@logto/schemas 1.7.0 → 1.9.0

package/lib/types/user.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { MfaFactor } from '../foundations/jsonb-types.js';
 export declare const userInfoSelectFields: readonly ["id", "username", "primaryEmail", "primaryPhone", "name", "avatar", "customData", "identities", "lastSignInAt", "createdAt", "applicationId", "isSuspended"];
 export declare const userInfoGuard: z.ZodObject<Pick<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
@@ -18,17 +19,56 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         details?: {} | undefined;
         userId: string;
     }>>;
-    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
+    customData: z.ZodType<import("../foundations/jsonb-types.js").JsonObject, z.ZodTypeDef, import("../foundations/jsonb-types.js").JsonObject>;
+    mfaVerifications: z.ZodType<({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[], z.ZodTypeDef, ({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "tenantId" | "username" | "applicationId" | "name" | "id" | "createdAt" | "primaryEmail" | "primaryPhone" | "passwordEncrypted" | "passwordEncryptionMethod" | "avatar" | "identities" | "customData" | "isSuspended" | "lastSignInAt">, "strip", z.ZodTypeAny, {
+}, "tenantId" | "username" | "id" | "createdAt" | "applicationId" | "name" | "primaryEmail" | "primaryPhone" | "passwordEncrypted" | "passwordEncryptionMethod" | "avatar" | "identities" | "customData" | "mfaVerifications" | "isSuspended" | "lastSignInAt">, "strip", z.ZodTypeAny, {
     tenantId: string;
     username: string | null;
-    applicationId: string | null;
-    name: string | null;
     id: string;
     createdAt: number;
+    applicationId: string | null;
+    name: string | null;
     primaryEmail: string | null;
     primaryPhone: string | null;
     passwordEncrypted: string | null;
@@ -38,16 +78,36 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         details?: {} | undefined;
         userId: string;
     }>;
-    customData: import("@withtyped/server").JsonObject;
+    customData: import("../foundations/jsonb-types.js").JsonObject;
+    mfaVerifications: ({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[];
     isSuspended: boolean;
     lastSignInAt: number | null;
 }, {
     tenantId: string;
     username: string | null;
-    applicationId: string | null;
-    name: string | null;
     id: string;
     createdAt: number;
+    applicationId: string | null;
+    name: string | null;
     primaryEmail: string | null;
     primaryPhone: string | null;
     passwordEncrypted: string | null;
@@ -57,7 +117,27 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         details?: {} | undefined;
         userId: string;
     }>;
-    customData: import("@withtyped/server").JsonObject;
+    customData: import("../foundations/jsonb-types.js").JsonObject;
+    mfaVerifications: ({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[];
     isSuspended: boolean;
     lastSignInAt: number | null;
 }>;
@@ -80,20 +160,59 @@ export declare const userProfileResponseGuard: z.ZodObject<z.extendShape<Pick<{
         details?: {} | undefined;
         userId: string;
     }>>;
-    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
+    customData: z.ZodType<import("../foundations/jsonb-types.js").JsonObject, z.ZodTypeDef, import("../foundations/jsonb-types.js").JsonObject>;
+    mfaVerifications: z.ZodType<({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[], z.ZodTypeDef, ({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "tenantId" | "username" | "applicationId" | "name" | "id" | "createdAt" | "primaryEmail" | "primaryPhone" | "passwordEncrypted" | "passwordEncryptionMethod" | "avatar" | "identities" | "customData" | "isSuspended" | "lastSignInAt">, {
+}, "tenantId" | "username" | "id" | "createdAt" | "applicationId" | "name" | "primaryEmail" | "primaryPhone" | "passwordEncrypted" | "passwordEncryptionMethod" | "avatar" | "identities" | "customData" | "mfaVerifications" | "isSuspended" | "lastSignInAt">, {
     hasPassword: z.ZodOptional<z.ZodBoolean>;
 }>, "strip", z.ZodTypeAny, {
     hasPassword?: boolean | undefined;
     tenantId: string;
     username: string | null;
-    applicationId: string | null;
-    name: string | null;
     id: string;
     createdAt: number;
+    applicationId: string | null;
+    name: string | null;
     primaryEmail: string | null;
     primaryPhone: string | null;
     passwordEncrypted: string | null;
@@ -103,17 +222,37 @@ export declare const userProfileResponseGuard: z.ZodObject<z.extendShape<Pick<{
         details?: {} | undefined;
         userId: string;
     }>;
-    customData: import("@withtyped/server").JsonObject;
+    customData: import("../foundations/jsonb-types.js").JsonObject;
+    mfaVerifications: ({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[];
     isSuspended: boolean;
     lastSignInAt: number | null;
 }, {
     hasPassword?: boolean | undefined;
     tenantId: string;
     username: string | null;
-    applicationId: string | null;
-    name: string | null;
     id: string;
     createdAt: number;
+    applicationId: string | null;
+    name: string | null;
     primaryEmail: string | null;
     primaryPhone: string | null;
     passwordEncrypted: string | null;
@@ -123,11 +262,51 @@ export declare const userProfileResponseGuard: z.ZodObject<z.extendShape<Pick<{
         details?: {} | undefined;
         userId: string;
     }>;
-    customData: import("@withtyped/server").JsonObject;
+    customData: import("../foundations/jsonb-types.js").JsonObject;
+    mfaVerifications: ({
+        type: MfaFactor.TOTP;
+        key: string;
+        id: string;
+        createdAt: string;
+    } | {
+        type: MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+    } | {
+        usedAt?: Date | undefined;
+        code: string;
+        type: MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+    })[];
     isSuspended: boolean;
     lastSignInAt: number | null;
 }>;
 export type UserProfileResponse = z.infer<typeof userProfileResponseGuard>;
+export declare const userMfaVerificationResponseGuard: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodString;
+    type: z.ZodNativeEnum<typeof MfaFactor>;
+    agent: z.ZodOptional<z.ZodString>;
+    used: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    agent?: string | undefined;
+    used?: boolean | undefined;
+    type: MfaFactor;
+    id: string;
+    createdAt: string;
+}, {
+    agent?: string | undefined;
+    used?: boolean | undefined;
+    type: MfaFactor;
+    id: string;
+    createdAt: string;
+}>, "many">;
+export type UserMfaVerificationResponse = z.infer<typeof userMfaVerificationResponseGuard>;
 /** Internal read-only roles for user tenants. */
 export declare enum InternalRole {
     /**

