@logto/schemas 1.37.1 → 1.39.0

package/lib/types/logto-config/index.js

@@ -18,6 +18,7 @@ export var LogtoOidcConfigKey;
 (function (LogtoOidcConfigKey) {
     LogtoOidcConfigKey["PrivateKeys"] = "oidc.privateKeys";
     LogtoOidcConfigKey["CookieKeys"] = "oidc.cookieKeys";
+    LogtoOidcConfigKey["Session"] = "oidc.session";
 })(LogtoOidcConfigKey || (LogtoOidcConfigKey = {}));
 /**
  * Logto supported signing key algorithms for OIDC private keys that sign JWT tokens.
@@ -32,9 +33,23 @@ export const oidcConfigKeyGuard = z.object({
     value: z.string(),
     createdAt: z.number(),
 });
+export var OidcSigningKeyStatus;
+(function (OidcSigningKeyStatus) {
+    OidcSigningKeyStatus["Next"] = "Next";
+    OidcSigningKeyStatus["Current"] = "Current";
+    OidcSigningKeyStatus["Previous"] = "Previous";
+})(OidcSigningKeyStatus || (OidcSigningKeyStatus = {}));
+export const oidcPrivateKeyGuard = oidcConfigKeyGuard.extend({
+    status: z.nativeEnum(OidcSigningKeyStatus).optional(),
+});
+export const oidcSessionConfigGuard = z.object({
+    ttl: z.number().int().min(1).max(31_536_000).optional(),
+});
 export const logtoOidcConfigGuard = Object.freeze({
-    [LogtoOidcConfigKey.PrivateKeys]: oidcConfigKeyGuard.array(),
+    [LogtoOidcConfigKey.PrivateKeys]: oidcPrivateKeyGuard.array(),
     [LogtoOidcConfigKey.CookieKeys]: oidcConfigKeyGuard.array(),
+    // Session config is optional, if not set, it will fallback to default value in core.
+    [LogtoOidcConfigKey.Session]: oidcSessionConfigGuard.nullish().transform((data) => data ?? {}),
 });
 export var LogtoJwtTokenKey;
 (function (LogtoJwtTokenKey) {
@@ -90,6 +105,10 @@ export const extendedIdTokenClaimsGuard = z.enum(extendedIdTokenClaims);
 export const idTokenConfigGuard = z.object({
     enabledExtendedClaims: extendedIdTokenClaimsGuard.array().optional(),
 });
+export const signingKeyRotationStateGuard = z.object({
+    tenantCacheExpiresAt: z.number().optional(),
+    signingKeyRotationAt: z.number().optional(),
+});
 export var LogtoTenantConfigKey;
 (function (LogtoTenantConfigKey) {
     LogtoTenantConfigKey["AdminConsole"] = "adminConsole";
@@ -98,12 +117,15 @@ export var LogtoTenantConfigKey;
     LogtoTenantConfigKey["SessionNotFoundRedirectUrl"] = "sessionNotFoundRedirectUrl";
     /** ID token configuration for extended claims. */
     LogtoTenantConfigKey["IdToken"] = "idToken";
+    /** Tenant-scoped rotation state for staged private signing key activation. */
+    LogtoTenantConfigKey["SigningKeyRotationState"] = "signingKeyRotationState";
 })(LogtoTenantConfigKey || (LogtoTenantConfigKey = {}));
 export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.AdminConsole]: adminConsoleDataGuard,
     [LogtoTenantConfigKey.CloudConnection]: cloudConnectionDataGuard,
     [LogtoTenantConfigKey.SessionNotFoundRedirectUrl]: z.object({ url: z.string() }),
     [LogtoTenantConfigKey.IdToken]: idTokenConfigGuard,
+    [LogtoTenantConfigKey.SigningKeyRotationState]: signingKeyRotationStateGuard,
 });
 export const logtoConfigKeys = Object.freeze([
     ...Object.values(LogtoOidcConfigKey),
@@ -115,6 +137,8 @@ export const logtoConfigGuards = Object.freeze({
     ...jwtCustomizerConfigGuard,
     ...logtoTenantConfigGuard,
 });
-export const oidcConfigKeysResponseGuard = oidcConfigKeyGuard
-    .omit({ value: true })
-    .merge(z.object({ signingKeyAlgorithm: z.nativeEnum(SupportedSigningKeyAlgorithm).optional() }));
+export const oidcConfigKeysResponseGuard = oidcConfigKeyGuard.omit({ value: true }).merge(z.object({
+    signingKeyAlgorithm: z.nativeEnum(SupportedSigningKeyAlgorithm).optional(),
+    status: z.nativeEnum(OidcSigningKeyStatus).optional(),
+    effectiveAt: z.number().optional(),
+}));

package/lib/types/logto-config/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/logto-config/index.test.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+import { LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, logtoOidcConfigGuard, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
+describe('logto config guards', () => {
+    it('accepts legacy private keys without status', () => {
+        const privateKeys = [
+            {
+                id: 'key_1',
+                value: 'private-key-1',
+                createdAt: 1_710_000_000_000,
+            },
+        ];
+        const result = logtoOidcConfigGuard[LogtoOidcConfigKey.PrivateKeys].safeParse(privateKeys);
+        expect(result.success).toBe(true);
+    });
+    it('accepts signing key status in OIDC key responses', () => {
+        const result = oidcConfigKeysResponseGuard.safeParse({
+            id: 'key_1',
+            createdAt: 1_710_000_000_000,
+            status: OidcSigningKeyStatus.Current,
+        });
+        expect(result.success).toBe(true);
+    });
+    it('accepts partial signing key rotation state', () => {
+        const result = logtoTenantConfigGuard[LogtoTenantConfigKey.SigningKeyRotationState].safeParse({
+            signingKeyRotationAt: 1_710_000_000_000,
+        });
+        expect(result.success).toBe(true);
+    });
+});