zyphr 0.1.51 → 0.1.53

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f7ec40b14a9b8a2ce14cff88cdb6d2e4cdebd6b1c324a65a8f8c4f1b551f1688
-  data.tar.gz: dd884a0621a0a3243a6b1ffa98e6acc8821f1b4efaaf841f12df6307fba729cb
+  metadata.gz: c48e48e0a4e1c2a2ea9d58e507adcee64e9cbac7a31c336da15d0ca3b0df3d51
+  data.tar.gz: c8accc89829202be56cdcae385e1ffd1df20da4bd89bbb2c46d70944eebe9ad8
 SHA512:
-  metadata.gz: 799f68978d7a8ea632126b16f2addb82b7e16f41e75c23f12abe809c5465ac74a7046276d371720f90472b4f0228353a3ccb9d48fbbf50ed443da2f9cf565a52
-  data.tar.gz: c17b1bdd2725d25d2c117ca6460e306ab1fe2cf96fddbcb43624f52f9dffa4546abd24ef2f13c66eb9c699e21ece24ef7e92f3d52f714ae712380fb09dcc21f6
+  metadata.gz: f3281a542c1412e8722f4a45a9363b956b8aa78133d77d0bd8dc56a9a40e827e88f8f05f8b80d75436786eb50e0772714dcc20c7fa0db00ff61bd86d2162eda3
+  data.tar.gz: bb9cd301b7568d3b9ff54f04555f1f1006c8a29a847c0c2f79986e45ac1368aa4d74daae347df7c3ba73f51fed00ac27e83f6d889faf29c2fbb8fe5125878b0a

