@absolutejs/auth 0.84.0 → 0.86.0

package/dist/organizations/config.d.ts

@@ -15,6 +15,8 @@ export type OrganizationInvitationMessage = {
 };
 export type OrganizationsConfig<UserType> = {
     getUserId: (user: UserType) => string;
+    /** Return only an independently verified email. Missing evidence denies acceptance. */
+    getVerifiedEmail?: (user: UserType) => string | undefined | Promise<string | undefined>;
     organizationStore: OrganizationStore;
     canCreateOrganization?: (user: UserType) => boolean | Promise<boolean>;
     canManageMembers?: (context: {

package/dist/organizations/operations.d.ts

@@ -1,10 +1,12 @@
 import type { OrganizationId } from '../tenancy';
-import type { Organization, OrganizationInvitation, OrganizationMembership, OrganizationStore } from './types';
-export declare const acceptInvitation: ({ organizationStore, token, userId }: {
+import type { Organization, OrganizationInvitation, OrganizationStore } from './types';
+export declare const acceptInvitation: ({ organizationStore, token, userId, verifiedEmail }: {
     organizationStore: OrganizationStore;
     token: string;
     userId: string;
-}) => Promise<OrganizationMembership | undefined>;
+    /** Provider-verified email, never an unverified profile field or request body. */
+    verifiedEmail?: string;
+}) => Promise<import("./types").OrganizationMembership | undefined>;
 export declare const autoAssignOrgsByEmail: ({ email, getOrgsForDomain, organizationStore, roles, userId }: {
     email: string;
     getOrgsForDomain: (domain: string) => Promise<OrganizationId[]> | OrganizationId[];
@@ -34,6 +36,6 @@ export declare const listUserOrganizations: ({ organizationStore, userId }: {
     organizationStore: OrganizationStore;
     userId: string;
 }) => Promise<{
-    membership: OrganizationMembership;
+    membership: import("./types").OrganizationMembership;
     organization: Organization | undefined;
 }[]>;

package/dist/organizations/routes.d.ts

@@ -1,6 +1,6 @@
 import type { SessionRecord } from '../types';
 import { type OrganizationsRouteProps } from './config';
-export declare const organizationRoutes: <UserType>({ authSessionStore, canCreateOrganization, canManageMembers, emit, getUserId, invitationDurationMs, onMembershipAdded, onMembershipRemoved, onOrganizationCreated, onSendInvitation, organizationsRoute, organizationStore, ownerRoles }: OrganizationsRouteProps<UserType>) => import("elysia/types").AddRoute<"", "local", {
+export declare const organizationRoutes: <UserType>({ authSessionStore, canCreateOrganization, canManageMembers, emit, getUserId, getVerifiedEmail, invitationDurationMs, onMembershipAdded, onMembershipRemoved, onOrganizationCreated, onSendInvitation, organizationsRoute, organizationStore, ownerRoles }: OrganizationsRouteProps<UserType>) => import("elysia/types").AddRoute<"", "local", {
     decorator: {};
     store: {
         session: SessionRecord<UserType>;

package/dist/organizations/types.d.ts

@@ -29,6 +29,14 @@ export type OrganizationInvitation = {
     tokenHash: string;
 };
 export type OrganizationStore = {
+    /** Atomically consume a live invitation and add membership. Custom stores must
+     * implement this capability; acceptance fails closed without it. */
+    acceptInvitation?: (input: {
+        tokenHash: string;
+        userId: string;
+        verifiedEmail: string;
+        now: number;
+    }) => Promise<OrganizationMembership | undefined>;
     deleteOrganization: (organizationId: OrganizationId) => Promise<void>;
     getInvitation: (invitationId: string) => Promise<OrganizationInvitation | undefined>;
     getInvitationByTokenHash: (tokenHash: string) => Promise<OrganizationInvitation | undefined>;

