@seamless-auth/types 0.17.0 → 0.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +53 -0
- package/dist/schemas/systemConfig/schema.d.ts +7 -1
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +47 -2
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/systemConfig/schema.ts +54 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,58 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.19.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 7390df6: Default `authenticator_policy.syncedPasskeys` to `allow`.
|
|
8
|
+
|
|
9
|
+
This reverses the default introduced in 0.15.0. `block` refuses any credential
|
|
10
|
+
that is backup eligible, and every iCloud Keychain and Google Password Manager
|
|
11
|
+
passkey is, so a stock deployment refused the passkey a normal laptop or phone
|
|
12
|
+
actually offers. The first registration failed on hardware the operator had no
|
|
13
|
+
way to change, which is not a posture anyone should inherit by accident.
|
|
14
|
+
|
|
15
|
+
A deployment issuing its own authenticators still sets `block`, and it now reads
|
|
16
|
+
as the deliberate choice it is:
|
|
17
|
+
|
|
18
|
+
```json
|
|
19
|
+
{ "syncedPasskeys": "block" }
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
Nothing else changes. The judgement is still made on backup eligibility rather
|
|
23
|
+
than current backup state, the refusal is still
|
|
24
|
+
`403 { "error": "synced_passkey_not_allowed" }`, and a policy that names the
|
|
25
|
+
field keeps whatever it names. Only an omitted field resolves differently.
|
|
26
|
+
|
|
27
|
+
## 0.18.0
|
|
28
|
+
|
|
29
|
+
### Minor Changes
|
|
30
|
+
|
|
31
|
+
- 40eb9c5: Add `magic_link_redirect_uris` to the system config.
|
|
32
|
+
|
|
33
|
+
An exact-match allowlist of destinations a magic link may be sent to, empty by
|
|
34
|
+
default. `seamless-auth-api` validates a requested destination against `origins`
|
|
35
|
+
today, which covers a target whose host is already a WebAuthn origin and cannot
|
|
36
|
+
express the two cases that need this: a custom application scheme such as
|
|
37
|
+
`myapp://auth`, and a universal link on a host that should not also be a WebAuthn
|
|
38
|
+
origin.
|
|
39
|
+
|
|
40
|
+
Exact match rather than origin comparison, because neither of those has an origin
|
|
41
|
+
worth comparing. Empty by default, so a deployment that sets nothing keeps comparing
|
|
42
|
+
against `origins` exactly as it does now.
|
|
43
|
+
|
|
44
|
+
Also exports `RedirectTargetSchema`, which is what entries are validated with, and
|
|
45
|
+
which is stricter than `z.url()` on purpose. `z.url()` accepts anything the URL parser
|
|
46
|
+
does, including `javascript:alert(1)` and `data:text/html,...`. A magic link
|
|
47
|
+
destination is rendered as an href in an email, so one of those stored in config would
|
|
48
|
+
be a script-execution sink reachable through the admin system-config API. The
|
|
49
|
+
`javascript:`, `data:`, `vbscript:`, `file:`, `blob:` and `about:` schemes are refused,
|
|
50
|
+
and everything else including arbitrary application schemes is allowed, since an
|
|
51
|
+
allowlist of known-good schemes could not express the case this exists for.
|
|
52
|
+
|
|
53
|
+
`SystemConfigPatchSchema` takes the field too, so the guard applies to the admin write
|
|
54
|
+
path and not only to what a server seeds at boot.
