mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zooqueenandHanzo Dev
ecee5e40aa
The IAM callback at /auth/callback reads IAM's userinfo answer and refuses an address IAM has not verified. An account is found by its linked IAM identity alone (provider hanzo, the IAM subject); an existing account that only shares the address is refused, never merged. A first sign-in makes an account only for an admin of the org the application serves or for someone an organisation invited at that verified address. Every refusal returns to /signin with a sentence saying what to do. Accepting an organisation invitation joins the signed-in person, and only when their verified address is the invited one; opening the link no longer adds whoever holds the address. The local email/password sign-up, sign-in, reset, verify-email and update routes, pages, jobs and mail are gone, as are passkey sign-in, the Google, Microsoft and generic OIDC providers, the per-organisation SSO portal and its account-link flow. Passkeys and two-factor stay for confirming a signature. The e2e suite starts sessions the way a finished IAM sign-in leaves them. Co-authored-by: Hanzo Dev <[email protected]>
28 lines
661 B
JSON
28 lines
661 B
JSON
{
|
|
"name": "@hanzo/esign-auth",
|
|
"version": "0.0.0",
|
|
"main": "./index.ts",
|
|
"types": "./index.ts",
|
|
"license": "MIT",
|
|
"scripts": {
|
|
"lint": "eslint .",
|
|
"lint:fix": "eslint . --fix",
|
|
"test": "tsx --test __tests__/*.test.ts",
|
|
"clean": "rimraf node_modules"
|
|
},
|
|
"dependencies": {
|
|
"@hanzo/esign-lib": "*",
|
|
"@hanzo/esign-prisma": "*",
|
|
"@hono/standard-validator": "^0.4.0",
|
|
"@oslojs/crypto": "^1.0.1",
|
|
"@oslojs/encoding": "^1.1.0",
|
|
"@simplewebauthn/server": "^13.3.3",
|
|
"arctic": "^3.7.0",
|
|
"hono": "^4.13.5",
|
|
"luxon": "^3.7.2",
|
|
"nanoid": "^6.0.1",
|
|
"ts-pattern": "^5.9.0",
|
|
"zod": "^4.5.2"
|
|
}
|
|
}
|