@logto/schemas 1.14.0 → 1.16.0

package/lib/types/sso-connector.d.ts

@@ -25,7 +25,12 @@ export declare enum SsoProviderName {
     SAML = "SAML",
     AZURE_AD = "AzureAD",
     GOOGLE_WORKSPACE = "GoogleWorkspace",
-    OKTA = "Okta"
+    OKTA = "Okta",
+    AZURE_AD_OIDC = "AzureAdOidc"
+}
+export declare enum SsoProviderType {
+    OIDC = "oidc",
+    SAML = "saml"
 }
 export declare const singleSignOnDomainBlackList: readonly string[];
 export type SupportedSsoConnector = Omit<SsoConnector, 'providerName'> & {
@@ -33,6 +38,7 @@ export type SupportedSsoConnector = Omit<SsoConnector, 'providerName'> & {
 };
 declare const ssoConnectorProviderDetailGuard: z.ZodObject<{
     providerName: z.ZodNativeEnum<typeof SsoProviderName>;
+    providerType: z.ZodNativeEnum<typeof SsoProviderType>;
     logo: z.ZodString;
     logoDark: z.ZodString;
     description: z.ZodString;
@@ -43,16 +49,19 @@ declare const ssoConnectorProviderDetailGuard: z.ZodObject<{
     description: string;
     logoDark: string;
     providerName: SsoProviderName;
+    providerType: SsoProviderType;
 }, {
     name: string;
     logo: string;
     description: string;
     logoDark: string;
     providerName: SsoProviderName;
+    providerType: SsoProviderType;
 }>;
 export type SsoConnectorProviderDetail = z.infer<typeof ssoConnectorProviderDetailGuard>;
 export declare const ssoConnectorProvidersResponseGuard: z.ZodArray<z.ZodObject<{
     providerName: z.ZodNativeEnum<typeof SsoProviderName>;
+    providerType: z.ZodNativeEnum<typeof SsoProviderType>;
     logo: z.ZodString;
     logoDark: z.ZodString;
     description: z.ZodString;
@@ -63,12 +72,14 @@ export declare const ssoConnectorProvidersResponseGuard: z.ZodArray<z.ZodObject<
     description: string;
     logoDark: string;
     providerName: SsoProviderName;
+    providerType: SsoProviderType;
 }, {
     name: string;
     logo: string;
     description: string;
     logoDark: string;
     providerName: SsoProviderName;
+    providerType: SsoProviderType;
 }>, "many">;
 export type SsoConnectorProvidersResponse = z.infer<typeof ssoConnectorProvidersResponseGuard>;
 export declare const ssoConnectorWithProviderConfigGuard: z.ZodObject<{
@@ -87,9 +98,10 @@ export declare const ssoConnectorWithProviderConfigGuard: z.ZodObject<{
     syncProfile: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     config: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     domains: z.ZodType<string[], z.ZodTypeDef, string[]>;
+    providerName: z.ZodNativeEnum<typeof SsoProviderName>;
     connectorName: z.ZodType<string, z.ZodTypeDef, string>;
     name: z.ZodString;
-    providerName: z.ZodNativeEnum<typeof SsoProviderName>;
+    providerType: z.ZodNativeEnum<typeof SsoProviderType>;
     providerLogo: z.ZodString;
     providerLogoDark: z.ZodString;
     providerConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -108,6 +120,7 @@ export declare const ssoConnectorWithProviderConfigGuard: z.ZodObject<{
     domains: string[];
     providerName: SsoProviderName;
     connectorName: string;
+    providerType: SsoProviderType;
     providerLogo: string;
     providerLogoDark: string;
     providerConfig?: Record<string, unknown> | undefined;
@@ -126,6 +139,7 @@ export declare const ssoConnectorWithProviderConfigGuard: z.ZodObject<{
     domains: string[];
     providerName: SsoProviderName;
     connectorName: string;
+    providerType: SsoProviderType;
     providerLogo: string;
     providerLogoDark: string;
     providerConfig?: Record<string, unknown> | undefined;

