@faable/auth-sdk 2.7.15 → 2.7.16

package/dist/api/types.d.ts

@@ -8918,6 +8918,8 @@ export interface operations {
                             id: string;
                             client_id: string;
                             name: string;
+                            /** @description The http(s) origins this client registered in its `callbacks`, de-duplicated. A hosted screen uses it as the allow-list for a cross-origin `return_to`: the account security page is opened from the tenant's own application and has to offer a way back to it, which `redirect_to` (same-origin paths only) cannot express. Nothing secret — a redirect URI already travels in the query of every `/authorize` call. */
+                            origins: string[];
                         } | null;
                         identifier_first: boolean;
                         remember_last_method: boolean;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.15";
+export const version = "2.7.16";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "7f86ca2";
+export const commit = "a854d55";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.15",
+  "version": "2.7.16",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.25.10",
+    "version": "2.26.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -14221,7 +14221,8 @@
                           "required": [
                             "id",
                             "client_id",
-                            "name"
+                            "name",
+                            "origins"
                           ],
                           "properties": {
                             "id": {
@@ -14232,6 +14233,13 @@
                             },
                             "name": {
                               "type": "string"
+                            },
+                            "origins": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "description": "The http(s) origins this client registered in its `callbacks`, de-duplicated. A hosted screen uses it as the allow-list for a cross-origin `return_to`: the account security page is opened from the tenant's own application and has to offer a way back to it, which `redirect_to` (same-origin paths only) cannot express. Nothing secret — a redirect URI already travels in the query of every `/authorize` call."
                             }
                           }
                         },