@faable/auth-sdk 2.8.10 → 2.8.12

package/dist/FaableAuthApi.d.ts

@@ -618,7 +618,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         all: () => Promise<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -634,6 +634,10 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             authorize_params: {
                 [key: string]: string;
             };
+            provider_options?: {
+                team_id?: string | undefined;
+                key_id?: string | undefined;
+            } | undefined;
             claims_mapping?: {
                 [key: string]: string;
             } | undefined;
@@ -659,7 +663,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         first: () => Promise<import("@faable/sdk-base/dist/helpers/paginator.js").Page<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -675,6 +679,10 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             authorize_params: {
                 [key: string]: string;
             };
+            provider_options?: {
+                team_id?: string | undefined;
+                key_id?: string | undefined;
+            } | undefined;
             claims_mapping?: {
                 [key: string]: string;
             } | undefined;
@@ -703,7 +711,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         } | undefined) => Promise<import("@faable/sdk-base/dist/helpers/paginator.js").Page<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -719,6 +727,10 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             authorize_params: {
                 [key: string]: string;
             };
+            provider_options?: {
+                team_id?: string | undefined;
+                key_id?: string | undefined;
+            } | undefined;
             claims_mapping?: {
                 [key: string]: string;
             } | undefined;
@@ -746,7 +758,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
     getConection(...args: Parameters<GeneratedFaableAuthApi["connectionGet"]>): Promise<{
         id: string;
         connection_name: string;
-        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
         authorize_url: string;
         token_url: string;
         userinfo_url: string;
@@ -762,6 +774,10 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         authorize_params: {
             [key: string]: string;
         };
+        provider_options?: {
+            team_id?: string | undefined;
+            key_id?: string | undefined;
+        } | undefined;
         claims_mapping?: {
             [key: string]: string;
         } | undefined;

package/dist/api/generated-client.d.ts

@@ -482,7 +482,23 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 body?: string | null | undefined;
                 social_links?: {
                     label: string;
-                    url: string;
+                    url: string; /**
+                     * `GET /user` — operationId: `user/list`
+                     *
+                     * List Users
+                     *
+                     * @throws {FaableApiError} `invalid_query` (400) — The `?query=` FaableQL expression could not be parsed.
+                     * @throws {FaableApiError} `invalid_expand` (400) — An `?expand=` path is not allowed on this resource.
+                     * @throws {FaableApiError} `search_not_supported` (400) — This resource does not support `?search=`.
+                     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+                     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+                     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+                     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+                     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+                     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+                     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+                     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+                     */
                 }[] | null | undefined;
             } | null | undefined;
             email_change_verification_mode?: "new_only" | "old_and_new" | undefined;
@@ -552,7 +568,23 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 body?: string | null | undefined;
                 social_links?: {
                     label: string;
-                    url: string;
+                    url: string; /**
+                     * `GET /user` — operationId: `user/list`
+                     *
+                     * List Users
+                     *
+                     * @throws {FaableApiError} `invalid_query` (400) — The `?query=` FaableQL expression could not be parsed.
+                     * @throws {FaableApiError} `invalid_expand` (400) — An `?expand=` path is not allowed on this resource.
+                     * @throws {FaableApiError} `search_not_supported` (400) — This resource does not support `?search=`.
+                     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+                     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+                     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+                     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+                     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+                     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+                     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+                     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+                     */
                 }[] | null | undefined;
             } | null | undefined;
             email_change_verification_mode?: "new_only" | "old_and_new" | undefined;
@@ -625,7 +657,23 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 body?: string | null | undefined;
                 social_links?: {
                     label: string;
-                    url: string;
+                    url: string; /**
+                     * `GET /user` — operationId: `user/list`
+                     *
+                     * List Users
+                     *
+                     * @throws {FaableApiError} `invalid_query` (400) — The `?query=` FaableQL expression could not be parsed.
+                     * @throws {FaableApiError} `invalid_expand` (400) — An `?expand=` path is not allowed on this resource.
+                     * @throws {FaableApiError} `search_not_supported` (400) — This resource does not support `?search=`.
+                     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+                     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+                     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+                     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+                     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+                     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+                     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+                     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+                     */
                 }[] | null | undefined;
             } | null | undefined;
             email_change_verification_mode?: "new_only" | "old_and_new" | undefined;
@@ -2266,7 +2314,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
     connectionCreate(data: OpBody<"connection/create">): Promise<{
         id: string;
         connection_name: string;
-        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
         authorize_url: string;
         token_url: string;
         userinfo_url: string;
@@ -2282,6 +2330,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         authorize_params: {
             [key: string]: string;
         };
+        provider_options?: {
+            team_id?: string | undefined;
+            key_id?: string | undefined;
+        } | undefined;
         claims_mapping?: {
             [key: string]: string;
         } | undefined;
@@ -2323,7 +2375,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
     connectionDelete(connection_id: string): Promise<{
         id: string;
         connection_name: string;
-        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
         authorize_url: string;
         token_url: string;
         userinfo_url: string;
@@ -2339,6 +2391,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         authorize_params: {
             [key: string]: string;
         };
+        provider_options?: {
+            team_id?: string | undefined;
+            key_id?: string | undefined;
+        } | undefined;
         claims_mapping?: {
             [key: string]: string;
         } | undefined;
@@ -2381,7 +2437,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
     connectionGet(connection_id: string): Promise<{
         id: string;
         connection_name: string;
-        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
         authorize_url: string;
         token_url: string;
         userinfo_url: string;
@@ -2397,6 +2453,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         authorize_params: {
             [key: string]: string;
         };
+        provider_options?: {
+            team_id?: string | undefined;
+            key_id?: string | undefined;
+        } | undefined;
         claims_mapping?: {
             [key: string]: string;
         } | undefined;
@@ -2440,7 +2500,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         all: () => Promise<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -2456,6 +2516,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             authorize_params: {
                 [key: string]: string;
             };
+            provider_options?: {
+                team_id?: string | undefined;
+                key_id?: string | undefined;
+            } | undefined;
             claims_mapping?: {
                 [key: string]: string;
             } | undefined;
@@ -2481,7 +2545,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         first: () => Promise<import("@faable/sdk-base/dist/helpers/paginator.js").Page<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -2497,6 +2561,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             authorize_params: {
                 [key: string]: string;
             };
+            provider_options?: {
+                team_id?: string | undefined;
+                key_id?: string | undefined;
+            } | undefined;
             claims_mapping?: {
                 [key: string]: string;
             } | undefined;
@@ -2525,7 +2593,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined) => Promise<import("@faable/sdk-base/dist/helpers/paginator.js").Page<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -2541,6 +2609,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             authorize_params: {
                 [key: string]: string;
             };
+            provider_options?: {
+                team_id?: string | undefined;
+                key_id?: string | undefined;
+            } | undefined;
             claims_mapping?: {
                 [key: string]: string;
             } | undefined;
@@ -2584,7 +2656,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
     connectionUpdate(connection_id: string, data: OpBody<"connection/update">): Promise<{
         id: string;
         connection_name: string;
-        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+        connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
         authorize_url: string;
         token_url: string;
         userinfo_url: string;
@@ -2600,6 +2672,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         authorize_params: {
             [key: string]: string;
         };
+        provider_options?: {
+            team_id?: string | undefined;
+            key_id?: string | undefined;
+        } | undefined;
         claims_mapping?: {
             [key: string]: string;
         } | undefined;

package/dist/api/types.d.ts

@@ -4874,7 +4874,11 @@ export interface paths {
          */
         get: operations["callback"];
         put?: never;
-        post?: never;
+        /**
+         * OAuth2 Callback URL (form_post)
+         * @description Callback for providers that use `response_mode=form_post` (Sign in with Apple). Redirects (303) to `GET /callback` with the same `code` and `state`.
