-
-
-
-
-
-
|
-
-
|
-
-
-
-
-
-
-
-
diff --git a/auth0/pages/login.html b/auth0/pages/login.html
deleted file mode 100644
index a4b3232c..00000000
--- a/auth0/pages/login.html
+++ /dev/null
@@ -1,685 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/auth0/pages/password_reset.html b/auth0/pages/password_reset.html
deleted file mode 100644
index fe32958e..00000000
--- a/auth0/pages/password_reset.html
+++ /dev/null
@@ -1,427 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 
-
-
-
-
-
-
-
-
-
-
-
-
-
- Log in to Maybe
-
-
-
- Sign up for Maybe
-- Already have an account? - -
-
-
-
- Reset Password
-- Enter your email address and we'll send you a link to reset your - password. -
-
-
- Check your email
-- You should receive a reset link shortly. If you do not receive an email, - please contact us. -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- - By signing up, you acknowledge that you have read and understood, and agree to - Maybe's - Terms and Conditions and - Privacy Policy. -
-
-
-
- Something went wrong. Please try again.
-
-
-
-
- Your password was reset.
-
-
-
-
-
-
-
-
diff --git a/auth0/rules/assignRolesOnLogin.js b/auth0/rules/assignRolesOnLogin.js
deleted file mode 100644
index 60dd0bfd..00000000
--- a/auth0/rules/assignRolesOnLogin.js
+++ /dev/null
@@ -1,45 +0,0 @@
-function assignRolesOnLogin(user, context, callback) {
- // This rule does not apply to unverified users - never assign a privileged role without verification!
- if (!user.email || !user.email_verified) {
- return callback(null, user, context);
- }
-
- const maybeEmailDomain = 'maybe.co';
- const emailSplit = user.email.split('@');
- const isMaybeEmployee = emailSplit[emailSplit.length - 1].toLowerCase() === maybeEmailDomain;
-
- if (!isMaybeEmployee) {
- return callback(null, user, context);
- }
-
- // Use latest version that is allowed here - https://auth0-extensions.github.io/canirequire/#auth0
- const ManagementClient = require('auth0@2.35.0').ManagementClient;
-
- const cli = new ManagementClient({
- token: auth0.accessToken,
- domain: auth0.domain,
- });
-
- const admins = ['REPLACE_THIS'];
-
- const rolesToAssign = [];
-
- // https://auth0.com/docs/rules/configuration#use-the-configuration-object
- if (admins.includes(user.email)) {
- rolesToAssign.push(configuration.ADMIN_ROLE_ID);
- }
-
- // https://auth0.com/docs/rules/configuration#use-the-configuration-object
- if (isMaybeEmployee) {
- rolesToAssign.push(configuration.BETA_TESTER_ROLE_ID);
- }
-
- // If we make it here, we know the user has verified their email and their email is in the Maybe Finance Gmail domain
- cli.assignRolestoUser({ id: user.user_id }, { roles: rolesToAssign }, function (err) {
- if (err) {
- console.log(err);
- }
-
- return callback(null, user, context);
- });
-}
diff --git a/auth0/rules/enhanceIdToken.js b/auth0/rules/enhanceIdToken.js
deleted file mode 100644
index 098f7d9f..00000000
--- a/auth0/rules/enhanceIdToken.js
+++ /dev/null
@@ -1,53 +0,0 @@
-function enhanceIdToken(user, context, callback) {
- // Does not have to be a valid URL, just has to be unique and start with http / https
- const namespace = 'https://maybe.co';
-
- const assignedRoles = (context.authorization || {}).roles;
-
- let idTokenClaims = context.idToken || {};
- let accessTokenClaims = context.accessToken || {};
-
- let identityClaim;
-
- if (user.identities && user.identities.length) {
- const primaryIdentities = user.identities.filter((identity) => {
- // https://auth0.com/docs/manage-users/user-accounts/user-account-linking#how-it-works
- const isSecondary = 'profileData' in identity;
-
- return !isSecondary;
- });
-
- if (primaryIdentities.length === 0) {
- identityClaim = undefined;
- }
-
- // Based on prior checks, this should represent the primary identity
- const primaryIdentity = primaryIdentities[0];
-
- identityClaim = {
- connection: primaryIdentity.connection,
- provider: primaryIdentity.provider,
- isSocial: primaryIdentity.isSocial,
- };
- }
-
- // Access token claims are populated on the parsed server-side JWT
- accessTokenClaims[`${namespace}/name`] = user.name;
