@logto/schemas 1.42.0 → 1.44.0

package/lib/types/interactions.js

@@ -2,8 +2,10 @@
 import { emailRegEx, numberAndAlphabetRegEx, phoneRegEx, usernameRegEx } from '@logto/core-kit';
 import { z } from 'zod';
 import { AdditionalIdentifier, MfaFactor, SignInIdentifier, jsonObjectGuard, webAuthnTransportGuard, } from '../foundations/index.js';
+import { requestedAuthenticationContextGuard, } from './authentication-context.js';
 import { InteractionEvent } from './interaction-event.js';
 import { emailVerificationCodePayloadGuard, phoneVerificationCodePayloadGuard, } from './verification-code.js';
+import { VerificationType } from './verification-records/verification-type.js';
 export { eventGuard, InteractionEvent } from './interaction-event.js';
 export const verificationIdentifierGuard = z.object({
     type: z.union([z.nativeEnum(SignInIdentifier), z.nativeEnum(AdditionalIdentifier)]),
@@ -25,6 +27,14 @@ export const verificationCodeIdentifierGuard = z.discriminatedUnion('type', [
         value: z.string().regex(phoneRegEx),
     }),
 ]);
+export const subjectVerificationCodeIdentifierGuard = z.object({
+    type: z.enum([SignInIdentifier.Email, SignInIdentifier.Phone]),
+    value: z.undefined(),
+});
+export const verificationCodeIdentifierPayloadGuard = z.union([
+    verificationCodeIdentifierGuard,
+    subjectVerificationCodeIdentifierGuard,
+]);
 export const socialAuthorizationUrlPayloadGuard = z.object({
     state: z.string(),
     redirectUri: z.string(),
@@ -38,6 +48,10 @@ export const passwordVerificationPayloadGuard = z.object({
     identifier: interactionIdentifierGuard,
     password: z.string().min(1),
 });
+export const subjectPasswordVerificationPayloadGuard = z.object({
+    identifier: z.undefined(),
+    password: z.string().min(1),
+});
 export const totpVerificationVerifyPayloadGuard = z.object({
     code: z.string().min(1),
     verificationId: z.string().optional(),
@@ -149,6 +163,15 @@ export var MissingProfile;
     MissingProfile["emailOrPhone"] = "emailOrPhone";
     MissingProfile["extraProfile"] = "extraProfile";
 })(MissingProfile || (MissingProfile = {}));
+export const interactionAuthenticationContextGuard = requestedAuthenticationContextGuard.extend({
+    availableMethods: z.nativeEnum(VerificationType).array(),
+    establishableMethods: z.nativeEnum(MissingProfile).array(),
+    enrollableFactors: z.nativeEnum(MfaFactor).array(),
+    subjectProofConnectors: z
+        .object({ type: z.enum(['social', 'sso']), connectorId: z.string() })
+        .array(),
+    maskedIdentifiers: z.object({ email: z.string().optional(), phone: z.string().optional() }),
+});
 export const bindTotpPayloadGuard = z.object({
     // Unlike identifier payload which has indicator like "email",
     // mfa payload must have an additional type field to indicate type

package/lib/types/log/index.d.ts

@@ -4,12 +4,14 @@ import type * as interaction from './interaction.js';
 import type * as jwtCustomizer from './jwt-customizer.js';
 import type * as saml from './saml.js';
 import type * as token from './token.js';
+import type * as trustedDevice from './trusted-device.js';
 export * as interaction from './interaction.js';
 export * as token from './token.js';
 export * as hook from './hook.js';
 export * as action from './action.js';
 export * as jwtCustomizer from './jwt-customizer.js';
 export * as saml from './saml.js';
+export * as trustedDevice from './trusted-device.js';
 /** Fallback for empty or unrecognized log keys. */
 export declare const LogKeyUnknown = "Unknown";
 export type InteractionLogKey = interaction.LogKey;
@@ -18,17 +20,18 @@ export type WebhookLogKey = hook.LogKey;
 export type ActionLogKey = action.LogKey;
 export type JwtCustomizerLogKey = jwtCustomizer.LogKey;
 export type SamlLogKey = saml.LogKey;
+export type TrustedDeviceLogKey = trustedDevice.LogKey;
 /**
  * The union type of all available audit log keys.
  *
  * - All user-facing audit log keys should be included here.
  * - Webhook log keys are excluded.
  */
-export type AuditLogKey = typeof LogKeyUnknown | InteractionLogKey | TokenLogKey | SamlLogKey | ActionLogKey | JwtCustomizerLogKey;
+export type AuditLogKey = typeof LogKeyUnknown | InteractionLogKey | TokenLogKey | SamlLogKey | ActionLogKey | JwtCustomizerLogKey | TrustedDeviceLogKey;
 /**
  * The union type of all available log keys.
  * Note duplicate keys are allowed but should be avoided.
  **/
 export type LogKey = AuditLogKey | WebhookLogKey;
-export type AuditLogPrefix = interaction.Prefix | token.Type | saml.Prefix | action.Prefix | jwtCustomizer.Prefix | typeof LogKeyUnknown;
+export type AuditLogPrefix = interaction.Prefix | token.Type | saml.Prefix | action.Prefix | jwtCustomizer.Prefix | trustedDevice.Prefix | typeof LogKeyUnknown;
 export type WebhookLogPrefix = hook.Type;

