@seamless-auth/types 0.7.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +53 -0
- package/dist/schemas/admin/schema.d.ts +37 -0
- package/dist/schemas/admin/schema.d.ts.map +1 -1
- package/dist/schemas/admin/schema.js +33 -0
- package/dist/schemas/admin/schema.js.map +1 -1
- package/dist/schemas/systemConfig/schema.d.ts +4 -0
- package/dist/schemas/systemConfig/schema.d.ts.map +1 -1
- package/dist/schemas/systemConfig/schema.js +10 -0
- package/dist/schemas/systemConfig/schema.js.map +1 -1
- package/package.json +1 -1
- package/src/schemas/admin/schema.ts +39 -0
- package/src/schemas/systemConfig/schema.ts +12 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,58 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.9.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- da415ff: Require identity proofing on admin-assisted device replacement.
|
|
8
|
+
|
|
9
|
+
**Breaking for callers of `DeviceReplacementRecoverySchema`.** The schema now
|
|
10
|
+
requires a `proofing` object:
|
|
11
|
+
|
|
12
|
+
```ts
|
|
13
|
+
proofing: {
|
|
14
|
+
method: 'in_person' | 'remote_exception';
|
|
15
|
+
evidenceRef: string; // a ticket or case number, not the evidence itself
|
|
16
|
+
approver?: string; // required when method is 'remote_exception'
|
|
17
|
+
}
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
Admin-assisted recovery revokes every session, removes every passkey and
|
|
21
|
+
disables TOTP, so it is the step social engineering aims at. It previously
|
|
22
|
+
carried no record of how the operator established who they were talking to, which
|
|
23
|
+
made a recovery impossible to review after the fact.
|
|
24
|
+
|
|
25
|
+
`in_person` is the default path and needs no approver. `remote_exception` is the
|
|
26
|
+
documented exception and does not validate without a named approver, so taking
|
|
27
|
+
the weaker path is a deliberate act with someone's name attached.
|
|
28
|
+
|
|
29
|
+
`evidenceRef` is a pointer rather than the evidence. It ends up in the audit
|
|
30
|
+
trail, where identifiers are redacted, so personal data does not belong in it.
|
|
31
|
+
|
|
32
|
+
Callers sending `{}` and relying on the clearing defaults will now fail
|
|
33
|
+
validation. Those defaults are unchanged.
|
|
34
|
+
|
|
35
|
+
## 0.8.0
|
|
36
|
+
|
|
37
|
+
### Minor Changes
|
|
38
|
+
|
|
39
|
+
- 6fe9671: Add `session_idle_ttl` to the system configuration.
|
|
40
|
+
|
|
41
|
+
A session can now be bounded by how long it goes unrefreshed, separately from
|
|
42
|
+
its absolute lifetime:
|
|
43
|
+
|
|
44
|
+
```ts
|
|
45
|
+
session_idle_ttl: string; // "\d+[smhd]", defaults to "8h"
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
The absolute session lifetime stays `refresh_token_ttl`, since the refresh token
|
|
49
|
+
is the session credential. `session_idle_ttl` is the idle bound underneath it,
|
|
50
|
+
and it only does anything when it is the shorter of the two.
|
|
51
|
+
|
|
52
|
+
Additive and backward compatible: config that predates the key parses to `8h`.
|
|
53
|
+
The key is accepted by the strict patch schema, and deliberately carries no
|
|
54
|
+
default there, so a patch that does not mention it leaves the stored value alone.
|
|
55
|
+
|
|
3
56
|
## 0.7.0
|
|
4
57
|
|
|
5
58
|
### Minor Changes
|
|
@@ -3,15 +3,52 @@ export declare const UserIdParamSchema: z.ZodObject<{
|
|
|
3
3
|
userId: z.ZodString;
|
|
4
4
|
}, z.core.$strip>;
|
|
5
5
|
export type UserIdParam = z.infer<typeof UserIdParamSchema>;
|
|
6
|
+
export declare const RecoveryProofingMethodSchema: z.ZodEnum<{
|
|
7
|
+
in_person: "in_person";
|
|
8
|
+
remote_exception: "remote_exception";
|
|
9
|
+
}>;
|
|
10
|
+
export type RecoveryProofingMethod = z.infer<typeof RecoveryProofingMethodSchema>;
|
|
11
|
+
/**
|
|
12
|
+
* How the operator established that the person asking is who they say they are.
