@seamless-auth/types 0.28.0 → 0.30.0

package/dist/schemas/policy/schema.d.ts

@@ -0,0 +1,555 @@
+import { z } from 'zod';
+/**
+ * The system config keys that decide who can sign in, and how. These are the ones a
+ * change can lock people out with, so each published change is kept as a version that
+ * can be restored in one step, and can be staged as a draft and dry-run first.
+ */
+export declare const POLICY_KEYS: readonly ["login_methods", "passkey_login_fallback_enabled", "phishing_resistant_only", "prompt_passkey_enrollment", "authenticator_policy", "lockout_policy", "recovery_codes", "account_recovery"];
+export declare const PolicyKeySchema: z.ZodEnum<{
+    login_methods: "login_methods";
+    passkey_login_fallback_enabled: "passkey_login_fallback_enabled";
+    prompt_passkey_enrollment: "prompt_passkey_enrollment";
+    phishing_resistant_only: "phishing_resistant_only";
+    lockout_policy: "lockout_policy";
+    authenticator_policy: "authenticator_policy";
+    recovery_codes: "recovery_codes";
+    account_recovery: "account_recovery";
+}>;
+export type PolicyKey = z.infer<typeof PolicyKeySchema>;
+export declare const PolicyDocumentSchema: z.ZodObject<{
+    login_methods: z.ZodArray<z.ZodEnum<{
+        passkey: "passkey";
+        magic_link: "magic_link";
+        email_otp: "email_otp";
+        phone_otp: "phone_otp";
+        oauth: "oauth";
+    }>>;
+    passkey_login_fallback_enabled: z.ZodBoolean;
+    prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+    phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+    lockout_policy: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxFailures: z.ZodDefault<z.ZodNumber>;
+        windowSeconds: z.ZodDefault<z.ZodNumber>;
+        lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    authenticator_policy: z.ZodDefault<z.ZodObject<{
+        attachment: z.ZodDefault<z.ZodEnum<{
+            "cross-platform": "cross-platform";
+            platform: "platform";
+            any: "any";
+        }>>;
+        userVerification: z.ZodDefault<z.ZodEnum<{
+            discouraged: "discouraged";
+            preferred: "preferred";
+            required: "required";
+        }>>;
+        attestation: z.ZodDefault<z.ZodEnum<{
+            direct: "direct";
+            none: "none";
+        }>>;
+        requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+        syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+            block: "block";
+            allow: "allow";
+        }>>;
+        aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    recovery_codes: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    account_recovery: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        delay: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PolicyDocument = z.infer<typeof PolicyDocumentSchema>;
+/**
+ * How a version came to be. Drafts are optional: a whole-config PATCH that touches a
+ * policy key still applies immediately, and is recorded as a `config_patch` version so
+ * it can be rolled back like any other.