package/lib/types/user.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { Users } from '../db-entries/index.js';
+import { MfaFactor } from '../foundations/jsonb-types.js';
 export const userInfoSelectFields = Object.freeze([
     'id',
     'username',
@@ -18,6 +19,15 @@ export const userInfoGuard = Users.guard.pick(Object.fromEntries(userInfoSelectF
 export const userProfileResponseGuard = userInfoGuard.extend({
     hasPassword: z.boolean().optional(),
 });
+export const userMfaVerificationResponseGuard = z
+    .object({
+    id: z.string(),
+    createdAt: z.string(),
+    type: z.nativeEnum(MfaFactor),
+    agent: z.string().optional(),
+    used: z.boolean().optional(),
+})
+    .array();
 /** Internal read-only roles for user tenants. */
 export var InternalRole;
 (function (InternalRole) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -25,17 +25,17 @@
   },
   "devDependencies": {
     "@silverhand/eslint-config": "4.0.1",
-    "@silverhand/essentials": "^2.5.0",
+    "@silverhand/essentials": "^2.8.4",
     "@silverhand/ts-config": "4.0.0",
     "@types/inquirer": "^9.0.0",
     "@types/jest": "^29.4.0",
     "@types/node": "^18.11.18",
     "@types/pluralize": "^0.0.29",
-    "camelcase": "^7.0.0",
+    "camelcase": "^8.0.0",
     "chalk": "^5.0.0",
     "eslint": "^8.44.0",
     "jest": "^29.5.0",
-    "lint-staged": "^13.0.0",
+    "lint-staged": "^14.0.0",
     "pluralize": "^8.0.0",
     "prettier": "^3.0.0",
     "roarr": "^7.11.0",
@@ -65,12 +65,12 @@
   "prettier": "@silverhand/eslint-config/.prettierrc",
   "dependencies": {
     "@logto/connector-kit": "^1.1.1",
-    "@logto/core-kit": "^2.0.1",
+    "@logto/core-kit": "^2.1.0",
     "@logto/language-kit": "^1.0.0",
-    "@logto/phrases": "^1.4.1",
-    "@logto/phrases-ui": "^1.2.0",
-    "@logto/shared": "^2.0.0",
-    "@withtyped/server": "^0.12.8"
+    "@logto/phrases": "^1.5.0",
+    "@logto/phrases-experience": "^1.3.0",
+    "@logto/shared": "^2.0.1",
+    "@withtyped/server": "^0.12.9"
   },
   "peerDependencies": {
     "zod": "^3.20.2"

