@authhero/adapter-interfaces 4.2.1 → 4.4.0

package/dist/types/adapters/ScimConfigurations.d.ts

@@ -0,0 +1,7 @@
+import { ScimConfiguration, ScimConfigurationInsert } from "../types/ScimConfiguration";
+export interface ScimConfigurationsAdapter {
+    create: (tenant_id: string, configuration: ScimConfigurationInsert) => Promise<ScimConfiguration>;
+    get: (tenant_id: string, connection_id: string) => Promise<ScimConfiguration | null>;
+    update: (tenant_id: string, connection_id: string, configuration: Partial<ScimConfigurationInsert>) => Promise<boolean>;
+    remove: (tenant_id: string, connection_id: string) => Promise<boolean>;
+}

package/dist/types/adapters/ScimExternalIds.d.ts

@@ -0,0 +1,7 @@
+import { ScimExternalId, ScimExternalIdInsert } from "../types/ScimExternalId";
+export interface ScimExternalIdsAdapter {
+    create: (tenant_id: string, externalId: ScimExternalIdInsert) => Promise<ScimExternalId>;
+    getByExternalId: (tenant_id: string, connection_id: string, external_id: string) => Promise<ScimExternalId | null>;
+    getByUserId: (tenant_id: string, connection_id: string, user_id: string) => Promise<ScimExternalId | null>;
+    remove: (tenant_id: string, connection_id: string, user_id: string) => Promise<boolean>;
+}

package/dist/types/adapters/ScimTokens.d.ts

@@ -0,0 +1,9 @@
+import { ScimToken, ScimTokenInsert } from "../types/ScimToken";
+export interface ScimTokensAdapter {
+    create: (tenant_id: string, token: ScimTokenInsert) => Promise<ScimToken>;
+    get: (tenant_id: string, token_id: string) => Promise<ScimToken | null>;
+    getByHash: (tenant_id: string, token_hash: string) => Promise<ScimToken | null>;
+    listByConnection: (tenant_id: string, connection_id: string) => Promise<ScimToken[]>;
+    markUsed: (tenant_id: string, token_id: string, last_used_at: string) => Promise<boolean>;
+    remove: (tenant_id: string, token_id: string) => Promise<boolean>;
+}

package/dist/types/adapters/UserRoles.d.ts

@@ -21,6 +21,19 @@ export interface ListRoleUsersResponse {
     next?: string;
 }
 export interface UserRolesAdapter {
+    /**
+     * List the roles assigned to a user, returned as a flat array.
+     *
+     * `organizationId` selects the scope and adapters MUST honor it exactly:
+     *   - `undefined` — roles across every organization scope (no filter)
+     *   - `""`        — global / tenant-level roles only
+     *   - `"<id>"`    — that organization's roles only
+     *
+     * The empty-string case is load-bearing: callers pass `""` to read a user's
+     * global roles (e.g. the org-membership `admin:organizations` bypass), so an
+     * adapter that treats `""` as "all scopes" leaks org-scoped roles into global
+     * lookups (see #1198).
+     */
     list(tenantId: string, userId: string, params?: ListParams, organizationId?: string): Promise<Role[]>;
     /**
      * List the distinct users assigned to a role, across all organization

