@absolutejs/auth 0.77.1 → 0.79.0

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to `@absolutejs/auth`.
+
+This file is generated by `absolute-changelog` from the entries in
+`changelog/`. Edit an entry, not this file — and add new ones under
+`changelog/unreleased/`.
+
+## 0.79.0 — 2026-09-10
+
+### Breaking
+
+- **Separate API credential token routes from OIDC and reject conflicting configuration** (`apiKeysRoutes`, `auth`, `createAuthApplications`, `AuthConfig`, `ApiKeysConfig`)
+  _Migration:_ Send client_credentials requests to /auth/api/token instead of /oauth2/token and update advertised enterprise token URLs. Keep authorization_code and refresh_token requests at /oauth2/token. Prefer auth({ oidc, apikeys }) for configuration validation. API-only consumers may explicitly keep tokenRoute: /oauth2/token if no OIDC handler uses that path.

package/README.md

@@ -392,3 +392,19 @@ using it has expired; duplicate key IDs fail closed.
 ## Note
 
 This project uses Bun and is built for Elysia.
+
+## OAuth and API credential token routes
+
+As of 0.79.0, `apiKeysRoutes()` and `auth({ apikeys })` serve the
+`client_credentials` grant at `/auth/api/token` by default. OIDC authorization
+code and refresh grants continue to use `/oauth2/token`. This keeps separately
+mounted plugins from replacing each other's token handler.
+
+Update enterprise integrations and displayed token URLs to `/auth/api/token`.
+API-only applications can retain the previous URL by explicitly setting
+`apikeys.tokenRoute: '/oauth2/token'`, provided no OIDC handler uses that path.
+
+Prefer configuring both features in `auth({ oidc, apikeys })`: conflicting token
+paths are rejected during construction, including a trailing-slash alias.
+When mounting standalone plugins with custom paths, the consumer must keep
+the paths distinct; Elysia does not reject arbitrary duplicate routes.

package/changelog.json

@@ -0,0 +1,27 @@
+{
+	"contract": 1,
+	"name": "@absolutejs/auth",
+	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "breaking",
+					"migration": {
+						"instruction": "Send client_credentials requests to /auth/api/token instead of /oauth2/token and update advertised enterprise token URLs. Keep authorization_code and refresh_token requests at /oauth2/token. Prefer auth({ oidc, apikeys }) for configuration validation. API-only consumers may explicitly keep tokenRoute: /oauth2/token if no OIDC handler uses that path.",
+						"manual": true
+					},
+					"summary": "Separate API credential token routes from OIDC and reject conflicting configuration",
+					"symbols": [
+						"apiKeysRoutes",
+						"auth",
+						"createAuthApplications",
+						"AuthConfig",
+						"ApiKeysConfig"
+					]
+				}
+			],
+			"date": "2026-09-10",
+			"version": "0.79.0"
+		}
+	]
+}

package/dist/apikeys/config.d.ts

@@ -13,7 +13,7 @@ export type ApiKeysConfig = {
     /** Static API keys. Used by the exported `verifyApiKey` / `resolveApiPrincipal`
      *  helpers; the consumer wires its own management + guard routes. */
     apiKeyStore?: ApiKeyStore;
-    /** Path of the client_credentials token endpoint (defaults to `/oauth2/token`). */
+    /** Path of the client_credentials token endpoint (defaults to `/auth/api/token`). */
     tokenRoute?: RouteString;
 };
 export type ClientCredentialsResult = {

package/dist/apikeys/tokenRoutes.d.ts

@@ -0,0 +1,7 @@
+import type { RouteString } from '../types';
+import { type ApiKeysConfig } from './config';
+/** Elysia replaces duplicate method/path registrations. Refuse that setup
+ * before composing the two independently configured token handlers. */
+export declare const assertTokenRouteConfiguration: (apikeys: ApiKeysConfig | undefined, oidc: {
+    oidcRoute?: RouteString;
+} | undefined) => void;

package/dist/cli/migrate.js

@@ -2664,7 +2664,7 @@ var linkedProviderBindingsTable = pgTable7("linked_provider_bindings", {
   available_scopes: jsonb3("available_scopes").$type().notNull().default([]),
   capabilities: jsonb3("capabilities").$type().default([]),
   connector_provider: varchar7("connector_provider", { length: 64 }).notNull(),
-  created_at: timestamp("created_at").notNull().defaultNow(),
+  created_at: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   email: varchar7("email", { length: 320 }),
   external_account_id: varchar7("external_account_id", {
     length: 255
@@ -2677,18 +2677,18 @@ var linkedProviderBindingsTable = pgTable7("linked_provider_bindings", {
   label: varchar7("label", { length: 255 }),
   metadata: jsonb3("metadata").$type().default({}),
   status: varchar7("status", { length: 64 }).$type().notNull(),
-  updated_at: timestamp("updated_at").notNull().defaultNow(),
+  updated_at: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   username: varchar7("username", { length: 255 })
 });
 var linkedProviderGrantsTable = pgTable7("linked_provider_grants", {
   access_token_ciphertext: text3("access_token_ciphertext"),
   auth_provider_key: varchar7("auth_provider_key", { length: 64 }).notNull(),
-  created_at: timestamp("created_at").notNull().defaultNow(),
-  expires_at: timestamp("expires_at"),
+  created_at: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  expires_at: timestamp("expires_at", { withTimezone: true }),
   granted_scopes: jsonb3("granted_scopes").$type().notNull().default([]),
   id: varchar7("id", { length: 255 }).primaryKey(),
   last_refresh_error: text3("last_refresh_error"),
-  last_refreshed_at: timestamp("last_refreshed_at"),
+  last_refreshed_at: timestamp("last_refreshed_at", { withTimezone: true }),
   metadata: jsonb3("metadata").$type().default({}),
   owner_ref: varchar7("owner_ref", { length: 255 }).notNull(),
   provider_family: varchar7("provider_family", { length: 64 }).notNull(),
@@ -2696,7 +2696,7 @@ var linkedProviderGrantsTable = pgTable7("linked_provider_grants", {
   refresh_token_ciphertext: text3("refresh_token_ciphertext"),
   status: varchar7("status", { length: 64 }).$type().notNull(),
   token_type: varchar7("token_type", { length: 64 }),
-  updated_at: timestamp("updated_at").notNull().defaultNow()
+  updated_at: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 });
 
 // src/lockout/postgresLockoutStore.ts
@@ -3659,5 +3659,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=4F26DF822A88399A64756E2164756E21
+//# debugId=1171B72D10FC06DD64756E2164756E21
 //# sourceMappingURL=migrate.js.map