+ */
+export declare const PolicyVersionSourceSchema: z.ZodEnum<{
+    rollback: "rollback";
+    publish: "publish";
+    config_patch: "config_patch";
+    bootstrap: "bootstrap";
+}>;
+export type PolicyVersionSource = z.infer<typeof PolicyVersionSourceSchema>;
+export declare const PolicyVersionSchema: z.ZodObject<{
+    version: z.ZodNumber;
+    policy: z.ZodObject<{
+        login_methods: z.ZodArray<z.ZodEnum<{
+            passkey: "passkey";
+            magic_link: "magic_link";
+            email_otp: "email_otp";
+            phone_otp: "phone_otp";
+            oauth: "oauth";
+        }>>;
+        passkey_login_fallback_enabled: z.ZodBoolean;
+        prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+        phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+        lockout_policy: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxFailures: z.ZodDefault<z.ZodNumber>;
+            windowSeconds: z.ZodDefault<z.ZodNumber>;
+            lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        authenticator_policy: z.ZodDefault<z.ZodObject<{
+            attachment: z.ZodDefault<z.ZodEnum<{
+                "cross-platform": "cross-platform";
+                platform: "platform";
+                any: "any";
+            }>>;
+            userVerification: z.ZodDefault<z.ZodEnum<{
+                discouraged: "discouraged";
+                preferred: "preferred";
+                required: "required";
+            }>>;
+            attestation: z.ZodDefault<z.ZodEnum<{
+                direct: "direct";
+                none: "none";
+            }>>;
+            requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+            syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                block: "block";
+                allow: "allow";
+            }>>;
+            aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        recovery_codes: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        account_recovery: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            delay: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    source: z.ZodEnum<{
+        rollback: "rollback";
+        publish: "publish";
+        config_patch: "config_patch";
+        bootstrap: "bootstrap";
+    }>;
+    publishedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    publishedBy: z.ZodNullable<z.ZodString>;
+    rolledBackTo: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type PolicyVersion = z.infer<typeof PolicyVersionSchema>;
+export declare const PolicyDraftSchema: z.ZodObject<{
+    policy: z.ZodObject<{
+        login_methods: z.ZodArray<z.ZodEnum<{
+            passkey: "passkey";
+            magic_link: "magic_link";
+            email_otp: "email_otp";
+            phone_otp: "phone_otp";
+            oauth: "oauth";
+        }>>;
+        passkey_login_fallback_enabled: z.ZodBoolean;
+        prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+        phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+        lockout_policy: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxFailures: z.ZodDefault<z.ZodNumber>;
+            windowSeconds: z.ZodDefault<z.ZodNumber>;
+            lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        authenticator_policy: z.ZodDefault<z.ZodObject<{
+            attachment: z.ZodDefault<z.ZodEnum<{
+                "cross-platform": "cross-platform";
+                platform: "platform";
+                any: "any";
+            }>>;
+            userVerification: z.ZodDefault<z.ZodEnum<{
+                discouraged: "discouraged";
+                preferred: "preferred";
+                required: "required";
+            }>>;
+            attestation: z.ZodDefault<z.ZodEnum<{
+                direct: "direct";
+                none: "none";
+            }>>;
+            requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+            syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                block: "block";
+                allow: "allow";
+            }>>;
+            aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        recovery_codes: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        account_recovery: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            delay: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    basedOnVersion: z.ZodNumber;
+    updatedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    updatedBy: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PolicyDraft = z.infer<typeof PolicyDraftSchema>;
+/** `GET /system-config/policy`. */
+export declare const PolicyStateResponseSchema: z.ZodObject<{
+    published: z.ZodObject<{
+        version: z.ZodNumber;
+        policy: z.ZodObject<{
+            login_methods: z.ZodArray<z.ZodEnum<{
+                passkey: "passkey";
+                magic_link: "magic_link";
+                email_otp: "email_otp";
+                phone_otp: "phone_otp";
+                oauth: "oauth";
+            }>>;
+            passkey_login_fallback_enabled: z.ZodBoolean;
+            prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+            phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+            lockout_policy: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                maxFailures: z.ZodDefault<z.ZodNumber>;
+                windowSeconds: z.ZodDefault<z.ZodNumber>;
+                lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+            authenticator_policy: z.ZodDefault<z.ZodObject<{
+                attachment: z.ZodDefault<z.ZodEnum<{
+                    "cross-platform": "cross-platform";
+                    platform: "platform";
+                    any: "any";
+                }>>;
