feat(config): add phishing_resistant_only system config key

.changeset/phishing-resistant-only.md

@@ -0,0 +1,5 @@
+---
+'@seamless-auth/types': minor
+---
+
+Add `phishing_resistant_only` to `SystemConfigSchema` (default `false`) and `SystemConfigPatchSchema`. When it is on, the API starts a session only from a passkey, and refuses email and phone codes, magic links, TOTP and OAuth whatever `login_methods` says. A code is still accepted once, to verify a new account's address before its first passkey is enrolled.

src/schemas/systemConfig/schema.test.ts

@@ -181,6 +181,18 @@ describe('SystemConfigSchema', () => {
     ).toBe(true);
   });
 
+  it('leaves phishing-resistant-only mode off so existing deployments are unaffected', () => {
+    expect(SystemConfigSchema.parse(baseConfig).phishing_resistant_only).toBe(false);
+    expect(
+      SystemConfigSchema.parse({ ...baseConfig, phishing_resistant_only: true })
+        .phishing_resistant_only,
+    ).toBe(true);
+    expect(SystemConfigPatchSchema.safeParse({ phishing_resistant_only: true }).success).toBe(true);
+    expect(SystemConfigPatchSchema.safeParse({ phishing_resistant_only: 'yes' }).success).toBe(
+      false,
+    );
+  });
+
   it('applies the default lockout policy', () => {
     const parsed = SystemConfigSchema.parse(baseConfig);
 

src/schemas/systemConfig/schema.ts

@@ -290,6 +290,14 @@ export const SystemConfigSchema = z.object({
    * providers have their own `promptPasskeyEnrollment`.
    */
   prompt_passkey_enrollment: z.boolean().default(false),
+  /**
+   * Phishing-resistant authentication only. Sign-in accepts a passkey and nothing
+   * else: email and phone codes, magic links, TOTP and OAuth are refused as ways to
+   * start a session, whatever `login_methods` and `passkey_login_fallback_enabled`
+   * say. A code is still accepted once, to verify the address of a new account before
+   * its first passkey is enrolled.
+   */
+  phishing_resistant_only: z.boolean().default(false),
   oauth_providers: z.array(OAuthProviderConfigSchema).default([]),
   lockout_policy: LockoutPolicySchema.default(DefaultLockoutPolicy),
   // Derived from the field defaults rather than restated, so the two cannot drift.
@@ -365,6 +373,7 @@ export const SystemConfigPatchSchema = z
     passkey_login_fallback_enabled:
       SystemConfigSchema.shape.passkey_login_fallback_enabled.optional(),
     prompt_passkey_enrollment: z.boolean().optional(),
+    phishing_resistant_only: z.boolean().optional(),
     oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
     lockout_policy: LockoutPolicySchema.optional(),
     authenticator_policy: AuthenticatorPolicySchema.optional(),