@objectstack/service-settings 10.3.0 → 11.1.0

package/dist/index.js

@@ -1128,7 +1128,15 @@ function registerSettingsRoutes(http, service, opts = {}) {
   }));
   http.put(`${base}/:namespace`, (async (req, res) => {
     const ns = req.params.namespace;
-    const body = req.body ?? {};
+    let body = req.body ?? {};
+    if (Object.keys(body).length === 1 && body.values && typeof body.values === "object" && !Array.isArray(body.values)) {
+      const inner = body.values;
+      body = Object.fromEntries(
+        Object.entries(inner).map(
+          ([k, v]) => v && typeof v === "object" && !Array.isArray(v) && "value" in v ? [k, v.value] : [k, v]
+        )
+      );
+    }
     try {
       const ctx = ctxOf(req);
       const result = await service.setMany(ns, body, ctx);
@@ -1257,6 +1265,133 @@ var manifest = {
       description: "Upper bound guards against denial-of-service via very long password hashing.",
       visible: "${data.email_password_enabled !== false}"
     },
+    {
+      type: "toggle",
+      key: "password_reject_breached",
+      label: "Reject breached passwords",
+      required: false,
+      default: false,
+      description: "Block passwords found in public breach corpora via Have I Been Pwned (k-anonymity range check; the password is never sent in full).",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "toggle",
+      key: "password_require_complexity",
+      label: "Require complex passwords",
+      required: false,
+      default: false,
+      description: "Require passwords to mix character classes (uppercase, lowercase, digits, symbols) on sign-up and password change/reset.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "password_min_classes",
+      label: "Minimum character classes",
+      required: false,
+      default: 3,
+      min: 1,
+      max: 4,
+      description: "How many of the four classes (upper / lower / digit / symbol) a password must include.",
+      visible: "${data.email_password_enabled !== false && data.password_require_complexity === true}"
+    },
+    {
+      type: "number",
+      key: "password_history_count",
+      label: "Password history (no reuse)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 24,
+      description: "Block reusing this many previous passwords on change/reset. 0 disables the check.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "password_expiry_days",
+      label: "Password expiry (days)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 3650,
+      description: "Force a password change after this many days. 0 disables expiry. While expired, the user is blocked from data until they change their password.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "group",
+      id: "anti_abuse",
+      label: "Anti-abuse",
+      required: false,
+      description: "Brute-force protection: per-identity account lockout and per-IP rate limiting on auth endpoints."
+    },
+    {
+      type: "number",
+      key: "lockout_threshold",
+      label: "Account lockout threshold",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 20,
+      description: "Lock an account after this many consecutive failed sign-ins. 0 disables lockout. While locked, sign-in is rejected even with the correct password.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "lockout_duration_minutes",
+      label: "Lockout duration (minutes)",
+      required: false,
+      default: 15,
+      min: 1,
+      max: 1440,
+      description: "How long an account stays locked once the threshold is crossed.",
+      visible: "${data.email_password_enabled !== false && data.lockout_threshold > 0}"
+    },
+    {
+      type: "number",
+      key: "rate_limit_max",
+      label: "Auth rate-limit: max requests",
+      required: false,
+      default: 10,
+      min: 1,
+      max: 1e3,
+      description: "Maximum requests per IP, per window, to the sign-in / sign-up / password-reset endpoints."
+    },
+    {
+      type: "number",
+      key: "rate_limit_window_seconds",
+      label: "Auth rate-limit: window (seconds)",
+      required: false,
+      default: 60,
+      min: 1,
+      max: 3600,
+      description: "Sliding window over which the request cap above is counted."
+    },
+    {
+      type: "group",
+      id: "multi_factor",
+      label: "Multi-factor",
+      required: false,
+      description: "Require members to protect their account with an authenticator app (TOTP)."
+    },
+    {
+      type: "toggle",
+      key: "mfa_required",
+      label: "Require multi-factor authentication",
+      required: false,
+      default: false,
+      description: "Users without an authenticator enrolled are blocked from data once their grace period ends. Enabling this also turns on the two-factor feature so users can enroll.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "mfa_grace_period_days",
+      label: "MFA grace period (days)",
+      required: false,
+      default: 7,
+      min: 0,
+      max: 90,
+      description: "How long users may defer enrollment before the hard block. 0 blocks immediately.",
+      visible: "${data.mfa_required === true}"
+    },
     {
       type: "group",
       id: "sessions",
@@ -1284,6 +1419,50 @@ var manifest = {
       max: 90,
       description: "An active session is extended when it is older than this."
     },
+    {
+      type: "number",
+      key: "session_idle_timeout_minutes",
+      label: "Idle timeout (minutes)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 10080,
+      description: "Sign a user out after this many minutes of inactivity. 0 disables."
+    },
+    {
+      type: "number",
+      key: "session_absolute_max_hours",
+      label: "Absolute session lifetime (hours)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 8760,
+      description: "Force re-authentication this many hours after sign-in, regardless of activity. 0 disables."
+    },
+    {
+      type: "number",
+      key: "max_concurrent_sessions_per_user",
+      label: "Max concurrent sessions per user",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 100,
+      description: "Cap simultaneous signed-in sessions per user; the oldest are signed out past the cap. 0 = unlimited."
+    },
+    {
+      type: "group",
+      id: "network",
+      label: "Network",
+      required: false,
+      description: "Restrict where users can authenticate from."
+    },
+    {
+      type: "textarea",
+      key: "allowed_ip_ranges",
+      label: "Allowed IP ranges",
+      required: false,
+      description: "CIDR ranges or exact IPs (one per line, or comma-separated), e.g. 203.0.113.0/24. When set, sign-in from outside these ranges is rejected. Empty = no restriction. Requires a trusted proxy to set X-Forwarded-For."
+    },
     {
       type: "group",
       id: "social",
@@ -3205,10 +3384,10 @@ var zhCN = {
         default_country: { label: "\u9ED8\u8BA4\u56FD\u5BB6/\u5730\u533A", help: "ISO 3166-1 \u4E8C\u4F4D\u4EE3\u7801(\u5982 US\u3001GB\u3001CN)\u3002" },
         date_format: { label: "\u65E5\u671F\u683C\u5F0F" },
         time_format: { label: "\u65F6\u95F4\u683C\u5F0F", options: { "24h": "24 \u5C0F\u65F6\u5236(14:30)", "12h": "12 \u5C0F\u65F6\u5236(2:30 PM)" } },
-        number_format: { label: "\u6570\u5B57\u683C\u5F0F" },
-        first_day_of_week: { label: "\u6BCF\u5468\u8D77\u59CB\u65E5", options: { monday: "\u5468\u4E00(ISO)", sunday: "\u5468\u65E5", saturday: "\u5468\u516D" } },
-        currency: { label: "\u9ED8\u8BA4\u8D27\u5E01" },
-        fiscal_year_start: { label: "\u8D22\u5E74\u8D77\u59CB\u6708" }
+        number_format: { label: "\u6570\u5B57\u683C\u5F0F", help: "\u7528\u4E8E\u663E\u793A\u6570\u5B57\u7684\u5343\u5206\u4F4D\u4E0E\u5C0F\u6570\u5206\u9694\u7B26\u3002" },
+        first_day_of_week: { label: "\u6BCF\u5468\u8D77\u59CB\u65E5", help: "\u7528\u4F5C\u5468\u5EA6\u5206\u6790\u5206\u6876\u4E0E\u65E5\u5386\u7F51\u683C\u7684\u8D77\u59CB\u57FA\u51C6\u3002", options: { monday: "\u5468\u4E00(ISO)", sunday: "\u5468\u65E5", saturday: "\u5468\u516D" } },
+        currency: { label: "\u9ED8\u8BA4\u8D27\u5E01", help: "\u5F53\u8D27\u5E01\u5B57\u6BB5\u672A\u6307\u5B9A\u5E01\u79CD\u65F6\u5957\u7528\u7684 ISO 4217 \u4EE3\u7801\u3002" },
+        fiscal_year_start: { label: "\u8D22\u5E74\u8D77\u59CB\u6708", help: '\u8D22\u5E74\u7684\u8D77\u59CB\u6708\u4EFD\u2014\u2014\u51B3\u5B9A\u62A5\u8868\u4E2D\u7684"\u672C\u5B63\u5EA6/\u672C\u8D22\u5E74"\u3002' }
       }
     },
     auth: {