@seamless-auth/types 0.14.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -0
- package/dist/schemas/systemConfig/schema.d.ts +38 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +32 -1
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/systemConfig/schema.ts +37 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,35 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.15.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 0857223: Let a deployment refuse synced passkeys and restrict authenticator models.
|
|
8
|
+
|
|
9
|
+
`AuthenticatorPolicySchema` gains three fields:
|
|
10
|
+
|
|
11
|
+
- `syncedPasskeys`, `allow` or `block`, **defaulting to `block`**
|
|
12
|
+
- `aaguidAllowList`, empty by default
|
|
13
|
+
- `aaguidDenyList`, empty by default
|
|
14
|
+
|
|
15
|
+
**`syncedPasskeys` defaults to `block`, which is a behaviour change.** A
|
|
16
|
+
multi-device credential is synced by a platform password manager, so its private
|
|
17
|
+
key exists somewhere outside the authenticator that created it. That is what a
|
|
18
|
+
consumer wants and what an organisation issuing its own authenticators does not,
|
|
19
|
+
and this package now takes the stricter position by default. A deployment that
|
|
20
|
+
wants platform passkeys sets `syncedPasskeys: 'allow'`.
|
|
21
|
+
|
|
22
|
+
The judgement is made on backup eligibility rather than current backup state: a
|
|
23
|
+
credential that _can_ leave the device is the exposure, whether or not it
|
|
24
|
+
already has.
|
|
25
|
+
|
|
26
|
+
The AAGUID lists restrict which authenticator models may register. They need
|
|
27
|
+
`attestation: 'direct'` to mean anything, because an authenticator that was never
|
|
28
|
+
asked to identify itself reports no usable AAGUID.
|
|
29
|
+
|
|
30
|
+
The whole-object default for `authenticator_policy` is now derived from the field
|
|
31
|
+
defaults rather than restated alongside them, so the two cannot drift.
|
|
32
|
+
|
|
3
33
|
## 0.14.0
|
|
4
34
|
|
|
5
35
|
### Minor Changes
|
|
@@ -65,6 +65,11 @@ export declare const AttestationPolicySchema: z.ZodEnum<{
|
|
|
65
65
|
direct: "direct";
|
|
66
66
|
none: "none";
|
|
67
67
|
}>;
|
|
68
|
+
export declare const SyncedPasskeyPolicySchema: z.ZodEnum<{
|
|
69
|
+
block: "block";
|
|
70
|
+
allow: "allow";
|
|
71
|
+
}>;
|
|
72
|
+
export type SyncedPasskeyPolicy = z.infer<typeof SyncedPasskeyPolicySchema>;
|
|
68
73
|
export type AttestationPolicy = z.infer<typeof AttestationPolicySchema>;
|
|
69
74
|
export declare const UserVerificationPolicySchema: z.ZodEnum<{
|
|
70
75
|
discouraged: "discouraged";
|
|
@@ -88,6 +93,12 @@ export declare const AuthenticatorPolicySchema: z.ZodObject<{
|
|
|
88
93
|
none: "none";
|
|
89
94
|
}>>;
|
|
90
95
|
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
96
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
97
|
+
block: "block";
|
|
98
|
+
allow: "allow";
|
|
99
|
+
}>>;
|
|
100
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
101
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
91
102
|
}, z.core.$strip>;
|
|
92
103
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
93
104
|
export declare const DefaultAuthenticatorPolicy: {
|
|
@@ -95,6 +106,9 @@ export declare const DefaultAuthenticatorPolicy: {
|
|
|
95
106
|
readonly userVerification: "required";
|
|
96
107
|
readonly attestation: "none";
|
|
97
108
|
readonly requireKnownAuthenticator: false;
|
|
109
|
+
readonly syncedPasskeys: "block";
|
|
110
|
+
readonly aaguidAllowList: readonly [];
|
|
111
|
+
readonly aaguidDenyList: readonly [];
|
|
98
112
|
};
|
|
99
113
|
export declare const SystemConfigSchema: z.ZodObject<{
|
|
100
114
|
app_name: z.ZodString;
|
|
@@ -154,6 +168,12 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
154
168
|
none: "none";
|
|
155
169
|
}>>;
|
|
156
170
|
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
171
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
172
|
+
block: "block";
|
|
173
|
+
allow: "allow";
|
|
174
|
+
}>>;
|
|
175
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
176
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
157
177
|
}, z.core.$strip>>;
|
|
158
178
|
access_token_ttl: z.ZodString;
|
|
159
179
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -223,6 +243,12 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
223
243
|
none: "none";
|
|
224
244
|
}>>;
|
|
225
245
|
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
246
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
247
|
+
block: "block";
|
|
248
|
+