package/dist/types/adapters/index.d.ts

@@ -25,6 +25,9 @@ import { ThemesAdapter } from "./Themes";
 import { LoginSessionsAdapter } from "./LoginSessions";
 import { PromptSettingsAdapter } from "./PromptSettings";
 import { ProxyRoutesAdapter } from "./ProxyRoutes";
+import { ScimConfigurationsAdapter } from "./ScimConfigurations";
+import { ScimTokensAdapter } from "./ScimTokens";
+import { ScimExternalIdsAdapter } from "./ScimExternalIds";
 import { EmailProvidersAdapter } from "./EmailProviders";
 import { EmailTemplatesAdapter } from "./EmailTemplates";
 import { RefreshTokensAdapter } from "./RefreshTokens";
@@ -102,6 +105,16 @@ export interface DataAdapters {
      * directly from the database or by calling this management API.
      */
     proxyRoutes?: ProxyRoutesAdapter;
+    /**
+     * Optional SCIM 2.0 inbound-provisioning adapters (issue #1191). When all
+     * three are set, AuthHero exposes the SCIM configuration management API and
+     * (Phase 2) the `/scim/v2` provisioning endpoints. `scimConfigurations`
+     * holds one config per connection, `scimTokens` the hashed bearer tokens,
+     * and `scimExternalIds` the IdP `externalId` → `user_id` lookup table.
+     */
+    scimConfigurations?: ScimConfigurationsAdapter;
+    scimTokens?: ScimTokensAdapter;
+    scimExternalIds?: ScimExternalIdsAdapter;
     refreshTokens: RefreshTokensAdapter;
     resourceServers: ResourceServersAdapter;
     rolePermissions: RolePermissionsAdapter;
@@ -260,6 +273,9 @@ export * from "./Logs";
 export * from "./Passwords";
 export * from "./PromptSettings";
 export * from "./ProxyRoutes";
+export * from "./ScimConfigurations";
+export * from "./ScimTokens";
+export * from "./ScimExternalIds";
 export * from "./ResourceServers";
 export * from "./Roles";
 export * from "./Sessions";

package/dist/types/types/AuditEvent.d.ts

@@ -41,6 +41,7 @@ export declare const requestContextSchema: z.ZodObject<{
     ip: z.ZodString;
     user_agent: z.ZodOptional<z.ZodString>;
     correlation_id: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type RequestContext = z.infer<typeof requestContextSchema>;
 export declare const responseContextSchema: z.ZodObject<{
@@ -105,6 +106,7 @@ export declare const auditEventInsertSchema: z.ZodObject<{
         ip: z.ZodString;
         user_agent: z.ZodOptional<z.ZodString>;
         correlation_id: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     response: z.ZodOptional<z.ZodObject<{
         status_code: z.ZodNumber;
@@ -179,6 +181,7 @@ export declare const auditEventSchema: z.ZodObject<{
         ip: z.ZodString;
         user_agent: z.ZodOptional<z.ZodString>;
         correlation_id: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     response: z.ZodOptional<z.ZodObject<{
         status_code: z.ZodNumber;

package/dist/types/types/Connection.d.ts

@@ -298,8 +298,8 @@ export declare const connectionInsertSchema: z.ZodObject<{
         }>>;
     }, z.core.$strip>>>;
     enabled_clients: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-    response_type: z.ZodOptional<z.ZodCustom<AuthorizationResponseType, AuthorizationResponseType>>;
-    response_mode: z.ZodOptional<z.ZodCustom<AuthorizationResponseMode, AuthorizationResponseMode>>;
+    response_type: z.ZodOptional<z.ZodEnum<typeof AuthorizationResponseType>>;
+    response_mode: z.ZodOptional<z.ZodEnum<typeof AuthorizationResponseMode>>;
     is_domain_connection: z.ZodOptional<z.ZodBoolean>;
     show_as_button: z.ZodOptional<z.ZodBoolean>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
@@ -460,8 +460,8 @@ export declare const connectionSchema: z.ZodObject<{
         }>>;
     }, z.core.$strip>>>;
     enabled_clients: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-    response_type: z.ZodOptional<z.ZodCustom<AuthorizationResponseType, AuthorizationResponseType>>;
-    response_mode: z.ZodOptional<z.ZodCustom<AuthorizationResponseMode, AuthorizationResponseMode>>;
+    response_type: z.ZodOptional<z.ZodEnum<typeof AuthorizationResponseType>>;
+    response_mode: z.ZodOptional<z.ZodEnum<typeof AuthorizationResponseMode>>;
     is_domain_connection: z.ZodOptional<z.ZodBoolean>;
     show_as_button: z.ZodOptional<z.ZodBoolean>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;

