@faable/auth-sdk 2.7.43 → 2.7.45

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/FaableAuthApi.d.ts +9 -0
  2. package/dist/api/generated-client.d.ts +23 -0
  3. package/dist/api/types.d.ts +292 -0
  4. package/dist/version.js +2 -2
  5. package/package.json +1 -1
  6. package/spec/openapi.json +548 -1
package/spec/openapi.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "info": {
4
4
  "title": "@faablecloud/auth",
5
5
  "description": "Auth Platform made by Faable. Manage Users and Roles",
6
- "version": "2.43.0",
6
+ "version": "2.45.0",
7
7
  "license": {
8
8
  "name": "private",
9
9
  "url": "https://faable.com/docs/platform/privacy-policy"
@@ -494,6 +494,10 @@
494
494
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
495
495
  "nullable": true
496
496
  },
497
+ "logout_confirm_required": {
498
+ "type": "boolean",
499
+ "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
500
+ },
497
501
  "createdAt": {
498
502
  "type": "string",
499
503
  "description": "AuthAccount creation date"
@@ -1489,6 +1493,13 @@
1489
1493
  "frontchannel_logout_session_required": {
1490
1494
  "type": "boolean"
1491
1495
  },
1496
+ "backchannel_logout_uri": {
1497
+ "type": "string",
1498
+ "nullable": true
1499
+ },
1500
+ "backchannel_logout_session_required": {
1501
+ "type": "boolean"
1502
+ },
1492
1503
  "login_methods": {
1493
1504
  "type": "object",
1494
1505
  "properties": {
@@ -2128,6 +2139,13 @@
2128
2139
  "frontchannel_logout_session_required": {
2129
2140
  "type": "boolean"
2130
2141
  },
2142
+ "backchannel_logout_uri": {
2143
+ "type": "string",
2144
+ "nullable": true
2145
+ },
2146
+ "backchannel_logout_session_required": {
2147
+ "type": "boolean"
2148
+ },
2131
2149
  "login_methods": {
2132
2150
  "anyOf": [
2133
2151
  {
@@ -6398,6 +6416,14 @@
6398
6416
  "type": "boolean",
6399
6417
  "description": "OIDC Front-Channel Logout 1.0 — when true, the OP MUST include `iss` and `sid` parameters when calling the frontchannel_logout_uri."
6400
6418
  },
6419
+ "backchannel_logout_uri": {
6420
+ "type": "string",
6421
+ "description": "OIDC Back-Channel Logout 1.0 — URL the OP POSTs a signed `logout_token` to when a session this client took part in ends."
6422
+ },
6423
+ "backchannel_logout_session_required": {
6424
+ "type": "boolean",
6425
+ "description": "OIDC Back-Channel Logout 1.0 — when true, the `logout_token` MUST include a `sid` claim."
6426
+ },
6401
6427
  "web_origins": {
6402
6428
  "type": "array",
6403
6429
  "items": {
@@ -6502,6 +6528,12 @@
6502
6528
  "frontchannel_logout_session_required": {
6503
6529
  "type": "boolean"
6504
6530
  },
6531
+ "backchannel_logout_uri": {
6532
+ "type": "string"
6533
+ },
6534
+ "backchannel_logout_session_required": {
6535
+ "type": "boolean"
6536
+ },
6505
6537
  "web_origins": {
6506
6538
  "type": "array",
6507
6539
  "items": {
@@ -7080,6 +7112,16 @@
7080
7112
  "type": "string",
7081
7113
  "nullable": true
7082
7114
  },
7115
+ "logout_confirm_required": {
7116
+ "anyOf": [
7117
+ {
7118
+ "type": "boolean"
7119
+ },
7120
+ {
7121
+ "type": "null"
7122
+ }
7123
+ ]
7124
+ },
7083
7125
  "login_flow": {
7084
7126
  "type": "string",
7085
7127
  "nullable": true
@@ -7355,6 +7397,22 @@
7355
7397
  "prompt": {
7356
7398
  "type": "string"
7357
7399
  },
7400
+ "login_hint": {
7401
+ "type": "string",
7402
+ "description": "OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers."
