@logto/schemas 1.40.1 → 1.42.0

package/lib/types/logto-config/jwt-customizer.d.ts

@@ -106,6 +106,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../../foundations/index.js").MfaFactor.WebAuthn;
@@ -133,6 +134,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../../foundations/index.js").MfaFactor.WebAuthn;
@@ -157,7 +159,9 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: ZodType<number, z.ZodTypeDef, number>;
     updatedAt: ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
@@ -863,10 +867,13 @@ export declare const jwtCustomizerUserInteractionContextGuard: z.ZodObject<{
         }>;
         oneTimeTokenContext: z.ZodOptional<z.ZodObject<{
             jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof InteractionEvent>>;
         }, "strip", z.ZodTypeAny, {
             jitOrganizationIds?: string[] | undefined;
+            interactionEvent?: InteractionEvent | undefined;
         }, {
             jitOrganizationIds?: string[] | undefined;
+            interactionEvent?: InteractionEvent | undefined;
         }>>;
     }, "strip", z.ZodTypeAny, {
         type: VerificationType.OneTimeToken;
@@ -878,6 +885,7 @@ export declare const jwtCustomizerUserInteractionContextGuard: z.ZodObject<{
         verified: boolean;
         oneTimeTokenContext?: {
             jitOrganizationIds?: string[] | undefined;
+            interactionEvent?: InteractionEvent | undefined;
         } | undefined;
     }, {
         type: VerificationType.OneTimeToken;
@@ -889,6 +897,7 @@ export declare const jwtCustomizerUserInteractionContextGuard: z.ZodObject<{
         verified: boolean;
         oneTimeTokenContext?: {
             jitOrganizationIds?: string[] | undefined;
+            interactionEvent?: InteractionEvent | undefined;
         } | undefined;
     }>, z.ZodObject<Omit<{
         id: z.ZodString;
@@ -982,6 +991,7 @@ export declare const jwtCustomizerUserInteractionContextGuard: z.ZodObject<{
         verified: boolean;
         oneTimeTokenContext?: {
             jitOrganizationIds?: string[] | undefined;
+            interactionEvent?: InteractionEvent | undefined;
         } | undefined;
     } | {
         type: VerificationType.Password;
@@ -1096,6 +1106,7 @@ export declare const jwtCustomizerUserInteractionContextGuard: z.ZodObject<{
         verified: boolean;
         oneTimeTokenContext?: {
             jitOrganizationIds?: string[] | undefined;
+            interactionEvent?: InteractionEvent | undefined;
         } | undefined;
     } | {
         type: VerificationType.Password;
@@ -1273,6 +1284,54 @@ export declare const jwtCustomizerApplicationContextGuard: z.ZodObject<Omit<{
     isThirdParty: boolean;
     appLevelAccessControlEnabled: boolean;
 }>;
+/**
+ * The target organization context for organization (API resource) access tokens.
+ *
+ * Only populated when the token is being issued for a specific organization (i.e. the
+ * `organization_id` request parameter is present), letting the customizer attach per-org
+ * claims without embedding every organization the user belongs to.
+ */
+export declare const jwtCustomizerOrganizationContextGuard: z.ZodObject<Pick<{
+    tenantId: ZodType<string, z.ZodTypeDef, string>;
+    id: ZodType<string, z.ZodTypeDef, string>;
+    name: ZodType<string, z.ZodTypeDef, string>;
+    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+    customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+    color: ZodType<Partial<{
+        primaryColor: string;
+        isDarkModeEnabled: boolean;
+        darkPrimaryColor: string;
+    }>, z.ZodTypeDef, Partial<{
+        primaryColor: string;
+        isDarkModeEnabled: boolean;
+        darkPrimaryColor: string;
+    }>>;
+    branding: ZodType<{
+        logoUrl?: string | undefined;
+        darkLogoUrl?: string | undefined;
+        favicon?: string | undefined;
+        darkFavicon?: string | undefined;
+    }, z.ZodTypeDef, {
+        logoUrl?: string | undefined;
+        darkLogoUrl?: string | undefined;
+        favicon?: string | undefined;
+        darkFavicon?: string | undefined;
+    }>;
+    customCss: ZodType<string | null, z.ZodTypeDef, string | null>;
+    createdAt: ZodType<number, z.ZodTypeDef, number>;
+}, "name" | "id" | "customData" | "description">, "strip", z.ZodTypeAny, {
+    name: string;
+    id: string;
+    customData: import("@withtyped/server/lib/types.js").JsonObject;
+    description: string | null;
+}, {
+    name: string;
+    id: string;
