Michal
44061918ac
Scan a QR on your authentik login page with your phone, approve it with a passkey and a fingerprint, and the laptop signs itself in. The service holds NO authentik credential. A flow policy calls it with a session id and gets back the username that approved it, or nothing -- so there is no standing credential to steal. The obvious alternative, authentik's recovery-link API, effectively requires a superuser and was rejected for that reason. See README.md for the traps this had to work around, including the two flow-binding settings that are counter-intuitive and load-bearing, and an honest account of what QR sign-in cannot defend against.
27 lines
887 B
JSON
27 lines
887 B
JSON
{
|
|
"compilerOptions": {
|
|
"target": "ES2023",
|
|
"module": "commonjs",
|
|
"moduleResolution": "node",
|
|
"lib": ["ES2023"],
|
|
"outDir": "dist",
|
|
"rootDir": "src",
|
|
"strict": true,
|
|
"esModuleInterop": true,
|
|
"skipLibCheck": true,
|
|
"forceConsistentCasingInFileNames": true,
|
|
"declaration": false,
|
|
"sourceMap": false,
|
|
|
|
// Relative imports carry `.ts` and TypeScript rewrites them to `.js` on
|
|
// emit. This is what lets the SAME source run two ways: compiled to
|
|
// dist/ for the image, and under Node's strip-only type stripping for
|
|
// `node --test`, which resolves imports by their real filename. Without it
|
|
// any src module that imports another src module is untestable.
|
|
"allowImportingTsExtensions": true,
|
|
"rewriteRelativeImportExtensions": true
|
|
},
|
|
"include": ["src/**/*.ts"],
|
|
"exclude": ["node_modules", "dist", "test"]
|
|
}
|