@seamless-auth/types 0.20.0 → 0.22.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/CHANGELOG.md +40 -0
  2. package/dist/schemas/admin/schema.d.ts +10 -0
  3. package/dist/schemas/admin/schema.d.ts.map +1 -1
  4. package/dist/schemas/authEvent/schema.d.ts +10 -0
  5. package/dist/schemas/authEvent/schema.d.ts.map +1 -1
  6. package/dist/schemas/authEvent/schema.js +29 -0
  7. package/dist/schemas/authEvent/schema.js.map +1 -1
  8. package/dist/schemas/metrics/schema.d.ts +10 -0
  9. package/dist/schemas/metrics/schema.d.ts.map +1 -1
  10. package/dist/schemas/systemConfig/schema.d.ts +107 -0
  11. package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
  12. package/dist/schemas/systemConfig/schema.js +59 -0
  13. package/dist/schemas/systemConfig/schema.js.map +1 -1
  14. package/package.json +1 -1
  15. package/src/schemas/authEvent/schema.ts +29 -0
  16. package/src/schemas/systemConfig/schema.ts +64 -0
package/CHANGELOG.md CHANGED
@@ -1,5 +1,45 @@
1
1
  # @seamless-auth/types
2
2
 
3
+ ## 0.22.0
4
+
5
+ ### Minor Changes
6
+
7
+ - c934d8f: Add `flow_rate_limits` to the system config, and pin the Android WebAuthn origin form.
8
+
9
+ `seamless-auth-api` limits how often one caller may start an OTP, magic link, or OAuth flow, on
10
+ top of the general `rate_limit`, with constants fixed in code: 10 OTP sends and 20 magic links per
11
+ IP per 15 minutes, 5 per address, 30 OAuth starts per IP and 10 per provider. Those are fine for a
12
+ web audience and wrong for a mobile one, because carriers put thousands of subscribers behind one
13
+ address. `flow_rate_limits` is an object key (`windowSeconds`, `otp.perIp`, `otp.perIdentity`,
14
+ `magicLink.perIp`, `magicLink.perIdentity`, `oauth.perIp`, `oauth.perProvider`) whose defaults
15
+ are exactly those constants, so a deployment that sets nothing behaves as it did, and a partial
16
+ value fills the flows it leaves out. `FlowRateLimitsSchema`, `FlowRateLimits` and
17
+ `DefaultFlowRateLimits` are exported; the patch schema accepts the key.
18
+
19
+ `origins` gains a test and a comment for the form Android reports, `android:apk-key-hash:<base64url>`,
20
+ which `z.url()` accepts as an opaque URL. It has to keep accepting it for native passkeys to
21
+ verify, and nothing said so until now.
22
+
23
+ Part of the mobile track, fells-code/seamless-templates#40.
24
+
25
+ ## 0.21.0
26
+
27
+ ### Minor Changes
28
+
29
+ - 395e2a1: Carry the telemetry dimensions `seamless-auth-api` now records on every auth event.
30
+
31
+ `AuthEventSchema` gains `deployment_id`, `device_class`, `mail_provider`, `owner` and
32
+ `attempt_id`, all optional and nullable. The API writes them on every `auth_events` row
33
+ (fells-code/seamless-auth-api#306): which deployment wrote the row, the platform family the
34
+ user agent folds into, the subject's mail provider (a provider name, never the domain), whether
35
+ the subject is a configured owner, and the sign-in attempt the row belongs to (the ephemeral
36
+ token's `jti`).
37
+
38
+ Until now the schema stripped them from `GET /admin/auth-events`, since it is a plain object
39
+ schema, so a dashboard could not show which device or attempt an event came from. The two
40
+ classifications stay plain strings rather than enums for the same reason `type` does: a newer
41
+ server may add a class an older consumer has not heard of, and a stored event must still parse.