+    customData: import("@withtyped/server/lib/types.js").JsonObject;
+    description: string | null;
+}>;
+export type JwtCustomizerOrganizationContext = z.infer<typeof jwtCustomizerOrganizationContextGuard>;
 export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -2124,10 +2183,13 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 }>;
                 oneTimeTokenContext: z.ZodOptional<z.ZodObject<{
                     jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                    interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof InteractionEvent>>;
                 }, "strip", z.ZodTypeAny, {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 }, {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 }>>;
             }, "strip", z.ZodTypeAny, {
                 type: VerificationType.OneTimeToken;
@@ -2139,6 +2201,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             }, {
                 type: VerificationType.OneTimeToken;
@@ -2150,6 +2213,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             }>, z.ZodObject<Omit<{
                 id: z.ZodString;
@@ -2243,6 +2307,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -2357,6 +2422,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -2611,6 +2677,22 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         }>>;
+        organization: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            description: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
@@ -2734,6 +2816,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -2799,6 +2887,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -2976,6 +3065,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -3041,6 +3136,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -3222,6 +3318,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -3287,6 +3389,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -3482,6 +3585,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -3547,6 +3656,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -4944,10 +5054,13 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 }>;
                 oneTimeTokenContext: z.ZodOptional<z.ZodObject<{
                     jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                    interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof InteractionEvent>>;
                 }, "strip", z.ZodTypeAny, {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 }, {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 }>>;
             }, "strip", z.ZodTypeAny, {
                 type: VerificationType.OneTimeToken;
@@ -4959,6 +5072,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             }, {
                 type: VerificationType.OneTimeToken;
@@ -4970,6 +5084,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             }>, z.ZodObject<Omit<{
                 id: z.ZodString;
@@ -5063,6 +5178,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -5177,6 +5293,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -5431,6 +5548,22 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         }>>;
+        organization: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            description: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
@@ -5554,6 +5687,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -5619,6 +5758,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -5796,6 +5936,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -5861,6 +6007,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -6056,6 +6203,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -6121,6 +6274,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -6316,6 +6470,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -6381,6 +6541,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 verified: boolean;
                 oneTimeTokenContext?: {
                     jitOrganizationIds?: string[] | undefined;
+                    interactionEvent?: InteractionEvent | undefined;
                 } | undefined;
             } | {
                 type: VerificationType.Password;
@@ -6977,7 +7138,7 @@ export declare const customJwtErrorBodyGuard: z.ZodObject<{
 export type CustomJwtErrorBody = z.infer<typeof customJwtErrorBodyGuard>;
 export type CustomJwtApiContext = {
     /**
-     * Reject the the current token request.
+     * Reject the current token request.
      *
      * @remarks
      * By calling this function, the current token request will be rejected,

package/lib/types/logto-config/jwt-customizer.js

@@ -111,6 +111,19 @@ export const jwtCustomizerUserInteractionContextGuard = z.object({
 export const jwtCustomizerApplicationContextGuard = Applications.guard.omit({
     secret: true,
 });
+/**
+ * The target organization context for organization (API resource) access tokens.
+ *
+ * Only populated when the token is being issued for a specific organization (i.e. the
+ * `organization_id` request parameter is present), letting the customizer attach per-org
+ * claims without embedding every organization the user belongs to.
+ */
+export const jwtCustomizerOrganizationContextGuard = Organizations.guard.pick({
+    id: true,
+    name: true,
+    description: true,
+    customData: true,
+});
 export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
     .extend({
     // Use partial token guard since users customization may not rely on all fields.
@@ -121,6 +134,7 @@ export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
         grant: jwtCustomizerGrantContextGuard.partial().optional(),
         interaction: jwtCustomizerUserInteractionContextGuard.partial().optional(),
         application: jwtCustomizerApplicationContextGuard.partial().optional(),
+        organization: jwtCustomizerOrganizationContextGuard.partial().optional(),
     })
         .optional(),
 })

package/lib/types/organization.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { type OrganizationRole, type Organization, type OrganizationInvitation, type Application } from '../db-entries/index.js';
 import { type ToZodObject } from '../utils/zod.js';
 import { type UserInfo, type FeaturedUser } from './user.js';
@@ -66,7 +67,141 @@ export type ApplicationWithOrganizationRoles = Application & {
     /** The roles of the application in the organization. */
     organizationRoles: OrganizationRoleEntity[];
 };
-export declare const applicationWithOrganizationRolesGuard: ToZodObject<ApplicationWithOrganizationRoles>;
+export declare const applicationWithOrganizationRolesGuard: z.ZodObject<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    name: z.ZodType<string, z.ZodTypeDef, string>;
+    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
+    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
+    customClientMetadata: z.ZodType<{
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }, z.ZodTypeDef, {
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }>;
+    protectedAppMetadata: z.ZodType<{
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null, z.ZodTypeDef, {
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null>;
+    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
+    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    secret: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
+} & {
+    organizationRoles: z.ZodArray<ToZodObject<OrganizationRoleEntity>, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    organizationRoles: {
+        name: string;
+        id: string;
+    }[];
+    secret?: string | undefined;
+}, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    organizationRoles: {
+        name: string;
+        id: string;
+    }[];
+    secret?: string | undefined;
+}>;
+export type ApplicationWithOrganizationRolesResponse = z.infer<typeof applicationWithOrganizationRolesGuard>;
 /**
  * The organization invitation with additional fields:
  *

package/lib/types/organization.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
-import { OrganizationRoles, Organizations, OrganizationInvitations, Applications, } from '../db-entries/index.js';
+import { OrganizationRoles, Organizations, OrganizationInvitations, } from '../db-entries/index.js';
+import { applicationResponseGuard } from './application.js';
 import { userInfoGuard } from './user.js';
 export const organizationRoleWithScopesGuard = OrganizationRoles.guard.extend({
     scopes: z
@@ -29,7 +30,7 @@ export const organizationWithOrganizationRolesGuard = Organizations.guard.extend
 export const userWithOrganizationRolesGuard = userInfoGuard.extend({
     organizationRoles: organizationRoleEntityGuard.array(),
 });
-export const applicationWithOrganizationRolesGuard = Applications.guard.extend({
+export const applicationWithOrganizationRolesGuard = applicationResponseGuard.extend({
     organizationRoles: organizationRoleEntityGuard.array(),
 });
 export const organizationInvitationEntityGuard = OrganizationInvitations.guard.extend({

package/lib/types/saml-application.d.ts

@@ -50,6 +50,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
     customData: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>>>;
     description: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>>>;
+    appLevelAccessControlEnabled: z.ZodOptional<z.ZodType<boolean, z.ZodTypeDef, boolean>>;
     attributeMapping: z.ZodOptional<z.ZodType<Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>, z.ZodTypeDef, Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>>>;
     entityId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     acsUrl: z.ZodOptional<z.ZodType<import("../foundations/index.js").SamlAcsUrl | null, z.ZodTypeDef, import("../foundations/index.js").SamlAcsUrl | null>>;
@@ -68,6 +69,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name?: string | undefined;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
+    appLevelAccessControlEnabled?: boolean;
     attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;
@@ -81,6 +83,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name?: string | undefined;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
+    appLevelAccessControlEnabled?: boolean;
     attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;

package/lib/types/saml-application.js

@@ -26,6 +26,9 @@ export const samlApplicationPatchGuard = applicationPatchGuard
     description: true,
     customData: true,
 })
+    .merge(Applications.createGuard.pick({
+    appLevelAccessControlEnabled: true,
+}))
     // The reason for encapsulating attributeMapping and spMetadata into an object within the config field is that you cannot provide only one of `attributeMapping` or `spMetadata`. Due to the structure of the `saml_application_configs` table, both must be not null.
     .merge(samlAppConfigGuard.partial())
     .extend({ nameIdFormat: nameIdFormatGuard.optional() });