7403
+ },
7404
+ "id_token_hint": {
7405
+ "type": "string",
7406
+ "description": "OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in."
7407
+ },
7408
+ "acr_values": {
7409
+ "type": "string",
7410
+ "description": "OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`)."
7411
+ },
7412
+ "ui_locales": {
7413
+ "type": "string",
7414
+ "description": "OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers."
7415
+ },
7358
7416
  "audience": {
7359
7417
  "type": "string",
7360
7418
  "description": "Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource."
@@ -8119,6 +8177,10 @@
8119
8177
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
8120
8178
  "nullable": true
8121
8179
  },
8180
+ "logout_confirm_required": {
8181
+ "type": "boolean",
8182
+ "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
8183
+ },
8122
8184
  "createdAt": {
8123
8185
  "type": "string",
8124
8186
  "description": "AuthAccount creation date"
@@ -8820,6 +8882,10 @@
8820
8882
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
8821
8883
  "nullable": true
8822
8884
  },
8885
+ "logout_confirm_required": {
8886
+ "type": "boolean",
8887
+ "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
8888
+ },
8823
8889
  "createdAt": {
8824
8890
  "type": "string",
8825
8891
  "description": "AuthAccount creation date"
@@ -9757,6 +9823,10 @@
9757
9823
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
9758
9824
  "nullable": true
9759
9825
  },
9826
+ "logout_confirm_required": {
9827
+ "type": "boolean",
9828
+ "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
9829
+ },
9760
9830
  "createdAt": {
9761
9831
  "type": "string",
9762
9832
  "description": "AuthAccount creation date"
@@ -10338,6 +10408,16 @@
10338
10408
  "type": "string",
10339
10409
  "nullable": true
10340
10410
  },
10411
+ "logout_confirm_required": {
10412
+ "anyOf": [
10413
+ {
10414
+ "type": "boolean"
10415
+ },
10416
+ {
10417
+ "type": "null"
10418
+ }
10419
+ ]
10420
+ },
10341
10421
  "login_flow": {
10342
10422
  "type": "string",
10343
10423
  "nullable": true
@@ -10828,6 +10908,10 @@
10828
10908
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
10829
10909
  "nullable": true
10830
10910
  },
10911
+ "logout_confirm_required": {
10912
+ "type": "boolean",
10913
+ "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
10914
+ },
10831
10915
  "createdAt": {
10832
10916
  "type": "string",
10833
10917
  "description": "AuthAccount creation date"
@@ -16613,6 +16697,13 @@
16613
16697
  "frontchannel_logout_session_required": {
16614
16698
  "type": "boolean"
16615
16699
  },
16700
+ "backchannel_logout_uri": {
16701
+ "type": "string",
16702
+ "nullable": true
16703
+ },
16704
+ "backchannel_logout_session_required": {
16705
+ "type": "boolean"
16706
+ },
16616
16707
  "login_methods": {
16617
16708
  "type": "object",
16618
16709
  "properties": {
@@ -17225,6 +17316,13 @@
17225
17316
  "frontchannel_logout_session_required": {
17226
17317
  "type": "boolean"
17227
17318
  },
17319
+ "backchannel_logout_uri": {
17320
+ "type": "string",
17321
+ "nullable": true
17322
+ },
17323
+ "backchannel_logout_session_required": {
17324
+ "type": "boolean"
17325
+ },
17228
17326
  "login_methods": {
17229
17327
  "type": "object",
17230
17328
  "properties": {
@@ -17860,6 +17958,13 @@
17860
17958
  "frontchannel_logout_session_required": {
17861
17959
  "type": "boolean"
17862
17960
  },
17961
+ "backchannel_logout_uri": {
17962
+ "type": "string",
17963
+ "nullable": true
17964
+ },
17965
