@authhero/adapter-interfaces 2.10.0 → 2.11.0

package/dist/types/adapters/Grants.d.ts

@@ -0,0 +1,18 @@
+import { ListParams } from "../types/ListParams";
+import { Totals } from "../types";
+import { Grant, GrantInsert } from "../types/Grant";
+export interface ListGrantsResponse extends Totals {
+    grants: Grant[];
+}
+export interface GrantsAdapter {
+    /**
+     * Upsert a grant. If a row already exists for
+     * (tenant_id, user_id, clientID, audience) the supplied scopes are unioned
+     * into the stored scope array; otherwise a new row is created.
+     */
+    create: (tenant_id: string, grant: GrantInsert) => Promise<Grant>;
+    get: (tenant_id: string, user_id: string, clientID: string, audience?: string) => Promise<Grant | null>;
+    list: (tenant_id: string, params?: ListParams) => Promise<ListGrantsResponse>;
+    remove: (tenant_id: string, id: string) => Promise<boolean>;
+    removeByUser: (tenant_id: string, user_id: string) => Promise<boolean>;
+}

package/dist/types/adapters/index.d.ts

@@ -31,6 +31,7 @@ import { RefreshTokensAdapter } from "./RefreshTokens";
 import { FormsAdapter } from "./Forms";
 import { ResourceServersAdapter } from "./ResourceServers";
 import { RolePermissionsAdapter } from "./RolePermissions";
+import { GrantsAdapter } from "./Grants";
 import { UserPermissionsAdapter } from "./UserPermissions";
 import { RolesAdapter } from "./Roles";
 import { UserRolesAdapter } from "./UserRoles";
@@ -100,6 +101,19 @@ export interface DataAdapters {
     refreshTokens: RefreshTokensAdapter;
     resourceServers: ResourceServersAdapter;
     rolePermissions: RolePermissionsAdapter;
+    /**
+     * Optional store for per-(user, client) OAuth grants. When set,
+     * third-party clients (`is_first_party=false`) must have a grant
+     * covering the requested non-basic scopes; without it, silent auth returns
+     * `consent_required` and interactive auth redirects to the consent screen.
+     * When undefined, the consent gate fails closed for third-party clients —
+     * deployments that don't ship this adapter effectively can't run third-party
+     * clients through the standard authorize flow.
+     *
+     * Auth0 parity: surfaced as `/api/v2/grants` (distinct from M2M
+     * `/api/v2/client-grants`, which is `clientGrants` above).
+     */
+    grants?: GrantsAdapter;
     userPermissions: UserPermissionsAdapter;
     roles: RolesAdapter;
     sessions: SessionsAdapter;
@@ -223,4 +237,5 @@ export * from "./Sessions";
 export * from "./TenantSettings";
 export * from "./Tenants";
 export * from "./Themes";
+export * from "./Grants";
 export * from "./Users";

package/dist/types/types/Grant.d.ts

@@ -0,0 +1,16 @@
+import { z } from "@hono/zod-openapi";
+export declare const grantInsertSchema: z.ZodObject<{
+    user_id: z.ZodString;
+    clientID: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    scope: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type GrantInsert = z.input<typeof grantInsertSchema>;
+export declare const grantSchema: z.ZodObject<{
+    user_id: z.ZodString;
+    clientID: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    scope: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type Grant = z.infer<typeof grantSchema>;

package/dist/types/types/LoginSession.d.ts

@@ -12,6 +12,8 @@ export declare enum LoginSessionState {
     AWAITING_HOOK = "awaiting_hook",
     /** Waiting for user to complete action on continuation page (change-email, account, etc.) */
     AWAITING_CONTINUATION = "awaiting_continuation",
+    /** Waiting for user to approve OAuth consent for a third-party client */
+    AWAITING_CONSENT = "awaiting_consent",
     /** Tokens issued successfully */
     COMPLETED = "completed",
     /** Authentication failed (wrong password, blocked, etc.) */

package/dist/types/types/ProxyRoute.d.ts

@@ -13,6 +13,7 @@ export declare const handlerConfigSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type HandlerConfig = z.infer<typeof handlerConfigSchema>;
 export declare const proxyRouteInsertSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
     custom_domain_id: z.ZodString;
     priority: z.ZodDefault<z.ZodNumber>;
     match: z.ZodObject<{

package/dist/types/types/index.d.ts

@@ -40,6 +40,7 @@ export * from "./RefreshTokens";
 export * from "./SmsProvider";
 export * from "./ResourceServer";
 export * from "./RolePermission";
+export * from "./Grant";
 export * from "./UserPermission";
 export * from "./UserRole";
 export * from "./Role";

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "2.10.0",
+  "version": "2.11.0",
   "files": [
     "dist"
   ],