@meistrari/auth-core 1.28.0 → 1.28.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/index.d.mts +37 -21
  2. package/dist/index.d.ts +37 -21
  3. package/dist/index.mjs +22 -7
  4. package/package.json +1 -1
package/dist/index.d.mts CHANGED
@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
14
14
  declare const ACRBrand: unique symbol;
15
15
  declare const AuthMethodBrand: unique symbol;
16
16
  declare const AMRs: {
17
- readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
18
- readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
19
- readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
20
- readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
21
- readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
17
+ readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
18
+ readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
19
+ readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
20
+ readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
21
+ readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
22
22
  };
23
23
  declare const AALs: {
24
24
  readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -29,11 +29,11 @@ declare const ACRs: {
29
29
  readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
30
30
  };
31
31
  declare const AuthMethods: {
32
- readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
33
- readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
34
- readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
35
- readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
36
- readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
32
+ readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
33
+ readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
34
+ readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
35
+ readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
36
+ readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
37
37
  };
38
38
  declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
39
39
  readonly Pwd: "pwd";
@@ -390,8 +390,16 @@ type SessionAssurancePolicy = {
390
390
  };
391
391
  declare const SessionAssurancePolicy: z.ZodType<SessionAssurancePolicy>;
392
392
  declare const SENSITIVE_ACTION_ASSURANCE_POLICY: SessionAssurancePolicy;
393
+ /**
394
+ * Maximum age of an elevated (stepped-up) assurance, in seconds. Enforced by
395
+ * `isAssuranceSufficientForPolicy` for any policy that requires AAL2 or higher,
396
+ * so a one-time step-up cannot satisfy a sensitive-action policy indefinitely.
397
+ * Baseline AAL1 policies impose no freshness requirement, so ordinary sessions
398
+ * and their token refreshes are unaffected.
399
+ */
400
+ declare const STEP_UP_MAX_AGE_SECONDS: number;
393
401
  declare function getAalRank(aal: JWTPayload['assurance']['aal']): number;
394
- declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy): boolean;
402
+ declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy, now?: Date): boolean;
395
403
  declare function canStepUpWithAmr(assurance: JWTPayload['assurance'], amr: AMR): boolean;
396
404
  declare function mergeStepUpAssurance(assurance: JWTPayload['assurance'], amr: AMR, now?: Date): JWTPayload['assurance'];
397
405
 
@@ -712,7 +720,13 @@ type DeviceAuthorizationActionResponse = {
712
720
  * `ApplicationError` to handle any application-related failure.
713
721
  */
714
722
  declare class ApplicationError extends BaseError {
715
- constructor(message: string, options?: ErrorOptions);
723
+ /**
724
+ * HTTP status of the upstream failure, when one was received.
725
+ */
726
+ readonly status?: number;
727
+ constructor(message: string, options?: ErrorOptions & {
728
+ status?: number;
729
+ });
716
730
  }
717
731
  /**
718
732
  * Thrown when a refresh token has expired or been revoked.
@@ -721,7 +735,9 @@ declare class ApplicationError extends BaseError {
721
735
  * to re-authenticate.
722
736
  */
723
737
  declare class RefreshTokenExpiredError extends ApplicationError {
724
- constructor(options?: ErrorOptions);
738
+ constructor(options?: ErrorOptions & {
739
+ status?: number;
740
+ });
725
741
  }
726
742
  /**
727
743
  * Thrown when an authorization flow fails unexpectedly.
@@ -903,7 +919,7 @@ declare class ApplicationService {
903
919
  * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
904
920
  * @throws {ApplicationError} For other API errors
905
921
  */
906
- refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse | null>;
922
+ refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
907
923
  /**
908
924
  * Gets the current user and organization for a specific application.
909
925
  *
@@ -4386,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
4386
4402
  } & {
4387
4403
  applications: {
4388
4404
  getApplicationAuthContext: (applicationId: string) => Promise<{
4405
+ data: ApplicationAuthContextResponse;
4406
+ error: null;
4407
+ } | {
4389
4408
  data: null;
4390
4409
  error: {
4391
4410
  message?: string | undefined;
4392
4411
  status: number;
4393
4412
  statusText: string;
4394
4413
  };
4395
- } | {
4396
- data: ApplicationAuthContextResponse;
4397
- error: null;
4398
4414
  }>;
4399
4415
  listCandidateOrganizations: (applicationId: string) => Promise<{
4400
4416
  data: ListCandidateOrganizationsResponse;
@@ -6037,15 +6053,15 @@ declare class AdminService {
6037
6053
  * @returns The paginated organization listing
6038
6054
  */
6039
6055
  listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
6040
- data: ListAdminOrganizationsResult;
6041
- error: null;
6042
- } | {
6043
6056
  data: null;
6044
6057
  error: {
6045
6058
  message?: string | undefined;
6046
6059
  status: number;
6047
6060
  statusText: string;
6048
6061
  };
6062
+ } | {
6063
+ data: ListAdminOrganizationsResult;
6064
+ error: null;
6049
6065
  }>;
6050
6066
  /**
6051
6067
  * Lists all Better Auth users from the user table.
@@ -7067,5 +7083,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
7067
7083
  */
7068
7084
  declare function extractTokenPayload(token: string): DecodedJWTPayload;
7069
7085
 