package/lib/types/sso-connector.js

@@ -16,7 +16,13 @@ export var SsoProviderName;
     SsoProviderName["AZURE_AD"] = "AzureAD";
     SsoProviderName["GOOGLE_WORKSPACE"] = "GoogleWorkspace";
     SsoProviderName["OKTA"] = "Okta";
+    SsoProviderName["AZURE_AD_OIDC"] = "AzureAdOidc";
 })(SsoProviderName || (SsoProviderName = {}));
+export var SsoProviderType;
+(function (SsoProviderType) {
+    SsoProviderType["OIDC"] = "oidc";
+    SsoProviderType["SAML"] = "saml";
+})(SsoProviderType || (SsoProviderType = {}));
 export const singleSignOnDomainBlackList = Object.freeze([
     'gmail.com',
     'yahoo.com',
@@ -40,6 +46,7 @@ export const singleSignOnDomainBlackList = Object.freeze([
 ]);
 const ssoConnectorProviderDetailGuard = z.object({
     providerName: z.nativeEnum(SsoProviderName),
+    providerType: z.nativeEnum(SsoProviderType),
     logo: z.string(),
     logoDark: z.string(),
     description: z.string(),
@@ -48,11 +55,17 @@ const ssoConnectorProviderDetailGuard = z.object({
 export const ssoConnectorProvidersResponseGuard = z.array(ssoConnectorProviderDetailGuard);
 // API response guard for all the SSO connectors CRUD APIs
 export const ssoConnectorWithProviderConfigGuard = SsoConnectors.guard
-    .omit({ providerName: true })
-    .merge(z.object({
-    name: z.string(), // For display purpose, generate from i18n key name defined by SSO factory.
-    providerName: z.nativeEnum(SsoProviderName),
+    // Must be a supported SSO provider name. Overwrite the providerName string type to enum.
+    .extend({ providerName: z.nativeEnum(SsoProviderName) })
+    .merge(
+// Static provider details
+z.object({
+    name: z.string(),
+    providerType: z.nativeEnum(SsoProviderType),
     providerLogo: z.string(),
     providerLogoDark: z.string(),
+    // SSO connection config parsed from the provider.
+    // - OIDC: connection config fetched from the OIDC provider.
+    // - SAML: connection config fetched from the metadata url or metadata file.
     providerConfig: z.record(z.unknown()).optional(),
 }));

package/lib/types/system.d.ts

@@ -153,14 +153,14 @@ export declare const demoSocialDataGuard: z.ZodArray<z.ZodObject<{
     name: string;
     logo: string;
     logoDark: string;
-    provider: DemoSocialProvider;
     clientId: string;
+    provider: DemoSocialProvider;
 }, {
     name: string;
     logo: string;
     logoDark: string;
-    provider: DemoSocialProvider;
     clientId: string;
+    provider: DemoSocialProvider;
 }>, "many">;
 export type DemoSocialData = z.infer<typeof demoSocialDataGuard>;
 export declare enum DemoSocialKey {
@@ -206,15 +206,42 @@ export declare const protectedAppConfigProviderDataGuard: z.ZodObject<{
     keyName: string;
 }>;
 export type ProtectedAppConfigProviderData = z.infer<typeof protectedAppConfigProviderDataGuard>;
+/**
+ * Cloudflare workers config for custom JWT.
+ * Ref: https://developers.cloudflare.com/api/
+ */
+export declare const customJwtWorkerConfigGuard: z.ZodObject<{
+    /** Cloudflare API Key (api_key). */
+    apiKey: z.ZodString;
+    /** Cloudflare API Key (api_email). */
+    apiEmail: z.ZodString;
+    /** Cloudflare account ID. */
+    accountId: z.ZodString;
+    /** Default Cloudflare subdomain for the account. */
+    subdomain: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    accountId: string;
+    apiKey: string;
+    apiEmail: string;
+    subdomain: string;
+}, {
+    accountId: string;
+    apiKey: string;
+    apiEmail: string;
+    subdomain: string;
+}>;
+export type CustomJwtWorkerConfig = z.infer<typeof customJwtWorkerConfigGuard>;
 export declare enum CloudflareKey {
     HostnameProvider = "cloudflareHostnameProvider",
     ProtectedAppConfigProvider = "cloudflareProtectedAppConfigProvider",
-    ProtectedAppHostnameProvider = "cloudflareProtectedAppHostnameProvider"
+    ProtectedAppHostnameProvider = "cloudflareProtectedAppHostnameProvider",
+    CustomJwtWorkerConfig = "cloudflareCustomJwtWorkerConfig"
 }
 export type CloudflareType = {
     [CloudflareKey.HostnameProvider]: HostnameProviderData;
     [CloudflareKey.ProtectedAppConfigProvider]: ProtectedAppConfigProviderData;
     [CloudflareKey.ProtectedAppHostnameProvider]: HostnameProviderData;
+    [CloudflareKey.CustomJwtWorkerConfig]: CustomJwtWorkerConfig;
 };
 export declare const cloudflareGuard: Readonly<{
     [key in CloudflareKey]: ZodType<CloudflareType[key]>;

