c60cc7ca75
Some checks failed
CI / Run tests and lints (push) Failing after 29s
CI / Build CLI docs (push) Has been skipped
CI / Run Playwright end-to-end tests (mysql) (push) Failing after 3s
CI / Run Playwright end-to-end tests (postgres) (push) Failing after 2s
CI / Run Playwright end-to-end tests (sqlite) (push) Failing after 3s
CodeQL / Analyze (go) (push) Failing after 4s
CodeQL / Analyze (javascript) (push) Failing after 3s
Docker Image Scanners / scanners (push) Failing after 4s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Run end-to-end tests (postgres) (push) Failing after 19s
CI / Run end-to-end tests (sqlite) (push) Failing after 2s
CI / Run Playwright end-to-end tests (cockroach) (push) Failing after 2s
CI / Draft newsletter (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
1600 lines
59 KiB
TypeScript
1600 lines
59 KiB
TypeScript
// Copyright © 2026 Ory Corp
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
/* eslint-disable */
|
|
/**
|
|
* This file was automatically generated by json-schema-to-typescript.
|
|
* DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
|
|
* and run json-schema-to-typescript to regenerate this file.
|
|
*/
|
|
|
|
export type OryKratosConfiguration = {
|
|
[k: string]: unknown | undefined
|
|
} & {
|
|
selfservice: {
|
|
default_browser_return_url: RedirectBrowsersToSetURLPerDefault
|
|
allowed_return_urls?: AllowedReturnToURLs
|
|
flows?: {
|
|
settings?: {
|
|
ui_url?: URLOfTheSettingsPage
|
|
lifespan?: string
|
|
privileged_session_max_age?: string
|
|
required_aal?: RequiredAuthenticatorAssuranceLevel
|
|
after?: SelfServiceAfterSettings
|
|
before?: SelfServiceBeforeSettings
|
|
}
|
|
logout?: {
|
|
clear_browser_data?: ClearBrowserDataOnLogout
|
|
after?: {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
}
|
|
}
|
|
registration?: {
|
|
enabled?: EnableUserRegistration
|
|
login_hints?: ProvideLoginHintsOnFailedRegistration
|
|
ui_url?: RegistrationUIURL
|
|
lifespan?: string
|
|
before?: SelfServiceBeforeRegistration
|
|
after?: SelfServiceAfterRegistration
|
|
enable_legacy_one_step?: DisableTwoStepRegistration
|
|
style?: RegistrationFlowStyle
|
|
}
|
|
login?: {
|
|
ui_url?: LoginUIURL
|
|
lifespan?: string
|
|
style?: LoginFlowStyle
|
|
before?: SelfServiceBeforeLogin
|
|
after?: SelfServiceAfterLogin
|
|
}
|
|
verification?: EmailAndPhoneVerificationAndAccountActivationConfiguration
|
|
recovery?: AccountRecoveryConfiguration
|
|
error?: {
|
|
ui_url?: OryKratosErrorUIURL
|
|
}
|
|
}
|
|
methods?: {
|
|
b2b?: SingleSignOnForB2B
|
|
profile?: {
|
|
enabled?: EnablesProfileManagementMethod
|
|
}
|
|
link?: {
|
|
enabled?: EnablesLinkMethod
|
|
config?: LinkConfiguration
|
|
}
|
|
code?:
|
|
| {
|
|
passwordless_enabled?: true
|
|
mfa_enabled?: false
|
|
[k: string]: unknown | undefined
|
|
}
|
|
| {
|
|
mfa_enabled?: true
|
|
passwordless_enabled?: false
|
|
[k: string]: unknown | undefined
|
|
}
|
|
| {
|
|
mfa_enabled?: false
|
|
passwordless_enabled?: false
|
|
[k: string]: unknown | undefined
|
|
}
|
|
password?: {
|
|
enabled?: EnablesUsernameEmailAndPasswordMethod
|
|
config?: PasswordConfiguration
|
|
}
|
|
totp?: {
|
|
enabled?: EnablesTheTOTPMethod
|
|
config?: TOTPConfiguration
|
|
}
|
|
lookup_secret?: {
|
|
enabled?: EnablesTheLookupSecretMethod
|
|
}
|
|
webauthn?: {
|
|
enabled?: EnablesTheWebAuthnMethod
|
|
config?: WebAuthnConfiguration
|
|
}
|
|
passkey?: {
|
|
enabled?: EnablesThePasskeyMethod
|
|
config?: PasskeyConfiguration
|
|
}
|
|
oidc?: SpecifyOpenIDConnectAndOAuth2Configuration
|
|
}
|
|
}
|
|
database?: DatabaseRelatedConfiguration
|
|
dsn: DataSourceName
|
|
courier?: CourierConfiguration
|
|
oauth2_provider?: OAuth2ProviderConfiguration
|
|
preview?: ConfigurePreviewFeatures
|
|
serve?: {
|
|
admin?: {
|
|
request_log?: {
|
|
disable_for_health?: DisableHealthEndpointsRequestLogging
|
|
}
|
|
base_url?: AdminBaseURL
|
|
host?: AdminHost
|
|
port?: AdminPort
|
|
socket?: Socket
|
|
tls?: HTTPS
|
|
}
|
|
public?: {
|
|
request_log?: {
|
|
disable_for_health?: DisableHealthEndpointsRequestLogging1
|
|
}
|
|
/**
|
|
* Configures Cross Origin Resource Sharing for public endpoints.
|
|
*/
|
|
cors?: {
|
|
/**
|
|
* Sets whether CORS is enabled.
|
|
*/
|
|
enabled?: boolean
|
|
/**
|
|
* A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.
|
|
*/
|
|
allowed_origins?: ((string | "*") & string)[]
|
|
/**
|
|
* A list of HTTP methods the user agent is allowed to use with cross-domain requests.
|
|
*/
|
|
allowed_methods?: (
|
|
| "POST"
|
|
| "GET"
|
|
| "PUT"
|
|
| "PATCH"
|
|
| "DELETE"
|
|
| "CONNECT"
|
|
| "HEAD"
|
|
| "OPTIONS"
|
|
| "TRACE"
|
|
)[]
|
|
/**
|
|
* A list of non simple headers the client is allowed to use with cross-domain requests.
|
|
*/
|
|
allowed_headers?: string[]
|
|
/**
|
|
* Sets which headers are safe to expose to the API of a CORS API specification.
|
|
*/
|
|
exposed_headers?: string[]
|
|
/**
|
|
* Sets whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates.
|
|
*/
|
|
allow_credentials?: boolean
|
|
/**
|
|
* TODO
|
|
*/
|
|
options_passthrough?: boolean
|
|
/**
|
|
* Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request is preceded by a preflight request.
|
|
*/
|
|
max_age?: number
|
|
/**
|
|
* Adds additional log output to debug server side CORS issues.
|
|
*/
|
|
debug?: boolean
|
|
}
|
|
base_url?: BaseURL
|
|
host?: PublicHost
|
|
port?: PublicPort
|
|
socket?: Socket
|
|
tls?: HTTPS
|
|
}
|
|
}
|
|
tracing?: {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
log?: Log
|
|
identity: {
|
|
default_schema_id?: TheDefaultIdentitySchema
|
|
schemas: AllJSONSchemasForIdentityTraits
|
|
}
|
|
secrets?: {
|
|
default?: DefaultEncryptionSigningSecrets
|
|
cookie?: SigningKeysForCookies
|
|
pagination?: SecretsToEncryptThePaginationToken
|
|
cipher?: SecretsToUseForEncryptionByCipher
|
|
}
|
|
hashers?: HashingAlgorithmConfiguration
|
|
ciphers?: CipherAlgorithmConfiguration
|
|
cookies?: HTTPCookieConfiguration
|
|
session?: {
|
|
whoami?: WhoAmIToSessionSettings
|
|
lifespan?: SessionLifespan
|
|
cookie?: {
|
|
domain?: SessionCookieDomain
|
|
name?: SessionCookieName
|
|
persistent?: MakeSessionCookiePersistent
|
|
path?: SessionCookiePath
|
|
secure?: SessionCookieSecureFlag1
|
|
same_site?: SessionCookieSameSiteConfiguration
|
|
}
|
|
earliest_possible_extend?: EarliestPossibleSessionExtension
|
|
}
|
|
security?: {
|
|
account_enumeration?: {
|
|
/**
|
|
* Mitigate account enumeration by making it harder to figure out if an identifier (email, phone number) exists or not. Enabling this setting degrades user experience. This setting does not mitigate all possible attack vectors yet.
|
|
*/
|
|
mitigate?: boolean
|
|
[k: string]: unknown | undefined
|
|
}
|
|
disallow_ref_in_identity_schemas?: DisallowExternal$RefResolutionInIdentitySchemas
|
|
[k: string]: unknown | undefined
|
|
}
|
|
version?: TheKratosVersionThisConfigIsWrittenFor
|
|
dev?: boolean
|
|
help?: boolean
|
|
/**
|
|
* This is a CLI flag and environment variable and can not be set using the config file.
