@seamless-auth/types 0.30.0 → 0.32.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/dist/schemas/auth/auth.schema.d.ts +87 -0
- package/dist/schemas/auth/auth.schema.d.ts.map +1 -1
- package/dist/schemas/authEvent/schema.d.ts +19 -1
- package/dist/schemas/authEvent/schema.d.ts.map +1 -1
- package/dist/schemas/authEvent/schema.js +6 -0
- package/dist/schemas/authEvent/schema.js.map +1 -1
- package/dist/schemas/enrollment/schema.d.ts +58 -0
- package/dist/schemas/enrollment/schema.d.ts.map +1 -1
- package/dist/schemas/me/schema.d.ts +1 -0
- package/dist/schemas/me/schema.d.ts.map +1 -1
- package/dist/schemas/me/schema.js +6 -0
- package/dist/schemas/me/schema.js.map +1 -1
- package/dist/schemas/messaging/schema.d.ts +45 -0
- package/dist/schemas/messaging/schema.d.ts.map +1 -1
- package/dist/schemas/messaging/schema.js +31 -0
- package/dist/schemas/messaging/schema.js.map +1 -1
- package/dist/schemas/policy/schema.d.ts +33 -33
- package/dist/schemas/recovery/schema.d.ts +149 -2
- package/dist/schemas/recovery/schema.d.ts.map +1 -1
- package/dist/schemas/recovery/schema.js +34 -2
- package/dist/schemas/recovery/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/authEvent/schema.ts +6 -0
- package/src/schemas/me/schema.ts +6 -0
- package/src/schemas/messaging/schema.ts +37 -0
- package/src/schemas/recovery/schema.ts +49 -2
|
@@ -42,16 +42,30 @@ export const SendMagicLinkEmailInputSchema = z.object({
|
|
|
42
42
|
* the message itself when the adopter owns delivery, so this is the contract
|
|
43
43
|
* between the two.
|
|
44
44
|
*/
|
|
45
|
+
/**
|
|
46
|
+
* Why a code was sent, when it is not an ordinary sign-in or verification code. A server
|
|
47
|
+
* that ignores it still delivers the code; one that reads it can warn the owner.
|
|
48
|
+
*/
|
|
49
|
+
export const DeliveryPurposeSchema = z.enum(['account_recovery']);
|
|
50
|
+
/** The owner notices the auth API sends about something that happened to an account. */
|
|
51
|
+
export const AccountNoticeNameSchema = z.enum([
|
|
52
|
+
'account_recovery_opened',
|
|
53
|
+
'account_recovery_completed',
|
|
54
|
+
'recovery_code_used',
|
|
55
|
+
'identity_changed',
|
|
56
|
+
]);
|
|
45
57
|
export const AuthDeliverySchema = z.discriminatedUnion('kind', [
|
|
46
58
|
z.object({
|
|
47
59
|
kind: z.literal('otp_email'),
|
|
48
60
|
to: z.string(),
|
|
49
61
|
token: z.string(),
|
|
62
|
+
purpose: DeliveryPurposeSchema.optional(),
|
|
50
63
|
}),
|
|
51
64
|
z.object({
|
|
52
65
|
kind: z.literal('otp_sms'),
|
|
53
66
|
to: z.string(),
|
|
54
67
|
token: z.union([z.string(), z.number()]),
|
|
68
|
+
purpose: DeliveryPurposeSchema.optional(),
|
|
55
69
|
}),
|
|
56
70
|
z.object({
|
|
57
71
|
kind: z.literal('magic_link_email'),
|
|
@@ -65,5 +79,22 @@ export const AuthDeliverySchema = z.discriminatedUnion('kind', [
|
|
|
65
79
|
// The sign-in page. It carries no credential, so it signs nobody in on its own.
|
|
66
80
|
signInUrl: z.string(),
|
|
67
81
|
}),
|
|
82
|
+
// `subject` and `text` are ready to send as they are; `notice` lets a server use its
|
|
83
|
+
// own template instead. `cancelUrl` carries a credential, so it must reach only `to`.
