@seamless-auth/types 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +29 -0
- package/dist/schemas/systemConfig/schema.d.ts +53 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +17 -0
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/systemConfig/schema.ts +24 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,34 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.7.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- fef7f2c: Add `authenticator_policy` to the system configuration.
|
|
8
|
+
|
|
9
|
+
A deployment can now state which authenticators it will enrol, rather than the
|
|
10
|
+
decision being fixed in the auth server. The block starts with one field:
|
|
11
|
+
|
|
12
|
+
```ts
|
|
13
|
+
authenticator_policy: {
|
|
14
|
+
attachment: 'any' | 'platform' | 'cross-platform';
|
|
15
|
+
}
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
`attachment` is the standing default for the browser picker at registration.
|
|
19
|
+
`any`, the default, offers both built-in and roaming authenticators, which is
|
|
20
|
+
what a deployment issuing hardware security keys needs. Naming one narrows the
|
|
21
|
+
picker and bounds what a per-request override may ask for.
|
|
22
|
+
|
|
23
|
+
Additive and backward compatible: config that predates the key parses to
|
|
24
|
+
`{ attachment: 'any' }`, which is the behaviour callers already had. The key is
|
|
25
|
+
also accepted by the strict patch schema, so it is editable through the admin
|
|
26
|
+
config route.
|
|
27
|
+
|
|
28
|
+
Introduced as a block rather than a single key because authenticator policy is
|
|
29
|
+
expected to grow: synced passkey posture and AAGUID allow and deny lists belong
|
|
30
|
+
in the same place, and adding them later should not mean migrating config twice.
|
|
31
|
+
|
|
3
32
|
## 0.6.0
|
|
4
33
|
|
|
5
34
|
### Minor Changes
|
|
@@ -47,6 +47,31 @@ export declare const DefaultLockoutPolicy: {
|
|
|
47
47
|
readonly windowSeconds: number;
|
|
48
48
|
readonly lockoutSeconds: number;
|
|
49
49
|
};
|
|
50
|
+
export declare const AuthenticatorAttachmentPolicySchema: z.ZodEnum<{
|
|
51
|
+
"cross-platform": "cross-platform";
|
|
52
|
+
platform: "platform";
|
|
53
|
+
any: "any";
|
|
54
|
+
}>;
|
|
55
|
+
export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachmentPolicySchema>;
|
|
56
|
+
/**
|
|
57
|
+
* Which authenticators a deployment will enrol.
|
|
58
|
+
*
|
|
59
|
+
* `attachment` is the standing default for the browser picker at registration.
|
|
60
|
+
* `any` offers both built-in and roaming authenticators, which is what a
|
|
61
|
+
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
62
|
+
* and also bounds what a per-request override may ask for.
|
|
63
|
+
*/
|
|
64
|
+
export declare const AuthenticatorPolicySchema: z.ZodObject<{
|
|
65
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
66
|
+
"cross-platform": "cross-platform";
|
|
67
|
+
platform: "platform";
|
|
68
|
+
any: "any";
|
|
69
|
+
}>>;
|
|
70
|
+
}, z.core.$strip>;
|
|
71
|
+
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
72
|
+
export declare const DefaultAuthenticatorPolicy: {
|
|
73
|
+
readonly attachment: "any";
|
|
74
|
+
};
|
|
50
75
|
export declare const SystemConfigSchema: z.ZodObject<{
|
|
51
76
|
app_name: z.ZodString;
|
|
52
77
|
default_roles: z.ZodArray<z.ZodString>;
|
|
@@ -89,6 +114,13 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
89
114
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
90
115
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
91
116
|
}, z.core.$strip>>;
|
|
117
|
+
authenticator_policy: z.ZodDefault<z.ZodObject<{
|
|
118
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
119
|
+
"cross-platform": "cross-platform";
|
|
120
|
+
platform: "platform";
|
|
121
|
+
any: "any";
|
|
122
|
+
}>>;
|
|
123
|
+
}, z.core.$strip>>;
|
|
92
124
|
access_token_ttl: z.ZodString;
|
|
93
125
|
refresh_token_ttl: z.ZodString;
|
|
94
126
|
rate_limit: z.ZodNumber;
|
|
@@ -140,6 +172,13 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
140
172
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
141
173
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
142
174
|
}, z.core.$strip>>;
|
|
175
|
+
authenticator_policy: z.ZodOptional<z.ZodObject<{
|
|
176
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
177
|
+
"cross-platform": "cross-platform";
|
|
178
|
+
platform: "platform";
|
|
179
|
+
any: "any";
|
|
180
|
+
}>>;
|
|
181
|
+
}, z.core.$strip>>;
|
|
143
182
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
144
183
|
refresh_token_ttl: z.ZodOptional<z.ZodString>;
|
|
145
184
|
rate_limit: z.ZodOptional<z.ZodNumber>;
|
|
@@ -194,6 +233,13 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
194
233
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
195
234
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
196
235
|
}, z.core.$strip>>;
|
|
236
|
+
authenticator_policy: z.ZodOptional<z.ZodObject<{
|
|
237
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
238
|
+
"cross-platform": "cross-platform";
|
|
239
|
+
platform: "platform";
|
|
240
|
+
any: "any";
|
|
241
|
+
}>>;
|
|
242
|
+
}, z.core.$strip>>;
|
|
197
243
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
198
244
|
refresh_token_ttl: z.ZodOptional<z.ZodString>;
|
|
199
245
|
rate_limit: z.ZodOptional<z.ZodNumber>;
|
|
@@ -355,6 +401,13 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
355
401
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
356
402
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
357
403
|
}, z.core.$strip>>;
|
|
404
|
+
authenticator_policy: z.ZodDefault<z.ZodObject<{
|
|
405
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
406
|
+
"cross-platform": "cross-platform";
|
|
407
|
+
platform: "platform";
|
|
408
|
+
any: "any";
|
|
409
|
+
}>>;
|
|
410
|
+
}, z.core.$strip>>;
|
|
358
411
|
access_token_ttl: z.ZodString;
|
|
359
412
|
refresh_token_ttl: z.ZodString;
|
|
360
413
|
rate_limit: z.ZodNumber;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,kBAAkB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;iBAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;CAE7B,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -51,6 +51,21 @@ export const DefaultLockoutPolicy = {
|
|
|
51
51
|
windowSeconds: 15 * 60,
|
|
52
52
|
lockoutSeconds: 15 * 60,
|
|
53
53
|
};
|
|
54
|
+
export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'cross-platform']);
|
|
55
|
+
/**
|
|
56
|
+
* Which authenticators a deployment will enrol.