+ "backchannel_logout_session_required": {
17966
+ "type": "boolean"
17967
+ },
17863
17968
  "login_methods": {
17864
17969
  "anyOf": [
17865
17970
  {
@@ -18318,6 +18423,13 @@
18318
18423
  "frontchannel_logout_session_required": {
18319
18424
  "type": "boolean"
18320
18425
  },
18426
+ "backchannel_logout_uri": {
18427
+ "type": "string",
18428
+ "nullable": true
18429
+ },
18430
+ "backchannel_logout_session_required": {
18431
+ "type": "boolean"
18432
+ },
18321
18433
  "login_methods": {
18322
18434
  "type": "object",
18323
18435
  "properties": {
@@ -18930,6 +19042,13 @@
18930
19042
  "frontchannel_logout_session_required": {
18931
19043
  "type": "boolean"
18932
19044
  },
19045
+ "backchannel_logout_uri": {
19046
+ "type": "string",
19047
+ "nullable": true
19048
+ },
19049
+ "backchannel_logout_session_required": {
19050
+ "type": "boolean"
19051
+ },
18933
19052
  "login_methods": {
18934
19053
  "type": "object",
18935
19054
  "properties": {
@@ -19543,6 +19662,13 @@
19543
19662
  "frontchannel_logout_session_required": {
19544
19663
  "type": "boolean"
19545
19664
  },
19665
+ "backchannel_logout_uri": {
19666
+ "type": "string",
19667
+ "nullable": true
19668
+ },
19669
+ "backchannel_logout_session_required": {
19670
+ "type": "boolean"
19671
+ },
19546
19672
  "login_methods": {
19547
19673
  "type": "object",
19548
19674
  "properties": {
@@ -57588,6 +57714,166 @@
57588
57714
  }
57589
57715
  }
57590
57716
  },
57717
+ "/logout/confirm": {
57718
+ "post": {
57719
+ "operationId": "session/logoutConfirm",
57720
+ "summary": "Confirm a parked RP-Initiated Logout",
57721
+ "tags": [
57722
+ "session"
57723
+ ],
57724
+ "description": "Finishes a `/logout` request that was parked pending confirmation (backlog §240) because it carried no verified `id_token_hint`. Single-use: the state cannot be replayed.",
57725
+ "requestBody": {
57726
+ "required": true,
57727
+ "content": {
57728
+ "application/json": {
57729
+ "schema": {
57730
+ "type": "object",
57731
+ "required": [
57732
+ "state"
57733
+ ],
57734
+ "properties": {
57735
+ "state": {
57736
+ "type": "string",
57737
+ "description": "The `state` the confirmation screen was opened with."
57738
+ }
57739
+ }
57740
+ }
57741
+ }
57742
+ }
57743
+ },
57744
+ "responses": {
57745
+ "200": {
57746
+ "description": "Default Response"
57747
+ },
57748
+ "400": {
57749
+ "description": "`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
57750
+ "content": {
57751
+ "application/json": {
57752
+ "schema": {
57753
+ "allOf": [
57754
+ {
57755
+ "$ref": "#/components/schemas/ErrorResponse"
57756
+ },
57757
+ {
57758
+ "type": "object",
57759
+ "properties": {
57760
+ "error_code": {
57761
+ "type": "string",
57762
+ "enum": [
57763
+ "invalid_state",
57764
+ "validation_error"
57765
+ ]
57766
+ }
57767
+ }
57768
+ }
57769
+ ]
57770
+ }
57771
+ }
57772
+ }
57773
+ },
57774
+ "401": {
57775
+ "description": "`state_mismatch` — The `state` belongs to another account, session, client or ceremony.",
57776
+ "content": {
57777
+ "application/json": {
57778
+ "schema": {
57779
+ "allOf": [
57780
+ {
57781
+ "$ref": "#/components/schemas/ErrorResponse"
57782
+ },
57783
+ {
57784
+ "type": "object",
57785
+ "properties": {
57786
+ "error_code": {
57787
+ "type": "string",
57788
+ "enum": [
57789
+ "state_mismatch"
57790
+ ]
57791
+ }
57792
+ }
57793
+ }
57794
+ ]
57795
+ }
57796
+ }
57797
+ }
57798
+ },
57799
+ "404": {
57800
+ "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
57801
+ "content": {
57802
+ "application/json": {