42
+
3
43
  ## 0.20.0
4
44
 
5
45
  ### Minor Changes
package/dist/schemas/admin/schema.d.ts CHANGED
@@ -116,6 +116,11 @@ export declare const AdminUserDetailResponseSchema: z.ZodObject<{
116
116
  type: z.ZodString;
117
117
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
118
118
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
119
+ deployment_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
120
+ device_class: z.ZodOptional<z.ZodNullable<z.ZodString>>;
121
+ mail_provider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
122
+ owner: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
123
+ attempt_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
119
124
  metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
120
125
  created_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
121
126
  updated_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
@@ -131,6 +136,11 @@ export declare const AdminUserAnomaliesResponseSchema: z.ZodObject<{
131
136
  type: z.ZodString;
132
137
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
133
138
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
139
+ deployment_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
140
+ device_class: z.ZodOptional<z.ZodNullable<z.ZodString>>;
141
+ mail_provider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
142
+ owner: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
143
+ attempt_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
134
144
  metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
135
145
  created_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
136
146
  updated_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
package/dist/schemas/admin/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
package/dist/schemas/authEvent/schema.d.ts CHANGED
@@ -85,6 +85,11 @@ export declare const AuthEventSchema: z.ZodObject<{
85
85
  type: z.ZodString;
86
86
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
87
87
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
88
+ deployment_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
89
+ device_class: z.ZodOptional<z.ZodNullable<z.ZodString>>;
90
+ mail_provider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
91
+ owner: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
92
+ attempt_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
88
93
  metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
89
94
  created_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
90
95
  updated_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
@@ -260,6 +265,11 @@ export declare const AuthEventsResponseSchema: z.ZodObject<{
260
265
  type: z.ZodString;
261
266
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
262
267
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
268
+ deployment_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
269
+ device_class: z.ZodOptional<z.ZodNullable<z.ZodString>>;
270
+ mail_provider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
271
+ owner: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
272
+ attempt_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
263
273
  metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
264
274
  created_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
265
275
  updated_at: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
package/dist/schemas/authEvent/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,gBAAgB,gqDA2EnB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA2B,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe;;;;;;;;;;;iBAyB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,gBAAgB,gqDA2EnB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA2B,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;iBAsD1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
package/dist/schemas/authEvent/schema.js CHANGED
@@ -101,6 +101,35 @@ export const AuthEventSchema = z.object({
101
101
  type: z.string(),
102
102
  ip_address: z.string().nullable().optional(),
103
103
  user_agent: z.string().nullable().optional(),
104
+ /**
105
+ * Which deployment wrote the row (the server's `APP_ID`), so rows collected
106
+ * across a fleet stay attributable. Null on rows written before the column
107
+ * existed.
108
+ */
109
+ deployment_id: z.string().nullable().optional(),
110
+ /**
111
+ * The platform family the user agent folds into: `ios`, `android`, `macos`,
112
+ * `windows`, `linux`, `chromeos`, `bot` or `unknown`. A plain string rather
113
+ * than an enum for the same reason `type` is: a newer server may add a class
114
+ * an older consumer has not heard of.
115
+ */
116
+ device_class: z.string().nullable().optional(),
117
+ /**
118
+ * The subject's mail provider (`gmail`, `outlook`, `other`, ...), never the
119
+ * domain. Null when the row does not know who the subject is.
120
+ */
121
+ mail_provider: z.string().nullable().optional(),
122
+ /**
123
+ * Whether the subject is a configured owner of the deployment. Null when the
124
+ * subject is unknown, which is different from a known non-owner.
125
+ */
126
+ owner: z.boolean().nullable().optional(),
127
+ /**
128
+ * The sign-in or registration attempt the row belongs to: the ephemeral
129
+ * token's `jti`. Every step taken on one token carries the same id. Null on
130
+ * rows written from an access session and on rows older than the claim.