package/dist/types/types/Forms.d.ts

@@ -516,6 +516,8 @@ declare const socialField: z.ZodObject<{
             display_name: z.ZodOptional<z.ZodString>;
             icon_url: z.ZodOptional<z.ZodString>;
             href: z.ZodOptional<z.ZodString>;
+            last_used: z.ZodOptional<z.ZodBoolean>;
+            last_used_label: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -1151,6 +1153,8 @@ export declare const fieldComponentSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
             display_name: z.ZodOptional<z.ZodString>;
             icon_url: z.ZodOptional<z.ZodString>;
             href: z.ZodOptional<z.ZodString>;
+            last_used: z.ZodOptional<z.ZodBoolean>;
+            last_used_label: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -1750,6 +1754,8 @@ export declare const formNodeComponentDefinition: z.ZodUnion<readonly [z.ZodDisc
             display_name: z.ZodOptional<z.ZodString>;
             icon_url: z.ZodOptional<z.ZodString>;
             href: z.ZodOptional<z.ZodString>;
+            last_used: z.ZodOptional<z.ZodBoolean>;
+            last_used_label: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -2440,6 +2446,8 @@ declare const stepNodeSchema: z.ZodObject<{
                     display_name: z.ZodOptional<z.ZodString>;
                     icon_url: z.ZodOptional<z.ZodString>;
                     href: z.ZodOptional<z.ZodString>;
+                    last_used: z.ZodOptional<z.ZodBoolean>;
+                    last_used_label: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>>>;
             }, z.core.$strip>>;
         }, z.core.$strip>, z.ZodObject<{
@@ -3077,6 +3085,8 @@ export declare const formNodeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     display_name: z.ZodOptional<z.ZodString>;
                     icon_url: z.ZodOptional<z.ZodString>;
                     href: z.ZodOptional<z.ZodString>;
+                    last_used: z.ZodOptional<z.ZodBoolean>;
+                    last_used_label: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>>>;
             }, z.core.$strip>>;
         }, z.core.$strip>, z.ZodObject<{
@@ -3732,6 +3742,8 @@ export declare const formInsertSchema: z.ZodObject<{
                         display_name: z.ZodOptional<z.ZodString>;
                         icon_url: z.ZodOptional<z.ZodString>;
                         href: z.ZodOptional<z.ZodString>;
+                        last_used: z.ZodOptional<z.ZodBoolean>;
+                        last_used_label: z.ZodOptional<z.ZodString>;
                     }, z.core.$strip>>>;
                 }, z.core.$strip>>;
             }, z.core.$strip>, z.ZodObject<{
@@ -4419,6 +4431,8 @@ export declare const formSchema: z.ZodObject<{
                         display_name: z.ZodOptional<z.ZodString>;
                         icon_url: z.ZodOptional<z.ZodString>;
                         href: z.ZodOptional<z.ZodString>;
+                        last_used: z.ZodOptional<z.ZodBoolean>;
+                        last_used_label: z.ZodOptional<z.ZodString>;
                     }, z.core.$strip>>>;
                 }, z.core.$strip>>;
             }, z.core.$strip>, z.ZodObject<{
@@ -5097,6 +5111,8 @@ export declare const uiScreenSchema: z.ZodObject<{
                 display_name: z.ZodOptional<z.ZodString>;
                 icon_url: z.ZodOptional<z.ZodString>;
                 href: z.ZodOptional<z.ZodString>;
+                last_used: z.ZodOptional<z.ZodBoolean>;
+                last_used_label: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>>;
         }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodObject<{

package/dist/types/types/PromptSetting.d.ts

@@ -6,6 +6,7 @@ export declare const promptSettingSchema: z.ZodObject<{
     }>>;
     identifier_first: z.ZodDefault<z.ZodBoolean>;
     password_first: z.ZodDefault<z.ZodBoolean>;
+    show_last_used_connection: z.ZodDefault<z.ZodBoolean>;
     webauthn_platform_first_factor: z.ZodBoolean;
 }, z.core.$strip>;
 export type PromptSetting = z.infer<typeof promptSettingSchema>;