7070
- export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
7086
+ export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
7071
7087
  export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminOrganizationTeamRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
package/dist/index.d.ts CHANGED
@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
14
14
  declare const ACRBrand: unique symbol;
15
15
  declare const AuthMethodBrand: unique symbol;
16
16
  declare const AMRs: {
17
- readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
18
- readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
19
- readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
20
- readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
21
- readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
17
+ readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
18
+ readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
19
+ readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
20
+ readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
21
+ readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
22
22
  };
23
23
  declare const AALs: {
24
24
  readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -29,11 +29,11 @@ declare const ACRs: {
29
29
  readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
30
30
  };
31
31
  declare const AuthMethods: {
32
- readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
33
- readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
34
- readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
35
- readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
36
- readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
32
+ readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
33
+ readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
34
+ readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
35
+ readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
36
+ readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
37
37
  };
38
38
  declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
39
39
  readonly Pwd: "pwd";
@@ -390,8 +390,16 @@ type SessionAssurancePolicy = {
390
390
  };
391
391
  declare const SessionAssurancePolicy: z.ZodType<SessionAssurancePolicy>;
392
392
  declare const SENSITIVE_ACTION_ASSURANCE_POLICY: SessionAssurancePolicy;
393
+ /**
394
+ * Maximum age of an elevated (stepped-up) assurance, in seconds. Enforced by
395
+ * `isAssuranceSufficientForPolicy` for any policy that requires AAL2 or higher,
396
+ * so a one-time step-up cannot satisfy a sensitive-action policy indefinitely.
397
+ * Baseline AAL1 policies impose no freshness requirement, so ordinary sessions
398
+ * and their token refreshes are unaffected.
399
+ */
400
+ declare const STEP_UP_MAX_AGE_SECONDS: number;
393
401
  declare function getAalRank(aal: JWTPayload['assurance']['aal']): number;
394
- declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy): boolean;
402
+ declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy, now?: Date): boolean;
395
403
  declare function canStepUpWithAmr(assurance: JWTPayload['assurance'], amr: AMR): boolean;
396
404
  declare function mergeStepUpAssurance(assurance: JWTPayload['assurance'], amr: AMR, now?: Date): JWTPayload['assurance'];
397
405
 
@@ -712,7 +720,13 @@ type DeviceAuthorizationActionResponse = {
712
720
  * `ApplicationError` to handle any application-related failure.
713
721
  */
714
722
  declare class ApplicationError extends BaseError {
715
- constructor(message: string, options?: ErrorOptions);
723
+ /**
724
+ * HTTP status of the upstream failure, when one was received.
725
+ */
726
+ readonly status?: number;
727
+ constructor(message: string, options?: ErrorOptions & {
728
+ status?: number;
729
+ });
716
730
  }
717
731
  /**
718
732
  * Thrown when a refresh token has expired or been revoked.
@@ -721,7 +735,9 @@ declare class ApplicationError extends BaseError {
721
735
  * to re-authenticate.
722
736
  */
723
737
  declare class RefreshTokenExpiredError extends ApplicationError {
724
- constructor(options?: ErrorOptions);
738
+ constructor(options?: ErrorOptions & {
739
+ status?: number;
740
+ });
725
741
  }
726
742
  /**
727
743
  * Thrown when an authorization flow fails unexpectedly.
@@ -903,7 +919,7 @@ declare class ApplicationService {
903
919
  * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
904
920
  * @throws {ApplicationError} For other API errors
905
921
  */
906
- refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse | null>;
922
+ refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
907
923
  /**
908
924
  * Gets the current user and organization for a specific application.
909
925
  *
@@ -4386,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
4386
4402
  } & {
4387
4403
  applications: {
4388
4404
  getApplicationAuthContext: (applicationId: string) => Promise<{
4405
+ data: ApplicationAuthContextResponse;
4406
+ error: null;
4407
+ } | {
4389
4408
  data: null;
4390
4409
  error: {
4391
4410
  message?: string | undefined;
4392
4411
  status: number;
4393
4412
  statusText: string;
4394
4413
  };
4395
- } | {
4396
- data: ApplicationAuthContextResponse;
4397
- error: null;
4398
4414
  }>;
4399
4415
  listCandidateOrganizations: (applicationId: string) => Promise<{
4400
4416
  data: ListCandidateOrganizationsResponse;
@@ -6037,15 +6053,15 @@ declare class AdminService {
6037
6053
  * @returns The paginated organization listing
6038
6054
  */
6039
6055
  listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
6040
- data: ListAdminOrganizationsResult;
6041
- error: null;
6042
- } | {
6043
6056
  data: null;
6044
6057
  error: {
6045
6058
  message?: string | undefined;
6046
6059
  status: number;
6047
6060
  statusText: string;
6048
6061
  };
6062
+ } | {
6063
+ data: ListAdminOrganizationsResult;
6064
+ error: null;
6049
6065
  }>;
6050
6066
  /**
6051
6067
  * Lists all Better Auth users from the user table.
@@ -7067,5 +7083,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
7067
7083
  */
7068
7084
  declare function extractTokenPayload(token: string): DecodedJWTPayload;
7069
7085
 