|
|
13
|
+
*
|
|
14
|
+
* Admin-assisted recovery revokes every session, removes every passkey and
|
|
15
|
+
* disables TOTP, so it is the step social engineering aims at. Recording the
|
|
16
|
+
* proofing makes a recovery reviewable after the fact and forces the operator to
|
|
17
|
+
* have done it.
|
|
18
|
+
*
|
|
19
|
+
* `evidenceRef` is a pointer, for example a ticket or case number, not the
|
|
20
|
+
* evidence itself. Do not put personal data here: it is written to the audit
|
|
21
|
+
* trail, where identifiers are redacted.
|
|
22
|
+
*/
|
|
23
|
+
export declare const RecoveryProofingSchema: z.ZodObject<{
|
|
24
|
+
method: z.ZodEnum<{
|
|
25
|
+
in_person: "in_person";
|
|
26
|
+
remote_exception: "remote_exception";
|
|
27
|
+
}>;
|
|
28
|
+
evidenceRef: z.ZodString;
|
|
29
|
+
approver: z.ZodOptional<z.ZodString>;
|
|
30
|
+
}, z.core.$strict>;
|
|
31
|
+
export type RecoveryProofing = z.infer<typeof RecoveryProofingSchema>;
|
|
6
32
|
/**
|
|
7
33
|
* What an operator clears when a user replaces a lost device. Each step is
|
|
8
34
|
* opt-out rather than opt-in so a hurried recovery does not leave the old
|
|
9
35
|
* device's credentials in place.
|
|
36
|
+
*
|
|
37
|
+
* `proofing` is required: this endpoint cannot be called without stating how
|
|
38
|
+
* identity was established.
|
|
10
39
|
*/
|
|
11
40
|
export declare const DeviceReplacementRecoverySchema: z.ZodObject<{
|
|
12
41
|
revokeSessions: z.ZodDefault<z.ZodBoolean>;
|
|
13
42
|
removePasskeys: z.ZodDefault<z.ZodBoolean>;
|
|
14
43
|
disableTotp: z.ZodDefault<z.ZodBoolean>;
|
|
44
|
+
proofing: z.ZodObject<{
|
|
45
|
+
method: z.ZodEnum<{
|
|
46
|
+
in_person: "in_person";
|
|
47
|
+
remote_exception: "remote_exception";
|
|
48
|
+
}>;
|
|
49
|
+
evidenceRef: z.ZodString;
|
|
50
|
+
approver: z.ZodOptional<z.ZodString>;
|
|
51
|
+
}, z.core.$strict>;
|
|
15
52
|
}, z.core.$strict>;
|
|
16
53
|
export type DeviceReplacementRecoveryRequest = z.infer<typeof DeviceReplacementRecoverySchema>;
|
|
17
54
|
export declare const DeviceReplacementRecoveryResponseSchema: z.ZodObject<{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -6,16 +6,49 @@ import { ApiUserSchema } from '../user/schema.js';
|
|
|
6
6
|
export const UserIdParamSchema = z.object({
|
|
7
7
|
userId: z.string(),
|
|
8
8
|
});
|
|
9
|
+
export const RecoveryProofingMethodSchema = z.enum(['in_person', 'remote_exception']);
|
|
10
|
+
/**
|
|
11
|
+
* How the operator established that the person asking is who they say they are.
|
|
12
|
+
*
|
|
13
|
+
* Admin-assisted recovery revokes every session, removes every passkey and
|
|
14
|
+
* disables TOTP, so it is the step social engineering aims at. Recording the
|
|
15
|
+
* proofing makes a recovery reviewable after the fact and forces the operator to
|
|
16
|
+
* have done it.