+         */
+        post: operations["callbackFormPost"];
         delete?: never;
         options?: never;
         head?: never;
@@ -5695,7 +5699,7 @@ export interface components {
             id: string;
             connection_name: string;
             /** @enum {unknown} */
-            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             /** @default null */
             authorize_url: string;
             /** @default null */
@@ -5726,6 +5730,13 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+            provider_options?: {
+                /** @description Apple: the Apple Developer Team ID (10 characters). */
+                team_id?: string;
+                /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                key_id?: string;
+            };
             claims_mapping?: {
                 [key: string]: string;
             };
@@ -5771,7 +5782,7 @@ export interface components {
         ConnectionCreate: {
             connection_name: string;
             /** @enum {unknown} */
-            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             authorize_url?: string;
             client_id?: string;
             client_secret?: string;
@@ -5793,6 +5804,13 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+            provider_options?: {
+                /** @description Apple: the Apple Developer Team ID (10 characters). */
+                team_id?: string;
+                /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                key_id?: string;
+            };
             /**
              * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
              *
@@ -5842,6 +5860,13 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+            provider_options?: {
+                /** @description Apple: the Apple Developer Team ID (10 characters). */
+                team_id?: string;
+                /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                key_id?: string;
+            };
             claims_mapping?: {
                 [key: string]: string;
             };
@@ -5862,7 +5887,7 @@ export interface components {
         /** @description Presentation metadata for one connection type. Contains no endpoint URLs and no credentials. */
         ConnectionTypeInfo: {
             /** @enum {unknown} */
-            type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
             /** @description Brand name for this provider. Not translatable — "GitHub" is "GitHub" in every locale. */
             label: string;
             /** @description Stable icon slug (e.g. `github`, `google`, `microsoft`). Clients map it to their own icon set; it is not a URL. */
@@ -5883,6 +5908,17 @@ export interface components {
                 label: string;
                 url: string;
             };
+            /** @description The credentials a tenant fills in for its own app, when they are more than a client id and a secret (Apple). Absent means client id + secret. */
+            credential_fields?: {
+                /** @description Connection field this input writes, as a dotted path (`client_id`, `provider_options.team_id`). */
+                key: string;
+                label: string;
+                description?: string;
+                /** @description A credential: render it as a password input. */
+                secret?: boolean;
+                /** @description A PEM key, not a one-line value. */
+                multiline?: boolean;
+            }[];
         };
         /** @description One method the login screen should offer. Discriminated by `kind`. Connection methods carry only what a login screen needs — never credentials, endpoints or the rest of the Connection document. */
         LoginOptionMethod: {
@@ -11264,7 +11300,7 @@ export interface operations {
                 "application/json": {
                     connection_name: string;
                     /** @enum {unknown} */
-                    connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+                    connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
                     authorize_url?: string;
                     client_id?: string;
                     client_secret?: string;
@@ -11286,6 +11322,13 @@ export interface operations {
                     authorize_params?: {
                         [key: string]: string;
                     };
+                    /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+                    provider_options?: {
+                        /** @description Apple: the Apple Developer Team ID (10 characters). */
+                        team_id?: string;
+                        /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                        key_id?: string;
+                    };
                     /**
                      * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
                      *
@@ -11324,7 +11367,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -11355,6 +11398,13 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+                        provider_options?: {
+                            /** @description Apple: the Apple Developer Team ID (10 characters). */
+                            team_id?: string;
+                            /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                            key_id?: string;
+                        };
                         claims_mapping?: {
                             [key: string]: string;
                         };
@@ -11497,7 +11547,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -11528,6 +11578,13 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+                        provider_options?: {
+                            /** @description Apple: the Apple Developer Team ID (10 characters). */
+                            team_id?: string;
+                            /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                            key_id?: string;
+                        };
                         claims_mapping?: {
                             [key: string]: string;
                         };
@@ -11686,6 +11743,13 @@ export interface operations {
                     authorize_params?: {
                         [key: string]: string;
                     };
+                    /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+                    provider_options?: {
+                        /** @description Apple: the Apple Developer Team ID (10 characters). */
