@seamless-auth/types 0.13.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +58 -0
- package/dist/schemas/systemConfig/schema.d.ts +70 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +55 -1
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/systemConfig/schema.ts +63 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,63 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.15.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 0857223: Let a deployment refuse synced passkeys and restrict authenticator models.
|
|
8
|
+
|
|
9
|
+
`AuthenticatorPolicySchema` gains three fields:
|
|
10
|
+
|
|
11
|
+
- `syncedPasskeys`, `allow` or `block`, **defaulting to `block`**
|
|
12
|
+
- `aaguidAllowList`, empty by default
|
|
13
|
+
- `aaguidDenyList`, empty by default
|
|
14
|
+
|
|
15
|
+
**`syncedPasskeys` defaults to `block`, which is a behaviour change.** A
|
|
16
|
+
multi-device credential is synced by a platform password manager, so its private
|
|
17
|
+
key exists somewhere outside the authenticator that created it. That is what a
|
|
18
|
+
consumer wants and what an organisation issuing its own authenticators does not,
|
|
19
|
+
and this package now takes the stricter position by default. A deployment that
|
|
20
|
+
wants platform passkeys sets `syncedPasskeys: 'allow'`.
|
|
21
|
+
|
|
22
|
+
The judgement is made on backup eligibility rather than current backup state: a
|
|
23
|
+
credential that _can_ leave the device is the exposure, whether or not it
|
|
24
|
+
already has.
|
|
25
|
+
|
|
26
|
+
The AAGUID lists restrict which authenticator models may register. They need
|
|
27
|
+
`attestation: 'direct'` to mean anything, because an authenticator that was never
|
|
28
|
+
asked to identify itself reports no usable AAGUID.
|
|
29
|
+
|
|
30
|
+
The whole-object default for `authenticator_policy` is now derived from the field
|
|
31
|
+
defaults rather than restated alongside them, so the two cannot drift.
|
|
32
|
+
|
|
33
|
+
## 0.14.0
|
|
34
|
+
|
|
35
|
+
### Minor Changes
|
|
36
|
+
|
|
37
|
+
- a75751e: Let a deployment ask authenticators to identify themselves.
|
|
38
|
+
|
|
39
|
+
`AuthenticatorPolicySchema` gains two fields:
|
|
40
|
+
|
|
41
|
+
- `attestation`, `none` or `direct`, defaulting to `none`
|
|
42
|
+
- `requireKnownAuthenticator`, defaulting to `false`
|
|
43
|
+
|
|
44
|
+
`none` asks for nothing and is right for a consumer deployment: attestation
|
|
45
|
+
carries a privacy cost and most relying parties have no use for it. `direct`
|
|
46
|
+
requests a statement, which is what makes validation against the FIDO Metadata
|
|
47
|
+
Service possible, and what an organisation issuing its own authenticators needs.
|
|
48
|
+
|
|
49
|
+
`requireKnownAuthenticator` decides what happens to an authenticator the Metadata
|
|
50
|
+
Service does not list. False registers it anyway; true refuses it. It is only
|
|
51
|
+
meaningful under `direct`, because an authenticator that was never asked to
|
|
52
|
+
identify itself cannot be looked up.
|
|
53
|
+
|
|
54
|
+
`indirect` and `enterprise` are valid WebAuthn conveyance values and are
|
|
55
|
+
deliberately not accepted, because nothing consumes them yet and accepting them
|
|
56
|
+
would promise handling that does not exist.
|
|
57
|
+
|
|
58
|
+
Additive: config that predates these fields parses to `none` and `false`, which
|
|
59
|
+
is the behaviour every deployment has today.
|
|
60
|
+
|
|
3
61
|
## 0.13.0
|
|
4
62
|
|
|
5
63
|
### Minor Changes
|
|
@@ -61,6 +61,16 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
61
61
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
62
62
|
* and also bounds what a per-request override may ask for.