|
|
*/
|
|
"sqa-opt-out"?: boolean
|
|
/**
|
|
* This is a CLI flag and environment variable and can not be set using the config file.
|
|
*/
|
|
"watch-courier"?: boolean
|
|
"expose-metrics-port"?: MetricsPort
|
|
/**
|
|
* This is a CLI flag and environment variable and can not be set using the config file.
|
|
*/
|
|
config?: string[]
|
|
clients?: GlobalOutgoingNetworkSettings
|
|
feature_flags?: FeatureFlags
|
|
organizations?: Organizations
|
|
enterprise?: EnterpriseFeatures
|
|
revision?: ConfigRevision
|
|
}
|
|
/**
|
|
* Ory Kratos redirects to this URL per default on completion of self-service flows and other browser interaction. Read this [article for more information on browser redirects](https://www.ory.com/kratos/docs/concepts/browser-redirect-flow-completion).
|
|
*/
|
|
export type RedirectBrowsersToSetURLPerDefault = string
|
|
/**
|
|
* List of URLs that are allowed to be redirected to. A redirection request is made by appending `?return_to=...` to Login, Registration, and other self-service flows.
|
|
*/
|
|
export type AllowedReturnToURLs = string[]
|
|
/**
|
|
* URL where the Settings UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
|
|
*/
|
|
export type URLOfTheSettingsPage = string
|
|
/**
|
|
* Sets what Authenticator Assurance Level (used for 2FA) is required to access this feature. If set to `highest_available` then this endpoint requires the highest AAL the identity has set up. If set to `aal1` then the identity can access this feature without 2FA.
|
|
*/
|
|
export type RequiredAuthenticatorAssuranceLevel = "aal1" | "highest_available"
|
|
/**
|
|
* Define what the hook should do
|
|
*/
|
|
export type WebHookConfiguration =
|
|
| {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
| {
|
|
can_interrupt?: false
|
|
[k: string]: unknown | undefined
|
|
}
|
|
export type SelfServiceHooks = (SelfServiceWebHook | B2BSSOHook)[]
|
|
/**
|
|
* If set to true, a successful browser logout sends the `Clear-Site-Data` response header over HTTPS, instructing the browser to clear cookies, storage, and caches for the origin. This is off by default to avoid clearing data that other applications on the same origin may rely on.
|
|
*/
|
|
export type ClearBrowserDataOnLogout = boolean
|
|
/**
|
|
* If set to true will enable [User Registration](https://www.ory.com/kratos/docs/self-service/flows/user-registration/).
|
|
*/
|
|
export type EnableUserRegistration = boolean
|
|
/**
|
|
* When registration fails because an account with the given credentials or addresses previously signed up, provide login hints about available methods to sign in to the user.
|
|
*/
|
|
export type ProvideLoginHintsOnFailedRegistration = boolean
|
|
/**
|
|
* URL where the Registration UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
|
|
*/
|
|
export type RegistrationUIURL = string
|
|
/**
|
|
* Deprecated, please use `style` instead.
|
|
*/
|
|
export type DisableTwoStepRegistration = boolean
|
|
/**
|
|
* The style of the registration flow. If set to `unified` the login flow will be a one-step process. If set to `profile_first` the registration flow will first ask for the profile information first, and then the credentials.
|
|
*/
|
|
export type RegistrationFlowStyle = "unified" | "profile_first"
|
|
/**
|
|
* URL where the Login UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
|
|
*/
|
|
export type LoginUIURL = string
|
|
/**
|
|
* The style of the login flow. If set to `unified` the login flow will be a one-step process. If set to `identifier_first` (experimental!) the login flow will first ask for the identifier and then the credentials.
|
|
*/
|
|
export type LoginFlowStyle = "unified" | "identifier_first"
|
|
export type SelfServiceAfterDefaultLoginMethodHooks = (
|
|
| SelfServiceSessionRevokerHook
|
|
| SelfServiceRequireVerifiedAddressHook
|
|
| SelfServiceWebHook
|
|
| SelfServiceVerificationHook
|
|
| SelfServiceShowVerificationUIHook
|
|
| B2BSSOHook
|
|
)[]
|
|
/**
|
|
* If set to true will enable [Email and Phone Verification and Account Activation](https://www.ory.com/kratos/docs/self-service/flows/verify-email-account-activation/).
|
|
*/
|
|
export type EnableEmailPhoneVerification = boolean
|
|
/**
|
|
* URL where the Ory Verify UI is hosted. This is the page where users activate and / or verify their email or telephone number. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
|
|
*/
|
|
export type VerifyUIURL = string
|
|
/**
|
|
* Sets how long the verification request (for the UI interaction) is valid.
|
|
*/
|
|
export type SelfServiceVerificationRequestLifespan = string
|
|
/**
|
|
* The strategy to use for verification requests
|
|
*/
|
|
export type VerificationStrategy = "link" | "code"
|
|
/**
|
|
* Whether to notify recipients, if verification was requested for their address.
|
|
*/
|
|
export type NotifyUnknownRecipients = boolean
|
|
/**
|
|
* If set to true will enable [Account Recovery](https://www.ory.com/kratos/docs/self-service/flows/password-reset-account-recovery/).
|
|
*/
|
|
export type EnableAccountRecovery = boolean
|
|
/**
|
|
* URL where the Ory Recovery UI is hosted. This is the page where users request and complete account recovery. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
|
|
*/
|
|
export type RecoveryUIURL = string
|
|
export type SelfServiceAfterRecoveryHooks = (
|
|
| SelfServiceWebHook
|
|
| SelfServiceSessionRevokerHook
|
|
)[]
|
|
/**
|
|
* Sets how long the recovery request is valid. If expired, the user has to redo the flow.
|
|
*/
|
|
export type SelfServiceRecoveryRequestLifespan = string
|
|
/**
|
|
* The strategy to use for recovery requests
|
|
*/
|
|
export type RecoveryStrategy = "link" | "code"
|
|
/**
|
|
* Whether to notify recipients, if recovery was requested for their account.
|
|
*/
|
|
export type NotifyUnknownRecipients1 = boolean
|
|
/**
|
|
* URL where the Ory Kratos Error UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).
|
|
*/
|
|
export type OryKratosErrorUIURL = string
|
|
/**
|
|
* Overrides session.lifespan for sessions issued for this organization. Unset means inherit the project default.
|
|
*/
|
|
export type SessionLifespanOverride = string
|
|
export type EnablesProfileManagementMethod = boolean
|
|
export type EnablesLinkMethod = boolean
|
|
export type OverrideTheBaseURLWhichShouldBeUsedAsTheBaseForRecoveryAndVerificationLinks =
|
|
string
|
|
export type HowLongALinkIsValidFor = string
|
|
export type EnablesUsernameEmailAndPasswordMethod = boolean
|
|
/**
|
|
* Allows changing the default HIBP host to a self hosted version.
|
|
*/
|
|
export type CustomHaveibeenpwnedHost = string
|
|
/**
|
|
* If set to false the password validation does not utilize the Have I Been Pwnd API.
|
|
*/
|
|
export type EnableTheHaveIBeenPwnedAPI = boolean
|
|
/**
|
|
* Defines how often a password may have been breached before it is rejected.
|
|
*/
|
|
export type AllowPasswordBreaches = number
|
|
/**
|
|
* If set to false the password validation fails when the network or the Have I Been Pwnd API is down.
|
|
*/
|
|
export type IgnoreLookupNetworkErrors = boolean
|
|
/**
|
|
* Defines the minimum length of the password.
|
|
*/
|
|
export type MinimumPasswordLength = number
|
|
/**
|
|
* If set to false the password validation does not check for similarity between the password and the user identifier.
|
|
*/
|
|
export type EnablePasswordIdentifierSimilarityCheck = boolean
|
|
/**
|
|
* If set to true will enable password migration.
|
|
*/
|
|
export type EnablePasswordMigration = boolean
|
|
/**
|
|
* Define which auth mechanism the Web-Hook should use
|
|
*/
|
|
export type AuthMechanisms =
|
|
| WebHookAuthApiKeyProperties
|
|
| WebHookAuthBasicAuthProperties
|
|
export type EnablesTheTOTPMethod = boolean
|
|
/**
|
|
* The issuer (e.g. a domain name) will be shown in the TOTP app (e.g. Google Authenticator). It helps the user differentiate between different codes.
|
|
*/
|
|
export type TOTPIssuer = string
|
|
export type EnablesTheLookupSecretMethod = boolean
|
|
export type EnablesTheWebAuthnMethod = boolean
|
|
/**
|
|
* If enabled will have the effect that WebAuthn is used for passwordless flows (as a first factor) and not for multi-factor set ups. With this set to true, users will see an option to sign up with WebAuthn on the registration screen.
