@logto/schemas 1.36.0 → 1.37.0

package/lib/types/logto-config/jwt-customizer.js

@@ -1,6 +1,6 @@
 import { jsonGuard, jsonObjectGuard, socialUserInfoGuard } from '@logto/connector-kit';
 import { z } from 'zod';
-import { Organizations, Roles, UserSsoIdentities, } from '../../db-entries/index.js';
+import { Applications, Organizations, Roles, UserSsoIdentities, } from '../../db-entries/index.js';
 import { mfaFactorsGuard } from '../../foundations/index.js';
 import { InteractionEvent } from '../interactions.js';
 import { GrantType } from '../oidc-config.js';
@@ -14,7 +14,7 @@ import { oneTimeTokenVerificationRecordDataGuard } from '../verification-records
 import { passwordVerificationRecordDataGuard } from '../verification-records/password-verification.js';
 import { socialVerificationRecordDataGuard } from '../verification-records/social-verification.js';
 import { totpVerificationRecordDataGuard } from '../verification-records/totp-verification.js';
-import { webAuthnVerificationRecordDataGuard } from '../verification-records/web-authn-verification.js';
+import { webAuthnVerificationRecordDataGuard, signInWebAuthnVerificationRecordDataGuard, } from '../verification-records/web-authn-verification.js';
 import { accessTokenPayloadGuard, clientCredentialsPayloadGuard } from './oidc-provider.js';
 export const jwtCustomizerGuard = z.object({
     script: z.string(),
@@ -85,6 +85,12 @@ const jwtCustomizerUserInteractionVerificationRecordGuard = z.discriminatedUnion
         authenticationChallenge: true,
         registrationInfo: true,
     }),
+    signInWebAuthnVerificationRecordDataGuard.omit({
+        registrationChallenge: true,
+        authenticationChallenge: true,
+        registrationInfo: true,
+        authenticationRpId: true,
+    }),
     oneTimeTokenVerificationRecordDataGuard,
     newPasswordIdentityVerificationRecordDataGuard.omit({
         passwordEncrypted: true,
@@ -95,6 +101,10 @@ export const jwtCustomizerUserInteractionContextGuard = z.object({
     interactionEvent: z.nativeEnum(InteractionEvent),
     userId: z.string(),
     verificationRecords: jwtCustomizerUserInteractionVerificationRecordGuard.array(),
+    signInContext: z.record(z.string(), z.string()).optional(),
+});
+export const jwtCustomizerApplicationContextGuard = Applications.guard.omit({
+    secret: true,
 });
 export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
     .extend({
@@ -105,6 +115,7 @@ export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
         user: jwtCustomizerUserContextGuard.partial(),
         grant: jwtCustomizerGrantContextGuard.partial().optional(),
         interaction: jwtCustomizerUserInteractionContextGuard.partial().optional(),
+        application: jwtCustomizerApplicationContextGuard.partial().optional(),
     })
         .optional(),
 })
@@ -113,6 +124,11 @@ export const clientCredentialsJwtCustomizerGuard = jwtCustomizerGuard
     .extend({
     // Use partial token guard since users customization may not rely on all fields.
     tokenSample: clientCredentialsPayloadGuard.partial().optional(),
+    contextSample: z
+        .object({
+        application: jwtCustomizerApplicationContextGuard.partial().optional(),
+    })
+        .optional(),
 })
     .strict();
 /**
@@ -133,6 +149,7 @@ export const jwtCustomizerTestRequestBodyGuard = z.discriminatedUnion('tokenType
         tokenType: z.literal(LogtoJwtTokenKeyType.ClientCredentials),
         ...clientCredentialsJwtCustomizerGuard.pick({ environmentVariables: true, script: true }).shape,
         token: clientCredentialsJwtCustomizerGuard.required().shape.tokenSample,
+        context: clientCredentialsJwtCustomizerGuard.required().shape.contextSample,
     }),
 ]);
 /**
@@ -153,6 +170,9 @@ export const customJwtFetcherGuard = z.discriminatedUnion('tokenType', [
     }),
     commonJwtCustomizerGuard.extend({
         tokenType: z.literal(LogtoJwtTokenKeyType.ClientCredentials),
+        // TODO: @xiaoyijun Make `context` required once the application context feature is fully launched
+        // and all core instances are sending `context` for client credentials requests.
+        context: jsonObjectGuard.optional(),
     }),
 ]);
 export var CustomJwtErrorCode;