+                userVerification: z.ZodDefault<z.ZodEnum<{
+                    discouraged: "discouraged";
+                    preferred: "preferred";
+                    required: "required";
+                }>>;
+                attestation: z.ZodDefault<z.ZodEnum<{
+                    direct: "direct";
+                    none: "none";
+                }>>;
+                requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+                syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                    block: "block";
+                    allow: "allow";
+                }>>;
+                aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+            recovery_codes: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            account_recovery: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                delay: z.ZodDefault<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        source: z.ZodEnum<{
+            rollback: "rollback";
+            publish: "publish";
+            config_patch: "config_patch";
+            bootstrap: "bootstrap";
+        }>;
+        publishedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        publishedBy: z.ZodNullable<z.ZodString>;
+        rolledBackTo: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    draft: z.ZodNullable<z.ZodObject<{
+        policy: z.ZodObject<{
+            login_methods: z.ZodArray<z.ZodEnum<{
+                passkey: "passkey";
+                magic_link: "magic_link";
+                email_otp: "email_otp";
+                phone_otp: "phone_otp";
+                oauth: "oauth";
+            }>>;
+            passkey_login_fallback_enabled: z.ZodBoolean;
+            prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+            phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+            lockout_policy: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                maxFailures: z.ZodDefault<z.ZodNumber>;
+                windowSeconds: z.ZodDefault<z.ZodNumber>;
+                lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+            authenticator_policy: z.ZodDefault<z.ZodObject<{
+                attachment: z.ZodDefault<z.ZodEnum<{
+                    "cross-platform": "cross-platform";
+                    platform: "platform";
+                    any: "any";
+                }>>;
+                userVerification: z.ZodDefault<z.ZodEnum<{
+                    discouraged: "discouraged";
+                    preferred: "preferred";
+                    required: "required";
+                }>>;
+                attestation: z.ZodDefault<z.ZodEnum<{
+                    direct: "direct";
+                    none: "none";
+                }>>;
+                requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+                syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                    block: "block";
+                    allow: "allow";
+                }>>;
+                aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+            recovery_codes: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            account_recovery: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                delay: z.ZodDefault<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        basedOnVersion: z.ZodNumber;
+        updatedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        updatedBy: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PolicyStateResponse = z.infer<typeof PolicyStateResponseSchema>;
+/** `PUT /system-config/policy/draft`. */
+export declare const PolicyDraftSaveRequestSchema: z.ZodObject<{
+    policy: z.ZodObject<{
+        login_methods: z.ZodArray<z.ZodEnum<{
+            passkey: "passkey";
+            magic_link: "magic_link";
+            email_otp: "email_otp";
+            phone_otp: "phone_otp";
+            oauth: "oauth";
+        }>>;
+        passkey_login_fallback_enabled: z.ZodBoolean;
+        prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+        phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+        lockout_policy: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxFailures: z.ZodDefault<z.ZodNumber>;
+            windowSeconds: z.ZodDefault<z.ZodNumber>;
+            lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        authenticator_policy: z.ZodDefault<z.ZodObject<{
+            attachment: z.ZodDefault<z.ZodEnum<{
+                "cross-platform": "cross-platform";
+                platform: "platform";
+                any: "any";
+            }>>;
+            userVerification: z.ZodDefault<z.ZodEnum<{
+                discouraged: "discouraged";
+                preferred: "preferred";
+                required: "required";
+            }>>;
+            attestation: z.ZodDefault<z.ZodEnum<{
+                direct: "direct";
+                none: "none";
+            }>>;
+            requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+            syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                block: "block";
+                allow: "allow";
+            }>>;
+            aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        recovery_codes: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        account_recovery: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            delay: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strict>;
+export type PolicyDraftSaveRequest = z.infer<typeof PolicyDraftSaveRequestSchema>;
+/**
+ * `POST /system-config/policy/publish`. `expectedVersion` is the published version the
+ * caller reviewed; publishing answers `409` if another version was published since, so
+ * a stale draft cannot silently undo someone else's change.