package/lib/types/log/index.js

@@ -4,5 +4,6 @@ export * as hook from './hook.js';
 export * as action from './action.js';
 export * as jwtCustomizer from './jwt-customizer.js';
 export * as saml from './saml.js';
+export * as trustedDevice from './trusted-device.js';
 /** Fallback for empty or unrecognized log keys. */
 export const LogKeyUnknown = 'Unknown';

package/lib/types/log/interaction.d.ts

@@ -13,7 +13,12 @@ export declare enum Field {
     Mfa = "Mfa",
     Verification = "Verification",
     Captcha = "Captcha",
-    SignInPasskey = "SignInPasskey"
+    SignInPasskey = "SignInPasskey",
+    /**
+     * A pure step-up submission: an authenticated session re-proved its subject to reach a requested
+     * authentication context class. Not a sign-in, so it never shares `SignIn.Submit`.
+     */
+    StepUp = "StepUp"
 }
 /** Method to verify the identifier */
 export declare enum Method {
@@ -74,5 +79,13 @@ export type DeprecatedInteractionLogKey = `${Prefix}.${InteractionEvent}.${Field
  * - Indicates an identifier method is being created or submitted to an interaction.
  *   - When {@link Method} is `VerificationCode`, {@link Action} can be `Create` (generate and send a code) or `Submit` (verify and submit to the identifiers);
  *   - Otherwise, {@link Action} is fixed to `Submit` (other methods can be verified on submitting).
+ *
+ * ```ts
+ * `Interaction.${InteractionEvent}.${Field.StepUp}.${Action.Submit}`
+ * ```
+ *
+ * - Indicates a pure step-up interaction is submitted: an authenticated session re-proved its
+ *   subject to reach the requested authentication context class. Its payload records the requested
+ *   and achieved classes and the factor families that were proved, never a credential.
  */
-export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.SignInPasskey}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}` | DeprecatedInteractionLogKey;
+export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.SignInPasskey}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.StepUp}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}` | DeprecatedInteractionLogKey;

package/lib/types/log/interaction.js

@@ -11,6 +11,11 @@ export var Field;
     Field["Verification"] = "Verification";
     Field["Captcha"] = "Captcha";
     Field["SignInPasskey"] = "SignInPasskey";
+    /**
+     * A pure step-up submission: an authenticated session re-proved its subject to reach a requested
+     * authentication context class. Not a sign-in, so it never shares `SignIn.Submit`.
+     */
+    Field["StepUp"] = "StepUp";
 })(Field || (Field = {}));
 /** Method to verify the identifier */
 export var Method;

package/lib/types/log/trusted-device.d.ts

@@ -0,0 +1,7 @@
+export type Prefix = 'TrustedDevice';
+export declare const prefix: Prefix;
+export declare enum Type {
+    Created = "Created",
+    Used = "Used"
+}
+export type LogKey = `${Prefix}.${Type}`;

package/lib/types/log/trusted-device.js

@@ -0,0 +1,6 @@
+export const prefix = 'TrustedDevice';
+export var Type;
+(function (Type) {
+    Type["Created"] = "Created";
+    Type["Used"] = "Used";
+})(Type || (Type = {}));

package/lib/types/logto-config/action.d.ts

@@ -39,7 +39,7 @@ export declare const logtoActionGuard: z.ZodObject<{
 }>;
 /**
  * Shared execution payload for production Actions and Management API dry runs.
- * Cloud remote execution and the local VM runner both accept this shape.
+ * Cloud remote execution and the local runner both accept this shape.
  */
 export declare const actionExecutionRequestBodyGuard: z.ZodObject<{
     script: z.ZodString;

package/lib/types/logto-config/action.js

@@ -21,7 +21,7 @@ export const logtoActionGuard = z
     .strict();
 /**
  * Shared execution payload for production Actions and Management API dry runs.
- * Cloud remote execution and the local VM runner both accept this shape.
+ * Cloud remote execution and the local runner both accept this shape.
  */
 export const actionExecutionRequestBodyGuard = z
     .object({