|
|
*/
|
|
export type UseForPasswordlessFlows = boolean
|
|
export type RelyingPartyRPConfig =
|
|
| {
|
|
origin?: {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
origins?: {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
[k: string]: unknown | undefined
|
|
}
|
|
| {
|
|
origin: string
|
|
origins?: {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
[k: string]: unknown | undefined
|
|
}
|
|
| {
|
|
origin?: {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
origins: string[]
|
|
[k: string]: unknown | undefined
|
|
}
|
|
export type EnablesThePasskeyMethod = boolean
|
|
/**
|
|
* A name to help the user identify this RP.
|
|
*/
|
|
export type RelyingPartyDisplayName = string
|
|
/**
|
|
* The id must be a subset of the domain currently in the browser.
|
|
*/
|
|
export type RelyingPartyIdentifier = string
|
|
/**
|
|
* A list of explicit RP origins. If left empty, this defaults to either `origin` or `id`, prepended with the current protocol schema (HTTP or HTTPS).
|
|
*/
|
|
export type RelyingPartyOrigins = string[]
|
|
/**
|
|
* Constrains eligible authenticators to a specific attachment modality. Use 'platform' for built-in authenticators (Touch ID, Windows Hello) or 'cross-platform' for roaming authenticators (HID tokens, Yubikeys). Omit this field to let users register either type (WebAuthn 'no preference'), which is the recommended default for passkey deployments.
|
|
*/
|
|
export type AuthenticatorAttachment = "platform" | "cross-platform"
|
|
/**
|
|
* Controls whether the authenticator must create a client-side discoverable credential (historically called a resident key). Maps to the WebAuthn authenticatorSelection.residentKey member, whose name the spec retains for compatibility. See https://pkg.go.dev/github.com/go-webauthn/webauthn/protocol#ResidentKeyRequirement.
|
|
*/
|
|
export type ClientSideDiscoverableCredentialRequirement =
|
|
| "required"
|
|
| "preferred"
|
|
| "discouraged"
|
|
/**
|
|
* Controls whether biometrics or PIN are required for the passkey ceremony.
|
|
*/
|
|
export type UserVerificationRequirement =
|
|
| "required"
|
|
| "preferred"
|
|
| "discouraged"
|
|
/**
|
|
* Tells the authenticator what attestation statement to provide. 'none' is the WebAuthn default and tells the client not to provide an attestation statement, which is what most consumer passkeys (e.g., iOS, Android) support today. Use 'direct' to request the raw attestation statement, 'indirect' to allow the client to decide, or 'enterprise' for uniquely identifying attestation.
|
|
*/
|
|
export type AttestationConveyancePreference =
|
|
| "none"
|
|
| "indirect"
|
|
| "direct"
|
|
| "enterprise"
|
|
/**
|
|
* Timeout for the passkey registration ceremony. Uses Go duration format. If empty, library defaults are used (5m with user verification, 2m without).
|
|
*/
|
|
export type RegistrationTimeout = string
|
|
/**
|
|
* Timeout for the passkey login ceremony. Uses Go duration format. If empty, library defaults are used (5m with user verification, 2m without).
|
|
*/
|
|
export type LoginTimeout = string
|
|
export type EnablesOpenIDConnectMethod = boolean
|
|
/**
|
|
* Can be used to modify the base URL for OAuth2 Redirect URLs. If unset, the Public Base URL will be used.
|
|
*/
|
|
export type BaseURLForOAuth2RedirectURIs = string
|
|
export type SelfServiceOIDCProvider = {
|
|
[k: string]: unknown | undefined
|
|
} & {
|
|
id: string
|
|
provider: Provider
|
|
label?: OptionalStringWhichWillBeUsedWhenGeneratingLabelsForUIButtons
|
|
client_id: string
|
|
client_secret?: string
|
|
issuer_url?: string
|
|
auth_url?: string
|
|
token_url?: string
|
|
mapper_url: JsonnetMapperURL
|
|
scope?: string[]
|
|
microsoft_tenant?: AzureADTenant
|
|
subject_source?: MicrosoftSubjectSource
|
|
apple_team_id?: AppleDeveloperTeamID
|
|
apple_private_key_id?: ApplePrivateKeyIdentifier
|
|
apple_private_key?: ApplePrivateKey
|
|
requested_claims?: OpenIDConnectClaims
|
|
organization_id?: OrganizationID
|
|
additional_id_token_audiences?: AdditionalClientIdsAllowedWhenUsingIDTokenSubmission
|
|
aal2_acr_values?: UpstreamAcrValuesThatMarkTheSessionAsAAL2
|
|
aal2_amr_values?: UpstreamAmrValuesThatMarkTheSessionAsAAL2
|
|
claims_source?: ClaimsSource
|
|
pkce?: ProofKeyForCodeExchange
|
|
fedcm_config_url?: FederationConfigurationURL
|
|
net_id_token_origin_header?: NetIDTokenOriginHeader
|
|
account_linking_mode?: AccountLinkingMode
|
|
update_identity_on_login?: UpdateIdentityOnLogin
|
|
}
|
|
/**
|
|
* Can be one of github, github-app, gitlab, generic, google, microsoft, discord, salesforce, slack, facebook, auth0, vk, yandex, apple, spotify, netid, dingtalk, patreon, amazon.
|
|
*/
|
|
export type Provider =
|
|
| "github"
|
|
| "github-app"
|
|
| "gitlab"
|
|
| "generic"
|
|
| "google"
|
|
| "microsoft"
|
|
| "discord"
|
|
| "salesforce"
|
|
| "slack"
|
|
| "facebook"
|
|
| "auth0"
|
|
| "vk"
|
|
| "yandex"
|
|
| "apple"
|
|
| "spotify"
|
|
| "netid"
|
|
| "dingtalk"
|
|
| "patreon"
|
|
| "line"
|
|
| "linkedin"
|
|
| "linkedin_v2"
|
|
| "lark"
|
|
| "x"
|
|
| "fedcm-test"
|
|
| "amazon"
|
|
| "uaepass"
|
|
export type OptionalStringWhichWillBeUsedWhenGeneratingLabelsForUIButtons =
|
|
string
|
|
/**
|
|
* The URL where the jsonnet source is located for mapping the provider's data to Ory Kratos data.
|
|
*/
|
|
export type JsonnetMapperURL = string
|
|
/**
|
|
* The Azure AD Tenant to use for authentication.
|
|
*/
|
|
export type AzureADTenant = string
|
|
/**
|
|
* Controls which source the subject identifier is taken from by microsoft provider. If set to `userinfo` (the default) then the identifier is taken from the `sub` field of OIDC ID token or data received from `/userinfo` standard OIDC endpoint. If set to `me` then the `id` field of data structure received from `https://graph.microsoft.com/v1.0/me` is taken as an identifier. If the value is `oid` then the the oid (Object ID) is taken to identify users across different services.
|
|
*/
|
|
export type MicrosoftSubjectSource = "userinfo" | "me" | "oid"
|
|
/**
|
|
* Apple Developer Team ID needed for generating a JWT token for client secret
|
|
*/
|
|
export type AppleDeveloperTeamID = string
|
|
/**
|
|
* Sign In with Apple Private Key Identifier needed for generating a JWT token for client secret
|
|
*/
|
|
export type ApplePrivateKeyIdentifier = string
|
|
/**
|
|
* Sign In with Apple Private Key needed for generating a JWT token for client secret
|
|
*/
|
|
export type ApplePrivateKey = string
|
|
/**
|
|
* The ID of the organization that this provider belongs to. Only effective in the Ory Network.
|
|
*/
|
|
export type OrganizationID = string
|
|
export type AdditionalClientIdsAllowedWhenUsingIDTokenSubmission = string[]
|
|
/**
|
|
* List of upstream OIDC `acr` claim values that should elevate the resulting Kratos session to AAL2. If the ID token returned by the upstream provider contains an `acr` claim matching any of these values, the session is marked AAL2. Leave empty to always issue AAL1 sessions for this provider.
|
|
*/
|
|
export type UpstreamAcrValuesThatMarkTheSessionAsAAL2 = string[]
|
|
/**
|
|
* List of upstream OIDC `amr` claim values that should elevate the resulting Kratos session to AAL2. If the ID token returned by the upstream provider contains an `amr` array including any of these values, the session is marked AAL2. Values follow RFC 8176 (for example `mfa`, `otp`, `hwk`, `fpt`).
