } = c.req.valid("json");
+        switch (kind) {
+          case "ipa-backfill":
+            return ok({ message: "IPA backfill job submitted", jobId: await lifecycleJobs.submitIpaBackfill() });
+          case "local-user-backfill":
+            return ok({ message: "Local user backfill job submitted", jobId: await lifecycleJobs.submitLocalUserBackfill() });
+          case "guest-backfill":
+            return ok({ message: "Local guest backfill job submitted", jobId: await lifecycleJobs.submitGuestBackfill() });
+        }
+      }),
+  )
+  .get(
+    "/health",
+    describeRoute({
+      tags: ["Admin Lifecycle"],
+      summary: "Lifecycle worker metrics",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(z.object({ metrics: z.record(z.string(), z.unknown()) }), "Process-local worker metrics"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+      },
+    }),
+    async (c) => c.json({ metrics: lifecycleJobs.metrics() }),
+  )
+  .get(
+    "/",
+    describeRoute({
+      tags: ["Admin Lifecycle"],
+      summary: "Lifecycle API root",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(MessageResponseSchema, "Lifecycle API available"),
+      },
+    }),
+    (c) => c.json({ message: "Account lifecycle admin API" }),
+  );
+
+export default app;
+export type ApiType = typeof app;

package/src/api/admin-linux-identities.ts

@@ -0,0 +1,66 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { LinuxIdentityConfigurationSchema, PosixOverridesSchema } from "../contracts/posix";
+import { auth, type AuthContext, v } from "../server";
+import { posix, PosixError } from "../services/accounts/posix";
+
+const Id = z.object({ id: z.uuid() });
+const Configure = z.object({ config: LinuxIdentityConfigurationSchema, rangeReserved: z.boolean() }).strict();
+
+export const createAdminLinuxIdentityRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
+  service: typeof posix = posix,
+) =>
+  new Hono<AuthContext>()
+    .use(authenticate)
+    .onError((error, c) => {
+      if (error instanceof PosixError) return c.json({ code: error.code }, error.status);
+      throw error;
+    })
+    .get(
+      "/",
+      describeRoute({ tags: ["Linux identities"], summary: "Preview Linux identities without provisioning accounts" }),
+      v(
+        "query",
+        z.object({ after: z.uuid().optional(), search: z.string().trim().optional(), scope: z.enum(["ready", "all"]).optional() }),
+      ),
+      async (c) => c.json(await service.overview(c.get("user"), c.req.valid("query").after ?? null, c.req.valid("query"))),
+    )
+    .put(
+      "/configuration",
+      describeRoute({ tags: ["Linux identities"], summary: "Configure automatic local Linux identity assignment; does not enable computer login" }),
+      v("json", Configure),
+      async (c) => {
+        const { config, rangeReserved } = c.req.valid("json");
+        if (config.enabled && !rangeReserved) throw new PosixError("range_confirmation_required", 400);
+        return c.json(await service.configure(c.get("user"), config));
+      },
+    )
+    .get(
+      "/users/:id",
+      describeRoute({ tags: ["Linux identities"], summary: "Read a local or FreeIPA Linux identity" }),
+      v("param", Id),
+      async (c) => c.json(await service.get(c.get("user"), c.req.valid("param").id)),
+    )
+    .post(
+      "/users/:id",
+      describeRoute({ tags: ["Linux identities"], summary: "Backfill missing Linux attributes for one local full account; safe to repeat" }),
+      v("param", Id),
+      async (c) => c.json(await service.provision(c.get("user"), c.req.valid("param").id)),
+    )
+    .post(
+      "/groups/:id",
+      describeRoute({ tags: ["Linux identities"], summary: "Assign a stable Linux GID to a local group" }),
+      v("param", Id),
+      async (c) => c.json(await service.provisionGroup(c.get("user"), c.req.valid("param").id)),
+    )
+    .patch(
+      "/users/:id",
+      describeRoute({ tags: ["Linux identities"], summary: "Change local home and shell without changing numeric IDs or moving files" }),
+      v("param", Id),
+      v("json", PosixOverridesSchema),
+      async (c) => c.json(await service.update(c.get("user"), c.req.valid("param").id, c.req.valid("json"))),
+    );
+
+export default createAdminLinuxIdentityRoutes();