+                        team_id?: string;
+                        /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                        key_id?: string;
+                    };
                     claims_mapping?: {
                         [key: string]: string;
                     };
@@ -11717,7 +11781,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -11748,6 +11812,13 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+                        provider_options?: {
+                            /** @description Apple: the Apple Developer Team ID (10 characters). */
+                            team_id?: string;
+                            /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                            key_id?: string;
+                        };
                         claims_mapping?: {
                             [key: string]: string;
                         };
@@ -11896,7 +11967,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "apple" | "facebook" | "linkedin" | "discord" | "gitlab" | "slack" | "x" | "twitch" | "bitbucket" | "spotify" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -11927,6 +11998,13 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        /** @description Provider-specific settings beyond client_id/client_secret. Only `apple` uses them. */
+                        provider_options?: {
+                            /** @description Apple: the Apple Developer Team ID (10 characters). */
+                            team_id?: string;
+                            /** @description Apple: the Key ID of the Sign in with Apple private key. */
+                            key_id?: string;
+                        };
                         claims_mapping?: {
                             [key: string]: string;
                         };
@@ -33392,8 +33470,10 @@ export interface operations {
             query: {
                 /** @description A ticket from `POST /oauth/link_ticket`, single use. */
                 ticket: string;
-                /** @description Where to go once the session is open: a path of this host under `/flow/` (e.g. `/flow/account/security?client_id=…`). */
+                /** @description Where to go once the session is open: a path of this host under `/flow/` (e.g. `/flow/account/security?client_id=…`), or — with `client_id` — a URL on one of that client’s own origins (its `web_origins` or the origin of a registered callback). */
                 redirect_to: string;
+                /** @description The OAuth `client_id` the ticket was minted for. Required when `redirect_to` leaves `/flow/`: it is what the return URL is checked against, before the ticket is spent. */
+                client_id?: string;
             };
             header?: never;
             path?: never;
@@ -34255,6 +34335,83 @@ export interface operations {
             };
         };
     };
+    callbackFormPost: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    code?: string;
+                    state?: string;
+                    error?: string;
+                    error_uri?: string;
+                    error_description?: string;
+                    user?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     oauth_continue: {
         parameters: {
             query: {

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.8.10";
+export const version = "2.8.12";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "5e45325";
+export const commit = "a76f608";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.8.10",
+  "version": "2.8.12",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.82.1",
+    "version": "2.83.1",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -698,6 +698,16 @@
               "google_oauth2",
               "microsoft",
               "oidc",
+              "apple",
+              "facebook",
+              "linkedin",
+              "discord",
+              "gitlab",
+              "slack",
+              "x",
+              "twitch",
+              "bitbucket",
+              "spotify",
               "passwordless_email"
             ]
           },
@@ -764,6 +774,21 @@
               "type": "string"
             }
           },
+          "provider_options": {
+            "type": "object",
+            "properties": {
+              "team_id": {
+                "type": "string",
+                "description": "Apple: the Apple Developer Team ID (10 characters)."
+              },
+              "key_id": {
+                "type": "string",
+                "description": "Apple: the Key ID of the Sign in with Apple private key."
+              }
+            },
+            "additionalProperties": false,
+            "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+          },
           "claims_mapping": {
             "type": "object",
             "additionalProperties": {
@@ -927,6 +952,16 @@
               "google_oauth2",
               "microsoft",
               "oidc",
+              "apple",
+              "facebook",
+              "linkedin",
+              "discord",
+              "gitlab",
+              "slack",
+              "x",
+              "twitch",
+              "bitbucket",
+              "spotify",
               "passwordless_email"
             ]
           },
@@ -978,6 +1013,21 @@
               "type": "string"
             }
           },
+          "provider_options": {
+            "type": "object",
+            "properties": {
+              "team_id": {
+                "type": "string",
+                "description": "Apple: the Apple Developer Team ID (10 characters)."
+              },
+              "key_id": {
+                "type": "string",
+                "description": "Apple: the Key ID of the Sign in with Apple private key."
+              }
+            },
+            "additionalProperties": false,
+            "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+          },
           "email_oauth_sync_policy": {
             "anyOf": [
               {
@@ -1150,6 +1200,21 @@
               "type": "string"
             }
           },
+          "provider_options": {
+            "type": "object",
+            "properties": {
+              "team_id": {
+                "type": "string",
+                "description": "Apple: the Apple Developer Team ID (10 characters)."
+              },
+              "key_id": {
+                "type": "string",
+                "description": "Apple: the Key ID of the Sign in with Apple private key."