|
|
*/
|
|
export type UpstreamAmrValuesThatMarkTheSessionAsAAL2 = string[]
|
|
/**
|
|
* Can be either `userinfo` (calls the userinfo endpoint to get the claims) or `id_token` (takes the claims from the id token). It defaults to `id_token`
|
|
*/
|
|
export type ClaimsSource = "id_token" | "userinfo"
|
|
/**
|
|
* PKCE controls if the OpenID Connect OAuth2 flow should use PKCE (Proof Key for Code Exchange). IMPORTANT: If you set this to `force`, you must whitelist a different return URL for your OAuth2 client in the provider's configuration. Instead of <base-url>/self-service/methods/oidc/callback/<provider>, you must use <base-url>/self-service/methods/oidc/callback
|
|
*/
|
|
export type ProofKeyForCodeExchange = "auto" | "never" | "force"
|
|
/**
|
|
* The URL where the FedCM IdP configuration is located for the provider. This is only effective in the Ory Network.
|
|
*/
|
|
export type FederationConfigurationURL = string
|
|
/**
|
|
* Contains the orgin header to be used when exchanging a NetID FedCM token for an ID token
|
|
*/
|
|
export type NetIDTokenOriginHeader = string
|
|
/**
|
|
* Controls how account conflicts are resolved for this provider. `confirm_with_existing_credential` (default) requires the user to verify their identity with an existing credential. `automatic` silently links accounts if the provider verifies email ownership. This is only effective in the Ory Network.
|
|
*/
|
|
export type AccountLinkingMode =
|
|
| "confirm_with_existing_credential"
|
|
| "automatic"
|
|
/**
|
|
* Controls whether the identity is updated from OIDC claims on each login. `never` (default) does not update the identity. `automatic` re-runs the Jsonnet claims mapper on every OIDC login and updates the identity's traits and metadata if they changed.
|
|
*/
|
|
export type UpdateIdentityOnLogin = "never" | "automatic"
|
|
/**
|
|
* A list and configuration of OAuth2 and OpenID Connect providers Ory Kratos should integrate with.
|
|
*/
|
|
export type OpenIDConnectAndOAuth2Providers = SelfServiceOIDCProvider[]
|
|
/**
|
|
* Controls how many records should be purged from one table during database cleanup task
|
|
*/
|
|
export type NumberOfRecordsToCleanInOneIteration = number
|
|
/**
|
|
* Controls the delay time between cleaning each table in one cleanup iteration
|
|
*/
|
|
export type DelayBetweenEachTableCleanups = string
|
|
/**
|
|
* Controls how old records do we want to leave
|
|
*/
|
|
export type RemoveRecordsOlderThan = string
|
|
/**
|
|
* DSN is used to specify the database credentials as a connection URI.
|
|
*/
|
|
export type DataSourceName = string
|
|
/**
|
|
* You can override certain or all message templates by pointing this key to the path where the templates are located.
|
|
*/
|
|
export type OverrideMessageTemplates = string
|
|
/**
|
|
* Defines how emails will be sent, either through SMTP (default) or HTTP.
|
|
*/
|
|
export type DeliveryStrategy = "smtp" | "http"
|
|
/**
|
|
* This URL will be used to send the emails to.
|
|
*/
|
|
export type HTTPAddressOfAPIEndpoint = string
|
|
/**
|
|
* Define which auth mechanism to use for auth with the HTTP email provider
|
|
*/
|
|
export type AuthMechanisms1 =
|
|
| WebHookAuthApiKeyProperties
|
|
| WebHookAuthBasicAuthProperties
|
|
/**
|
|
* This URI will be used to connect to the SMTP server. Use the scheme smtps for implicit TLS sessions or smtp for explicit StartTLS/cleartext sessions. Please note that TLS is always enforced with certificate trust verification by default for security reasons on both schemes. With the smtp scheme you can use the query parameter (`?disable_starttls=true`) to allow cleartext sessions or (`?disable_starttls=false`) to enforce StartTLS (default behaviour). Additionally, use the query parameter to allow (`?skip_ssl_verify=true`) or disallow (`?skip_ssl_verify=false`) self-signed TLS certificates (default behaviour) on both implicit and explicit TLS sessions.
|
|
*/
|
|
export type SMTPConnectionString = string
|
|
/**
|
|
* Path of the client X.509 certificate, in case of certificate based client authentication to the SMTP server.
|
|
*/
|
|
export type SMTPClientCertificatePath = string
|
|
/**
|
|
* Path of the client certificate private key, in case of certificate based client authentication to the SMTP server
|
|
*/
|
|
export type SMTPClientPrivateKeyPath = string
|
|
/**
|
|
* The recipient of an email will see this as the sender address.
|
|
*/
|
|
export type SMTPSenderAddress = string
|
|
/**
|
|
* The recipient of an email will see this as the sender name.
|
|
*/
|
|
export type SMTPSenderName = string
|
|
/**
|
|
* Identifier used in the SMTP HELO/EHLO command. Some SMTP relays require a unique identifier.
|
|
*/
|
|
export type SMTPHELOEHLOName = string
|
|
/**
|
|
* The channel id. Corresponds to the .via property of the identity schema for recovery, verification, etc. Currently only sms is supported.
|
|
*/
|
|
export type ChannelId = "sms"
|
|
/**
|
|
* The channel type. Currently only http is supported.
|
|
*/
|
|
export type ChannelType = "http"
|
|
/**
|
|
* If set, the login and registration flows will handle the Ory OAuth 2.0 & OpenID `login_challenge` query parameter to serve as an OpenID Connect Provider. This URL should point to Ory Hydra when you are not running on the Ory Network and be left untouched otherwise.
|
|
*/
|
|
export type OAuth20ProviderURL = string
|
|
/**
|
|
* Override the return_to query parameter with the OAuth2 provider request URL when perfoming an OAuth2 login flow.
|
|
*/
|
|
export type PersistOAuth2RequestBetweenFlows = boolean
|
|
/**
|
|
* The default consistency level to use when reading from the database. Defaults to `strong` to not break existing API contracts. Only set this to `eventual` if you can accept that other read APIs will suddenly return eventually consistent results. It is only effective in Ory Network.
|
|
*/
|
|
export type DefaultReadConsistencyLevel = "strong" | "eventual"
|
|
/**
|
|
* Disable request logging for /health/alive and /health/ready endpoints
|
|
*/
|
|
export type DisableHealthEndpointsRequestLogging = boolean
|
|
/**
|
|
* The URL where the admin endpoint is exposed at.
|
|
*/
|
|
export type AdminBaseURL = string
|
|
/**
|
|
* The host (interface) kratos' admin endpoint listens on.
|
|
*/
|
|
export type AdminHost = string
|
|
/**
|
|
* The port kratos' admin endpoint listens on.
|
|
*/
|
|
export type AdminPort = number
|
|
export type PrivateKeyPEM = TlsxSource
|
|
export type PathToPEMEncodedFle = string
|
|
/**
|
|
* The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.
|
|
*/
|
|
export type Base64EncodedInline = string
|
|
export type TLSCertificatePEM = TlsxSource
|
|
/**
|
|
* Disable request logging for /health/alive and /health/ready endpoints
|
|
*/
|
|
export type DisableHealthEndpointsRequestLogging1 = boolean
|
|
/**
|
|
* The URL where the endpoint is exposed at. This domain is used to generate redirects, form URLs, and more.
|
|
*/
|
|
export type BaseURL = string
|
|
/**
|
|
* The host (interface) kratos' public endpoint listens on.
|
|
*/
|
|
export type PublicHost = string
|
|
/**
|
|
* The port kratos' public endpoint listens on.
|
|
*/
|
|
export type PublicPort = number
|
|
/**
|
|
* If set will leak sensitive values (e.g. emails) in the logs.
|
|
*/
|
|
export type LeakSensitiveLogValues = boolean
|
|
/**
|
|
* Text to use, when redacting sensitive log value.
|
|
*/
|
|
export type SensitiveLogValueRedactionText = string
|
|
/**
|
|
* This Identity Schema will be used as the default for self-service flows. Its ID needs to exist in the "schemas" list.
|
|
*/
|
|
export type TheDefaultIdentitySchema = string
|
|
/**
|
|
* Note that identities that used the "default_schema_url" field in older kratos versions will be corrupted unless you specify their schema url with the id "default" in this list.
|
|
*
|
|
* @minItems 1
|
|
*/
|
|
export type AllJSONSchemasForIdentityTraits = [
|
|
{
|
|
id: TheSchemaSID
|
|
url: JSONSchemaURLForIdentityTraitsSchema
|
|
selfservice_selectable?: IsTheSchemaEnabledInSelfServiceFlows
|
|
[k: string]: unknown | undefined
|
|
},
|
|
...{
|
|
id: TheSchemaSID
|
|
url: JSONSchemaURLForIdentityTraitsSchema
|
|
selfservice_selectable?: IsTheSchemaEnabledInSelfServiceFlows
|
|
[k: string]: unknown | undefined
|
|
}[],
|
|
]
|
|
export type TheSchemaSID = string
|
|
/**
|
|
* URL for JSON Schema which describes a identity's traits. Can be a file path, a https URL, or a base64 encoded string.