package/dist/providers/clients.d.ts

@@ -1069,6 +1069,31 @@ export declare const buildClientProviders: (providersConfiguration: OAuth2Config
                         encoding: "application/x-www-form-urlencoded";
                         url: string;
                     };
+                } & import("citra").ProviderConfig<any>) | ({
+                    authorizationUrl: string;
+                    isOIDC: true;
+                    isRefreshable: true;
+                    PKCEMethod: "S256";
+                    profileRequest: {
+                        authIn: "header";
+                        encoding: "application/json";
+                        method: "GET";
+                        url: string;
+                    };
+                    revocationRequest: {
+                        authIn: "body";
+                        encoding: "application/x-www-form-urlencoded";
+                        tokenParamName: "token";
+                        url: string;
+                    };
+                    scopeRequired: true;
+                    subject: string[];
+                    subjectType: "string";
+                    tokenRequest: {
+                        authIn: "body";
+                        encoding: "application/x-www-form-urlencoded";
+                        url: string;
+                    };
                 } & import("citra").ProviderConfig<any>) | ({
                     authorizationUrl: string;
                     email: string[];
@@ -1810,7 +1835,7 @@ export declare const buildClientProviders: (providersConfiguration: OAuth2Config
                         url: string;
                     };
                 } & import("citra").ProviderConfig<any>);
-                providerInstance: OAuth2Client<"42" | "absolutejs" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "azureadb2c" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraexternalid" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "onspark" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom">;
+                providerInstance: OAuth2Client<"42" | "absolutejs" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "azureadb2c" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraexternalid" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "neon" | "notion" | "okta" | "onspark" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom">;
                 requiresPKCE: boolean;
                 scope: string[] | undefined;
                 searchParams: [string, string][] | undefined;
@@ -1821,7 +1846,7 @@ export declare const buildClientProviders: (providersConfiguration: OAuth2Config
 }>;
 export declare const normalizeProvidersConfiguration: (providersConfiguration: OAuth2ConfigurationOptions) => {
     [k: string]: {
-        [k: string]: OAuth2ProviderClientConfiguration<"42" | "absolutejs" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "azureadb2c" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraexternalid" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "onspark" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom">;
+        [k: string]: OAuth2ProviderClientConfiguration<"42" | "absolutejs" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "azureadb2c" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraexternalid" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "neon" | "notion" | "okta" | "onspark" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom">;
     };
 };
 export declare const resolveClientProviderEntry: ({ clientName, clientProviders, providerName }: {
@@ -1852,7 +1877,7 @@ export declare const resolveProviderClientConfiguration: ({ clientName, provider
     error: "Client provider not found";
     config?: undefined;
 } | {
-    config: OAuth2ProviderClientConfiguration<"42" | "absolutejs" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "azureadb2c" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraexternalid" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "onspark" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom"> | undefined;
+    config: OAuth2ProviderClientConfiguration<"42" | "absolutejs" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "azureadb2c" | "battlenet" | "bitbucket" | "box" | "bungie" | "calendly" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraexternalid" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "neon" | "notion" | "okta" | "onspark" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "slackuser" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom"> | undefined;
     readonly error?: undefined;
 } | {
     error: "Client variant is required";

package/dist/providers/index.js

@@ -1262,6 +1262,32 @@ var providers = defineProviders({
       url: "https://nid.naver.com/oauth2.0/token"
     }
   },
+  neon: {
+    authorizationUrl: "https://oauth2.neon.tech/oauth2/auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth2.neon.tech/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://oauth2.neon.tech/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth2.neon.tech/oauth2/token"
+    }
+  },
   notion: {
     authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
     email: ["bot", "owner", "user", "person", "email"],
@@ -2883,39 +2909,13 @@ var buildOAuth2Client = async (meta, config) => {
 var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 // src/providers/neon.ts
-var neonProviderConfiguration = defineProvider({
-  authorizationUrl: "https://oauth2.neon.tech/oauth2/auth",
-  isOIDC: true,
-  isRefreshable: true,
-  PKCEMethod: "S256",
-  profileRequest: {
-    authIn: "header",
-    encoding: "application/json",
-    method: "GET",
-    url: "https://oauth2.neon.tech/userinfo"
-  },
-  revocationRequest: {
-    authIn: "body",
-    encoding: "application/x-www-form-urlencoded",
-    tokenParamName: "token",
-    url: "https://oauth2.neon.tech/oauth2/revoke"
-  },
-  scopeRequired: true,
-  subject: ["sub"],
-  subjectType: "string",
-  tokenRequest: {
-    authIn: "body",
-    encoding: "application/x-www-form-urlencoded",
-    url: "https://oauth2.neon.tech/oauth2/token"
-  }
-});
+var neonProviderConfiguration = providers.neon;
 var createNeonProviderConfiguration = ({
   credentials,
   offlineAccess = false,
   scopes
 }) => ({
   credentials: { ...credentials },
-  providerConfig: neonProviderConfiguration,
   scope: [
     "openid",
     ...offlineAccess ? ["offline", "offline_access"] : [],
@@ -2943,5 +2943,5 @@ export {
   scopeRequiredProviderOptions
 };
 
-//# debugId=B1F765FDFC228CB564756E2164756E21
+//# debugId=5BB504DE6AFE93D864756E2164756E21
 //# sourceMappingURL=index.js.map