@seamless-auth/types 0.11.0 → 0.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +42 -0
- package/dist/schemas/admin/schema.d.ts +1 -0
- package/dist/schemas/admin/schema.d.ts.map +1 -1
- package/dist/schemas/credential/schema.d.ts +4 -0
- package/dist/schemas/credential/schema.d.ts.map +1 -1
- package/dist/schemas/credential/schema.js +12 -0
- package/dist/schemas/credential/schema.js.map +1 -1
- package/dist/schemas/me/schema.d.ts +1 -0
- package/dist/schemas/me/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.d.ts +32 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +15 -0
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/credential/schema.ts +12 -0
- package/src/schemas/systemConfig/schema.ts +18 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,47 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.13.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- ab19e4a: Let a deployment state whether the authenticator must verify the human.
|
|
8
|
+
|
|
9
|
+
`AuthenticatorPolicySchema` gains `userVerification`, accepting `required`,
|
|
10
|
+
`preferred` or `discouraged`, defaulting to `required`.
|
|
11
|
+
|
|
12
|
+
One value is meant to drive both what the browser is asked for and what the
|
|
13
|
+
server enforces. Asking for less than is enforced sends a user through an entire
|
|
14
|
+
ceremony that fails at the last step, which is what `seamless-auth-api` does
|
|
15
|
+
today: it advertises `preferred` and then rejects a response that skipped
|
|
16
|
+
verification.
|
|
17
|
+
|
|
18
|
+
`required` is the default because user verification is what separates a second
|
|
19
|
+
factor from a second signature, and it is the basis of any AAL2 claim.
|
|
20
|
+
|
|
21
|
+
Additive: config that predates the key parses to `required`, and the field sits
|
|
22
|
+
on the existing authenticator policy block rather than adding another top-level
|
|
23
|
+
key.
|
|
24
|
+
|
|
25
|
+
## 0.12.0
|
|
26
|
+
|
|
27
|
+
### Minor Changes
|
|
28
|
+
|
|
29
|
+
- e89de6c: Record which authenticator a credential came from.
|
|
30
|
+
|
|
31
|
+
`CredentialSchema` gains `aaguid`, and it is included in `CredentialApiSchema`
|
|
32
|
+
so it reaches `CredentialResponseSchema`.
|
|
33
|
+
|
|
34
|
+
The AAGUID is the authenticator's model identifier. Without it there is no key to
|
|
35
|
+
look an authenticator up in the FIDO Metadata Service, no way to express an allow
|
|
36
|
+
or deny list of approved models, and no way to report which authenticators an
|
|
37
|
+
organisation actually has deployed.
|
|
38
|
+
|
|
39
|
+
Additive and backward compatible: nullable and optional, so credentials
|
|
40
|
+
registered before this was recorded still parse. Note that an all-zero AAGUID is
|
|
41
|
+
not missing data. It is an authenticator declining to identify itself, which many
|
|
42
|
+
platform authenticators do unless attestation is requested, so it is carried
|
|
43
|
+
through rather than normalised away.
