@objectstack/spec 0.6.0 → 0.7.1

package/json-schema/auth/AuthConfig.json

@@ -2,839 +2,267 @@
   "$ref": "#/definitions/AuthConfig",
   "definitions": {
     "AuthConfig": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string",
-          "pattern": "^[a-z_][a-z0-9_]*$",
-          "description": "Configuration name (snake_case)"
-        },
-        "label": {
-          "type": "string",
-          "description": "Display label"
-        },
-        "driver": {
-          "type": "string",
-          "default": "better-auth",
-          "description": "The underlying authentication implementation driver"
-        },
-        "strategies": {
-          "type": "array",
-          "items": {
-            "type": "string",
-            "enum": [
-              "email_password",
-              "magic_link",
-              "oauth",
-              "passkey",
-              "otp",
-              "anonymous"
-            ]
-          },
-          "minItems": 1,
-          "description": "Enabled authentication strategies"
-        },
-        "baseUrl": {
-          "type": "string",
-          "format": "uri",
-          "description": "Application base URL"
-        },
-        "secret": {
-          "type": "string",
-          "minLength": 32,
-          "description": "Secret key for signing (min 32 chars)"
-        },
-        "emailPassword": {
+      "anyOf": [
+        {
           "type": "object",
           "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": true
-            },
-            "requireEmailVerification": {
-              "type": "boolean",
-              "default": true,
-              "description": "Require email verification before login"
-            },
-            "minPasswordLength": {
-              "type": "number",
-              "minimum": 6,
-              "maximum": 128,
-              "default": 8,
-              "description": "Minimum password length"
-            },
-            "requirePasswordComplexity": {
-              "type": "boolean",
-              "default": true,
-              "description": "Require uppercase, lowercase, numbers, symbols"
-            },
-            "allowPasswordReset": {
-              "type": "boolean",
-              "default": true,
-              "description": "Enable password reset functionality"
+            "type": {
+              "type": "string",
+              "const": "oauth2",
+              "description": "Authentication type"
             },
-            "passwordResetExpiry": {
-              "type": "number",
-              "default": 3600,
-              "description": "Password reset token expiry in seconds"
-            }
-          },
-          "additionalProperties": false
-        },
-        "magicLink": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": true
+            "authorizationUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "OAuth2 authorization endpoint"
             },
-            "expiryTime": {
-              "type": "number",
-              "default": 900,
-              "description": "Magic link expiry time in seconds (default 15 min)"
-            }
-          },
-          "additionalProperties": false
-        },
-        "passkey": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": false
+            "tokenUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "OAuth2 token endpoint"
             },
-            "rpName": {
+            "clientId": {
               "type": "string",
-              "description": "Relying Party name"
+              "description": "OAuth2 client ID"
             },
-            "rpId": {
+            "clientSecret": {
               "type": "string",
-              "description": "Relying Party ID (defaults to domain)"
+              "description": "OAuth2 client secret (typically from ENV)"
             },
-            "allowedOrigins": {
+            "scopes": {
               "type": "array",
               "items": {
-                "type": "string",
-                "format": "uri"
+                "type": "string"
               },
-              "description": "Allowed origins for WebAuthn"
+              "description": "Requested OAuth2 scopes"
             },
-            "userVerification": {
+            "redirectUri": {
               "type": "string",
-              "enum": [
-                "required",
-                "preferred",
-                "discouraged"
-              ],
-              "default": "preferred"
+              "format": "uri",
+              "description": "OAuth2 redirect URI"
             },
-            "attestation": {
+            "refreshToken": {
               "type": "string",
-              "enum": [
-                "none",
-                "indirect",
-                "direct",
-                "enterprise"
-              ],
-              "default": "none"
-            }
-          },
-          "required": [
-            "rpName"
-          ],
-          "additionalProperties": false
-        },
-        "oauth": {
-          "type": "object",
-          "properties": {
-            "providers": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "provider": {
-                    "type": "string",
-                    "enum": [
-                      "google",
-                      "github",
-                      "facebook",
-                      "twitter",
-                      "linkedin",
-                      "microsoft",
-                      "apple",
-                      "discord",
-                      "gitlab",
-                      "custom"
-                    ],
-                    "description": "OAuth provider type"
-                  },
-                  "clientId": {
-                    "type": "string",
-                    "description": "OAuth client ID"
-                  },
-                  "clientSecret": {
-                    "type": "string",
-                    "description": "OAuth client secret (typically from ENV)"
-                  },