- accessTokenClaims[`${namespace}/email`] = user.email;
- accessTokenClaims[`${namespace}/picture`] = user.picture;
- accessTokenClaims[`${namespace}/roles`] = assignedRoles;
- accessTokenClaims[`${namespace}/user-metadata`] = user.user_metadata;
- accessTokenClaims[`${namespace}/app-metadata`] = user.app_metadata;
- accessTokenClaims[`${namespace}/primary-identity`] = identityClaim;
-
- // ID token claims are populated in the parsed client-side React hook
- idTokenClaims[`${namespace}/roles`] = assignedRoles;
- idTokenClaims[`${namespace}/user-metadata`] = user.user_metadata;
- idTokenClaims[`${namespace}/app-metadata`] = user.app_metadata;
- idTokenClaims[`${namespace}/primary-identity`] = identityClaim;
-
- context.idToken = idTokenClaims;
- context.accessToken = accessTokenClaims;
-
- return callback(null, user, context);
-}
diff --git a/auth0/rules/mfaAuth.js b/auth0/rules/mfaAuth.js
deleted file mode 100644
index 4c00d9fe..00000000
--- a/auth0/rules/mfaAuth.js
+++ /dev/null
@@ -1,23 +0,0 @@
-// https://auth0.com/docs/secure/multi-factor-authentication/customize-mfa
-function mfaAuth(user, context, callback) {
- const ENABLED_CLIENT_IDS = [
- 'REPLACE_THIS',
- ];
-
- // Only enable MFA on the Next.js app (client IDs above)
- if (ENABLED_CLIENT_IDS.indexOf(context.clientID) !== -1) {
- // This makes MFA optional for users (they can enroll via their profile within the app)
- if (user.user_metadata && user.user_metadata.enrolled_mfa) {
- context.multifactor = {
- // See options here - https://auth0.com/docs/secure/multi-factor-authentication/customize-mfa#use-rules
- // `any` is the generic option (i.e. Google Authenticator or something similar)
- provider: 'any',
-
- // If set to true, MFA will turn off for 30 days for the user's current browser
- allowRememberBrowser: true,
- };
- }
- }
-
- return callback(null, user, context);
-}
diff --git a/auth0/rules/updateUserMetadata.js b/auth0/rules/updateUserMetadata.js
deleted file mode 100644
index c031c4e3..00000000
--- a/auth0/rules/updateUserMetadata.js
+++ /dev/null
@@ -1,27 +0,0 @@
-function updateUserMetadata(user, context, callback) {
- // Use latest version that is allowed here (2.4.0 as of today) - https://auth0-extensions.github.io/canirequire/#auth0
- const ManagementClient = require('auth0@2.35.0').ManagementClient;
-
- const cli = new ManagementClient({
- token: auth0.accessToken,
- domain: auth0.domain,
- });
-
- const metadata = {
- firstName:
- (user.user_metadata && user.user_metadata.firstName) ||
- user.first_name ||
- user.given_name ||
- '',
- lastName:
- (user.user_metadata && user.user_metadata.lastName) ||
- user.last_name ||
- user.family_name ||
- '',
- };
-
- // Maps data from various identity providers to a normalized identity
- cli.updateUserMetadata({ id: user.user_id }, metadata, function (err, updatedUser) {
- return callback(null, updatedUser, context);
- });
-}
diff --git a/auth0/rules/verifyUserOnPasswordReset.js b/auth0/rules/verifyUserOnPasswordReset.js
deleted file mode 100644
index 44f067a9..00000000
--- a/auth0/rules/verifyUserOnPasswordReset.js
+++ /dev/null
@@ -1,34 +0,0 @@
-// If the user successfully performs a password reset, we *know* their email is valid, so go ahead and verify it if not already verified
-function verifyUserWithPasswordReset(user, context, callback) {
- const request = require('request');
- const userApiUrl = auth0.baseUrl + '/users/';
-
- // This rule is only for Auth0 databases
- if (context.connectionStrategy !== 'auth0') {
- return callback(null, user, context);
- }
-
- if (user.email_verified || !user.last_password_reset) {
- return callback(null, user, context);
- }
-
- // Set email verified if a user has already updated his/her password
- request.patch(
- {
- url: userApiUrl + user.user_id,
- headers: {
- Authorization: 'Bearer ' + auth0.accessToken,
- },
- json: { email_verified: true },
- timeout: 5000,
- },
- function (err, response, body) {
- // Setting email verified isn't propagated to id_token in this
- // authentication cycle so explicitly set it to true given no errors.
