@webda/auth 4.0.0-beta.11 → 4.0.0-beta.13

package/webda.module.json

@@ -255,6 +255,10 @@
             },
             "type": "array"
           },
+          "baseUrl": {
+            "description": "Optional canonical origin (e.g. \"https://api.example.com\") used to build emailed verification and recovery links\ninstead of trusting the request Host header",
+            "type": "string"
+          },
           "mailer": {
             "default": "Mailer",
             "description": "Mailer service name",
@@ -327,6 +331,91 @@
       },
       "Configuration": "lib/email/emailpassword.service:EmailPasswordParameters"
     },
+    "Webda/SmsMfaService": {
+      "Import": "lib/mfa/sms.service:SmsMfaService",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "definitions": {
+          "ThrottleParameters": {
+            "additionalProperties": false,
+            "description": "Throttle configuration options",
+            "properties": {
+              "failedBeforeDelay": {
+                "description": "Failures allowed before lockout engages",
+                "type": "number"
+              },
+              "lockout": {
+                "description": "Lockout duration in milliseconds",
+                "type": "number"
+              }
+            },
+            "type": "object"
+          }
+        },
+        "description": "Parameters for the SMS second factor",
+        "properties": {
+          "app": {
+            "description": "Application name in the message (defaults to the application package name)",
+            "type": "string"
+          },
+          "digits": {
+            "description": "Number of digits of a code",
+            "maximum": 10,
+            "minimum": 4,
+            "type": "number"
+          },
+          "message": {
+            "default": "{code} is your {app} verification code",
+            "description": "Message template, `{code}` and `{app}` are replaced",
+            "type": "string"
+          },
+          "recoveryCodes": {
+            "description": "Number of recovery codes generated (default 10, 0 disables recovery codes)",
+            "type": "number"
+          },
+          "resendDelay": {
+            "default": "60s",
+            "description": "Minimum delay between two codes sent to the same factor: seconds or a duration string such as \"60s\"",
+            "type": [
+              "string",
+              "number"
+            ]
+          },
+          "sender": {
+            "default": "SmsSender",
+            "description": "Name of the {@link SmsSender} service delivering the codes",
+            "type": "string"
+          },
+          "throttle": {
+            "$ref": "#/definitions/ThrottleParameters",
+            "description": "Throttle config for failed attempts"
+          },
+          "ttl": {
+            "default": "5m",
+            "description": "Lifetime of a code: seconds or a duration string such as \"5m\"",
+            "type": [
+              "string",
+              "number"
+            ]
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "type"
+        ],
+        "type": "object",
+        "title": "SmsMfaService"
+      },
+      "Configuration": "lib/mfa/sms.service:SmsMfaParameters"
+    },
     "Webda/TotpService": {
       "Import": "lib/mfa/totp.service:TotpService",
       "Schema": {
@@ -474,7 +563,14 @@
     },
     "Authentication.providers.input": {
       "type": "object",
-      "properties": {}
+      "properties": {},
+      "x-webda-rest": {
+        "method": "get",
+        "template": "auth/providers",
+        "path": [],
+        "query": [],
+        "body": []
+      }
     },
     "Authentication.providers.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -516,14 +612,28 @@
     },
     "Authentication.me.input": {
       "type": "object",
-      "properties": {}
+      "properties": {},
+      "x-webda-rest": {
+        "method": "get",
+        "template": "auth/me",
+        "path": [],
+        "query": [],
+        "body": []
+      }
     },
     "Authentication.me.output": {
       "$schema": "http://json-schema.org/draft-07/schema#"
     },
     "Authentication.logout.input": {
       "type": "object",
-      "properties": {}
+      "properties": {},
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/logout",
+        "path": [],
+        "query": [],
+        "body": []
+      }
     },
     "Authentication.logout.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -538,7 +648,16 @@
       },
       "required": [
         "refreshToken"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/refresh",
+        "path": [],
+        "query": [],
+        "body": [
+          "refreshToken"
+        ]
+      }
     },
     "Authentication.refresh.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -564,7 +683,14 @@
     },
     "Authentication.idents.input": {
       "type": "object",
-      "properties": {}
+      "properties": {},
+      "x-webda-rest": {
+        "method": "get",
+        "template": "auth/idents",
+        "path": [],
+        "query": [],
+        "body": []
+      }
     },