|
|
55
|
+
|
|
3
56
|
## 0.17.0
|
|
4
57
|
|
|
5
58
|
### Minor Changes
|
|
@@ -7,6 +7,8 @@ export declare const LoginMethodSchema: z.ZodEnum<{
|
|
|
7
7
|
oauth: "oauth";
|
|
8
8
|
}>;
|
|
9
9
|
export type LoginMethod = z.infer<typeof LoginMethodSchema>;
|
|
10
|
+
export declare const RedirectTargetSchema: z.ZodURL;
|
|
11
|
+
export type RedirectTarget = z.infer<typeof RedirectTargetSchema>;
|
|
10
12
|
export declare const OAuthProviderIdSchema: z.ZodString;
|
|
11
13
|
export type OAuthProviderId = z.infer<typeof OAuthProviderIdSchema>;
|
|
12
14
|
export declare const OAuthProviderConfigSchema: z.ZodObject<{
|
|
@@ -106,7 +108,7 @@ export declare const DefaultAuthenticatorPolicy: {
|
|
|
106
108
|
readonly userVerification: "required";
|
|
107
109
|
readonly attestation: "none";
|
|
108
110
|
readonly requireKnownAuthenticator: false;
|
|
109
|
-
readonly syncedPasskeys: "
|
|
111
|
+
readonly syncedPasskeys: "allow";
|
|
110
112
|
readonly aaguidAllowList: readonly [];
|
|
111
113
|
readonly aaguidDenyList: readonly [];
|
|
112
114
|
};
|
|
@@ -184,6 +186,7 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
184
186
|
rpid: z.ZodString;
|
|
185
187
|
origins: z.ZodArray<z.ZodURL>;
|
|
186
188
|
frontend_url: z.ZodOptional<z.ZodURL>;
|
|
189
|
+
magic_link_redirect_uris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
|
|
187
190
|
}, z.core.$strip>;
|
|
188
191
|
export type SystemConfig = z.infer<typeof SystemConfigSchema>;
|
|
189
192
|
export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
@@ -259,6 +262,7 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
259
262
|
delay_after: z.ZodOptional<z.ZodNumber>;
|
|
260
263
|
rpid: z.ZodOptional<z.ZodString>;
|
|
261
264
|
origins: z.ZodOptional<z.ZodArray<z.ZodURL>>;
|
|
265
|
+
magic_link_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
|
|
262
266
|
}, z.core.$strict>;
|
|
263
267
|
export type SystemConfigPatch = z.infer<typeof SystemConfigPatchSchema>;
|
|
264
268
|
/**
|
|
@@ -338,6 +342,7 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
338
342
|
delay_after: z.ZodOptional<z.ZodNumber>;
|
|
339
343
|
rpid: z.ZodOptional<z.ZodString>;
|
|
340
344
|
origins: z.ZodOptional<z.ZodArray<z.ZodURL>>;
|
|
345
|
+
magic_link_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
|
|
341
346
|
}, z.core.$strict>;
|
|
342
347
|
export declare const OAuthProviderCreateSchema: z.ZodObject<{
|
|
343
348
|
id: z.ZodString;
|
|
@@ -525,6 +530,7 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
525
530
|
rpid: z.ZodString;
|
|
526
531
|
origins: z.ZodArray<z.ZodURL>;
|
|
527
532
|
frontend_url: z.ZodOptional<z.ZodURL>;
|
|
533
|
+
magic_link_redirect_uris: z.ZodDefault<z.ZodArray<z.ZodURL>>;
|
|
528
534
|
}, z.core.$strip>;
|
|
529
535
|
export type GetSystemConfigResponse = z.infer<typeof GetSystemConfigResponseSchema>;
|
|
530
536
|
export declare const UpdateSystemConfigResponseSchema: z.ZodObject<{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0D7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -7,6 +7,32 @@ export const LoginMethodSchema = z.enum([
|
|
|
7
7
|
'phone_otp',
|
|
8
8
|
'oauth',
|
|
9
9
|
]);
|
|
10
|
+
/**
|
|
11
|
+
* Schemes that must never be a redirect target.
|
|
12
|
+
*
|
|
13
|
+
* `z.url()` accepts anything the URL parser does, which includes
|
|
14
|
+
* `javascript:alert(1)` and `data:text/html,...`. A magic link target is rendered as
|
|
15
|
+
* an href in an email, so one of those stored in config would be a script-execution
|
|
16
|
+
* sink reachable through the admin API. Denied rather than allowlisted because the
|
|
17
|
+
* point of this list is to permit arbitrary application schemes (`myapp://`), which
|
|
18
|
+
* an allowlist of known-good schemes could not express.
|
|
19
|
+
*/
|
|
20
|
+
const DENIED_REDIRECT_PROTOCOLS = new Set([
|
|
21
|
+
'javascript:',
|
|
22
|
+
'data:',
|
|
23
|
+
'vbscript:',
|
|
24
|
+
'file:',
|
|
25
|
+
'blob:',
|
|
26
|
+
'about:',
|
|
27
|
+
]);
|
|
28
|
+
export const RedirectTargetSchema = z.url().refine((value) => {
|
|
29
|
+
try {
|
|
30
|
+
return !DENIED_REDIRECT_PROTOCOLS.has(new URL(value).protocol.toLowerCase());
|
|
31
|
+
}
|
|
32
|
+
catch {
|
|
33
|
+
return false;
|
|
34
|
+
}
|
|
35
|
+
}, { message: 'Redirect target uses a scheme that cannot be a link destination' });
|
|
10
36
|
export const OAuthProviderIdSchema = z.string().regex(/^[a-z0-9-]{2,40}$/);
|
|
11
37
|
export const OAuthProviderConfigSchema = z.object({
|
|
12
38
|
id: OAuthProviderIdSchema,
|
|
@@ -107,10 +133,18 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
107
133
|
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
108
134
|
* own authenticators does not.