|
|
63
63
|
*/
|
|
64
|
+
export declare const AttestationPolicySchema: z.ZodEnum<{
|
|
65
|
+
direct: "direct";
|
|
66
|
+
none: "none";
|
|
67
|
+
}>;
|
|
68
|
+
export declare const SyncedPasskeyPolicySchema: z.ZodEnum<{
|
|
69
|
+
block: "block";
|
|
70
|
+
allow: "allow";
|
|
71
|
+
}>;
|
|
72
|
+
export type SyncedPasskeyPolicy = z.infer<typeof SyncedPasskeyPolicySchema>;
|
|
73
|
+
export type AttestationPolicy = z.infer<typeof AttestationPolicySchema>;
|
|
64
74
|
export declare const UserVerificationPolicySchema: z.ZodEnum<{
|
|
65
75
|
discouraged: "discouraged";
|
|
66
76
|
preferred: "preferred";
|
|
@@ -78,11 +88,27 @@ export declare const AuthenticatorPolicySchema: z.ZodObject<{
|
|
|
78
88
|
preferred: "preferred";
|
|
79
89
|
required: "required";
|
|
80
90
|
}>>;
|
|
91
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
92
|
+
direct: "direct";
|
|
93
|
+
none: "none";
|
|
94
|
+
}>>;
|
|
95
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
96
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
97
|
+
block: "block";
|
|
98
|
+
allow: "allow";
|
|
99
|
+
}>>;
|
|
100
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
101
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
81
102
|
}, z.core.$strip>;
|
|
82
103
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
83
104
|
export declare const DefaultAuthenticatorPolicy: {
|
|
84
105
|
readonly attachment: "any";
|
|
85
106
|
readonly userVerification: "required";
|
|
107
|
+
readonly attestation: "none";
|
|
108
|
+
readonly requireKnownAuthenticator: false;
|
|
109
|
+
readonly syncedPasskeys: "block";
|
|
110
|
+
readonly aaguidAllowList: readonly [];
|
|
111
|
+
readonly aaguidDenyList: readonly [];
|
|
86
112
|
};
|
|
87
113
|
export declare const SystemConfigSchema: z.ZodObject<{
|
|
88
114
|
app_name: z.ZodString;
|
|
@@ -137,6 +163,17 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
137
163
|
preferred: "preferred";
|
|
138
164
|
required: "required";
|
|
139
165
|
}>>;
|
|
166
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
167
|
+
direct: "direct";
|
|
168
|
+
none: "none";
|
|
169
|
+
}>>;
|
|
170
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
171
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
172
|
+
block: "block";
|
|
173
|
+
allow: "allow";
|
|
174
|
+
}>>;
|
|
175
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
176
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
140
177
|
}, z.core.$strip>>;
|
|
141
178
|
access_token_ttl: z.ZodString;
|
|
142
179
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -201,6 +238,17 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
201
238
|
preferred: "preferred";
|
|
202
239
|
required: "required";
|
|
203
240
|
}>>;
|
|
241
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
242
|
+
direct: "direct";
|
|
243
|
+
none: "none";
|
|
244
|
+
}>>;
|
|
245
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
246
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
247
|
+
block: "block";
|
|
248
|
+
allow: "allow";
|
|
249
|
+
}>>;
|
|
250
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
251
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
204
252
|
}, z.core.$strip>>;
|
|
205
253
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
206
254
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -268,6 +316,17 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
268
316
|
preferred: "preferred";
|
|
269
317
|
required: "required";
|
|
270
318
|
}>>;
|
|
319
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
320
|
+
direct: "direct";
|
|
321
|
+
none: "none";
|
|
322
|
+
}>>;
|
|
323
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
324
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
325
|
+
block: "block";
|
|
326
|
+
allow: "allow";
|
|
327
|
+
}>>;
|
|
328
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
329
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
271
330
|
}, z.core.$strip>>;
|
|
272
331
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
273
332
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -442,6 +501,17 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
442
501
|
preferred: "preferred";
|
|
443
502
|
required: "required";
|
|
444
503
|
}>>;
|
|
504
|
+
attestation: z.ZodDefault<z.ZodEnum<{
|
|
505
|
+
direct: "direct";
|
|
506
|
+
none: "none";
|
|
507
|
+
}>>;
|
|
508
|
+
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
509
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
510
|
+
block: "block";
|
|
511
|
+
allow: "allow";
|
|
512
|
+
}>>;
|
|
513
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
514
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
445
515
|
}, z.core.$strip>>;
|
|
446
516
|
access_token_ttl: z.ZodString;
|
|
447
517
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBA4DpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -60,6 +60,8 @@ export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'c
|
|
|
60
60
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
61
61
|
* and also bounds what a per-request override may ask for.
|
|
62
62
|
*/
|
|
63
|
+
export const AttestationPolicySchema = z.enum(['none', 'direct']);
|
|
64
|
+
export const SyncedPasskeyPolicySchema = z.enum(['allow', 'block']);
|
|
63
65
|
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
64
66
|
export const AuthenticatorPolicySchema = z.object({
|
|
65
67
|
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
@@ -76,10 +78,60 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
76
78
|
* claim.
|
|
77
79
|
*/
|
|
78
80
|
userVerification: UserVerificationPolicySchema.default('required'),
|
|
81
|
+
/**
|
|
82
|
+
* Whether to ask the authenticator to identify itself with an attestation
|
|
83
|
+
* statement.