package/lib/types/system.js

@@ -114,16 +114,32 @@ export const protectedAppConfigProviderDataGuard = z.object({
     domain: z.string(),
     apiToken: z.string(), // Requires account permission for "KV Storage Edit"
 });
+/**
+ * Cloudflare workers config for custom JWT.
+ * Ref: https://developers.cloudflare.com/api/
+ */
+export const customJwtWorkerConfigGuard = z.object({
+    /** Cloudflare API Key (api_key). */
+    apiKey: z.string(),
+    /** Cloudflare API Key (api_email). */
+    apiEmail: z.string(),
+    /** Cloudflare account ID. */
+    accountId: z.string(),
+    /** Default Cloudflare subdomain for the account. */
+    subdomain: z.string(),
+});
 export var CloudflareKey;
 (function (CloudflareKey) {
     CloudflareKey["HostnameProvider"] = "cloudflareHostnameProvider";
     CloudflareKey["ProtectedAppConfigProvider"] = "cloudflareProtectedAppConfigProvider";
     CloudflareKey["ProtectedAppHostnameProvider"] = "cloudflareProtectedAppHostnameProvider";
+    CloudflareKey["CustomJwtWorkerConfig"] = "cloudflareCustomJwtWorkerConfig";
 })(CloudflareKey || (CloudflareKey = {}));
 export const cloudflareGuard = Object.freeze({
     [CloudflareKey.HostnameProvider]: hostnameProviderDataGuard,
     [CloudflareKey.ProtectedAppConfigProvider]: protectedAppConfigProviderDataGuard,
     [CloudflareKey.ProtectedAppHostnameProvider]: hostnameProviderDataGuard,
+    [CloudflareKey.CustomJwtWorkerConfig]: customJwtWorkerConfigGuard,
 });
 export const systemKeys = Object.freeze([
     ...Object.values(AlterationStateKey),

package/lib/types/tenant-organization.d.ts

@@ -9,6 +9,8 @@
 import { type CreateOrganization, type OrganizationRole, type OrganizationScope } from '../db-entries/index.js';
 /** Given a tenant ID, return the corresponding organization ID in the admin tenant. */
 export declare const getTenantOrganizationId: (tenantId: string) => string;
+/** Given an admin tenant organization ID, check the format and return the corresponding user tenant ID. */
+export declare const getTenantIdFromOrganizationId: (organizationId: string) => string;
 /**
  * Given a tenant ID, return the organization create data for the admin tenant. It follows a
  * convention to generate the organization ID and name which can be used across the system.
@@ -41,6 +43,8 @@ export declare enum TenantScope {
     WriteData = "write:data",
     /** Delete data of the tenant. */
     DeleteData = "delete:data",
+    /** Read members of the tenant. */
+    ReadMember = "read:member",
     /** Invite members to the tenant. */
     InviteMember = "invite:member",
     /** Remove members from the tenant. */
@@ -78,22 +82,22 @@ export declare const getTenantScope: (scope: TenantScope) => Readonly<Organizati
 export declare enum TenantRole {
     /** Admin of the tenant, who has all permissions. */
     Admin = "admin",
-    /** Member of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
-    Member = "member"
+    /** Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
+    Collaborator = "collaborator"
 }
 /**
  * Given a tenant role, return the corresponding organization role data in the admin tenant.
  *
  * @example
  * ```ts
- * const role = TenantRole.Member; // 'member'
+ * const role = TenantRole.Collaborator; // 'collaborator'
  * const roleData = getTenantRole(role);
  *
  * expect(roleData).toEqual({
  *   tenantId: 'admin',
- *   id: 'member',
- *   name: 'member',
- *   description: 'Member of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
+ *   id: 'collaborator',
+ *   name: 'collaborator',
+ *   description: 'Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
  * });
  * ```
  *

