@seamless-auth/types 0.18.0 → 0.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +53 -0
- package/dist/schemas/oauth/schema.d.ts +1 -0
- package/dist/schemas/oauth/schema.d.ts.map +1 -1
- package/dist/schemas/oauth/schema.js +13 -2
- package/dist/schemas/oauth/schema.js.map +1 -1
- package/dist/schemas/systemConfig/schema.d.ts +1 -1
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +10 -2
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/dist/schemas/webauthn/schema.d.ts +2 -2
- package/package.json +2 -2
- package/src/schemas/oauth/schema.ts +13 -2
- package/src/schemas/systemConfig/schema.ts +10 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,58 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.20.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 9541d01: Carry `returnTo` back out of the OAuth callback, and hold it to a scheme that can be a
|
|
8
|
+
link destination.
|
|
9
|
+
|
|
10
|
+
`StartOAuthLoginRequestSchema` has taken a `returnTo` since OAuth landed, and nothing ever
|
|
11
|
+
gave it back. `seamless-auth-api` validated it against the configured origins and signed it
|
|
12
|
+
into the state, and `seamless-auth-react` sent it, but no schema carried it to the end of the
|
|
13
|
+
flow, so a client that asked to be returned somewhere had no way to learn where. It was a
|
|
14
|
+
field that looked supported and did nothing.
|
|
15
|
+
|
|
16
|
+
`OAuthLoginSuccessResponseSchema` now carries an optional `returnTo`. The API reads it back
|
|
17
|
+
out of the signed state rather than from the callback request, so it is the value validated
|
|
18
|
+
at `/start` and not one introduced at the end of the round trip. Absent when the caller asked
|
|
19
|
+
for nothing, so a client falls through to its own default rather than treating absence as an
|
|
20
|
+
error.
|
|
21
|
+
|
|
22
|
+
Both `returnTo` fields move from `z.url()` to `RedirectTargetSchema`. `z.url()` accepts
|
|
23
|
+
`javascript:alert(1)` and `data:text/html,...`, and a client navigates to whatever comes back
|
|
24
|
+
out of this flow, so it is the same sink a magic link destination is. That is what
|
|
25
|
+
`RedirectTargetSchema` was added for in 0.18.0, and the OAuth fields should have used it
|
|
26
|
+
then.
|
|
27
|
+
|
|
28
|
+
Additive for a consumer that ignores the new field. A caller that was somehow sending a
|
|
29
|
+
`javascript:` or `data:` `returnTo` is now refused at the schema rather than later, which is
|
|
30
|
+
the intended change.
|
|
31
|
+
|
|
32
|
+
## 0.19.0
|
|
33
|
+
|
|
34
|
+
### Minor Changes
|
|
35
|
+
|
|
36
|
+
- 7390df6: Default `authenticator_policy.syncedPasskeys` to `allow`.
|
|
37
|
+
|
|
38
|
+
This reverses the default introduced in 0.15.0. `block` refuses any credential
|
|
39
|
+
that is backup eligible, and every iCloud Keychain and Google Password Manager
|
|
40
|
+
passkey is, so a stock deployment refused the passkey a normal laptop or phone
|
|
41
|
+
actually offers. The first registration failed on hardware the operator had no
|
|
42
|
+
way to change, which is not a posture anyone should inherit by accident.
|
|
43
|
+
|
|
44
|
+
A deployment issuing its own authenticators still sets `block`, and it now reads
|
|
45
|
+
as the deliberate choice it is:
|
|
46
|
+
|
|
47
|
+
```json
|
|
48
|
+
{ "syncedPasskeys": "block" }
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
Nothing else changes. The judgement is still made on backup eligibility rather
|
|
52
|
+
than current backup state, the refusal is still
|
|
53
|
+
`403 { "error": "synced_passkey_not_allowed" }`, and a policy that names the
|
|
54
|
+
field keeps whatever it names. Only an omitted field resolves differently.
|
|
55
|
+
|
|
3
56
|
## 0.18.0
|
|
4
57
|
|
|
5
58
|
### Minor Changes
|
|
@@ -49,6 +49,7 @@ export declare const OAuthLoginSuccessResponseSchema: z.ZodObject<{
|
|
|
49
49
|
refreshToken: z.ZodOptional<z.ZodString>;
|
|
50
50
|
organizationId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
51
51
|
refreshTtl: z.ZodOptional<z.ZodNumber>;
|
|
52
|
+
returnTo: z.ZodOptional<z.ZodURL>;
|
|
52
53
|
}, z.core.$strip>;
|
|
53
54
|
export type OAuthLoginSuccessResponse = z.infer<typeof OAuthLoginSuccessResponseSchema>;
|
|
54
55
|
export declare const OAUTH_ERROR_CODES: readonly ["oauth_missing_email", "oauth_email_not_verified", "oauth_missing_subject"];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;iBAa1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,uFAIpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { RefreshSuccessResponseSchema } from '../auth/auth.schema.js';
|
|
3
|
-
import { OAuthProviderIdSchema } from '../systemConfig/schema.js';
|
|
3
|
+
import { OAuthProviderIdSchema, RedirectTargetSchema } from '../systemConfig/schema.js';
|
|
4
4
|
export const OAuthProviderParamSchema = z.object({
|
|
5
5
|
providerId: OAuthProviderIdSchema,
|
|
6
6
|
});
|
|
@@ -15,7 +15,7 @@ export const OAuthProvidersResponseSchema = z.object({
|
|
|
15
15
|
});
|
|
16
16
|
export const StartOAuthLoginRequestSchema = z.object({
|
|
17
17
|
redirectUri: z.url().optional(),
|
|
18
|
-
returnTo:
|
|
18
|
+
returnTo: RedirectTargetSchema.optional(),
|
|
19
19
|
});
|
|
20
20
|
export const StartOAuthLoginResponseSchema = z.object({
|
|
21
21
|
provider: PublicOAuthProviderSchema,
|
|
@@ -28,6 +28,17 @@ export const FinishOAuthLoginRequestSchema = z.object({
|
|
|
28
28
|
});
|
|
29
29
|
export const OAuthLoginSuccessResponseSchema = RefreshSuccessResponseSchema.omit({
|
|
30
30
|
sessionId: true,
|
|
31
|
+
}).extend({
|
|
32
|
+
/**
|
|
33
|
+
* Where the caller asked to be sent once the flow completes.
|
|
34
|
+
*
|
|
35
|
+
* Read back out of the signed state rather than from the callback request, so it is
|
|
36
|
+
* the value the authorization server accepted at `/start` and not one introduced at
|
|
37
|
+
* the end of the round trip. Present only when the caller supplied one and it passed
|
|
38
|
+
* validation there, so a client treats absence as "use my own default" rather than
|
|
39
|
+
* as an error.
|
|
40
|
+
*/
|
|
41
|
+
returnTo: RedirectTargetSchema.optional(),
|
|
31
42
|
});
|
|
32
43
|
export const OAUTH_ERROR_CODES = [
|
|
33
44
|
'oauth_missing_email',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAExF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR;;;;;;;;OAQG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
|
|
@@ -108,7 +108,7 @@ export declare const DefaultAuthenticatorPolicy: {
|
|
|
108
108
|
readonly userVerification: "required";
|
|
109
109
|
readonly attestation: "none";
|
|
110
110
|
readonly requireKnownAuthenticator: false;
|
|
111
|
-
readonly syncedPasskeys: "
|
|
111
|
+
readonly syncedPasskeys: "allow";
|
|
112
112
|
readonly aaguidAllowList: readonly [];
|
|
113
113
|
readonly aaguidDenyList: readonly [];
|
|
114
114
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0D7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -133,10 +133,18 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
133
133
|
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
134
134
|
* own authenticators does not.
|
|
135
135
|
*
|
|
136
|
+
* `allow` is the default because it is the only value under which a stock
|
|
137
|
+
* deployment enrols the passkey a normal device actually offers. Every iCloud
|
|
138
|
+
* Keychain and Google Password Manager credential is multi-device, so
|
|
139
|
+
* defaulting to `block` refuses the common case and makes a first registration
|
|
140
|
+
* fail on hardware the operator has no way to change. An organisation issuing
|
|
141
|
+
* its own authenticators sets `block`, which is a deliberate posture rather
|
|
142
|
+
* than something to be inherited by accident.
|
|
143
|
+
*
|
|
136
144
|
* Judged on backup eligibility rather than current backup state: a credential
|
|
137
145
|
* that *can* sync is the exposure, whether or not it has yet.
|
|
138
146
|
*/
|
|
139
|
-
syncedPasskeys: SyncedPasskeyPolicySchema.default('
|
|
147
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('allow'),
|
|
140
148
|
/**
|
|
141
149
|
* Authenticator models that may register, by AAGUID.
