mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zooqueenandHanzo Dev
ecee5e40aa
The IAM callback at /auth/callback reads IAM's userinfo answer and refuses an address IAM has not verified. An account is found by its linked IAM identity alone (provider hanzo, the IAM subject); an existing account that only shares the address is refused, never merged. A first sign-in makes an account only for an admin of the org the application serves or for someone an organisation invited at that verified address. Every refusal returns to /signin with a sentence saying what to do. Accepting an organisation invitation joins the signed-in person, and only when their verified address is the invited one; opening the link no longer adds whoever holds the address. The local email/password sign-up, sign-in, reset, verify-email and update routes, pages, jobs and mail are gone, as are passkey sign-in, the Google, Microsoft and generic OIDC providers, the per-organisation SSO portal and its account-link flow. Passkeys and two-factor stay for confirming a signature. The e2e suite starts sessions the way a finished IAM sign-in leaves them. Co-authored-by: Hanzo Dev <[email protected]>
137 lines
4.2 KiB
JSON
137 lines
4.2 KiB
JSON
{
|
|
"$schema": "https://turbo.build/schema.json",
|
|
"tasks": {
|
|
"build": {
|
|
"dependsOn": ["prebuild", "^build"],
|
|
"outputs": [".next/**", "!.next/cache/**"]
|
|
},
|
|
"prebuild": {
|
|
"cache": false,
|
|
"dependsOn": ["^prebuild"]
|
|
},
|
|
"lint": {
|
|
"cache": false
|
|
},
|
|
"lint:fix": {
|
|
"cache": false
|
|
},
|
|
"clean": {
|
|
"cache": false
|
|
},
|
|
"dev": {
|
|
"cache": false,
|
|
"persistent": true
|
|
},
|
|
"start": {
|
|
"dependsOn": ["^build"],
|
|
"cache": false,
|
|
"persistent": true
|
|
},
|
|
"dev:test": {
|
|
"cache": false
|
|
},
|
|
"test:e2e": {
|
|
"dependsOn": ["^build"],
|
|
"cache": false
|
|
}
|
|
},
|
|
"globalDependencies": ["**/.env.*local"],
|
|
"globalEnv": [
|
|
"APP_VERSION",
|
|
"PORT",
|
|
"NEXT_PRIVATE_ENCRYPTION_KEY",
|
|
"NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY",
|
|
"NEXT_PRIVATE_AUTH_SECRET",
|
|
"NEXT_PUBLIC_PROJECT",
|
|
"NEXT_PUBLIC_APP_NAME",
|
|
"NEXT_PUBLIC_APP_NAME_PRIMARY",
|
|
"NEXT_PUBLIC_APP_NAME_SUFFIX",
|
|
"NEXT_PUBLIC_WEBAPP_URL",
|
|
"NEXT_PRIVATE_INTERNAL_WEBAPP_URL",
|
|
"NEXT_PUBLIC_INSIGHTS_KEY",
|
|
"NEXT_PUBLIC_FEATURE_BILLING_ENABLED",
|
|
"NEXT_PUBLIC_DISABLE_SIGNUP",
|
|
"NEXT_PRIVATE_PLAIN_API_KEY",
|
|
"NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT",
|
|
"NEXT_PRIVATE_SIGN_LICENSE_KEY",
|
|
"BASE_PATH",
|
|
"DATABASE_URL",
|
|
"NEXT_PRIVATE_LOGGER_FILE_PATH",
|
|
"NEXT_PRIVATE_SIGNING_TRANSPORT",
|
|
"NEXT_PRIVATE_SIGNING_PASSPHRASE",
|
|
"NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH",
