@faable/auth-sdk 2.9.7 → 2.9.9

package/dist/api/types.d.ts

@@ -8585,6 +8585,10 @@ export interface components {
             /** @description An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks. */
             state?: string;
             response_type?: string;
+            /** @description PKCE challenge, without a `state` only. */
+            code_challenge?: string;
+            /** @description Only `S256` is supported. */
+            code_challenge_method?: string;
             /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
             redirect_to?: string;
             /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`): `true` keeps the session for `remember_me_days`, `false` ends it when the browser closes. */
@@ -37316,6 +37320,10 @@ export interface operations {
                     /** @description An opaque value the applications adds to the initial request that the authorization server includes when redirecting the back to the application. This value must be used by the application to prevent CSRF attacks. */
                     state?: string;
                     response_type?: string;
+                    /** @description PKCE challenge, without a `state` only. */
+                    code_challenge?: string;
+                    /** @description Only `S256` is supported. */
+                    code_challenge_method?: string;
                     /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
                     redirect_to?: string;
                     /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`): `true` keeps the session for `remember_me_days`, `false` ends it when the browser closes. */
@@ -37363,6 +37371,8 @@ export interface operations {
              *
              *     `invalid_credentials` — The email/username or password is incorrect.
              *
+             *     `invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -37372,7 +37382,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_code" | "invalid_connection" | "invalid_credentials" | "validation_error";
+                        error_code?: "invalid_code" | "invalid_connection" | "invalid_credentials" | "invalid_request" | "validation_error";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.9.7";
+export const version = "2.9.9";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "70e9f25";
+export const commit = "dba1c7a";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.9.7",
+  "version": "2.9.9",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.96.1",
+    "version": "2.97.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -9619,6 +9619,14 @@
           "response_type": {
             "type": "string"
           },
+          "code_challenge": {
+            "type": "string",
+            "description": "PKCE challenge, without a `state` only."
+          },
+          "code_challenge_method": {
+            "type": "string",
+            "description": "Only `S256` is supported."
+          },
           "redirect_to": {
             "type": "string",
             "description": "Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored."
@@ -80400,6 +80408,14 @@
                   "response_type": {
                     "type": "string"
                   },
+                  "code_challenge": {
+                    "type": "string",
+                    "description": "PKCE challenge, without a `state` only."
+                  },
+                  "code_challenge_method": {
+                    "type": "string",
+                    "description": "Only `S256` is supported."
+                  },
                   "redirect_to": {
                     "type": "string",
                     "description": "Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored."
@@ -80475,7 +80491,7 @@
             "description": "Default Response"
           },
           "400": {
-            "description": "`invalid_code` — The verification code is wrong, expired or already used.\n\n`invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.\n\n`invalid_credentials` — The email/username or password is incorrect.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_code` — The verification code is wrong, expired or already used.\n\n`invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.\n\n`invalid_credentials` — The email/username or password is incorrect.\n\n`invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -80492,6 +80508,7 @@
                             "invalid_code",
                             "invalid_connection",
                             "invalid_credentials",
+                            "invalid_request",
                             "validation_error"
                           ]
                         }