@faable/auth-sdk 2.5.55 → 2.5.57

package/dist/api/types.d.ts

@@ -1320,6 +1320,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/oauth/link_ticket": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a link ticket
+         * @description Trades the Bearer access token of a signed-in user for a single-use, short-lived ticket that lets `/authorize?link=true` establish the cookie session it links the new identity to. For Relying Parties that authenticated the user with a direct grant (e.g. passwordless OTP) and therefore hold no cookie session. Subject to the client’s `web_origins` allowlist like `/oauth/token`.
+         */
+        post: operations["oauth/link_ticket"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/oauth/token": {
         parameters: {
             query?: never;
@@ -9136,6 +9156,8 @@ export interface operations {
                 redirect_to?: string;
                 /** @description Link mode: attach the resulting provider identity to the ACTIVE session user instead of signing in or up. Requires a session; incompatible with prompt=login/consent. */
                 link?: boolean;
+                /** @description Single-use ticket from `POST /oauth/link_ticket`. With `link=true`, establishes the cookie session for the ticket’s user before linking — for Relying Parties that hold tokens but no cookie session (direct grants such as passwordless OTP). Invalid or expired tickets are ignored. */
+                link_ticket?: string;
                 client_id: string;
                 /** @description Deprecated. Use connection_id */
                 connection?: string;
@@ -9171,6 +9193,31 @@ export interface operations {
             };
         };
     };
+    "oauth/link_ticket": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Opaque single-use ticket. Pass it as `link_ticket` on `/authorize?link=true` within `expires_in` seconds. */
+                        link_ticket: string;
+                        /** @description Ticket lifetime in seconds. */
+                        expires_in: number;
+                    };
+                };
+            };
+        };
+    };
     "oauth/tokenGet": {
         parameters: {
             query?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.5.55",
+  "version": "2.5.57",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "1.51.0",
+    "version": "1.53.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -18871,6 +18871,15 @@
             "required": false,
             "description": "Link mode: attach the resulting provider identity to the ACTIVE session user instead of signing in or up. Requires a session; incompatible with prompt=login/consent."
           },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "link_ticket",
+            "required": false,
+            "description": "Single-use ticket from `POST /oauth/link_ticket`. With `link=true`, establishes the cookie session for the ticket’s user before linking — for Relying Parties that hold tokens but no cookie session (direct grants such as passwordless OTP). Invalid or expired tickets are ignored."
+          },
           {
             "schema": {
               "type": "string"
@@ -18976,6 +18985,42 @@
         }
       }
     },
+    "/oauth/link_ticket": {
+      "post": {
+        "operationId": "oauth/link_ticket",
+        "summary": "Mint a link ticket",
+        "tags": [
+          "oauth"
+        ],
+        "description": "Trades the Bearer access token of a signed-in user for a single-use, short-lived ticket that lets `/authorize?link=true` establish the cookie session it links the new identity to. For Relying Parties that authenticated the user with a direct grant (e.g. passwordless OTP) and therefore hold no cookie session. Subject to the client’s `web_origins` allowlist like `/oauth/token`.",
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "link_ticket",
+                    "expires_in"
+                  ],
+                  "properties": {
+                    "link_ticket": {
+                      "type": "string",
+                      "description": "Opaque single-use ticket. Pass it as `link_ticket` on `/authorize?link=true` within `expires_in` seconds."
+                    },
+                    "expires_in": {
+                      "type": "number",
+                      "description": "Ticket lifetime in seconds."
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/oauth/token": {
       "get": {
         "operationId": "oauth/tokenGet",