tenant.yaml

rules:
  - name: mfaAuth
    script: ./rules/mfaAuth.js
    stage: login_success
    enabled: true
    order: 1
  - name: verifyUserOnPasswordReset
    script: ./rules/verifyUserOnPasswordReset.js
    stage: login_success
    enabled: true
    order: 2
  - name: assignRolesOnLogin
    script: ./rules/assignRolesOnLogin.js
    stage: login_success
    enabled: true
    order: 3
  - name: updateUserMetadata
    script: ./rules/updateUserMetadata.js
    stage: login_success
    enabled: true
    order: 4
  - name: enhanceIdToken
    script: ./rules/enhanceIdToken.js
    stage: login_success
    enabled: true
    order: 5


rulesConfigs:
  - key: "ADMIN_ROLE_ID"
    value: '##ADMIN_ROLE_ID##'
  - key: "BETA_TESTER_ROLE_ID"
    value: '##BETA_TESTER_ROLE_ID##'

hooks: []

pages:
  - name: guardian_multifactor
    enabled: false
    html: ./pages/guardian_multifactor.html
  - name: login
    enabled: true
    html: ./pages/login.html
  - name: password_reset
    enabled: true
    html: ./pages/password_reset.html

resourceServers:
  - name: maybe-finance-api
    identifier: https://maybe-finance-api/v1
    allow_offline_access: true
    signing_alg: RS256
    skip_consent_for_verifiable_first_party_clients: true
    token_lifetime: 86400 # 24 hours
    token_lifetime_for_web: 7200

clients:
  - name: Maybe
    app_type: spa
    allowed_clients: []
    callbacks: @@CLIENT_BASE_URLS@@
    allowed_logout_urls: @@CLIENT_LOGOUT_URLS@@
    allowed_origins: @@CLIENT_BASE_URLS@@
    web_origins: @@CLIENT_BASE_URLS@@
    client_aliases: []
    cross_origin_auth: false
    custom_login_page_on: true
    grant_types:
      - authorization_code
      - implicit
      - refresh_token
      - password
      - http://auth0.com/oauth/grant-type/password-realm
    is_first_party: true
    is_token_endpoint_ip_header_trusted: false
    jwt_configuration:
      alg: RS256
      lifetime_in_seconds: 36000
      secret_encoded: false
    native_social_login:
      apple:
        enabled: false
      facebook:
        enabled: false
    oidc_conformant: true
    refresh_token:
      expiration_type: expiring
      leeway: 0
      token_lifetime: 2592000 # 30 days
      idle_token_lifetime: 1296000 # 15 days
      infinite_token_lifetime: false
      infinite_idle_token_lifetime: false
      rotation_type: rotating
    sso_disabled: false
    token_endpoint_auth_method: none

  - name: Maybe Admin
    allowed_clients: []
    app_type: regular_web
    callbacks: @@SERVER_CALLBACK_URLS@@
    allowed_logout_urls: @@SERVER_BASE_URLS@@
    allowed_origins: @@SERVER_BASE_URLS@@
    web_origins: @@SERVER_BASE_URLS@@
    client_aliases: []
    cross_origin_auth: false
    custom_login_page_on: true
    grant_types:
      - authorization_code
      - implicit
      - refresh_token
      - client_credentials
      - password
    is_first_party: true
    is_token_endpoint_ip_header_trusted: false
    jwt_configuration:
      alg: RS256
      lifetime_in_seconds: 36000
      secret_encoded: false
    native_social_login:
      apple:
        enabled: false
      facebook:
        enabled: false
    oidc_conformant: true
    refresh_token:
      expiration_type: non-expiring
      leeway: 0
      infinite_token_lifetime: true
      infinite_idle_token_lifetime: true
      token_lifetime: 31557600
      idle_token_lifetime: 2592000
      rotation_type: non-rotating
    sso_disabled: false
    token_endpoint_auth_method: client_secret_post

  - name: auth0-deploy-cli-extension
    app_type: non_interactive
    cross_origin_auth: false
    custom_login_page_on: true
    grant_types:
      - client_credentials
    is_first_party: true
    is_token_endpoint_ip_header_trusted: false
    jwt_configuration:
      alg: RS256
      lifetime_in_seconds: 36000
      secret_encoded: false
    oidc_conformant: true
    refresh_token:
      expiration_type: non-expiring
      leeway: 0
      infinite_token_lifetime: true
      infinite_idle_token_lifetime: true
      token_lifetime: 31557600
      idle_token_lifetime: 2592000
      rotation_type: non-rotating
    sso_disabled: false
    token_endpoint_auth_method: client_secret_post

