@faable/auth-sdk 2.5.72 → 2.5.74

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/FaableAuthApi.d.ts +5 -0
  2. package/dist/api/generated-client.d.ts +15 -0
  3. package/dist/api/types.d.ts +81 -0
  4. package/package.json +1 -1
  5. package/spec/openapi.json +162 -1
package/dist/FaableAuthApi.d.ts CHANGED
@@ -49,6 +49,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
49
49
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
50
50
  login_methods?: {
51
51
  order?: string[] | undefined;
52
+ disabled_connections?: string[] | undefined;
52
53
  passkey_login_enabled?: boolean | undefined;
53
54
  identifier_first?: boolean | undefined;
54
55
  remember_last_method?: boolean | undefined;
@@ -727,6 +728,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
727
728
  frontchannel_logout_session_required?: boolean | undefined;
728
729
  login_methods?: {
729
730
  order?: string[] | undefined;
731
+ disabled_connections?: string[] | undefined;
730
732
  passkey_login_enabled?: boolean | undefined;
731
733
  identifier_first?: boolean | undefined;
732
734
  remember_last_method?: boolean | undefined;
@@ -775,6 +777,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
775
777
  frontchannel_logout_session_required?: boolean | undefined;
776
778
  login_methods?: {
777
779
  order?: string[] | undefined;
780
+ disabled_connections?: string[] | undefined;
778
781
  passkey_login_enabled?: boolean | undefined;
779
782
  identifier_first?: boolean | undefined;
780
783
  remember_last_method?: boolean | undefined;
@@ -826,6 +829,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
826
829
  frontchannel_logout_session_required?: boolean | undefined;
827
830
  login_methods?: {
828
831
  order?: string[] | undefined;
832
+ disabled_connections?: string[] | undefined;
829
833
  passkey_login_enabled?: boolean | undefined;
830
834
  identifier_first?: boolean | undefined;
831
835
  remember_last_method?: boolean | undefined;
@@ -876,6 +880,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
876
880
  frontchannel_logout_session_required?: boolean | undefined;
877
881
  login_methods?: {
878
882
  order?: string[] | undefined;
883
+ disabled_connections?: string[] | undefined;
879
884
  passkey_login_enabled?: boolean | undefined;
880
885
  identifier_first?: boolean | undefined;
881
886
  remember_last_method?: boolean | undefined;
package/dist/api/generated-client.d.ts CHANGED
@@ -45,6 +45,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
45
45
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
46
46
  login_methods?: {
47
47
  order?: string[] | undefined;
48
+ disabled_connections?: string[] | undefined;
48
49
  passkey_login_enabled?: boolean | undefined;
49
50
  identifier_first?: boolean | undefined;
50
51
  remember_last_method?: boolean | undefined;
@@ -85,6 +86,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
85
86
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
86
87
  login_methods?: {
87
88
  order?: string[] | undefined;
89
+ disabled_connections?: string[] | undefined;
88
90
  passkey_login_enabled?: boolean | undefined;
89
91
  identifier_first?: boolean | undefined;
90
92
  remember_last_method?: boolean | undefined;
@@ -131,6 +133,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
131
133
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
132
134
  login_methods?: {
133
135
  order?: string[] | undefined;
136
+ disabled_connections?: string[] | undefined;
134
137
  passkey_login_enabled?: boolean | undefined;
135
138
  identifier_first?: boolean | undefined;
136
139
  remember_last_method?: boolean | undefined;
@@ -182,6 +185,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
182
185
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
183
186
  login_methods?: {
184
187
  order?: string[] | undefined;
188
+ disabled_connections?: string[] | undefined;
185
189
  passkey_login_enabled?: boolean | undefined;
186
190
  identifier_first?: boolean | undefined;
187
191
  remember_last_method?: boolean | undefined;
@@ -217,6 +221,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
217
221
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
218
222
  login_methods?: {
219
223
  order?: string[] | undefined;
224
+ disabled_connections?: string[] | undefined;
220
225
  passkey_login_enabled?: boolean | undefined;
221
226
  identifier_first?: boolean | undefined;
222
227
  remember_last_method?: boolean | undefined;
@@ -255,6 +260,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
255
260
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
256
261
  login_methods?: {
257
262
  order?: string[] | undefined;
