@logto/schemas 1.37.1 → 1.38.0

package/lib/types/logto-config/jwt-customizer.js

@@ -7,14 +7,14 @@ import { GrantType } from '../oidc-config.js';
 import { scopeResponseGuard } from '../scope.js';
 import { userInfoGuard } from '../user.js';
 import { backupCodeVerificationRecordDataGuard } from '../verification-records/backup-code-verification.js';
-import { emailCodeVerificationRecordDataGuard, phoneCodeVerificationRecordDataGuard, } from '../verification-records/code-verification.js';
+import { emailCodeVerificationRecordDataGuard, mfaEmailCodeVerificationRecordDataGuard, mfaPhoneCodeVerificationRecordDataGuard, phoneCodeVerificationRecordDataGuard, } from '../verification-records/code-verification.js';
 import { enterpriseSsoVerificationRecordDataGuard } from '../verification-records/enterprise-sso-verification.js';
 import { newPasswordIdentityVerificationRecordDataGuard } from '../verification-records/new-password-identity-verification.js';
 import { oneTimeTokenVerificationRecordDataGuard } from '../verification-records/one-time-token-verification.js';
 import { passwordVerificationRecordDataGuard } from '../verification-records/password-verification.js';
 import { socialVerificationRecordDataGuard } from '../verification-records/social-verification.js';
 import { totpVerificationRecordDataGuard } from '../verification-records/totp-verification.js';
-import { webAuthnVerificationRecordDataGuard, signInWebAuthnVerificationRecordDataGuard, } from '../verification-records/web-authn-verification.js';
+import { webAuthnVerificationRecordDataGuard, signInPasskeyVerificationRecordDataGuard, } from '../verification-records/web-authn-verification.js';
 import { accessTokenPayloadGuard, clientCredentialsPayloadGuard } from './oidc-provider.js';
 export const jwtCustomizerGuard = z.object({
     script: z.string(),
@@ -59,6 +59,8 @@ const jwtCustomizerUserInteractionVerificationRecordGuard = z.discriminatedUnion
     passwordVerificationRecordDataGuard,
     emailCodeVerificationRecordDataGuard,
     phoneCodeVerificationRecordDataGuard,
+    mfaEmailCodeVerificationRecordDataGuard,
+    mfaPhoneCodeVerificationRecordDataGuard,
     socialVerificationRecordDataGuard.omit({
         connectorSession: true,
         encryptedTokenSet: true,
@@ -85,7 +87,7 @@ const jwtCustomizerUserInteractionVerificationRecordGuard = z.discriminatedUnion
         authenticationChallenge: true,
         registrationInfo: true,
     }),
-    signInWebAuthnVerificationRecordDataGuard.omit({
+    signInPasskeyVerificationRecordDataGuard.omit({
         registrationChallenge: true,
         authenticationChallenge: true,
         registrationInfo: true,
@@ -97,6 +99,8 @@ const jwtCustomizerUserInteractionVerificationRecordGuard = z.discriminatedUnion
         passwordEncryptionMethod: true,
     }),
 ]);
+// This is to ensure that all the verification types are covered in the `jwtCustomizerUserInteractionVerificationRecordGuard`.
+const _jwtCustomizerUserInteractionVerificationRecordTypeCoverage = true;
 export const jwtCustomizerUserInteractionContextGuard = z.object({
     interactionEvent: z.nativeEnum(InteractionEvent),
     userId: z.string(),

package/lib/types/oidc-config.d.ts

@@ -9,5 +9,6 @@ export declare enum GrantType {
     AuthorizationCode = "authorization_code",
     RefreshToken = "refresh_token",
     ClientCredentials = "client_credentials",
-    TokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange"
+    TokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange",
+    DeviceCode = "urn:ietf:params:oauth:grant-type:device_code"
 }

package/lib/types/oidc-config.js

@@ -4,4 +4,5 @@ export var GrantType;
     GrantType["RefreshToken"] = "refresh_token";
     GrantType["ClientCredentials"] = "client_credentials";
     GrantType["TokenExchange"] = "urn:ietf:params:oauth:grant-type:token-exchange";
+    GrantType["DeviceCode"] = "urn:ietf:params:oauth:grant-type:device_code";
 })(GrantType || (GrantType = {}));

package/lib/types/sign-in-experience.d.ts

@@ -63,10 +63,10 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     hideLogtoBranding: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     languageInfo: z.ZodType<{
         autoDetect: boolean;
-        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
     }, z.ZodTypeDef, {
         autoDetect: boolean;
-        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
     }>;
     termsOfUseUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     privacyPolicyUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
@@ -362,6 +362,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             "ca-ES"?: string | undefined;
             "cb-IQ"?: string | undefined;
             "co-FR"?: string | undefined;
+            cs?: string | undefined;
             "cs-CZ"?: string | undefined;
             "cx-PH"?: string | undefined;
             "cy-GB"?: string | undefined;
@@ -502,6 +503,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             "ca-ES"?: string | undefined;
             "cb-IQ"?: string | undefined;
             "co-FR"?: string | undefined;
+            cs?: string | undefined;
             "cs-CZ"?: string | undefined;
             "cx-PH"?: string | undefined;
             "cy-GB"?: string | undefined;
@@ -739,6 +741,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             "ca-ES"?: string | undefined;
             "cb-IQ"?: string | undefined;
             "co-FR"?: string | undefined;
+            cs?: string | undefined;
             "cs-CZ"?: string | undefined;
             "cx-PH"?: string | undefined;
             "cy-GB"?: string | undefined;
@@ -935,6 +938,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             "ca-ES"?: string | undefined;
             "cb-IQ"?: string | undefined;
             "co-FR"?: string | undefined;
+            cs?: string | undefined;
             "cs-CZ"?: string | undefined;
             "cx-PH"?: string | undefined;
             "cy-GB"?: string | undefined;

package/lib/types/user-logto-config.d.ts

@@ -8,10 +8,23 @@ export declare const userPasskeySignInDataKey = "passkey_sign_in";
  * Schema for MFA-related data stored in user's logto_config
  */
 export declare const userMfaDataGuard: z.ZodObject<{
+    /**
+     * Whether the user has actively enabled/bound MFA factors
+     *
+     * Note: The `undefined` value indicates that a new user has never made a choice on enabling the optional MFA; or an
+     * existing user data was created before the introduction of this field, so the MFA enabled state is unknown. We need
+     * to check extra conditions to determine it when the user submits the experience interaction.
+     * @see {@link @logto/core/packages/core/src/routes/experience/classes/mfa.ts#assertOptionalMfaEnablement}
+     */
+    enabled: z.ZodOptional<z.ZodBoolean>;
     /**
      * Whether the user has skipped MFA binding flow
      */
     skipped: z.ZodOptional<z.ZodBoolean>;
+    /**
+     * Whether the user has skipped optional additional MFA binding suggestion
+     */
+    additionalBindingSuggestionSkipped: z.ZodOptional<z.ZodBoolean>;
     /**
      * Whether the user has skipped MFA verification on sign-in
      *
@@ -20,10 +33,14 @@ export declare const userMfaDataGuard: z.ZodObject<{
      */
     skipMfaOnSignIn: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
+    enabled?: boolean | undefined;
     skipped?: boolean | undefined;
+    additionalBindingSuggestionSkipped?: boolean | undefined;
     skipMfaOnSignIn?: boolean | undefined;
 }, {
+    enabled?: boolean | undefined;
     skipped?: boolean | undefined;
+    additionalBindingSuggestionSkipped?: boolean | undefined;
     skipMfaOnSignIn?: boolean | undefined;
 }>;
 export type UserMfaData = z.infer<typeof userMfaDataGuard>;
@@ -46,10 +63,23 @@ export type UserPasskeySignInData = z.infer<typeof userPasskeySignInDataGuard>;
  */
 export declare const userLogtoConfigGuard: z.ZodObject<{
     mfa: z.ZodOptional<z.ZodObject<{
+        /**
+         * Whether the user has actively enabled/bound MFA factors
+         *
+         * Note: The `undefined` value indicates that a new user has never made a choice on enabling the optional MFA; or an
+         * existing user data was created before the introduction of this field, so the MFA enabled state is unknown. We need
+         * to check extra conditions to determine it when the user submits the experience interaction.
+         * @see {@link @logto/core/packages/core/src/routes/experience/classes/mfa.ts#assertOptionalMfaEnablement}
+         */
+        enabled: z.ZodOptional<z.ZodBoolean>;
         /**
          * Whether the user has skipped MFA binding flow
          */
         skipped: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether the user has skipped optional additional MFA binding suggestion
+         */
+        additionalBindingSuggestionSkipped: z.ZodOptional<z.ZodBoolean>;
         /**
          * Whether the user has skipped MFA verification on sign-in
          *
@@ -58,10 +88,14 @@ export declare const userLogtoConfigGuard: z.ZodObject<{
          */
         skipMfaOnSignIn: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
         skipped?: boolean | undefined;
+        additionalBindingSuggestionSkipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     }, {
+        enabled?: boolean | undefined;
         skipped?: boolean | undefined;
+        additionalBindingSuggestionSkipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     }>>;
     passkey_sign_in: z.ZodOptional<z.ZodObject<{
@@ -76,7 +110,9 @@ export declare const userLogtoConfigGuard: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     mfa?: {
+        enabled?: boolean | undefined;
         skipped?: boolean | undefined;
+        additionalBindingSuggestionSkipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     } | undefined;
     passkey_sign_in?: {
@@ -84,7 +120,9 @@ export declare const userLogtoConfigGuard: z.ZodObject<{
     } | undefined;
 }, {
     mfa?: {
+        enabled?: boolean | undefined;
         skipped?: boolean | undefined;
+        additionalBindingSuggestionSkipped?: boolean | undefined;
         skipMfaOnSignIn?: boolean | undefined;
     } | undefined;
     passkey_sign_in?: {

package/lib/types/user-logto-config.js

@@ -11,10 +11,23 @@ export const userPasskeySignInDataKey = 'passkey_sign_in';
  * Schema for MFA-related data stored in user's logto_config
  */
 export const userMfaDataGuard = z.object({
+    /**
+     * Whether the user has actively enabled/bound MFA factors
+     *
+     * Note: The `undefined` value indicates that a new user has never made a choice on enabling the optional MFA; or an
+     * existing user data was created before the introduction of this field, so the MFA enabled state is unknown. We need
+     * to check extra conditions to determine it when the user submits the experience interaction.
+     * @see {@link @logto/core/packages/core/src/routes/experience/classes/mfa.ts#assertOptionalMfaEnablement}
+     */
+    enabled: z.boolean().optional(),
     /**
      * Whether the user has skipped MFA binding flow
      */
     skipped: z.boolean().optional(),
+    /**
+     * Whether the user has skipped optional additional MFA binding suggestion
+     */
+    additionalBindingSuggestionSkipped: z.boolean().optional(),
     /**
      * Whether the user has skipped MFA verification on sign-in
      *