Interface ComponentMap

Type Declaration

• OptionalaccessTokenDenylist?: { adapter?: "memory" | "redis" }

• Optionalaudit?: { sink: { type: string; [key: string]: unknown } }

• cors: { allowedOrigins: string[] }

• Optionaldeployment?: { mode?: "single" | "multi" }

• endpoints: { login: { url: string } }

• federations: Record<string, { enabled: boolean; type?: string; [key: string]: unknown }>

• http: {
      port: number;
      readinessTimeoutMs: number;
      trustProxy: number | boolean | string[];
  }

• logging: { level: "trace" | "debug" | "info" | "warn" | "error" | "fatal" | "silent" }

• OptionalmemoryRateLimiter?: {
      defaultLimit?: { limit: number; windowSeconds: number };
      limits?: Record<string, { limit: number; windowSeconds: number }>;
      maxBuckets?: number;
  }

• oauth: {
      accessToken: { expiresIn: number };
      authorize?: Record<string, never>;
      code?: { adapter?: "memory" | "redis" };
      grants: { [key: string]: unknown };
      jwt: {
          issuer: string;
          jwksCacheMaxAge?: number;
          jwksPath?: string;
          legacyTypAccept?: boolean;
          signingKey: {
              local?:
                  | {
                      algorithm: "HS256";
                      kid: string;
                      previousSecrets?: { expiresAt: string; kid: string; secret: string }[];
                      secret?: string;
                  }
                  | {
                      algorithm: "RS256"
                      | "ES256"
                      | "EdDSA";
                      kid: string;
                      previousKeys?: {
                          expiresAt: string;
                          kid: string;
                          publicKey?: string;
                          publicKeyPath?: string;
                      }[];
                      privateKey?: string;
                      privateKeyPath?: string;
                      publicKey?: string;
                      publicKeyPath?: string;
                      [key: string]: unknown;
                  };
              provider: string;
              [key: string]: unknown;
          };
      };
      nonce?: { maxLength: number };
      oidcMode: "oidc-required" | "dual";
      refreshToken: {
          expiresIn: number;
          legacyRtPolicy: "reject";
          unknownFamilyPolicy: "accept" | "reject";
      };
      requireEmailVerified?: boolean;
      resourceIndicator?: { enabled: boolean };
      revocation?: { accessToken: "denylist" | "unsupported" };
      tokenBinding?: {
          "dispatch-policy": "intent-explicit" | "strict-mutual-exclusion";
      };
      tokenExchange?: { maxActorChainDepth: number };
  }

• rateLimit: { failMode: "open" | "closed"; login: { limit: number; windowMs: number } }

  Rate-limit config for SESSION routes (e.g. /session/login bruteforce protection). Uses windowMs (milliseconds) for historical reasons — the section was shaped by express-rate-limit, which packages/session/src/routes/Session.mts consumed until #270.

  Since #270 /session/login runs on the shared rateLimiter component instead, keyed login:ip:<ip>, so the guard is one bucket set across replicas rather than one per process. These values stay the single source of truth: both bundled limiter adapters seed their own limits.login from them (resolveLoginLimitSpec), converting to the whole seconds a RateLimitSpec takes.

  IH-18 — config split: This section ONLY governs session-route rate limiting. OAuth endpoint rate limiting (/token, /authorize) is provided via the optional rateLimiter component slot; the built-in module config lives under memoryRateLimiter.* / redisRateLimiter.* and uses windowSeconds (seconds) per RateLimitSpec in packages/core/src/ratelimit/types.mts. Two independent systems, different keys, different units.

• OptionalrateLimiter?: { adapter?: "memory" | "redis" }

• OptionalredisAccessTokenDenylist?: { keyPrefix?: string }

• OptionalredisCodeRepository?: { defaultExpiresIn?: number; keyPrefix?: string }

• OptionalredisRefreshTokenFamilyStore?: { casRetryLimit?: number; keyPrefix?: string }

• OptionalredisSessionStores?: { keyPrefix?: string }

• OptionalrefreshTokenFamilyStore?: { redis?: { password?: string; url: string } }

• repositories: {
      client: { type: string; [key: string]: unknown };
      code: { type: string; [key: string]: unknown };
      user: { type: string; [key: string]: unknown };
  }

• session: {
      csrf?: { trustedOrigins: string[]; ttlSeconds: number };
      domain: string | null;
      maxAge: number;
      name: string;
      sameSite: "lax" | "none" | "strict";
      secret: string;
      secure: boolean;
      storage: {
          redis?: { password?: string; url: string };
          type: string;
          [key: string]: unknown;
      };
  }

  • Optionalcsrf?: { trustedOrigins: string[]; ttlSeconds: number }

    #272 — CSRF policy for the state-changing session routes.

    .optional() on purpose: a deployment inheriting reference.conf always has it, and every value has a code-side default, so a hand-built config (tests, embedders composing their own object) is not forced to restate a section it has no opinion about.

    trustedOrigins is NOT cors.allowedOrigins. "May this origin read my responses" and "may this origin make me change state" are two questions, and #272 was filed because one list was answering both. Deployments whose login UI is served from a different origin than the provider list those origins here — explicitly.

  • domain: string | null

  • maxAge: number

  • name: string

  • sameSite: "lax" | "none" | "strict"

  • secret: string

  • secure: boolean

  • storage: {
        redis?: { password?: string; url: string };
        type: string;
        [key: string]: unknown;
    }

• OptionaluserSessionStores?: { adapter?: "memory" | "redis" }