131
+ */
132
+ attempt_id: z.string().nullable().optional(),
104
133
  metadata: z.record(z.string(), z.unknown()).nullable(),
105
134
  created_at: IsoDate,
106
135
  updated_at: IsoDate,
package/dist/schemas/authEvent/schema.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mCAAmC;IACnC,uBAAuB;IACvB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,eAAe;IACf,gCAAgC;IAChC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;IACxC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,8BAA8B;IAC9B,+BAA+B;IAC/B,kCAAkC;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAI1D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0DAA0D;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mCAAmC;IACnC,uBAAuB;IACvB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,eAAe;IACf,gCAAgC;IAChC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;IACxC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,8BAA8B;IAC9B,+BAA+B;IAC/B,kCAAkC;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAI1D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0DAA0D;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
package/dist/schemas/metrics/schema.d.ts CHANGED
@@ -58,6 +58,11 @@ export declare const PartialAuthEventSchema: z.ZodObject<{
58
58
  type: z.ZodOptional<z.ZodString>;
59
59
  ip_address: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
60
60
  user_agent: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
61
+ deployment_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
62
+ device_class: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
63
+ mail_provider: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
64
+ owner: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodBoolean>>>;
65
+ attempt_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
61
66
  metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
62
67
  created_at: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
63
68
  updated_at: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
@@ -72,6 +77,11 @@ export declare const SecurityAnomaliesResponseSchema: z.ZodObject<{
72
77
  type: z.ZodOptional<z.ZodString>;
73
78
  ip_address: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
74
79
  user_agent: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
80
+ deployment_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
81
+ device_class: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
82
+ mail_provider: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
83
+ owner: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodBoolean>>>;
84
+ attempt_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
75
85
  metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
76
86
  created_at: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
77
87
  updated_at: z.ZodOptional<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
package/dist/schemas/metrics/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;iBAG1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAUzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;iBAG1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAUzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
package/dist/schemas/systemConfig/schema.d.ts CHANGED
@@ -49,6 +49,53 @@ export declare const DefaultLockoutPolicy: {
49
49
  readonly windowSeconds: number;
50
50
  readonly lockoutSeconds: number;
51
51
  };
52
+ /**
53
+ * How many times one caller may start a message-carrying or provider flow per
54
+ * window, before the general `rate_limit` applies to everything else.
55
+ *
56
+ * Two keys per flow because they guard different things. `perIdentity` bounds
57
+ * how often one address or phone can be messaged, which is the abuse a sender
58
+ * cares about. `perIp` bounds how many distinct addresses one network location
59
+ * can drive, which is the enumeration and spam guard. The per-IP values were
60
+ * fixed constants before this key existed, and those constants are the defaults
61
+ * here, so a deployment that sets nothing behaves as it did.
62