263
+ disabled_connections?: string[] | undefined;
258
264
  passkey_login_enabled?: boolean | undefined;
259
265
  identifier_first?: boolean | undefined;
260
266
  remember_last_method?: boolean | undefined;
@@ -308,6 +314,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
308
314
  email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
309
315
  login_methods?: {
310
316
  order?: string[] | undefined;
317
+ disabled_connections?: string[] | undefined;
311
318
  passkey_login_enabled?: boolean | undefined;
312
319
  identifier_first?: boolean | undefined;
313
320
  remember_last_method?: boolean | undefined;
@@ -712,6 +719,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
712
719
  frontchannel_logout_session_required?: boolean | undefined;
713
720
  login_methods?: {
714
721
  order?: string[] | undefined;
722
+ disabled_connections?: string[] | undefined;
715
723
  passkey_login_enabled?: boolean | undefined;
716
724
  identifier_first?: boolean | undefined;
717
725
  remember_last_method?: boolean | undefined;
@@ -765,6 +773,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
765
773
  frontchannel_logout_session_required?: boolean | undefined;
766
774
  login_methods?: {
767
775
  order?: string[] | undefined;
776
+ disabled_connections?: string[] | undefined;
768
777
  passkey_login_enabled?: boolean | undefined;
769
778
  identifier_first?: boolean | undefined;
770
779
  remember_last_method?: boolean | undefined;
@@ -818,6 +827,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
818
827
  frontchannel_logout_session_required?: boolean | undefined;
819
828
  login_methods?: {
820
829
  order?: string[] | undefined;
830
+ disabled_connections?: string[] | undefined;
821
831
  passkey_login_enabled?: boolean | undefined;
822
832
  identifier_first?: boolean | undefined;
823
833
  remember_last_method?: boolean | undefined;
@@ -872,6 +882,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
872
882
  frontchannel_logout_session_required?: boolean | undefined;
873
883
  login_methods?: {
874
884
  order?: string[] | undefined;
885
+ disabled_connections?: string[] | undefined;
875
886
  passkey_login_enabled?: boolean | undefined;
876
887
  identifier_first?: boolean | undefined;
877
888
  remember_last_method?: boolean | undefined;
@@ -920,6 +931,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
920
931
  frontchannel_logout_session_required?: boolean | undefined;
921
932
  login_methods?: {
922
933
  order?: string[] | undefined;
934
+ disabled_connections?: string[] | undefined;
923
935
  passkey_login_enabled?: boolean | undefined;
924
936
  identifier_first?: boolean | undefined;
925
937
  remember_last_method?: boolean | undefined;
@@ -971,6 +983,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
971
983
  frontchannel_logout_session_required?: boolean | undefined;
972
984
  login_methods?: {
973
985
  order?: string[] | undefined;
986
+ disabled_connections?: string[] | undefined;
974
987
  passkey_login_enabled?: boolean | undefined;
975
988
  identifier_first?: boolean | undefined;
976
989
  remember_last_method?: boolean | undefined;
@@ -1025,6 +1038,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
1025
1038
  frontchannel_logout_session_required?: boolean | undefined;
1026
1039
  login_methods?: {
1027
1040
  order?: string[] | undefined;
1041
+ disabled_connections?: string[] | undefined;
1028
1042
  passkey_login_enabled?: boolean | undefined;
1029
1043
  identifier_first?: boolean | undefined;
1030
1044
  remember_last_method?: boolean | undefined;
@@ -1078,6 +1092,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
1078
1092
  frontchannel_logout_session_required?: boolean | undefined;
1079
1093
  login_methods?: {
1080
1094
  order?: string[] | undefined;
1095
+ disabled_connections?: string[] | undefined;
1081
1096
  passkey_login_enabled?: boolean | undefined;
1082
1097
  identifier_first?: boolean | undefined;
1083
1098
  remember_last_method?: boolean | undefined;
package/dist/api/types.d.ts CHANGED
@@ -1889,6 +1889,55 @@ export interface paths {
1889
1889
  patch?: never;
1890
1890
  trace?: never;
1891
1891
  };
1892
+ "/mfa/step-up": {
1893
+ parameters: {
1894
+ query?: never;
1895
+ header?: never;
1896
+ path?: never;
1897
+ cookie?: never;
1898
+ };
1899
+ get?: never;
1900
+ put?: never;
1901
+ /**
1902
+ * Start a step-up challenge for the current session
1903
+ * @description Parks a challenge for the signed-in user and returns where to send the browser. Answering it seals the session at AAL2 and returns to `redirect_to`. Answers `already_satisfied` when the session is AAL2 already.
