@logto/schemas 1.41.0 → 1.42.0

package/lib/types/organization.d.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { type OrganizationRole, type Organization, type OrganizationInvitation, type Application } from '../db-entries/index.js';
 import { type ToZodObject } from '../utils/zod.js';
 import { type UserInfo, type FeaturedUser } from './user.js';
@@ -66,7 +67,141 @@ export type ApplicationWithOrganizationRoles = Application & {
     /** The roles of the application in the organization. */
     organizationRoles: OrganizationRoleEntity[];
 };
-export declare const applicationWithOrganizationRolesGuard: ToZodObject<ApplicationWithOrganizationRoles>;
+export declare const applicationWithOrganizationRolesGuard: z.ZodObject<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    name: z.ZodType<string, z.ZodTypeDef, string>;
+    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
+    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
+    customClientMetadata: z.ZodType<{
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }, z.ZodTypeDef, {
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }>;
+    protectedAppMetadata: z.ZodType<{
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null, z.ZodTypeDef, {
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null>;
+    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
+    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    secret: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
+} & {
+    organizationRoles: z.ZodArray<ToZodObject<OrganizationRoleEntity>, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    organizationRoles: {
+        name: string;
+        id: string;
+    }[];
+    secret?: string | undefined;
+}, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    organizationRoles: {
+        name: string;
+        id: string;
+    }[];
+    secret?: string | undefined;
+}>;
+export type ApplicationWithOrganizationRolesResponse = z.infer<typeof applicationWithOrganizationRolesGuard>;
 /**
  * The organization invitation with additional fields:
  *

package/lib/types/organization.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
-import { OrganizationRoles, Organizations, OrganizationInvitations, Applications, } from '../db-entries/index.js';
+import { OrganizationRoles, Organizations, OrganizationInvitations, } from '../db-entries/index.js';
+import { applicationResponseGuard } from './application.js';
 import { userInfoGuard } from './user.js';
 export const organizationRoleWithScopesGuard = OrganizationRoles.guard.extend({
     scopes: z
@@ -29,7 +30,7 @@ export const organizationWithOrganizationRolesGuard = Organizations.guard.extend
 export const userWithOrganizationRolesGuard = userInfoGuard.extend({
     organizationRoles: organizationRoleEntityGuard.array(),
 });
-export const applicationWithOrganizationRolesGuard = Applications.guard.extend({
+export const applicationWithOrganizationRolesGuard = applicationResponseGuard.extend({
     organizationRoles: organizationRoleEntityGuard.array(),
 });
 export const organizationInvitationEntityGuard = OrganizationInvitations.guard.extend({

package/lib/types/sign-in-experience.d.ts

@@ -12,7 +12,7 @@ type ForgotPassword = {
  * the need to load the full connector metadata that is not needed for rendering.
  */
 export type ExperienceSocialConnector = Omit<ConnectorMetadata, 'description' | 'configTemplate' | 'formItems' | 'readme' | 'customData'>;
-export type FullSignInExperience = Omit<SignInExperience, 'forgotPasswordMethods'> & {
+export type FullSignInExperience = Omit<SignInExperience, 'emailBlocklistPolicy' | 'forgotPasswordMethods'> & {
     socialConnectors: ExperienceSocialConnector[];
     ssoConnectors: SsoConnectorMetadata[];
     forgotPassword: ForgotPassword;
@@ -160,7 +160,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }[] | null>;
     passwordExpiration: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy>;
     usernamePolicy: z.ZodType<import("../foundations/jsonb-types/index.js").UsernamePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/index.js").UsernamePolicy>;
-}, "forgotPasswordMethods"> & {
+}, "emailBlocklistPolicy" | "forgotPasswordMethods"> & {
     socialConnectors: z.ZodArray<z.ZodObject<Omit<{
         id: z.ZodString;
         target: z.ZodString;
@@ -740,7 +740,6 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
     sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
-    emailBlocklistPolicy: import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy;
     verificationCodePolicy: import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy;
     passkeySignIn: import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn;
     signUpProfileFields: import("../foundations/jsonb-types/sign-in-experience.js").SignUpProfileFields | null;
@@ -943,7 +942,6 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
     sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
-    emailBlocklistPolicy: import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy;
     verificationCodePolicy: import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy;
     passkeySignIn: import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn;
     signUpProfileFields: import("../foundations/jsonb-types/sign-in-experience.js").SignUpProfileFields | null;

