mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zooqueenandHanzo Dev
ecee5e40aa
The IAM callback at /auth/callback reads IAM's userinfo answer and refuses an address IAM has not verified. An account is found by its linked IAM identity alone (provider hanzo, the IAM subject); an existing account that only shares the address is refused, never merged. A first sign-in makes an account only for an admin of the org the application serves or for someone an organisation invited at that verified address. Every refusal returns to /signin with a sentence saying what to do. Accepting an organisation invitation joins the signed-in person, and only when their verified address is the invited one; opening the link no longer adds whoever holds the address. The local email/password sign-up, sign-in, reset, verify-email and update routes, pages, jobs and mail are gone, as are passkey sign-in, the Google, Microsoft and generic OIDC providers, the per-organisation SSO portal and its account-link flow. Passkeys and two-factor stay for confirming a signature. The e2e suite starts sessions the way a finished IAM sign-in leaves them. Co-authored-by: Hanzo Dev <[email protected]>
156 lines
4.6 KiB
YAML
156 lines
4.6 KiB
YAML
services:
|
|
- type: web
|
|
runtime: node
|
|
name: hanzo-sign-app
|
|
plan: free
|
|
buildCommand: npm i && npm run build
|
|
startCommand: npx prisma migrate deploy --schema packages/prisma/schema.prisma && npx turbo run start --filter=@hanzo/esign-remix
|
|
healthCheckPath: /v1/health
|
|
|
|
# The embedded Base SQLite database lives on a persistent disk; `sign.db`
|
|
# is created on demand under BASE_PATH on first start.
|
|
disk:
|
|
name: hanzo-sign-base
|
|
mountPath: /opt/hanzo-sign/base/data
|
|
sizeGB: 10
|
|
|
|
envVars:
|
|
# Node Version
|
|
- key: NODE_VERSION
|
|
value: 22.22.0
|
|
|
|
- key: PORT
|
|
value: 10000
|
|
|
|
# Auth
|
|
- key: NEXT_PUBLIC_WEBAPP_URL
|
|
fromService:
|
|
name: hanzo-sign-app
|
|
type: web
|
|
envVarKey: RENDER_EXTERNAL_URL
|
|
- key: NEXT_PRIVATE_AUTH_SECRET
|
|
generateValue: true
|
|
|
|
# Database — embedded Base SQLite under the persistent disk's BASE_PATH.
|
|
- key: BASE_PATH
|
|
value: /opt/hanzo-sign/base/data
|
|
- key: DATABASE_URL
|
|
value: file:/opt/hanzo-sign/base/data/sign.db
|
|
|
|
# URLs
|
|
- key: NEXT_PUBLIC_WEBAPP_URL
|
|
fromService:
|
|
name: hanzo-sign-app
|
|
type: web
|
|
envVarKey: RENDER_EXTERNAL_URL
|
|
- key: NEXT_PRIVATE_INTERNAL_WEBAPP_URL
|
|
value: 'http://localhost:10000'
|
|
|
|
# SMTP
|
|
- key: NEXT_PRIVATE_SMTP_TRANSPORT
|
|
value: 'smtp-auth'
|
|
- key: NEXT_PRIVATE_SMTP_HOST
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_PORT
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_USERNAME
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_PASSWORD
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_FROM_NAME
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_FROM_ADDRESS
|
|
sync: false
|
|
|
|
# Stripe
|
|
- key: NEXT_PRIVATE_STRIPE_API_KEY
|
|
sync: false
|
|
- key: NEXT_PRIVATE_STRIPE_WEBHOOK_SECRET
|
|
sync: false
|
|
|
|
# Features
|
|
- key: NEXT_PUBLIC_INSIGHTS_KEY
|
|
sync: false
|
|
- key: NEXT_PUBLIC_FEATURE_BILLING_ENABLED
|
|
sync: false
|
|
|
|
# Storage
|
|
- key: NEXT_PUBLIC_UPLOAD_TRANSPORT
|
|
value: 'database'
|
|
- key: NEXT_PRIVATE_UPLOAD_ENDPOINT
|
|
sync: false
|
|
- key: NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE
|
|
sync: false
|
|
- key: NEXT_PRIVATE_UPLOAD_REGION
|
|
sync: false
|
|
- key: NEXT_PRIVATE_UPLOAD_BUCKET
|
|
sync: false
|
|
- key: NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID
|
|
sync: false
|
|
- key: NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY
|
|
sync: false
|
|
|
|
# Crypto
|
|
- key: NEXT_PRIVATE_ENCRYPTION_KEY
|
|
generateValue: true
|
|
- key: NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY
|
|
generateValue: true
|
|
|
|
# Signing
|
|
- key: NEXT_PRIVATE_SIGNING_TRANSPORT
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_PASSPHRASE
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_PATH
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_FILE_PATH
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_CONTENTS
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_GCLOUD_HSM_SECRET_MANAGER_CERT_PATH
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SIGNING_TIMESTAMP_AUTHORITY
|
|
sync: false
|
|
- key: NEXT_PUBLIC_SIGNING_CONTACT_INFO
|
|
sync: false
|
|
- key: NEXT_PRIVATE_USE_LEGACY_SIGNING_SUBFILTER
|
|
sync: false
|
|
|
|
# SMTP Optional
|
|
- key: NEXT_PRIVATE_SMTP_APIKEY_USER
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_APIKEY
|
|
sync: false
|
|
- key: NEXT_PRIVATE_SMTP_SECURE
|
|
sync: false
|
|
- key: NEXT_PRIVATE_RESEND_API_KEY
|
|
sync: false
|
|
- key: NEXT_PRIVATE_MAILCHANNELS_API_KEY
|
|
sync: false
|
|
- key: NEXT_PRIVATE_MAILCHANNELS_ENDPOINT
|
|
sync: false
|
|
- key: NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN
|
|
sync: false
|
|
- key: NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR
|
|
sync: false
|
|
- key: NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY
|
|
sync: false
|
|
- key: NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT
|
|
sync: false
|
|
|
|
# Features Optional
|
|
- key: NEXT_PUBLIC_DISABLE_SIGNUP
|
|
sync: false
|
|
- key: NEXT_PUBLIC_USE_INTERNAL_URL_BROWSERLESS
|
|
sync: false
|