|
|
84
|
+
z.object({
|
|
85
|
+
kind: z.literal('account_notice_email'),
|
|
86
|
+
notice: AccountNoticeNameSchema,
|
|
87
|
+
to: z.string(),
|
|
88
|
+
subject: z.string(),
|
|
89
|
+
text: z.string(),
|
|
90
|
+
cancelUrl: z.string().optional(),
|
|
91
|
+
}),
|
|
92
|
+
z.object({
|
|
93
|
+
kind: z.literal('account_notice_sms'),
|
|
94
|
+
notice: AccountNoticeNameSchema,
|
|
95
|
+
to: z.string(),
|
|
96
|
+
text: z.string(),
|
|
97
|
+
cancelUrl: z.string().optional(),
|
|
98
|
+
}),
|
|
68
99
|
]);
|
|
69
100
|
//# sourceMappingURL=schema.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/messaging/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAI/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,sBAAsB;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/messaging/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAI/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,sBAAsB;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAIlE,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,kBAAkB;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;KAC1C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;KAC1C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;QAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,gFAAgF;QAChF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;IACF,qFAAqF;IACrF,sFAAsF;IACtF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;QACvC,MAAM,EAAE,uBAAuB;QAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrC,MAAM,EAAE,uBAAuB;QAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;CACH,CAAC,CAAC"}
|
|
@@ -6,6 +6,7 @@ import { z } from 'zod';
|
|
|
6
6
|
*/
|
|
7
7
|
export declare const POLICY_KEYS: readonly ["login_methods", "passkey_login_fallback_enabled", "phishing_resistant_only", "prompt_passkey_enrollment", "authenticator_policy", "lockout_policy", "recovery_codes", "account_recovery"];
|
|
8
8
|
export declare const PolicyKeySchema: z.ZodEnum<{
|
|
9
|
+
account_recovery: "account_recovery";
|
|
9
10
|
login_methods: "login_methods";
|
|
10
11
|
passkey_login_fallback_enabled: "passkey_login_fallback_enabled";
|
|
11
12
|
prompt_passkey_enrollment: "prompt_passkey_enrollment";
|
|
@@ -13,10 +14,13 @@ export declare const PolicyKeySchema: z.ZodEnum<{
|
|
|
13
14
|
lockout_policy: "lockout_policy";
|
|
14
15
|
authenticator_policy: "authenticator_policy";
|
|
15
16
|
recovery_codes: "recovery_codes";
|
|
16
|
-
account_recovery: "account_recovery";
|
|
17
17
|
}>;
|
|
18
18
|
export type PolicyKey = z.infer<typeof PolicyKeySchema>;
|
|
19
19
|
export declare const PolicyDocumentSchema: z.ZodObject<{
|
|
20
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
21
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
22
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
23
|
+
}, z.core.$strip>>;
|
|
20
24
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
21
25
|
passkey: "passkey";
|
|
22
26
|
magic_link: "magic_link";
|
|
@@ -60,10 +64,6 @@ export declare const PolicyDocumentSchema: z.ZodObject<{
|
|
|
60
64
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
61
65
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
62
66
|
}, z.core.$strip>>;
|
|
63
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
64
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
65
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
66
|
-
}, z.core.$strip>>;
|
|
67
67
|
}, z.core.$strip>;
|
|
68
68
|
export type PolicyDocument = z.infer<typeof PolicyDocumentSchema>;
|
|
69
69
|
/**
|
|
@@ -81,6 +81,10 @@ export type PolicyVersionSource = z.infer<typeof PolicyVersionSourceSchema>;
|
|
|
81
81
|
export declare const PolicyVersionSchema: z.ZodObject<{
|
|
82
82
|
version: z.ZodNumber;
|
|
83
83
|
policy: z.ZodObject<{
|
|
84
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
85
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
86
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
87
|
+
}, z.core.$strip>>;
|
|
84
88
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
85
89
|
passkey: "passkey";
|
|
86
90
|
magic_link: "magic_link";
|
|
@@ -124,10 +128,6 @@ export declare const PolicyVersionSchema: z.ZodObject<{
|
|
|
124
128
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
125
129
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
126
130
|
}, z.core.$strip>>;
|
|
127
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
128
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
129
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
130
|
-
}, z.core.$strip>>;
|
|
131
131
|
}, z.core.$strip>;
|
|
132
132
|
source: z.ZodEnum<{
|
|
133
133
|
rollback: "rollback";
|
|
@@ -142,6 +142,10 @@ export declare const PolicyVersionSchema: z.ZodObject<{
|
|
|
142
142
|
export type PolicyVersion = z.infer<typeof PolicyVersionSchema>;
