@authhero/adapter-interfaces 4.2.1 → 4.3.0

package/dist/types/adapters/UserRoles.d.ts

@@ -21,6 +21,19 @@ export interface ListRoleUsersResponse {
     next?: string;
 }
 export interface UserRolesAdapter {
+    /**
+     * List the roles assigned to a user, returned as a flat array.
+     *
+     * `organizationId` selects the scope and adapters MUST honor it exactly:
+     *   - `undefined` — roles across every organization scope (no filter)
+     *   - `""`        — global / tenant-level roles only
+     *   - `"<id>"`    — that organization's roles only
+     *
+     * The empty-string case is load-bearing: callers pass `""` to read a user's
+     * global roles (e.g. the org-membership `admin:organizations` bypass), so an
+     * adapter that treats `""` as "all scopes" leaks org-scoped roles into global
+     * lookups (see #1198).
+     */
     list(tenantId: string, userId: string, params?: ListParams, organizationId?: string): Promise<Role[]>;
     /**
      * List the distinct users assigned to a role, across all organization

package/dist/types/types/AuditEvent.d.ts

@@ -41,6 +41,7 @@ export declare const requestContextSchema: z.ZodObject<{
     ip: z.ZodString;
     user_agent: z.ZodOptional<z.ZodString>;
     correlation_id: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type RequestContext = z.infer<typeof requestContextSchema>;
 export declare const responseContextSchema: z.ZodObject<{
@@ -105,6 +106,7 @@ export declare const auditEventInsertSchema: z.ZodObject<{
         ip: z.ZodString;
         user_agent: z.ZodOptional<z.ZodString>;
         correlation_id: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     response: z.ZodOptional<z.ZodObject<{
         status_code: z.ZodNumber;
@@ -179,6 +181,7 @@ export declare const auditEventSchema: z.ZodObject<{
         ip: z.ZodString;
         user_agent: z.ZodOptional<z.ZodString>;
         correlation_id: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     response: z.ZodOptional<z.ZodObject<{
         status_code: z.ZodNumber;

package/dist/types/types/codeHookApiShapes.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The per-trigger allowlist of namespaced API methods exposed to user-authored
+ * code hooks. Each entry maps a trigger id to `{ namespace: [method, ...] }`.
+ *
+ * Code hooks run in an isolate with a **recording** `api` proxy: user code calls
+ * `api.<namespace>.<method>(...)`, the call is captured as
+ * `{ method: "<namespace>.<method>", args }`, and the host replays it against
+ * the real API objects after the isolate returns. This shape is what the proxy
+ * is built from, so it is the single source of truth for *which* verbs a trigger
+ * exposes.
+ *
+ * It lives here (not in an executor) because both executors need an identical
+ * copy: the local `LocalCodeExecutor` builds the proxy in-process, and the
+ * Cloudflare `WorkerLoaderCodeExecutor` serializes this object into the
+ * generated worker script. Duplicating it risked the two drifting; importing
+ * this const keeps them byte-identical by construction.
+ */
+export declare const TRIGGER_API_SHAPES: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>>;
+/**
+ * A single candidate primary the built-in email-based linking policy would
+ * consider, pre-resolved into a `post-user-login` code-hook event as
+ * `event.link_candidates`. Code hooks have no return channel and no data
+ * adapter, so link targets must be pushed *into* the event rather than looked
+ * up from user code. The shape is intentionally minimal and JSON-serializable.
+ */
+export interface LinkCandidate {
+    user_id: string;
+    email: string;
+    email_verified: boolean;
+    provider: string;
+    connection: string;
+    created_at: string;
+    /** No `linked_to` set — this user is itself a primary. */
+    is_primary: boolean;
+    /** The candidate the built-in "oldest account wins" policy would pick. */
+    is_oldest: boolean;
+}

package/dist/types/types/index.d.ts

@@ -58,3 +58,4 @@ export * from "./CustomText";
 export * from "./Strategy";
 export * from "./AuthenticationMethod";
 export * from "./ImportMetadata";
+export * from "./codeHookApiShapes";

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "4.2.1",
+  "version": "4.3.0",
   "files": [
     "dist"
   ],
@@ -44,6 +44,7 @@
   "dependencies": {
     "nanoid": "^5.1.11"
   },
+  "license": "MIT",
   "scripts": {
     "build": "vite build && tsc -p tsconfig.types.json && rollup -c rollup.dts.config.mjs"
   }