+ *
63
+ * Per-IP limits are the ones a native app runs into first. Mobile carriers put
64
+ * thousands of subscribers behind one address, so a value that never troubles a
65
+ * web audience can refuse a mobile audience at modest scale. Raise `perIp` for a
66
+ * deployment that serves phones; leave `perIdentity` where it is.
67
+ */
68
+ export declare const FlowRateLimitsSchema: z.ZodObject<{
69
+ windowSeconds: z.ZodDefault<z.ZodNumber>;
70
+ otp: z.ZodDefault<z.ZodObject<{
71
+ perIp: z.ZodDefault<z.ZodNumber>;
72
+ perIdentity: z.ZodDefault<z.ZodNumber>;
73
+ }, z.core.$strip>>;
74
+ magicLink: z.ZodDefault<z.ZodObject<{
75
+ perIp: z.ZodDefault<z.ZodNumber>;
76
+ perIdentity: z.ZodDefault<z.ZodNumber>;
77
+ }, z.core.$strip>>;
78
+ oauth: z.ZodDefault<z.ZodObject<{
79
+ perIp: z.ZodDefault<z.ZodNumber>;
80
+ perProvider: z.ZodDefault<z.ZodNumber>;
81
+ }, z.core.$strip>>;
82
+ }, z.core.$strip>;
83
+ export type FlowRateLimits = z.infer<typeof FlowRateLimitsSchema>;
84
+ export declare const DefaultFlowRateLimits: {
85
+ readonly windowSeconds: number;
86
+ readonly otp: {
87
+ readonly perIp: 10;
88
+ readonly perIdentity: 5;
89
+ };
90
+ readonly magicLink: {
91
+ readonly perIp: 20;
92
+ readonly perIdentity: 5;
93
+ };
94
+ readonly oauth: {
95
+ readonly perIp: 30;
96
+ readonly perProvider: 10;
97
+ };
98
+ };
52
99
  export declare const AuthenticatorAttachmentPolicySchema: z.ZodEnum<{
53
100
  "cross-platform": "cross-platform";
54
101
  platform: "platform";
@@ -183,6 +230,21 @@ export declare const SystemConfigSchema: z.ZodObject<{
183
230
  max_concurrent_sessions: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
184
231
  rate_limit: z.ZodNumber;
185
232
  delay_after: z.ZodNumber;
233
+ flow_rate_limits: z.ZodDefault<z.ZodObject<{
234
+ windowSeconds: z.ZodDefault<z.ZodNumber>;
235
+ otp: z.ZodDefault<z.ZodObject<{
236
+ perIp: z.ZodDefault<z.ZodNumber>;
237
+ perIdentity: z.ZodDefault<z.ZodNumber>;
238
+ }, z.core.$strip>>;
239
+ magicLink: z.ZodDefault<z.ZodObject<{
240
+ perIp: z.ZodDefault<z.ZodNumber>;
241
+ perIdentity: z.ZodDefault<z.ZodNumber>;
242
+ }, z.core.$strip>>;
243
+ oauth: z.ZodDefault<z.ZodObject<{
244
+ perIp: z.ZodDefault<z.ZodNumber>;
245
+ perProvider: z.ZodDefault<z.ZodNumber>;
246
+ }, z.core.$strip>>;
247
+ }, z.core.$strip>>;
186
248
  rpid: z.ZodString;
187
249
  origins: z.ZodArray<z.ZodURL>;
188
250
  frontend_url: z.ZodOptional<z.ZodURL>;
@@ -260,6 +322,21 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
260
322
  max_concurrent_sessions: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
261
323
  rate_limit: z.ZodOptional<z.ZodNumber>;
262
324
  delay_after: z.ZodOptional<z.ZodNumber>;
325
+ flow_rate_limits: z.ZodOptional<z.ZodObject<{
326
+ windowSeconds: z.ZodDefault<z.ZodNumber>;
327
+ otp: z.ZodDefault<z.ZodObject<{
328
+ perIp: z.ZodDefault<z.ZodNumber>;
329
+ perIdentity: z.ZodDefault<z.ZodNumber>;
330
+ }, z.core.$strip>>;
331
+ magicLink: z.ZodDefault<z.ZodObject<{
332
+ perIp: z.ZodDefault<z.ZodNumber>;
333
+ perIdentity: z.ZodDefault<z.ZodNumber>;
334
+ }, z.core.$strip>>;
335
+ oauth: z.ZodDefault<z.ZodObject<{
336
+ perIp: z.ZodDefault<z.ZodNumber>;
337
+ perProvider: z.ZodDefault<z.ZodNumber>;
338
+ }, z.core.$strip>>;
339
+ }, z.core.$strip>>;
263
340
  rpid: z.ZodOptional<z.ZodString>;
264
341
  origins: z.ZodOptional<z.ZodArray<z.ZodURL>>;
265
342
  magic_link_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
@@ -340,6 +417,21 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
340
417
  max_concurrent_sessions: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
341
418
  rate_limit: z.ZodOptional<z.ZodNumber>;
342
419
  delay_after: z.ZodOptional<z.ZodNumber>;
420
+ flow_rate_limits: z.ZodOptional<z.ZodObject<{
421
+ windowSeconds: z.ZodDefault<z.ZodNumber>;
422
+ otp: z.ZodDefault<z.ZodObject<{
423
+ perIp: z.ZodDefault<z.ZodNumber>;
424
+ perIdentity: z.ZodDefault<z.ZodNumber>;
425
+ }, z.core.$strip>>;
426
+ magicLink: z.ZodDefault<z.ZodObject<{
427
+ perIp: z.ZodDefault<z.ZodNumber>;