data/README.md

@@ -167,6 +167,7 @@ Class | Method | HTTP request | Description
 *Zyphr::AuthMFAApi* | [**verify_mfa_enrollment**](docs/AuthMFAApi.md#verify_mfa_enrollment) | **POST** /auth/mfa/verify-enrollment | Verify MFA enrollment
 *Zyphr::AuthMagicLinksApi* | [**send_magic_link**](docs/AuthMagicLinksApi.md#send_magic_link) | **POST** /auth/magic-link/send | Send a magic link
 *Zyphr::AuthMagicLinksApi* | [**verify_magic_link**](docs/AuthMagicLinksApi.md#verify_magic_link) | **POST** /auth/magic-link/verify | Verify a magic link
+*Zyphr::AuthOAuthApi* | [**complete_o_auth_link**](docs/AuthOAuthApi.md#complete_o_auth_link) | **POST** /auth/oauth/{provider}/link/callback | Complete linking an OAuth provider to the current account
 *Zyphr::AuthOAuthApi* | [**disconnect_o_auth_provider**](docs/AuthOAuthApi.md#disconnect_o_auth_provider) | **DELETE** /auth/oauth/{provider} | Disconnect OAuth provider
 *Zyphr::AuthOAuthApi* | [**get_o_auth_authorization_url**](docs/AuthOAuthApi.md#get_o_auth_authorization_url) | **GET** /auth/oauth/{provider}/authorize | Get OAuth authorization URL
 *Zyphr::AuthOAuthApi* | [**get_o_auth_connection_info**](docs/AuthOAuthApi.md#get_o_auth_connection_info) | **GET** /auth/oauth/connections/{provider} | Get OAuth connection info
@@ -175,6 +176,7 @@ Class | Method | HTTP request | Description
 *Zyphr::AuthOAuthApi* | [**list_o_auth_connections**](docs/AuthOAuthApi.md#list_o_auth_connections) | **GET** /auth/oauth/connections | List OAuth connections
 *Zyphr::AuthOAuthApi* | [**list_o_auth_providers**](docs/AuthOAuthApi.md#list_o_auth_providers) | **GET** /auth/oauth/providers | List OAuth providers
 *Zyphr::AuthOAuthApi* | [**refresh_o_auth_tokens**](docs/AuthOAuthApi.md#refresh_o_auth_tokens) | **POST** /auth/oauth/tokens/{provider}/refresh | Refresh OAuth provider tokens
+*Zyphr::AuthOAuthApi* | [**start_o_auth_link**](docs/AuthOAuthApi.md#start_o_auth_link) | **GET** /auth/oauth/{provider}/link | Start linking an OAuth provider to the current account
 *Zyphr::AuthOrganizationsApi* | [**add_organization_member**](docs/AuthOrganizationsApi.md#add_organization_member) | **POST** /auth/organizations/{id}/members | Add a member to an organization
 *Zyphr::AuthOrganizationsApi* | [**create_organization**](docs/AuthOrganizationsApi.md#create_organization) | **POST** /auth/organizations | Create an organization
 *Zyphr::AuthOrganizationsApi* | [**delete_organization**](docs/AuthOrganizationsApi.md#delete_organization) | **DELETE** /auth/organizations/{id} | Delete an organization
@@ -598,6 +600,8 @@ Class | Method | HTTP request | Description
  - [Zyphr::MfaVerifyRequest](docs/MfaVerifyRequest.md)
  - [Zyphr::OAuthAuthorizationUrlResponse](docs/OAuthAuthorizationUrlResponse.md)
  - [Zyphr::OAuthAuthorizationUrlResponseData](docs/OAuthAuthorizationUrlResponseData.md)
+ - [Zyphr::OAuthAuthorizeResponse](docs/OAuthAuthorizeResponse.md)
+ - [Zyphr::OAuthAuthorizeResponseData](docs/OAuthAuthorizeResponseData.md)
  - [Zyphr::OAuthCallbackRequest](docs/OAuthCallbackRequest.md)
  - [Zyphr::OAuthCallbackResponse](docs/OAuthCallbackResponse.md)
  - [Zyphr::OAuthCallbackResponseData](docs/OAuthCallbackResponseData.md)
@@ -606,6 +610,8 @@ Class | Method | HTTP request | Description
  - [Zyphr::OAuthConnectionInfoResponseData](docs/OAuthConnectionInfoResponseData.md)
  - [Zyphr::OAuthConnectionsResponse](docs/OAuthConnectionsResponse.md)
  - [Zyphr::OAuthConnectionsResponseData](docs/OAuthConnectionsResponseData.md)
+ - [Zyphr::OAuthLinkResponse](docs/OAuthLinkResponse.md)
+ - [Zyphr::OAuthLinkResponseData](docs/OAuthLinkResponseData.md)
  - [Zyphr::OAuthProvider](docs/OAuthProvider.md)
  - [Zyphr::OAuthProviderInfo](docs/OAuthProviderInfo.md)
  - [Zyphr::OAuthProviderName](docs/OAuthProviderName.md)

data/docs/ApplicationSelf.md

@@ -10,6 +10,7 @@
 | **signing_algorithm** | **String** | JWT signing algorithm for this application's end-user tokens. |  |
 | **test_recipients** | **Array<String>** | The auth-email allowlist. In `allowlist` mode, only these addresses receive auth emails; in `unrestricted` mode it is ignored. Settable via PATCH /auth/application (sc-7600). |  |
 | **auth_email_mode** | **String** | Explicit auth-email gate mode (sc-7673). `unrestricted` sends auth emails to everyone. `allowlist` restricts auth email to `test_recipients` — and an EMPTY allowlist in this mode fails CLOSED (blocks all auth email). This replaces the previous behavior where the gate was inferred from whether `test_recipients` was empty. Defaults to `unrestricted`. |  |
+| **password_disallow_breached** | **Boolean** | When true (sc-7680), passwords found in the HaveIBeenPwned breach corpus are rejected at register/reset (and returned `valid:false` by `/auth/password-strength`). When false (default), breach info is advisory only. Fail-open: a breach-source outage never blocks auth. |  |
 