+ */
+export declare const PolicyPublishRequestSchema: z.ZodObject<{
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type PolicyPublishRequest = z.infer<typeof PolicyPublishRequestSchema>;
+/** `POST /system-config/policy/rollback`: publishes a copy of `version` as a new version. */
+export declare const PolicyRollbackRequestSchema: z.ZodObject<{
+    version: z.ZodNumber;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type PolicyRollbackRequest = z.infer<typeof PolicyRollbackRequestSchema>;
+/** `GET /system-config/policy/versions`, newest first. */
+export declare const PolicyVersionsResponseSchema: z.ZodObject<{
+    versions: z.ZodArray<z.ZodObject<{
+        version: z.ZodNumber;
+        policy: z.ZodObject<{
+            login_methods: z.ZodArray<z.ZodEnum<{
+                passkey: "passkey";
+                magic_link: "magic_link";
+                email_otp: "email_otp";
+                phone_otp: "phone_otp";
+                oauth: "oauth";
+            }>>;
+            passkey_login_fallback_enabled: z.ZodBoolean;
+            prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+            phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+            lockout_policy: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                maxFailures: z.ZodDefault<z.ZodNumber>;
+                windowSeconds: z.ZodDefault<z.ZodNumber>;
+                lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+            authenticator_policy: z.ZodDefault<z.ZodObject<{
+                attachment: z.ZodDefault<z.ZodEnum<{
+                    "cross-platform": "cross-platform";
+                    platform: "platform";
+                    any: "any";
+                }>>;
+                userVerification: z.ZodDefault<z.ZodEnum<{
+                    discouraged: "discouraged";
+                    preferred: "preferred";
+                    required: "required";
+                }>>;
+                attestation: z.ZodDefault<z.ZodEnum<{
+                    direct: "direct";
+                    none: "none";
+                }>>;
+                requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+                syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                    block: "block";
+                    allow: "allow";
+                }>>;
+                aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+            recovery_codes: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            account_recovery: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                delay: z.ZodDefault<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        source: z.ZodEnum<{
+            rollback: "rollback";
+            publish: "publish";
+            config_patch: "config_patch";
+            bootstrap: "bootstrap";
+        }>;
+        publishedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        publishedBy: z.ZodNullable<z.ZodString>;
+        rolledBackTo: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PolicyVersionsResponse = z.infer<typeof PolicyVersionsResponseSchema>;
+/**
+ * `POST /system-config/policy/dry-run`. Without `policy`, evaluates the current draft.
+ */
+export declare const PolicyDryRunRequestSchema: z.ZodObject<{
+    policy: z.ZodOptional<z.ZodObject<{
+        login_methods: z.ZodArray<z.ZodEnum<{
+            passkey: "passkey";
+            magic_link: "magic_link";
+            email_otp: "email_otp";
+            phone_otp: "phone_otp";
+            oauth: "oauth";
+        }>>;
+        passkey_login_fallback_enabled: z.ZodBoolean;
+        prompt_passkey_enrollment: z.ZodDefault<z.ZodBoolean>;
+        phishing_resistant_only: z.ZodDefault<z.ZodBoolean>;
+        lockout_policy: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxFailures: z.ZodDefault<z.ZodNumber>;
+            windowSeconds: z.ZodDefault<z.ZodNumber>;
+            lockoutSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        authenticator_policy: z.ZodDefault<z.ZodObject<{
+            attachment: z.ZodDefault<z.ZodEnum<{
+                "cross-platform": "cross-platform";
+                platform: "platform";
+                any: "any";
+            }>>;
+            userVerification: z.ZodDefault<z.ZodEnum<{
+                discouraged: "discouraged";
+                preferred: "preferred";
+                required: "required";
+            }>>;
+            attestation: z.ZodDefault<z.ZodEnum<{
+                direct: "direct";
+                none: "none";
+            }>>;
+            requireKnownAuthenticator: z.ZodDefault<z.ZodBoolean>;
+            syncedPasskeys: z.ZodDefault<z.ZodEnum<{
+                block: "block";
+                allow: "allow";
+            }>>;