|
|
*/
|
|
export type JSONSchemaURLForIdentityTraitsSchema = string
|
|
/**
|
|
* If set to true, this schema can be used explicity in self-service flows by setting `identity_schema` query parameter to the schema's ID.
|
|
*/
|
|
export type IsTheSchemaEnabledInSelfServiceFlows = boolean
|
|
/**
|
|
* The first secret in the array is used for signing and encrypting things while all other keys are used to verify and decrypt older things that were signed with that old secret.
|
|
*/
|
|
export type DefaultEncryptionSigningSecrets = string[]
|
|
/**
|
|
* The first secret in the array is used for encrypting cookies while all other keys are used to decrypt older cookies that were signed with that old secret.
|
|
*/
|
|
export type SigningKeysForCookies = string[]
|
|
/**
|
|
* To avoid clients reverse-engineering and relying on the implementation details of the pagination token, it is encrypted with these keys
|
|
*
|
|
* @minItems 1
|
|
*/
|
|
export type SecretsToEncryptThePaginationToken = [string, ...string[]]
|
|
/**
|
|
* The first secret in the array is used for encryption data while all other keys are used to decrypt older data that were signed with.
|
|
*
|
|
* @minItems 1
|
|
*/
|
|
export type SecretsToUseForEncryptionByCipher = [string, ...string[]]
|
|
/**
|
|
* One of the values: argon2, bcrypt.
|
|
* Any other hashes will be migrated to the set algorithm once an identity authenticates using their password.
|
|
*/
|
|
export type PasswordHashingAlgorithm = "argon2" | "bcrypt"
|
|
/**
|
|
* One of the values: noop, aes, xchacha20-poly1305
|
|
*/
|
|
export type CipheringAlgorithm = "noop" | "aes" | "xchacha20-poly1305"
|
|
/**
|
|
* Sets the cookie domain for session and CSRF cookies. Useful when dealing with subdomains. Use with care!
|
|
*/
|
|
export type HTTPCookieDomain = string
|
|
/**
|
|
* Sets the session and CSRF cookie path. Use with care!
|
|
*/
|
|
export type HTTPCookiePath = string
|
|
/**
|
|
* Sets the session secure flag. If unset, defaults to !dev mode.
|
|
*/
|
|
export type SessionCookieSecureFlag = string
|
|
/**
|
|
* Sets the session and CSRF cookie SameSite.
|
|
*/
|
|
export type HTTPCookieSameSiteConfiguration = "Strict" | "Lax" | "None"
|
|
export type TokenTimeToLive = string
|
|
export type JsonnetMapperURL1 = string
|
|
export type JSONWebKeySetURL = string
|
|
/**
|
|
* The source of the subject claim in the token. Can be one of: `id`, or `external_id`.
|
|
*/
|
|
export type SubjectSource = "id" | "external_id"
|
|
/**
|
|
* Defines how long a session is active. Once that lifespan has been reached, the user needs to sign in again.
|
|
*/
|
|
export type SessionLifespan = string
|
|
/**
|
|
* Sets the session cookie domain. Useful when dealing with subdomains. Use with care! Overrides `cookies.domain`.
|
|
*/
|
|
export type SessionCookieDomain = string
|
|
/**
|
|
* Sets the session cookie name. Use with care!
|
|
*/
|
|
export type SessionCookieName = string
|
|
/**
|
|
* If set to true will persist the cookie in the end-user's browser using the `max-age` parameter which is set to the `session.lifespan` value. Persistent cookies are not deleted when the browser is closed (e.g. on reboot or alt+f4). This option affects the Ory OAuth2 and OpenID Provider's remember feature as well.
|
|
*/
|
|
export type MakeSessionCookiePersistent = boolean
|
|
/**
|
|
* Sets the session cookie path. Use with care! Overrides `cookies.path`.
|
|
*/
|
|
export type SessionCookiePath = string
|
|
/**
|
|
* Sets the session secure flag. If unset, defaults to !dev mode.
|
|
*/
|
|
export type SessionCookieSecureFlag1 = string
|
|
/**
|
|
* Sets the session cookie SameSite. Overrides `cookies.same_site`.
|
|
*/
|
|
export type SessionCookieSameSiteConfiguration = "Strict" | "Lax" | "None"
|
|
/**
|
|
* Sets when a session can be extended. Settings this value to `24h` will prevent the session from being extended before until 24 hours before it expires. This setting prevents excessive writes to the database. We highly recommend setting this value.
|
|
*/
|
|
export type EarliestPossibleSessionExtension = string
|
|
/**
|
|
* If true, `$ref` URLs inside identity schemas may not resolve to `file://`, `http://`, or `https://` sources. This blocks server-side file reads (`file://`) and server-side request forgery (`http(s)://`) via malicious identity schemas. Internal JSON-pointer refs (`#/definitions/...`) and self-contained `base64://` refs remain allowed. Leave at the default (false) to preserve existing behavior for operators who intentionally reference external schemas. Ory Network forces this to true.
|
|
*/
|
|
export type DisallowExternal$RefResolutionInIdentitySchemas = boolean
|
|
/**
|
|
* SemVer according to https://semver.org/ prefixed with `v` as in our releases.
|
|
*/
|
|
export type TheKratosVersionThisConfigIsWrittenFor = string
|
|
/**
|
|
* The port the courier's metrics endpoint listens on (0/disabled by default). This is a CLI flag and environment variable and can not be set using the config file.
|
|
*/
|
|
export type MetricsPort = number
|
|
/**
|
|
* Disallow all outgoing HTTP calls to private IP ranges. This feature can help protect against SSRF attacks.
|
|
*/
|
|
export type DisallowPrivateIPRanges = boolean
|
|
/**
|
|
* Allows the given URLs to be called despite them being in the private IP range. URLs need to have an exact and case-sensitive match to be exempt.
|
|
*/
|
|
export type AddExemptURLsToPrivateIPRanges = string[]
|
|
/**
|
|
* Disallow all outgoing SMTP connections to private IP ranges. This feature can help protect against SSRF attacks.
|
|
*/
|
|
export type DisallowPrivateIPRanges1 = boolean
|
|
/**
|
|
* List of request headers that are forwarded to the web hook target in canonical form.
|
|
*/
|
|
export type AllowedRequestHeaders = string[]
|
|
/**
|
|
* If enabled allows Ory Sessions to be cached. Only effective in the Ory Network.
|
|
*/
|
|
export type EnableOrySessionsCaching = boolean
|
|
/**
|
|
* Set how long Ory Sessions are cached on the edge. If unset, the session expiry will be used. Only effective in the Ory Network.
|
|
*/
|
|
export type SetOrySessionEdgeCachingMaximumAge = string
|
|
/**
|
|
* If enabled allows new flow transitions using `continue_with` items.
|
|
*/
|
|
export type EnableNewFlowTransitionsUsingContinueWithItems = boolean
|
|
/**
|
|
* If enabled, enable new recovery screens to pick which address to send a recovery code to, and can send a code via SMS. It is safe to toggle it back and forth, existing recovery flows will be handled with their respective logic. That is because it is decided at creation time whether a recovery flow is V1 or V2 and this cannot be changed afterwards. Thus, if a recovery flow is created with this flag enabled, it will be created as a recovery v2 flow. If this flag is disabled while this flow is still active, this flow will still be handled with the correct logic (v2).
|
|
*/
|
|
export type EnableNewRecoveryScreensToPickWhichAddressToSendARecoveryCodeLinkTo =
|
|
boolean
|
|
/**
|
|
* If true, restores the legacy behavior of always including `show_verification_ui` in the registration flow's `continue_with` when verification is enabled. If set to false, `show_verification_ui` is only set in `continue_with` if the `show_verification_ui` hook is used. This flag will be removed in the future.
|
|
*/
|
|
export type AlwaysIncludeShowVerificationUiInContinueWith = boolean
|
|
/**
|
|
* If true, the login flow will return a form error if the login identifier is not verified, which restores legacy behavior. If this value is false, the `continue_with` array will contain a `show_verification_ui` hook instead.
|
|
*/
|
|
export type ReturnAFormErrorIfTheLoginIdentifierIsNotVerified = boolean
|
|
/**
|
|
* If enabled allows faster session extension by skipping the session lookup. Disabling this feature will be deprecated in the future.
|
|
*/
|
|
export type EnableFasterSessionExtension = boolean
|
|
/**
|
|
* The node group to use for registration flows. Previously, the node group for the password method's profile fields was `password`. Going forward, it will be `default`. This switch can toggle between those two for backwards compatibility.
|
|
*/
|
|
export type RegistrationNodeGroup = "password" | "default"
|
|
/**
|
|
* The node group to use for registration flows. Previously, the node group for the oidc method's profile fields was `oidc`. Going forward, it will be `default`. This switch can toggle between those two for backwards compatibility and will be removed in the future.
|
|
*/
|
|
export type RegistrationNodeGroupForOIDC = boolean
|
|
/**
|
|
* If enabled, a code-strategy refresh (privileged re-authentication) login renders a "Send code to <address>" button per available code address instead of re-asking for the identifier. The identity is fixed by the active session, so re-entering the identifier is unnecessary and makes the privileged login look like a fresh login. It is safe to toggle this back and forth.
|
|
*/
|
|
export type EnableTheAddressPickerOnTheCodeRefreshLoginScreen = boolean
|
|
/**
|
|
* Please use selfservice.methods.b2b instead. This key will be removed. Only effective in the Ory Network.
|
|
*/
|
|
export type Organizations = unknown[]
|
|
/**
|
|
* A fallback URL template used when looking up identity schemas.
|
|
*/
|
|
export type FallbackURLTemplateForIdentitySchemas = string
|
|
/**
|
|
* Set a recognizable revision. This could be the commit time or a random value. This value is exposed at the `/health/config` endpoint and allows you to ensure that the correct config is loaded.
|
|
*/
|
|
export type ConfigRevision = string
|
|
|
|
export interface SelfServiceAfterSettings {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
password?: SelfServiceAfterSettingsAuthMethod
|
|
totp?: SelfServiceAfterSettingsAuthMethod
|
|
oidc?: SelfServiceAfterSettingsAuthMethod
|
|
webauthn?: SelfServiceAfterSettingsAuthMethod
|
|
passkey?: SelfServiceAfterSettingsAuthMethod
|
|
lookup_secret?: SelfServiceAfterSettingsAuthMethod
|
|
profile?: SelfServiceAfterSettingsProfileMethod
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface SelfServiceAfterSettingsAuthMethod {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: (SelfServiceWebHook | SelfServiceSessionRevokerHook)[]
|
|
}
|
|
export interface SelfServiceWebHook {
|
|
hook: "web_hook"
|
|
config: WebHookConfiguration
|
|
}
|
|
export interface SelfServiceSessionRevokerHook {
|
|
hook: "revoke_active_sessions"
|
|
}
|
|
export interface SelfServiceAfterSettingsProfileMethod {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: (
|
|
| SelfServiceWebHook
|
|
| SelfServiceShowVerificationUIHook
|
|
| B2BSSOHook
|
|
| VerifyNewAddressSettingsHook
|
|
| SelfServiceNotifyPreviousAddressesHook
|
|
)[]
|
|
}
|
|
export interface SelfServiceShowVerificationUIHook {
|
|
hook: "show_verification_ui"
|
|
}
|
|
export interface B2BSSOHook {
|
|
hook: "b2b_sso" | "organization"
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Defers email or phone changes made through the settings profile flow until the new address is verified. The identity's traits are applied only after the user completes a verification flow for the new address.
|
|
*
|
|
* Configuration note: do not configure `show_verification_ui` on the same `selfservice.flows.settings.after.profile.hooks` list. `verify_new_address` aborts the settings flow and triggers its own verification, so a `show_verification_ui` hook on the profile list would run twice: once when the settings flow is aborted and again after verification completes. Keep `show_verification_ui` off the `profile` hook list when `verify_new_address` is active.
|
|
*
|
|
* When the pending change is applied, the remaining post-persist hooks on the `profile` list (for example, `web_hook`) run against the updated identity. The pending change is rejected if the session that initiated it has been revoked, expired, or deleted before verification completes.
|
|
*/
|
|
export interface VerifyNewAddressSettingsHook {
|
|
hook: "verify_new_address"
|
|
}
|
|
export interface SelfServiceNotifyPreviousAddressesHook {
|
|
hook: "notify_previous_addresses"
|
|
config?: {
|
|
/**
|
|
* Which previous addresses receive the change notification. 'removed' (default): only addresses that no longer exist after the change. 'all_verified': all addresses that were verified before the change. 'all': all addresses on the identity before the change.
|
|
*/
|
|
recipients?: "removed" | "all_verified" | "all"
|
|
}
|
|
}
|
|
export interface SelfServiceBeforeSettings {
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface SelfServiceBeforeRegistration {
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface SelfServiceAfterRegistration {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
password?: SelfServiceAfterRegistrationMethod
|
|
webauthn?: SelfServiceAfterRegistrationMethod
|
|
passkey?: SelfServiceAfterRegistrationMethod
|
|
oidc?: SelfServiceAfterRegistrationMethod
|
|
code?: SelfServiceAfterRegistrationMethod
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface SelfServiceAfterRegistrationMethod {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: (
|
|
| SelfServiceSessionIssuerHook
|
|
| SelfServiceWebHook
|
|
| SelfServiceShowVerificationUIHook
|
|
| B2BSSOHook
|
|
)[]
|
|
}
|
|
export interface SelfServiceSessionIssuerHook {
|
|
hook: "session"
|
|
}
|
|
export interface SelfServiceBeforeLogin {
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface SelfServiceAfterLogin {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
password?: SelfServiceAfterDefaultLoginMethod
|
|
webauthn?: SelfServiceAfterDefaultLoginMethod
|
|
passkey?: SelfServiceAfterDefaultLoginMethod
|
|
oidc?: SelfServiceAfterOIDCLoginMethod
|
|
code?: SelfServiceAfterDefaultLoginMethod
|
|
totp?: SelfServiceAfterDefaultLoginMethod
|
|
lookup_secret?: SelfServiceAfterDefaultLoginMethod
|
|
hooks?: SelfServiceAfterDefaultLoginMethodHooks
|
|
}
|
|
export interface SelfServiceAfterDefaultLoginMethod {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: SelfServiceAfterDefaultLoginMethodHooks
|
|
}
|
|
export interface SelfServiceRequireVerifiedAddressHook {
|
|
hook: "require_verified_address"
|
|
}
|
|
export interface SelfServiceVerificationHook {
|
|
hook: "verification"
|
|
}
|
|
export interface SelfServiceAfterOIDCLoginMethod {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: (
|
|
| SelfServiceSessionRevokerHook
|
|
| SelfServiceWebHook
|
|
| SelfServiceRequireVerifiedAddressHook
|
|
| B2BSSOHook
|
|
)[]
|
|
}
|
|
export interface EmailAndPhoneVerificationAndAccountActivationConfiguration {
|
|
enabled?: EnableEmailPhoneVerification
|
|
ui_url?: VerifyUIURL
|
|
after?: SelfServiceAfterVerification
|
|
lifespan?: SelfServiceVerificationRequestLifespan
|
|
before?: SelfServiceBeforeVerification
|
|
use?: VerificationStrategy
|
|
notify_unknown_recipients?: NotifyUnknownRecipients
|
|
}
|
|
export interface SelfServiceAfterVerification {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface SelfServiceBeforeVerification {
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
export interface AccountRecoveryConfiguration {
|
|
enabled?: EnableAccountRecovery
|
|
ui_url?: RecoveryUIURL
|
|
after?: SelfServiceAfterRecovery
|
|
lifespan?: SelfServiceRecoveryRequestLifespan
|
|
before?: SelfServiceBeforeRecovery
|
|
use?: RecoveryStrategy
|
|
notify_unknown_recipients?: NotifyUnknownRecipients1
|
|
}
|
|
export interface SelfServiceAfterRecovery {
|
|
default_browser_return_url?: RedirectBrowsersToSetURLPerDefault
|
|
hooks?: SelfServiceAfterRecoveryHooks
|
|
}
|
|
export interface SelfServiceBeforeRecovery {
|
|
hooks?: SelfServiceHooks
|
|
}
|
|
/**
|
|
* Single Sign-On for B2B allows your customers to bring their own (workforce) identity server (e.g. OneLogin). This feature is not available in the open source licensed code.
|
|
*/
|
|
export interface SingleSignOnForB2B {
|
|
config?: {
|
|
organizations?: {
|
|
/**
|
|
* The ID of the organization.
|
|
*/
|
|
id?: string
|
|
/**
|
|
* The label of the organization.
|
|
*/
|
|
label?: string
|
|
domains?: string[]
|
|
session_lifespan?: SessionLifespanOverride
|
|
[k: string]: unknown | undefined
|
|
}[]
|
|
}
|
|
}
|
|
/**
|
|
* Additional configuration for the link strategy.
|
|
*/
|
|
export interface LinkConfiguration {
|
|
base_url?: OverrideTheBaseURLWhichShouldBeUsedAsTheBaseForRecoveryAndVerificationLinks
|
|
lifespan?: HowLongALinkIsValidFor
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Define how passwords are validated.