 ## Example
 
@@ -22,7 +23,8 @@ instance = Zyphr::ApplicationSelf.new(
   environment: null,
   signing_algorithm: null,
   test_recipients: null,
-  auth_email_mode: null
+  auth_email_mode: null,
+  password_disallow_breached: null
 )
 ```
 

data/docs/AuthOAuthApi.md

@@ -4,6 +4,7 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 | Method | HTTP request | Description |
 | ------ | ------------ | ----------- |
+| [**complete_o_auth_link**](AuthOAuthApi.md#complete_o_auth_link) | **POST** /auth/oauth/{provider}/link/callback | Complete linking an OAuth provider to the current account |
 | [**disconnect_o_auth_provider**](AuthOAuthApi.md#disconnect_o_auth_provider) | **DELETE** /auth/oauth/{provider} | Disconnect OAuth provider |
 | [**get_o_auth_authorization_url**](AuthOAuthApi.md#get_o_auth_authorization_url) | **GET** /auth/oauth/{provider}/authorize | Get OAuth authorization URL |
 | [**get_o_auth_connection_info**](AuthOAuthApi.md#get_o_auth_connection_info) | **GET** /auth/oauth/connections/{provider} | Get OAuth connection info |
@@ -12,6 +13,83 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 | [**list_o_auth_connections**](AuthOAuthApi.md#list_o_auth_connections) | **GET** /auth/oauth/connections | List OAuth connections |
 | [**list_o_auth_providers**](AuthOAuthApi.md#list_o_auth_providers) | **GET** /auth/oauth/providers | List OAuth providers |
 | [**refresh_o_auth_tokens**](AuthOAuthApi.md#refresh_o_auth_tokens) | **POST** /auth/oauth/tokens/{provider}/refresh | Refresh OAuth provider tokens |
+| [**start_o_auth_link**](AuthOAuthApi.md#start_o_auth_link) | **GET** /auth/oauth/{provider}/link | Start linking an OAuth provider to the current account |
+
+
+## complete_o_auth_link
+
+> <OAuthLinkResponse> complete_o_auth_link(provider, o_auth_callback_request)
+
+Complete linking an OAuth provider to the current account
+
+Complete an authenticated account-linking flow started via the link authorize endpoint. Attaches the resolved provider identity to the current end user. Rejects if the provider identity is already linked to a different account, if the provider did not verify the email, or if the linking session does not belong to the authenticated user. 
+
+### Examples
+
+```ruby
+require 'time'
+require 'zyphr'
+# setup authorization
+Zyphr.configure do |config|
+  # Configure Bearer authorization (JWT): EndUserToken
+  config.access_token = 'YOUR_BEARER_TOKEN'
+
+  # Configure API key authorization: ApplicationPublicKey
+  config.api_key['X-Application-Key'] = 'YOUR API KEY'
+  # Uncomment the following line to set a prefix for the API key, e.g. 'Bearer' (defaults to nil)
+  # config.api_key_prefix['X-Application-Key'] = 'Bearer'
+end
+
+api_instance = Zyphr::AuthOAuthApi.new
+provider = Zyphr::OAuthProviderName::GOOGLE # OAuthProviderName | OAuth provider name
+o_auth_callback_request = Zyphr::OAuthCallbackRequest.new({code: 'code_example', state: 'state_example'}) # OAuthCallbackRequest | 
+
+begin
+  # Complete linking an OAuth provider to the current account
+  result = api_instance.complete_o_auth_link(provider, o_auth_callback_request)
+  p result
+rescue Zyphr::ApiError => e
+  puts "Error when calling AuthOAuthApi->complete_o_auth_link: #{e}"
+end
+```
+