package/lib/types/sign-in-experience.js

@@ -4,7 +4,7 @@ import { CustomProfileFields, SignInExperiences, } from '../db-entries/index.js'
 import { CaptchaType, RecaptchaEnterpriseMode } from '../foundations/jsonb-types/index.js';
 import { ssoConnectorMetadataGuard } from './sso-connector.js';
 export const fullSignInExperienceGuard = SignInExperiences.guard
-    .omit({ forgotPasswordMethods: true })
+    .omit({ emailBlocklistPolicy: true, forgotPasswordMethods: true })
     .extend({
     socialConnectors: connectorMetadataGuard
         .omit({

package/lib/types/sso-connector.d.ts

@@ -168,4 +168,62 @@ export declare const extendedSocialUserInfoGuard: z.ZodObject<{
     rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
 }, z.ZodUnknown, "strip">>;
 export type ExtendedSocialUserInfo = z.infer<typeof extendedSocialUserInfoGuard>;
+export declare const samlSsoConnectorSigningKeyResponseGuard: z.ZodObject<Omit<{
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    ssoConnectorId: z.ZodType<string, z.ZodTypeDef, string>;
+    privateKey: z.ZodType<string, z.ZodTypeDef, string>;
+    certificate: z.ZodType<string, z.ZodTypeDef, string>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    expiresAt: z.ZodType<number, z.ZodTypeDef, number>;
+    active: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+}, "tenantId" | "ssoConnectorId" | "privateKey"> & {
+    fingerprints: z.ZodObject<{
+        sha256: z.ZodObject<{
+            formatted: z.ZodString;
+            unformatted: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            formatted: string;
+            unformatted: string;
+        }, {
+            formatted: string;
+            unformatted: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    }, {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    }>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    createdAt: number;
+    certificate: string;
+    active: boolean;
+    expiresAt: number;
+    fingerprints: {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    };
+}, {
+    id: string;
+    createdAt: number;
+    certificate: string;
+    active: boolean;
+    expiresAt: number;
+    fingerprints: {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    };
+}>;
+export type SamlSsoConnectorSigningKeyResponse = z.infer<typeof samlSsoConnectorSigningKeyResponseGuard>;
 export {};

package/lib/types/sso-connector.js

@@ -1,6 +1,8 @@
 import { socialUserInfoGuard } from '@logto/connector-kit';
 import { z } from 'zod';
+import { SamlSsoConnectorSigningKeys } from '../db-entries/saml-sso-connector-signing-key.js';
 import { SsoConnectors } from '../db-entries/sso-connector.js';
+import { certificateFingerprintsGuard } from './saml-application.js';
 /**
  * SSO Connector data type that are returned to the experience client for sign-in use.
  */
@@ -76,3 +78,13 @@ export var SsoAuthenticationQueryKey;
 })(SsoAuthenticationQueryKey || (SsoAuthenticationQueryKey = {}));
 // Saml assertion returned user attribute value
 export const extendedSocialUserInfoGuard = socialUserInfoGuard.catchall(z.unknown());
+// Make sure the `privateKey` is not exposed in the response.
+export const samlSsoConnectorSigningKeyResponseGuard = SamlSsoConnectorSigningKeys.guard
+    .omit({
+    tenantId: true,
+    ssoConnectorId: true,
+    privateKey: true,
+})
+    .extend({
+    fingerprints: certificateFingerprintsGuard,
+});