package/src/api/announcements.ts

@@ -0,0 +1,131 @@
+import { ok } from "@k2b/stdlib";
+import { Hono } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import {
+  ActiveAnnouncementsResponseSchema,
+  AnnouncementEntrySchema,
+  AnnouncementListResponseSchema,
+  CreateAnnouncementSchema,
+  ErrorResponseSchema,
+  MessageResponseSchema,
+  parseAnnouncementCookieHeader,
+  UpdateAnnouncementSchema,
+} from "../contracts";
+import { type AuthContext, auth, jsonResponse, requiresAdmin, requiresAuth, respond, v } from "../server";
+import { announcements } from "../services";
+
+const IdParamSchema = z.object({ id: z.uuid() });
+
+const withMessage = async <T>(operation: Promise<import("@k2b/stdlib").Result<T>>, message: string) => {
+  const result = await operation;
+  if (!result.ok) return result;
+  return ok({ message });
+};
+
+export const announcementRoutes = new Hono<AuthContext>().get(
+  "/active",
+  auth.requireRole("authenticated"),
+  describeRoute({
+    tags: ["Announcements"],
+    summary: "List active user announcements",
+    description: "Returns active banners and unseen announcements for the current request cookie state.",
+    ...requiresAuth,
+    responses: {
+      200: jsonResponse(ActiveAnnouncementsResponseSchema, "Active announcements"),
+      401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+    },
+  }),
+  async (c) => {
+    const state = parseAnnouncementCookieHeader(c.req.header("Cookie"));
+    return respond(c, ok(await announcements.active.forState({ state })));
+  },
+);
+
+export const adminAnnouncementRoutes = new Hono<AuthContext>()
+  .use(auth.requireRole("admin"))
+  .get(
+    "/",
+    describeRoute({
+      tags: ["Admin Announcements"],
+      summary: "List announcements",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(AnnouncementListResponseSchema, "Announcements"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+      },
+    }),
+    v(
+      "query",
+      z.object({
+        kind: z.enum(["announcement", "banner"]).optional(),
+        search: z.string().optional(),
+      }),
+    ),
+    async (c) => {
+      const query = c.req.valid("query");
+      const items = await announcements.admin.list({
+        filter: { kind: query.kind, query: query.search },
+      });
+      return respond(c, ok({ items }));
+    },
+  )
+  .post(
+    "/",
+    describeRoute({
+      tags: ["Admin Announcements"],
+      summary: "Create announcement",
+      ...requiresAdmin,
+      responses: {
+        201: jsonResponse(AnnouncementEntrySchema, "Created announcement"),
+        400: jsonResponse(ErrorResponseSchema, "Validation error"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+      },
+    }),
+    v("json", CreateAnnouncementSchema),
+    async (c) => respond(c, announcements.admin.create({ data: c.req.valid("json"), actorId: c.get("user").id }), 201),
+  )
+  .patch(
+    "/:id",
+    describeRoute({
+      tags: ["Admin Announcements"],
+      summary: "Update announcement",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(AnnouncementEntrySchema, "Updated announcement"),
+        400: jsonResponse(ErrorResponseSchema, "Validation error"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+        404: jsonResponse(ErrorResponseSchema, "Announcement not found"),
+      },
+    }),
+    v("param", IdParamSchema),
+    v("json", UpdateAnnouncementSchema),
+    async (c) =>
+      respond(
+        c,
+        announcements.admin.update({
+          id: c.req.valid("param").id,
+          data: c.req.valid("json"),
+          actorId: c.get("user").id,
+        }),
+      ),
+  )
+  .delete(
+    "/:id",
+    describeRoute({
+      tags: ["Admin Announcements"],
+      summary: "Delete announcement",
+      ...requiresAdmin,
+      responses: {
+        200: jsonResponse(MessageResponseSchema, "Announcement deleted"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Admin access required"),
+        404: jsonResponse(ErrorResponseSchema, "Announcement not found"),
+      },
+    }),
+    v("param", IdParamSchema),
+    async (c) => respond(c, withMessage(announcements.admin.remove({ id: c.req.valid("param").id }), "Announcement deleted.")),
+  );