+#### Using the complete_o_auth_link_with_http_info variant
+
+This returns an Array which contains the response data, status code and headers.
+
+> <Array(<OAuthLinkResponse>, Integer, Hash)> complete_o_auth_link_with_http_info(provider, o_auth_callback_request)
+
+```ruby
+begin
+  # Complete linking an OAuth provider to the current account
+  data, status_code, headers = api_instance.complete_o_auth_link_with_http_info(provider, o_auth_callback_request)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => <OAuthLinkResponse>
+rescue Zyphr::ApiError => e
+  puts "Error when calling AuthOAuthApi->complete_o_auth_link_with_http_info: #{e}"
+end
+```
+
+### Parameters
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **provider** | [**OAuthProviderName**](.md) | OAuth provider name |  |
+| **o_auth_callback_request** | [**OAuthCallbackRequest**](OAuthCallbackRequest.md) |  |  |
+
+### Return type
+
+[**OAuthLinkResponse**](OAuthLinkResponse.md)
+
+### Authorization
+
+[EndUserToken](../README.md#EndUserToken), [ApplicationPublicKey](../README.md#ApplicationPublicKey)
+
+### HTTP request headers
+
+- **Content-Type**: application/json
+- **Accept**: application/json
 
 
 ## disconnect_o_auth_provider
@@ -595,3 +673,79 @@ end
 - **Content-Type**: application/json
 - **Accept**: application/json
 
+
+## start_o_auth_link
+
+> <OAuthAuthorizeResponse> start_o_auth_link(provider, redirect_uri)
+
+Start linking an OAuth provider to the current account
+
+Begin an authenticated account-linking flow. Unlike the sign-in authorize endpoint, this binds the current end user into the OAuth state so the matching link callback attaches the returned provider identity to THIS account instead of finding-or-creating a user. Requires an end-user token. 
+
+### Examples
+
+```ruby
+require 'time'
+require 'zyphr'
+# setup authorization
+Zyphr.configure do |config|
+  # Configure Bearer authorization (JWT): EndUserToken
+  config.access_token = 'YOUR_BEARER_TOKEN'
+
+  # Configure API key authorization: ApplicationPublicKey
+  config.api_key['X-Application-Key'] = 'YOUR API KEY'
+  # Uncomment the following line to set a prefix for the API key, e.g. 'Bearer' (defaults to nil)
+  # config.api_key_prefix['X-Application-Key'] = 'Bearer'
+end
+
+api_instance = Zyphr::AuthOAuthApi.new
+provider = Zyphr::OAuthProviderName::GOOGLE # OAuthProviderName | OAuth provider name
+redirect_uri = 'redirect_uri_example' # String | Redirect URI registered for the application
+
+begin
+  # Start linking an OAuth provider to the current account
+  result = api_instance.start_o_auth_link(provider, redirect_uri)
+  p result
+rescue Zyphr::ApiError => e
+  puts "Error when calling AuthOAuthApi->start_o_auth_link: #{e}"
+end
+```
+
+#### Using the start_o_auth_link_with_http_info variant
+
+This returns an Array which contains the response data, status code and headers.
+
+> <Array(<OAuthAuthorizeResponse>, Integer, Hash)> start_o_auth_link_with_http_info(provider, redirect_uri)
+
+```ruby
+begin
+  # Start linking an OAuth provider to the current account
+  data, status_code, headers = api_instance.start_o_auth_link_with_http_info(provider, redirect_uri)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => <OAuthAuthorizeResponse>
+rescue Zyphr::ApiError => e
