Michal
44061918ac
Scan a QR on your authentik login page with your phone, approve it with a passkey and a fingerprint, and the laptop signs itself in. The service holds NO authentik credential. A flow policy calls it with a session id and gets back the username that approved it, or nothing -- so there is no standing credential to steal. The obvious alternative, authentik's recovery-link API, effectively requires a superuser and was rejected for that reason. See README.md for the traps this had to work around, including the two flow-binding settings that are counter-intuitive and load-bearing, and an honest account of what QR sign-in cannot defend against.
14 lines
495 B
JSON
14 lines
495 B
JSON
{
|
|
// The tests run under Node's type stripping, which resolves imports by their
|
|
// real filename — hence the `.ts` extensions in the test sources. The build
|
|
// tsconfig cannot allow those, so tests get their own noEmit config.
|
|
// Without this the test files would be the one surface nothing checks.
|
|
"extends": "./tsconfig.json",
|
|
"compilerOptions": {
|
|
"noEmit": true,
|
|
"allowImportingTsExtensions": true,
|
|
"rootDir": "."
|
|
},
|
|
"include": ["src/**/*.ts", "test/**/*.ts"]
|
|
}
|