- context.idToken.email_verified = !err && response.statusCode === 200;
-
- // Return with success at this point.
- return callback(null, user, context);
- }
- );
-}
diff --git a/auth0/sync.js b/auth0/sync.js
deleted file mode 100644
index 49736cfa..00000000
--- a/auth0/sync.js
+++ /dev/null
@@ -1,26 +0,0 @@
-const { config, sync } = require('./config')
-
-const firstArg = process.argv.slice(2)[0]
-
-if (firstArg === '--force') {
- sync({
- config: {
- ...config,
-
- // The deploy client only works with the DEFAULT Auth0 domain, NOT with custom domains
- AUTH0_DOMAIN: config.AUTH0_KEYWORD_REPLACE_MAPPINGS.AUTH0_DOMAIN,
- },
- format: 'yaml',
- output_folder: __dirname,
- })
- .then(() =>
- console.log(
- `Synced ${config.AUTH0_KEYWORD_REPLACE_MAPPINGS.AUTH0_DOMAIN} successfully!`
- )
- )
- .catch((err) => console.log(`Sync failed: ${err}`))
-} else {
- console.log(
- 'Syncing not recommended (see README.md). Instead, you should make changes locally and deploy to the tenant. \n\nIf you are sure you want to do this, run: \n\n`node sync --force`\n'
- )
-}
diff --git a/auth0/tenant.yaml b/auth0/tenant.yaml
deleted file mode 100644
index 0d8fe146..00000000
--- a/auth0/tenant.yaml
+++ /dev/null
@@ -1,360 +0,0 @@
-rules:
- - name: mfaAuth
- script: ./rules/mfaAuth.js
- stage: login_success
- enabled: true
- order: 1
- - name: verifyUserOnPasswordReset
- script: ./rules/verifyUserOnPasswordReset.js
- stage: login_success
- enabled: true
- order: 2
- - name: assignRolesOnLogin
- script: ./rules/assignRolesOnLogin.js
- stage: login_success
- enabled: true
- order: 3
- - name: updateUserMetadata
- script: ./rules/updateUserMetadata.js
- stage: login_success
- enabled: true
- order: 4
- - name: enhanceIdToken
- script: ./rules/enhanceIdToken.js
- stage: login_success
- enabled: true
- order: 5
-
-
-rulesConfigs:
- - key: "ADMIN_ROLE_ID"
- value: '##ADMIN_ROLE_ID##'
- - key: "BETA_TESTER_ROLE_ID"
- value: '##BETA_TESTER_ROLE_ID##'
-
-hooks: []
-
-pages:
- - name: guardian_multifactor
- enabled: false
- html: ./pages/guardian_multifactor.html
- - name: login
- enabled: true
- html: ./pages/login.html
- - name: password_reset
- enabled: true
- html: ./pages/password_reset.html
-
-resourceServers:
- - name: maybe-finance-api
- identifier: https://maybe-finance-api/v1
- allow_offline_access: true
- signing_alg: RS256
- skip_consent_for_verifiable_first_party_clients: true
- token_lifetime: 86400 # 24 hours
- token_lifetime_for_web: 7200
-
-clients:
- - name: Maybe
- app_type: spa
- allowed_clients: []
- callbacks: @@CLIENT_BASE_URLS@@
- allowed_logout_urls: @@CLIENT_LOGOUT_URLS@@
- allowed_origins: @@CLIENT_BASE_URLS@@
- web_origins: @@CLIENT_BASE_URLS@@
- client_aliases: []
- cross_origin_auth: false
- custom_login_page_on: true
- grant_types:
- - authorization_code
- - implicit
- - refresh_token
- - password
- - http://auth0.com/oauth/grant-type/password-realm
- is_first_party: true
- is_token_endpoint_ip_header_trusted: false
- jwt_configuration:
- alg: RS256
- lifetime_in_seconds: 36000
- secret_encoded: false
- native_social_login:
- apple:
- enabled: false
- facebook:
- enabled: false
- oidc_conformant: true
- refresh_token:
- expiration_type: expiring
- leeway: 0
- token_lifetime: 2592000 # 30 days
- idle_token_lifetime: 1296000 # 15 days
- infinite_token_lifetime: false
- infinite_idle_token_lifetime: false
- rotation_type: rotating
- sso_disabled: false
- token_endpoint_auth_method: none
-
- - name: Maybe Admin
- allowed_clients: []
- app_type: regular_web
- callbacks: @@SERVER_CALLBACK_URLS@@
- allowed_logout_urls: @@SERVER_BASE_URLS@@
- allowed_origins: @@SERVER_BASE_URLS@@
- web_origins: @@SERVER_BASE_URLS@@
- client_aliases: []
- cross_origin_auth: false
- custom_login_page_on: true
- grant_types:
- - authorization_code
- - implicit
- - refresh_token
- - client_credentials
- - password
- is_first_party: true
- is_token_endpoint_ip_header_trusted: false
- jwt_configuration:
- alg: RS256
- lifetime_in_seconds: 36000
- secret_encoded: false
- native_social_login:
- apple:
- enabled: false
- facebook:
- enabled: false
- oidc_conformant: true
- refresh_token:
- expiration_type: non-expiring
- leeway: 0
- infinite_token_lifetime: true
- infinite_idle_token_lifetime: true
- token_lifetime: 31557600
- idle_token_lifetime: 2592000
- rotation_type: non-rotating
- sso_disabled: false
- token_endpoint_auth_method: client_secret_post
-
- - name: auth0-deploy-cli-extension
- app_type: non_interactive
- cross_origin_auth: false
- custom_login_page_on: true
- grant_types:
- - client_credentials
- is_first_party: true
- is_token_endpoint_ip_header_trusted: false
- jwt_configuration:
- alg: RS256
- lifetime_in_seconds: 36000
- secret_encoded: false
- oidc_conformant: true
- refresh_token:
- expiration_type: non-expiring
- leeway: 0
- infinite_token_lifetime: true
- infinite_idle_token_lifetime: true
- token_lifetime: 31557600
- idle_token_lifetime: 2592000
- rotation_type: non-rotating
- sso_disabled: false
- token_endpoint_auth_method: client_secret_post
-
- - name: server-m2m-cli
- allowed_clients: []
- allowed_origins: []
- app_type: non_interactive
- callbacks: []
- client_aliases: []
- cross_origin_auth: false
- custom_login_page_on: true
- grant_types:
- - client_credentials
- is_first_party: true
- is_token_endpoint_ip_header_trusted: false
- jwt_configuration:
- alg: RS256
- lifetime_in_seconds: 36000
- secret_encoded: false
- native_social_login:
- apple:
- enabled: false
- facebook:
- enabled: false
- oidc_conformant: true
- refresh_token:
- expiration_type: non-expiring
- leeway: 0
- infinite_token_lifetime: true
- infinite_idle_token_lifetime: true
- token_lifetime: 31557600
- idle_token_lifetime: 2592000
- rotation_type: non-rotating
- sso_disabled: false
- token_endpoint_auth_method: client_secret_post
-
-databases:
- - name: Username-Password-Authentication
- strategy: auth0
- enabled_clients:
- - auth0-deploy-cli-extension
- - Maybe
- - Maybe Admin
- is_domain_connection: false
- options:
- mfa:
- active: true
- return_enroll_settings: true
- passwordPolicy: good
- strategy_version: 2
- brute_force_protection: true
- realms:
- - Username-Password-Authentication
-
-connections:
- - name: google-oauth2
- strategy: google-oauth2
- enabled_clients:
- - auth0-deploy-cli-extension
- - Maybe
- - Maybe Admin
- - server-m2m-cli
- is_domain_connection: false
- options:
- email: true