+              }
+            },
+            "additionalProperties": false,
+            "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+          },
           "claims_mapping": {
             "type": "object",
             "additionalProperties": {
@@ -1297,6 +1362,16 @@
               "google_oauth2",
               "microsoft",
               "oidc",
+              "apple",
+              "facebook",
+              "linkedin",
+              "discord",
+              "gitlab",
+              "slack",
+              "x",
+              "twitch",
+              "bitbucket",
+              "spotify",
               "passwordless_email"
             ]
           },
@@ -1348,6 +1423,38 @@
               }
             },
             "description": "Provider documentation for tenants registering their own OAuth app."
+          },
+          "credential_fields": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "key",
+                "label"
+              ],
+              "properties": {
+                "key": {
+                  "type": "string",
+                  "description": "Connection field this input writes, as a dotted path (`client_id`, `provider_options.team_id`)."
+                },
+                "label": {
+                  "type": "string"
+                },
+                "description": {
+                  "type": "string"
+                },
+                "secret": {
+                  "type": "boolean",
+                  "description": "A credential: render it as a password input."
+                },
+                "multiline": {
+                  "type": "boolean",
+                  "description": "A PEM key, not a one-line value."
+                }
+              },
+              "additionalProperties": false
+            },
+            "description": "The credentials a tenant fills in for its own app, when they are more than a client id and a secret (Apple). Absent means client id + secret."
           }
         },
         "description": "Presentation metadata for one connection type. Contains no endpoint URLs and no credentials.",
@@ -17058,6 +17165,16 @@
                       "google_oauth2",
                       "microsoft",
                       "oidc",
+                      "apple",
+                      "facebook",
+                      "linkedin",
+                      "discord",
+                      "gitlab",
+                      "slack",
+                      "x",
+                      "twitch",
+                      "bitbucket",
+                      "spotify",
                       "passwordless_email"
                     ]
                   },
@@ -17109,6 +17226,21 @@
                       "type": "string"
                     }
                   },
+                  "provider_options": {
+                    "type": "object",
+                    "properties": {
+                      "team_id": {
+                        "type": "string",
+                        "description": "Apple: the Apple Developer Team ID (10 characters)."
+                      },
+                      "key_id": {
+                        "type": "string",
+                        "description": "Apple: the Key ID of the Sign in with Apple private key."
+                      }
+                    },
+                    "additionalProperties": false,
+                    "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+                  },
                   "email_oauth_sync_policy": {
                     "anyOf": [
                       {
@@ -17275,6 +17407,16 @@
                         "google_oauth2",
                         "microsoft",
                         "oidc",
+                        "apple",
+                        "facebook",
+                        "linkedin",
+                        "discord",
+                        "gitlab",
+                        "slack",
+                        "x",
+                        "twitch",
+                        "bitbucket",
+                        "spotify",
                         "passwordless_email"
                       ]
                     },
@@ -17341,6 +17483,21 @@
                         "type": "string"
                       }
                     },
+                    "provider_options": {
+                      "type": "object",
+                      "properties": {
+                        "team_id": {
+                          "type": "string",
+                          "description": "Apple: the Apple Developer Team ID (10 characters)."
+                        },
+                        "key_id": {
+                          "type": "string",
+                          "description": "Apple: the Key ID of the Sign in with Apple private key."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+                    },
                     "claims_mapping": {
                       "type": "object",
                       "additionalProperties": {
@@ -17704,6 +17861,16 @@
                         "google_oauth2",
                         "microsoft",
                         "oidc",
+                        "apple",
+                        "facebook",
+                        "linkedin",
+                        "discord",
+                        "gitlab",
+                        "slack",
+                        "x",
+                        "twitch",
+                        "bitbucket",
+                        "spotify",
                         "passwordless_email"
                       ]
                     },
@@ -17770,6 +17937,21 @@
                         "type": "string"
                       }
                     },
+                    "provider_options": {
+                      "type": "object",
+                      "properties": {
+                        "team_id": {
+                          "type": "string",
+                          "description": "Apple: the Apple Developer Team ID (10 characters)."
