@meistrari/auth-core 1.43.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/index.d.mts +35 -18
  2. package/dist/index.d.ts +35 -18
  3. package/dist/index.mjs +27 -13
  4. package/package.json +1 -1
package/dist/index.d.mts CHANGED
@@ -32,17 +32,28 @@ declare const ACRs: {
32
32
  readonly Unspecified: "urn:tela:auth:unspecified" & zod__default.core.$brand<typeof ACRBrand>;
33
33
  };
34
34
  declare const AuthMethods: {
35
- readonly Password: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
36
- readonly EmailOTP: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
37
- readonly OAuth: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
38
- readonly SAML: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
39
- readonly Unknown: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
35
+ readonly Password: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
36
+ readonly EmailOTP: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
37
+ readonly OAuth: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
38
+ readonly SSO: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
39
+ readonly SAML: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
40
+ readonly Unknown: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
40
41
  };
42
+ /**
43
+ * Reads the legacy `saml` AMR as `sso`, so sessions and application policies
44
+ * created before SAML and OIDC were unified keep matching each other.
45
+ */
46
+ declare function normalizeAmr(amr: AMR): AMR;
41
47
  declare const AMR: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
42
48
  readonly Pwd: "pwd";
43
49
  readonly Otp: "otp";
44
50
  readonly Oauth: "oauth";
45
51
  readonly Sso: "sso";
52
+ /**
53
+ * @deprecated Issued to SSO sessions before SAML and OIDC were unified
54
+ * under `sso`. Still parsed so existing sessions and application policies
55
+ * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
56
+ */
46
57
  readonly Saml: "saml";
47
58
  }>, typeof AMRBrand, "out">;
48
59
  type AMR = zod__default.infer<typeof AMR>;
@@ -60,6 +71,11 @@ declare const AuthMethod: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
60
71
  readonly Password: "password";
61
72
  readonly EmailOTP: "email_otp";
62
73
  readonly OAuth: "oauth";
74
+ readonly SSO: "sso";
75
+ /**
76
+ * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
77
+ * under `sso`. Kept so existing sessions still parse; never recorded.
78
+ */
63
79
  readonly SAML: "saml";
64
80
  readonly Unknown: "unknown";
65
81
  }>, typeof AuthMethodBrand, "out">;
@@ -534,10 +550,10 @@ type SocialSignInOptions = {
534
550
  loginHint?: string;
535
551
  };
536
552
  /**
537
- * Options for signing in via SAML Single Sign-On.
553
+ * Options for signing in via Single Sign-On (SAML or OIDC).
538
554
  */
539
- type SignInWithSamlOptions = {
540
- /** The user's email address, used to resolve the correct SAML identity provider. */
555
+ type SignInWithSsoOptions = {
556
+ /** The user's email address, used to resolve the correct SSO identity provider. */
541
557
  email: string;
542
558
  /** URL to redirect to after successful authentication. */
543
559
  callbackURL: string;
@@ -560,7 +576,7 @@ type SignInWithEmailAndPasswordOptions = {
560
576
  * Session-carrying mechanisms (JWT, API keys, application tokens) are not
561
577
  * login methods.
562
578
  */
563
- declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
579
+ declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "sso", "otp"];
564
580
  type LoginMethod = typeof LOGIN_METHODS[number];
565
581
  /**
566
582
  * Response of the public `GET /login-methods` endpoint.
@@ -1037,7 +1053,7 @@ type ApiKeyWithoutSecret = Omit<ApiKey, 'key'>;
1037
1053
  type CreateApiKeyPayload = {
1038
1054
  /** Display name for the API key. */
1039
1055
  name: string;
1040
- /** Time in milliseconds until the key expires. Omit for a non-expiring key. */
1056
+ /** Time in seconds until the key expires. Omit for a non-expiring key. */
1041
1057
  expiresIn?: number;
1042
1058
  /** Optional prefix prepended to the generated key for identification. */
1043
1059
  prefix?: string;
@@ -5840,7 +5856,7 @@ declare class OrganizationService {
5840
5856
  /**
5841
5857
  * Service for managing user authentication sessions.
5842
5858
  *
5843
- * Provides methods for signing in with various providers (social, SAML, email/password),
5859
+ * Provides methods for signing in with various providers (social, SSO, email/password),
5844
5860
  * signing out, and password reset functionality.
5845
5861
  */
5846
5862
  declare class SessionService {
@@ -5913,7 +5929,7 @@ declare class SessionService {
5913
5929
  *
5914
5930
  * @returns The enabled login methods
5915
5931
  */
5916
- getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
5932
+ getLoginMethods(): Promise<("sso" | "google" | "microsoft" | "password" | "otp")[]>;
5917
5933
  /**
5918
5934
  * Initiates social authentication flow with Google or Microsoft.
5919
5935
  *
@@ -5928,17 +5944,18 @@ declare class SessionService {
5928
5944
  */
5929
5945
  signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
5930
5946
  /**
5931
- * Initiates SAML-based Single Sign-On authentication flow.
5947
+ * Initiates the Single Sign-On authentication flow. The provider resolved
5948
+ * from the email's domain determines whether SAML or OIDC is used.