428
+ perIdentity: z.ZodDefault<z.ZodNumber>;
429
+ }, z.core.$strip>>;
430
+ oauth: z.ZodDefault<z.ZodObject<{
431
+ perIp: z.ZodDefault<z.ZodNumber>;
432
+ perProvider: z.ZodDefault<z.ZodNumber>;
433
+ }, z.core.$strip>>;
434
+ }, z.core.$strip>>;
343
435
  rpid: z.ZodOptional<z.ZodString>;
344
436
  origins: z.ZodOptional<z.ZodArray<z.ZodURL>>;
345
437
  magic_link_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
@@ -527,6 +619,21 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
527
619
  max_concurrent_sessions: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
528
620
  rate_limit: z.ZodNumber;
529
621
  delay_after: z.ZodNumber;
622
+ flow_rate_limits: z.ZodDefault<z.ZodObject<{
623
+ windowSeconds: z.ZodDefault<z.ZodNumber>;
624
+ otp: z.ZodDefault<z.ZodObject<{
625
+ perIp: z.ZodDefault<z.ZodNumber>;
626
+ perIdentity: z.ZodDefault<z.ZodNumber>;
627
+ }, z.core.$strip>>;
628
+ magicLink: z.ZodDefault<z.ZodObject<{
629
+ perIp: z.ZodDefault<z.ZodNumber>;
630
+ perIdentity: z.ZodDefault<z.ZodNumber>;
631
+ }, z.core.$strip>>;
632
+ oauth: z.ZodDefault<z.ZodObject<{
633
+ perIp: z.ZodDefault<z.ZodNumber>;
634
+ perProvider: z.ZodDefault<z.ZodNumber>;
635
+ }, z.core.$strip>>;
636
+ }, z.core.$strip>>;
530
637
  rpid: z.ZodString;
531
638
  origins: z.ZodArray<z.ZodURL>;
532
639
  frontend_url: z.ZodOptional<z.ZodURL>;
package/dist/schemas/systemConfig/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0D7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAIX;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAwB/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;CAKxB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoE7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
package/dist/schemas/systemConfig/schema.js CHANGED
@@ -77,6 +77,54 @@ export const DefaultLockoutPolicy = {
77
77
  windowSeconds: 15 * 60,
78
78
  lockoutSeconds: 15 * 60,
79
79
  };
80
+ const PerIpLimitSchema = z.number().int().positive();
81
+ /**
82
+ * How many times one caller may start a message-carrying or provider flow per
83
+ * window, before the general `rate_limit` applies to everything else.
84
+ *
85
+ * Two keys per flow because they guard different things. `perIdentity` bounds
86
+ * how often one address or phone can be messaged, which is the abuse a sender
87
+ * cares about. `perIp` bounds how many distinct addresses one network location
88
+ * can drive, which is the enumeration and spam guard. The per-IP values were
89
+ * fixed constants before this key existed, and those constants are the defaults
90
+ * here, so a deployment that sets nothing behaves as it did.
91
+ *
92
+ * Per-IP limits are the ones a native app runs into first. Mobile carriers put
93
+ * thousands of subscribers behind one address, so a value that never troubles a
94
+ * web audience can refuse a mobile audience at modest scale. Raise `perIp` for a
95
+ * deployment that serves phones; leave `perIdentity` where it is.
96
+ */
97
+ export const FlowRateLimitsSchema = z.object({
98
+ windowSeconds: z
99
+ .number()
100
+ .int()
101
+ .positive()
102
+ .default(15 * 60),
103
+ otp: z
104
+ .object({
105
+ perIp: PerIpLimitSchema.default(10),
106
+ perIdentity: PerIpLimitSchema.default(5),
107
+ })
108
+ .default({ perIp: 10, perIdentity: 5 }),
109
+ magicLink: z
110
+ .object({
111
+ perIp: PerIpLimitSchema.default(20),
112
+ perIdentity: PerIpLimitSchema.default(5),
113
+ })
114
+ .default({ perIp: 20, perIdentity: 5 }),
115
+ oauth: z
116
+ .object({
117
+ perIp: PerIpLimitSchema.default(30),
118
+ perProvider: PerIpLimitSchema.default(10),
119
+ })
120
+ .default({ perIp: 30, perProvider: 10 }),
121
+ });
122
+ export const DefaultFlowRateLimits = {
123
+ windowSeconds: 15 * 60,
124
+ otp: { perIp: 10, perIdentity: 5 },
125
+ magicLink: { perIp: 20, perIdentity: 5 },
126
+ oauth: { perIp: 30, perProvider: 10 },
127
+ };
80
128
  export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'cross-platform']);
81
129
  /**
82
130
  * Which authenticators a deployment will enrol.
@@ -204,7 +252,17 @@ export const SystemConfigSchema = z.object({
204
252
  max_concurrent_sessions: z.number().int().positive().nullable().default(null),
205
253
  rate_limit: z.number().int().positive(),
206
254
  delay_after: z.number().int().nonnegative(),
255
+ flow_rate_limits: FlowRateLimitsSchema.default(DefaultFlowRateLimits),
207
256
  rpid: z.string().min(1),
257
+ /**
258
+ * The WebAuthn origins this deployment accepts, and the fallback for the magic
259
+ * link and OAuth destinations (`origins[0]`), so the web origin belongs first.
260
+ *
261
+ * `z.url()` here is deliberately loose. An Android app's WebAuthn origin is
262
+ * `android:apk-key-hash:<base64url>`, which is a valid URL with an opaque path
263
+ * and no host, and it must be accepted here for native passkeys to verify. Do
264
+ * not tighten this to a hostname check without carrying that form along.
265
+ */
208
266
  origins: z.array(z.url()).min(1),
209
267
  frontend_url: z.url().optional(),
210
268
  /**
@@ -234,6 +292,7 @@ export const SystemConfigPatchSchema = z
234
292
  max_concurrent_sessions: z.number().int().positive().nullable().optional(),
235
293
  rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
236
294
  delay_after: SystemConfigSchema.shape.delay_after.optional(),
295
+ flow_rate_limits: FlowRateLimitsSchema.optional(),
237
296
  rpid: SystemConfigSchema.shape.rpid.optional(),
238
297
  origins: SystemConfigSchema.shape.origins.optional(),
239
298
  magic_link_redirect_uris: z.array(RedirectTargetSchema).optional(),
package/dist/schemas/systemConfig/schema.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1C,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;IAClC,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;IACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7B,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,gBAAgB,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAErE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@seamless-auth/types",
3
- "version": "0.20.0",
3
+ "version": "0.22.0",
4
4
  "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
5
5
  "author": "Fells Code, LLC",
6
6
  "license": "AGPL-3.0-only",
package/src/schemas/authEvent/schema.ts CHANGED
@@ -106,6 +106,35 @@ export const AuthEventSchema = z.object({
106
106
  type: z.string(),
107
107
  ip_address: z.string().nullable().optional(),
108
108
  user_agent: z.string().nullable().optional(),
109
+ /**
110
+ * Which deployment wrote the row (the server's `APP_ID`), so rows collected
111
+ * across a fleet stay attributable. Null on rows written before the column
112
+ * existed.
113
+ */
114
+ deployment_id: z.string().nullable().optional(),
115
+ /**
116
+ * The platform family the user agent folds into: `ios`, `android`, `macos`,
117
+ * `windows`, `linux`, `chromeos`, `bot` or `unknown`. A plain string rather
118
+ * than an enum for the same reason `type` is: a newer server may add a class
119
+ * an older consumer has not heard of.
120
+ */
121
+ device_class: z.string().nullable().optional(),
122
+ /**
123
+ * The subject's mail provider (`gmail`, `outlook`, `other`, ...), never the
124
+ * domain. Null when the row does not know who the subject is.
125
+ */
126
+ mail_provider: z.string().nullable().optional(),
127
+ /**
128
+ * Whether the subject is a configured owner of the deployment. Null when the
129
+ * subject is unknown, which is different from a known non-owner.
130
+ */
131
+ owner: z.boolean().nullable().optional(),
132
+ /**
133
+ * The sign-in or registration attempt the row belongs to: the ephemeral
134
+ * token's `jti`. Every step taken on one token carries the same id. Null on
135
+ * rows written from an access session and on rows older than the claim.
136
+ */
137
+ attempt_id: z.string().nullable().optional(),
109
138
  metadata: z.record(z.string(), z.unknown()).nullable(),
110
139
  created_at: IsoDate,
111
140
  updated_at: IsoDate,
package/src/schemas/systemConfig/schema.ts CHANGED
@@ -97,6 +97,59 @@ export const DefaultLockoutPolicy = {
97
97
  lockoutSeconds: 15 * 60,
98
98
  } as const;
99
99
 
100
+ const PerIpLimitSchema = z.number().int().positive();
101
+
102
+ /**
103
+ * How many times one caller may start a message-carrying or provider flow per
104
+ * window, before the general `rate_limit` applies to everything else.
105
+ *
106
+ * Two keys per flow because they guard different things. `perIdentity` bounds
107
+ * how often one address or phone can be messaged, which is the abuse a sender
108
+ * cares about. `perIp` bounds how many distinct addresses one network location
109
+ * can drive, which is the enumeration and spam guard. The per-IP values were
110
+ * fixed constants before this key existed, and those constants are the defaults
111
+ * here, so a deployment that sets nothing behaves as it did.
112
+ *
113
+ * Per-IP limits are the ones a native app runs into first. Mobile carriers put
114
+ * thousands of subscribers behind one address, so a value that never troubles a
115
+ * web audience can refuse a mobile audience at modest scale. Raise `perIp` for a
116
+ * deployment that serves phones; leave `perIdentity` where it is.
117
+ */
118
+ export const FlowRateLimitsSchema = z.object({
119
+ windowSeconds: z
120
+ .number()
121
+ .int()
122
+ .positive()
123
+ .default(15 * 60),
124
+ otp: z
125
+ .object({
126
+ perIp: PerIpLimitSchema.default(10),
127
+ perIdentity: PerIpLimitSchema.default(5),
128
+ })
129
+ .default({ perIp: 10, perIdentity: 5 }),
130
+ magicLink: z
131
+ .object({
132
+ perIp: PerIpLimitSchema.default(20),
133
+ perIdentity: PerIpLimitSchema.default(5),
134
+ })
135
+ .default({ perIp: 20, perIdentity: 5 }),
136
+ oauth: z
137
+ .object({
138
+ perIp: PerIpLimitSchema.default(30),
139
+ perProvider: PerIpLimitSchema.default(10),
140
+ })
141
+ .default({ perIp: 30, perProvider: 10 }),
142
+ });
143
+
144
+ export type FlowRateLimits = z.infer<typeof FlowRateLimitsSchema>;
145
+
146
+ export const DefaultFlowRateLimits = {
147
+ windowSeconds: 15 * 60,
148
+ otp: { perIp: 10, perIdentity: 5 },
149
+ magicLink: { perIp: 20, perIdentity: 5 },
150
+ oauth: { perIp: 30, perProvider: 10 },
151
+ } as const;
152
+
100
153
  export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'cross-platform']);
101
154
 
102
155
  export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachmentPolicySchema>;
@@ -247,8 +300,18 @@ export const SystemConfigSchema = z.object({
247
300
 
248
301
  rate_limit: z.number().int().positive(),
249
302
  delay_after: z.number().int().nonnegative(),
303
+ flow_rate_limits: FlowRateLimitsSchema.default(DefaultFlowRateLimits),
250
304
 
251
305
  rpid: z.string().min(1),
306
+ /**
307
+ * The WebAuthn origins this deployment accepts, and the fallback for the magic
308
+ * link and OAuth destinations (`origins[0]`), so the web origin belongs first.
309
+ *
310
+ * `z.url()` here is deliberately loose. An Android app's WebAuthn origin is
311
+ * `android:apk-key-hash:<base64url>`, which is a valid URL with an opaque path
312
+ * and no host, and it must be accepted here for native passkeys to verify. Do
313
+ * not tighten this to a hostname check without carrying that form along.
314
+ */
252
315
  origins: z.array(z.url()).min(1),
253
316
 
254
317
  frontend_url: z.url().optional(),
@@ -284,6 +347,7 @@ export const SystemConfigPatchSchema = z
284
347
  max_concurrent_sessions: z.number().int().positive().nullable().optional(),
285
348
  rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
286
349
  delay_after: SystemConfigSchema.shape.delay_after.optional(),
350
+ flow_rate_limits: FlowRateLimitsSchema.optional(),
287
351
  rpid: SystemConfigSchema.shape.rpid.optional(),
288
352
  origins: SystemConfigSchema.shape.origins.optional(),
289
353
  magic_link_redirect_uris: z.array(RedirectTargetSchema).optional(),