+            aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        recovery_codes: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        account_recovery: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            delay: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    days: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type PolicyDryRunRequest = z.infer<typeof PolicyDryRunRequestSchema>;
+export declare const PolicyDryRunReasonSchema: z.ZodEnum<{
+    authenticator_not_allowed: "authenticator_not_allowed";
+    method_disabled: "method_disabled";
+    phishing_resistant_required: "phishing_resistant_required";
+    fallback_disabled: "fallback_disabled";
+    synced_passkey_blocked: "synced_passkey_blocked";
+    user_verification_required: "user_verification_required";
+}>;
+export type PolicyDryRunReason = z.infer<typeof PolicyDryRunReasonSchema>;
+export declare const PolicyDryRunUserSchema: z.ZodObject<{
+    userId: z.ZodString;
+    email: z.ZodString;
+    signIns: z.ZodNumber;
+    reasons: z.ZodArray<z.ZodEnum<{
+        authenticator_not_allowed: "authenticator_not_allowed";
+        method_disabled: "method_disabled";
+        phishing_resistant_required: "phishing_resistant_required";
+        fallback_disabled: "fallback_disabled";
+        synced_passkey_blocked: "synced_passkey_blocked";
+        user_verification_required: "user_verification_required";
+    }>>;
+    lockedOut: z.ZodBoolean;
+}, z.core.$strip>;
+export type PolicyDryRunUser = z.infer<typeof PolicyDryRunUserSchema>;
+export declare const PolicyDryRunResponseSchema: z.ZodObject<{
+    window: z.ZodObject<{
+        from: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+        to: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    }, z.core.$strip>;
+    signInsEvaluated: z.ZodNumber;
+    usersEvaluated: z.ZodNumber;
+    wouldFail: z.ZodArray<z.ZodObject<{
+        userId: z.ZodString;
+        email: z.ZodString;
+        signIns: z.ZodNumber;
+        reasons: z.ZodArray<z.ZodEnum<{
+            authenticator_not_allowed: "authenticator_not_allowed";
+            method_disabled: "method_disabled";
+            phishing_resistant_required: "phishing_resistant_required";
+            fallback_disabled: "fallback_disabled";
+            synced_passkey_blocked: "synced_passkey_blocked";
+            user_verification_required: "user_verification_required";
+        }>>;
+        lockedOut: z.ZodBoolean;
+    }, z.core.$strip>>;
+    usersLockedOut: z.ZodNumber;
+    breakGlassAccounts: z.ZodNumber;
+}, z.core.$strip>;
+export type PolicyDryRunResponse = z.infer<typeof PolicyDryRunResponseSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schemas/policy/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/policy/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;GAIG;AACH,eAAO,MAAM,WAAW,sMASd,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;;;;EAAsB,CAAC;AAEnD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;;EAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,mCAAmC;AACnC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,yCAAyC;AACzC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;kBAI5B,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,6FAA6F;AAC7F,eAAO,MAAM,2BAA2B;;;kBAK7B,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,wBAAwB;;;;;;;EAOnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;iBAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;iBAQrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/policy/schema.js

@@ -0,0 +1,125 @@
+import { z } from 'zod';
+import { IsoDate } from '../../shared.js';
+import { SystemConfigSchema } from '../systemConfig/schema.js';
+/**
+ * The system config keys that decide who can sign in, and how. These are the ones a
+ * change can lock people out with, so each published change is kept as a version that
+ * can be restored in one step, and can be staged as a draft and dry-run first.
+ */
+export const POLICY_KEYS = [
+    'login_methods',
+    'passkey_login_fallback_enabled',
+    'phishing_resistant_only',
+    'prompt_passkey_enrollment',
+    'authenticator_policy',
+    'lockout_policy',
+    'recovery_codes',
+    'account_recovery',
+];
+export const PolicyKeySchema = z.enum(POLICY_KEYS);
+export const PolicyDocumentSchema = SystemConfigSchema.pick({
+    login_methods: true,
+    passkey_login_fallback_enabled: true,
+    phishing_resistant_only: true,
+    prompt_passkey_enrollment: true,
+    authenticator_policy: true,
+    lockout_policy: true,
+    recovery_codes: true,
+    account_recovery: true,
+});
+/**
+ * How a version came to be. Drafts are optional: a whole-config PATCH that touches a
+ * policy key still applies immediately, and is recorded as a `config_patch` version so
+ * it can be rolled back like any other.
