@seamless-auth/types 0.6.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +50 -0
- package/dist/schemas/systemConfig/schema.d.ts +57 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +27 -0
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/systemConfig/schema.ts +36 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,55 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.8.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 6fe9671: Add `session_idle_ttl` to the system configuration.
|
|
8
|
+
|
|
9
|
+
A session can now be bounded by how long it goes unrefreshed, separately from
|
|
10
|
+
its absolute lifetime:
|
|
11
|
+
|
|
12
|
+
```ts
|
|
13
|
+
session_idle_ttl: string; // "\d+[smhd]", defaults to "8h"
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
The absolute session lifetime stays `refresh_token_ttl`, since the refresh token
|
|
17
|
+
is the session credential. `session_idle_ttl` is the idle bound underneath it,
|
|
18
|
+
and it only does anything when it is the shorter of the two.
|
|
19
|
+
|
|
20
|
+
Additive and backward compatible: config that predates the key parses to `8h`.
|
|
21
|
+
The key is accepted by the strict patch schema, and deliberately carries no
|
|
22
|
+
default there, so a patch that does not mention it leaves the stored value alone.
|
|
23
|
+
|
|
24
|
+
## 0.7.0
|
|
25
|
+
|
|
26
|
+
### Minor Changes
|
|
27
|
+
|
|
28
|
+
- fef7f2c: Add `authenticator_policy` to the system configuration.
|
|
29
|
+
|
|
30
|
+
A deployment can now state which authenticators it will enrol, rather than the
|
|
31
|
+
decision being fixed in the auth server. The block starts with one field:
|
|
32
|
+
|
|
33
|
+
```ts
|
|
34
|
+
authenticator_policy: {
|
|
35
|
+
attachment: 'any' | 'platform' | 'cross-platform';
|
|
36
|
+
}
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
`attachment` is the standing default for the browser picker at registration.
|
|
40
|
+
`any`, the default, offers both built-in and roaming authenticators, which is
|
|
41
|
+
what a deployment issuing hardware security keys needs. Naming one narrows the
|
|
42
|
+
picker and bounds what a per-request override may ask for.
|
|
43
|
+
|
|
44
|
+
Additive and backward compatible: config that predates the key parses to
|
|
45
|
+
`{ attachment: 'any' }`, which is the behaviour callers already had. The key is
|
|
46
|
+
also accepted by the strict patch schema, so it is editable through the admin
|
|
47
|
+
config route.
|
|
48
|
+
|
|
49
|
+
Introduced as a block rather than a single key because authenticator policy is
|
|
50
|
+
expected to grow: synced passkey posture and AAGUID allow and deny lists belong
|
|
51
|
+
in the same place, and adding them later should not mean migrating config twice.
|
|
52
|
+
|
|
3
53
|
## 0.6.0
|
|
4
54
|
|
|
5
55
|
### Minor Changes
|
|
@@ -47,6 +47,31 @@ export declare const DefaultLockoutPolicy: {
|
|
|
47
47
|
readonly windowSeconds: number;
|
|
48
48
|
readonly lockoutSeconds: number;
|
|
49
49
|
};
|
|
50
|
+
export declare const AuthenticatorAttachmentPolicySchema: z.ZodEnum<{
|
|
51
|
+
"cross-platform": "cross-platform";
|
|
52
|
+
platform: "platform";
|
|
53
|
+
any: "any";
|
|
54
|
+
}>;
|
|
55
|
+
export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachmentPolicySchema>;
|
|
56
|
+
/**
|
|
57
|
+
* Which authenticators a deployment will enrol.
|
|
58
|
+
*
|
|
59
|
+
* `attachment` is the standing default for the browser picker at registration.
|
|
60
|
+
* `any` offers both built-in and roaming authenticators, which is what a
|
|
61
|
+
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
62
|
+
* and also bounds what a per-request override may ask for.