package/lib/types/tenant-organization.js

@@ -9,6 +9,13 @@
 import { adminTenantId } from '../seeds/tenant.js';
 /** Given a tenant ID, return the corresponding organization ID in the admin tenant. */
 export const getTenantOrganizationId = (tenantId) => `t-${tenantId}`;
+/** Given an admin tenant organization ID, check the format and return the corresponding user tenant ID. */
+export const getTenantIdFromOrganizationId = (organizationId) => {
+    if (!organizationId.startsWith('t-')) {
+        throw new Error(`Invalid admin tenant organization ID: ${organizationId}`);
+    }
+    return organizationId.slice(2);
+};
 /**
  * Given a tenant ID, return the organization create data for the admin tenant. It follows a
  * convention to generate the organization ID and name which can be used across the system.
@@ -46,6 +53,8 @@ export var TenantScope;
     TenantScope["WriteData"] = "write:data";
     /** Delete data of the tenant. */
     TenantScope["DeleteData"] = "delete:data";
+    /** Read members of the tenant. */
+    TenantScope["ReadMember"] = "read:member";
     /** Invite members to the tenant. */
     TenantScope["InviteMember"] = "invite:member";
     /** Remove members from the tenant. */
@@ -84,6 +93,7 @@ const tenantScopeDescriptions = Object.freeze({
     [TenantScope.ReadData]: 'Read the tenant data.',
     [TenantScope.WriteData]: 'Write the tenant data, including creating and updating the tenant.',
     [TenantScope.DeleteData]: 'Delete data of the tenant.',
+    [TenantScope.ReadMember]: 'Read members of the tenant.',
     [TenantScope.InviteMember]: 'Invite members to the tenant.',
     [TenantScope.RemoveMember]: 'Remove members from the tenant.',
     [TenantScope.UpdateMemberRole]: 'Update the role of a member in the tenant.',
@@ -99,26 +109,26 @@ export var TenantRole;
 (function (TenantRole) {
     /** Admin of the tenant, who has all permissions. */
     TenantRole["Admin"] = "admin";
-    /** Member of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
-    TenantRole["Member"] = "member";
+    /** Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
+    TenantRole["Collaborator"] = "collaborator";
 })(TenantRole || (TenantRole = {}));
 const tenantRoleDescriptions = Object.freeze({
     [TenantRole.Admin]: 'Admin of the tenant, who has all permissions.',
-    [TenantRole.Member]: 'Member of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
+    [TenantRole.Collaborator]: 'Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
 });
 /**
  * Given a tenant role, return the corresponding organization role data in the admin tenant.
  *
  * @example
  * ```ts
- * const role = TenantRole.Member; // 'member'
+ * const role = TenantRole.Collaborator; // 'collaborator'
  * const roleData = getTenantRole(role);
  *
  * expect(roleData).toEqual({
  *   tenantId: 'admin',
- *   id: 'member',
- *   name: 'member',
- *   description: 'Member of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
+ *   id: 'collaborator',
+ *   name: 'collaborator',
+ *   description: 'Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
  * });
  * ```
  *
@@ -136,10 +146,10 @@ export const getTenantRole = (role) => Object.freeze({
  */
 export const tenantRoleScopes = Object.freeze({
     [TenantRole.Admin]: allTenantScopes,
-    [TenantRole.Member]: [
+    [TenantRole.Collaborator]: [
         TenantScope.ReadData,
         TenantScope.WriteData,
         TenantScope.DeleteData,
-        TenantScope.InviteMember,
+        TenantScope.ReadMember,
     ],
 });