|
|
44
|
+
|
|
3
45
|
## 0.11.0
|
|
4
46
|
|
|
5
47
|
### Minor Changes
|
|
@@ -87,6 +87,7 @@ export declare const AdminUserDetailResponseSchema: z.ZodObject<{
|
|
|
87
87
|
browser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
88
88
|
createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
89
89
|
counter: z.ZodNumber;
|
|
90
|
+
aaguid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
90
91
|
transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
91
92
|
ble: "ble";
|
|
92
93
|
hybrid: "hybrid";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -19,6 +19,7 @@ export declare const CredentialSchema: z.ZodObject<{
|
|
|
19
19
|
userId: z.ZodString;
|
|
20
20
|
publicKey: z.ZodString;
|
|
21
21
|
counter: z.ZodNumber;
|
|
22
|
+
aaguid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
22
23
|
transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
23
24
|
ble: "ble";
|
|
24
25
|
hybrid: "hybrid";
|
|
@@ -58,6 +59,7 @@ export declare const CredentialApiSchema: z.ZodObject<{
|
|
|
58
59
|
browser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
59
60
|
createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
60
61
|
counter: z.ZodNumber;
|
|
62
|
+
aaguid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
61
63
|
transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
62
64
|
ble: "ble";
|
|
63
65
|
hybrid: "hybrid";
|
|
@@ -88,6 +90,7 @@ export declare const CredentialResponseSchema: z.ZodObject<{
|
|
|
88
90
|
browser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
89
91
|
createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
90
92
|
counter: z.ZodNumber;
|
|
93
|
+
aaguid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
91
94
|
transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
92
95
|
ble: "ble";
|
|
93
96
|
hybrid: "hybrid";
|
|
@@ -117,6 +120,7 @@ export declare const CredentialUpdateResponseSchema: z.ZodObject<{
|
|
|
117
120
|
browser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
118
121
|
createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
119
122
|
counter: z.ZodNumber;
|
|
123
|
+
aaguid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
120
124
|
transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
121
125
|
ble: "ble";
|
|
122
126
|
hybrid: "hybrid";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/credential/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAMpB,eAAO,MAAM,eAAe;;;;;;;;EAQ1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;EAA0C,CAAC;AAExE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,gBAAgB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/credential/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAMpB,eAAO,MAAM,eAAe;;;;;;;;EAQ1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;EAA0C,CAAC;AAExE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,6BAA6B;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
|
|
@@ -18,6 +18,17 @@ export const CredentialSchema = z.object({
|
|
|
18
18
|
userId: z.string(),
|
|
19
19
|
publicKey: z.string(),
|
|
20
20
|
counter: z.number(),
|
|
21
|
+
/**
|
|
22
|
+
* The authenticator's model identifier, as it reported at registration.
|
|
23
|
+
*
|
|
24
|
+
* Null for credentials registered before this was recorded. An all-zero value
|
|
25
|
+
* is not missing data: it is an authenticator declining to say what it is,
|
|
26
|
+
* which many platform authenticators do unless attestation is requested.
|
|
27
|
+
*
|
|
28
|
+
* This is the key the FIDO Metadata Service is looked up by, and the key an
|
|
29
|
+
* allow or deny list of approved authenticators is expressed in.
|
|
30
|
+
*/
|
|
31
|
+
aaguid: z.string().nullable().optional(),
|
|
21
32
|
transports: z.array(TransportSchema).optional(),
|
|
22
33
|
deviceType: DeviceTypeSchema.optional(),
|
|
23
34
|
backedUp: z.boolean(),
|
|
@@ -39,6 +50,7 @@ export const DeleteCredentialRequestSchema = z.object({
|
|
|
39
50
|
});
|
|
40
51
|
export const CredentialApiSchema = CredentialSchema.pick({
|
|
41
52
|
id: true,
|
|
53
|
+
aaguid: true,
|
|
42
54
|
transports: true,
|
|
43
55
|
deviceType: true,
|
|
44
56
|
backedUp: true,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/credential/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,yEAAyE;AACzE,+EAA+E;AAC/E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACN,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAIxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAElB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/credential/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,yEAAyE;AACzE,+EAA+E;AAC/E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACN,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAIxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAElB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAExC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAE/C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAEvC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5C,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC;IACvD,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACjE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,wBAAwB;CACrC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
|
|
@@ -29,6 +29,7 @@ export declare const MeResponseSchema: z.ZodObject<{
|
|
|
29
29
|
browser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
30
30
|
createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
31
31
|
counter: z.ZodNumber;
|
|
32
|
+
aaguid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
32
33
|
transports: z.ZodOptional<z.ZodArray<z.ZodEnum<{
|
|
33
34
|
ble: "ble";
|
|
34
35
|
hybrid: "hybrid";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/me/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAOvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,sCAAsC;AACtC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,eAAO,MAAM,gBAAgB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/me/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;iBAOvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,sCAAsC;AACtC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
|
|
@@ -61,16 +61,28 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
61
61
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
62
62
|
* and also bounds what a per-request override may ask for.
|
|
63
63
|
*/
|
|
64
|
+
export declare const UserVerificationPolicySchema: z.ZodEnum<{
|
|
65
|
+
discouraged: "discouraged";
|
|
66
|
+
preferred: "preferred";
|
|
67
|
+
required: "required";
|
|
68
|
+
}>;
|
|
69
|
+
export type UserVerificationPolicy = z.infer<typeof UserVerificationPolicySchema>;
|
|
64
70
|
export declare const AuthenticatorPolicySchema: z.ZodObject<{
|
|
65
71
|
attachment: z.ZodDefault<z.ZodEnum<{
|
|
66
72
|
"cross-platform": "cross-platform";
|
|
67
73
|
platform: "platform";
|
|
68
74
|
any: "any";
|
|
69
75
|
}>>;
|
|
76
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
77
|
+
discouraged: "discouraged";
|
|
78
|
+
preferred: "preferred";
|
|
79
|
+
required: "required";
|
|
80
|
+
}>>;
|
|
70
81
|
}, z.core.$strip>;
|
|
71
82
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
72
83
|
export declare const DefaultAuthenticatorPolicy: {
|
|
73
84
|
readonly attachment: "any";
|
|
85
|
+
readonly userVerification: "required";
|
|
74
86
|
};
|
|
75
87
|
export declare const SystemConfigSchema: z.ZodObject<{
|
|
76
88
|
app_name: z.ZodString;
|
|
@@ -120,6 +132,11 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
120
132
|
platform: "platform";
|
|
121
133
|
any: "any";
|
|
122
134
|
}>>;
|
|
135
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
136
|
+
discouraged: "discouraged";
|
|
137
|
+
preferred: "preferred";
|
|
138
|
+
required: "required";
|
|
139
|
+
}>>;
|
|
123
140
|
}, z.core.$strip>>;
|
|
124
141
|
access_token_ttl: z.ZodString;
|
|
125
142
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -179,6 +196,11 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
179
196
|
platform: "platform";
|
|
180
197
|
any: "any";
|
|
181
198
|
}>>;
|
|
199
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
200
|
+
discouraged: "discouraged";
|
|
201
|
+
preferred: "preferred";
|
|
202
|
+
required: "required";
|
|
203
|
+
}>>;
|
|
182
204
|
}, z.core.$strip>>;
|
|
183
205
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
184
206
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -241,6 +263,11 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
241
263
|
platform: "platform";
|
|
242
264
|
any: "any";
|
|
243
265
|
}>>;
|
|
266
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
267
|
+
discouraged: "discouraged";
|
|
268
|
+
preferred: "preferred";
|
|
269
|
+
required: "required";
|
|
270
|
+
}>>;
|
|
244
271
|
}, z.core.$strip>>;
|
|
245
272
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
246
273
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -410,6 +437,11 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
410
437
|
platform: "platform";
|
|
411
438
|
any: "any";
|
|
412
439
|
}>>;
|
|
440
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
441
|
+
discouraged: "discouraged";
|
|
442
|
+
preferred: "preferred";
|
|
443
|
+
required: "required";
|
|
444
|
+
}>>;
|
|
413
445
|
}, z.core.$strip>>;
|
|
414
446
|
access_token_ttl: z.ZodString;
|
|
415
447
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;iBAepC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;CAG7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -60,11 +60,26 @@ export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'c
|
|
|
60
60
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
61
61
|
* and also bounds what a per-request override may ask for.
|
|
62
62
|
*/
|
|
63
|
+
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
63
64
|
export const AuthenticatorPolicySchema = z.object({
|
|
64
65
|
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
66
|
+
/**
|
|
67
|
+
* Whether the authenticator must verify the human, by PIN, biometric or
|
|
68
|
+
* equivalent, rather than only proving it holds the key.
|
|
69
|
+
*
|
|
70
|
+
* One value drives both what the browser is asked for and what the server
|
|
71
|
+
* enforces, so the two cannot disagree. Asking for less than is enforced sends
|
|
72
|
+
* a user through an entire ceremony that fails at the last step.
|
|
73
|
+
*
|
|
74
|
+
* `required` is the default because user verification is what separates a
|
|
75
|
+
* second factor from a second signature, and it is the basis of any AAL2
|
|
76
|
+
* claim.
|
|
77
|
+
*/
|
|
78
|
+
userVerification: UserVerificationPolicySchema.default('required'),
|
|
65
79
|
});
|
|
66
80
|
export const DefaultAuthenticatorPolicy = {
|
|
67
81
|
attachment: 'any',
|
|
82
|
+
userVerification: 'required',
|
|
68
83
|
};
|
|
69
84
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
70
85
|
export const SystemConfigSchema = z.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;CACnE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;CACpB,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAEnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -26,6 +26,17 @@ export const CredentialSchema = z.object({
|
|
|
26
26
|
|
|
27
27
|
publicKey: z.string(),
|
|
28
28
|
counter: z.number(),
|
|
29
|
+
/**
|
|
30
|
+
* The authenticator's model identifier, as it reported at registration.
|
|
31
|
+
*
|
|
32
|
+
* Null for credentials registered before this was recorded. An all-zero value
|
|
33
|
+
* is not missing data: it is an authenticator declining to say what it is,
|
|
34
|
+
* which many platform authenticators do unless attestation is requested.
|
|
35
|
+
*
|
|
36
|
+
* This is the key the FIDO Metadata Service is looked up by, and the key an
|
|
37
|
+
* allow or deny list of approved authenticators is expressed in.
|
|
38
|
+
*/
|
|
39
|
+
aaguid: z.string().nullable().optional(),
|
|
29
40
|
|
|
30
41
|
transports: z.array(TransportSchema).optional(),
|
|
31
42
|
|
|
@@ -62,6 +73,7 @@ export type DeleteCredentialRequest = z.infer<typeof DeleteCredentialRequestSche
|
|
|
62
73
|
|
|
63
74
|
export const CredentialApiSchema = CredentialSchema.pick({
|
|
64
75
|
id: true,
|
|
76
|
+
aaguid: true,
|
|
65
77
|
transports: true,
|
|
66
78
|
deviceType: true,
|
|
67
79
|
backedUp: true,
|
|
@@ -77,14 +77,32 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
77
77
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
78
78
|
* and also bounds what a per-request override may ask for.
|
|
79
79
|
*/
|
|
80
|
+
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
81
|
+
|
|
82
|
+
export type UserVerificationPolicy = z.infer<typeof UserVerificationPolicySchema>;
|
|
83
|
+
|
|
80
84
|
export const AuthenticatorPolicySchema = z.object({
|
|
81
85
|
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
86
|
+
/**
|
|
87
|
+
* Whether the authenticator must verify the human, by PIN, biometric or
|
|
88
|
+
* equivalent, rather than only proving it holds the key.
|
|
89
|
+
*
|
|
90
|
+
* One value drives both what the browser is asked for and what the server
|
|
91
|
+
* enforces, so the two cannot disagree. Asking for less than is enforced sends
|
|
92
|
+
* a user through an entire ceremony that fails at the last step.
|
|
93
|
+
*
|
|
94
|
+
* `required` is the default because user verification is what separates a
|
|
95
|
+
* second factor from a second signature, and it is the basis of any AAL2
|
|
96
|
+
* claim.
|
|
97
|
+
*/
|
|
98
|
+
userVerification: UserVerificationPolicySchema.default('required'),
|
|
82
99
|
});
|
|
83
100
|
|
|
84
101
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
85
102
|
|
|
86
103
|
export const DefaultAuthenticatorPolicy = {
|
|
87
104
|
attachment: 'any',
|
|
105
|
+
userVerification: 'required',
|
|
88
106
|
} as const;
|
|
89
107
|
|
|
90
108
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|