package/src/api/app-approval.ts

@@ -0,0 +1,129 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { HTTPException } from "hono/http-exception";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import {
+  APP_APPROVAL_LIMITS,
+  AppDeviceMutationSchema,
+  AppDeviceRequestSchema,
+  AppLoginReferenceSchema,
+  AppLoginStartSchema,
+  AppPairingClaimSchema,
+  AppPairingConfirmSchema,
+  AppPairingReferenceSchema,
+  AppPairingStartSchema,
+} from "../contracts/app-approval";
+import { auth, type AuthContext, rateLimit, v } from "../server";
+import { appApproval, AppApprovalError, type AppApprovalActor, type createAppApprovalService } from "../services/app-approval";
+
+const PairingIdSchema = z.object({ pairingId: z.string().uuid() }).strict();
+const DevicePageSchema = z.object({ after: z.string().uuid().optional() }).strict();
+type Service = ReturnType<typeof createAppApprovalService>;
+
+/** This is a separate credential surface, never a user API-key or OAuth scope. */
+export const createAppApprovalRoutes = (service: Service = appApproval) => {
+  const actor = async (c: Parameters<typeof auth.session.getToken>[0]): Promise<AppApprovalActor> => {
+    const token = auth.session.getToken(c);
+    const session = token ? await auth.session.authenticateRequest(c, token) : null;
+    if (!session) throw new AppApprovalError("REAUTHENTICATE", 403);
+    return { userId: session.user.id, sid: session.data.sid, admin: session.user.roles.includes("admin") };
+  };
+  return new Hono<AuthContext>()
+    .onError((error, c) => {
+      if (error instanceof AppApprovalError) return c.json({ code: error.code, message: error.code }, error.status);
+      if (error instanceof HTTPException && error.status < 500) return c.json({ code: "INVALID_REQUEST" }, error.status);
+      // Never include SQL, pairing secrets, signature bodies or keys in errors.
+      console.error("[app-approval] operation failed", error instanceof Error ? error.name : "UnknownError");
+      return c.json({ code: "UNAVAILABLE", message: "App approval is unavailable." }, 503);
+    })
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      c.header("Referrer-Policy", "no-referrer");
+      c.header("Vary", "Origin");
+      const cfg = await service.config(c.req.path.includes("/manage/") ? false : true);
+      const origin = c.req.header("Origin");
+      const deviceSurface = /\/(info|pairings\/claim|pairings\/result|device)$/.test(c.req.path);
+      if (origin && origin !== cfg.issuer && !(deviceSurface && origin === cfg.appOrigin)) return c.json({ code: "FORBIDDEN" }, 403);
+      if (!deviceSurface && c.req.method !== "GET" && origin !== cfg.issuer) return c.json({ code: "FORBIDDEN" }, 403);
+      if (deviceSurface && origin === cfg.appOrigin) {
+        c.header("Access-Control-Allow-Origin", cfg.appOrigin);
+        c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+        c.header("Access-Control-Allow-Headers", "Content-Type");
+        c.header("Access-Control-Max-Age", "300");
+      }
+      if (c.req.method === "OPTIONS") return c.body(null, 204);
+      await next();
+    })
+    .use("*", bodyLimit({ maxSize: APP_APPROVAL_LIMITS.bodyBytes }))
+    .use("*", rateLimit({ keyBy: "ip" }))
+    .use("/manage/*", auth.requireRole("authenticated"))
+    .get("/info", describeRoute({ tags: ["App approval"], summary: "Discover the enabled app approval protocol" }), async (c) =>
+      c.json(await service.info()),
+    )
+    .post(
+      "/manage/pairings/start",
+      describeRoute({ tags: ["App approval"], summary: "Start recent-session authorized device pairing" }),
+      v("json", AppPairingStartSchema),
+      async (c) => c.json(await service.startPairing(await actor(c), c.req.valid("json").userId), 201),
+    )
+    .post("/manage/pairings/status", v("json", PairingIdSchema), async (c) =>
+      c.json(await service.inspectPairing(await actor(c), c.req.valid("json").pairingId)),
+    )
+    .post("/manage/pairings/confirm", v("json", AppPairingConfirmSchema), async (c) => {
+      const input = c.req.valid("json");
+      return c.json(await service.confirmPairing(await actor(c), input.pairingId, input.comparison));
+    })
+    .post("/manage/pairings/cancel", v("json", PairingIdSchema), async (c) => {
+      await service.cancelPairing(await actor(c), c.req.valid("json").pairingId);
+      return c.body(null, 204);
+    })
+    .get("/manage/devices", v("query", DevicePageSchema), async (c) =>
+      c.json(await service.listDevices(await actor(c), c.req.valid("query").after)),
+    )
+    .post("/manage/devices/update", v("json", AppDeviceMutationSchema), async (c) => {
+      const input = c.req.valid("json");
+      await service.mutateDevice(await actor(c), input.deviceId, input.operation === "rename" ? input.name : undefined);
+      return c.body(null, 204);
+    })
+    .post(
+      "/pairings/claim",
+      describeRoute({ tags: ["App approval"], summary: "Claim a pairing with device proof of possession" }),
+      v("json", AppPairingClaimSchema),
+      async (c) => c.json(await service.claimPairing(c.req.valid("json"))),
+    )
+    .post("/pairings/result", v("json", AppPairingReferenceSchema), async (c) => {
+      const input = c.req.valid("json");
+      return c.json(await service.pairingResult(input.pairingId, input.secret, input.publicKey));
+    })
+    .post(
+      "/device",
+      describeRoute({ tags: ["App approval"], summary: "Execute a one-use signed device command" }),
+      v("json", AppDeviceRequestSchema),
+      async (c) => c.json(await service.deviceCommand(c.req.valid("json"))),
+    )
+    .post(
+      "/login/start",
+      describeRoute({ tags: ["App approval"], summary: "Start a browser-bound app login without revealing account existence" }),
+      v("json", AppLoginStartSchema),
+      async (c) => {
+        const input = c.req.valid("json");
+        return c.json(await service.startLogin(input.identifier, input.category), 202);
+      },
+    )
+    .post("/login/status", v("json", AppLoginReferenceSchema), async (c) => {
+      const input = c.req.valid("json");
+      return c.json(await service.browserStatus(input.requestId, input.browserSecret));
+    })
+    .post(
+      "/login/complete",
+      describeRoute({ tags: ["App approval"], summary: "Consume an approval once and set only the original browser session cookie" }),
+      v("json", AppLoginReferenceSchema),
+      async (c) => {
+        const input = c.req.valid("json");
+        const userId = await service.consumeLogin(input.requestId, input.browserSecret);
+        await auth.session.create(c, userId);
+        return c.body(null, 204);
+      },
+    );
+};

