@absolutejs/auth 0.84.0 → 0.86.0

package/CHANGELOG.md

@@ -6,6 +6,24 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.86.0 — 2026-09-23
+
+### Breaking
+
+- **Bind organization invitation acceptance to a verified email and atomically consume the invitation with membership creation. Deny expired, revoked, missing-organization and suspended-member invitations; preserve existing member roles.** (`acceptInvitation`, `OrganizationsConfig`, `OrganizationStore`, `listUserOrganizations`, `organizationRoutes`)
+  _Migration:_ Configure organizations.getVerifiedEmail with provider-verified email evidence. Direct acceptInvitation callers must supply verifiedEmail. Custom OrganizationStore adapters must implement atomic acceptInvitation; older adapters fail closed.
+
+## 0.85.0 — 2026-09-23
+
+### Breaking
+
+- **Use the native Citra Neon provider for Auth configuration and linked-account refresh** (`createNeonProviderConfiguration`, `neonProviderConfiguration`)
+  _Migration:_ Move createNeonProviderConfiguration results from customProviders.neon to providersConfiguration.neon. Neon is now a built-in Citra provider; credentials, scopes and offlineAccess inputs are unchanged.
+
+### Changed
+
+- **Include Neon in the typed built-in provider registry and configuration resolution** (`buildClientProviders`, `resolveProviderClientConfiguration`)
+
 ## 0.84.0 — 2026-09-23
 
 ### Added

package/changelog.json

@@ -2,6 +2,53 @@
 	"contract": 1,
 	"name": "@absolutejs/auth",
 	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "breaking",
+					"migration": {
+						"instruction": "Configure organizations.getVerifiedEmail with provider-verified email evidence. Direct acceptInvitation callers must supply verifiedEmail. Custom OrganizationStore adapters must implement atomic acceptInvitation; older adapters fail closed.",
+						"manual": true
+					},
+					"summary": "Bind organization invitation acceptance to a verified email and atomically consume the invitation with membership creation. Deny expired, revoked, missing-organization and suspended-member invitations; preserve existing member roles.",
+					"symbols": [
+						"acceptInvitation",
+						"OrganizationsConfig",
+						"OrganizationStore",
+						"listUserOrganizations",
+						"organizationRoutes"
+					]
+				}
+			],
+			"date": "2026-09-23",
+			"version": "0.86.0"
+		},
+		{
+			"changes": [
+				{
+					"kind": "changed",
+					"summary": "Include Neon in the typed built-in provider registry and configuration resolution",
+					"symbols": [
+						"buildClientProviders",
+						"resolveProviderClientConfiguration"
+					]
+				},
+				{
+					"kind": "breaking",
+					"migration": {
+						"instruction": "Move createNeonProviderConfiguration results from customProviders.neon to providersConfiguration.neon. Neon is now a built-in Citra provider; credentials, scopes and offlineAccess inputs are unchanged.",
+						"manual": true
+					},
+					"summary": "Use the native Citra Neon provider for Auth configuration and linked-account refresh",
+					"symbols": [
+						"createNeonProviderConfiguration",
+						"neonProviderConfiguration"
+					]
+				}
+			],
+			"date": "2026-09-23",
+			"version": "0.85.0"
+		},
 		{
 			"changes": [
 				{

package/dist/bun.js

@@ -13754,6 +13754,32 @@ var providers = defineProviders({
       url: "https://nid.naver.com/oauth2.0/token"
     }
   },
+  neon: {
+    authorizationUrl: "https://oauth2.neon.tech/oauth2/auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth2.neon.tech/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://oauth2.neon.tech/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth2.neon.tech/oauth2/token"
+    }
+  },
   notion: {
     authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
     email: ["bot", "owner", "user", "person", "email"],
@@ -16892,6 +16918,27 @@ var toInvitation = (row) => ({
 });
 var createNeonOrganizationStore = (databaseUrl) => createPostgresOrganizationStore(createNeonDatabase(databaseUrl));
 var createPostgresOrganizationStore = (db) => ({
+  acceptInvitation: async ({ now, tokenHash, userId, verifiedEmail }) => {
+    const claimed = db.$with("claimed").as(db.update(organizationInvitationsTable).set({ accepted_at_ms: now, state: "accepted" }).where(and(eq(organizationInvitationsTable.token_hash, tokenHash), eq(organizationInvitationsTable.state, "pending"), gt3(organizationInvitationsTable.expires_at_ms, now), sql`lower(trim(${organizationInvitationsTable.email})) = ${verifiedEmail}`, exists(db.select().from(organizationsTable).where(eq(organizationsTable.organization_id, organizationInvitationsTable.organization_id))), notExists(db.select().from(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationInvitationsTable.organization_id), eq(organizationMembershipsTable.user_id, userId), eq(organizationMembershipsTable.status, "suspended")))))).returning({
+      organizationId: organizationInvitationsTable.organization_id,
+      roles: organizationInvitationsTable.roles
+    }));
+    const [row] = await db.with(claimed).insert(organizationMembershipsTable).select(db.select({
+      created_at_ms: sql`${now}`.as("created_at_ms"),
+      organization_id: claimed.organizationId,
+      roles: claimed.roles,
+      status: sql`'active'`.as("status"),
+      updated_at_ms: sql`${now}`.as("updated_at_ms"),
+      user_id: sql`${userId}`.as("user_id")
+    }).from(claimed)).onConflictDoUpdate({
+      set: { user_id: userId },
+      target: [
+        organizationMembershipsTable.organization_id,
+        organizationMembershipsTable.user_id
+      ]
+    }).returning();
+    return row && row.status === "active" ? toMembership(row) : undefined;
+  },
   deleteOrganization: async (organizationId) => {
     await db.delete(organizationsTable).where(eq(organizationsTable.organization_id, organizationId));
   },
@@ -18074,5 +18121,5 @@ export {
   runBunMigrations
 };
 
-//# debugId=2CBFE7DC73F7997264756E2164756E21
+//# debugId=0AF087F2064BFFA264756E2164756E21
 //# sourceMappingURL=bun.js.map