@faable/auth-sdk 2.7.64 → 2.7.65

package/dist/api/types.d.ts

@@ -26559,6 +26559,8 @@ export interface operations {
                     redirect_to?: string;
                     /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`). */
                     remember_me?: boolean;
+                    /** @description The login's key from `/authorize` — the hosted screen's `?state=`. Carries the client's OAuth request (its `redirect_uri`, its own `state`, PKCE challenge, nonce, scope) into the code this login issues. Absent when the screen was not opened by `/authorize` (device-code confirm, account pages). */
+                    state?: string;
                 };
             };
         };
@@ -26577,6 +26579,8 @@ export interface operations {
             /**
              * @description `invalid_client` — The `client_id` in the request does not name a client of this account.
              *
+             *     `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -26586,7 +26590,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_client" | "validation_error";
+                        error_code?: "invalid_client" | "invalid_state" | "validation_error";
                     };
                 };
             };
@@ -26594,6 +26598,8 @@ export interface operations {
              * @description `invalid_otp` — The one-time password is wrong or expired.
              *
              *     `login_denied` — A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.
+             *
+             *     `state_mismatch` — The `state` belongs to another account, session, client or ceremony.
              */
             401: {
                 headers: {
@@ -26602,7 +26608,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_otp" | "login_denied";
+                        error_code?: "invalid_otp" | "login_denied" | "state_mismatch";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.64";
+export const version = "2.7.65";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "f9ef123";
+export const commit = "605b840";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.64",
+  "version": "2.7.65",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.52.2",
+    "version": "2.52.3",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -54698,6 +54698,10 @@
                   "remember_me": {
                     "type": "boolean",
                     "description": "The \"Remember me on this device\" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: \"optional\"`)."
+                  },
+                  "state": {
+                    "type": "string",
+                    "description": "The login's key from `/authorize` — the hosted screen's `?state=`. Carries the client's OAuth request (its `redirect_uri`, its own `state`, PKCE challenge, nonce, scope) into the code this login issues. Absent when the screen was not opened by `/authorize` (device-code confirm, account pages)."
                   }
                 }
               }
@@ -54724,7 +54728,7 @@
             }
           },
           "400": {
-            "description": "`invalid_client` — The `client_id` in the request does not name a client of this account.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_client` — The `client_id` in the request does not name a client of this account.\n\n`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -54739,6 +54743,7 @@
                           "type": "string",
                           "enum": [
                             "invalid_client",
+                            "invalid_state",
                             "validation_error"
                           ]
                         }
@@ -54750,7 +54755,7 @@
             }
           },
           "401": {
-            "description": "`invalid_otp` — The one-time password is wrong or expired.\n\n`login_denied` — A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.",
+            "description": "`invalid_otp` — The one-time password is wrong or expired.\n\n`login_denied` — A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n\n`state_mismatch` — The `state` belongs to another account, session, client or ceremony.",
             "content": {
               "application/json": {
                 "schema": {
@@ -54765,7 +54770,8 @@
                           "type": "string",
                           "enum": [
                             "invalid_otp",
-                            "login_denied"
+                            "login_denied",
+                            "state_mismatch"
                           ]
                         }
                       }