@webda/auth 0.0.0-stage → 4.0.0-beta.10

package/webda.module.json

@@ -0,0 +1,891 @@
+{
+  "$schema": "https://webda.io/schemas/webda.module.v4.json",
+  "beans": {},
+  "deployers": {},
+  "moddas": {
+    "Webda/Authentication": {
+      "Import": "lib/authentication.service:Authentication",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "definitions": {
+          "AuthenticationCompatibility": {
+            "additionalProperties": false,
+            "description": "v3 data compatibility options",
+            "properties": {
+              "v3": {
+                "default": true,
+                "description": "Read and write v3 data layouts",
+                "type": "boolean"
+              }
+            },
+            "type": "object"
+          }
+        },
+        "description": "Authentication parameters",
+        "properties": {
+          "compatibility": {
+            "$ref": "#/definitions/AuthenticationCompatibility",
+            "default": {
+              "v3": true
+            },
+            "description": "v3 data compatibility"
+          },
+          "identModel": {
+            "default": "Webda/Ident",
+            "description": "Ident model",
+            "type": "string"
+          },
+          "linking": {
+            "default": "verified",
+            "description": "Linking policy",
+            "enum": [
+              "never",
+              "verified",
+              "always"
+            ],
+            "type": "string"
+          },
+          "registration": {
+            "default": true,
+            "description": "Allow automatic registration of new users",
+            "type": "boolean"
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "userModel": {
+            "default": "Webda/User",
+            "description": "User model",
+            "type": "string"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "type"
+        ],
+        "type": "object",
+        "title": "Authentication"
+      },
+      "Configuration": "lib/authentication.service:AuthenticationParameters",
+      "commands": {
+        "auth migrate": {
+          "description": "Migrate v3 authentication data (idents, users) to v4",
+          "method": "migrate",
+          "args": {
+            "dryRun": {
+              "type": "boolean",
+              "default": false,
+              "description": "Only count the records to migrate, write nothing"
+            },
+            "batch": {
+              "type": "number",
+              "default": 100,
+              "description": "Page size of the store scans"
+            }
+          },
+          "phase": "initialized"
+        }
+      }
+    },
+    "Webda/CertificateProvider": {
+      "Import": "lib/certificate/certificate.service:CertificateProvider",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "definitions": {
+          "Record<string, string[]>": {
+            "additionalProperties": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "description": "Construct a type with a set of properties K of type T",
+            "type": "object"
+          }
+        },
+        "description": "CertificateProvider parameters",
+        "properties": {
+          "allowedIssuers": {
+            "description": "Only certificates whose issuer common name or distinguished name (\"O=Webda, CN=ca\") is listed are accepted,\nundefined accepts every issuer trusted by the TLS layer",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "allowedSubjects": {
+            "description": "Only certificates whose subject distinguished name (\"O=Webda, CN=alice\") matches one of these regular\nexpressions are accepted, undefined accepts every subject",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "autoRegister": {
+            "default": false,
+            "description": "Register a user on the first request of an unknown certificate; otherwise the certificate has to be linked to\na logged user with `Auth.Certificate.Link`",
+            "type": "boolean"
+          },
+          "cacheTtl": {
+            "default": 60000,
+            "description": "How long a certificate resolved to a user is remembered, in milliseconds (0 disables the cache)",
+            "type": "number"
+          },
+          "identityField": {
+            "default": "fingerprint256",
+            "description": "Certificate field used as ident uid: the SHA-256 fingerprint pins one certificate, the other fields survive a\ncertificate renewal",
+            "enum": [
+              "fingerprint256",
+              "subject.CN",
+              "san.email",
+              "san.uri"
+            ],
+            "type": "string"
+          },
+          "mode": {
+            "default": "login",
+            "description": "`factor` only adds `mtls` to a session already authenticated as the certificate's linked user.",
+            "enum": [
+              "login",
+              "factor"
+            ],
+            "type": "string"
+          },
+          "roles": {
+            "$ref": "#/definitions/Record%3Cstring%2C%20string%5B%5D%3E",
+            "description": "Roles of the certificate sessions by subject attribute: `{ \"OU=admins\": [\"admin\"] }` gives the role admin to\ncertificates having an OU admins"
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "type"
+        ],
+        "type": "object",
+        "title": "CertificateProvider"
+      },
+      "Configuration": "lib/certificate/certificate.service:CertificateProviderParameters"
+    },
+    "Webda/EmailPasswordProvider": {
+      "Import": "lib/email/emailpassword.service:EmailPasswordProvider",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "definitions": {
+          "password": {
+            "additionalProperties": false,
+            "default": {
+              "policy": ".{8,}"
+            },
+            "description": "Password rules",
+            "properties": {
+              "policy": {
+                "default": ".{8,}",
+                "type": "string"
+              },
+              "verifier": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "redirects": {
+            "additionalProperties": false,
+            "description": "Browser redirects for emailed links (no defaults: init() refuses a missing required one). `failure` and `recover`\nare always required, `verified` and `register` unless `verification` is \"none\". `recover` receives the recovery\nlink as `?token=...` (the page then calls Auth.Password.Recover). `confirm` (default `failure`) receives a\nverification link opened without the matching session, with `?reason=LOGIN_REQUIRED&token=...`: log in then call\nAuth.Email.Verify with the token",
+            "properties": {
+              "confirm": {
+                "type": "string"
+              },
+              "failure": {
+                "type": "string"
+              },
+              "recover": {
+                "type": "string"
+              },
+              "register": {
+                "type": "string"
+              },
+              "verified": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "throttle": {
+            "additionalProperties": false,
+            "default": {
+              "failedBeforeDelay": 3,
+              "lockout": 900000,
+              "resendDelay": 14400000
+            },
+            "description": "Throttling",
+            "properties": {
+              "failedBeforeDelay": {
+                "default": 3,
+                "type": "number"
+              },
+              "lockout": {
+                "default": 900000,
+                "type": "number"
+              },
+              "resendDelay": {
+                "default": 14400000,
+                "type": "number"
+              }
+            },
+            "type": "object"
+          }
+        },
+        "description": "EmailPasswordProvider parameters",
+        "properties": {
+          "allowedEmailDomains": {
+            "description": "Only these email domains may use this provider (see ProviderEmailPolicy)",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "mailer": {
+            "default": "Mailer",
+            "description": "Mailer service name",
+            "type": "string"
+          },
+          "password": {
+            "$ref": "#/definitions/password",
+            "default": {
+              "policy": ".{8,}"
+            },
+            "description": "Password rules"
+          },
+          "redirects": {
+            "$ref": "#/definitions/redirects",
+            "description": "Browser redirects for emailed links (no defaults: init() refuses a missing required one). `failure` and `recover`\nare always required, `verified` and `register` unless `verification` is \"none\". `recover` receives the recovery\nlink as `?token=...` (the page then calls Auth.Password.Recover). `confirm` (default `failure`) receives a\nverification link opened without the matching session, with `?reason=LOGIN_REQUIRED&token=...`: log in then call\nAuth.Email.Verify with the token"
+          },
+          "throttle": {
+            "$ref": "#/definitions/throttle",
+            "default": {
+              "failedBeforeDelay": 3,
+              "lockout": 900000,
+              "resendDelay": 14400000
+            },
+            "description": "Throttling"
+          },
+          "trustEmailVerification": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "boolean"
+              }
+            ],
+            "description": "Whether the verification of the email is believed (see ProviderEmailPolicy)"
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "url": {
+            "default": "/auth/email",
+            "description": "Base url for emailed links",
+            "type": "string"
+          },
+          "verification": {
+            "default": "before",
+            "description": "Verification mode",
+            "enum": [
+              "before",
+              "after",
+              "none"
+            ],
+            "type": "string"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "redirects",
+          "type"
+        ],
+        "type": "object",
+        "title": "EmailPasswordProvider"
+      },
+      "Configuration": "lib/email/emailpassword.service:EmailPasswordParameters"
+    },
+    "Webda/TotpService": {
+      "Import": "lib/mfa/totp.service:TotpService",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "definitions": {
+          "ThrottleParameters": {
+            "additionalProperties": false,
+            "description": "Throttle configuration options",
+            "properties": {
+              "failedBeforeDelay": {
+                "description": "Failures allowed before lockout engages",
+                "type": "number"
+              },
+              "lockout": {
+                "description": "Lockout duration in milliseconds",
+                "type": "number"
+              }
+            },
+            "type": "object"
+          }
+        },
+        "description": "Parameters for TOTP service",
+        "properties": {
+          "algorithm": {
+            "default": "sha1",
+            "description": "HMAC hash algorithm (default \"sha1\")",
+            "enum": [
+              "sha1",
+              "sha256",
+              "sha512"
+            ],
+            "type": "string"
+          },
+          "digits": {
+            "description": "Number of digits (default 6)",
+            "enum": [
+              6,
+              8
+            ],
+            "type": "number"
+          },
+          "issuer": {
+            "description": "Application name / issuer shown in authenticator apps (defaults to application name)",
+            "type": "string"
+          },
+          "period": {
+            "description": "Time step in seconds (default 30)",
+            "type": "number"
+          },
+          "recoveryCodes": {