|
|
109
135
|
*
|
|
136
|
+
* `allow` is the default because it is the only value under which a stock
|
|
137
|
+
* deployment enrols the passkey a normal device actually offers. Every iCloud
|
|
138
|
+
* Keychain and Google Password Manager credential is multi-device, so
|
|
139
|
+
* defaulting to `block` refuses the common case and makes a first registration
|
|
140
|
+
* fail on hardware the operator has no way to change. An organisation issuing
|
|
141
|
+
* its own authenticators sets `block`, which is a deliberate posture rather
|
|
142
|
+
* than something to be inherited by accident.
|
|
143
|
+
*
|
|
110
144
|
* Judged on backup eligibility rather than current backup state: a credential
|
|
111
145
|
* that *can* sync is the exposure, whether or not it has yet.
|
|
112
146
|
*/
|
|
113
|
-
syncedPasskeys: SyncedPasskeyPolicySchema.default('
|
|
147
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('allow'),
|
|
114
148
|
/**
|
|
115
149
|
* Authenticator models that may register, by AAGUID.
|
|
116
150
|
*
|
|
@@ -129,7 +163,7 @@ export const DefaultAuthenticatorPolicy = {
|
|
|
129
163
|
userVerification: 'required',
|
|
130
164
|
attestation: 'none',
|
|
131
165
|
requireKnownAuthenticator: false,
|
|
132
|
-
syncedPasskeys: '
|
|
166
|
+
syncedPasskeys: 'allow',
|
|
133
167
|
aaguidAllowList: [],
|
|
134
168
|
aaguidDenyList: [],
|
|
135
169
|
};
|
|
@@ -173,6 +207,16 @@ export const SystemConfigSchema = z.object({
|
|
|
173
207
|
rpid: z.string().min(1),
|
|
174
208
|
origins: z.array(z.url()).min(1),
|
|
175
209
|
frontend_url: z.url().optional(),
|
|
210
|
+
/**
|
|
211
|
+
* Exact-match destinations a magic link may be sent to, beyond what `origins`
|
|
212
|
+
* already covers. Empty by default, which leaves the server comparing a requested
|
|
213
|
+
* target against `origins` as it did before this key existed.
|
|
214
|
+
*
|
|
215
|
+
* Exact match rather than origin comparison, because the cases this exists for have
|
|
216
|
+
* no origin to compare: a custom scheme such as `myapp://auth`, or a universal link
|
|
217
|
+
* on a host that should not also be a WebAuthn origin.
|
|
218
|
+
*/
|
|
219
|
+
magic_link_redirect_uris: z.array(RedirectTargetSchema).default([]),
|
|
176
220
|
});
|
|
177
221
|
export const SystemConfigPatchSchema = z
|
|
178
222
|
.object({
|
|
@@ -192,6 +236,7 @@ export const SystemConfigPatchSchema = z
|
|
|
192
236
|
delay_after: SystemConfigSchema.shape.delay_after.optional(),
|
|
193
237
|
rpid: SystemConfigSchema.shape.rpid.optional(),
|
|
194
238
|
origins: SystemConfigSchema.shape.origins.optional(),
|
|
239
|
+
magic_link_redirect_uris: z.array(RedirectTargetSchema).optional(),
|
|
195
240
|
})
|
|
196
241
|
.strict();
|
|
197
242
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -11,6 +11,38 @@ export const LoginMethodSchema = z.enum([
|
|
|
11
11
|
|
|
12
12
|
export type LoginMethod = z.infer<typeof LoginMethodSchema>;
|
|
13
13
|
|
|
14
|
+
/**
|
|
15
|
+
* Schemes that must never be a redirect target.
|
|
16
|
+
*
|
|
17
|
+
* `z.url()` accepts anything the URL parser does, which includes
|
|
18
|
+
* `javascript:alert(1)` and `data:text/html,...`. A magic link target is rendered as
|
|
19
|
+
* an href in an email, so one of those stored in config would be a script-execution
|
|
20
|
+
* sink reachable through the admin API. Denied rather than allowlisted because the
|
|
21
|
+
* point of this list is to permit arbitrary application schemes (`myapp://`), which
|
|
22
|
+
* an allowlist of known-good schemes could not express.
