@absolutejs/auth 0.83.0 → 0.85.0

package/docs/neon.md

@@ -0,0 +1,49 @@
+# Neon partner OAuth
+
+Neon direct OAuth requires a registered partner application and an active commercial
+relationship. This preset does not register an application or confer partner status.
+See https://neon.com/docs/guides/oauth-integration for registration and callback requirements.
+
+```ts
+import { createNeonProviderConfiguration } from '@absolutejs/auth/providers';
+
+const neon = createNeonProviderConfiguration({
+  credentials: {
+    clientId: process.env.NEON_CLIENT_ID!,
+    clientSecret: process.env.NEON_CLIENT_SECRET!,
+    redirectUri: 'https://app.example.com/auth/neon/callback'
+  },
+  scopes: ['urn:neoncloud:orgs:read', 'urn:neoncloud:projects:read'],
+  offlineAccess: true
+});
+// Pass providersConfiguration: { neon } to your existing Auth configuration.
+```
+
+Keep credentials on the server. Register the exact callback used by your Auth
+mount. The preset enables S256 PKCE, identifies accounts by `sub`, and requests
+`openid`. Management permissions must be explicit. `offlineAccess` adds both
+`offline` and `offline_access`; it defaults to false. Request create/update only
+when the customer needs those operations. Delete and organization administration
+are never implicit. Do not infer an email or organization from the subject.
+
+The existing built-in provider authorization, callback, profile, refresh and revoke
+routes handle this definition. An account connection is separate from signing the
+customer into your application; enforce your application's account-linking policy.
+The generic `createOAuthLinkedProviderCredentialResolver` recognizes Neon through
+Citra's built-in provider registry, including background token renewal.
+This preset alone does not
+provide a resource picker, database provisioning, secret delivery or browser
+assistance. Do not enable the customer-facing connection until those pieces and
+partner credentials are in place.
+
+Use a provider-owned sign-in window where required. Do not proxy sign-in into an
+embedded browser that violates the identity provider's policies. Never put client
+secrets, refresh tokens or database connection strings into chat or referral URLs.
+Referral agreements and reporting are separate from OAuth permission grants.
+
+## Migration from 0.84.0
+
+Move the helper result from `customProviders.neon` to
+`providersConfiguration.neon`. Neon is now a built-in Citra provider; retaining a
+custom provider under that name is rejected to prevent provider collisions.
+The helper retains the same credentials, scopes and offline-access options.

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.83.0",
+	"version": "0.85.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -75,7 +75,7 @@
 		"@neondatabase/serverless": "1.0.0",
 		"@opentelemetry/api": "1.9.1",
 		"@simplewebauthn/browser": "13.3.0",
-		"citra": "0.29.13",
+		"citra": "0.30.0",
 		"typebox": "^1.3.16"
 	},
 	"devDependencies": {