+            "description": "Number of recovery codes generated (default 10, 0 disables recovery codes)",
+            "type": "number"
+          },
+          "throttle": {
+            "$ref": "#/definitions/ThrottleParameters",
+            "description": "Throttle config for failed attempts"
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "window": {
+            "description": "Accepted drift window in time steps (default 1)",
+            "type": "number"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "type"
+        ],
+        "type": "object",
+        "title": "TotpService"
+      },
+      "Configuration": "lib/mfa/totp.service:TotpParameters"
+    }
+  },
+  "models": {},
+  "schemas": {
+    "Webda/BinaryFile": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "WebdaSchema": true,
+      "additionalProperties": false,
+      "description": "Represent a file to store",
+      "properties": {
+        "hash": {
+          "description": "Will be computed by the service\n\nhash of the content",
+          "type": "string"
+        },
+        "metadata": {
+          "description": "Metadatas stored along with the binary"
+        },
+        "mimetype": {
+          "description": "Mimetype of the binary",
+          "type": "string"
+        },
+        "name": {
+          "description": "Current name",
+          "type": "string"
+        },
+        "originalname": {
+          "description": "Original name",
+          "type": "string"
+        },
+        "size": {
+          "description": "Size of the binary",
+          "type": "number"
+        }
+      },
+      "required": [
+        "mimetype",
+        "name",
+        "size"
+      ],
+      "type": "object",
+      "title": "BinaryFile"
+    },
+    "Webda/OAuthTokenRequest": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "WebdaSchema": true,
+      "additionalProperties": false,
+      "definitions": {
+        "OAuthTokens": {
+          "additionalProperties": {},
+          "description": "Credentials as returned by an OAuth token endpoint (google-auth-library `Credentials` shape): `id_token`,\n`access_token`, `refresh_token`, `expiry_date`, `token_type`, `scope`... Values are not typed by the schema\n(providers send nulls); providers check what they use.",
+          "type": "object"
+        }
+      },
+      "description": "Input of the `Auth.<Provider>.Token` operations: `token`, or the provider credentials `tokens`",
+      "properties": {
+        "token": {
+          "description": "Token issued by the provider to the client (an ID token for OpenID Connect providers)",
+          "type": "string"
+        },
+        "tokens": {
+          "$ref": "#/definitions/OAuthTokens",
+          "description": "Credentials obtained by the client from the provider (v3 body; its `id_token` is verified)"
+        }
+      },
+      "type": "object",
+      "title": "OAuthTokenRequest"
+    },
+    "Authentication.providers.input": {
+      "type": "object",
+      "properties": {}
+    },
+    "Authentication.providers.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "items": {
+        "$ref": "#/definitions/ProviderInfo"
+      },
+      "type": "array",
+      "definitions": {
+        "ProviderInfo": {
+          "additionalProperties": false,
+          "description": "Describe an authentication provider exposed by an authentication service",
+          "properties": {
+            "name": {
+              "description": "Provider name",
+              "type": "string"
+            },
+            "startUrl": {
+              "description": "URL to start the authentication flow (oauth, passwordless)",
+              "type": "string"
+            },
+            "type": {
+              "description": "Provider type",
+              "enum": [
+                "password",
+                "oauth",
+                "passwordless",
+                "certificate"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "name",
+            "type"
+          ],
+          "type": "object"
+        }
+      }
+    },
+    "Authentication.me.input": {
+      "type": "object",
+      "properties": {}
+    },
+    "Authentication.me.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#"
+    },
+    "Authentication.logout.input": {
+      "type": "object",
+      "properties": {}
+    },
+    "Authentication.logout.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    },
+    "Authentication.refresh.input": {
+      "type": "object",
+      "properties": {
+        "refreshToken": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "refreshToken"
+      ]
+    },
+    "Authentication.refresh.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "additionalProperties": false,
+      "description": "Tokens returned by a successful login or refresh",
+      "properties": {
+        "accessToken": {
+          "type": "string"
+        },
+        "expiresIn": {
+          "type": "number"
+        },
+        "refreshToken": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "accessToken",
+        "expiresIn",
+        "refreshToken"
+      ],
+      "type": "object"
+    },
+    "Authentication.idents.input": {
+      "type": "object",
+      "properties": {}
+    },
+    "Authentication.idents.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "items": {
+        "$ref": "#/definitions/%5B%5D"
+      },
+      "type": "array",
+      "definitions": {
+        "[]": {
+          "additionalProperties": false,
+          "properties": {
+            "email": {
+              "type": "string"
+            },
+            "lastUsedAt": {
+              "format": "date-time",
+              "type": "string"
+            },
+            "provider": {
+              "type": "string"
+            },
+            "providerUid": {
+              "type": "string"
+            },
+            "verifiedAt": {
+              "format": "date-time",
+              "type": "string"