|
|
142
150
|
*
|
|
@@ -155,7 +163,7 @@ export const DefaultAuthenticatorPolicy = {
|
|
|
155
163
|
userVerification: 'required',
|
|
156
164
|
attestation: 'none',
|
|
157
165
|
requireKnownAuthenticator: false,
|
|
158
|
-
syncedPasskeys: '
|
|
166
|
+
syncedPasskeys: 'allow',
|
|
159
167
|
aaguidAllowList: [],
|
|
160
168
|
aaguidDenyList: [],
|
|
161
169
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
|
@@ -9,8 +9,8 @@ export declare const WebAuthnPrfRequestSchema: z.ZodObject<{
|
|
|
9
9
|
}, z.core.$strip>;
|
|
10
10
|
export type WebAuthnPrfRequest = z.infer<typeof WebAuthnPrfRequestSchema>;
|
|
11
11
|
export declare const WebAuthnRegisterStartQuerySchema: z.ZodObject<{
|
|
12
|
-
requestPrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean
|
|
13
|
-
requirePrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean
|
|
12
|
+
requestPrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean>, unknown>;
|
|
13
|
+
requirePrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean>, unknown>;
|
|
14
14
|
}, z.core.$strip>;
|
|
15
15
|
export type WebAuthnRegisterStartQuery = z.infer<typeof WebAuthnRegisterStartQuerySchema>;
|
|
16
16
|
export declare const WebAuthnAssertionStartSchema: z.ZodDefault<z.ZodObject<{
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@seamless-auth/types",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.20.0",
|
|
4
4
|
"description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
|
|
5
5
|
"author": "Fells Code, LLC",
|
|
6
6
|
"license": "AGPL-3.0-only",
|
|
@@ -78,7 +78,7 @@
|
|
|
78
78
|
"zod": "^4.3.6"
|
|
79
79
|
},
|
|
80
80
|
"devDependencies": {
|
|
81
|
-
"@changesets/cli": "^
|
|
81
|
+
"@changesets/cli": "^3.0.2",
|
|
82
82
|
"@commitlint/cli": "^21.2.1",
|
|
83
83
|
"@commitlint/config-conventional": "^21.2.0",
|
|
84
84
|
"@typescript-eslint/eslint-plugin": "^8.57.2",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { RefreshSuccessResponseSchema } from '../auth/auth.schema.js';
|
|
3
|
-
import { OAuthProviderIdSchema } from '../systemConfig/schema.js';
|
|
3
|
+
import { OAuthProviderIdSchema, RedirectTargetSchema } from '../systemConfig/schema.js';
|
|
4
4
|
|
|
5
5
|
export const OAuthProviderParamSchema = z.object({
|
|
6
6
|
providerId: OAuthProviderIdSchema,
|
|
@@ -25,7 +25,7 @@ export type OAuthProvidersResponse = z.infer<typeof OAuthProvidersResponseSchema
|
|
|
25
25
|
|
|
26
26
|
export const StartOAuthLoginRequestSchema = z.object({
|
|
27
27
|
redirectUri: z.url().optional(),
|
|
28
|
-
returnTo:
|
|
28
|
+
returnTo: RedirectTargetSchema.optional(),
|
|
29
29
|
});
|
|
30
30
|
|
|
31
31
|
export type StartOAuthLoginRequest = z.infer<typeof StartOAuthLoginRequestSchema>;
|
|
@@ -47,6 +47,17 @@ export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSche
|
|
|
47
47
|
|
|
48
48
|
export const OAuthLoginSuccessResponseSchema = RefreshSuccessResponseSchema.omit({
|
|
49
49
|
sessionId: true,
|
|
50
|
+
}).extend({
|
|
51
|
+
/**
|
|
52
|
+
* Where the caller asked to be sent once the flow completes.
|
|
53
|
+
*
|
|
54
|
+
* Read back out of the signed state rather than from the callback request, so it is
|
|
55
|
+
* the value the authorization server accepted at `/start` and not one introduced at
|
|
56
|
+
* the end of the round trip. Present only when the caller supplied one and it passed
|
|
57
|
+
* validation there, so a client treats absence as "use my own default" rather than
|
|
58
|
+
* as an error.
|
|
59
|
+
*/
|
|
60
|
+
returnTo: RedirectTargetSchema.optional(),
|
|
50
61
|
});
|
|
51
62
|
|
|
52
63
|
export type OAuthLoginSuccessResponse = z.infer<typeof OAuthLoginSuccessResponseSchema>;
|
|
@@ -165,10 +165,18 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
165
165
|
* exactly what a consumer wants and exactly what an organisation issuing its
|
|
166
166
|
* own authenticators does not.
|
|
167
167
|
*
|
|
168
|
+
* `allow` is the default because it is the only value under which a stock
|
|
169
|
+
* deployment enrols the passkey a normal device actually offers. Every iCloud
|
|
170
|
+
* Keychain and Google Password Manager credential is multi-device, so
|
|
171
|
+
* defaulting to `block` refuses the common case and makes a first registration
|
|
172
|
+
* fail on hardware the operator has no way to change. An organisation issuing
|
|
173
|
+
* its own authenticators sets `block`, which is a deliberate posture rather
|
|
174
|
+
* than something to be inherited by accident.
|
|
175
|
+
*
|
|
168
176
|
* Judged on backup eligibility rather than current backup state: a credential
|
|
169
177
|
* that *can* sync is the exposure, whether or not it has yet.
|
|
170
178
|
*/
|
|
171
|
-
syncedPasskeys: SyncedPasskeyPolicySchema.default('
|
|
179
|
+
syncedPasskeys: SyncedPasskeyPolicySchema.default('allow'),
|
|
172
180
|
/**
|
|
173
181
|
* Authenticator models that may register, by AAGUID.
|
|
174
182
|
*
|
|
@@ -190,7 +198,7 @@ export const DefaultAuthenticatorPolicy = {
|
|
|
190
198
|
userVerification: 'required',
|
|
191
199
|
attestation: 'none',
|
|
192
200
|
requireKnownAuthenticator: false,
|
|
193
|
-
syncedPasskeys: '
|
|
201
|
+
syncedPasskeys: 'allow',
|
|
194
202
|
aaguidAllowList: [],
|
|
195
203
|
aaguidDenyList: [],
|
|
196
204
|
} as const;
|