@seamless-auth/types 0.12.0 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +50 -0
- package/dist/schemas/systemConfig/schema.d.ts +64 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +38 -0
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/systemConfig/schema.ts +44 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,55 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.14.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- a75751e: Let a deployment ask authenticators to identify themselves.
|
|
8
|
+
|
|
9
|
+
`AuthenticatorPolicySchema` gains two fields:
|
|
10
|
+
|
|
11
|
+
- `attestation`, `none` or `direct`, defaulting to `none`
|
|
12
|
+
- `requireKnownAuthenticator`, defaulting to `false`
|
|
13
|
+
|
|
14
|
+
`none` asks for nothing and is right for a consumer deployment: attestation
|
|
15
|
+
carries a privacy cost and most relying parties have no use for it. `direct`
|
|
16
|
+
requests a statement, which is what makes validation against the FIDO Metadata
|
|
17
|
+
Service possible, and what an organisation issuing its own authenticators needs.
|
|
18
|
+
|
|
19
|
+
`requireKnownAuthenticator` decides what happens to an authenticator the Metadata
|
|
20
|
+
Service does not list. False registers it anyway; true refuses it. It is only
|
|
21
|
+
meaningful under `direct`, because an authenticator that was never asked to
|
|
22
|
+
identify itself cannot be looked up.
|
|
23
|
+
|
|
24
|
+
`indirect` and `enterprise` are valid WebAuthn conveyance values and are
|
|
25
|
+
deliberately not accepted, because nothing consumes them yet and accepting them
|
|
26
|
+
would promise handling that does not exist.
|
|
27
|
+
|
|
28
|
+
Additive: config that predates these fields parses to `none` and `false`, which
|
|
29
|
+
is the behaviour every deployment has today.
|
|
30
|
+
|
|
31
|
+
## 0.13.0
|
|
32
|
+
|
|
33
|
+
### Minor Changes
|
|
34
|
+
|
|
35
|
+
- ab19e4a: Let a deployment state whether the authenticator must verify the human.
|
|
36
|
+
|
|
37
|
+
`AuthenticatorPolicySchema` gains `userVerification`, accepting `required`,
|
|
38
|
+
`preferred` or `discouraged`, defaulting to `required`.
|
|
39
|
+
|
|
40
|
+
One value is meant to drive both what the browser is asked for and what the
|
|
41
|
+
server enforces. Asking for less than is enforced sends a user through an entire
|
|
42
|
+
ceremony that fails at the last step, which is what `seamless-auth-api` does
|
|
43
|
+
today: it advertises `preferred` and then rejects a response that skipped
|
|
44
|
+
verification.
|
|
45
|
+
|
|
46
|
+
`required` is the default because user verification is what separates a second
|
|
47
|
+
factor from a second signature, and it is the basis of any AAL2 claim.
|
|
48
|
+
|
|
49
|
+
Additive: config that predates the key parses to `required`, and the field sits
|
|
50
|
+
on the existing authenticator policy block rather than adding another top-level
|
|
51
|
+
key.
|
|
52
|
+
|
|
3
53
|
## 0.12.0
|
|
4
54
|
|
|
5
55
|
### Minor Changes
|
|
@@ -61,16 +61,40 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
61
61
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
62
62
|
* and also bounds what a per-request override may ask for.
|
|
63
63
|
*/
|
|
64
|
+
export declare const AttestationPolicySchema: z.ZodEnum<{
|
|
65
|
+
direct: "direct";
|
|
66
|
+
none: "none";
|
|
67
|
+
}>;
|
|
68
|
+
export type AttestationPolicy = z.infer<typeof AttestationPolicySchema>;
|
|
69
|
+
export declare const UserVerificationPolicySchema: z.ZodEnum<{
|
|
70
|
+
discouraged: "discouraged";
|
|
71
|
+
preferred: "preferred";
|
|
72
|
+
required: "required";
|
|
73
|
+
}>;
|
|
74
|
+
export type UserVerificationPolicy = z.infer<typeof UserVerificationPolicySchema>;
|
|
64
75
|
export declare const AuthenticatorPolicySchema: z.ZodObject<{
|
|
65
76
|
attachment: z.ZodDefault<z.ZodEnum<{
|
|
66
77
|
"cross-platform": "cross-platform";
|
|
67
78
|
platform: "platform";
|
|
68
79
|
any: "any";
|
|
69
80
|
}>>;
|
|
81
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
82
|
+
discouraged: "discouraged";
|
|
83
|
+
preferred: "preferred";
|
|
84
|
+
required: "required";
|
|
85
|
+
}>>;
|
|
86
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
87
|
+
direct: "direct";
|
|
88
|
+
none: "none";
|
|
89
|
+
}>>;
|
|
90
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
70
91
|
}, z.core.$strip>;
|
|
71
92
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
72
93
|
export declare const DefaultAuthenticatorPolicy: {
|
|
73
94
|
readonly attachment: "any";
|
|
95
|
+
readonly userVerification: "required";
|
|
96
|
+
readonly attestation: "none";
|
|
97
|
+
readonly requireKnownAuthenticator: false;
|
|
74
98
|
};
|
|
75
99
|
export declare const SystemConfigSchema: z.ZodObject<{
|
|
76
100
|
app_name: z.ZodString;
|
|
@@ -120,6 +144,16 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
120
144
|
platform: "platform";
|
|
121
145
|
any: "any";
|
|
122
146
|
}>>;
|
|
147
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
148
|
+
discouraged: "discouraged";
|
|
149
|
+
preferred: "preferred";
|
|
150
|
+
required: "required";
|
|
151
|
+
}>>;
|
|
152
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
153
|
+
direct: "direct";
|
|
154
|
+
none: "none";
|
|
155
|
+
}>>;
|
|
156
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
123
157
|
}, z.core.$strip>>;
|
|
124
158
|
access_token_ttl: z.ZodString;
|
|
125
159
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -179,6 +213,16 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
179
213
|
platform: "platform";
|
|
180
214
|
any: "any";
|
|
181
215
|
}>>;
|
|
216
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
217
|
+
discouraged: "discouraged";
|
|
218
|
+
preferred: "preferred";
|
|
219
|
+
required: "required";
|
|
220
|
+
}>>;
|
|
221
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
222
|
+
direct: "direct";
|
|
223
|
+
none: "none";
|
|
224
|
+
}>>;
|
|
225
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
182
226
|
}, z.core.$strip>>;
|
|
183
227
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
184
228
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -241,6 +285,16 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
241
285
|
platform: "platform";
|
|
242
286
|
any: "any";
|
|
243
287
|
}>>;
|
|
288
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
289
|
+
discouraged: "discouraged";
|
|
290
|
+
preferred: "preferred";
|
|
291
|
+
required: "required";
|
|
292
|
+
}>>;
|
|
293
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
294
|
+
direct: "direct";
|
|
295
|
+
none: "none";
|
|
296
|
+
}>>;
|
|
297
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
244
298
|
}, z.core.$strip>>;
|
|
245
299
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
246
300
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -410,6 +464,16 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
410
464
|
platform: "platform";
|
|
411
465
|
any: "any";
|
|
412
466
|
}>>;
|
|
467
|
+
userVerification: z.ZodDefault<z.ZodEnum<{
|
|
468
|
+
discouraged: "discouraged";
|
|
469
|
+
preferred: "preferred";
|
|
470
|
+
required: "required";
|
|
471
|
+
}>>;
|
|
472
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
473
|
+
direct: "direct";
|
|
474
|
+
none: "none";
|
|
475
|
+
}>>;
|
|
476
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
413
477
|
}, z.core.$strip>>;
|
|
414
478
|
access_token_ttl: z.ZodString;
|
|
415
479
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;iBAmCpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;CAK7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -60,11 +60,49 @@ export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'c
|
|
|
60
60
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
61
61
|
* and also bounds what a per-request override may ask for.
|
|
62
62
|
*/
|
|
63
|
+
export const AttestationPolicySchema = z.enum(['none', 'direct']);
|
|
64
|
+
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
63
65
|
export const AuthenticatorPolicySchema = z.object({
|
|
64
66
|
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
67
|
+
/**
|
|
68
|
+
* Whether the authenticator must verify the human, by PIN, biometric or
|
|
69
|
+
* equivalent, rather than only proving it holds the key.
|
|
70
|
+
*
|
|
71
|
+
* One value drives both what the browser is asked for and what the server
|
|
72
|
+
* enforces, so the two cannot disagree. Asking for less than is enforced sends
|
|
73
|
+
* a user through an entire ceremony that fails at the last step.
|
|
74
|
+
*
|
|
75
|
+
* `required` is the default because user verification is what separates a
|
|
76
|
+
* second factor from a second signature, and it is the basis of any AAL2
|
|
77
|
+
* claim.
|
|
78
|
+
*/
|
|
79
|
+
userVerification: UserVerificationPolicySchema.default('required'),
|
|
80
|
+
/**
|
|
81
|
+
* Whether to ask the authenticator to identify itself with an attestation
|
|
82
|
+
* statement.
|
|
83
|
+
*
|
|
84
|
+
* `none`, the default, asks for nothing and is right for a consumer
|
|
85
|
+
* deployment: attestation carries a privacy cost and most relying parties have
|
|
86
|
+
* no use for it. `direct` requests a statement, which is what makes metadata
|
|
87
|
+
* validation and any allow or deny list of approved models possible, and is
|
|
88
|
+
* what an organisation issuing its own authenticators wants.
|
|
89
|
+
*/
|
|
90
|
+
attestation: AttestationPolicySchema.default('none'),
|
|
91
|
+
/**
|
|
92
|
+
* What to do with an authenticator the FIDO Metadata Service does not list.
|
|
93
|
+
*
|
|
94
|
+
* `false`, the default, registers it anyway. `true` refuses it, which is the
|
|
95
|
+
* stricter posture an organisation wanting only known, certified models would
|
|
96
|
+
* choose. Only meaningful when `attestation` is `direct`, since an
|
|
97
|
+
* authenticator that was never asked to identify itself cannot be looked up.
|
|
98
|
+
*/
|
|
99
|
+
requireKnownAuthenticator: z.boolean().default(false),
|
|
65
100
|
});
|
|
66
101
|
export const DefaultAuthenticatorPolicy = {
|
|
67
102
|
attachment: 'any',
|
|
103
|
+
userVerification: 'required',
|
|
104
|
+
attestation: 'none',
|
|
105
|
+
requireKnownAuthenticator: false,
|
|
68
106
|
};
|
|
69
107
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
70
108
|
export const SystemConfigSchema = z.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAIlE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;CACxB,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAEnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -77,14 +77,58 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
77
77
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
78
78
|
* and also bounds what a per-request override may ask for.
|
|
79
79
|
*/
|
|
80
|
+
export const AttestationPolicySchema = z.enum(['none', 'direct']);
|
|
81
|
+
|
|
82
|
+
export type AttestationPolicy = z.infer<typeof AttestationPolicySchema>;
|
|
83
|
+
|
|
84
|
+
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
85
|
+
|
|
86
|
+
export type UserVerificationPolicy = z.infer<typeof UserVerificationPolicySchema>;
|
|
87
|
+
|
|
80
88
|
export const AuthenticatorPolicySchema = z.object({
|
|
81
89
|
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
90
|
+
/**
|
|
91
|
+
* Whether the authenticator must verify the human, by PIN, biometric or
|
|
92
|
+
* equivalent, rather than only proving it holds the key.
|
|
93
|
+
*
|
|
94
|
+
* One value drives both what the browser is asked for and what the server
|
|
95
|
+
* enforces, so the two cannot disagree. Asking for less than is enforced sends
|
|
96
|
+
* a user through an entire ceremony that fails at the last step.
|
|
97
|
+
*
|
|
98
|
+
* `required` is the default because user verification is what separates a
|
|
99
|
+
* second factor from a second signature, and it is the basis of any AAL2
|
|
100
|
+
* claim.
|
|
101
|
+
*/
|
|
102
|
+
userVerification: UserVerificationPolicySchema.default('required'),
|
|
103
|
+
/**
|
|
104
|
+
* Whether to ask the authenticator to identify itself with an attestation
|
|
105
|
+
* statement.
|
|
106
|
+
*
|
|
107
|
+
* `none`, the default, asks for nothing and is right for a consumer
|
|
108
|
+
* deployment: attestation carries a privacy cost and most relying parties have
|
|
109
|
+
* no use for it. `direct` requests a statement, which is what makes metadata
|
|
110
|
+
* validation and any allow or deny list of approved models possible, and is
|
|
111
|
+
* what an organisation issuing its own authenticators wants.
|
|
112
|
+
*/
|
|
113
|
+
attestation: AttestationPolicySchema.default('none'),
|
|
114
|
+
/**
|
|
115
|
+
* What to do with an authenticator the FIDO Metadata Service does not list.
|
|
116
|
+
*
|
|
117
|
+
* `false`, the default, registers it anyway. `true` refuses it, which is the
|
|
118
|
+
* stricter posture an organisation wanting only known, certified models would
|
|
119
|
+
* choose. Only meaningful when `attestation` is `direct`, since an
|
|
120
|
+
* authenticator that was never asked to identify itself cannot be looked up.
|
|
121
|
+
*/
|
|
122
|
+
requireKnownAuthenticator: z.boolean().default(false),
|
|
82
123
|
});
|
|
83
124
|
|
|
84
125
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
85
126
|
|
|
86
127
|
export const DefaultAuthenticatorPolicy = {
|
|
87
128
|
attachment: 'any',
|
|
129
|
+
userVerification: 'required',
|
|
130
|
+
attestation: 'none',
|
|
131
|
+
requireKnownAuthenticator: false,
|
|
88
132
|
} as const;
|
|
89
133
|
|
|
90
134
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|