57803
+ "schema": {
57804
+ "allOf": [
57805
+ {
57806
+ "$ref": "#/components/schemas/ErrorResponse"
57807
+ },
57808
+ {
57809
+ "type": "object",
57810
+ "properties": {
57811
+ "error_code": {
57812
+ "type": "string",
57813
+ "enum": [
57814
+ "account_not_found"
57815
+ ]
57816
+ }
57817
+ }
57818
+ }
57819
+ ]
57820
+ }
57821
+ }
57822
+ }
57823
+ },
57824
+ "429": {
57825
+ "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
57826
+ "content": {
57827
+ "application/json": {
57828
+ "schema": {
57829
+ "allOf": [
57830
+ {
57831
+ "$ref": "#/components/schemas/ErrorResponse"
57832
+ },
57833
+ {
57834
+ "type": "object",
57835
+ "properties": {
57836
+ "error_code": {
57837
+ "type": "string",
57838
+ "enum": [
57839
+ "too_many_requests"
57840
+ ]
57841
+ }
57842
+ }
57843
+ }
57844
+ ]
57845
+ }
57846
+ }
57847
+ }
57848
+ },
57849
+ "500": {
57850
+ "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
57851
+ "content": {
57852
+ "application/json": {
57853
+ "schema": {
57854
+ "allOf": [
57855
+ {
57856
+ "$ref": "#/components/schemas/ErrorResponse"
57857
+ },
57858
+ {
57859
+ "type": "object",
57860
+ "properties": {
57861
+ "error_code": {
57862
+ "type": "string",
57863
+ "enum": [
57864
+ "internal_error"
57865
+ ]
57866
+ }
57867
+ }
57868
+ }
57869
+ ]
57870
+ }
57871
+ }
57872
+ }
57873
+ }
57874
+ }
57875
+ }
57876
+ },
57591
57877
  "/authorize": {
57592
57878
  "get": {
57593
57879
  "operationId": "authorize",
@@ -57773,6 +58059,42 @@
57773
58059
  "name": "prompt",
57774
58060
  "required": false
57775
58061
  },
58062
+ {
58063
+ "schema": {
58064
+ "type": "string"
58065
+ },
58066
+ "in": "query",
58067
+ "name": "login_hint",
58068
+ "required": false,
58069
+ "description": "OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers."
58070
+ },
58071
+ {
58072
+ "schema": {
58073
+ "type": "string"
58074
+ },
58075
+ "in": "query",
58076
+ "name": "id_token_hint",
58077
+ "required": false,
58078
+ "description": "OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in."
58079
+ },
58080
+ {
58081
+ "schema": {
58082
+ "type": "string"
58083
+ },
58084
+ "in": "query",
58085
+ "name": "acr_values",
58086
+ "required": false,
58087
+ "description": "OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`)."
58088
+ },
58089
+ {
58090
+ "schema": {
58091
+ "type": "string"
58092
+ },
58093
+ "in": "query",
58094
+ "name": "ui_locales",
58095
+ "required": false,
58096
+ "description": "OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers."
58097
+ },
57776
58098
  {
57777
58099
  "schema": {
57778
58100
  "type": "string"
@@ -57954,6 +58276,201 @@
57954
58276
  }
57955
58277
  }
57956
58278
  },
58279
+ "/select-account": {
58280
+ "post": {
58281
+ "operationId": "oauth/selectAccount",
58282
+ "summary": "Answer the account chooser of a prompt=select_account login",
58283
+ "tags": [
58284
+ "oauth"
58285
+ ],
58286
+ "description": "Resumes an authorization request that `/authorize` parked on the hosted account chooser. Requires the session cookie of the user the chooser was shown to. Returns where the browser goes next: the client callback with a code, or a login screen.",
58287
+ "requestBody": {
58288
+ "required": true,
58289
+ "content": {
58290
+ "application/json": {
58291
+ "schema": {
58292
+ "type": "object",
58293
+ "required": [
58294
+ "state",
58295
+ "choice"
58296
+ ],
58297
+ "properties": {
58298
+ "state": {
58299
+ "type": "string",
58300
+ "description": "The `state` the select-account screen was opened with."