allow: "allow";
|
|
249
|
+
}>>;
|
|
250
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
251
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
226
252
|
}, z.core.$strip>>;
|
|
227
253
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
228
254
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -295,6 +321,12 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
295
321
|
none: "none";
|
|
296
322
|
}>>;
|
|
297
323
|
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
324
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
325
|
+
block: "block";
|
|
326
|
+
allow: "allow";
|
|
327
|
+
}>>;
|
|
328
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
329
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
298
330
|
}, z.core.$strip>>;
|
|
299
331
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
300
332
|
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
@@ -474,6 +506,12 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
474
506
|
none: "none";
|
|
475
507
|
}>>;
|
|
476
508
|
requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
|
|
509
|
+
syncedPasskeys: z.ZodDefault<z.ZodEnum<{
|
|
510
|
+
block: "block";
|
|
511
|
+
allow: "allow";
|
|
512
|
+
}>>;
|
|
513
|
+
aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
514
|
+
aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
|
477
515
|
}, z.core.$strip>>;
|
|
478
516
|
access_token_ttl: z.ZodString;
|
|
479
517
|
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBA4DpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -61,6 +61,7 @@ export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'c
|
|
|
61
61
|
* and also bounds what a per-request override may ask for.
|
|
62
62
|
*/
|
|
63
63
|
export const AttestationPolicySchema = z.enum(['none', 'direct']);
|
|
64
|
+
export const SyncedPasskeyPolicySchema = z.enum(['allow', 'block']);
|
|
64
65
|
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
65
66
|
export const AuthenticatorPolicySchema = z.object({
|
|
66
67
|
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
@@ -97,12 +98,40 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
97
98
|
* authenticator that was never asked to identify itself cannot be looked up.
|
|
98
99
|
*/
|
|
99
100
|
requireKnownAuthenticator: z.boolean().default(false),
|
|
101
|
+
/**
|
|
102
|
+
* Whether a credential that can leave the device it was created on may be
|
|
103
|
+
* registered.
|
|
104
|
+
*
|
|
105
|
+
* A multi-device credential is synced by a platform password manager, so the
|
|
106
|
+
* private key exists somewhere outside the authenticator that made it. That is
|
|
107
|
+
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
108
|
+
* own authenticators does not.
|
|
109
|
+
*
|
|
110
|
+
* Judged on backup eligibility rather than current backup state: a credential
|
|
111
|
+
* that *can* sync is the exposure, whether or not it has yet.
|
|
112
|
+
*/
|
|
113
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('block'),
|
|
114
|
+
/**
|
|
115
|
+
* Authenticator models that may register, by AAGUID.
|
|
116
|
+
*
|
|
117
|
+
* Empty, the default, means no restriction. A non-empty list admits only those
|
|
118
|
+
* models, which is how an organisation limits enrolment to the keys it issues
|
|
119
|
+
* or to certified hardware. Requires `attestation: 'direct'` to be meaningful,
|
|
120
|
+
* since an authenticator that was never asked to identify itself reports no
|
|
121
|
+
* usable AAGUID.
|
|
122
|
+
*/
|
|
123
|
+
aaguidAllowList: z.array(z.string()).default([]),
|
|
124
|
+
/** Authenticator models that may not register, by AAGUID. Applied before the allow list. */
|
|
125
|
+
aaguidDenyList: z.array(z.string()).default([]),
|
|
100
126
|
});
|
|
101
127
|
export const DefaultAuthenticatorPolicy = {
|
|
102
128
|
attachment: 'any',
|
|
103
129
|
userVerification: 'required',
|
|
104
130
|
attestation: 'none',
|
|
105
131
|
requireKnownAuthenticator: false,
|
|
132
|
+
syncedPasskeys: 'block',
|
|
133
|
+
aaguidAllowList: [],
|
|
134
|
+
aaguidDenyList: [],
|
|
106
135
|
};
|
|
107
136
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
108
137
|
export const SystemConfigSchema = z.object({
|
|
@@ -113,7 +142,9 @@ export const SystemConfigSchema = z.object({
|
|
|
113
142
|
passkey_login_fallback_enabled: z.boolean(),
|
|
114
143
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
115
144
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
116
|
-
|
|
145
|
+
// Derived from the field defaults rather than restated, so the two cannot drift.