|
|
17
|
+
*
|
|
18
|
+
* `evidenceRef` is a pointer, for example a ticket or case number, not the
|
|
19
|
+
* evidence itself. Do not put personal data here: it is written to the audit
|
|
20
|
+
* trail, where identifiers are redacted.
|
|
21
|
+
*/
|
|
22
|
+
export const RecoveryProofingSchema = z
|
|
23
|
+
.object({
|
|
24
|
+
method: RecoveryProofingMethodSchema,
|
|
25
|
+
evidenceRef: z.string().trim().min(1).max(200),
|
|
26
|
+
approver: z.string().trim().min(1).max(200).optional(),
|
|
27
|
+
})
|
|
28
|
+
.strict()
|
|
29
|
+
.superRefine((value, ctx) => {
|
|
30
|
+
if (value.method === 'remote_exception' && !value.approver) {
|
|
31
|
+
ctx.addIssue({
|
|
32
|
+
code: 'custom',
|
|
33
|
+
path: ['approver'],
|
|
34
|
+
message: 'A remote exception requires a named approver',
|
|
35
|
+
});
|
|
36
|
+
}
|
|
37
|
+
});
|
|
9
38
|
/**
|
|
10
39
|
* What an operator clears when a user replaces a lost device. Each step is
|
|
11
40
|
* opt-out rather than opt-in so a hurried recovery does not leave the old
|
|
12
41
|
* device's credentials in place.
|
|
42
|
+
*
|
|
43
|
+
* `proofing` is required: this endpoint cannot be called without stating how
|
|
44
|
+
* identity was established.
|
|
13
45
|
*/
|
|
14
46
|
export const DeviceReplacementRecoverySchema = z
|
|
15
47
|
.object({
|
|
16
48
|
revokeSessions: z.boolean().default(true),
|
|
17
49
|
removePasskeys: z.boolean().default(true),
|
|
18
50
|
disableTotp: z.boolean().default(true),
|
|
51
|
+
proofing: RecoveryProofingSchema,
|
|
19
52
|
})
|
|
20
53
|
.strict();
|
|
21
54
|
export const DeviceReplacementRecoveryResponseSchema = z.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAItF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,4BAA4B;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,QAAQ,EAAE,sBAAsB;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxD,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC"}
|
|
@@ -122,6 +122,7 @@ export declare const SystemConfigSchema: z.ZodObject<{
|
|
|
122
122
|
}>>;
|
|
123
123
|
}, z.core.$strip>>;
|
|
124
124
|
access_token_ttl: z.ZodString;
|
|
125
|
+
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
125
126
|
refresh_token_ttl: z.ZodString;
|
|
126
127
|
rate_limit: z.ZodNumber;
|
|
127
128
|
delay_after: z.ZodNumber;
|
|
@@ -180,6 +181,7 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
|
|
|
180
181
|
}>>;
|
|
181
182
|
}, z.core.$strip>>;
|
|
182
183
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
184
|
+
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
183
185
|
refresh_token_ttl: z.ZodOptional<z.ZodString>;
|
|
184
186
|
rate_limit: z.ZodOptional<z.ZodNumber>;
|
|
185
187
|
delay_after: z.ZodOptional<z.ZodNumber>;
|
|
@@ -241,6 +243,7 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
|
|
|
241
243
|
}>>;
|
|
242
244
|
}, z.core.$strip>>;
|
|
243
245
|
access_token_ttl: z.ZodOptional<z.ZodString>;
|
|
246
|
+
session_idle_ttl: z.ZodOptional<z.ZodString>;
|
|
244
247
|
refresh_token_ttl: z.ZodOptional<z.ZodString>;
|
|
245
248
|
rate_limit: z.ZodOptional<z.ZodNumber>;
|
|
246
249
|
delay_after: z.ZodOptional<z.ZodNumber>;
|
|
@@ -409,6 +412,7 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
|
|
|
409
412
|
}>>;
|
|
410
413
|
}, z.core.$strip>>;
|
|
411
414
|
access_token_ttl: z.ZodString;
|
|
415
|
+
session_idle_ttl: z.ZodDefault<z.ZodString>;
|
|
412
416
|
refresh_token_ttl: z.ZodString;
|
|
413
417
|
rate_limit: z.ZodNumber;
|
|
414
418
|