+  puts "Error when calling AuthOAuthApi->start_o_auth_link_with_http_info: #{e}"
+end
+```
+
+### Parameters
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **provider** | [**OAuthProviderName**](.md) | OAuth provider name |  |
+| **redirect_uri** | **String** | Redirect URI registered for the application |  |
+
+### Return type
+
+[**OAuthAuthorizeResponse**](OAuthAuthorizeResponse.md)
+
+### Authorization
+
+[EndUserToken](../README.md#EndUserToken), [ApplicationPublicKey](../README.md#ApplicationPublicKey)
+
+### HTTP request headers
+
+- **Content-Type**: Not defined
+- **Accept**: application/json
+

data/docs/OAuthAuthorizeResponse.md

@@ -0,0 +1,20 @@
+# Zyphr::OAuthAuthorizeResponse
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **data** | [**OAuthAuthorizeResponseData**](OAuthAuthorizeResponseData.md) |  | [optional] |
+| **meta** | [**RequestMeta**](RequestMeta.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::OAuthAuthorizeResponse.new(
+  data: null,
+  meta: null
+)
+```
+

data/docs/OAuthAuthorizeResponseData.md

@@ -0,0 +1,20 @@
+# Zyphr::OAuthAuthorizeResponseData
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **authorization_url** | **String** | Provider authorization URL to redirect the user to | [optional] |
+| **state** | **String** | Opaque one-time state token for the callback | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::OAuthAuthorizeResponseData.new(
+  authorization_url: null,
+  state: null
+)
+```
+

data/docs/OAuthLinkResponse.md

@@ -0,0 +1,20 @@
+# Zyphr::OAuthLinkResponse
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **data** | [**OAuthLinkResponseData**](OAuthLinkResponseData.md) |  | [optional] |
+| **meta** | [**RequestMeta**](RequestMeta.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::OAuthLinkResponse.new(
+  data: null,
+  meta: null
+)
+```
+

data/docs/OAuthLinkResponseData.md

@@ -0,0 +1,20 @@
+# Zyphr::OAuthLinkResponseData
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **success** | **Boolean** |  | [optional] |
+| **provider_info** | [**OAuthProviderInfo**](OAuthProviderInfo.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::OAuthLinkResponseData.new(
+  success: null,
+  provider_info: null
+)
+```
+

data/docs/SetSelfApplicationTestRecipientsRequest.md

@@ -6,6 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **test_recipients** | **Array<String>** | Email addresses allowed to receive auth emails when auth_email_mode is 'allowlist'. Ignored in 'unrestricted' mode. Optional — omit to leave the current list unchanged. | [optional] |
 | **auth_email_mode** | **String** | Optional (sc-7673). Explicit auth-email gate mode. 'unrestricted' sends to everyone; 'allowlist' restricts to test_recipients (an EMPTY list in allowlist mode fails closed — blocks all auth email). Omit to leave the current mode unchanged. | [optional] |
+| **password_disallow_breached** | **Boolean** | Optional (sc-7680/sc-7697). When true, reject HIBP-breached passwords at register/reset. Omit to leave unchanged. | [optional] |
 
 ## Example
 
@@ -14,7 +15,8 @@ require 'zyphr'
 
 instance = Zyphr::SetSelfApplicationTestRecipientsRequest.new(
   test_recipients: null,
-  auth_email_mode: null
+  auth_email_mode: null,
+  password_disallow_breached: null
 )
 ```
 