1904
+ */
1905
+ post: {
1906
+ parameters: {
1907
+ query?: never;
1908
+ header?: never;
1909
+ path?: never;
1910
+ cookie?: never;
1911
+ };
1912
+ requestBody: {
1913
+ content: {
1914
+ "application/json": {
1915
+ /** @description Same-origin path to return to once the factor is proven. Off-origin values are dropped. */
1916
+ redirect_to?: string;
1917
+ };
1918
+ };
1919
+ };
1920
+ responses: {
1921
+ /** @description Default Response */
1922
+ 200: {
1923
+ headers: {
1924
+ [name: string]: unknown;
1925
+ };
1926
+ content: {
1927
+ "application/json": {
1928
+ redirect_url: string;
1929
+ already_satisfied: boolean;
1930
+ };
1931
+ };
1932
+ };
1933
+ };
1934
+ };
1935
+ delete?: never;
1936
+ options?: never;
1937
+ head?: never;
1938
+ patch?: never;
1939
+ trace?: never;
1940
+ };
1892
1941
  "/me": {
1893
1942
  parameters: {
1894
1943
  query?: never;
@@ -2385,6 +2434,8 @@ export interface components {
2385
2434
  login_methods?: {
2386
2435
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
2387
2436
  order?: string[];
2437
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
2438
+ disabled_connections?: string[];
2388
2439
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
2389
2440
  passkey_login_enabled?: boolean;
2390
2441
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -2663,6 +2714,8 @@ export interface components {
2663
2714
  login_methods?: {
2664
2715
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
2665
2716
  order?: string[];
2717
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
2718
+ disabled_connections?: string[];
2666
2719
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
2667
2720
  passkey_login_enabled?: boolean;
2668
2721
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -2754,6 +2807,8 @@ export interface components {
2754
2807
  login_methods?: {
2755
2808
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
2756
2809
  order?: string[];
2810
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
2811
+ disabled_connections?: string[];
2757
2812
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
2758
2813
  passkey_login_enabled?: boolean;
2759
2814
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4026,6 +4081,8 @@ export interface components {
4026
4081
  login_methods?: {
4027
4082
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4028
4083
  order?: string[];
4084
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4085
+ disabled_connections?: string[];
4029
4086
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4030
4087
  passkey_login_enabled?: boolean;
4031
4088
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4184,6 +4241,8 @@ export interface operations {
4184
4241
  login_methods?: {
4185
4242
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4186
4243
  order?: string[];
4244
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4245
+ disabled_connections?: string[];
4187
4246
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4188
4247
  passkey_login_enabled?: boolean;
4189
4248
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4320,6 +4379,8 @@ export interface operations {
4320
4379
  login_methods?: {
4321
4380
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4322
4381
  order?: string[];
4382
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4383
+ disabled_connections?: string[];
4323
4384
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4324
4385
  passkey_login_enabled?: boolean;
4325
4386
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4410,6 +4471,8 @@ export interface operations {
4410
4471
  login_methods?: {
4411
4472
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4412
4473
  order?: string[];
4474
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4475
+ disabled_connections?: string[];
4413
4476
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4414
4477
  passkey_login_enabled?: boolean;
4415
4478
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4472,6 +4535,8 @@ export interface operations {
4472
4535
  login_methods?: {
4473
4536
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4474
4537
  order?: string[];
4538
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4539
+ disabled_connections?: string[];
4475
4540
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4476
4541
  passkey_login_enabled?: boolean;
4477
4542
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4541,6 +4606,8 @@ export interface operations {
4541
4606
  login_methods?: {
4542
4607
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4543
4608
  order?: string[];
4609
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4610
+ disabled_connections?: string[];
4544
4611
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4545
4612
  passkey_login_enabled?: boolean;
4546
4613
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4640,6 +4707,8 @@ export interface operations {
4640
4707
  login_methods?: {
4641
4708
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
4642
4709
  order?: string[];
4710
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
4711
+ disabled_connections?: string[];
4643
4712
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
4644
4713
  passkey_login_enabled?: boolean;
4645
4714
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5299,6 +5368,8 @@ export interface operations {
5299
5368
  login_methods?: {
5300
5369
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
5301
5370
  order?: string[];
5371
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
5372
+ disabled_connections?: string[];
5302
5373