delay_after: z.ZodNumber;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;iBAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;CAE7B,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,aAAwC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAsBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;iBAEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;CAE7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAK9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAE3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -66,6 +66,7 @@ export const AuthenticatorPolicySchema = z.object({
|
|
|
66
66
|
export const DefaultAuthenticatorPolicy = {
|
|
67
67
|
attachment: 'any',
|
|
68
68
|
};
|
|
69
|
+
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
69
70
|
export const SystemConfigSchema = z.object({
|
|
70
71
|
app_name: z.string().min(3),
|
|
71
72
|
default_roles: z.array(RoleNameSchema).min(1),
|
|
@@ -76,6 +77,14 @@ export const SystemConfigSchema = z.object({
|
|
|
76
77
|
lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
|
|
77
78
|
authenticator_policy: AuthenticatorPolicySchema.default(DefaultAuthenticatorPolicy),
|
|
78
79
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
80
|
+
/**
|
|
81
|
+
* How long a session may live without being refreshed.
|
|
82
|
+
*
|
|
83
|
+
* The absolute session lifetime is `refresh_token_ttl`, since the refresh token
|
|
84
|
+
* is the session credential. This is the idle bound underneath it, and it only
|
|
85
|
+
* does anything when it is shorter, so keep the two distinct.
|
|
86
|
+
*/
|
|
87
|
+
session_idle_ttl: DurationSchema.default('8h'),
|
|
79
88
|
refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
80
89
|
rate_limit: z.number().int().positive(),
|
|
81
90
|
delay_after: z.number().int().nonnegative(),
|
|
@@ -94,6 +103,7 @@ export const SystemConfigPatchSchema = z
|
|
|
94
103
|
lockout_policy: LockoutPolicySchema.optional(),
|
|
95
104
|
authenticator_policy: AuthenticatorPolicySchema.optional(),
|
|
96
105
|
access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
|
|
106
|
+
session_idle_ttl: DurationSchema.optional(),
|
|
97
107
|
refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
|
|
98
108
|
rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
|
|
99
109
|
delay_after: SystemConfigSchema.shape.delay_after.optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAEnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAI3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;CACT,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAEnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAIH,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KAClF,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -10,16 +10,55 @@ export const UserIdParamSchema = z.object({
|
|
|
10
10
|
|
|
11
11
|
export type UserIdParam = z.infer<typeof UserIdParamSchema>;
|
|
12
12
|
|
|
13
|
+
export const RecoveryProofingMethodSchema = z.enum(['in_person', 'remote_exception']);
|
|
14
|
+
|
|
15
|
+
export type RecoveryProofingMethod = z.infer<typeof RecoveryProofingMethodSchema>;
|
|
16
|
+
|
|
17
|
+
/**
|
|
18
|
+
* How the operator established that the person asking is who they say they are.
|
|
19
|
+
*
|
|
20
|
+
* Admin-assisted recovery revokes every session, removes every passkey and
|
|
21
|
+
* disables TOTP, so it is the step social engineering aims at. Recording the
|
|
22
|
+
* proofing makes a recovery reviewable after the fact and forces the operator to
|
|
23
|
+
* have done it.
|
|
24
|
+
*
|
|
25
|
+
* `evidenceRef` is a pointer, for example a ticket or case number, not the
|
|
26
|
+
* evidence itself. Do not put personal data here: it is written to the audit
|
|
27
|
+
* trail, where identifiers are redacted.