  - name: server-m2m-cli
    allowed_clients: []
    allowed_origins: []
    app_type: non_interactive
    callbacks: []
    client_aliases: []
    cross_origin_auth: false
    custom_login_page_on: true
    grant_types:
      - client_credentials
    is_first_party: true
    is_token_endpoint_ip_header_trusted: false
    jwt_configuration:
      alg: RS256
      lifetime_in_seconds: 36000
      secret_encoded: false
    native_social_login:
      apple:
        enabled: false
      facebook:
        enabled: false
    oidc_conformant: true
    refresh_token:
      expiration_type: non-expiring
      leeway: 0
      infinite_token_lifetime: true
      infinite_idle_token_lifetime: true
      token_lifetime: 31557600
      idle_token_lifetime: 2592000
      rotation_type: non-rotating
    sso_disabled: false
    token_endpoint_auth_method: client_secret_post

databases:
  - name: Username-Password-Authentication
    strategy: auth0
    enabled_clients:
      - auth0-deploy-cli-extension
      - Maybe
      - Maybe Admin
    is_domain_connection: false
    options:
      mfa:
        active: true
        return_enroll_settings: true
      passwordPolicy: good
      strategy_version: 2
      brute_force_protection: true
    realms:
      - Username-Password-Authentication

connections:
  - name: google-oauth2
    strategy: google-oauth2
    enabled_clients:
      - auth0-deploy-cli-extension
      - Maybe
      - Maybe Admin
      - server-m2m-cli
    is_domain_connection: false
    options:
      email: true
      scope:
        - email
        - profile
      profile: true
  - name: apple
    strategy: apple
    enabled_clients:
      - auth0-deploy-cli-extension
      - Maybe
      - Maybe Admin
      - server-m2m-cli
    is_domain_connection: false
    options:
      client_id: co.maybe.webapp
      app_secret: @@APPLE_SIGN_IN_SECRET_KEY@@
      team_id: 8TQ4KDWF2S
      kid: 47WD7B27JK
      email: true
      name: true
      scope:
        - email
        - name

tenant:
  enabled_locales:
    - en
  # https://auth0.com/docs/authorization/flows/call-your-api-using-resource-owner-password-flow#configure-tenant
  default_directory: Username-Password-Authentication
  default_audience: https://maybe-finance-api/v1
  flags:
    new_universal_login_experience_enabled: true
    universal_login: true
    revoke_refresh_token_grant: false
    disable_clickjack_protection_headers: false
  friendly_name: Maybe Finance
  picture_url: >-
    https://assets.maybe.co/images/maybe.svg
  universal_login:
    colors:
      page_background: '#242629'
      primary: '#3bc9db'
  support_email: hello@maybe.co

emailProvider:
  name: smtp
  credentials:
    smtp_host: smtp.postmarkapp.com
    smtp_port: 587
    smtp_user: REPLACE_THIS
    smtp_pass: '##POSTMARK_SMTP_PASS##'
  default_from_address: account@maybe.co
  enabled: true

emailTemplates:
  - template: reset_email
    body: ./emailTemplates/reset_email.html
    enabled: true
    from: reset@maybe.co
    subject: Reset your password
    syntax: liquid
    urlLifetimeInSeconds: 86400
  - template: verify_email
    body: ./emailTemplates/verify_email.html
    enabled: true
    from: 'account@maybe.co'
    resultUrl: '{{ application.callback_domain }}'
    subject: 'Verify your email for Maybe Finance'
    syntax: liquid
    urlLifetimeInSeconds: 432000

clientGrants:
  - client_id: server-m2m-cli
    audience: https://##AUTH0_DOMAIN##/api/v2/
    scope:
      - read:users
      - update:users
      - delete:users
      - read:users_app_metadata
      - update:users_app_metadata
      - delete:users_app_metadata
      - create:users_app_metadata

guardianFactors:
  - name: duo
    enabled: false
  - name: email
    enabled: true
  - name: otp
    enabled: true
  - name: push-notification
    enabled: false
  - name: recovery-code
    enabled: true
  - name: sms
    enabled: false
  - name: webauthn-platform
    enabled: false
  - name: webauthn-roaming
    enabled: false

guardianFactorProviders: []

guardianFactorTemplates: []

guardianPolicies:
  policies: []

guardianPhoneFactorSelectedProvider:
  provider: auth0

guardianPhoneFactorMessageTypes:
  message_types: []

roles:
  - name: Admin
    description: Maybe Employee Admin
    permissions: []
  - name: CIUser
    description: Identifies our CI users for e2e testing
    permissions: []

branding:
  colors:
    page_background: '#242629'
    primary: '#3bc9db'
  logo_url: >-
    https://assets.maybe.co/images/maybe.svg

prompts:
  universal_login_experience: new
  identifier_first: false

migrations: {}

actions: []

triggers: {}

organizations: []