|
|
57
|
+
*
|
|
58
|
+
* `attachment` is the standing default for the browser picker at registration.
|
|
59
|
+
* `any` offers both built-in and roaming authenticators, which is what a
|
|
60
|
+
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
61
|
+
* and also bounds what a per-request override may ask for.
|
|
62
|
+
*/
|
|
63
|
+
export const AuthenticatorPolicySchema = z.object({
|
|
64
|
+
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
65
|
+
});
|
|
66
|
+
export const DefaultAuthenticatorPolicy = {
|
|
67
|
+
attachment: 'any',
|
|
68
|
+
};
|
|
54
69
|
export const SystemConfigSchema = z.object({
|
|
55
70
|
app_name: z.string().min(3),
|
|
56
71
|
default_roles: z.array(RoleNameSchema).min(1),
|
|
@@ -59,6 +74,7 @@ export const SystemConfigSchema = z.object({
|
|
|
59
74
|
passkey_login_fallback_enabled: z.boolean(),
|
|
60
75
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
61
76
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
77
|
+
authenticator_policy: AuthenticatorPolicySchema.default(DefaultAuthenticatorPolicy),
|
|
62
78
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
63
79
|
refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
64
80
|
rate_limit: z.number().int().positive(),
|
|
@@ -76,6 +92,7 @@ export const SystemConfigPatchSchema = z
|
|
|
76
92
|
passkey_login_fallback_enabled: SystemConfigSchema.shape.passkey_login_fallback_enabled.optional(),
|
|
77
93
|
oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
|
|
78
94
|
lockout_policy: LockoutPolicySchema.optional(),
|
|
95
|
+
authenticator_policy: AuthenticatorPolicySchema.optional(),
|
|
79
96
|
access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
|
|
80
97
|
refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
|
|
81
98
|
rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAEnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -65,6 +65,28 @@ export const DefaultLockoutPolicy = {
|
|
|
65
65
|
lockoutSeconds: 15 * 60,
|
|
66
66
|
} as const;
|
|
67
67
|
|
|
68
|
+
export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'cross-platform']);
|
|
69
|
+
|
|
70
|
+
export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachmentPolicySchema>;
|
|
71
|
+
|
|
72
|
+
/**
|
|
73
|
+
* Which authenticators a deployment will enrol.
|
|
74
|
+
*
|
|
75
|
+
* `attachment` is the standing default for the browser picker at registration.
|
|
76
|
+
* `any` offers both built-in and roaming authenticators, which is what a
|
|
77
|
+
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
78
|
+
* and also bounds what a per-request override may ask for.
|
|
79
|
+
*/
|
|
80
|
+
export const AuthenticatorPolicySchema = z.object({
|
|
81
|
+
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
82
|
+
});
|
|
83
|
+
|
|
84
|
+
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
85
|
+
|
|
86
|
+
export const DefaultAuthenticatorPolicy = {
|
|
87
|
+
attachment: 'any',
|
|
88
|
+
} as const;
|
|
89
|
+
|
|
68
90
|
export const SystemConfigSchema = z.object({
|
|
69
91
|
app_name: z.string().min(3),
|
|
70
92
|
default_roles: z.array(RoleNameSchema).min(1),
|
|
@@ -73,6 +95,7 @@ export const SystemConfigSchema = z.object({
|
|
|
73
95
|
passkey_login_fallback_enabled: z.boolean(),
|
|
74
96
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
75
97
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
98
|
+
authenticator_policy: AuthenticatorPolicySchema.default(DefaultAuthenticatorPolicy),
|
|
76
99
|
|
|
77
100
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
78
101
|
refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
@@ -98,6 +121,7 @@ export const SystemConfigPatchSchema = z
|
|
|
98
121
|
SystemConfigSchema.shape.passkey_login_fallback_enabled.optional(),
|
|
99
122
|
oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
|
|
100
123
|
lockout_policy: LockoutPolicySchema.optional(),
|
|
124
|
+
authenticator_policy: AuthenticatorPolicySchema.optional(),
|
|
101
125
|
access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
|
|
102
126
|
refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
|
|
103
127
|
rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
|