58301
+ },
58302
+ "choice": {
58303
+ "anyOf": [
58304
+ {
58305
+ "type": "string",
58306
+ "enum": [
58307
+ "continue"
58308
+ ]
58309
+ },
58310
+ {
58311
+ "type": "string",
58312
+ "enum": [
58313
+ "other"
58314
+ ]
58315
+ }
58316
+ ],
58317
+ "description": "`continue`: go on as the signed-in user. `other`: sign this browser out and start a fresh login for the same request."
58318
+ }
58319
+ },
58320
+ "additionalProperties": false
58321
+ }
58322
+ }
58323
+ }
58324
+ },
58325
+ "responses": {
58326
+ "200": {
58327
+ "description": "Default Response",
58328
+ "content": {
58329
+ "application/json": {
58330
+ "schema": {
58331
+ "type": "object",
58332
+ "required": [
58333
+ "redirect_url"
58334
+ ],
58335
+ "properties": {
58336
+ "redirect_url": {
58337
+ "type": "string"
58338
+ }
58339
+ }
58340
+ }
58341
+ }
58342
+ }
58343
+ },
58344
+ "400": {
58345
+ "description": "`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
58346
+ "content": {
58347
+ "application/json": {
58348
+ "schema": {
58349
+ "allOf": [
58350
+ {
58351
+ "$ref": "#/components/schemas/ErrorResponse"
58352
+ },
58353
+ {
58354
+ "type": "object",
58355
+ "properties": {
58356
+ "error_code": {
58357
+ "type": "string",
58358
+ "enum": [
58359
+ "invalid_state",
58360
+ "validation_error"
58361
+ ]
58362
+ }
58363
+ }
58364
+ }
58365
+ ]
58366
+ }
58367
+ }
58368
+ }
58369
+ },
58370
+ "401": {
58371
+ "description": "`not_logged_in` — There is no signed-in session for this request.\n\n`state_mismatch` — The `state` belongs to another account, session, client or ceremony.",
58372
+ "content": {
58373
+ "application/json": {
58374
+ "schema": {
58375
+ "allOf": [
58376
+ {
58377
+ "$ref": "#/components/schemas/ErrorResponse"
58378
+ },
58379
+ {
58380
+ "type": "object",
58381
+ "properties": {
58382
+ "error_code": {
58383
+ "type": "string",
58384
+ "enum": [
58385
+ "not_logged_in",
58386
+ "state_mismatch"
58387
+ ]
58388
+ }
58389
+ }
58390
+ }
58391
+ ]
58392
+ }
58393
+ }
58394
+ }
58395
+ },
58396
+ "404": {
58397
+ "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
58398
+ "content": {
58399
+ "application/json": {
58400
+ "schema": {
58401
+ "allOf": [
58402
+ {
58403
+ "$ref": "#/components/schemas/ErrorResponse"
58404
+ },
58405
+ {
58406
+ "type": "object",
58407
+ "properties": {
58408
+ "error_code": {
58409
+ "type": "string",
58410
+ "enum": [
58411
+ "account_not_found"
58412
+ ]
58413
+ }
58414
+ }
58415
+ }
58416
+ ]
58417
+ }
58418
+ }
58419
+ }
58420
+ },
58421
+ "429": {
58422
+ "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
58423
+ "content": {
58424
+ "application/json": {
58425
+ "schema": {
58426
+ "allOf": [
58427
+ {
58428
+ "$ref": "#/components/schemas/ErrorResponse"
58429
+ },
58430
+ {
58431
+ "type": "object",
58432
+ "properties": {
58433
+ "error_code": {
58434
+ "type": "string",
58435
+ "enum": [
58436
+ "too_many_requests"
58437
+ ]
58438
+ }
58439
+ }
58440
+ }
58441
+ ]
58442
+ }
58443
+ }
58444
+ }
58445
+ },
58446
+ "500": {
58447
+ "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