data/lib/zyphr/api/auth_o_auth_api.rb

@@ -19,6 +19,80 @@ module Zyphr
     def initialize(api_client = ApiClient.default)
       @api_client = api_client
     end
+    # Complete linking an OAuth provider to the current account
+    # Complete an authenticated account-linking flow started via the link authorize endpoint. Attaches the resolved provider identity to the current end user. Rejects if the provider identity is already linked to a different account, if the provider did not verify the email, or if the linking session does not belong to the authenticated user. 
+    # @param provider [OAuthProviderName] OAuth provider name
+    # @param o_auth_callback_request [OAuthCallbackRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [OAuthLinkResponse]
+    def complete_o_auth_link(provider, o_auth_callback_request, opts = {})
+      data, _status_code, _headers = complete_o_auth_link_with_http_info(provider, o_auth_callback_request, opts)
+      data
+    end
+
+    # Complete linking an OAuth provider to the current account
+    # Complete an authenticated account-linking flow started via the link authorize endpoint. Attaches the resolved provider identity to the current end user. Rejects if the provider identity is already linked to a different account, if the provider did not verify the email, or if the linking session does not belong to the authenticated user. 
+    # @param provider [OAuthProviderName] OAuth provider name
+    # @param o_auth_callback_request [OAuthCallbackRequest] 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(OAuthLinkResponse, Integer, Hash)>] OAuthLinkResponse data, response status code and response headers
+    def complete_o_auth_link_with_http_info(provider, o_auth_callback_request, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: AuthOAuthApi.complete_o_auth_link ...'
+      end
+      # verify the required parameter 'provider' is set
+      if @api_client.config.client_side_validation && provider.nil?
+        fail ArgumentError, "Missing the required parameter 'provider' when calling AuthOAuthApi.complete_o_auth_link"
+      end
+      # verify the required parameter 'o_auth_callback_request' is set
+      if @api_client.config.client_side_validation && o_auth_callback_request.nil?
+        fail ArgumentError, "Missing the required parameter 'o_auth_callback_request' when calling AuthOAuthApi.complete_o_auth_link"
+      end
+      # resource path
+      local_var_path = '/auth/oauth/{provider}/link/callback'.sub('{' + 'provider' + '}', CGI.escape(provider.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+          header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(o_auth_callback_request)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'OAuthLinkResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['EndUserToken', 'ApplicationPublicKey']
+
+      new_options = opts.merge(
+        :operation => :"AuthOAuthApi.complete_o_auth_link",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: AuthOAuthApi#complete_o_auth_link\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Disconnect OAuth provider
     # Disconnect an OAuth provider from the current user.
     # @param provider [OAuthProviderName] OAuth provider name
@@ -546,5 +620,75 @@ module Zyphr
       end
       return data, status_code, headers
     end
+
+    # Start linking an OAuth provider to the current account
+    # Begin an authenticated account-linking flow. Unlike the sign-in authorize endpoint, this binds the current end user into the OAuth state so the matching link callback attaches the returned provider identity to THIS account instead of finding-or-creating a user. Requires an end-user token. 
+    # @param provider [OAuthProviderName] OAuth provider name
+    # @param redirect_uri [String] Redirect URI registered for the application
+    # @param [Hash] opts the optional parameters
+    # @return [OAuthAuthorizeResponse]
+    def start_o_auth_link(provider, redirect_uri, opts = {})
+      data, _status_code, _headers = start_o_auth_link_with_http_info(provider, redirect_uri, opts)
+      data
+    end
+
+    # Start linking an OAuth provider to the current account
+    # Begin an authenticated account-linking flow. Unlike the sign-in authorize endpoint, this binds the current end user into the OAuth state so the matching link callback attaches the returned provider identity to THIS account instead of finding-or-creating a user. Requires an end-user token. 
+    # @param provider [OAuthProviderName] OAuth provider name
+    # @param redirect_uri [String] Redirect URI registered for the application
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(OAuthAuthorizeResponse, Integer, Hash)>] OAuthAuthorizeResponse data, response status code and response headers
+    def start_o_auth_link_with_http_info(provider, redirect_uri, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: AuthOAuthApi.start_o_auth_link ...'
+      end
+      # verify the required parameter 'provider' is set
+      if @api_client.config.client_side_validation && provider.nil?
+        fail ArgumentError, "Missing the required parameter 'provider' when calling AuthOAuthApi.start_o_auth_link"
+      end
+      # verify the required parameter 'redirect_uri' is set
+      if @api_client.config.client_side_validation && redirect_uri.nil?
+        fail ArgumentError, "Missing the required parameter 'redirect_uri' when calling AuthOAuthApi.start_o_auth_link"
+      end
+      # resource path
+      local_var_path = '/auth/oauth/{provider}/link'.sub('{' + 'provider' + '}', CGI.escape(provider.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'redirect_uri'] = redirect_uri
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'OAuthAuthorizeResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['EndUserToken', 'ApplicationPublicKey']
+
+      new_options = opts.merge(
+        :operation => :"AuthOAuthApi.start_o_auth_link",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: AuthOAuthApi#start_o_auth_link\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
   end
 end