     "Authentication.idents.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -615,7 +741,17 @@
       "required": [
         "provider",
         "providerUid"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/idents/unlink",
+        "path": [],
+        "query": [],
+        "body": [
+          "provider",
+          "providerUid"
+        ]
+      }
     },
     "Authentication.unlink.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -623,7 +759,14 @@
     },
     "CertificateProvider.link.input": {
       "type": "object",
-      "properties": {}
+      "properties": {},
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/certificate/link",
+        "path": [],
+        "query": [],
+        "body": []
+      }
     },
     "CertificateProvider.link.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -711,7 +854,17 @@
       "required": [
         "email",
         "password"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/email/login",
+        "path": [],
+        "query": [],
+        "body": [
+          "email",
+          "password"
+        ]
+      }
     },
     "EmailPasswordProvider.login.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -788,7 +941,19 @@
       "required": [
         "email",
         "password"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/email/register",
+        "path": [],
+        "query": [],
+        "body": [
+          "email",
+          "password",
+          "token",
+          "profile"
+        ]
+      }
     },
     "EmailPasswordProvider.register.output": {
       "$schema": "http://json-schema.org/draft-07/schema#"
@@ -802,7 +967,16 @@
       },
       "required": [
         "email"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/email/verification",
+        "path": [],
+        "query": [],
+        "body": [
+          "email"
+        ]
+      }
     },
     "EmailPasswordProvider.startVerification.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -817,7 +991,16 @@
       },
       "required": [
         "token"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/email/verify",
+        "path": [],
+        "query": [],
+        "body": [
+          "token"
+        ]
+      }
     },
     "EmailPasswordProvider.verify.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -842,7 +1025,16 @@
       },
       "required": [
         "email"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/password/recovery",
+        "path": [],
+        "query": [],
+        "body": [
+          "email"
+        ]
+      }
     },
     "EmailPasswordProvider.startRecovery.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -861,7 +1053,17 @@
       "required": [
         "token",
         "password"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/password/recover",
+        "path": [],
+        "query": [],
+        "body": [
+          "token",
+          "password"
+        ]
+      }
     },
     "EmailPasswordProvider.recover.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",
@@ -875,12 +1077,75 @@
         },
         "next": {
           "type": "string"
+        },
+        "escrow": {
+          "additionalProperties": false,
+          "description": "Keyring key wrapped by a KDF-derived KEK (AES-GCM), the parameters are stored so they can evolve\n\n`kid` is the active key the keyring was encrypted for when the escrow was made, in clear and outside the AAD: the\nserver refuses an escrow made for another key than its active one (a device that missed a rotation).",
+          "properties": {
+            "ct": {
+              "type": "string"
+            },
+            "iv": {
+              "type": "string"
+            },
+            "kdf": {
+              "description": "Supported password KDFs",
+              "enum": [
+                "argon2id",
+                "pbkdf2-sha256"
+              ],
+              "type": "string"
+            },
+            "kdfParams": {
+              "type": "object"
+            },
+            "kid": {
+              "description": "Active key id when the escrow was created",
+              "type": "string"
+            },
+            "kind": {
+              "enum": [
+                "password",
+                "recovery"
+              ],
+              "type": "string"
+            },
+            "salt": {
+              "type": "string"
+            },
+            "v": {
+              "const": 1,
+              "type": "number"
+            }
+          },
+          "required": [
+            "ct",
+            "iv",
+            "kdf",
+            "kdfParams",
+            "kid",
+            "kind",
+            "salt",
+            "v"
+          ],
+          "type": "object"
         }
       },
       "required": [
         "current",
         "next"
-      ]
+      ],
+      "x-webda-rest": {
+        "method": "post",
+        "template": "auth/password/change",
+        "path": [],
+        "query": [],
+        "body": [
+          "current",
+          "next",
+          "escrow"
+        ]
+      }
     },
     "EmailPasswordProvider.changePassword.output": {
       "$schema": "http://json-schema.org/draft-07/schema#",