@faable/auth-sdk 2.7.43 → 2.7.44

package/dist/api/types.d.ts

@@ -3936,6 +3936,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/select-account": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Answer the account chooser of a prompt=select_account login
+         * @description Resumes an authorization request that `/authorize` parked on the hosted account chooser. Requires the session cookie of the user the chooser was shown to. Returns where the browser goes next: the client callback with a code, or a login screen.
+         */
+        post: operations["oauth/selectAccount"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/oauth/link_ticket": {
         parameters: {
             query?: never;
@@ -6512,6 +6532,14 @@ export interface components {
             /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
             max_age?: number;
             prompt?: string;
+            /** @description OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers. */
+            login_hint?: string;
+            /** @description OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in. */
+            id_token_hint?: string;
+            /** @description OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`). */
+            acr_values?: string;
+            /** @description OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers. */
+            ui_locales?: string;
             /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
             audience?: string;
             /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
@@ -26203,6 +26231,14 @@ export interface operations {
                 /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                 max_age?: number;
                 prompt?: string;
+                /** @description OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers. */
+                login_hint?: string;
+                /** @description OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in. */
+                id_token_hint?: string;
+                /** @description OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`). */
+                acr_values?: string;
+                /** @description OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers. */
+                ui_locales?: string;
                 /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
                 audience?: string;
                 /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
@@ -26309,6 +26345,105 @@ export interface operations {
             };
         };
     };
+    "oauth/selectAccount": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The `state` the select-account screen was opened with. */
+                    state: string;
+                    /** @description `continue`: go on as the signed-in user. `other`: sign this browser out and start a fresh login for the same request. */
+                    choice: "continue" | "other";
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        redirect_url: string;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_state" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `not_logged_in` — There is no signed-in session for this request.
+             *
+             *     `state_mismatch` — The `state` belongs to another account, session, client or ceremony.
+             */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_logged_in" | "state_mismatch";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "oauth/link_ticket": {
         parameters: {
             query?: never;
@@ -27659,6 +27794,14 @@ export interface operations {
                     /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                     max_age?: number;
                     prompt?: string;
+                    /** @description OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers. */
+                    login_hint?: string;
+                    /** @description OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in. */
+                    id_token_hint?: string;
+                    /** @description OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`). */
+                    acr_values?: string;
+                    /** @description OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers. */
+                    ui_locales?: string;
                     /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
                     audience?: string;
                     /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.43";
+export const version = "2.7.44";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "c6f16f9";
+export const commit = "bbde982";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.43",
+  "version": "2.7.44",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.43.0",
+    "version": "2.44.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -7355,6 +7355,22 @@
           "prompt": {
             "type": "string"
           },
+          "login_hint": {
+            "type": "string",
+            "description": "OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers."
+          },
+          "id_token_hint": {
+            "type": "string",
+            "description": "OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in."
+          },
+          "acr_values": {
+            "type": "string",
+            "description": "OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`)."
+          },
+          "ui_locales": {
+            "type": "string",
+            "description": "OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers."
+          },
           "audience": {
             "type": "string",
             "description": "Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource."
@@ -57773,6 +57789,42 @@
             "name": "prompt",
             "required": false
           },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "login_hint",
+            "required": false,
+            "description": "OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "id_token_hint",
+            "required": false,
+            "description": "OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "acr_values",
+            "required": false,
+            "description": "OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`)."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "ui_locales",
+            "required": false,
+            "description": "OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers."
+          },
           {
             "schema": {
               "type": "string"
@@ -57954,6 +58006,201 @@
         }
       }
     },
+    "/select-account": {
+      "post": {
+        "operationId": "oauth/selectAccount",
+        "summary": "Answer the account chooser of a prompt=select_account login",
+        "tags": [
+          "oauth"
+        ],
+        "description": "Resumes an authorization request that `/authorize` parked on the hosted account chooser. Requires the session cookie of the user the chooser was shown to. Returns where the browser goes next: the client callback with a code, or a login screen.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "state",
+                  "choice"
+                ],
+                "properties": {
+                  "state": {
+                    "type": "string",
+                    "description": "The `state` the select-account screen was opened with."
+                  },
+                  "choice": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "continue"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "other"
+                        ]
+                      }
+                    ],
+                    "description": "`continue`: go on as the signed-in user. `other`: sign this browser out and start a fresh login for the same request."
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "redirect_url"
+                  ],
+                  "properties": {
+                    "redirect_url": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_state",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`not_logged_in` — There is no signed-in session for this request.\n\n`state_mismatch` — The `state` belongs to another account, session, client or ceremony.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_logged_in",
+                            "state_mismatch"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/oauth/link_ticket": {
       "post": {
         "operationId": "oauth/link_ticket",
@@ -60950,6 +61197,22 @@
                   "prompt": {
                     "type": "string"
                   },
+                  "login_hint": {
+                    "type": "string",
+                    "description": "OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers."
+                  },
+                  "id_token_hint": {
+                    "type": "string",
+                    "description": "OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in."
+                  },
+                  "acr_values": {
+                    "type": "string",
+                    "description": "OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`)."
+                  },
+                  "ui_locales": {
+                    "type": "string",
+                    "description": "OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers."
+                  },
                   "audience": {
                     "type": "string",
                     "description": "Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource."