@objectstack/service-settings 11.0.0 → 11.1.0

package/dist/index.cjs

@@ -1369,6 +1369,17 @@ var manifest = {
       description: "Block reusing this many previous passwords on change/reset. 0 disables the check.",
       visible: "${data.email_password_enabled !== false}"
     },
+    {
+      type: "number",
+      key: "password_expiry_days",
+      label: "Password expiry (days)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 3650,
+      description: "Force a password change after this many days. 0 disables expiry. While expired, the user is blocked from data until they change their password.",
+      visible: "${data.email_password_enabled !== false}"
+    },
     {
       type: "group",
       id: "anti_abuse",
@@ -1418,6 +1429,33 @@ var manifest = {
       max: 3600,
       description: "Sliding window over which the request cap above is counted."
     },
+    {
+      type: "group",
+      id: "multi_factor",
+      label: "Multi-factor",
+      required: false,
+      description: "Require members to protect their account with an authenticator app (TOTP)."
+    },
+    {
+      type: "toggle",
+      key: "mfa_required",
+      label: "Require multi-factor authentication",
+      required: false,
+      default: false,
+      description: "Users without an authenticator enrolled are blocked from data once their grace period ends. Enabling this also turns on the two-factor feature so users can enroll.",
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "number",
+      key: "mfa_grace_period_days",
+      label: "MFA grace period (days)",
+      required: false,
+      default: 7,
+      min: 0,
+      max: 90,
+      description: "How long users may defer enrollment before the hard block. 0 blocks immediately.",
+      visible: "${data.mfa_required === true}"
+    },
     {
       type: "group",
       id: "sessions",
@@ -1445,6 +1483,50 @@ var manifest = {
       max: 90,
       description: "An active session is extended when it is older than this."
     },
+    {
+      type: "number",
+      key: "session_idle_timeout_minutes",
+      label: "Idle timeout (minutes)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 10080,
+      description: "Sign a user out after this many minutes of inactivity. 0 disables."
+    },
+    {
+      type: "number",
+      key: "session_absolute_max_hours",
+      label: "Absolute session lifetime (hours)",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 8760,
+      description: "Force re-authentication this many hours after sign-in, regardless of activity. 0 disables."
+    },
+    {
+      type: "number",
+      key: "max_concurrent_sessions_per_user",
+      label: "Max concurrent sessions per user",
+      required: false,
+      default: 0,
+      min: 0,
+      max: 100,
+      description: "Cap simultaneous signed-in sessions per user; the oldest are signed out past the cap. 0 = unlimited."
+    },
+    {
+      type: "group",
+      id: "network",
+      label: "Network",
+      required: false,
+      description: "Restrict where users can authenticate from."
+    },
+    {
+      type: "textarea",
+      key: "allowed_ip_ranges",
+      label: "Allowed IP ranges",
+      required: false,
+      description: "CIDR ranges or exact IPs (one per line, or comma-separated), e.g. 203.0.113.0/24. When set, sign-in from outside these ranges is rejected. Empty = no restriction. Requires a trusted proxy to set X-Forwarded-For."
+    },
     {
       type: "group",
       id: "social",