|
|
84
|
+
*
|
|
85
|
+
* `none`, the default, asks for nothing and is right for a consumer
|
|
86
|
+
* deployment: attestation carries a privacy cost and most relying parties have
|
|
87
|
+
* no use for it. `direct` requests a statement, which is what makes metadata
|
|
88
|
+
* validation and any allow or deny list of approved models possible, and is
|
|
89
|
+
* what an organisation issuing its own authenticators wants.
|
|
90
|
+
*/
|
|
91
|
+
attestation: AttestationPolicySchema.default('none'),
|
|
92
|
+
/**
|
|
93
|
+
* What to do with an authenticator the FIDO Metadata Service does not list.
|
|
94
|
+
*
|
|
95
|
+
* `false`, the default, registers it anyway. `true` refuses it, which is the
|
|
96
|
+
* stricter posture an organisation wanting only known, certified models would
|
|
97
|
+
* choose. Only meaningful when `attestation` is `direct`, since an
|
|
98
|
+
* authenticator that was never asked to identify itself cannot be looked up.
|
|
99
|
+
*/
|
|
100
|
+
requireKnownAuthenticator: z.boolean().default(false),
|
|
101
|
+
/**
|
|
102
|
+
* Whether a credential that can leave the device it was created on may be
|
|
103
|
+
* registered.
|
|
104
|
+
*
|
|
105
|
+
* A multi-device credential is synced by a platform password manager, so the
|
|
106
|
+
* private key exists somewhere outside the authenticator that made it. That is
|
|
107
|
+
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
108
|
+
* own authenticators does not.
|
|
109
|
+
*
|
|
110
|
+
* Judged on backup eligibility rather than current backup state: a credential
|
|
111
|
+
* that *can* sync is the exposure, whether or not it has yet.
|
|
112
|
+
*/
|
|
113
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('block'),
|
|
114
|
+
/**
|
|
115
|
+
* Authenticator models that may register, by AAGUID.
|
|
116
|
+
*
|
|
117
|
+
* Empty, the default, means no restriction. A non-empty list admits only those
|
|
118
|
+
* models, which is how an organisation limits enrolment to the keys it issues
|
|
119
|
+
* or to certified hardware. Requires `attestation: 'direct'` to be meaningful,
|
|
120
|
+
* since an authenticator that was never asked to identify itself reports no
|
|
121
|
+
* usable AAGUID.
|
|
122
|
+
*/
|
|
123
|
+
aaguidAllowList: z.array(z.string()).default([]),
|
|
124
|
+
/** Authenticator models that may not register, by AAGUID. Applied before the allow list. */
|
|
125
|
+
aaguidDenyList: z.array(z.string()).default([]),
|
|
79
126
|
});
|
|
80
127
|
export const DefaultAuthenticatorPolicy = {
|
|
81
128
|
attachment: 'any',
|
|
82
129
|
userVerification: 'required',
|
|
130
|
+
attestation: 'none',
|
|
131
|
+
requireKnownAuthenticator: false,
|
|
132
|
+
syncedPasskeys: 'block',
|
|
133
|
+
aaguidAllowList: [],
|
|
134
|
+
aaguidDenyList: [],
|
|
83
135
|
};
|
|
84
136
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
85
137
|
export const SystemConfigSchema = z.object({
|
|
@@ -90,7 +142,9 @@ export const SystemConfigSchema = z.object({
|
|
|
90
142
|
passkey_login_fallback_enabled: z.boolean(),
|
|
91
143
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
92
144
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
93
|
-
|
|
145
|
+
// Derived from the field defaults rather than restated, so the two cannot drift.
|
|
146
|
+
// DefaultAuthenticatorPolicy stays exported for consumers that need the shape.
|
|
147
|
+
authenticator_policy: AuthenticatorPolicySchema.default(() => AuthenticatorPolicySchema.parse({})),
|
|
94
148
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
95
149
|
/**
|
|
96
150
|
* How long a session may live without being refreshed.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -77,6 +77,14 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
77
77
|
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
78
78
|
* and also bounds what a per-request override may ask for.
|
|
79
79
|
*/
|
|
80
|
+
export const AttestationPolicySchema = z.enum(['none', 'direct']);
|
|
81
|
+
|
|
82
|
+
export const SyncedPasskeyPolicySchema = z.enum(['allow', 'block']);
|
|
83
|
+
|
|
84
|
+
export type SyncedPasskeyPolicy = z.infer<typeof SyncedPasskeyPolicySchema>;
|
|
85
|
+
|
|
86
|
+
export type AttestationPolicy = z.infer<typeof AttestationPolicySchema>;
|
|
87
|
+
|
|
80
88
|
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
81
89
|
|
|
82
90
|
export type UserVerificationPolicy = z.infer<typeof UserVerificationPolicySchema>;
|
|
@@ -96,6 +104,51 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
96
104
|
* claim.