|
|
63
|
+
*/
|
|
64
|
+
export declare const AuthenticatorPolicySchema: z.ZodObject<{
|
|
65
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
66
|
+
"cross-platform": "cross-platform";
|
|
67
|
+
platform: "platform";
|
|
68
|
+
any: "any";
|
|
69
|
+
}>>;
|
|
70
|
+
}, z.core.$strip>;
|
|
71
|
+
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
72
|
+
export declare const DefaultAuthenticatorPolicy: {
|
|
73
|
+
readonly attachment: "any";
|
|
74
|
+
};
|
|
50
75
|
export declare const SystemConfigSchema: z.ZodObject<{
|
|
51
76
|
app_name: z.ZodString;
|
|
52
77
|
default_roles: z.ZodArray<z.ZodString>;
|
|
@@ -89,7 +114,15 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
89
114
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
90
115
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
91
116
|
}, z.core.$strip>>;
|
|
117
|
+
authenticator_policy: z.ZodDefault<z.ZodObject<{
|
|
118
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
119
|
+
"cross-platform": "cross-platform";
|
|
120
|
+
platform: "platform";
|
|
121
|
+
any: "any";
|
|
122
|
+
}>>;
|
|
123
|
+
}, z.core.$strip>>;
|
|
92
124
|
access_token_ttl: z.ZodString;
|
|
125
|
+
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
93
126
|
refresh_token_ttl: z.ZodString;
|
|
94
127
|
rate_limit: z.ZodNumber;
|
|
95
128
|
delay_after: z.ZodNumber;
|
|
@@ -140,7 +173,15 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
140
173
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
141
174
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
142
175
|
}, z.core.$strip>>;
|
|
176
|
+
authenticator_policy: z.ZodOptional<z.ZodObject<{
|
|
177
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
178
|
+
"cross-platform": "cross-platform";
|
|
179
|
+
platform: "platform";
|
|
180
|
+
any: "any";
|
|
181
|
+
}>>;
|
|
182
|
+
}, z.core.$strip>>;
|
|
143
183
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
184
|
+
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
144
185
|
refresh_token_ttl: z.ZodOptional<z.ZodString>;
|
|
145
186
|
rate_limit: z.ZodOptional<z.ZodNumber>;
|
|
146
187
|
delay_after: z.ZodOptional<z.ZodNumber>;
|
|
@@ -194,7 +235,15 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
194
235
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
195
236
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
196
237
|
}, z.core.$strip>>;
|
|
238
|
+
authenticator_policy: z.ZodOptional<z.ZodObject<{
|
|
239
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
240
|
+
"cross-platform": "cross-platform";
|
|
241
|
+
platform: "platform";
|
|
242
|
+
any: "any";
|
|
243
|
+
}>>;
|
|
244
|
+
}, z.core.$strip>>;
|
|
197
245
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
246
|
+
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
198
247
|
refresh_token_ttl: z.ZodOptional<z.ZodString>;
|
|
199
248
|
rate_limit: z.ZodOptional<z.ZodNumber>;
|
|
200
249
|
delay_after: z.ZodOptional<z.ZodNumber>;
|
|
@@ -355,7 +404,15 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
355
404
|
windowSeconds: z.ZodDefault<z.ZodNumber>;
|
|
356
405
|
lockoutSeconds: z.ZodDefault<z.ZodNumber>;
|
|
357
406
|
}, z.core.$strip>>;
|
|
407
|
+
authenticator_policy: z.ZodDefault<z.ZodObject<{
|
|
408
|
+
attachment: z.ZodDefault<z.ZodEnum<{
|
|
409
|
+
"cross-platform": "cross-platform";
|
|
410
|
+
platform: "platform";
|
|
411
|
+
any: "any";
|
|
412
|
+
}>>;
|
|
413
|
+
}, z.core.$strip>>;
|
|
358
414
|
access_token_ttl: z.ZodString;
|
|
415
|
+
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
359
416
|
refresh_token_ttl: z.ZodString;
|
|
360
417
|
rate_limit: z.ZodNumber;
|
|
361
418
|
delay_after: z.ZodNumber;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,kBAAkB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;iBAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;CAE7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -51,6 +51,22 @@ export const DefaultLockoutPolicy = {
|
|
|
51
51
|
windowSeconds: 15 * 60,
|
|
52
52
|
lockoutSeconds: 15 * 60,
|
|
53
53
|
};
|
|
54
|
+
export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'cross-platform']);
|
|
55
|
+
/**
|
|
56
|
+
* Which authenticators a deployment will enrol.
|
|
57
|
+
*
|
|
58
|
+
* `attachment` is the standing default for the browser picker at registration.
|
|
59
|
+
* `any` offers both built-in and roaming authenticators, which is what a
|
|
60
|
+
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
61
|
+
* and also bounds what a per-request override may ask for.
|
|
62
|
+
*/
|
|
63
|
+
export const AuthenticatorPolicySchema = z.object({
|
|
64
|
+
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
65
|
+
});
|
|
66
|
+
export const DefaultAuthenticatorPolicy = {
|
|
67
|
+
attachment: 'any',
|
|
68
|
+
};
|
|
69
|
+
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
54
70
|
export const SystemConfigSchema = z.object({
|
|
55
71
|
app_name: z.string().min(3),
|
|
56
72
|
default_roles: z.array(RoleNameSchema).min(1),
|
|
@@ -59,7 +75,16 @@ export const SystemConfigSchema = z.object({
|
|
|
59
75
|
passkey_login_fallback_enabled: z.boolean(),
|
|
60
76
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
61
77
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
78
|
+
authenticator_policy: AuthenticatorPolicySchema.default(DefaultAuthenticatorPolicy),
|
|
62
79
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
80
|
+
/**
|
|
81
|
+
* How long a session may live without being refreshed.