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
5303
5374
  passkey_login_enabled?: boolean;
5304
5375
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5388,6 +5459,8 @@ export interface operations {
5388
5459
  login_methods?: {
5389
5460
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
5390
5461
  order?: string[];
5462
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
5463
+ disabled_connections?: string[];
5391
5464
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
5392
5465
  passkey_login_enabled?: boolean;
5393
5466
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5471,6 +5544,8 @@ export interface operations {
5471
5544
  login_methods?: {
5472
5545
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
5473
5546
  order?: string[];
5547
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
5548
+ disabled_connections?: string[];
5474
5549
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
5475
5550
  passkey_login_enabled?: boolean;
5476
5551
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5541,6 +5616,8 @@ export interface operations {
5541
5616
  login_methods?: {
5542
5617
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
5543
5618
  order?: string[];
5619
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
5620
+ disabled_connections?: string[];
5544
5621
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
5545
5622
  passkey_login_enabled?: boolean;
5546
5623
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5630,6 +5707,8 @@ export interface operations {
5630
5707
  login_methods?: {
5631
5708
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
5632
5709
  order?: string[];
5710
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
5711
+ disabled_connections?: string[];
5633
5712
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
5634
5713
  passkey_login_enabled?: boolean;
5635
5714
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5719,6 +5798,8 @@ export interface operations {
5719
5798
  login_methods?: {
5720
5799
  /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
5721
5800
  order?: string[];
5801
+ /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
5802
+ disabled_connections?: string[];
5722
5803
  /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
5723
5804
  passkey_login_enabled?: boolean;
5724
5805
  /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@faable/auth-sdk",
3
- "version": "2.5.72",
3
+ "version": "2.5.74",
4
4
  "author": "Marc Pomar <marc@faable.com>",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
package/spec/openapi.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "info": {
4
4
  "title": "@faablecloud/auth",
5
5
  "description": "Auth Platform made by Faable. Manage Users and Roles",
6
- "version": "2.2.2",
6
+ "version": "2.3.0",
7
7
  "license": {
8
8
  "name": "private",
9
9
  "url": "https://faable.com/docs/platform/privacy-policy"
@@ -185,6 +185,13 @@
185
185
  },
186
186
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
187
187
  },
188
+ "disabled_connections": {
189
+ "type": "array",
190
+ "items": {
191
+ "type": "string"
192
+ },
193
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
194
+ },
188
195
  "passkey_login_enabled": {
189
196
  "type": "boolean",
190
197
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -1179,6 +1186,13 @@
1179
1186
  },
1180
1187
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
1181
1188
  },
1189
+ "disabled_connections": {
1190
+ "type": "array",
1191
+ "items": {
1192
+ "type": "string"
1193
+ },
1194
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
1195
+ },
1182
1196
  "passkey_login_enabled": {
1183
1197
  "type": "boolean",
1184
1198
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -1461,6 +1475,13 @@
1461
1475
  },
1462
1476
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
1463
1477
  },
1478
+ "disabled_connections": {
1479
+ "type": "array",
1480
+ "items": {
1481
+ "type": "string"
1482
+ },
1483
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
1484
+ },
1464
1485
  "passkey_login_enabled": {
1465
1486
  "type": "boolean",
1466
1487
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -4611,6 +4632,13 @@
4611
4632
  },
4612
4633
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
4613
4634
  },
4635
+ "disabled_connections": {
4636
+ "type": "array",
4637
+ "items": {
4638
+ "type": "string"
4639
+ },
4640
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
4641
+ },
4614
4642
  "passkey_login_enabled": {
4615
4643
  "type": "boolean",
4616
4644
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -5191,6 +5219,13 @@
5191
5219
  },
5192
5220
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
5193
5221
  },
5222
+ "disabled_connections": {
5223
+ "type": "array",
5224
+ "items": {
5225
+ "type": "string"
5226
+ },
5227
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
5228
+ },
5194
5229
  "passkey_login_enabled": {
5195
5230
  "type": "boolean",
5196
5231
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -5512,6 +5547,13 @@
5512
5547
  },
5513
5548
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
5514
5549
  },
5550
+ "disabled_connections": {
5551
+ "type": "array",
5552
+ "items": {
5553
+ "type": "string"
5554
+ },
5555
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
5556
+ },
5515
5557
  "passkey_login_enabled": {
5516
5558
  "type": "boolean",
5517
5559
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -5887,6 +5929,13 @@
5887
5929
  },
5888
5930
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
5889
5931
  },
5932
+ "disabled_connections": {
