@authhero/adapter-interfaces 4.8.0 → 4.9.0

package/dist/types/adapters/RefreshTokens.d.ts

@@ -1,4 +1,18 @@
 import { RefreshToken, RefreshTokenInsert, Totals, ListParams } from "../types";
+/**
+ * List params for refresh tokens, with `user_id` as a first-class exact
+ * predicate.
+ *
+ * Selecting a user through the `q` Lucene grammar is not safe here: both SQL
+ * adapters split `q` on ` OR ` *before* tokenizing, so a user id containing
+ * ` OR user_id:<other> OR ` yields a clean middle clause that matches another
+ * user's rows — quoting the value does not prevent it, because the quotes only
+ * bracket the first and last fragments. This field compiles to an equality
+ * comparison instead, so the id is never parsed as query syntax.
+ */
+export interface RefreshTokenListParams extends ListParams {
+    user_id?: string;
+}
 export interface ListRefreshTokenResponse extends Totals {
     refresh_tokens: RefreshToken[];
 }
@@ -23,9 +37,21 @@ export interface RefreshTokensAdapter {
      * matches. Callers must verify the secret hash before trusting the row.
      */
     getByLookup: (tenant_id: string, token_lookup: string) => Promise<RefreshToken | null>;
-    list(tenant_id: string, params?: ListParams): Promise<ListRefreshTokenResponse>;
+    list(tenant_id: string, params?: RefreshTokenListParams): Promise<ListRefreshTokenResponse>;
     update: (tenant_id: string, id: string, refresh_token: Partial<RefreshToken>, options?: UpdateRefreshTokenOptions) => Promise<boolean>;
     remove: (tenant_id: string, id: string) => Promise<boolean>;
+    /**
+     * Soft-revoke every refresh token belonging to a user that isn't already
+     * revoked. Exact tenant + user predicates, so nothing goes through the `q`
+     * grammar.
+     *
+     * The `revoked_at IS NULL` guard also makes this safe to run concurrently:
+     * a second bulk revocation cannot overwrite the audit timestamp written by
+     * the first.
+     *
+     * Returns the number of tokens revoked.
+     */
+    revokeByUser: (tenant_id: string, user_id: string, revoked_at: string) => Promise<number>;
     revokeByLoginSession: (tenant_id: string, login_session_id: string, revoked_at: string) => Promise<number>;
     /**
      * Soft-revoke every refresh token that shares `family_id` and isn't already

package/dist/types/types/RefreshTokens.d.ts

@@ -2,6 +2,13 @@ import { z } from "@hono/zod-openapi";
 export declare const refreshTokenInsertSchema: z.ZodObject<{
     id: z.ZodString;
     login_id: z.ZodString;
+    session_id: z.ZodOptional<z.ZodString>;
+    organization: z.ZodOptional<z.ZodString>;
+    auth_connection: z.ZodOptional<z.ZodString>;
+    auth_strategy: z.ZodOptional<z.ZodObject<{
+        strategy: z.ZodString;
+        strategy_type: z.ZodString;
+    }, z.core.$strip>>;
     user_id: z.ZodString;
     client_id: z.ZodString;
     expires_at: z.ZodOptional<z.ZodString>;
@@ -30,6 +37,13 @@ export type RefreshTokenInsert = z.infer<typeof refreshTokenInsertSchema>;
 export declare const refreshTokenSchema: z.ZodObject<{
     id: z.ZodString;
     login_id: z.ZodString;
+    session_id: z.ZodOptional<z.ZodString>;
+    organization: z.ZodOptional<z.ZodString>;
+    auth_connection: z.ZodOptional<z.ZodString>;
+    auth_strategy: z.ZodOptional<z.ZodObject<{
+        strategy: z.ZodString;
+        strategy_type: z.ZodString;
+    }, z.core.$strip>>;
     user_id: z.ZodString;
     client_id: z.ZodString;
     expires_at: z.ZodOptional<z.ZodString>;

package/dist/types/utils/index.d.ts

@@ -9,3 +9,4 @@ export * from "./hex";
 export * from "./cursor";
 export * from "./lucene";
 export * from "./session-retention";
+export * from "./username-validation";

package/dist/types/utils/lucene.d.ts

@@ -4,3 +4,4 @@
  * the query-string sanitization that enforces the tenant boundary.
  */
 export declare function sanitizeLuceneQuery(query: string, allowedFields: string[]): string;
+export declare function isEmailSearchTerm(value: string): boolean;

package/dist/types/utils/user-id.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Split an Auth0-style `provider|id` identifier into its provider (here named
+ * `connection` for historical reasons) and the bare id Auth0 reports as
+ * `identities[].user_id`.
+ *
+ * Splits on the *first* pipe only. Enterprise identifiers embed pipes of their
+ * own — `samlp|okta-connection|jane` is provider `samlp` plus bare id
+ * `okta-connection|jane` — and returning just `okta-connection` would report an
+ * id that resolves to no user and that cannot be unlinked.
+ */
 export declare function parseUserId(user_id: string): {
     connection: string;
     id: string;

package/dist/types/utils/username-validation.d.ts

@@ -0,0 +1,21 @@
+/** Mirrors Auth0's own wording, minus the "@" it allows and we don't. */
+export declare const USERNAME_INVALID_CHARACTERS_MESSAGE = "Username can only contain alphanumeric characters and the following characters: '_', '+', '-', '.', '!', '#', '$', \"'\", '^', '`', '~'";
+export declare const USERNAME_CONTAINS_AT_MESSAGE = "Usernames must not contain \"@\". Use the email field for email addresses.";
+export declare function usernameHasOnlyAllowedCharacters(username: string): boolean;
+/**
+ * Auth0 lowercases usernames on write, so `MyUser` and `myuser` are the same
+ * account. Applied at the write boundary only — never to values read back out
+ * of the database, which may predate this rule.
+ */
+export declare function normalizeUsername(username: string): string;
+export interface UsernameLengthBounds {
+    min: number;
+    max: number;
+}
+/**
+ * Returns an Auth0-shaped error message, or `null` when the username is valid.
+ * `bounds` comes from the connection's own configuration via
+ * `getConnectionIdentifierConfig`; omit it to skip the length check (the
+ * caller has no connection in hand).
+ */
+export declare function validateUsername(username: string, bounds?: UsernameLengthBounds): string | null;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "4.8.0",
+  "version": "4.9.0",
   "files": [
     "dist"
   ],