@authhero/adapter-interfaces 4.10.0 → 4.12.0

package/dist/types/adapters/RefreshTokens.d.ts

@@ -28,6 +28,23 @@ export interface UpdateRefreshTokenOptions {
         expires_at: string;
     };
 }
+/**
+ * Update payload for a refresh token.
+ *
+ * The two expiry columns are three-valued on the way in: `undefined` leaves
+ * the stored value alone, a string overwrites it, and `null` clears it — the
+ * token stops expiring on that axis.
+ *
+ * Clearing exists for the in-place refresh exchange. A rotating client
+ * reconciles a changed refresh-token config for free, because the child row is
+ * minted from the current lifetimes; a non-rotating one keeps handing back the
+ * row it was given, so switching a client to non-expiring has to be able to
+ * drop the expiries that row was stamped with.
+ */
+export type RefreshTokenUpdate = Partial<Omit<RefreshToken, "expires_at" | "idle_expires_at">> & {
+    expires_at?: string | null;
+    idle_expires_at?: string | null;
+};
 export interface RefreshTokensAdapter {
     create: (tenant_id: string, refresh_token: RefreshTokenInsert) => Promise<RefreshToken>;
     get: (tenant_id: string, id: string) => Promise<RefreshToken | null>;
@@ -38,7 +55,7 @@ export interface RefreshTokensAdapter {
      */
     getByLookup: (tenant_id: string, token_lookup: string) => Promise<RefreshToken | null>;
     list(tenant_id: string, params?: RefreshTokenListParams): Promise<ListRefreshTokenResponse>;
-    update: (tenant_id: string, id: string, refresh_token: Partial<RefreshToken>, options?: UpdateRefreshTokenOptions) => Promise<boolean>;
+    update: (tenant_id: string, id: string, refresh_token: RefreshTokenUpdate, options?: UpdateRefreshTokenOptions) => Promise<boolean>;
     remove: (tenant_id: string, id: string) => Promise<boolean>;
     /**
      * Soft-revoke every refresh token belonging to a user that isn't already

package/dist/types/types/Action.d.ts

@@ -85,3 +85,43 @@ export declare const actionSchema: z.ZodObject<{
     updated_at: z.ZodString;
 }, z.core.$strip>;
 export type Action = z.infer<typeof actionSchema>;
+/** A secret as it appears in an API response — name only, never the value. */
+export declare const actionSecretNameSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The action shape safe to return over HTTP.
+ *
+ * Identical to {@link actionSchema} except that secrets are narrowed to their
+ * names, so a secret value cannot leak through a management-API response —
+ * the route handlers already redact at runtime, and this makes the type
+ * system enforce it rather than relying on every handler remembering.
+ */
+export declare const actionResponseSchema: z.ZodObject<{
+    name: z.ZodString;
+    code: z.ZodString;
+    supported_triggers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    runtime: z.ZodOptional<z.ZodString>;
+    dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+    }, z.core.$strip>>>;
+    is_system: z.ZodOptional<z.ZodBoolean>;
+    inherit: z.ZodOptional<z.ZodBoolean>;
+    id: z.ZodString;
+    tenant_id: z.ZodString;
+    status: z.ZodDefault<z.ZodEnum<{
+        draft: "draft";
+        built: "built";
+    }>>;
+    deployed_at: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    secrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ActionResponse = z.infer<typeof actionResponseSchema>;

package/dist/types/types/Code.d.ts

@@ -7,11 +7,12 @@ export declare const codeTypeSchema: z.ZodEnum<{
     authorization_code: "authorization_code";
     oauth2_state: "oauth2_state";
     ticket: "ticket";
+    client_assertion_jti: "client_assertion_jti";
 }>;
 export type CodeType = z.infer<typeof codeTypeSchema>;
 export declare const codeInsertSchema: z.ZodObject<{
     code_id: z.ZodString;
-    login_id: z.ZodString;
+    login_id: z.ZodOptional<z.ZodString>;
     connection_id: z.ZodOptional<z.ZodString>;
     code_type: z.ZodEnum<{
         password_reset: "password_reset";
@@ -21,6 +22,7 @@ export declare const codeInsertSchema: z.ZodObject<{
         authorization_code: "authorization_code";
         oauth2_state: "oauth2_state";
         ticket: "ticket";
+        client_assertion_jti: "client_assertion_jti";
     }>;
     code_verifier: z.ZodOptional<z.ZodString>;
     code_challenge: z.ZodOptional<z.ZodString>;
@@ -39,7 +41,7 @@ export declare const codeInsertSchema: z.ZodObject<{
 export type CodeInsert = z.infer<typeof codeInsertSchema>;
 export declare const codeSchema: z.ZodObject<{
     code_id: z.ZodString;
-    login_id: z.ZodString;
+    login_id: z.ZodOptional<z.ZodString>;
     connection_id: z.ZodOptional<z.ZodString>;
     code_type: z.ZodEnum<{
         password_reset: "password_reset";
@@ -49,6 +51,7 @@ export declare const codeSchema: z.ZodObject<{
         authorization_code: "authorization_code";
         oauth2_state: "oauth2_state";
         ticket: "ticket";
+        client_assertion_jti: "client_assertion_jti";
     }>;
     code_verifier: z.ZodOptional<z.ZodString>;
     code_challenge: z.ZodOptional<z.ZodString>;

package/dist/types/utils/feature-not-supported.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Thrown by an adapter when a backend cannot implement a feature at all —
+ * as opposed to a transient failure or a bad request.
+ *
+ * Adapters are free to leave parts of the surface unimplemented (the AWS
+ * DynamoDB adapter has no Actions support, for example). Throwing this
+ * instead of a plain `Error` lets HTTP callers recognise the gap and map it
+ * to `501 Not Implemented` rather than a generic `500`.
+ */
+export declare class FeatureNotSupportedError extends Error {
+    /** The feature that is missing, e.g. `"actions"`. */
+    readonly feature: string;
+    /** The adapter that does not support it, e.g. `"aws-dynamodb"`. */
+    readonly adapter: string;
+    constructor(feature: string, adapter: string, 
+    /** Optional extra context appended to the message. */
+    details?: string);
+}
+/**
+ * Narrows an unknown thrown value to a {@link FeatureNotSupportedError}.
+ *
+ * Uses the `name` rather than `instanceof` so it keeps working across module
+ * instances (a bundled adapter and the host can carry separate copies of the
+ * class).
+ */
+export declare function isFeatureNotSupportedError(error: unknown): error is FeatureNotSupportedError;

package/dist/types/utils/http.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Response header stamped by the authhero control plane on its deliberate
+ * cross-host 302s — the `/authorize/resume` hop that sends the browser back
+ * to the host that served the original `/authorize` request so the session
+ * cookie lands on the right domain.
+ *
+ * Location-rewriting proxies (e.g. `@authhero/proxy`'s `rewrite_location`
+ * handler) must leave a marked Location untouched — rewriting it back onto
+ * the request host turns the hop into an infinite redirect loop — and strip
+ * the marker before the response reaches the browser.
+ */
+export declare const PRESERVE_LOCATION_HEADER = "x-authhero-preserve-location";

package/dist/types/utils/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./user-id";
+export * from "./http";
 export * from "./passthrough";
 export * from "./connection-attributes";
 export * from "./guards";
@@ -10,3 +11,4 @@ export * from "./cursor";
 export * from "./lucene";
 export * from "./session-retention";
 export * from "./username-validation";
+export * from "./feature-not-supported";

package/dist/types/utils/lucene.d.ts

@@ -1,7 +1,13 @@
 /**
  * Shared pieces of the Lucene-style `q` filter handling. The SQL generation
  * itself is ORM-specific and lives in each adapter; what is shared here is
- * the query-string sanitization that enforces the tenant boundary.
+ * the tokenizer (including the OR split) and the query-string sanitization
+ * that enforces the tenant boundary.
  */
+export declare function tokenizeLuceneQuery(query: string): string[];
+export declare function unescapeLuceneValue(value: string): string;
+export declare function escapeLuceneValue(value: string): string;
+export declare function unquoteLuceneValue(value: string): string;
+export declare function splitLuceneOrGroups(query: string): string[][];
 export declare function sanitizeLuceneQuery(query: string, allowedFields: string[]): string;
 export declare function isEmailSearchTerm(value: string): boolean;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "4.10.0",
+  "version": "4.12.0",
   "files": [
     "dist"
   ],