|
|
"NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_PATH",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_FILE_PATH",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_CONTENTS",
|
|
"NEXT_PRIVATE_SIGNING_GCLOUD_HSM_SECRET_MANAGER_CERT_PATH",
|
|
"NEXT_PRIVATE_SIGNING_TIMESTAMP_AUTHORITY",
|
|
"NEXT_PUBLIC_SIGNING_CONTACT_INFO",
|
|
"NEXT_PRIVATE_USE_LEGACY_SIGNING_SUBFILTER",
|
|
"NEXT_PUBLIC_UPLOAD_TRANSPORT",
|
|
"NEXT_PRIVATE_UPLOAD_ENDPOINT",
|
|
"NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE",
|
|
"NEXT_PRIVATE_UPLOAD_REGION",
|
|
"NEXT_PRIVATE_UPLOAD_BUCKET",
|
|
"NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID",
|
|
"NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY",
|
|
"NEXT_PRIVATE_UPLOAD_DISTRIBUTION_DOMAIN",
|
|
"NEXT_PRIVATE_UPLOAD_DISTRIBUTION_KEY_ID",
|
|
"NEXT_PRIVATE_UPLOAD_DISTRIBUTION_KEY_CONTENTS",
|
|
"NEXT_PRIVATE_SIGNING_TRANSPORT",
|
|
"NEXT_PRIVATE_SIGNING_PASSPHRASE",
|
|
"NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH",
|
|
"NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS",
|
|
"NEXT_PRIVATE_SIGNING_LOCAL_FILE_ENCODING",
|
|
"NEXT_PRIVATE_SMTP_TRANSPORT",
|
|
"NEXT_PRIVATE_RESEND_API_KEY",
|
|
"NEXT_PRIVATE_MAILCHANNELS_API_KEY",
|
|
"NEXT_PRIVATE_MAILCHANNELS_ENDPOINT",
|
|
"NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN",
|
|
"NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR",
|
|
"NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY",
|
|
"NEXT_PRIVATE_SMTP_HOST",
|
|
"NEXT_PRIVATE_SMTP_PORT",
|
|
"NEXT_PRIVATE_SMTP_USERNAME",
|
|
"NEXT_PRIVATE_SMTP_PASSWORD",
|
|
"NEXT_PRIVATE_SMTP_APIKEY_USER",
|
|
"NEXT_PRIVATE_SMTP_APIKEY",
|
|
"NEXT_PRIVATE_SMTP_SECURE",
|
|
"NEXT_PRIVATE_SMTP_UNSAFE_IGNORE_TLS",
|
|
"NEXT_PRIVATE_SMTP_FROM_NAME",
|
|
"NEXT_PRIVATE_SMTP_FROM_ADDRESS",
|
|
"NEXT_PRIVATE_SMTP_SERVICE",
|
|
"NEXT_PRIVATE_STRIPE_API_KEY",
|
|
"NEXT_PRIVATE_STRIPE_WEBHOOK_SECRET",
|
|
"NEXT_PRIVATE_GITHUB_TOKEN",
|
|
"NEXT_PRIVATE_BROWSERLESS_URL",
|
|
"NEXT_PRIVATE_JOBS_PROVIDER",
|
|
"NEXT_PRIVATE_INNGEST_APP_ID",
|
|
"INNGEST_EVENT_KEY",
|
|
"NEXT_PRIVATE_INNGEST_EVENT_KEY",
|
|
"NEXT_PRIVATE_TELEMETRY_KEY",
|
|
"NEXT_PRIVATE_TELEMETRY_HOST",
|
|
"SIGN_DISABLE_TELEMETRY",
|
|
"GOOGLE_VERTEX_PROJECT_ID",
|
|
"GOOGLE_VERTEX_LOCATION",
|
|
"GOOGLE_VERTEX_API_KEY",
|
|
"CI",
|
|
"NODE_ENV",
|
|
"POSTGRES_URL",
|
|
"DATABASE_URL",
|
|
"DATABASE_URL_UNPOOLED",
|
|
"POSTGRES_PRISMA_URL",
|
|
"POSTGRES_URL_NON_POOLING",
|
|
"GOOGLE_APPLICATION_CREDENTIALS",
|
|
"E2E_TEST_AUTHENTICATE_USERNAME",
|
|
"E2E_TEST_AUTHENTICATE_USER_EMAIL",
|
|
"E2E_TEST_AUTHENTICATE_USER_PASSWORD",
|
|
"DANGEROUS_BYPASS_RATE_LIMITS",
|
|
"NEXT_PUBLIC_USE_INTERNAL_URL_BROWSERLESS",
|
|
"NEXT_PRIVATE_OIDC_PROMPT"
|
|
]
|
|
}
|