- scope:
- - email
- - profile
- profile: true
- - name: apple
- strategy: apple
- enabled_clients:
- - auth0-deploy-cli-extension
- - Maybe
- - Maybe Admin
- - server-m2m-cli
- is_domain_connection: false
- options:
- client_id: co.maybe.webapp
- app_secret: @@APPLE_SIGN_IN_SECRET_KEY@@
- team_id: 8TQ4KDWF2S
- kid: 47WD7B27JK
- email: true
- name: true
- scope:
- - email
- - name
-
-tenant:
- enabled_locales:
- - en
- # https://auth0.com/docs/authorization/flows/call-your-api-using-resource-owner-password-flow#configure-tenant
- default_directory: Username-Password-Authentication
- default_audience: https://maybe-finance-api/v1
- flags:
- new_universal_login_experience_enabled: true
- universal_login: true
- revoke_refresh_token_grant: false
- disable_clickjack_protection_headers: false
- friendly_name: Maybe Finance
- picture_url: >-
- https://assets.maybe.co/images/maybe.svg
- universal_login:
- colors:
- page_background: '#242629'
- primary: '#3bc9db'
- support_email: hello@maybe.co
-
-emailProvider:
- name: smtp
- credentials:
- smtp_host: smtp.postmarkapp.com
- smtp_port: 587
- smtp_user: REPLACE_THIS
- smtp_pass: '##POSTMARK_SMTP_PASS##'
- default_from_address: account@maybe.co
- enabled: true
-
-emailTemplates:
- - template: reset_email
- body: ./emailTemplates/reset_email.html
- enabled: true
- from: reset@maybe.co
- subject: Reset your password
- syntax: liquid
- urlLifetimeInSeconds: 86400
- - template: verify_email
- body: ./emailTemplates/verify_email.html
- enabled: true
- from: 'account@maybe.co'
- resultUrl: '{{ application.callback_domain }}'
- subject: 'Verify your email for Maybe Finance'
- syntax: liquid
- urlLifetimeInSeconds: 432000
-
-clientGrants:
- - client_id: server-m2m-cli
- audience: https://##AUTH0_DOMAIN##/api/v2/
- scope:
- - read:users
- - update:users
- - delete:users
- - read:users_app_metadata
- - update:users_app_metadata
- - delete:users_app_metadata
- - create:users_app_metadata
-
-guardianFactors:
- - name: duo
- enabled: false
- - name: email
- enabled: true
- - name: otp
- enabled: true
- - name: push-notification
- enabled: false
- - name: recovery-code
- enabled: true
- - name: sms
- enabled: false
- - name: webauthn-platform
- enabled: false
- - name: webauthn-roaming
- enabled: false
-
-guardianFactorProviders: []
-
-guardianFactorTemplates: []
-
-guardianPolicies:
- policies: []
-
-guardianPhoneFactorSelectedProvider:
- provider: auth0
-
-guardianPhoneFactorMessageTypes:
- message_types: []
-
-roles:
- - name: Admin
- description: Maybe Employee Admin
- permissions: []
- - name: CIUser
- description: Identifies our CI users for e2e testing
- permissions: []
-
-branding:
- colors:
- page_background: '#242629'
- primary: '#3bc9db'
- logo_url: >-
- https://assets.maybe.co/images/maybe.svg
-
-prompts:
- universal_login_experience: new
- identifier_first: false
-
-migrations: {}
-
-actions: []
-
-triggers: {}
-
-organizations: []
diff --git a/custom-express.d.ts b/custom-express.d.ts
index e43bcf0f..58dd689a 100644
--- a/custom-express.d.ts
+++ b/custom-express.d.ts
@@ -13,19 +13,5 @@ declare global {
json(data: any): Send
-
-
-
-
-
-
-
-
- Set new password
-Enter new password.
-
-
-
-