data/lib/zyphr/models/application_self.rb

@@ -34,6 +34,9 @@ module Zyphr
     # Explicit auth-email gate mode (sc-7673). `unrestricted` sends auth emails to everyone. `allowlist` restricts auth email to `test_recipients` — and an EMPTY allowlist in this mode fails CLOSED (blocks all auth email). This replaces the previous behavior where the gate was inferred from whether `test_recipients` was empty. Defaults to `unrestricted`.
     attr_accessor :auth_email_mode
 
+    # When true (sc-7680), passwords found in the HaveIBeenPwned breach corpus are rejected at register/reset (and returned `valid:false` by `/auth/password-strength`). When false (default), breach info is advisory only. Fail-open: a breach-source outage never blocks auth.
+    attr_accessor :password_disallow_breached
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -64,7 +67,8 @@ module Zyphr
         :'environment' => :'environment',
         :'signing_algorithm' => :'signing_algorithm',
         :'test_recipients' => :'test_recipients',
-        :'auth_email_mode' => :'auth_email_mode'
+        :'auth_email_mode' => :'auth_email_mode',
+        :'password_disallow_breached' => :'password_disallow_breached'
       }
     end
 
@@ -86,7 +90,8 @@ module Zyphr
         :'environment' => :'String',
         :'signing_algorithm' => :'String',
         :'test_recipients' => :'Array<String>',
-        :'auth_email_mode' => :'String'
+        :'auth_email_mode' => :'String',
+        :'password_disallow_breached' => :'Boolean'
       }
     end
 
@@ -150,6 +155,12 @@ module Zyphr
       else
         self.auth_email_mode = nil
       end
+
+      if attributes.key?(:'password_disallow_breached')
+        self.password_disallow_breached = attributes[:'password_disallow_breached']
+      else
+        self.password_disallow_breached = nil
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -177,6 +188,10 @@ module Zyphr
         invalid_properties.push('invalid value for "auth_email_mode", auth_email_mode cannot be nil.')
       end
 
+      if @password_disallow_breached.nil?
+        invalid_properties.push('invalid value for "password_disallow_breached", password_disallow_breached cannot be nil.')
+      end
+
       invalid_properties
     end
 
@@ -195,6 +210,7 @@ module Zyphr
       return false if @auth_email_mode.nil?
       auth_email_mode_validator = EnumAttributeValidator.new('String', ["allowlist", "unrestricted"])
       return false unless auth_email_mode_validator.valid?(@auth_email_mode)
+      return false if @password_disallow_breached.nil?
       true
     end
 
@@ -258,6 +274,16 @@ module Zyphr
       @auth_email_mode = auth_email_mode
     end
 
+    # Custom attribute writer method with validation
+    # @param [Object] password_disallow_breached Value to be assigned
+    def password_disallow_breached=(password_disallow_breached)
+      if password_disallow_breached.nil?
+        fail ArgumentError, 'password_disallow_breached cannot be nil'
+      end
+
+      @password_disallow_breached = password_disallow_breached
+    end
+
     # Checks equality by comparing each attribute.
     # @param [Object] Object to be compared
     def ==(o)
@@ -268,7 +294,8 @@ module Zyphr
           environment == o.environment &&
           signing_algorithm == o.signing_algorithm &&
           test_recipients == o.test_recipients &&
-          auth_email_mode == o.auth_email_mode
+          auth_email_mode == o.auth_email_mode &&
+          password_disallow_breached == o.password_disallow_breached
     end
 
     # @see the `==` method
@@ -280,7 +307,7 @@ module Zyphr
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [id, name, environment, signing_algorithm, test_recipients, auth_email_mode].hash
+      [id, name, environment, signing_algorithm, test_recipients, auth_email_mode, password_disallow_breached].hash
     end
 
     # Builds the object from hash