package/src/api/apps.ts

@@ -0,0 +1,51 @@
+import { Hono } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { ErrorResponseSchema } from "../contracts";
+import { type AuthContext, auth, jsonResponse, requiresAuth, v } from "../server";
+import { visibleNavigationApps } from "../ssr/app-navigation";
+import { getLocalizedRuntimeContext } from "../ssr/runtime";
+
+const AppListQuerySchema = z.object({
+  search: z.string().trim().min(1).optional(),
+});
+
+const VisibleAppSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  description: z.string(),
+  icon: z.string(),
+  href: z.string(),
+});
+
+const VisibleAppListSchema = z.object({
+  items: z.array(VisibleAppSchema),
+});
+
+export const appDiscoveryRoutes = new Hono<AuthContext>().use(auth.requireRole("authenticated")).get(
+  "/",
+  describeRoute({
+    tags: ["Apps"],
+    summary: "List apps available to the current user",
+    description: "Returns live Cloud apps that are visible in the current user's navigation.",
+    ...requiresAuth,
+    responses: {
+      200: jsonResponse(VisibleAppListSchema, "Available apps"),
+      401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+    },
+  }),
+  v("query", AppListQuerySchema),
+  (c) => {
+    const search = c.req.valid("query").search?.toLowerCase();
+    const items = visibleNavigationApps(getLocalizedRuntimeContext(c).apps, c.get("user"))
+      .map((app) => ({
+        id: app.id,
+        name: app.name,
+        description: app.description,
+        icon: app.icon,
+        href: app.nav.href,
+      }))
+      .filter((app) => !search || `${app.id} ${app.name} ${app.description}`.toLowerCase().includes(search));
+    return c.json({ items });
+  },
+);

package/src/api/auth/schemas.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+
+import { UserSchema } from "../../contracts";
+
+export const LoginSchema = z.object({
+  username: z.string(),
+  password: z.string(),
+  acceptedAgb: z.literal(true).optional(),
+});
+
+export const EmailLoginSchema = z.object({
+  email: z.email(),
+  category: z.enum(["guest", "login"]).optional(),
+  acceptedAgb: z.literal(true).optional(),
+  redirectTo: z.string().max(2048).optional(),
+});
+
+export const VerifyTokenSchema = z.object({
+  token: z.uuid(),
+  acceptedAgb: z.literal(true).optional(),
+});
+
+export const PasswordResetRequestSchema = z.object({
+  email: z.email(),
+  acceptedAgb: z.literal(true),
+  redirectTo: z.string().max(2048).optional(),
+});
+
+export const PasswordResetCompleteSchema = z
+  .object({
+    token: z.uuid(),
+    newPassword: z.string().min(8),
+    confirmPassword: z.string().min(1),
+    acceptedAgb: z.literal(true).optional(),
+  })
+  .refine((data) => data.newPassword === data.confirmPassword, {
+    message: "Passwords do not match",
+    path: ["confirmPassword"],
+  });
+
+export const AdminLoginSchema = z.object({
+  token: z.string().min(1),
+  restoreLocalLogin: z.boolean().default(false),
+});
+
+export const AuthResponseSchema = z.object({
+  session_token: z.string(),
+  user: UserSchema,
+});
+
+export const VerifyPasskeyAuthenticationSchema = z.object({
+  response: z.unknown(),
+  acceptedAgb: z.literal(true).optional(),
+});