|
|
28
|
+
*/
|
|
29
|
+
export const RecoveryProofingSchema = z
|
|
30
|
+
.object({
|
|
31
|
+
method: RecoveryProofingMethodSchema,
|
|
32
|
+
evidenceRef: z.string().trim().min(1).max(200),
|
|
33
|
+
approver: z.string().trim().min(1).max(200).optional(),
|
|
34
|
+
})
|
|
35
|
+
.strict()
|
|
36
|
+
.superRefine((value, ctx) => {
|
|
37
|
+
if (value.method === 'remote_exception' && !value.approver) {
|
|
38
|
+
ctx.addIssue({
|
|
39
|
+
code: 'custom',
|
|
40
|
+
path: ['approver'],
|
|
41
|
+
message: 'A remote exception requires a named approver',
|
|
42
|
+
});
|
|
43
|
+
}
|
|
44
|
+
});
|
|
45
|
+
|
|
46
|
+
export type RecoveryProofing = z.infer<typeof RecoveryProofingSchema>;
|
|
47
|
+
|
|
13
48
|
/**
|
|
14
49
|
* What an operator clears when a user replaces a lost device. Each step is
|
|
15
50
|
* opt-out rather than opt-in so a hurried recovery does not leave the old
|
|
16
51
|
* device's credentials in place.
|
|
52
|
+
*
|
|
53
|
+
* `proofing` is required: this endpoint cannot be called without stating how
|
|
54
|
+
* identity was established.
|
|
17
55
|
*/
|
|
18
56
|
export const DeviceReplacementRecoverySchema = z
|
|
19
57
|
.object({
|
|
20
58
|
revokeSessions: z.boolean().default(true),
|
|
21
59
|
removePasskeys: z.boolean().default(true),
|
|
22
60
|
disableTotp: z.boolean().default(true),
|
|
61
|
+
proofing: RecoveryProofingSchema,
|
|
23
62
|
})
|
|
24
63
|
.strict();
|
|
25
64
|
|
|
@@ -87,6 +87,8 @@ export const DefaultAuthenticatorPolicy = {
|
|
|
87
87
|
attachment: 'any',
|
|
88
88
|
} as const;
|
|
89
89
|
|
|
90
|
+
const DurationSchema = z.string().regex(/^\d+[smhd]$/);
|
|
91
|
+
|
|
90
92
|
export const SystemConfigSchema = z.object({
|
|
91
93
|
app_name: z.string().min(3),
|
|
92
94
|
default_roles: z.array(RoleNameSchema).min(1),
|
|
@@ -98,6 +100,15 @@ export const SystemConfigSchema = z.object({
|
|
|
98
100
|
authenticator_policy: AuthenticatorPolicySchema.default(DefaultAuthenticatorPolicy),
|
|
99
101
|
|
|
100
102
|
access_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
103
|
+
|
|
104
|
+
/**
|
|
105
|
+
* How long a session may live without being refreshed.
|
|
106
|
+
*
|
|
107
|
+
* The absolute session lifetime is `refresh_token_ttl`, since the refresh token
|
|
108
|
+
* is the session credential. This is the idle bound underneath it, and it only
|
|
109
|
+
* does anything when it is shorter, so keep the two distinct.
|
|
110
|
+
*/
|
|
111
|
+
session_idle_ttl: DurationSchema.default('8h'),
|
|
101
112
|
refresh_token_ttl: z.string().regex(/^\d+[smhd]$/),
|
|
102
113
|
|
|
103
114
|
rate_limit: z.number().int().positive(),
|
|
@@ -123,6 +134,7 @@ export const SystemConfigPatchSchema = z
|
|
|
123
134
|
lockout_policy: LockoutPolicySchema.optional(),
|
|
124
135
|
authenticator_policy: AuthenticatorPolicySchema.optional(),
|
|
125
136
|
access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
|
|
137
|
+
session_idle_ttl: DurationSchema.optional(),
|
|
126
138
|
refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
|
|
127
139
|
rate_limit: SystemConfigSchema.shape.rate_limit.optional(),
|
|
128
140
|
delay_after: SystemConfigSchema.shape.delay_after.optional(),
|