7070
- export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
7086
+ export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
7071
7087
  export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminOrganizationTeamRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
package/dist/index.mjs CHANGED
@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
8
8
  import z, { z as z$1 } from 'zod';
9
9
  export { APIError } from 'better-auth';
10
10
 
11
- const version = "1.28.0";
11
+ const version = "1.28.2";
12
12
 
13
13
  function parsedEnumValues(schema) {
14
14
  return Object.fromEntries(
@@ -579,8 +579,13 @@ class BaseError extends Error {
579
579
  }
580
580
 
581
581
  class ApplicationError extends BaseError {
582
+ /**
583
+ * HTTP status of the upstream failure, when one was received.
584
+ */
585
+ status;
582
586
  constructor(message, options) {
583
587
  super("APPLICATION_ERROR", message, options);
588
+ this.status = options?.status;
584
589
  }
585
590
  }
586
591
  class RefreshTokenExpiredError extends ApplicationError {
@@ -663,6 +668,7 @@ const SENSITIVE_ACTION_ASSURANCE_POLICY = {
663
668
  minAal: AALs.Aal2,
664
669
  acceptedAmr: [AMRs.Pwd, AMRs.Otp, AMRs.Oauth]
665
670
  };
671
+ const STEP_UP_MAX_AGE_SECONDS = 15 * 60;
666
672
  function getAalRank(aal) {
667
673
  switch (aal) {
668
674
  case AALs.Aal3:
@@ -678,7 +684,7 @@ function getAalRank(aal) {
678
684
  function maxAal(left, right) {
679
685
  return getAalRank(left) >= getAalRank(right) ? left : right;
680
686
  }
681
- function isAssuranceSufficientForPolicy(assurance, policy) {
687
+ function isAssuranceSufficientForPolicy(assurance, policy, now = /* @__PURE__ */ new Date()) {
682
688
  if (!assurance) {
683
689
  return false;
684
690
  }
@@ -688,7 +694,16 @@ function isAssuranceSufficientForPolicy(assurance, policy) {
688
694
  if (!assurance.amr.length) {
689
695
  return false;
690
696
  }
691
- return assurance.amr.some((amr) => policy.acceptedAmr.includes(amr));
697
+ if (!assurance.amr.some((amr) => policy.acceptedAmr.includes(amr))) {
698
+ return false;
699
+ }
700
+ if (getAalRank(policy.minAal) >= getAalRank(AALs.Aal2)) {
701
+ const assuredAtMs = Date.parse(assurance.assuredAt);
702
+ if (Number.isNaN(assuredAtMs) || now.getTime() - assuredAtMs > STEP_UP_MAX_AGE_SECONDS * 1e3) {
703
+ return false;
704
+ }
705
+ }
706
+ return true;
692
707
  }
693
708
  function canStepUpWithAmr(assurance, amr) {
694
709
  return !assurance.amr.includes(amr);
@@ -1030,11 +1045,11 @@ class ApplicationService {
1030
1045
  async refreshAccessToken(refreshToken) {
1031
1046
  const handleRefreshError = (error) => {
1032
1047
  const status = error?.status;
1033
- if (status === 404) {
1034
- throw new RefreshTokenExpiredError({ cause: error });
1048
+ if (status === 401 || status === 404) {
1049
+ throw new RefreshTokenExpiredError({ cause: error, status });
1035
1050
  }
1036
1051
  const message = error?.message;
1037
- throw new ApplicationError(message || "Failed to refresh access token", { cause: error });
1052
+ throw new ApplicationError(message || "Failed to refresh access token", { cause: error, status });
1038
1053
  };
1039
1054
  try {
1040
1055
  const response = await this.client.applications.refreshAccessToken(refreshToken);
@@ -1836,4 +1851,4 @@ function extractTokenPayload(token) {
1836
1851
  return payload;
1837
1852
  }
1838
1853
 
1839
- export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
1854
+ export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@meistrari/auth-core",
3
- "version": "1.28.0",
3
+ "version": "1.28.2",
4
4
  "type": "module",
5
5
  "exports": {
6
6
  ".": {