package/lib/types/logto-config/jwt-customizer.test.js

@@ -7,7 +7,12 @@ const optionalFields = ['environmentVariables', 'contextSample', 'tokenSample'];
 const testClientCredentialsTokenPayload = {
     script: '',
     environmentVariables: {},
-    contextSample: {},
+    contextSample: {
+        application: {
+            id: 'my-app',
+            name: 'My M2M App',
+        },
+    },
     tokenSample: {},
 };
 const testAccessTokenPayload = {
@@ -75,4 +80,25 @@ describe('test token sample guard', () => {
         });
         expect(result.success).toBe(false);
     });
+    it('should allow access token sample without interaction context', () => {
+        const result = accessTokenJwtCustomizerGuard.safeParse(testAccessTokenPayload);
+        expect(result.success).toBe(true);
+    });
+    it('should keep sign-in context in interaction context sample', () => {
+        const interactionContext = {
+            signInContext: { country: 'US' },
+        };
+        const result = accessTokenJwtCustomizerGuard.safeParse({
+            ...testAccessTokenPayload,
+            contextSample: {
+                ...testAccessTokenPayload.contextSample,
+                interaction: interactionContext,
+            },
+        });
+        expect(result.success).toBe(true);
+        if (!result.success) {
+            return;
+        }
+        expect(result.data.contextSample?.interaction).toEqual(expect.objectContaining(interactionContext));
+    });
 });

package/lib/types/logto-config/oidc-provider.d.ts

@@ -21,28 +21,28 @@ export declare const accessTokenPayloadGuard: z.ZodObject<{
     clientId: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     grantId: string;
-    accountId: string;
     jti: string;
-    gty: string;
     kind: "AccessToken";
+    accountId: string;
+    gty: string;
     aud: string | string[];
+    sid?: string | undefined;
     scope?: string | undefined;
     sessionUid?: string | undefined;
-    expiresWithSession?: boolean | undefined;
-    sid?: string | undefined;
     clientId?: string | undefined;
+    expiresWithSession?: boolean | undefined;
 }, {
     grantId: string;
-    accountId: string;
     jti: string;
-    gty: string;
     kind: "AccessToken";
+    accountId: string;
+    gty: string;
     aud: string | string[];
+    sid?: string | undefined;
     scope?: string | undefined;
     sessionUid?: string | undefined;
-    expiresWithSession?: boolean | undefined;
-    sid?: string | undefined;
     clientId?: string | undefined;
+    expiresWithSession?: boolean | undefined;
 }>;
 export type AccessTokenPayload = z.infer<typeof accessTokenPayloadGuard>;
 export declare const clientCredentialsPayloadGuard: z.ZodObject<{

package/lib/types/saml-application.d.ts

@@ -4,7 +4,7 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
     name: z.ZodType<string, z.ZodTypeDef, string>;
     customData: z.ZodOptional<z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>>;
     description: z.ZodOptional<z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>>;
-    attributeMapping: z.ZodOptional<z.ZodType<Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>>, z.ZodTypeDef, Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>>>>;
+    attributeMapping: z.ZodOptional<z.ZodType<Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>, z.ZodTypeDef, Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>>>;
     entityId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     acsUrl: z.ZodOptional<z.ZodType<import("../foundations/index.js").SamlAcsUrl | null, z.ZodTypeDef, import("../foundations/index.js").SamlAcsUrl | null>>;
     encryption: z.ZodOptional<z.ZodType<{
@@ -23,7 +23,7 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
     nameIdFormat: NameIdFormat;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
-    attributeMapping?: Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>> | undefined;
+    attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;
     encryption?: {
@@ -35,7 +35,7 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
     name: string;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
-    attributeMapping?: Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>> | undefined;
+    attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;
     encryption?: {
@@ -50,7 +50,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
     customData: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>>>;
     description: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>>>;
-    attributeMapping: z.ZodOptional<z.ZodType<Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>>, z.ZodTypeDef, Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>>>>;
+    attributeMapping: z.ZodOptional<z.ZodType<Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>, z.ZodTypeDef, Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>>>;
     entityId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     acsUrl: z.ZodOptional<z.ZodType<import("../foundations/index.js").SamlAcsUrl | null, z.ZodTypeDef, import("../foundations/index.js").SamlAcsUrl | null>>;
     encryption: z.ZodOptional<z.ZodType<{
@@ -68,7 +68,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name?: string | undefined;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
-    attributeMapping?: Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>> | undefined;
+    attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;
     encryption?: {
@@ -81,7 +81,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name?: string | undefined;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
-    attributeMapping?: Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>> | undefined;
+    attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;
     encryption?: {
@@ -101,7 +101,7 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
     customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
     description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    attributeMapping: z.ZodType<Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>>, z.ZodTypeDef, Partial<Record<"name" | "email" | "username" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at", string>>>;
+    attributeMapping: z.ZodType<Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>, z.ZodTypeDef, Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>>;
     entityId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     acsUrl: z.ZodType<import("../foundations/index.js").SamlAcsUrl | null, z.ZodTypeDef, import("../foundations/index.js").SamlAcsUrl | null>;
     encryption: z.ZodType<{

