package config

Get desktop application:
View/edit binary Protocol Buffers messages

Used in: Config

• optional int64 auth_token_ttl_sec = 1

  / Time-to-live in seconds for auth tokens. [Default: 1h]

• optional int64 refresh_token_ttl_sec = 2

  / Time-to-live in seconds for refresh tokens. [Default: 30 days] / / When set to zero tokens will instantly expire basically disabling auth / token refresh. When set to a negative value, tokens will never expire.

• optional int64 anonymous_refresh_token_ttl_sec = 9

  / Time-to-live in seconds for anonymous-auth refresh tokens. / [Default: 90 days] / / When set to zero tokens will instantly expire basically disabling auth / token refresh. When set to a negative value, tokens will never expire.

• optional bool disable_password_auth = 3

  / Disables password-based sign-up. Does not affect already registered users.

• optional bool enable_otp_signin = 8

  / Whether sign-in via OTP codes (e.g. sent via Email) should be allowed. / This may be less secure since ultimately you're delegating operational / security to a user's inbox.

• optional bool enable_anonymous_signin = 12

  / Allow the creation of ephemeral user-accounts, e.g. for a frictionless / trial.

• optional uint32 password_minimal_length = 4

  / Minimal password length. [Default: 8]

• optional bool password_must_contain_upper_and_lower_case = 5

  / Password must contain lower and upper-case letters.

• optional bool password_must_contain_digits = 6

  / Password must contain digits in addition to alphabetic characters..

• optional bool password_must_contain_special_characters = 7

  / Password must contain special, non-alphanumeric, characters.

• map<string, OAuthProviderConfig> oauth_providers = 11

  / Map of configured OAuth providers.

• repeated string custom_uri_schemes = 21

  / List of custom URI schemes allowed as auth redirects. / / This is useful for mobile apps, desktop or SPAs where an app registers a / custom scheme for calls it wants to handle.

• repeated string redirect_uri_allowlist = 22

  / List of explicitly allowed redirect uris.

• optional UserIdentifier user_identifier = 31

  / Policy covering user registration and change (username|email) flows around / what user identifier is expected and accepted. [Default: ONLY_EMAIL]

• optional string apple_native_client_id = 32

  / When using "Sign-in with Apple" in native Mac or iOS apps, the auth flow / differs significantly from the web-based OAuth flows. The client signs in / with Apple directly using the user's iCloud account. The client then / forwards an apple-signed JWT identity token that can be exchanged for / TrailBase tokens: / https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple / / The tokens audience (`aud`) is validated against the "client id", which / unlike for OAuth is the app `Bundle ID` instead of the `Service ID` (i.e. / only configuring the Apple OAuth flow is insufficient for native sign-in): / https://developer.apple.com/documentation/signinwithapple/verifying-a-user#Verify-the-identity-token / / NOTE: while not explicitly required, Apple may reject apps from their / stores if they provide a social login w/o also providing an Apple option / using their native `AuthenticationServices`: / https://acceptmy.app/guides/sign-in-with-apple-rejection.

Used in: GetConfigResponse, UpdateConfigRequest

• required EmailConfig email = 2

  NOTE: These top-level fields currently have to be `required` due to the overly simple approach on how we do config merging (from env vars and vault).

• required ServerConfig server = 3

• required AuthConfig auth = 4

• required JobsConfig jobs = 5

• repeated DatabaseConfig databases = 8

• repeated RecordApiConfig record_apis = 11

• repeated JsonSchemaConfig schemas = 21

/ Sqlite specific (as opposed to standard SQL) constrained-violation / resolution strategy upon insert.

Used in: RecordApiConfig

• CONFLICT_RESOLUTION_STRATEGY_UNDEFINED = 0

• ABORT = 1

  / SQL default: Keep transaction open and abort the current statement.

• IGNORE = 4

  / Skip the statement and continue. Mostly matters in the context of batches / and transaction. Rather than aborting, subsequent operations will / continue.

• REPLACE = 5

  / Replaces the conflicting row in case of a collision (e.g. unique / constraint).