5933
+ "type": "array",
5934
+ "items": {
5935
+ "type": "string"
5936
+ },
5937
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
5938
+ },
5890
5939
  "passkey_login_enabled": {
5891
5940
  "type": "boolean",
5892
5941
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -6062,6 +6111,13 @@
6062
6111
  },
6063
6112
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
6064
6113
  },
6114
+ "disabled_connections": {
6115
+ "type": "array",
6116
+ "items": {
6117
+ "type": "string"
6118
+ },
6119
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
6120
+ },
6065
6121
  "passkey_login_enabled": {
6066
6122
  "type": "boolean",
6067
6123
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -6331,6 +6387,13 @@
6331
6387
  },
6332
6388
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
6333
6389
  },
6390
+ "disabled_connections": {
6391
+ "type": "array",
6392
+ "items": {
6393
+ "type": "string"
6394
+ },
6395
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
6396
+ },
6334
6397
  "passkey_login_enabled": {
6335
6398
  "type": "boolean",
6336
6399
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -6625,6 +6688,13 @@
6625
6688
  },
6626
6689
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
6627
6690
  },
6691
+ "disabled_connections": {
6692
+ "type": "array",
6693
+ "items": {
6694
+ "type": "string"
6695
+ },
6696
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
6697
+ },
6628
6698
  "passkey_login_enabled": {
6629
6699
  "type": "boolean",
6630
6700
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -8602,6 +8672,13 @@
8602
8672
  },
8603
8673
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
8604
8674
  },
8675
+ "disabled_connections": {
8676
+ "type": "array",
8677
+ "items": {
8678
+ "type": "string"
8679
+ },
8680
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
8681
+ },
8605
8682
  "passkey_login_enabled": {
8606
8683
  "type": "boolean",
8607
8684
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -8882,6 +8959,13 @@
8882
8959
  },
8883
8960
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
8884
8961
  },
8962
+ "disabled_connections": {
8963
+ "type": "array",
8964
+ "items": {
8965
+ "type": "string"
8966
+ },
8967
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
8968
+ },
8885
8969
  "passkey_login_enabled": {
8886
8970
  "type": "boolean",
8887
8971
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9127,6 +9211,13 @@
9127
9211
  },
9128
9212
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
9129
9213
  },
9214
+ "disabled_connections": {
9215
+ "type": "array",
9216
+ "items": {
9217
+ "type": "string"
9218
+ },
9219
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
9220
+ },
9130
9221
  "passkey_login_enabled": {
9131
9222
  "type": "boolean",
9132
9223
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9398,6 +9489,13 @@
9398
9489
  },
9399
9490
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
9400
9491
  },
9492
+ "disabled_connections": {
9493
+ "type": "array",
9494
+ "items": {
9495
+ "type": "string"
9496
+ },
9497
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
9498
+ },
9401
9499
  "passkey_login_enabled": {
9402
9500
  "type": "boolean",
9403
9501
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9676,6 +9774,13 @@
9676
9774
  },
9677
9775
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
9678
9776
  },
9777
+ "disabled_connections": {
9778
+ "type": "array",
9779
+ "items": {
9780
+ "type": "string"
9781
+ },
9782
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
9783
+ },
9679
9784
  "passkey_login_enabled": {
9680
9785
  "type": "boolean",
9681
9786
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9956,6 +10061,13 @@
9956
10061
  },
9957
10062
  "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
9958
10063
  },
10064
+ "disabled_connections": {
10065
+ "type": "array",
10066
+ "items": {
10067
+ "type": "string"
10068
+ },
10069
+ "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
10070
+ },
9959
10071
  "passkey_login_enabled": {
9960
10072
  "type": "boolean",
9961
10073
  "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -20866,6 +20978,55 @@
20866
20978
  }
20867
20979
  }
20868
20980
  },
20981
+ "/mfa/step-up": {
20982
+ "post": {
20983
+ "summary": "Start a step-up challenge for the current session",
20984
+ "tags": [
20985
+ "mfa"
20986
+ ],
20987
+ "description": "Parks a challenge for the signed-in user and returns where to send the browser. Answering it seals the session at AAL2 and returns to `redirect_to`. Answers `already_satisfied` when the session is AAL2 already.",
20988
+ "requestBody": {
20989
+ "required": true,
20990
+ "content": {
20991
+ "application/json": {
20992
+ "schema": {
20993
+ "type": "object",
20994
+ "properties": {
20995
+ "redirect_to": {
20996
+ "type": "string",
20997
+ "description": "Same-origin path to return to once the factor is proven. Off-origin values are dropped."
20998
+ }
20999
+ }
21000
+ }
21001
+ }
21002
+ }
21003
+ },
21004
+ "responses": {
21005
+ "200": {
21006
+ "description": "Default Response",
21007
+ "content": {
21008
+ "application/json": {
21009
+ "schema": {
21010
+ "type": "object",
21011
+ "required": [
21012
+ "redirect_url",
21013
+ "already_satisfied"
21014
+ ],
21015
+ "properties": {
21016
+ "redirect_url": {
21017
+ "type": "string"
21018
+ },
21019
+ "already_satisfied": {
21020
+ "type": "boolean"
21021
+ }
21022
+ }
21023
+ }
21024
+ }
21025
+ }
21026
+ }
21027
+ }
21028
+ }
21029
+ },
20869
21030
  "/me": {
20870
21031
  "get": {
20871
21032
  "operationId": "session/me",