|
|
146
|
+
// DefaultAuthenticatorPolicy stays exported for consumers that need the shape.
|
|
147
|
+
authenticator_policy: AuthenticatorPolicySchema.default(() => AuthenticatorPolicySchema.parse({})),
|
|
117
148
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
118
149
|
/**
|
|
119
150
|
* How long a session may live without being refreshed.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -79,6 +79,10 @@ export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachme
|
|
|
79
79
|
*/
|
|
80
80
|
export const AttestationPolicySchema = z.enum(['none', 'direct']);
|
|
81
81
|
|
|
82
|
+
export const SyncedPasskeyPolicySchema = z.enum(['allow', 'block']);
|
|
83
|
+
|
|
84
|
+
export type SyncedPasskeyPolicy = z.infer<typeof SyncedPasskeyPolicySchema>;
|
|
85
|
+
|
|
82
86
|
export type AttestationPolicy = z.infer<typeof AttestationPolicySchema>;
|
|
83
87
|
|
|
84
88
|
export const UserVerificationPolicySchema = z.enum(['required', 'preferred', 'discouraged']);
|
|
@@ -120,6 +124,31 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
120
124
|
* authenticator that was never asked to identify itself cannot be looked up.
|
|
121
125
|
*/
|
|
122
126
|
requireKnownAuthenticator: z.boolean().default(false),
|
|
127
|
+
/**
|
|
128
|
+
* Whether a credential that can leave the device it was created on may be
|
|
129
|
+
* registered.
|
|
130
|
+
*
|
|
131
|
+
* A multi-device credential is synced by a platform password manager, so the
|
|
132
|
+
* private key exists somewhere outside the authenticator that made it. That is
|
|
133
|
+
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
134
|
+
* own authenticators does not.
|
|
135
|
+
*
|
|
136
|
+
* Judged on backup eligibility rather than current backup state: a credential
|
|
137
|
+
* that *can* sync is the exposure, whether or not it has yet.
|
|
138
|
+
*/
|
|
139
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('block'),
|
|
140
|
+
/**
|
|
141
|
+
* Authenticator models that may register, by AAGUID.
|
|
142
|
+
*
|
|
143
|
+
* Empty, the default, means no restriction. A non-empty list admits only those
|
|
144
|
+
* models, which is how an organisation limits enrolment to the keys it issues
|
|
145
|
+
* or to certified hardware. Requires `attestation: 'direct'` to be meaningful,
|
|
146
|
+
* since an authenticator that was never asked to identify itself reports no
|
|
147
|
+
* usable AAGUID.
|
|
148
|
+
*/
|
|
149
|
+
aaguidAllowList: z.array(z.string()).default([]),
|
|
150
|
+
/** Authenticator models that may not register, by AAGUID. Applied before the allow list. */
|
|
151
|
+
aaguidDenyList: z.array(z.string()).default([]),
|
|
123
152
|
});
|
|
124
153
|
|
|
125
154
|
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
@@ -129,6 +158,9 @@ export const DefaultAuthenticatorPolicy = {
|
|
|
129
158
|
userVerification: 'required',
|
|
130
159
|
attestation: 'none',
|
|
131
160
|
requireKnownAuthenticator: false,
|
|
161
|
+
syncedPasskeys: 'block',
|
|
162
|
+
aaguidAllowList: [],
|
|
163
|
+
aaguidDenyList: [],
|
|
132
164
|
} as const;
|
|
133
165
|
|
|
134
166
|
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
@@ -141,7 +173,11 @@ export const SystemConfigSchema = z.object({
|
|
|
141
173
|
passkey_login_fallback_enabled: z.boolean(),
|
|
142
174
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
143
175
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
144
|
-
|
|
176
|
+
// Derived from the field defaults rather than restated, so the two cannot drift.
|
|
177
|
+
// DefaultAuthenticatorPolicy stays exported for consumers that need the shape.
|
|
178
|
+
authenticator_policy: AuthenticatorPolicySchema.default(() =>
|
|
179
|
+
AuthenticatorPolicySchema.parse({}),
|
|
180
|
+
),
|
|
145
181
|
|
|
146
182
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
147
183
|
|