-                  "scopes": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    },
-                    "description": "Requested OAuth scopes"
-                  },
-                  "redirectUri": {
-                    "type": "string",
-                    "format": "uri",
-                    "description": "OAuth callback URL"
-                  },
-                  "enabled": {
-                    "type": "boolean",
-                    "default": true,
-                    "description": "Whether this provider is enabled"
-                  },
-                  "displayName": {
-                    "type": "string",
-                    "description": "Display name for the provider button"
-                  },
-                  "icon": {
-                    "type": "string",
-                    "description": "Icon URL or identifier"
-                  }
-                },
-                "required": [
-                  "provider",
-                  "clientId",
-                  "clientSecret"
-                ],
-                "additionalProperties": false
-              },
-              "minItems": 1
+              "description": "Refresh token for token renewal"
+            },
+            "tokenExpiry": {
+              "type": "number",
+              "description": "Token expiry timestamp"
             }
           },
           "required": [
-            "providers"
+            "type",
+            "authorizationUrl",
+            "tokenUrl",
+            "clientId",
+            "clientSecret"
           ],
           "additionalProperties": false
         },
-        "session": {
+        {
           "type": "object",
           "properties": {
-            "expiresIn": {
-              "type": "number",
-              "default": 604800,
-              "description": "Session expiry in seconds (default 7 days)"
-            },
-            "updateAge": {
-              "type": "number",
-              "default": 86400,
-              "description": "Session update interval in seconds (default 1 day)"
-            },
-            "cookieName": {
+            "type": {
               "type": "string",
-              "default": "session_token",
-              "description": "Session cookie name"
+              "const": "api-key",
+              "description": "Authentication type"
             },
-            "cookieSecure": {
-              "type": "boolean",
-              "default": true,
-              "description": "Use secure cookies (HTTPS only)"
-            },
-            "cookieSameSite": {
+            "key": {
               "type": "string",
-              "enum": [
-                "strict",
-                "lax",
-                "none"
-              ],
-              "default": "lax",
-              "description": "SameSite cookie attribute"
+              "description": "API key value"
             },
-            "cookieDomain": {
+            "headerName": {
               "type": "string",
-              "description": "Cookie domain"
+              "default": "X-API-Key",
+              "description": "HTTP header name for API key"
             },
-            "cookiePath": {
+            "paramName": {
               "type": "string",
-              "default": "/",
-              "description": "Cookie path"
-            },
-            "cookieHttpOnly": {
-              "type": "boolean",
-              "default": true,
-              "description": "HttpOnly cookie attribute"
-            }
-          },
-          "additionalProperties": false,
-          "default": {}
-        },
-        "rateLimit": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": true
-            },
-            "maxAttempts": {
-              "type": "number",
-              "default": 5,
-              "description": "Maximum login attempts"
-            },
-            "windowMs": {
-              "type": "number",
-              "default": 900000,
-              "description": "Time window in milliseconds (default 15 min)"
-            },
-            "blockDuration": {
-              "type": "number",
-              "default": 900000,
-              "description": "Block duration after max attempts in ms"
-            },
-            "skipSuccessfulRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Only count failed requests"
+              "description": "Query parameter name (alternative to header)"
             }
           },
-          "additionalProperties": false,
-          "default": {}
+          "required": [
+            "type",
+            "key"
+          ],
+          "additionalProperties": false
         },
-        "csrf": {
+        {
           "type": "object",
           "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": true
-            },
-            "tokenLength": {
-              "type": "number",
-              "default": 32,
-              "description": "CSRF token length"
-            },
-            "cookieName": {
+            "type": {
               "type": "string",
-              "default": "csrf_token",
-              "description": "CSRF cookie name"
+              "const": "basic",
+              "description": "Authentication type"
             },
-            "headerName": {
+            "username": {
               "type": "string",
-              "default": "X-CSRF-Token",
-              "description": "CSRF header name"
-            }
-          },
-          "additionalProperties": false,
-          "default": {}
-        },
-        "accountLinking": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": true,
-              "description": "Allow account linking"
-            },
-            "autoLink": {
-              "type": "boolean",
-              "default": false,
-              "description": "Automatically link accounts with same email"
+              "description": "Username"
             },
-            "requireVerification": {
-              "type": "boolean",
-              "default": true,
-              "description": "Require email verification before linking"
-            }
-          },
-          "additionalProperties": false,
-          "default": {}
-        },
-        "twoFactor": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": false
-            },
-            "issuer": {
+            "password": {
               "type": "string",
-              "description": "TOTP issuer name"
-            },
-            "qrCodeSize": {
-              "type": "number",
-              "default": 200,
-              "description": "QR code size in pixels"
-            },
-            "backupCodes": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "type": "boolean",
-                  "default": true
-                },
-                "count": {
-                  "type": "number",
-                  "default": 10,
-                  "description": "Number of backup codes to generate"
-                }
-              },
-              "additionalProperties": false
+              "description": "Password (typically from ENV)"
             }
           },
+          "required": [
+            "type",
+            "username",
+            "password"
+          ],
           "additionalProperties": false
         },
-        "organization": {
+        {
           "type": "object",
           "properties": {
-            "enabled": {
-              "type": "boolean",
-              "default": false,
-              "description": "Enable organization/multi-tenant features"
-            },
-            "allowUserToCreateOrg": {
-              "type": "boolean",
-              "default": true,
-              "description": "Allow users to create organizations"
-            },
-            "defaultRole": {
+            "type": {
               "type": "string",
-              "default": "member",
-              "description": "Default role for new members"
+              "const": "bearer",
+              "description": "Authentication type"
             },
-            "creatorRole": {
+            "token": {
               "type": "string",
-              "default": "owner",
-              "description": "Role assigned to organization creator"
-            }
-          },
-          "additionalProperties": false,
-          "description": "Organization/multi-tenant configuration"
-        },
-        "enterprise": {
-          "type": "object",
-          "properties": {
-            "oidc": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "type": "boolean",
-                  "default": false
-                },
-                "issuer": {
-                  "type": "string",
-                  "format": "uri",
-                  "description": "OIDC Issuer URL (.well-known/openid-configuration)"
-                },
-                "clientId": {
-                  "type": "string",
-                  "description": "OIDC client ID"
-                },
-                "clientSecret": {
-                  "type": "string",
-                  "description": "OIDC client secret"
-                },
-                "scopes": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "default": [
-                    "openid",
-                    "profile",
-                    "email"
-                  ],
-                  "description": "OIDC scopes"
-                },
-                "attributeMapping": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "description": "Map IdP claims to User fields"
-                },
-                "displayName": {
-                  "type": "string",
-                  "description": "Display name for the provider button"
-                },
-                "icon": {
-                  "type": "string",
-                  "description": "Icon URL or identifier"
-                }
-              },
-              "required": [
-                "issuer",
-                "clientId",
-                "clientSecret"
-              ],
-              "additionalProperties": false,
-              "description": "OpenID Connect configuration"
-            },
-            "saml": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "type": "boolean",
-                  "default": false
-                },
-                "entryPoint": {
-                  "type": "string",
-                  "format": "uri",
-                  "description": "IdP SSO URL"
-                },
-                "cert": {
-                  "type": "string",
-                  "description": "IdP Public Certificate (PEM format)"
-                },
-                "issuer": {
-                  "type": "string",
-                  "description": "Entity ID of the IdP"
-                },
-                "signatureAlgorithm": {
-                  "type": "string",
-                  "enum": [
-                    "sha256",
-                    "sha512"
-                  ],
-                  "default": "sha256",
-                  "description": "Signature algorithm"
-                },
-                "attributeMapping": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "description": "Map SAML attributes to User fields"
-                },
-                "displayName": {
-                  "type": "string",
-                  "description": "Display name for the provider button"
-                },
-                "icon": {
-                  "type": "string",
-                  "description": "Icon URL or identifier"
-                }
-              },
-              "required": [
-                "entryPoint",
-                "cert",
-                "issuer"
-              ],
-              "additionalProperties": false,
-              "description": "SAML 2.0 configuration"
-            },
-            "ldap": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "type": "boolean",
-                  "default": false
-                },
-                "url": {
-                  "type": "string",
-                  "format": "uri",
-                  "description": "LDAP Server URL (ldap:// or ldaps://)"
-                },
-                "bindDn": {
-                  "type": "string",
-                  "description": "Bind DN for LDAP authentication"
-                },
-                "bindCredentials": {
-                  "type": "string",
-                  "description": "Bind credentials"
-                },
-                "searchBase": {
-                  "type": "string",
-                  "description": "Search base DN"
-                },
-                "searchFilter": {
-                  "type": "string",
-                  "description": "Search filter"
-                },
-                "groupSearchBase": {
-                  "type": "string",
-                  "description": "Group search base DN"
-                },
-                "displayName": {
-                  "type": "string",
-                  "description": "Display name for the provider button"
-                },
-                "icon": {
-                  "type": "string",
-                  "description": "Icon URL or identifier"
-                }
-              },
-              "required": [
-                "url",
-                "bindDn",
-                "bindCredentials",
-                "searchBase",
-                "searchFilter"
-              ],
-              "additionalProperties": false,
-              "description": "LDAP/Active Directory configuration"
+              "description": "Bearer token"
             }
           },
+          "required": [
+            "type",
+            "token"
+          ],
           "additionalProperties": false
         },
-        "userFieldMapping": {
+        {
           "type": "object",
           "properties": {
-            "id": {
-              "type": "string",
-              "default": "id",
-              "description": "User ID field"
-            },
-            "email": {
-              "type": "string",
-              "default": "email",
-              "description": "Email field"
-            },
-            "name": {
-              "type": "string",
-              "default": "name",
-              "description": "Name field"
-            },
-            "image": {
+            "type": {
               "type": "string",
-              "default": "image",
-              "description": "Profile image field"
+              "const": "jwt",
+              "description": "Authentication type"
             },
-            "emailVerified": {
+            "token": {
               "type": "string",
-              "default": "email_verified",
-              "description": "Email verification status field"
+              "description": "Pre-generated JWT token"
             },
-            "createdAt": {
+            "secretKey": {
               "type": "string",
-              "default": "created_at",
-              "description": "Created timestamp field"
+              "description": "Secret key for JWT signing"
             },
-            "updatedAt": {
-              "type": "string",
-              "default": "updated_at",
-              "description": "Updated timestamp field"
-            }
-          },
-          "additionalProperties": false,
-          "default": {}
-        },
-        "database": {
-          "type": "object",
-          "properties": {
-            "type": {
+            "algorithm": {
               "type": "string",
               "enum": [
-                "prisma",
-                "drizzle",
-                "kysely",
-                "custom"
+                "HS256",
+                "HS384",
+                "HS512",
+                "RS256",
+                "RS384",
+                "RS512",
+                "ES256",
+                "ES384",
+                "ES512"
               ],
-              "description": "Database adapter type"
+              "default": "HS256",
+              "description": "JWT signing algorithm"
             },
-            "connectionString": {
+            "issuer": {
               "type": "string",
-              "description": "Database connection string"
+              "description": "JWT issuer claim"
             },
-            "tablePrefix": {
+            "audience": {
               "type": "string",
-              "default": "auth_",
-              "description": "Prefix for auth tables"
+              "description": "JWT audience claim"
             },
-            "schema": {
+            "subject": {
               "type": "string",
-              "description": "Database schema name"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "additionalProperties": false
-        },
-        "mapping": {
-          "type": "object",
-          "properties": {
-            "user": {
-              "type": "object",
-              "additionalProperties": {
-                "type": "string"
-              },
-              "description": "User field mapping (e.g., { \"emailVerified\": \"email_verified\" })"
+              "description": "JWT subject claim"
             },
-            "session": {
-              "type": "object",
-              "additionalProperties": {
-                "type": "string"
-              },
-              "default": {
-                "sessionToken": "token",
-                "expires": "expiresAt"
-              },
-              "description": "Session field mapping"
-            },
-            "account": {
-              "type": "object",
-              "additionalProperties": {
-                "type": "string"
-              },
-              "default": {
-                "providerAccountId": "accountId",
-                "provider": "providerId"
-              },
-              "description": "Account field mapping"
+            "expiresIn": {
+              "type": "number",
+              "default": 3600,
+              "description": "Token expiry in seconds"
             },
-            "verificationToken": {
+            "claims": {
               "type": "object",
-              "additionalProperties": {
-                "type": "string"
-              },
-              "description": "VerificationToken field mapping"