package/dist/types/types/ScimConfiguration.d.ts

@@ -0,0 +1,30 @@
+import { z } from "@hono/zod-openapi";
+/**
+ * One attribute-mapping entry translating a SCIM resource attribute to an
+ * AuthHero user field. Mirrors Auth0's SCIM `mapping` shape (`{ scim, auth0 }`).
+ */
+export declare const scimMappingEntrySchema: z.ZodObject<{
+    scim: z.ZodString;
+    auth0: z.ZodString;
+}, z.core.$strip>;
+export type ScimMappingEntry = z.infer<typeof scimMappingEntrySchema>;
+export declare const scimConfigurationInsertSchema: z.ZodObject<{
+    connection_id: z.ZodString;
+    user_id_attribute: z.ZodDefault<z.ZodString>;
+    mapping: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        scim: z.ZodString;
+        auth0: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ScimConfigurationInsert = z.infer<typeof scimConfigurationInsertSchema>;
+export declare const scimConfigurationSchema: z.ZodObject<{
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    connection_id: z.ZodString;
+    user_id_attribute: z.ZodDefault<z.ZodString>;
+    mapping: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        scim: z.ZodString;
+        auth0: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ScimConfiguration = z.infer<typeof scimConfigurationSchema>;

package/dist/types/types/ScimExternalId.d.ts

@@ -0,0 +1,21 @@
+import { z } from "@hono/zod-openapi";
+/**
+ * Maps an IdP-assigned SCIM `externalId` to an AuthHero `user_id`, scoped to a
+ * connection. Kept out of the shared user schema so the (per-connection) SCIM
+ * concern stays isolated and a linked user can carry external ids from more
+ * than one SCIM connection. IdPs look users up by `externalId eq "…"` before
+ * creating, so this must be queryable by (connection_id, external_id).
+ */
+export declare const scimExternalIdInsertSchema: z.ZodObject<{
+    connection_id: z.ZodString;
+    external_id: z.ZodString;
+    user_id: z.ZodString;
+}, z.core.$strip>;
+export type ScimExternalIdInsert = z.infer<typeof scimExternalIdInsertSchema>;
+export declare const scimExternalIdSchema: z.ZodObject<{
+    created_at: z.ZodString;
+    connection_id: z.ZodString;
+    external_id: z.ZodString;
+    user_id: z.ZodString;
+}, z.core.$strip>;
+export type ScimExternalId = z.infer<typeof scimExternalIdSchema>;

package/dist/types/types/ScimToken.d.ts

@@ -0,0 +1,19 @@
+import { z } from "@hono/zod-openapi";
+export declare const scimTokenInsertSchema: z.ZodObject<{
+    token_id: z.ZodString;
+    connection_id: z.ZodString;
+    token_hash: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    valid_until: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ScimTokenInsert = z.infer<typeof scimTokenInsertSchema>;
+export declare const scimTokenSchema: z.ZodObject<{
+    created_at: z.ZodString;
+    last_used_at: z.ZodOptional<z.ZodString>;
+    token_id: z.ZodString;
+    connection_id: z.ZodString;
+    token_hash: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    valid_until: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ScimToken = z.infer<typeof scimTokenSchema>;