package/lib/types/user-logto-config.d.ts

@@ -3,11 +3,21 @@ import { z } from 'zod';
  * The key for MFA-related data in user's logto_config
  */
 export declare const userMfaDataKey = "mfa";
+export declare const userPasskeySignInDataKey = "passkey_sign_in";
 /**
  * Schema for MFA-related data stored in user's logto_config
  */
 export declare const userMfaDataGuard: z.ZodObject<{
+    /**
+     * Whether the user has skipped MFA binding flow
+     */
     skipped: z.ZodOptional<z.ZodBoolean>;
+    /**
+     * Whether the user has skipped MFA verification on sign-in
+     *
+     * Users can manually disable MFA verification requirement for sign-in,
+     * but if the MFA policy is set to mandatory, this setting will be ignored.
+     */
     skipMfaOnSignIn: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     skipped?: boolean | undefined;
@@ -17,12 +27,35 @@ export declare const userMfaDataGuard: z.ZodObject<{
     skipMfaOnSignIn?: boolean | undefined;
 }>;
 export type UserMfaData = z.infer<typeof userMfaDataGuard>;
+/**
+ * Schema for passkey sign-in related data stored in user's logto_config
+ */
+export declare const userPasskeySignInDataGuard: z.ZodObject<{
+    /**
+     * Whether the user has skipped binding passkey for sign-in persistently
+     */
+    skipped: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    skipped?: boolean | undefined;
+}, {
+    skipped?: boolean | undefined;
+}>;
+export type UserPasskeySignInData = z.infer<typeof userPasskeySignInDataGuard>;
 /**
  * Schema for user's logto_config field
  */
 export declare const userLogtoConfigGuard: z.ZodObject<{
     mfa: z.ZodOptional<z.ZodObject<{
+        /**
+         * Whether the user has skipped MFA binding flow
+         */
         skipped: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether the user has skipped MFA verification on sign-in
+         *
+         * Users can manually disable MFA verification requirement for sign-in,
+         * but if the MFA policy is set to mandatory, this setting will be ignored.
+         */
         skipMfaOnSignIn: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         skipped?: boolean | undefined;
@@ -31,15 +64,31 @@ export declare const userLogtoConfigGuard: z.ZodObject<{
         skipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     }>>;
+    passkey_sign_in: z.ZodOptional<z.ZodObject<{
+        /**
+         * Whether the user has skipped binding passkey for sign-in persistently
+         */
+        skipped: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        skipped?: boolean | undefined;
+    }, {
+        skipped?: boolean | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     mfa?: {
         skipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     } | undefined;
+    passkey_sign_in?: {
+        skipped?: boolean | undefined;
+    } | undefined;
 }, {
     mfa?: {
         skipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     } | undefined;
+    passkey_sign_in?: {
+        skipped?: boolean | undefined;
+    } | undefined;
 }>;
 export type UserLogtoConfig = z.infer<typeof userLogtoConfigGuard>;

package/lib/types/user-logto-config.js

@@ -3,16 +3,39 @@ import { z } from 'zod';
  * The key for MFA-related data in user's logto_config
  */
 export const userMfaDataKey = 'mfa';
+/*
+ * The key for passkey sign-in data in user's logto_config
+ */
+export const userPasskeySignInDataKey = 'passkey_sign_in';
 /**
  * Schema for MFA-related data stored in user's logto_config
  */
 export const userMfaDataGuard = z.object({
+    /**
+     * Whether the user has skipped MFA binding flow
+     */
     skipped: z.boolean().optional(),
+    /**
+     * Whether the user has skipped MFA verification on sign-in
+     *
+     * Users can manually disable MFA verification requirement for sign-in,
+     * but if the MFA policy is set to mandatory, this setting will be ignored.
+     */
     skipMfaOnSignIn: z.boolean().optional(),
 });
+/**
+ * Schema for passkey sign-in related data stored in user's logto_config
+ */
+export const userPasskeySignInDataGuard = z.object({
+    /**
+     * Whether the user has skipped binding passkey for sign-in persistently
+     */
+    skipped: z.boolean().optional(),
+});
 /**
  * Schema for user's logto_config field
  */
 export const userLogtoConfigGuard = z.object({
     [userMfaDataKey]: userMfaDataGuard.optional(),
+    [userPasskeySignInDataKey]: userPasskeySignInDataGuard.optional(),
 });