Used in: Config

• optional string name = 1

  / Name will be used as <traildepot>/(data/<name>.db|migrations/<name>/).

Used in: Config

• optional string smtp_host = 1

• optional uint32 smtp_port = 2

• optional string smtp_username = 3

• optional string smtp_password = 4

• optional SmtpEncryption smtp_encryption = 5

  Which encryption method to use. [Default: STARTTLS]

• optional string sender_name = 11

• optional string sender_address = 12

• optional EmailTemplate user_verification_template = 21

• optional EmailTemplate password_reset_template = 22

• optional EmailTemplate change_email_template = 23

• optional EmailTemplate otp_template = 24

Used in: EmailConfig

• optional string subject = 1

• optional string body = 2

• optional Config config = 1

• optional string hash = 2

Used in: Config

• repeated SystemJob system_jobs = 1

  / System jobs overrides. / / NOTE: This is technically a map from id to config, however enums are not / allowed as map keys.

Used in: Config

• optional string name = 1

• optional string schema = 2

Used in: AuthConfig

• optional string client_id = 1

• optional string client_secret = 2

• optional OAuthProviderId provider_id = 3

• optional string display_name = 11

  / Name to display in auth and admin UI.

• optional string auth_url = 12

  / Urls

• optional string token_url = 13

• optional string user_api_url = 14

• repeated string scopes = 15

  / User-info scopes to request. [Default: ["openid", "email", "profile"]] / / NOTE: Claims not covered by the requested scopes won't be returned by the / provider's user-info endpoint, e.g. dropping the "email" scope requires a / username-based `UserIdentifier`.

Used in: OAuthProviderConfig

• OAUTH_PROVIDER_ID_UNDEFINED = 0

• TEST = 1

• OIDC0 = 2

• APPLE = 9

• DISCORD = 10

• GITLAB = 11

• GOOGLE = 12

• FACEBOOK = 13

• MICROSOFT = 14

• TWITCH = 15

• YANDEX = 16

• GITHUB = 17

Used in: RecordApiConfig

• PERMISSION_FLAG_UNDEFINED = 0

• CREATE = 1

  Database record insert.

• READ = 2

  Database record read/list, i.e. select.

• UPDATE = 4

  Database record update.

• DELETE = 8

  Database record delete.

• SCHEMA = 16

  / Lookup JSON schema for the given record api .

Used in: Config

• optional string name = 1

  / API name, i.e. unique name used to access data via HTTP.

• optional string table_name = 2

  / Referenced table to be exposed.

• repeated string attached_databases = 3

  / Attached databases - will `ATTACH <traildepot>/data/<name>.db AS <name>`. / Can only reference configured databases.

• optional ConflictResolutionStrategy conflict_resolution = 5

  / Strategy to be used on insert if a table constraint is violated.

• optional bool autofill_missing_user_id_columns = 6

  / Fill columns referencing _user(id) automatically from current user's / authentication context if present. Can be useful for static clients, such / as HTML forms, otherwise it's recommended to have the client provide user / ids explicitly and to keep this feature off.

• optional bool enable_subscriptions = 9

  / Allow subscribing to data changes in realtime using SSE streaming. / / NOTE: If you're using a reverse proxy, this will likely require / configuration changes to allow for server-side streaming HTTP, e.g. / tell the proxy to keep listening and not cache.

• repeated PermissionFlag acl_world = 7

  / Access control lists.

• repeated PermissionFlag acl_authenticated = 8

• repeated string excluded_columns = 10

  / Columns excluded from this API. / / Excluded columns are completely inaccessible via this API. This is / different from columns with names prefixed by "_", which are considered / hidden. This means they can still be inserted, updated and access checked / unlike excluded columns.