package/dist/types/types/User.d.ts

@@ -79,6 +79,7 @@ export declare const userInsertSchema: z.ZodObject<{
     provider: z.ZodOptional<z.ZodString>;
     connection: z.ZodString;
     is_social: z.ZodOptional<z.ZodBoolean>;
+    blocked: z.ZodOptional<z.ZodBoolean>;
     registration_completed_at: z.ZodOptional<z.ZodString>;
     password: z.ZodOptional<z.ZodObject<{
         hash: z.ZodString;
@@ -120,6 +121,7 @@ export declare const userSchema: z.ZodObject<{
     verify_email: z.ZodOptional<z.ZodBoolean>;
     last_ip: z.ZodOptional<z.ZodString>;
     last_login: z.ZodOptional<z.ZodString>;
+    blocked: z.ZodOptional<z.ZodBoolean>;
     registration_completed_at: z.ZodOptional<z.ZodString>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
@@ -194,6 +196,7 @@ export declare const auth0UserResponseSchema: z.ZodObject<{
     last_ip: z.ZodOptional<z.ZodString>;
     last_login: z.ZodOptional<z.ZodString>;
     is_social: z.ZodBoolean;
+    blocked: z.ZodOptional<z.ZodBoolean>;
     login_count: z.ZodDefault<z.ZodNumber>;
     identities: z.ZodOptional<z.ZodArray<z.ZodObject<{
         connection: z.ZodString;

package/dist/types/types/auth0/UserResponse.d.ts

@@ -6,6 +6,7 @@ export interface PostUsersBody extends BaseUser {
     username?: string;
     connection?: string;
     email_verified?: boolean;
+    blocked?: boolean;
 }
 export declare const userResponseSchema: z.ZodObject<{
     email: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;

package/dist/types/types/codeHookApiShapes.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The per-trigger allowlist of namespaced API methods exposed to user-authored
+ * code hooks. Each entry maps a trigger id to `{ namespace: [method, ...] }`.
+ *
+ * Code hooks run in an isolate with a **recording** `api` proxy: user code calls
+ * `api.<namespace>.<method>(...)`, the call is captured as
+ * `{ method: "<namespace>.<method>", args }`, and the host replays it against
+ * the real API objects after the isolate returns. This shape is what the proxy
+ * is built from, so it is the single source of truth for *which* verbs a trigger
+ * exposes.
+ *
+ * It lives here (not in an executor) because both executors need an identical
+ * copy: the local `LocalCodeExecutor` builds the proxy in-process, and the
+ * Cloudflare `WorkerLoaderCodeExecutor` serializes this object into the
+ * generated worker script. Duplicating it risked the two drifting; importing
+ * this const keeps them byte-identical by construction.
+ */
+export declare const TRIGGER_API_SHAPES: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>>;
+/**
+ * A single candidate primary the built-in email-based linking policy would
+ * consider, pre-resolved into a `post-user-login` code-hook event as
+ * `event.link_candidates`. Code hooks have no return channel and no data
+ * adapter, so link targets must be pushed *into* the event rather than looked
+ * up from user code. The shape is intentionally minimal and JSON-serializable.
+ */
+export interface LinkCandidate {
+    user_id: string;
+    email: string;
+    email_verified: boolean;
+    provider: string;
+    connection: string;
+    created_at: string;
+    /** No `linked_to` set — this user is itself a primary. */
+    is_primary: boolean;
+    /** The candidate the built-in "oldest account wins" policy would pick. */
+    is_oldest: boolean;
+}

package/dist/types/types/index.d.ts

@@ -37,6 +37,9 @@ export * from "./User";
 export * from "./Theme";
 export * from "./PromptSetting";
 export * from "./ProxyRoute";
+export * from "./ScimConfiguration";
+export * from "./ScimToken";
+export * from "./ScimExternalId";
 export * from "./EmailProvider";
 export * from "./EmailTemplate";
 export * from "./RefreshTokens";
@@ -58,3 +61,4 @@ export * from "./CustomText";
 export * from "./Strategy";
 export * from "./AuthenticationMethod";
 export * from "./ImportMetadata";
+export * from "./codeHookApiShapes";

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "4.2.1",
+  "version": "4.4.0",
   "files": [
     "dist"
   ],
@@ -44,6 +44,7 @@
   "dependencies": {
     "nanoid": "^5.1.11"
   },
+  "license": "MIT",
   "scripts": {
     "build": "vite build && tsc -p tsconfig.types.json && rollup -c rollup.dts.config.mjs"
   }