+            }
+          },
+          "required": [
+            "provider",
+            "providerUid"
+          ],
+          "type": "object"
+        }
+      }
+    },
+    "Authentication.unlink.input": {
+      "type": "object",
+      "properties": {
+        "provider": {
+          "type": "string"
+        },
+        "providerUid": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "provider",
+        "providerUid"
+      ]
+    },
+    "Authentication.unlink.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    },
+    "CertificateProvider.link.input": {
+      "type": "object",
+      "properties": {}
+    },
+    "CertificateProvider.link.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "anyOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "accessToken": {
+              "type": "string"
+            },
+            "expiresIn": {
+              "type": "number"
+            },
+            "refreshToken": {
+              "type": "string"
+            },
+            "status": {
+              "const": "ok",
+              "type": "string"
+            },
+            "user": {}
+          },
+          "required": [
+            "accessToken",
+            "expiresIn",
+            "refreshToken",
+            "status",
+            "user"
+          ],
+          "type": "object"
+        },
+        {
+          "$ref": "#/definitions/%232"
+        },
+        {
+          "$ref": "#/definitions/%233"
+        }
+      ],
+      "definitions": {
+        "#2": {
+          "additionalProperties": false,
+          "properties": {
+            "methods": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "status": {
+              "const": "mfa_required",
+              "type": "string"
+            }
+          },
+          "required": [
+            "methods",
+            "status"
+          ],
+          "type": "object"
+        },
+        "#3": {
+          "additionalProperties": false,
+          "properties": {
+            "status": {
+              "const": "linked",
+              "type": "string"
+            }
+          },
+          "required": [
+            "status"
+          ],
+          "type": "object"
+        }
+      }
+    },
+    "EmailPasswordProvider.login.input": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        },
+        "password": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "email",
+        "password"
+      ]
+    },
+    "EmailPasswordProvider.login.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "anyOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "accessToken": {
+              "type": "string"
+            },
+            "expiresIn": {
+              "type": "number"
+            },
+            "refreshToken": {
+              "type": "string"
+            },
+            "status": {
+              "const": "ok",
+              "type": "string"
+            },
+            "user": {}
+          },
+          "required": [
+            "accessToken",
+            "expiresIn",
+            "refreshToken",
+            "status",
+            "user"
+          ],
+          "type": "object"
+        },
+        {
+          "$ref": "#/definitions/%232"
+        }
+      ],
+      "description": "Result of an authentication completion",
+      "definitions": {
+        "#2": {
+          "additionalProperties": false,
+          "properties": {
+            "methods": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "status": {
+              "const": "mfa_required",
+              "type": "string"
+            }
+          },
+          "required": [
+            "methods",
+            "status"
+          ],
+          "type": "object"
+        }
+      }
+    },
+    "EmailPasswordProvider.register.input": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        },
+        "password": {
+          "type": "string"
+        },
+        "token": {
+          "type": "string"
+        },
+        "profile": {}
+      },
+      "required": [
+        "email",
+        "password"
+      ]
+    },
+    "EmailPasswordProvider.register.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#"
+    },
+    "EmailPasswordProvider.startVerification.input": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "email"
+      ]
+    },
+    "EmailPasswordProvider.startVerification.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    },
+    "EmailPasswordProvider.verify.input": {
+      "type": "object",
+      "properties": {
+        "token": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "token"
+      ]
+    },
+    "EmailPasswordProvider.verify.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "additionalProperties": false,
+      "properties": {
+        "status": {
+          "const": "verified",
+          "type": "string"
+        }
+      },
+      "required": [
+        "status"
+      ],
+      "type": "object"
+    },
+    "EmailPasswordProvider.startRecovery.input": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "email"
+      ]
+    },
+    "EmailPasswordProvider.startRecovery.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    },
+    "EmailPasswordProvider.recover.input": {
+      "type": "object",
+      "properties": {
+        "token": {
+          "type": "string"
+        },
+        "password": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "token",
+        "password"
+      ]
+    },
+    "EmailPasswordProvider.recover.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    },
+    "EmailPasswordProvider.changePassword.input": {
+      "type": "object",
+      "properties": {
+        "current": {
+          "type": "string"
+        },
+        "next": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "current",
+        "next"
+      ]
+    },
+    "EmailPasswordProvider.changePassword.output": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "not": {}
+    }
+  },
+  "behaviors": {}
+}