58448
+ "content": {
58449
+ "application/json": {
58450
+ "schema": {
58451
+ "allOf": [
58452
+ {
58453
+ "$ref": "#/components/schemas/ErrorResponse"
58454
+ },
58455
+ {
58456
+ "type": "object",
58457
+ "properties": {
58458
+ "error_code": {
58459
+ "type": "string",
58460
+ "enum": [
58461
+ "internal_error"
58462
+ ]
58463
+ }
58464
+ }
58465
+ }
58466
+ ]
58467
+ }
58468
+ }
58469
+ }
58470
+ }
58471
+ }
58472
+ }
58473
+ },
57957
58474
  "/oauth/link_ticket": {
57958
58475
  "post": {
57959
58476
  "operationId": "oauth/link_ticket",
@@ -60651,6 +61168,14 @@
60651
61168
  "type": "boolean",
60652
61169
  "description": "OIDC Front-Channel Logout 1.0 — when true, the OP MUST include `iss` and `sid` parameters when calling the frontchannel_logout_uri."
60653
61170
  },
61171
+ "backchannel_logout_uri": {
61172
+ "type": "string",
61173
+ "description": "OIDC Back-Channel Logout 1.0 — URL the OP POSTs a signed `logout_token` to when a session this client took part in ends."
61174
+ },
61175
+ "backchannel_logout_session_required": {
61176
+ "type": "boolean",
61177
+ "description": "OIDC Back-Channel Logout 1.0 — when true, the `logout_token` MUST include a `sid` claim."
61178
+ },
60654
61179
  "web_origins": {
60655
61180
  "type": "array",
60656
61181
  "items": {
@@ -60763,6 +61288,12 @@
60763
61288
  "frontchannel_logout_session_required": {
60764
61289
  "type": "boolean"
60765
61290
  },
61291
+ "backchannel_logout_uri": {
61292
+ "type": "string"
61293
+ },
61294
+ "backchannel_logout_session_required": {
61295
+ "type": "boolean"
61296
+ },
60766
61297
  "web_origins": {
60767
61298
  "type": "array",
60768
61299
  "items": {
@@ -60950,6 +61481,22 @@
60950
61481
  "prompt": {
60951
61482
  "type": "string"
60952
61483
  },
61484
+ "login_hint": {
61485
+ "type": "string",
61486
+ "description": "OIDC §3.1.2.1 — hint about the identifier (email, username) the End-User will sign in with. Pre-fills the hosted login screen and is forwarded to upstream identity providers."
61487
+ },
61488
+ "id_token_hint": {
61489
+ "type": "string",
61490
+ "description": "OIDC §3.1.2.1 — an id_token this provider issued earlier for the user the client believes is signed in. Verified (signature, not expiry). With `prompt=none`, a session for a different user answers `login_required`; otherwise it forces a fresh sign-in."
61491
+ },
61492
+ "acr_values": {
61493
+ "type": "string",
61494
+ "description": "OIDC §3.1.2.1 — space-separated Authentication Context Class References, in order of preference. `urn:faable:loa:2` asks for a second factor: a session that only has one is challenged (or, with `prompt=none`, answers `interaction_required`)."
61495
+ },
61496
+ "ui_locales": {
61497
+ "type": "string",
61498
+ "description": "OIDC §3.1.2.1 — preferred languages for the hosted screens, space-separated BCP47 tags. Forwarded to upstream identity providers."
61499
+ },
60953
61500
  "audience": {
60954
61501
  "type": "string",
60955
61502
  "description": "Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource."