mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zooqueenandHanzo Dev
ecee5e40aa
The IAM callback at /auth/callback reads IAM's userinfo answer and refuses an address IAM has not verified. An account is found by its linked IAM identity alone (provider hanzo, the IAM subject); an existing account that only shares the address is refused, never merged. A first sign-in makes an account only for an admin of the org the application serves or for someone an organisation invited at that verified address. Every refusal returns to /signin with a sentence saying what to do. Accepting an organisation invitation joins the signed-in person, and only when their verified address is the invited one; opening the link no longer adds whoever holds the address. The local email/password sign-up, sign-in, reset, verify-email and update routes, pages, jobs and mail are gone, as are passkey sign-in, the Google, Microsoft and generic OIDC providers, the per-organisation SSO portal and its account-link flow. Passkeys and two-factor stay for confirming a signature. The e2e suite starts sessions the way a finished IAM sign-in leaves them. Co-authored-by: Hanzo Dev <[email protected]>
96 lines
3.5 KiB
TypeScript
96 lines
3.5 KiB
TypeScript
declare namespace NodeJS {
|
|
export interface ProcessEnv {
|
|
PORT?: string;
|
|
NEXT_PUBLIC_WEBAPP_URL?: string;
|
|
NEXT_PRIVATE_SIGN_LICENSE_KEY?: string;
|
|
|
|
// Base SQLite (single shared file). BASE_PATH is the directory that contains
|
|
// the one `sign.db` file; DATABASE_URL is the `file:` URL Prisma / the CLI /
|
|
// migrations open. Tenancy is enforced in-query via buildTeamWhereQuery, not
|
|
// by a per-org file — see packages/prisma/tenant.ts and HIP-0305.
|
|
BASE_PATH: string;
|
|
DATABASE_URL: string;
|
|
NEXT_PRIVATE_ENCRYPTION_KEY: string;
|
|
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: string;
|
|
|
|
NEXT_PRIVATE_LOGGER_FILE_PATH?: string;
|
|
|
|
NEXT_PRIVATE_STRIPE_API_KEY: string;
|
|
NEXT_PRIVATE_STRIPE_WEBHOOK_SECRET: string;
|
|
|
|
NEXT_PUBLIC_UPLOAD_TRANSPORT?: 'database' | 's3';
|
|
NEXT_PRIVATE_UPLOAD_ENDPOINT?: string;
|
|
NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE?: string;
|
|
NEXT_PRIVATE_UPLOAD_REGION?: string;
|
|
NEXT_PRIVATE_UPLOAD_BUCKET?: string;
|
|
NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID?: string;
|
|
NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY?: string;
|
|
NEXT_PRIVATE_UPLOAD_DISTRIBUTION_DOMAIN?: string;
|
|
NEXT_PRIVATE_UPLOAD_DISTRIBUTION_KEY_ID?: string;
|
|
NEXT_PRIVATE_UPLOAD_DISTRIBUTION_KEY_CONTENTS?: string;
|
|
|
|
NEXT_PRIVATE_SIGNING_TRANSPORT?: 'local' | 'http' | 'gcloud-hsm';
|
|
NEXT_PRIVATE_SIGNING_PASSPHRASE?: string;
|
|
NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH?: string;
|
|
NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS?: string;
|
|
NEXT_PRIVATE_SIGNING_LOCAL_FILE_ENCODING?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_PATH?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_FILE_PATH?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_CONTENTS?: string;
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_SECRET_MANAGER_CERT_PATH?: string;
|
|
NEXT_PRIVATE_SIGNING_TIMESTAMP_AUTHORITY?: string;
|
|
NEXT_PUBLIC_SIGNING_CONTACT_INFO?: string;
|
|
NEXT_PRIVATE_USE_LEGACY_SIGNING_SUBFILTER?: string;
|
|
|
|
NEXT_PRIVATE_SMTP_TRANSPORT?: 'notify' | 'mailchannels' | 'resend' | 'smtp-auth' | 'smtp-api';
|
|
|
|
NEXT_PRIVATE_RESEND_API_KEY?: string;
|
|
|
|
NEXT_PRIVATE_MAILCHANNELS_API_KEY?: string;
|
|
NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN?: string;
|
|
NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR?: string;
|
|
NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY?: string;
|
|
NEXT_PRIVATE_MAILCHANNELS_ENDPOINT?: string;
|
|
|
|
NEXT_PRIVATE_SMTP_HOST?: string;
|
|
NEXT_PRIVATE_SMTP_PORT?: string;
|
|
NEXT_PRIVATE_SMTP_USERNAME?: string;
|
|
NEXT_PRIVATE_SMTP_PASSWORD?: string;
|
|
|
|
NEXT_PRIVATE_SMTP_APIKEY_USER?: string;
|
|
NEXT_PRIVATE_SMTP_APIKEY?: string;
|
|
|
|
NEXT_PRIVATE_SMTP_SECURE?: string;
|
|
NEXT_PRIVATE_SMTP_UNSAFE_IGNORE_TLS?: string;
|
|
|
|
NEXT_PRIVATE_SMTP_FROM_NAME?: string;
|
|
NEXT_PRIVATE_SMTP_FROM_ADDRESS?: string;
|
|
|
|
NEXT_PUBLIC_DISABLE_SIGNUP?: string;
|
|
|
|
NEXT_PRIVATE_BROWSERLESS_URL?: string;
|
|
|
|
NEXT_PRIVATE_JOBS_PROVIDER?: 'inngest' | 'local';
|
|
|
|
NEXT_PUBLIC_USE_INTERNAL_URL_BROWSERLESS?: string;
|
|
|
|
/**
|
|
* Inngest environment variables
|
|
*/
|
|
INNGEST_EVENT_KEY?: string;
|
|
INNGEST_SIGNING_KEY?: string;
|
|
NEXT_PRIVATE_INNGEST_APP_ID?: string;
|
|
NEXT_PRIVATE_INNGEST_EVENT_KEY?: string;
|
|
|
|
/**
|
|
* Google Vertex AI environment variables
|
|
*/
|
|
GOOGLE_VERTEX_PROJECT_ID?: string;
|
|
GOOGLE_VERTEX_LOCATION?: string;
|
|
GOOGLE_VERTEX_API_KEY?: string;
|
|
}
|
|
}
|