|
|
97
105
|
*/
|
|
98
106
|
userVerification: UserVerificationPolicySchema.default('required'),
|
|
107
|
+
/**
|
|
108
|
+
* Whether to ask the authenticator to identify itself with an attestation
|
|
109
|
+
* statement.
|
|
110
|
+
*
|
|
111
|
+
* `none`, the default, asks for nothing and is right for a consumer
|
|
112
|
+
* deployment: attestation carries a privacy cost and most relying parties have
|
|
113
|
+
* no use for it. `direct` requests a statement, which is what makes metadata
|
|
114
|
+
* validation and any allow or deny list of approved models possible, and is
|
|
115
|
+
* what an organisation issuing its own authenticators wants.
|
|
116
|
+
*/
|
|
117
|
+
attestation: AttestationPolicySchema.default('none'),
|
|
118
|
+
/**
|
|
119
|
+
* What to do with an authenticator the FIDO Metadata Service does not list.
|
|
120
|
+
*
|
|
121
|
+
* `false`, the default, registers it anyway. `true` refuses it, which is the
|
|
122
|
+
* stricter posture an organisation wanting only known, certified models would
|
|
123
|
+
* choose. Only meaningful when `attestation` is `direct`, since an
|
|
124
|
+
* authenticator that was never asked to identify itself cannot be looked up.
|
|
125
|
+
*/
|
|
126
|
+
requireKnownAuthenticator: z.boolean().default(false),
|
|
127
|
+
/**
|
|
128
|
+
* Whether a credential that can leave the device it was created on may be
|
|
129
|
+
* registered.
|
|
130
|
+
*
|
|
131
|
+
* A multi-device credential is synced by a platform password manager, so the
|
|
132
|
+
* private key exists somewhere outside the authenticator that made it. That is
|
|
133
|
+
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
134
|
+
* own authenticators does not.
|
|
135
|
+
*
|
|
136
|
+
* Judged on backup eligibility rather than current backup state: a credential
|
|
137
|
+
* that *can* sync is the exposure, whether or not it has yet.
|
|
138
|
+
*/
|
|
139
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('block'),
|
|
140
|
+
/**
|
|
141
|
+
* Authenticator models that may register, by AAGUID.
|
|
142
|
+
*
|
|
143
|
+
* Empty, the default, means no restriction. A non-empty list admits only those
|
|
144
|
+
* models, which is how an organisation limits enrolment to the keys it issues
|
|
145
|
+
* or to certified hardware. Requires `attestation: 'direct'` to be meaningful,
|
|
146
|
+
* since an authenticator that was never asked to identify itself reports no
|
|
147
|
+
* usable AAGUID.
|
|
148
|
+
*/
|
|
149
|
+
aaguidAllowList: z.array(z.string()).default([]),
|
|
150
|
+
/** Authenticator models that may not register, by AAGUID. Applied before the allow list. */
|
|
151
|
+
aaguidDenyList: z.array(z.string()).default([]),
|
|
99
152
|
});
|
|
100
153
|
|
|
101
154
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
@@ -103,6 +156,11 @@ export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
|
103
156
|
export const DefaultAuthenticatorPolicy = {
|
|
104
157
|
attachment: 'any',
|
|
105
158
|
userVerification: 'required',
|
|
159
|
+
attestation: 'none',
|
|
160
|
+
requireKnownAuthenticator: false,
|
|
161
|
+
syncedPasskeys: 'block',
|
|
162
|
+
aaguidAllowList: [],
|
|
163
|
+
aaguidDenyList: [],
|
|
106
164
|
} as const;
|
|
107
165
|
|
|
108
166
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
@@ -115,7 +173,11 @@ export const SystemConfigSchema = z.object({
|
|
|
115
173
|
passkey_login_fallback_enabled: z.boolean(),
|
|
116
174
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
117
175
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
118
|
-
|
|
176
|
+
// Derived from the field defaults rather than restated, so the two cannot drift.
|
|
177
|
+
// DefaultAuthenticatorPolicy stays exported for consumers that need the shape.
|
|
178
|
+
authenticator_policy: AuthenticatorPolicySchema.default(() =>
|
|
179
|
+
AuthenticatorPolicySchema.parse({}),
|
|
180
|
+
),
|
|
119
181
|
|
|
120
182
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
121
183
|
|