|
|
23
|
+
*/
|
|
24
|
+
const DENIED_REDIRECT_PROTOCOLS = new Set([
|
|
25
|
+
'javascript:',
|
|
26
|
+
'data:',
|
|
27
|
+
'vbscript:',
|
|
28
|
+
'file:',
|
|
29
|
+
'blob:',
|
|
30
|
+
'about:',
|
|
31
|
+
]);
|
|
32
|
+
|
|
33
|
+
export const RedirectTargetSchema = z.url().refine(
|
|
34
|
+
(value) => {
|
|
35
|
+
try {
|
|
36
|
+
return !DENIED_REDIRECT_PROTOCOLS.has(new URL(value).protocol.toLowerCase());
|
|
37
|
+
} catch {
|
|
38
|
+
return false;
|
|
39
|
+
}
|
|
40
|
+
},
|
|
41
|
+
{ message: 'Redirect target uses a scheme that cannot be a link destination' },
|
|
42
|
+
);
|
|
43
|
+
|
|
44
|
+
export type RedirectTarget = z.infer<typeof RedirectTargetSchema>;
|
|
45
|
+
|
|
14
46
|
export const OAuthProviderIdSchema = z.string().regex(/^[a-z0-9-]{2,40}$/);
|
|
15
47
|
|
|
16
48
|
export type OAuthProviderId = z.infer<typeof OAuthProviderIdSchema>;
|
|
@@ -133,10 +165,18 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
133
165
|
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
134
166
|
* own authenticators does not.
|
|
135
167
|
*
|
|
168
|
+
* `allow` is the default because it is the only value under which a stock
|
|
169
|
+
* deployment enrols the passkey a normal device actually offers. Every iCloud
|
|
170
|
+
* Keychain and Google Password Manager credential is multi-device, so
|
|
171
|
+
* defaulting to `block` refuses the common case and makes a first registration
|
|
172
|
+
* fail on hardware the operator has no way to change. An organisation issuing
|
|
173
|
+
* its own authenticators sets `block`, which is a deliberate posture rather
|
|
174
|
+
* than something to be inherited by accident.
|
|
175
|
+
*
|
|
136
176
|
* Judged on backup eligibility rather than current backup state: a credential
|
|
137
177
|
* that *can* sync is the exposure, whether or not it has yet.
|
|
138
178
|
*/
|
|
139
|
-
syncedPasskeys: SyncedPasskeyPolicySchema.default('
|
|
179
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('allow'),
|
|
140
180
|
/**
|
|
141
181
|
* Authenticator models that may register, by AAGUID.
|
|
142
182
|
*
|
|
@@ -158,7 +198,7 @@ export const DefaultAuthenticatorPolicy = {
|
|
|
158
198
|
userVerification: 'required',
|
|
159
199
|
attestation: 'none',
|
|
160
200
|
requireKnownAuthenticator: false,
|
|
161
|
-
syncedPasskeys: '
|
|
201
|
+
syncedPasskeys: 'allow',
|
|
162
202
|
aaguidAllowList: [],
|
|
163
203
|
aaguidDenyList: [],
|
|
164
204
|
} as const;
|
|
@@ -212,6 +252,17 @@ export const SystemConfigSchema = z.object({
|
|
|
212
252
|
origins: z.array(z.url()).min(1),
|
|
213
253
|
|
|
214
254
|
frontend_url: z.url().optional(),
|
|
255
|
+
|
|
256
|
+
/**
|
|
257
|
+
* Exact-match destinations a magic link may be sent to, beyond what `origins`
|
|
258
|
+
* already covers. Empty by default, which leaves the server comparing a requested
|
|
259
|
+
* target against `origins` as it did before this key existed.
|
|
260
|
+
*
|
|
261
|
+
* Exact match rather than origin comparison, because the cases this exists for have
|
|
262
|
+
* no origin to compare: a custom scheme such as `myapp://auth`, or a universal link
|
|
263
|
+
* on a host that should not also be a WebAuthn origin.
|
|
264
|
+
*/
|
|
265
|
+
magic_link_redirect_uris: z.array(RedirectTargetSchema).default([]),
|
|
215
266
|
});
|
|
216
267
|
|
|
217
268
|
export type SystemConfig = z.infer<typeof SystemConfigSchema>;
|
|
@@ -235,6 +286,7 @@ export const SystemConfigPatchSchema = z
|
|
|
235
286
|
delay_after: SystemConfigSchema.shape.delay_after.optional(),
|
|
236
287
|
rpid: SystemConfigSchema.shape.rpid.optional(),
|
|
237
288
|
origins: SystemConfigSchema.shape.origins.optional(),
|
|
289
|
+
magic_link_redirect_uris: z.array(RedirectTargetSchema).optional(),
|
|
238
290
|
})
|
|
239
291
|
.strict();
|
|
240
292
|
|