+                        },
+                        "key_id": {
+                          "type": "string",
+                          "description": "Apple: the Key ID of the Sign in with Apple private key."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+                    },
                     "claims_mapping": {
                       "type": "object",
                       "additionalProperties": {
@@ -18131,6 +18313,21 @@
                       "type": "string"
                     }
                   },
+                  "provider_options": {
+                    "type": "object",
+                    "properties": {
+                      "team_id": {
+                        "type": "string",
+                        "description": "Apple: the Apple Developer Team ID (10 characters)."
+                      },
+                      "key_id": {
+                        "type": "string",
+                        "description": "Apple: the Key ID of the Sign in with Apple private key."
+                      }
+                    },
+                    "additionalProperties": false,
+                    "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+                  },
                   "claims_mapping": {
                     "type": "object",
                     "additionalProperties": {
@@ -18320,6 +18517,16 @@
                         "google_oauth2",
                         "microsoft",
                         "oidc",
+                        "apple",
+                        "facebook",
+                        "linkedin",
+                        "discord",
+                        "gitlab",
+                        "slack",
+                        "x",
+                        "twitch",
+                        "bitbucket",
+                        "spotify",
                         "passwordless_email"
                       ]
                     },
@@ -18386,6 +18593,21 @@
                         "type": "string"
                       }
                     },
+                    "provider_options": {
+                      "type": "object",
+                      "properties": {
+                        "team_id": {
+                          "type": "string",
+                          "description": "Apple: the Apple Developer Team ID (10 characters)."
+                        },
+                        "key_id": {
+                          "type": "string",
+                          "description": "Apple: the Key ID of the Sign in with Apple private key."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+                    },
                     "claims_mapping": {
                       "type": "object",
                       "additionalProperties": {
@@ -18749,6 +18971,16 @@
                         "google_oauth2",
                         "microsoft",
                         "oidc",
+                        "apple",
+                        "facebook",
+                        "linkedin",
+                        "discord",
+                        "gitlab",
+                        "slack",
+                        "x",
+                        "twitch",
+                        "bitbucket",
+                        "spotify",
                         "passwordless_email"
                       ]
                     },
@@ -18815,6 +19047,21 @@
                         "type": "string"
                       }
                     },
+                    "provider_options": {
+                      "type": "object",
+                      "properties": {
+                        "team_id": {
+                          "type": "string",
+                          "description": "Apple: the Apple Developer Team ID (10 characters)."
+                        },
+                        "key_id": {
+                          "type": "string",
+                          "description": "Apple: the Key ID of the Sign in with Apple private key."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Provider-specific settings beyond client_id/client_secret. Only `apple` uses them."
+                    },
                     "claims_mapping": {
                       "type": "object",
                       "additionalProperties": {
@@ -71903,7 +72150,16 @@
             "in": "query",
             "name": "redirect_to",
             "required": true,
-            "description": "Where to go once the session is open: a path of this host under `/flow/` (e.g. `/flow/account/security?client_id=…`)."
+            "description": "Where to go once the session is open: a path of this host under `/flow/` (e.g. `/flow/account/security?client_id=…`), or — with `client_id` — a URL on one of that client’s own origins (its `web_origins` or the origin of a registered callback)."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "client_id",
+            "required": false,
+            "description": "The OAuth `client_id` the ticket was minted for. Required when `redirect_to` leaves `/flow/`: it is what the return URL is checked against, before the ticket is spent."
           }
         ],
         "responses": {
@@ -73914,6 +74170,150 @@
             }
           }
         }
+      },
+      "post": {
+        "operationId": "callbackFormPost",
+        "summary": "OAuth2 Callback URL (form_post)",
+        "tags": [
+          "oauth"
+        ],
+        "description": "Callback for providers that use `response_mode=form_post` (Sign in with Apple). Redirects (303) to `GET /callback` with the same `code` and `state`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "type": "string"
+                  },
+                  "state": {
+                    "type": "string"
+                  },
+                  "error": {
+                    "type": "string"
+                  },
+                  "error_uri": {
+                    "type": "string"
+                  },
+                  "error_description": {
+                    "type": "string"
+                  },
+                  "user": {
+                    "type": "string",
+                    "maxLength": 4096
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response"
+          },
+          "400": {
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
       }
     },
     "/continue": {