@objectstack/service-settings 10.2.0 → 11.0.0

package/dist/index.js

@@ -852,6 +852,7 @@ import { dirname, join } from "path";
 var SECRET_KEY_ENV = "OS_SECRET_KEY";
 var DEV_KEY_ENV = "OS_DEV_CRYPTO_KEY";
 var DEV_KEY_LEGACY_ENV = "OBJECTSTACK_DEV_CRYPTO_KEY";
+var AUTOKEY_ENV = "OS_CRYPTO_AUTOKEY";
 var processEnv = () => globalThis.process?.env ?? {};
 var detectMode = (env) => {
   if (env.VITEST || env.NODE_ENV === "test") return "test";
@@ -875,6 +876,10 @@ var parseKey = (raw) => {
   }
   return void 0;
 };
+var parseBool = (raw) => {
+  const v = raw?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+};
 var loadExistingKey = (path) => {
   try {
     if (!existsSync(path)) return void 0;
@@ -948,6 +953,17 @@ function resolveDataKey(opts) {
       );
       return { key: existing, source: "file" };
     }
+    if (parseBool(env[AUTOKEY_ENV])) {
+      const persisted2 = loadOrCreateKey(path);
+      if (persisted2) {
+        if (persisted2.generated) {
+          warn(
+            `[LocalCryptoProvider] No ${SECRET_KEY_ENV} set \u2014 minted a new AES-256-GCM key and persisted it to ${path} (mode 0600). Restarts on this host reuse it automatically. For containers, CI, or multi-node, set ${SECRET_KEY_ENV} so every node shares one key.`
+          );
+        }
+        return { key: persisted2.key, source: persisted2.generated ? "generated-file" : "file" };
+      }
+    }
     throw new Error(MISSING_PROD_KEY_MSG(path));
   }
   const persisted = loadOrCreateKey(path);
@@ -1112,7 +1128,15 @@ function registerSettingsRoutes(http, service, opts = {}) {
   }));
   http.put(`${base}/:namespace`, (async (req, res) => {
     const ns = req.params.namespace;
-    const body = req.body ?? {};
+    let body = req.body ?? {};
+    if (Object.keys(body).length === 1 && body.values && typeof body.values === "object" && !Array.isArray(body.values)) {
+      const inner = body.values;
+      body = Object.fromEntries(
+        Object.entries(inner).map(
+          ([k, v]) => v && typeof v === "object" && !Array.isArray(v) && "value" in v ? [k, v.value] : [k, v]
+        )
+      );
+    }
     try {
       const ctx = ctxOf(req);
       const result = await service.setMany(ns, body, ctx);
@@ -1241,6 +1265,95 @@ var manifest = {
       description: "Upper bound guards against denial-of-service via very long password hashing.",
       visible: "${data.email_password_enabled !== false}"
     },
+    {
+      type: "toggle",
+      key: "password_reject_breached",
+      label: "Reject breached passwords",
+      required: false,
+      default: false,
+      description: "Block passwords found in public breach corpora via Have I Been Pwned (k-anonymity range check; the password is never sent in full).",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "toggle",
+      key: "password_require_complexity",
+      label: "Require complex passwords",
+      required: false,
+      default: false,
+      description: "Require passwords to mix character classes (uppercase, lowercase, digits, symbols) on sign-up and password change/reset.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "password_min_classes",
+      label: "Minimum character classes",
+      required: false,
+      default: 3,
+      min: 1,
+      max: 4,
+      description: "How many of the four classes (upper / lower / digit / symbol) a password must include.",
+      visible: "${data.email_password_enabled !== false && data.password_require_complexity === true}"
+    },
+    {
+      type: "number",
+      key: "password_history_count",
+      label: "Password history (no reuse)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 24,
+      description: "Block reusing this many previous passwords on change/reset. 0 disables the check.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "group",
+      id: "anti_abuse",
+      label: "Anti-abuse",
+      required: false,
+      description: "Brute-force protection: per-identity account lockout and per-IP rate limiting on auth endpoints."
+    },
+    {
+      type: "number",
+      key: "lockout_threshold",
+      label: "Account lockout threshold",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 20,
+      description: "Lock an account after this many consecutive failed sign-ins. 0 disables lockout. While locked, sign-in is rejected even with the correct password.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "lockout_duration_minutes",
+      label: "Lockout duration (minutes)",
+      required: false,
+      default: 15,
+      min: 1,
+      max: 1440,
+      description: "How long an account stays locked once the threshold is crossed.",
+      visible: "${data.email_password_enabled !== false && data.lockout_threshold > 0}"
+    },
+    {
+      type: "number",
+      key: "rate_limit_max",
+      label: "Auth rate-limit: max requests",
+      required: false,
+      default: 10,
+      min: 1,
+      max: 1e3,
+      description: "Maximum requests per IP, per window, to the sign-in / sign-up / password-reset endpoints."
+    },
+    {
+      type: "number",
+      key: "rate_limit_window_seconds",
+      label: "Auth rate-limit: window (seconds)",
+      required: false,
+      default: 60,
+      min: 1,
+      max: 3600,
+      description: "Sliding window over which the request cap above is counted."
+    },
     {
       type: "group",
       id: "sessions",
@@ -3189,10 +3302,10 @@ var zhCN = {
         default_country: { label: "\u9ED8\u8BA4\u56FD\u5BB6/\u5730\u533A", help: "ISO 3166-1 \u4E8C\u4F4D\u4EE3\u7801(\u5982 US\u3001GB\u3001CN)\u3002" },
         date_format: { label: "\u65E5\u671F\u683C\u5F0F" },
         time_format: { label: "\u65F6\u95F4\u683C\u5F0F", options: { "24h": "24 \u5C0F\u65F6\u5236(14:30)", "12h": "12 \u5C0F\u65F6\u5236(2:30 PM)" } },
-        number_format: { label: "\u6570\u5B57\u683C\u5F0F" },
-        first_day_of_week: { label: "\u6BCF\u5468\u8D77\u59CB\u65E5", options: { monday: "\u5468\u4E00(ISO)", sunday: "\u5468\u65E5", saturday: "\u5468\u516D" } },
-        currency: { label: "\u9ED8\u8BA4\u8D27\u5E01" },
-        fiscal_year_start: { label: "\u8D22\u5E74\u8D77\u59CB\u6708" }
+        number_format: { label: "\u6570\u5B57\u683C\u5F0F", help: "\u7528\u4E8E\u663E\u793A\u6570\u5B57\u7684\u5343\u5206\u4F4D\u4E0E\u5C0F\u6570\u5206\u9694\u7B26\u3002" },
+        first_day_of_week: { label: "\u6BCF\u5468\u8D77\u59CB\u65E5", help: "\u7528\u4F5C\u5468\u5EA6\u5206\u6790\u5206\u6876\u4E0E\u65E5\u5386\u7F51\u683C\u7684\u8D77\u59CB\u57FA\u51C6\u3002", options: { monday: "\u5468\u4E00(ISO)", sunday: "\u5468\u65E5", saturday: "\u5468\u516D" } },
+        currency: { label: "\u9ED8\u8BA4\u8D27\u5E01", help: "\u5F53\u8D27\u5E01\u5B57\u6BB5\u672A\u6307\u5B9A\u5E01\u79CD\u65F6\u5957\u7528\u7684 ISO 4217 \u4EE3\u7801\u3002" },
+        fiscal_year_start: { label: "\u8D22\u5E74\u8D77\u59CB\u6708", help: '\u8D22\u5E74\u7684\u8D77\u59CB\u6708\u4EFD\u2014\u2014\u51B3\u5B9A\u62A5\u8868\u4E2D\u7684"\u672C\u5B63\u5EA6/\u672C\u8D22\u5E74"\u3002' }
       }
     },
     auth: {