|
|
*/
|
|
export interface PasswordConfiguration {
|
|
haveibeenpwned_host?: CustomHaveibeenpwnedHost
|
|
haveibeenpwned_enabled?: EnableTheHaveIBeenPwnedAPI
|
|
max_breaches?: AllowPasswordBreaches
|
|
ignore_network_errors?: IgnoreLookupNetworkErrors
|
|
min_password_length?: MinimumPasswordLength
|
|
identifier_similarity_check_enabled?: EnablePasswordIdentifierSimilarityCheck
|
|
migrate_hook?: {
|
|
enabled?: EnablePasswordMigration
|
|
config?: {
|
|
/**
|
|
* The URL the password migration hook should call
|
|
*/
|
|
url?: string
|
|
/**
|
|
* The HTTP method to use (GET, POST, etc).
|
|
*/
|
|
method?: "POST"
|
|
/**
|
|
* The HTTP headers that must be applied to the password migration hook.
|
|
*/
|
|
headers?: {
|
|
[k: string]: string | undefined
|
|
}
|
|
/**
|
|
* Emit tracing events for this hook on delivery or error
|
|
*/
|
|
emit_analytics_event?: boolean
|
|
auth?: AuthMechanisms
|
|
/**
|
|
* URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads
|
|
*/
|
|
body?: string
|
|
additionalProperties?: never
|
|
}
|
|
}
|
|
}
|
|
export interface WebHookAuthApiKeyProperties {
|
|
type: "api_key"
|
|
config: {
|
|
/**
|
|
* The name of the api key
|
|
*/
|
|
name: string
|
|
/**
|
|
* The value of the api key
|
|
*/
|
|
value: string
|
|
/**
|
|
* How the api key should be transferred
|
|
*/
|
|
in: "header" | "cookie"
|
|
}
|
|
}
|
|
export interface WebHookAuthBasicAuthProperties {
|
|
type: "basic_auth"
|
|
config: {
|
|
/**
|
|
* user name for basic auth
|
|
*/
|
|
user: string
|
|
/**
|
|
* password for basic auth
|
|
*/
|
|
password: string
|
|
}
|
|
}
|
|
export interface TOTPConfiguration {
|
|
issuer?: TOTPIssuer
|
|
}
|
|
export interface WebAuthnConfiguration {
|
|
passwordless?: UseForPasswordlessFlows
|
|
rp?: RelyingPartyRPConfig
|
|
}
|
|
export interface PasskeyConfiguration {
|
|
rp?: RelyingPartyRPConfig1
|
|
authenticator_selection?: AuthenticatorSelectionCriteria
|
|
attestation?: AttestationConfiguration
|
|
timeouts?: TimeoutConfiguration
|
|
}
|
|
export interface RelyingPartyRPConfig1 {
|
|
display_name: RelyingPartyDisplayName
|
|
id: RelyingPartyIdentifier
|
|
origins?: RelyingPartyOrigins
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Controls which authenticators are eligible for passkey registration.
|
|
*/
|
|
export interface AuthenticatorSelectionCriteria {
|
|
attachment?: AuthenticatorAttachment
|
|
resident_key?: ClientSideDiscoverableCredentialRequirement
|
|
user_verification?: UserVerificationRequirement
|
|
}
|
|
/**
|
|
* Controls the attestation conveyance preference sent to the authenticator during passkey registration.
|
|
*/
|
|
export interface AttestationConfiguration {
|
|
preference?: AttestationConveyancePreference
|
|
}
|
|
/**
|
|
* Controls timeouts for passkey registration and login ceremonies.
|
|
*/
|
|
export interface TimeoutConfiguration {
|
|
registration?: RegistrationTimeout
|
|
login?: LoginTimeout
|
|
}
|
|
export interface SpecifyOpenIDConnectAndOAuth2Configuration {
|
|
enabled?: EnablesOpenIDConnectMethod
|
|
config?: {
|
|
base_redirect_uri?: BaseURLForOAuth2RedirectURIs
|
|
providers?: OpenIDConnectAndOAuth2Providers
|
|
}
|
|
}
|
|
/**
|
|
* The OpenID Connect claims and optionally their properties which should be included in the id_token or returned from the UserInfo Endpoint.
|
|
*/
|
|
export interface OpenIDConnectClaims {
|
|
/**
|
|
* This interface was referenced by `OpenIDConnectClaims`'s JSON-Schema definition
|
|
* via the `patternProperty` "^userinfo$|^id_token$".
|
|
*/
|
|
[k: string]: {
|
|
/**
|
|
* This interface was referenced by `undefined`'s JSON-Schema definition
|
|
* via the `patternProperty` ".*".
|
|
*/
|
|
[k: string]: null | {
|
|
/**
|
|
* Indicates whether the Claim being requested is an Essential Claim.
|
|
*/
|
|
essential?: boolean
|
|
/**
|
|
* Requests that the Claim be returned with a particular value.
|
|
*/
|
|
value?: {
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Requests that the Claim be returned with one of a set of values, with the values appearing in order of preference.
|
|
*/
|
|
values?: {
|
|
[k: string]: unknown | undefined
|
|
}[]
|
|
}
|
|
}
|
|
}
|
|
/**
|
|
* Miscellaneous settings used in database related tasks (cleanup, etc.)
|
|
*/
|
|
export interface DatabaseRelatedConfiguration {
|
|
cleanup?: DatabaseCleanupSettings
|
|
}
|
|
/**
|
|
* Settings that controls how the database cleanup process is configured (delays, batch size, etc.)
|
|
*/
|
|
export interface DatabaseCleanupSettings {
|
|
batch_size?: NumberOfRecordsToCleanInOneIteration
|
|
sleep?: DelaysBetweenVariousDatabaseCleanupPhases
|
|
older_than?: RemoveRecordsOlderThan
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Configures delays between each step of the cleanup process. It is useful to tune the process so it will be efficient and performant.
|
|
*/
|
|
export interface DelaysBetweenVariousDatabaseCleanupPhases {
|
|
tables?: DelayBetweenEachTableCleanups
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* The courier is responsible for sending and delivering messages over email, sms, and other means.
|
|
*/
|
|
export interface CourierConfiguration {
|
|
templates?: {
|
|
recovery?: CourierTemplates
|
|
recovery_code?: CourierTemplates
|
|
verification?: CourierTemplates
|
|
verification_code?: CourierTemplates
|
|
registration_code?: {
|
|
valid?: {
|
|
email: EmailCourierTemplate
|
|
sms?: SmsCourierTemplate
|
|
}
|
|
}
|
|
login_code?: {
|
|
valid?: {
|
|
email: EmailCourierTemplate
|
|
sms?: SmsCourierTemplate
|
|
}
|
|
}
|
|
verifiable_address_changed?: {
|
|
email?: EmailCourierTemplate
|
|
sms?: SmsCourierTemplate
|
|
}
|
|
}
|
|
template_override_path?: OverrideMessageTemplates
|
|
/**
|
|
* Defines the maximum number of times the sending of a message is retried after it failed before it is marked as abandoned
|
|
*/
|
|
message_retries?: number
|
|
/**
|
|
* Configures the dispatch worker.
|
|
*/
|
|
worker?: {
|
|
/**
|
|
* Defines how many messages are pulled from the queue at once.
|
|
*/
|
|
pull_count?: number
|
|
/**
|
|
* Defines how long the worker waits before pulling messages from the queue again.
|
|
*/
|
|
pull_wait?: string
|
|
[k: string]: unknown | undefined
|
|
}
|
|
delivery_strategy?: DeliveryStrategy
|
|
http?: HTTPConfiguration
|
|
smtp?: SMTPConfiguration
|
|
channels?: CourierChannelConfiguration[]
|
|
}
|
|
export interface CourierTemplates {
|
|
invalid?: {
|
|
email: EmailCourierTemplate
|
|
}
|
|
valid?: {
|
|
email: EmailCourierTemplate
|
|
sms?: SmsCourierTemplate
|
|
}
|
|
}
|
|
export interface EmailCourierTemplate {
|
|
body?: {
|
|
/**
|
|
* The fallback template for email clients that do not support html.
|
|
*/
|
|
plaintext?: string
|
|
/**
|
|
* The default template used for sending out emails. The template can contain HTML
|
|
*/
|
|
html?: string
|
|
}
|
|
subject?: string
|
|
}
|
|
export interface SmsCourierTemplate {
|
|
body?: {
|
|
/**
|
|
* A template send to the SMS provider.
|
|
*/
|
|
plaintext?: string
|
|
}
|
|
}
|
|
/**
|
|
* Configures outgoing emails using HTTP.
|
|
*/
|
|
export interface HTTPConfiguration {
|
|
request_config?: HttpRequestConfig
|
|
}
|
|
export interface HttpRequestConfig {
|
|
url?: HTTPAddressOfAPIEndpoint
|
|
/**
|
|
* The HTTP method to use (GET, POST, etc). Defaults to POST.
|
|
*/
|
|
method?: string
|
|
/**
|
|
* The HTTP headers that must be applied to request
|
|
*/
|
|
headers?: {
|
|
[k: string]: string | undefined
|
|
}
|
|
/**
|
|
* URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods which support HTTP body payloads
|
|
*/
|
|
body?: string
|
|
auth?: AuthMechanisms1
|
|
additionalProperties?: never
|
|
}
|
|
/**
|
|
* Configures outgoing emails using the SMTP protocol.