+ */
+export const PolicyVersionSourceSchema = z.enum([
+    'publish',
+    'rollback',
+    'config_patch',
+    'bootstrap',
+]);
+export const PolicyVersionSchema = z.object({
+    version: z.number().int().positive(),
+    policy: PolicyDocumentSchema,
+    source: PolicyVersionSourceSchema,
+    publishedAt: IsoDate,
+    /** User id of the administrator, or null for a version the server wrote itself. */
+    publishedBy: z.string().nullable(),
+    /** The version a rollback restored. */
+    rolledBackTo: z.number().int().positive().optional(),
+});
+export const PolicyDraftSchema = z.object({
+    policy: PolicyDocumentSchema,
+    /** The published version the draft was started from. */
+    basedOnVersion: z.number().int().positive(),
+    updatedAt: IsoDate,
+    updatedBy: z.string().nullable(),
+});
+/** `GET /system-config/policy`. */
+export const PolicyStateResponseSchema = z.object({
+    published: PolicyVersionSchema,
+    draft: PolicyDraftSchema.nullable(),
+});
+/** `PUT /system-config/policy/draft`. */
+export const PolicyDraftSaveRequestSchema = z
+    .object({
+    policy: PolicyDocumentSchema,
+})
+    .strict();
+/**
+ * `POST /system-config/policy/publish`. `expectedVersion` is the published version the
+ * caller reviewed; publishing answers `409` if another version was published since, so
+ * a stale draft cannot silently undo someone else's change.
+ */
+export const PolicyPublishRequestSchema = z
+    .object({
+    expectedVersion: z.number().int().positive(),
+})
+    .strict();
+/** `POST /system-config/policy/rollback`: publishes a copy of `version` as a new version. */
+export const PolicyRollbackRequestSchema = z
+    .object({
+    version: z.number().int().positive(),
+    expectedVersion: z.number().int().positive(),
+})
+    .strict();
+/** `GET /system-config/policy/versions`, newest first. */
+export const PolicyVersionsResponseSchema = z.object({
+    versions: z.array(PolicyVersionSchema),
+});
+/**
+ * `POST /system-config/policy/dry-run`. Without `policy`, evaluates the current draft.
+ */
+export const PolicyDryRunRequestSchema = z
+    .object({
+    policy: PolicyDocumentSchema.optional(),
+    days: z.number().int().min(1).max(30).default(7),
+})
+    .strict();
+export const PolicyDryRunReasonSchema = z.enum([
+    'method_disabled',
+    'phishing_resistant_required',
+    'fallback_disabled',
+    'synced_passkey_blocked',
+    'authenticator_not_allowed',
+    'user_verification_required',
+]);
+export const PolicyDryRunUserSchema = z.object({
+    userId: z.string(),
+    email: z.string(),
+    /** Sign-ins in the window this policy would have refused. */
+    signIns: z.number().int().nonnegative(),
+    reasons: z.array(PolicyDryRunReasonSchema).min(1),
+    /** True when none of the user's enrolled factors would still sign them in. */
+    lockedOut: z.boolean(),
+});
+export const PolicyDryRunResponseSchema = z.object({
+    window: z.object({ from: IsoDate, to: IsoDate }),
+    signInsEvaluated: z.number().int().nonnegative(),
+    usersEvaluated: z.number().int().nonnegative(),
+    wouldFail: z.array(PolicyDryRunUserSchema),
+    usersLockedOut: z.number().int().nonnegative(),
+    /** Break-glass accounts are exempt from policy, so they are counted, never refused. */
+    breakGlassAccounts: z.number().int().nonnegative(),
+});
+//# sourceMappingURL=schema.js.map