|
|
82
|
+
*
|
|
83
|
+
* The absolute session lifetime is `refresh_token_ttl`, since the refresh token
|
|
84
|
+
* is the session credential. This is the idle bound underneath it, and it only
|
|
85
|
+
* does anything when it is shorter, so keep the two distinct.
|
|
86
|
+
*/
|
|
87
|
+
session_idle_ttl: DurationSchema.default('8h'),
|
|
63
88
|
refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
64
89
|
rate_limit: z.number().int().positive(),
|
|
65
90
|
delay_after: z.number().int().nonnegative(),
|
|
@@ -76,7 +101,9 @@ export const SystemConfigPatchSchema = z
|
|
|
76
101
|
passkey_login_fallback_enabled: SystemConfigSchema.shape.passkey_login_fallback_enabled.optional(),
|
|
77
102
|
oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
|
|
78
103
|
lockout_policy: LockoutPolicySchema.optional(),
|
|
104
|
+
authenticator_policy: AuthenticatorPolicySchema.optional(),
|
|
79
105
|
access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
|
|
106
|
+
session_idle_ttl: DurationSchema.optional(),
|
|
80
107
|
refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
|
|
81
108
|
rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
|
|
82
109
|
delay_after: SystemConfigSchema.shape.delay_after.optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;CACT,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAEnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -65,6 +65,30 @@ export const DefaultLockoutPolicy = {
|
|
|
65
65
|
lockoutSeconds: 15 * 60,
|
|
66
66
|
} as const;
|
|
67
67
|
|
|
68
|
+
export const AuthenticatorAttachmentPolicySchema = z.enum(['any', 'platform', 'cross-platform']);
|
|
69
|
+
|
|
70
|
+
export type AuthenticatorAttachmentPolicy = z.infer<typeof AuthenticatorAttachmentPolicySchema>;
|
|
71
|
+
|
|
72
|
+
/**
|
|
73
|
+
* Which authenticators a deployment will enrol.
|
|
74
|
+
*
|
|
75
|
+
* `attachment` is the standing default for the browser picker at registration.
|
|
76
|
+
* `any` offers both built-in and roaming authenticators, which is what a
|
|
77
|
+
* deployment issuing hardware security keys needs. Naming one narrows the picker
|
|
78
|
+
* and also bounds what a per-request override may ask for.
|
|
79
|
+
*/
|
|
80
|
+
export const AuthenticatorPolicySchema = z.object({
|
|
81
|
+
attachment: AuthenticatorAttachmentPolicySchema.default('any'),
|
|
82
|
+
});
|
|
83
|
+
|
|
84
|
+
export type AuthenticatorPolicy = z.infer<typeof AuthenticatorPolicySchema>;
|
|
85
|
+
|
|
86
|
+
export const DefaultAuthenticatorPolicy = {
|
|
87
|
+
attachment: 'any',
|
|
88
|
+
} as const;
|
|
89
|
+
|
|
90
|
+
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
91
|
+
|
|
68
92
|
export const SystemConfigSchema = z.object({
|
|
69
93
|
app_name: z.string().min(3),
|
|
70
94
|
default_roles: z.array(RoleNameSchema).min(1),
|
|
@@ -73,8 +97,18 @@ export const SystemConfigSchema = z.object({
|
|
|
73
97
|
passkey_login_fallback_enabled: z.boolean(),
|
|
74
98
|
oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
|
|
75
99
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
100
|
+
authenticator_policy: AuthenticatorPolicySchema.default(DefaultAuthenticatorPolicy),
|
|
76
101
|
|
|
77
102
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
103
|
+
|
|
104
|
+
/**
|
|
105
|
+
* How long a session may live without being refreshed.
|
|
106
|
+
*
|
|
107
|
+
* The absolute session lifetime is `refresh_token_ttl`, since the refresh token
|
|
108
|
+
* is the session credential. This is the idle bound underneath it, and it only
|
|
109
|
+
* does anything when it is shorter, so keep the two distinct.
|
|
110
|
+
*/
|
|
111
|
+
session_idle_ttl: DurationSchema.default('8h'),
|
|
78
112
|
refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
79
113
|
|
|
80
114
|
rate_limit: z.number().int().positive(),
|
|
@@ -98,7 +132,9 @@ export const SystemConfigPatchSchema = z
|
|
|
98
132
|
SystemConfigSchema.shape.passkey_login_fallback_enabled.optional(),
|
|
99
133
|
oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
|
|
100
134
|
lockout_policy: LockoutPolicySchema.optional(),
|
|
135
|
+
authenticator_policy: AuthenticatorPolicySchema.optional(),
|
|
101
136
|
access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
|
|
137
|
+
session_idle_ttl: DurationSchema.optional(),
|
|
102
138
|
refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
|
|
103
139
|
rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
|
|
104
140
|
delay_after: SystemConfigSchema.shape.delay_after.optional(),
|