|
|
*/
|
|
export interface SMTPConfiguration {
|
|
connection_uri?: SMTPConnectionString
|
|
client_cert_path?: SMTPClientCertificatePath
|
|
client_key_path?: SMTPClientPrivateKeyPath
|
|
from_address?: SMTPSenderAddress
|
|
from_name?: SMTPSenderName
|
|
headers?: SMTPHeaders
|
|
local_name?: SMTPHELOEHLOName
|
|
}
|
|
/**
|
|
* These headers will be passed in the SMTP conversation -- e.g. when using the AWS SES SMTP interface for cross-account sending.
|
|
*/
|
|
export interface SMTPHeaders {
|
|
[k: string]: string | undefined
|
|
}
|
|
export interface CourierChannelConfiguration {
|
|
id: ChannelId
|
|
type?: ChannelType
|
|
request_config: HttpRequestConfig
|
|
}
|
|
export interface OAuth2ProviderConfiguration {
|
|
url?: OAuth20ProviderURL
|
|
headers?: HTTPRequestHeaders
|
|
override_return_to?: PersistOAuth2RequestBetweenFlows
|
|
}
|
|
/**
|
|
* These headers will be passed in HTTP request to the OAuth2 Provider.
|
|
*/
|
|
export interface HTTPRequestHeaders {
|
|
[k: string]: string | undefined
|
|
}
|
|
export interface ConfigurePreviewFeatures {
|
|
default_read_consistency_level?: DefaultReadConsistencyLevel
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Sets the permissions of the unix socket
|
|
*/
|
|
export interface Socket {
|
|
/**
|
|
* Owner of unix socket. If empty, the owner will be the user running Kratos.
|
|
*/
|
|
owner?: string
|
|
/**
|
|
* Group of unix socket. If empty, the group will be the primary group of the user running Kratos.
|
|
*/
|
|
group?: string
|
|
/**
|
|
* Mode of unix socket in numeric form
|
|
*/
|
|
mode?: number
|
|
}
|
|
/**
|
|
* Configure HTTP over TLS (HTTPS). All options can also be set using environment variables by replacing dots (`.`) with underscores (`_`) and uppercasing the key. For example, `some.prefix.tls.key.path` becomes `export SOME_PREFIX_TLS_KEY_PATH`. If all keys are left undefined, TLS will be disabled.
|
|
*/
|
|
export interface HTTPS {
|
|
key?: PrivateKeyPEM
|
|
cert?: TLSCertificatePEM
|
|
}
|
|
export interface TlsxSource {
|
|
path?: PathToPEMEncodedFle
|
|
base64?: Base64EncodedInline
|
|
}
|
|
/**
|
|
* Configure logging using the following options. Logging will always be sent to stdout and stderr.
|
|
*/
|
|
export interface Log {
|
|
/**
|
|
* Debug enables stack traces on errors. Can also be set using environment variable LOG_LEVEL.
|
|
*/
|
|
level?: "trace" | "debug" | "info" | "warning" | "error" | "fatal" | "panic"
|
|
leak_sensitive_values?: LeakSensitiveLogValues
|
|
redaction_text?: SensitiveLogValueRedactionText
|
|
/**
|
|
* The log format can either be text or JSON.
|
|
*/
|
|
format?: "json" | "text"
|
|
}
|
|
export interface HashingAlgorithmConfiguration {
|
|
algorithm?: PasswordHashingAlgorithm
|
|
argon2?: ConfigurationForTheArgon2IdHasher
|
|
bcrypt?: ConfigurationForTheBcryptHasherMinimumIs4WhenDevFlagIsUsedAnd12Otherwise
|
|
}
|
|
export interface ConfigurationForTheArgon2IdHasher {
|
|
memory?: string
|
|
iterations?: number
|
|
/**
|
|
* Number of parallel workers, defaults to 2*runtime.NumCPU().
|
|
*/
|
|
parallelism?: number
|
|
salt_length?: number
|
|
key_length?: number
|
|
/**
|
|
* The time a hashing operation (~login latency) should take.
|
|
*/
|
|
expected_duration?: string
|
|
/**
|
|
* The standard deviation expected for hashing operations. If this value is exceeded you will be warned in the logs to adjust the parameters.
|
|
*/
|
|
expected_deviation?: string
|
|
/**
|
|
* The memory dedicated for Kratos. As password hashing is very resource intense, Kratos will monitor the memory consumption and warn about high values.
|
|
*/
|
|
dedicated_memory?: string
|
|
}
|
|
export interface ConfigurationForTheBcryptHasherMinimumIs4WhenDevFlagIsUsedAnd12Otherwise {
|
|
cost: number
|
|
}
|
|
export interface CipherAlgorithmConfiguration {
|
|
algorithm?: CipheringAlgorithm
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Configure the HTTP Cookies. Applies to both CSRF and session cookies.
|
|
*/
|
|
export interface HTTPCookieConfiguration {
|
|
domain?: HTTPCookieDomain
|
|
path?: HTTPCookiePath
|
|
secure?: SessionCookieSecureFlag
|
|
same_site?: HTTPCookieSameSiteConfiguration
|
|
}
|
|
/**
|
|
* Control how the `/sessions/whoami` endpoint is behaving.
|
|
*/
|
|
export interface WhoAmIToSessionSettings {
|
|
required_aal?: RequiredAuthenticatorAssuranceLevel
|
|
tokenizer?: TokenizerConfiguration
|
|
}
|
|
/**
|
|
* Configure the tokenizer, responsible for converting a session into a token format such as JWT.
|
|
*/
|
|
export interface TokenizerConfiguration {
|
|
templates?: TokenizerTemplates
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* A list of different templates that govern how a session is converted to a token format.
|
|
*/
|
|
export interface TokenizerTemplates {
|
|
/**
|
|
* This interface was referenced by `TokenizerTemplates`'s JSON-Schema definition
|
|
* via the `patternProperty` "[a-zA-Z0-9-_.]+".
|
|
*/
|
|
[k: string]: {
|
|
ttl?: TokenTimeToLive
|
|
claims_mapper_url?: JsonnetMapperURL1
|
|
jwks_url: JSONWebKeySetURL
|
|
subject_source?: SubjectSource
|
|
[k: string]: unknown | undefined
|
|
}
|
|
}
|
|
/**
|
|
* Configure how outgoing network calls behave.
|
|
*/
|
|
export interface GlobalOutgoingNetworkSettings {
|
|
http?: GlobalHTTPClientConfiguration
|
|
smtp?: SMTPClientConfiguration
|
|
web_hook?: GlobalWebHookHTTPClientConfiguration
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Configure how outgoing HTTP calls behave.
|
|
*/
|
|
export interface GlobalHTTPClientConfiguration {
|
|
disallow_private_ip_ranges?: DisallowPrivateIPRanges
|
|
private_ip_exception_urls?: AddExemptURLsToPrivateIPRanges
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Configure how outgoing SMTP calls behave.
|
|
*/
|
|
export interface SMTPClientConfiguration {
|
|
disallow_private_ip_ranges?: DisallowPrivateIPRanges1
|
|
[k: string]: unknown | undefined
|
|
}
|
|
/**
|
|
* Configure the global HTTP client of the web_hook action.
|
|
*/
|
|
export interface GlobalWebHookHTTPClientConfiguration {
|
|
header_allowlist?: AllowedRequestHeaders
|
|
[k: string]: unknown | undefined
|
|
}
|
|
export interface FeatureFlags {
|
|
cacheable_sessions?: EnableOrySessionsCaching
|
|
cacheable_sessions_max_age?: SetOrySessionEdgeCachingMaximumAge
|
|
use_continue_with_transitions?: EnableNewFlowTransitionsUsingContinueWithItems
|
|
choose_recovery_address?: EnableNewRecoveryScreensToPickWhichAddressToSendARecoveryCodeLinkTo
|
|
legacy_continue_with_verification_ui?: AlwaysIncludeShowVerificationUiInContinueWith
|
|
legacy_require_verified_login_error?: ReturnAFormErrorIfTheLoginIdentifierIsNotVerified
|
|
faster_session_extend?: EnableFasterSessionExtension
|
|
password_profile_registration_node_group?: RegistrationNodeGroup
|
|
legacy_oidc_registration_node_group?: RegistrationNodeGroupForOIDC
|
|
refresh_login_choose_address?: EnableTheAddressPickerOnTheCodeRefreshLoginScreen
|
|
}
|
|
/**
|
|
* Specifies enterprise features. Only effective in the Ory Network or with a valid license.
|
|
*/
|
|
export interface EnterpriseFeatures {
|
|
identity_schema_fallback_url_template?: FallbackURLTemplateForIdentitySchemas
|
|
}
|