+              "additionalProperties": {},
+              "description": "Additional JWT claims"
             }
           },
+          "required": [
+            "type"
+          ],
           "additionalProperties": false
         },
-        "plugins": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string",
-                "description": "Plugin name"
-              },
-              "enabled": {
-                "type": "boolean",
-                "default": true
-              },
-              "options": {
-                "type": "object",
-                "additionalProperties": {},
-                "description": "Plugin-specific options"
-              }
-            },
-            "required": [
-              "name"
-            ],
-            "additionalProperties": false
-          },
-          "default": []
-        },
-        "hooks": {
-          "type": "object",
-          "properties": {},
-          "additionalProperties": false,
-          "description": "Authentication lifecycle hooks"
-        },
-        "security": {
+        {
           "type": "object",
           "properties": {
-            "allowedOrigins": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "CORS allowed origins"
+            "type": {
+              "type": "string",
+              "const": "saml",
+              "description": "Authentication type"
             },
-            "trustProxy": {
-              "type": "boolean",
-              "default": false,
-              "description": "Trust proxy headers"
+            "entryPoint": {
+              "type": "string",
+              "format": "uri",
+              "description": "SAML IdP entry point URL"
             },
-            "ipRateLimiting": {
-              "type": "boolean",
-              "default": true,
-              "description": "Enable IP-based rate limiting"
+            "issuer": {
+              "type": "string",
+              "description": "SAML service provider issuer"
             },
-            "sessionFingerprinting": {
-              "type": "boolean",
-              "default": true,
-              "description": "Enable session fingerprinting"
+            "certificate": {
+              "type": "string",
+              "description": "SAML IdP certificate (X.509)"
             },
-            "maxSessions": {
-              "type": "number",
-              "default": 5,
-              "description": "Maximum concurrent sessions per user"
-            }
-          },
-          "additionalProperties": false,
-          "description": "Advanced security settings"
-        },
-        "email": {
-          "type": "object",
-          "properties": {
-            "from": {
+            "privateKey": {
               "type": "string",
-              "format": "email",
-              "description": "From email address"
+              "description": "SAML service provider private key"
             },
-            "fromName": {
+            "callbackUrl": {
               "type": "string",
-              "description": "From name"
+              "format": "uri",
+              "description": "SAML assertion consumer service URL"
             },
-            "provider": {
+            "signatureAlgorithm": {
               "type": "string",
               "enum": [
-                "smtp",
-                "sendgrid",
-                "mailgun",
-                "ses",
-                "resend",
-                "custom"
+                "sha1",
+                "sha256",
+                "sha512"
               ],
-              "description": "Email provider"
+              "default": "sha256",
+              "description": "SAML signature algorithm"
             },
-            "config": {
-              "type": "object",
-              "additionalProperties": {},
-              "description": "Provider-specific configuration"
+            "wantAssertionsSigned": {
+              "type": "boolean",
+              "default": true,
+              "description": "Require signed SAML assertions"
+            },
+            "identifierFormat": {
+              "type": "string",
+              "description": "SAML NameID format"
             }
           },
           "required": [
-            "from",
-            "provider"
+            "type",
+            "entryPoint",
+            "issuer",
+            "certificate"
           ],
-          "additionalProperties": false,
-          "description": "Email configuration"
+          "additionalProperties": false
         },
-        "ui": {
+        {
           "type": "object",
           "properties": {
-            "brandName": {
-              "type": "string",
-              "description": "Brand name displayed in auth UI"
-            },
-            "logo": {
-              "type": "string",
-              "description": "Logo URL"
-            },
-            "primaryColor": {
-              "type": "string",
-              "description": "Primary brand color (hex)"
-            },
-            "customCss": {
+            "type": {
               "type": "string",
-              "description": "Custom CSS for auth pages"
+              "const": "none",
+              "description": "No authentication required"
             }
           },
-          "additionalProperties": false,
-          "description": "UI customization"
-        },
-        "active": {
-          "type": "boolean",
-          "default": true,
-          "description": "Whether this provider is active"
-        },
-        "allowRegistration": {
-          "type": "boolean",
-          "default": true,
-          "description": "Allow new user registration"
+          "required": [
+            "type"
+          ],
+          "additionalProperties": false
         }
-      },
-      "required": [
-        "name",
-        "label",
-        "strategies",
-        "baseUrl",
-        "secret"
-      ],
-      "additionalProperties": false
+      ]
     }
   },
   "$schema": "http://json-schema.org/draft-07/schema#"