• optional string create_access_rule = 11

  / Access rules to be evaluated on request. Expected to be valid SQL / expression, where `SELECT <expr>` returns a unary boolean. / / The evaluator injects _USER_, _ROW_ and _REQ_ tables that can be / used for validating access, e.g.: / / _USER_.id = _REQ_.owner / / ensures that the value provided for the `owner` column during an insert / matches the current authenticated user's id. One can also construct / arbitrary validations including sub-queries, e.g.: / / _USER_.id = _REQ_.owner AND EXISTS(SELECT FROM allowed WHERE / allowed.user = _USER_.id)

• optional string read_access_rule = 12

• optional string update_access_rule = 13

• optional string delete_access_rule = 14

• optional string schema_access_rule = 15

• repeated string expand = 21

  / A list of foreign key columns that *can* be expanded on read/list, i.e. / the foreign record will be inlined into the response. By default nothing / is expanded. / / Only columns and foreign tables with names not starting with "_", i.e. are / allowed to be expanded.

• optional uint64 listing_hard_limit = 22

  / Hard limit for listing records. [Default: 1024]

Used in: ServerConfig

• optional string endpoint = 1

• optional string region = 2

• optional string bucket_name = 5

• optional string access_key = 8

  / S3 access key, a.k.a. username.

• optional string secret_access_key = 9

  / S3 secret access key, a.k.a. password.

Used in: Config

• optional string application_name = 1

  / Application name presented to users, e.g. when sending emails. / [Default: "TrailBase"]

• optional string site_url = 2

  / Your final, deployed URL. This url is used to build canonical urls / for emails, OAuth redirects, ... . [Default: "http://localhost:4000"]

• optional int64 logs_retention_sec = 11

  / Max age of logs that will be retained during period logs cleanup. Note / that this implies that some older logs may persist until the cleanup job / reruns. [Default: 7 days]

• optional S3StorageConfig s3_storage_config = 13

  / If present will use S3 setup over local file-system based storage.

• optional bool enable_record_transactions = 14

  / If enabled, batches of transactions can be submitted for atomic execution

• optional uint64 request_size_limit_bytes = 15

  / Request size limit. [Default: 10MB]

• optional uint32 auth_ip_rate_limit = 16

  / Limits the request per IP per second to auth POST APIs for abuse / protection. If TrailBase is behind a proxy, make sure to set / "X-Forwarded-For". [Default: disabled] / / Note that login endpoints have additional fixed rate limits / on a per credentials level.

• optional uint64 backup_window_size = 17

  / Limits how many backups are kept at any time. [Default: 5]

Used in: EmailConfig

• SMTP_ENCRYPTION_UNDEFINED = 0

• SMTP_ENCRYPTION_NONE = 1

• SMTP_ENCRYPTION_STARTTLS = 2

• SMTP_ENCRYPTION_TLS = 3

Used in: JobsConfig

• optional SystemJobId id = 1

  / Identifies the system job by its id.

• optional string schedule = 2

  / Cron spec: shorthand or 7-components: (sec, min, hour, day of month, / / month, day of week, year).

• optional bool disabled = 3

  / Disable the system job.

• optional uint64 timeout = 4

  / Timeout in milliseconds.

Used in: SystemJob

• SYSTEM_JOB_ID_UNDEFINED = 0

• BACKUP = 1

• HEARTBEAT = 2

• LOG_CLEANER = 3

• AUTH_CLEANER = 4

• QUERY_OPTIMIZER = 5

• FILE_DELETIONS = 6

• ANONYMOUS_CLEANER = 7

• optional Config config = 1

• optional string hash = 2

What user identifier to use for new user registrations as well as change-(email|username). NOTE: W/o email there's no way to contact users.

Used in: AuthConfig

• USER_IDENTIFIER_UNDEFINED = 0

  / Behaves like ONLY_EMAIL for legacy reasons.

• ONLY_EMAIL = 1

  / Only email. Doesn't work for anonymous login.

• ONLY_USERNAME = 2

  / Only username. No email allowed.

• REQUIRE_EMAIL = 3

  / Requires email and allows an optional username.

• REQUIRE_USERNAME = 4

  / Requires username and allows an optional email.

• REQUIRE_EMAIL_AND_USERNAME = 5

  / Requires both email and username.

• map<string, string> secrets = 1