npm - @faable/auth-sdk - Versions diffs - 2.5.73 → 2.5.74 - Mend

@faable/auth-sdk 2.5.73 → 2.5.74

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/FaableAuthApi.d.ts +5 -0
package/dist/api/generated-client.d.ts +15 -0
package/dist/api/types.d.ts +32 -0
package/package.json +1 -1
package/spec/openapi.json +113 -1

package/dist/FaableAuthApi.d.ts CHANGED Viewed

@@ -49,6 +49,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -727,6 +728,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             frontchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -775,6 +777,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             frontchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -826,6 +829,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             frontchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -876,6 +880,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         frontchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;

package/dist/api/generated-client.d.ts CHANGED Viewed

@@ -45,6 +45,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -85,6 +86,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -131,6 +133,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -182,6 +185,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -217,6 +221,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -255,6 +260,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -308,6 +314,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -712,6 +719,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         frontchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -765,6 +773,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         frontchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -818,6 +827,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         frontchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -872,6 +882,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             frontchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -920,6 +931,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             frontchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -971,6 +983,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             frontchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
+                disabled_connections?: string[] | undefined;
                 passkey_login_enabled?: boolean | undefined;
                 identifier_first?: boolean | undefined;
                 remember_last_method?: boolean | undefined;
@@ -1025,6 +1038,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         frontchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;
@@ -1078,6 +1092,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         frontchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
             passkey_login_enabled?: boolean | undefined;
             identifier_first?: boolean | undefined;
             remember_last_method?: boolean | undefined;

package/dist/api/types.d.ts CHANGED Viewed

@@ -2434,6 +2434,8 @@ export interface components {
             login_methods?: {
                 /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                 order?: string[];
+                /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                disabled_connections?: string[];
                 /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                 passkey_login_enabled?: boolean;
                 /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -2712,6 +2714,8 @@ export interface components {
             login_methods?: {
                 /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                 order?: string[];
+                /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                disabled_connections?: string[];
                 /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                 passkey_login_enabled?: boolean;
                 /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -2803,6 +2807,8 @@ export interface components {
             login_methods?: {
                 /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                 order?: string[];
+                /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                disabled_connections?: string[];
                 /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                 passkey_login_enabled?: boolean;
                 /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4075,6 +4081,8 @@ export interface components {
             login_methods?: {
                 /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                 order?: string[];
+                /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                disabled_connections?: string[];
                 /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                 passkey_login_enabled?: boolean;
                 /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4233,6 +4241,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4369,6 +4379,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4459,6 +4471,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4521,6 +4535,8 @@ export interface operations {
                     login_methods?: {
                         /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                         order?: string[];
+                        /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                        disabled_connections?: string[];
                         /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                         passkey_login_enabled?: boolean;
                         /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4590,6 +4606,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -4689,6 +4707,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5348,6 +5368,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5437,6 +5459,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5520,6 +5544,8 @@ export interface operations {
                     login_methods?: {
                         /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                         order?: string[];
+                        /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                        disabled_connections?: string[];
                         /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                         passkey_login_enabled?: boolean;
                         /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5590,6 +5616,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5679,6 +5707,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
@@ -5768,6 +5798,8 @@ export interface operations {
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                             order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
                             /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
                             passkey_login_enabled?: boolean;
                             /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.5.73",
+  "version": "2.5.74",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json CHANGED Viewed

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.2.3",
+    "version": "2.3.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -185,6 +185,13 @@
                 },
                 "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
               },
+              "disabled_connections": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+              },
               "passkey_login_enabled": {
                 "type": "boolean",
                 "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -1179,6 +1186,13 @@
                 },
                 "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
               },
+              "disabled_connections": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+              },
               "passkey_login_enabled": {
                 "type": "boolean",
                 "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -1461,6 +1475,13 @@
                     },
                     "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                   },
+                  "disabled_connections": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                  },
                   "passkey_login_enabled": {
                     "type": "boolean",
                     "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -4611,6 +4632,13 @@
                     },
                     "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                   },
+                  "disabled_connections": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                  },
                   "passkey_login_enabled": {
                     "type": "boolean",
                     "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -5191,6 +5219,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -5512,6 +5547,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -5887,6 +5929,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -6062,6 +6111,13 @@
                             },
                             "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                           },
+                          "disabled_connections": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                          },
                           "passkey_login_enabled": {
                             "type": "boolean",
                             "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -6331,6 +6387,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -6625,6 +6688,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -8602,6 +8672,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -8882,6 +8959,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9127,6 +9211,13 @@
                             },
                             "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                           },
+                          "disabled_connections": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                          },
                           "passkey_login_enabled": {
                             "type": "boolean",
                             "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9398,6 +9489,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9676,6 +9774,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
@@ -9956,6 +10061,13 @@
                           },
                           "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
                         },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
                         "passkey_login_enabled": {
                           "type": "boolean",
                           "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."