@faable/auth-sdk 2.7.9 → 2.7.10

package/dist/api/types.d.ts

@@ -23936,6 +23936,8 @@ export interface operations {
                 link?: boolean;
                 /** @description Preview token from `POST /loginflow/:id/preview-token`. This login runs the DRAFT of that flow, for this browser only; nothing is published. Invalid or expired tokens are ignored. */
                 flow_preview?: string;
+                /** @description Resume the login transaction the hosted screen has parked, instead of starting a new one. Used by the screen itself when the person picks a method: everything that belongs to the Relying Party — `code_challenge`, `state`, `redirect_uri`, `nonce`, `scope`, `audience` — is taken from the parked transaction and CANNOT be overridden by the query. Only `connection` is read from the caller. */
+                resume_state?: string;
                 /** @description Single-use ticket from `POST /oauth/link_ticket`. With `link=true`, establishes the cookie session for the ticket’s user before linking — for Relying Parties that hold tokens but no cookie session (direct grants such as passwordless OTP). Invalid or expired tickets are ignored. */
                 link_ticket?: string;
                 client_id: string;
@@ -23976,6 +23978,8 @@ export interface operations {
              *
              *     `invalid_redirect_uri` — The redirect URI is not registered for the client.
              *
+             *     `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -23985,7 +23989,19 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_client" | "invalid_redirect_uri" | "validation_error";
+                        error_code?: "invalid_client" | "invalid_redirect_uri" | "invalid_state" | "validation_error";
+                    };
+                };
+            };
+            /** @description `state_mismatch` — The `state` belongs to another account, session, client or ceremony. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "state_mismatch";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.9";
+export const version = "2.7.10";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "ffe5415";
+export const commit = "7e3c429";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.9",
+  "version": "2.7.10",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.25.4",
+    "version": "2.25.5",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -52824,6 +52824,15 @@
             "required": false,
             "description": "Preview token from `POST /loginflow/:id/preview-token`. This login runs the DRAFT of that flow, for this browser only; nothing is published. Invalid or expired tokens are ignored."
           },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "resume_state",
+            "required": false,
+            "description": "Resume the login transaction the hosted screen has parked, instead of starting a new one. Used by the screen itself when the person picks a method: everything that belongs to the Relying Party — `code_challenge`, `state`, `redirect_uri`, `nonce`, `scope`, `audience` — is taken from the parked transaction and CANNOT be overridden by the query. Only `connection` is read from the caller."
+          },
           {
             "schema": {
               "type": "string"
@@ -52936,7 +52945,7 @@
             "description": "Default Response"
           },
           "400": {
-            "description": "`invalid_client` — The `client_id` in the request does not name a client of this account.\n\n`invalid_redirect_uri` — The redirect URI is not registered for the client.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_client` — The `client_id` in the request does not name a client of this account.\n\n`invalid_redirect_uri` — The redirect URI is not registered for the client.\n\n`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -52952,6 +52961,7 @@
                           "enum": [
                             "invalid_client",
                             "invalid_redirect_uri",
+                            "invalid_state",
                             "validation_error"
                           ]
                         }
@@ -52962,6 +52972,31 @@
               }
             }
           },
+          "401": {
+            "description": "`state_mismatch` — The `state` belongs to another account, session, client or ceremony.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "state_mismatch"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "403": {
             "description": "`origin_not_allowed` — The request `Origin` is not in the client's Allowed Web Origins.",
             "content": {