|
|
143
143
|
export declare const PolicyDraftSchema: z.ZodObject<{
|
|
144
144
|
policy: z.ZodObject<{
|
|
145
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
146
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
147
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
148
|
+
}, z.core.$strip>>;
|
|
145
149
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
146
150
|
passkey: "passkey";
|
|
147
151
|
magic_link: "magic_link";
|
|
@@ -185,10 +189,6 @@ export declare const PolicyDraftSchema: z.ZodObject<{
|
|
|
185
189
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
186
190
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
187
191
|
}, z.core.$strip>>;
|
|
188
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
189
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
190
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
191
|
-
}, z.core.$strip>>;
|
|
192
192
|
}, z.core.$strip>;
|
|
193
193
|
basedOnVersion: z.ZodNumber;
|
|
194
194
|
updatedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
@@ -200,6 +200,10 @@ export declare const PolicyStateResponseSchema: z.ZodObject<{
|
|
|
200
200
|
published: z.ZodObject<{
|
|
201
201
|
version: z.ZodNumber;
|
|
202
202
|
policy: z.ZodObject<{
|
|
203
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
204
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
205
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
206
|
+
}, z.core.$strip>>;
|
|
203
207
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
204
208
|
passkey: "passkey";
|
|
205
209
|
magic_link: "magic_link";
|
|
@@ -243,10 +247,6 @@ export declare const PolicyStateResponseSchema: z.ZodObject<{
|
|
|
243
247
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
244
248
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
245
249
|
}, z.core.$strip>>;
|
|
246
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
247
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
248
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
249
|
-
}, z.core.$strip>>;
|
|
250
250
|
}, z.core.$strip>;
|
|
251
251
|
source: z.ZodEnum<{
|
|
252
252
|
rollback: "rollback";
|
|
@@ -260,6 +260,10 @@ export declare const PolicyStateResponseSchema: z.ZodObject<{
|
|
|
260
260
|
}, z.core.$strip>;
|
|
261
261
|
draft: z.ZodNullable<z.ZodObject<{
|
|
262
262
|
policy: z.ZodObject<{
|
|
263
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
264
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
265
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
266
|
+
}, z.core.$strip>>;
|
|
263
267
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
264
268
|
passkey: "passkey";
|
|
265
269
|
magic_link: "magic_link";
|
|
@@ -303,10 +307,6 @@ export declare const PolicyStateResponseSchema: z.ZodObject<{
|
|
|
303
307
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
304
308
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
305
309
|
}, z.core.$strip>>;
|
|
306
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
307
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
308
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
309
|
-
}, z.core.$strip>>;
|
|
310
310
|
}, z.core.$strip>;
|
|
311
311
|
basedOnVersion: z.ZodNumber;
|
|
312
312
|
updatedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
@@ -317,6 +317,10 @@ export type PolicyStateResponse = z.infer<typeof PolicyStateResponseSchema>;
|
|
|
317
317
|
/** `PUT /system-config/policy/draft`. */
|
|
318
318
|
export declare const PolicyDraftSaveRequestSchema: z.ZodObject<{
|
|
319
319
|
policy: z.ZodObject<{
|
|
320
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
321
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
322
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
323
|
+
}, z.core.$strip>>;
|
|
320
324
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
321
325
|
passkey: "passkey";
|
|
322
326
|
magic_link: "magic_link";
|
|
@@ -360,10 +364,6 @@ export declare const PolicyDraftSaveRequestSchema: z.ZodObject<{
|
|
|
360
364
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
361
365
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
362
366
|
}, z.core.$strip>>;
|
|
363
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
364
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
365
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
366
|
-
}, z.core.$strip>>;
|
|
367
367
|
}, z.core.$strip>;
|
|
368
368
|
}, z.core.$strict>;
|
|
369
369
|
export type PolicyDraftSaveRequest = z.infer<typeof PolicyDraftSaveRequestSchema>;
|
|
@@ -387,6 +387,10 @@ export declare const PolicyVersionsResponseSchema: z.ZodObject<{
|
|
|
387
387
|
versions: z.ZodArray<z.ZodObject<{
|
|
388
388
|
version: z.ZodNumber;
|
|
389
389
|
policy: z.ZodObject<{
|
|
390
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
391
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
392
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
393
|
+
}, z.core.$strip>>;
|
|
390
394
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
391
395
|
passkey: "passkey";
|
|
392
396
|
magic_link: "magic_link";
|
|
@@ -430,10 +434,6 @@ export declare const PolicyVersionsResponseSchema: z.ZodObject<{
|
|
|
430
434
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
431
435
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
432
436
|
}, z.core.$strip>>;
|
|
433
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
434
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
435
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
436
|
-
}, z.core.$strip>>;
|
|
437
437
|
}, z.core.$strip>;
|
|
438
438
|
source: z.ZodEnum<{
|
|
439
439
|
rollback: "rollback";
|
|
@@ -452,6 +452,10 @@ export type PolicyVersionsResponse = z.infer<typeof PolicyVersionsResponseSchema
|
|
|
452
452
|
*/
|
|
453
453
|
export declare const PolicyDryRunRequestSchema: z.ZodObject<{
|
|
454
454
|
policy: z.ZodOptional<z.ZodObject<{
|
|
455
|
+
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
456
|
+
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
457
|
+
delay: z.ZodDefault<z.ZodString>;
|
|
458
|
+
}, z.core.$strip>>;
|
|
455
459
|
login_methods: z.ZodArray<z.ZodEnum<{
|
|
456
460
|
passkey: "passkey";
|
|
457
461
|
magic_link: "magic_link";
|
|
@@ -495,10 +499,6 @@ export declare const PolicyDryRunRequestSchema: z.ZodObject<{
|
|
|
495
499
|
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
496
500
|
requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
|
|
497
501
|
}, z.core.$strip>>;
|
|
498
|
-
account_recovery: z.ZodDefault<z.ZodObject<{
|
|
499
|
-
enabled: z.ZodDefault<z.ZodBoolean>;
|
|
500
|
-
delay: z.ZodDefault<z.ZodString>;
|
|
501
|
-
}, z.core.$strip>>;
|
|
502
502
|
}, z.core.$strip>>;
|
|
503
503
|
days: z.ZodDefault<z.ZodNumber>;
|
|
504
504
|
}, z.core.$strict>;
|
|
@@ -75,10 +75,16 @@ export declare const AccountRecoveryStartResponseSchema: z.ZodObject<{
|
|
|
75
75
|
kind: z.ZodLiteral<"otp_email">;
|
|
76
76
|
to: z.ZodString;
|
|
77
77
|
token: z.ZodString;
|
|
78
|
+
purpose: z.ZodOptional<z.ZodEnum<{
|
|
79
|
+
account_recovery: "account_recovery";
|
|
80
|
+
}>>;
|
|
78
81
|
}, z.core.$strip>, z.ZodObject<{
|
|
79
82
|
kind: z.ZodLiteral<"otp_sms">;
|
|
80
83
|
to: z.ZodString;
|
|
81
84
|
token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
|
|
85
|
+
purpose: z.ZodOptional<z.ZodEnum<{
|
|
86
|
+
account_recovery: "account_recovery";
|
|
87
|
+
}>>;
|
|
82
88
|
}, z.core.$strip>, z.ZodObject<{
|
|
83
89
|
kind: z.ZodLiteral<"magic_link_email">;
|
|
84
90
|
to: z.ZodString;
|
|
@@ -88,6 +94,29 @@ export declare const AccountRecoveryStartResponseSchema: z.ZodObject<{
|
|
|
88
94
|
kind: z.ZodLiteral<"enrollment_invite_email">;
|
|
89
95
|
to: z.ZodString;
|
|
90
96
|
signInUrl: z.ZodString;
|
|
97
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
98
|
+
kind: z.ZodLiteral<"account_notice_email">;
|
|
99
|
+
notice: z.ZodEnum<{
|
|
100
|
+
account_recovery_completed: "account_recovery_completed";
|
|
101
|
+
recovery_code_used: "recovery_code_used";
|
|
102
|
+
account_recovery_opened: "account_recovery_opened";
|
|
103
|
+
identity_changed: "identity_changed";
|
|
104
|
+
}>;
|
|
105
|
+
to: z.ZodString;
|
|
106
|
+
subject: z.ZodString;
|
|
107
|
+
text: z.ZodString;
|
|
108
|
+
cancelUrl: z.ZodOptional<z.ZodString>;
|
|
109
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
110
|
+
kind: z.ZodLiteral<"account_notice_sms">;
|
|
111
|
+
notice: z.ZodEnum<{
|
|
112
|
+
account_recovery_completed: "account_recovery_completed";
|
|
113
|
+
recovery_code_used: "recovery_code_used";
|
|
114
|
+
account_recovery_opened: "account_recovery_opened";
|
|
115
|
+
identity_changed: "identity_changed";
|
|
116
|
+
}>;
|
|
117
|
+
to: z.ZodString;
|
|
118
|
+
text: z.ZodString;
|
|
119
|
+
cancelUrl: z.ZodOptional<z.ZodString>;
|
|
91
120
|
}, z.core.$strip>], "kind">>;
|
|
92
121
|
}, z.core.$strip>;
|
|
93
122
|
export type AccountRecoveryStartResponse = z.infer<typeof AccountRecoveryStartResponseSchema>;
|
|
@@ -120,8 +149,126 @@ export declare const AccountRecoveryStatusSchema: z.ZodObject<{
|
|
|
120
149
|
}, z.core.$strip>;
|
|
121
150
|
export type AccountRecoveryStatus = z.infer<typeof AccountRecoveryStatusSchema>;
|
|
122
151
|
/**
|
|
123
|
-
* `POST /recovery/
|
|
124
|
-
*
|
|
152
|
+
* `POST /recovery/verify`. `deliveries` carries the "recovery opened" notices only for a
|
|
153
|
+
* credentialed caller that owns delivery and names their kinds in
|
|
154
|
+
* `x-seamless-auth-delivery-kinds`; each can hold a cancel link for the owner alone.
|
|
155
|
+
*/
|
|
156
|
+
export declare const AccountRecoveryVerifyResponseSchema: z.ZodObject<{
|
|
157
|
+
state: z.ZodEnum<{
|
|
158
|
+
completed: "completed";
|
|
159
|
+
pending: "pending";
|
|
160
|
+
ready: "ready";
|
|
161
|
+
cancelled: "cancelled";
|
|
162
|
+
}>;
|
|
163
|
+
requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
164
|
+
completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
165
|
+
deliveries: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
166
|
+
kind: z.ZodLiteral<"otp_email">;
|
|
167
|
+
to: z.ZodString;
|
|
168
|
+
token: z.ZodString;
|
|
169
|
+
purpose: z.ZodOptional<z.ZodEnum<{
|
|
170
|
+
account_recovery: "account_recovery";
|
|
171
|
+
}>>;
|
|
172
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
173
|
+
kind: z.ZodLiteral<"otp_sms">;
|
|
174
|
+
to: z.ZodString;
|
|
175
|
+
token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
|
|
176
|
+
purpose: z.ZodOptional<z.ZodEnum<{
|
|
177
|
+
account_recovery: "account_recovery";
|
|
178
|
+
}>>;
|
|
179
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
180
|
+
kind: z.ZodLiteral<"magic_link_email">;
|
|
181
|
+
to: z.ZodString;
|
|
182
|
+
token: z.ZodOptional<z.ZodString>;
|
|
183
|
+
magicLinkUrl: z.ZodString;
|
|
184
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
185
|
+
kind: z.ZodLiteral<"enrollment_invite_email">;
|
|
186
|
+
to: z.ZodString;
|
|
187
|
+
signInUrl: z.ZodString;
|
|
188
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
189
|
+
kind: z.ZodLiteral<"account_notice_email">;
|
|
190
|
+
notice: z.ZodEnum<{
|
|
191
|
+
account_recovery_completed: "account_recovery_completed";
|
|
192
|
+
recovery_code_used: "recovery_code_used";
|
|
193
|
+
account_recovery_opened: "account_recovery_opened";
|
|
194
|
+
identity_changed: "identity_changed";
|
|
195
|
+
}>;
|
|
196
|
+
to: z.ZodString;
|
|
197
|
+
subject: z.ZodString;
|
|
198
|
+
text: z.ZodString;
|
|
199
|
+
cancelUrl: z.ZodOptional<z.ZodString>;
|
|
200
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
201
|
+
kind: z.ZodLiteral<"account_notice_sms">;
|
|
202
|
+
notice: z.ZodEnum<{
|
|
203
|
+
account_recovery_completed: "account_recovery_completed";
|
|
204
|
+
recovery_code_used: "recovery_code_used";
|
|
205
|
+
account_recovery_opened: "account_recovery_opened";
|
|
206
|
+
identity_changed: "identity_changed";
|
|
207
|
+
}>;
|
|
208
|
+
to: z.ZodString;
|
|
209
|
+
text: z.ZodString;
|
|
210
|
+
cancelUrl: z.ZodOptional<z.ZodString>;
|
|
211
|
+
}, z.core.$strip>], "kind">>>;
|
|
212
|
+
}, z.core.$strip>;
|
|
213
|
+
export type AccountRecoveryVerifyResponse = z.infer<typeof AccountRecoveryVerifyResponseSchema>;
|
|
214
|
+
/** One open request, as `GET /recovery/requests` lists it for the signed-in owner. */
|
|
215
|
+
export declare const AccountRecoveryRequestSchema: z.ZodObject<{
|
|
216
|
+
state: z.ZodEnum<{
|
|
217
|
+
completed: "completed";
|
|
218
|
+
pending: "pending";
|
|
219
|
+
ready: "ready";
|
|
220
|
+
cancelled: "cancelled";
|
|
221
|
+
}>;
|
|
222
|
+
requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
223
|
+
completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
224
|
+
id: z.ZodString;
|
|
225
|
+
channel: z.ZodEnum<{
|
|
226
|
+
email: "email";
|
|
227
|
+
phone: "phone";
|
|
228
|
+
}>;
|
|
229
|
+
}, z.core.$strip>;
|
|
230
|
+
export type AccountRecoveryRequest = z.infer<typeof AccountRecoveryRequestSchema>;
|
|
231
|
+
export declare const AccountRecoveryRequestsResponseSchema: z.ZodObject<{
|
|
232
|
+
requests: z.ZodArray<z.ZodObject<{
|
|
233
|
+
state: z.ZodEnum<{
|
|
234
|
+
completed: "completed";
|
|
235
|
+
pending: "pending";
|
|
236
|
+
ready: "ready";
|
|
237
|
+
cancelled: "cancelled";
|
|
238
|
+
}>;
|
|
239
|
+
requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
240
|
+
completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
|
|
241
|
+
id: z.ZodString;
|
|
242
|
+
channel: z.ZodEnum<{
|
|
243
|
+
email: "email";
|
|
244
|
+
phone: "phone";
|
|
245
|
+
}>;
|
|
246
|
+
}, z.core.$strip>>;
|
|
247
|
+
}, z.core.$strip>;
|
|
248
|
+
export type AccountRecoveryRequestsResponse = z.infer<typeof AccountRecoveryRequestsResponseSchema>;
|
|
249
|
+
/** `DELETE /recovery/requests/:id`. */
|
|
250
|
+
export declare const AccountRecoveryRequestIdParamSchema: z.ZodObject<{
|
|
251
|
+
id: z.ZodString;
|
|
252
|
+
}, z.core.$strip>;
|
|
253
|
+
export type AccountRecoveryRequestIdParam = z.infer<typeof AccountRecoveryRequestIdParamSchema>;
|
|
254
|
+
/**
|
|
255
|
+
* The `error` values the recovery code and account recovery routes answer with, so a
|
|
256
|
+
* client can tell them apart without matching strings of its own.
|
|
257
|
+
*/
|
|
258
|
+
export declare const RecoveryErrorCodeSchema: z.ZodEnum<{
|
|
259
|
+
invalid_recovery_code: "invalid_recovery_code";
|
|
260
|
+
recovery_codes_disabled: "recovery_codes_disabled";
|
|
261
|
+
cancel_token_required: "cancel_token_required";
|
|
262
|
+
recovery_notice_failed: "recovery_notice_failed";
|
|
263
|
+
account_recovery_disabled: "account_recovery_disabled";
|
|
264
|
+
recovery_not_found: "recovery_not_found";
|
|
265
|
+
recovery_not_ready: "recovery_not_ready";
|
|
266
|
+
enrollment_required: "enrollment_required";
|
|
267
|
+
}>;
|
|
268
|
+
export type RecoveryErrorCode = z.infer<typeof RecoveryErrorCodeSchema>;
|
|
269
|
+
/**
|
|
270
|
+
* `POST /recovery/cancel` with the token from the "recovery opened" notice. A signed-in
|
|
271
|
+
* owner cancels without it through `DELETE /recovery/requests/:id`.
|
|
125
272
|
*/
|
|
126
273
|
export declare const AccountRecoveryCancelRequestSchema: z.ZodObject<{
|
|
127
274
|
cancelToken: z.ZodOptional<z.ZodString>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAGiD,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAA6B,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAGiD,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAA6B,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,kFAAkF;AAClF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,0BAA0B;;;;;EAAyD,CAAC;AAEjG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,sFAAsF;AACtF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;iBAEhD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,uCAAuC;AACvC,eAAO,MAAM,mCAAmC;;iBAAsC,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;EASlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}
|
|
@@ -72,8 +72,40 @@ export const AccountRecoveryStatusSchema = z.object({
|
|
|
72
72
|
completesAt: IsoDate,
|
|
73
73
|
});
|
|
74
74
|
/**
|
|
75
|
-
* `POST /recovery/
|
|
76
|
-
*
|
|
75
|
+
* `POST /recovery/verify`. `deliveries` carries the "recovery opened" notices only for a
|
|
76
|
+
* credentialed caller that owns delivery and names their kinds in
|
|
77
|
+
* `x-seamless-auth-delivery-kinds`; each can hold a cancel link for the owner alone.
|
|
78
|
+
*/
|
|
79
|
+
export const AccountRecoveryVerifyResponseSchema = AccountRecoveryStatusSchema.extend({
|
|
80
|
+
deliveries: z.array(AuthDeliverySchema).optional(),
|
|
81
|
+
});
|
|
82
|
+
/** One open request, as `GET /recovery/requests` lists it for the signed-in owner. */
|
|
83
|
+
export const AccountRecoveryRequestSchema = AccountRecoveryStatusSchema.extend({
|
|
84
|
+
id: z.string().uuid(),
|
|
85
|
+
channel: AccountRecoveryChannelSchema,
|
|
86
|
+
});
|
|
87
|
+
export const AccountRecoveryRequestsResponseSchema = z.object({
|
|
88
|
+
requests: z.array(AccountRecoveryRequestSchema),
|
|
89
|
+
});
|
|
90
|
+
/** `DELETE /recovery/requests/:id`. */
|
|
91
|
+
export const AccountRecoveryRequestIdParamSchema = z.object({ id: z.string().uuid() });
|
|
92
|
+
/**
|
|
93
|
+
* The `error` values the recovery code and account recovery routes answer with, so a
|
|
94
|
+
* client can tell them apart without matching strings of its own.
|
|
95
|
+
*/
|
|
96
|
+
export const RecoveryErrorCodeSchema = z.enum([
|
|
97
|
+
'invalid_recovery_code',
|
|
98
|
+
'recovery_codes_disabled',
|
|
99
|
+
'cancel_token_required',
|
|
100
|
+
'recovery_notice_failed',
|
|
101
|
+
'account_recovery_disabled',
|
|
102
|
+
'recovery_not_found',
|
|
103
|
+
'recovery_not_ready',
|
|
104
|
+
'enrollment_required',
|
|
105
|
+
]);
|
|
106
|
+
/**
|
|
107
|
+
* `POST /recovery/cancel` with the token from the "recovery opened" notice. A signed-in
|
|
108
|
+
* owner cancels without it through `DELETE /recovery/requests/:id`.
|
|
77
109
|
*/
|
|
78
110
|
export const AccountRecoveryCancelRequestSchema = z.object({
|
|
79
111
|
cancelToken: z.string().trim().min(1).optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAIjF,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,kBAAkB;CACzB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC7E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAIvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC;CACvD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAIjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;CACrB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAIjF,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,kBAAkB;CACzB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC7E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAIvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC;CACvD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAIjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;CACrB,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,2BAA2B,CAAC,MAAM,CAAC;IACpF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAIH,sFAAsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC,MAAM,CAAC;IAC7E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,OAAO,EAAE,4BAA4B;CACtC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;CAChD,CAAC,CAAC;AAIH,uCAAuC;AACvC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAIvF;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,uBAAuB;IACvB,yBAAyB;IACzB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -4,10 +4,12 @@ import { IsoDate } from '../../shared.js';
|
|
|
4
4
|
export const AUTH_EVENT_TYPES = [
|
|
5
5
|
'account_recovery_cancelled',
|
|
6
6
|
'account_recovery_completed',
|
|
7
|
+
'account_recovery_failed',
|
|
7
8
|
'account_recovery_started',
|
|
8
9
|
'account_recovery_verified',
|
|
9
10
|
'admin_device_replacement_recovery',
|
|
10
11
|
'admin_enrollment_invite_sent',
|
|
12
|
+
'admin_last_admin_change_refused',
|
|
11
13
|
'admin_oauth_provider_restored',
|
|
12
14
|
'admin_oauth_provider_retired',
|
|
13
15
|
'admin_session_revoked',
|
|
@@ -17,6 +19,7 @@ export const AUTH_EVENT_TYPES = [
|
|
|
17
19
|
'bearer_token_failed',
|
|
18
20
|
'bearer_token_success',
|
|
19
21
|
'bearer_token_suspicious',
|
|
22
|
+
'break_glass_enrollment',
|
|
20
23
|
'break_glass_sign_in',
|
|
21
24
|
'credentials_deleted',
|
|
22
25
|
'informational',
|
|
@@ -31,6 +34,7 @@ export const AUTH_EVENT_TYPES = [
|
|
|
31
34
|
'logout_failed',
|
|
32
35
|
'logout_success',
|
|
33
36
|
'logout_suspicious',
|
|
37
|
+
'magic_link_confirmation_required',
|
|
34
38
|
'magic_link_failed',
|
|
35
39
|
'magic_link_poll_completed_successfully',
|
|
36
40
|
'magic_link_requested',
|
|
@@ -67,6 +71,7 @@ export const AUTH_EVENT_TYPES = [
|
|
|
67
71
|
'service_token_rotated',
|
|
68
72
|
'service_token_success',
|
|
69
73
|
'service_token_suspicious',
|
|
74
|
+
'session_evicted',
|
|
70
75
|
'step_up_challenge',
|
|
71
76
|
'step_up_failed',
|
|
72
77
|
'step_up_success',
|
|
@@ -91,6 +96,7 @@ export const AUTH_EVENT_TYPES = [
|
|
|
91
96
|
'webauthn_login_failed',
|
|
92
97
|
'webauthn_login_success',
|
|
93
98
|
'webauthn_login_suspicious',
|
|
99
|
+
'webauthn_registration_challenge',
|
|
94
100
|
'webauthn_registration_failed',
|
|
95
101
|
'webauthn_registration_success',
|
|
96
102
|
'webauthn_registration_suspicious',
|
package/src/schemas/me/schema.ts
CHANGED
|
@@ -27,6 +27,12 @@ export const MeResponseSchema = z.object({
|
|
|
27
27
|
credentials: z.array(CredentialResponseSchema),
|
|
28
28
|
organizations: z.array(OrganizationSchema).optional(),
|
|
29
29
|
activeOrganization: OrganizationSchema.nullable().optional(),
|
|
30
|
+
/**
|
|
31
|
+
* True for a recovery session, from account recovery or a recovery code: it can only
|
|
32
|
+
* enroll a new passkey or authenticator app until one is enrolled. A cookie client
|
|
33
|
+
* cannot read its access token, so this is how it learns that after a reload.
|
|
34
|
+
*/
|
|
35
|
+
recovery: z.boolean().optional(),
|
|
30
36
|
});
|
|
31
37
|
|
|
32
38
|
export type MeResponse = z.infer<typeof MeResponseSchema>;
|
|
@@ -64,16 +64,36 @@ export type SendMagicLinkEmailInput = z.infer<typeof SendMagicLinkEmailInputSche
|
|
|
64
64
|
* the message itself when the adopter owns delivery, so this is the contract
|
|
65
65
|
* between the two.
|
|
66
66
|
*/
|
|
67
|
+
/**
|
|
68
|
+
* Why a code was sent, when it is not an ordinary sign-in or verification code. A server
|
|
69
|
+
* that ignores it still delivers the code; one that reads it can warn the owner.
|
|
70
|
+
*/
|
|
71
|
+
export const DeliveryPurposeSchema = z.enum(['account_recovery']);
|
|
72
|
+
|
|
73
|
+
export type DeliveryPurpose = z.infer<typeof DeliveryPurposeSchema>;
|
|
74
|
+
|
|
75
|
+
/** The owner notices the auth API sends about something that happened to an account. */
|
|
76
|
+
export const AccountNoticeNameSchema = z.enum([
|
|
77
|
+
'account_recovery_opened',
|
|
78
|
+
'account_recovery_completed',
|
|
79
|
+
'recovery_code_used',
|
|
80
|
+
'identity_changed',
|
|
81
|
+
]);
|
|
82
|
+
|
|
83
|
+
export type AccountNoticeName = z.infer<typeof AccountNoticeNameSchema>;
|
|
84
|
+
|
|
67
85
|
export const AuthDeliverySchema = z.discriminatedUnion('kind', [
|
|
68
86
|
z.object({
|
|
69
87
|
kind: z.literal('otp_email'),
|
|
70
88
|
to: z.string(),
|
|
71
89
|
token: z.string(),
|
|
90
|
+
purpose: DeliveryPurposeSchema.optional(),
|
|
72
91
|
}),
|
|
73
92
|
z.object({
|
|
74
93
|
kind: z.literal('otp_sms'),
|
|
75
94
|
to: z.string(),
|
|
76
95
|
token: z.union([z.string(), z.number()]),
|
|
96
|
+
purpose: DeliveryPurposeSchema.optional(),
|
|
77
97
|
}),
|
|
78
98
|
z.object({
|
|
79
99
|
kind: z.literal('magic_link_email'),
|
|
@@ -87,6 +107,23 @@ export const AuthDeliverySchema = z.discriminatedUnion('kind', [
|
|
|
87
107
|
// The sign-in page. It carries no credential, so it signs nobody in on its own.
|
|
88
108
|
signInUrl: z.string(),
|
|
89
109
|
}),
|
|
110
|
+
// `subject` and `text` are ready to send as they are; `notice` lets a server use its
|
|
111
|
+
// own template instead. `cancelUrl` carries a credential, so it must reach only `to`.
|
|
112
|
+
z.object({
|
|
113
|
+
kind: z.literal('account_notice_email'),
|
|
114
|
+
notice: AccountNoticeNameSchema,
|
|
115
|
+
to: z.string(),
|
|
116
|
+
subject: z.string(),
|
|
117
|
+
text: z.string(),
|
|
118
|
+
cancelUrl: z.string().optional(),
|
|
119
|
+
}),
|
|
120
|
+
z.object({
|
|
121
|
+
kind: z.literal('account_notice_sms'),
|
|
122
|
+
notice: AccountNoticeNameSchema,
|
|
123
|
+
to: z.string(),
|
|
124
|
+
text: z.string(),
|
|
125
|
+
cancelUrl: z.string().optional(),
|
|
126
|
+
}),
|
|
90
127
|
]);
|
|
91
128
|
|
|
92
129
|
export type AuthDeliveryInstruction = z.infer<typeof AuthDeliverySchema>;
|