package/tables/applications_roles.sql

@@ -1,3 +1,5 @@
+/* init_order = 2 */
+
 create table applications_roles (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
@@ -8,7 +10,9 @@ create table applications_roles (
     references roles (id) on update cascade on delete cascade,
   primary key (id),
   constraint applications_roles__application_id_role_id
-    unique (tenant_id, application_id, role_id)
+    unique (tenant_id, application_id, role_id),
+  constraint applications_roles__role_type
+    check (public.check_role_type(role_id, 'MachineToMachine'))
 );
 
 create index applications_roles__id

package/tables/roles.sql

@@ -1,11 +1,14 @@
 /* init_order = 1 */
 
+create type role_type as enum ('User', 'MachineToMachine');
+
 create table roles (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null,
   name varchar(128) not null,
   description varchar(128) not null,
+  type role_type not null default 'User',
   primary key (id),
   constraint roles__name
     unique (tenant_id, name)
@@ -13,3 +16,8 @@ create table roles (
 
 create index roles__id
   on roles (tenant_id, id);
+
+create function public.check_role_type(role_id varchar(21), target_type role_type) returns boolean as
+$$ begin
+  return (select type from public.roles where id = role_id) = target_type;
+end; $$ language plpgsql;

package/tables/sign_in_experiences.sql

@@ -15,5 +15,7 @@ create table sign_in_experiences (
   sign_in_mode sign_in_mode not null default 'SignInAndRegister',
   custom_css text,
   custom_content jsonb /* @use CustomContent */ not null default '{}'::jsonb,
+  password_policy jsonb /* @use PartialPasswordPolicy */ not null default '{}'::jsonb,
+  mfa jsonb /* @use Mfa */ not null default '{}'::jsonb,
   primary key (tenant_id, id)
 );

package/tables/users.sql

@@ -16,6 +16,7 @@ create table users (
   application_id varchar(21),
   identities jsonb /* @use Identities */ not null default '{}'::jsonb,
   custom_data jsonb /* @use JsonObject */ not null default '{}'::jsonb,
+  mfa_verifications jsonb /* @use MfaVerifications */ not null default '[]'::jsonb,
   is_suspended boolean not null default false,
   last_sign_in_at timestamptz,
   created_at timestamptz not null default (now()),

package/tables/users_roles.sql

@@ -1,3 +1,5 @@
+/* init_order = 2 */
+
 create table users_roles (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
@@ -8,7 +10,9 @@ create table users_roles (
     references roles (id) on update cascade on delete cascade,
   primary key (id),
   constraint users_roles__user_id_role_id
-    unique (tenant_id, user_id, role_id)
+    unique (tenant_id, user_id, role_id),
+  constraint users_roles__role_type
+    check (public.check_role_type(role_id, 'User'))
 );
 
 create index users_roles__id