5932
5949
  *
5933
- * @param options - SAML sign-in configuration
5934
- * @param options.email - User's email to determine the SAML provider
5950
+ * @param options - SSO sign-in configuration
5951
+ * @param options.email - User's email to determine the SSO provider
5935
5952
  * @param options.callbackURL - URL to redirect to after successful authentication
5936
5953
  * @param options.errorCallbackURL - URL to redirect to on error
5937
5954
  *
5938
5955
  * @throws {EmailRequired} When email is not provided
5939
5956
  * @throws {InvalidCallbackURL} When callback URLs are malformed
5940
5957
  */
5941
- signInWithSaml({ email, callbackURL, errorCallbackURL, }: SignInWithSamlOptions): Promise<void>;
5958
+ signInWithSso({ email, callbackURL, errorCallbackURL, }: SignInWithSsoOptions): Promise<void>;
5942
5959
  /**
5943
5960
  * Authenticates a user with email and password credentials.
5944
5961
  *
@@ -6424,5 +6441,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
6424
6441
  */
6425
6442
  declare function extractTokenPayload(token: string): DecodedJWTPayload;
6426
6443
 
6427
- export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
6428
- export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
6444
+ export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
6445
+ export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
package/dist/index.d.ts CHANGED
@@ -32,17 +32,28 @@ declare const ACRs: {
32
32
  readonly Unspecified: "urn:tela:auth:unspecified" & zod__default.core.$brand<typeof ACRBrand>;
33
33
  };
34
34
  declare const AuthMethods: {
35
- readonly Password: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
36
- readonly EmailOTP: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
37
- readonly OAuth: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
38
- readonly SAML: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
39
- readonly Unknown: ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
35
+ readonly Password: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
36
+ readonly EmailOTP: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
37
+ readonly OAuth: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
38
+ readonly SSO: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
39
+ readonly SAML: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
40
+ readonly Unknown: ("sso" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("unknown" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("password" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("saml" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("oauth" & zod__default.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & zod__default.core.$brand<typeof AuthMethodBrand>);
40
41
  };
42
+ /**
43
+ * Reads the legacy `saml` AMR as `sso`, so sessions and application policies
44
+ * created before SAML and OIDC were unified keep matching each other.
45
+ */
46
+ declare function normalizeAmr(amr: AMR): AMR;
41
47
  declare const AMR: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
42
48
  readonly Pwd: "pwd";
43
49
  readonly Otp: "otp";
44
50
  readonly Oauth: "oauth";
45
51
  readonly Sso: "sso";
52
+ /**
53
+ * @deprecated Issued to SSO sessions before SAML and OIDC were unified
54
+ * under `sso`. Still parsed so existing sessions and application policies
55
+ * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
56
+ */
46
57
  readonly Saml: "saml";
47
58
  }>, typeof AMRBrand, "out">;
48
59
  type AMR = zod__default.infer<typeof AMR>;
@@ -60,6 +71,11 @@ declare const AuthMethod: zod__default.core.$ZodBranded<zod__default.ZodEnum<{
60
71
  readonly Password: "password";
61
72
  readonly EmailOTP: "email_otp";
62
73
  readonly OAuth: "oauth";
74
+ readonly SSO: "sso";
75
+ /**
76
+ * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
77
+ * under `sso`. Kept so existing sessions still parse; never recorded.
78
+ */
63
79
  readonly SAML: "saml";
64
80
  readonly Unknown: "unknown";
65
81
  }>, typeof AuthMethodBrand, "out">;
@@ -534,10 +550,10 @@ type SocialSignInOptions = {
534
550
  loginHint?: string;
535
551
  };
536
552
  /**
537
- * Options for signing in via SAML Single Sign-On.
553
+ * Options for signing in via Single Sign-On (SAML or OIDC).
538
554
  */
539
- type SignInWithSamlOptions = {
540
- /** The user's email address, used to resolve the correct SAML identity provider. */
555
+ type SignInWithSsoOptions = {
556
+ /** The user's email address, used to resolve the correct SSO identity provider. */
541
557
  email: string;
542
558
  /** URL to redirect to after successful authentication. */
543
559
  callbackURL: string;
@@ -560,7 +576,7 @@ type SignInWithEmailAndPasswordOptions = {
560
576
  * Session-carrying mechanisms (JWT, API keys, application tokens) are not
561
577
  * login methods.
562
578
  */
563
- declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "saml", "otp"];
579
+ declare const LOGIN_METHODS: readonly ["password", "google", "microsoft", "sso", "otp"];
564
580
  type LoginMethod = typeof LOGIN_METHODS[number];
565
581
  /**
566
582
  * Response of the public `GET /login-methods` endpoint.
@@ -1037,7 +1053,7 @@ type ApiKeyWithoutSecret = Omit<ApiKey, 'key'>;
1037
1053
  type CreateApiKeyPayload = {
1038
1054
  /** Display name for the API key. */
1039
1055
  name: string;
1040
- /** Time in milliseconds until the key expires. Omit for a non-expiring key. */
1056
+ /** Time in seconds until the key expires. Omit for a non-expiring key. */
1041
1057
  expiresIn?: number;
1042
1058
  /** Optional prefix prepended to the generated key for identification. */
1043
1059
  prefix?: string;
@@ -5840,7 +5856,7 @@ declare class OrganizationService {
5840
5856
  /**
5841
5857
  * Service for managing user authentication sessions.
5842
5858
  *
5843
- * Provides methods for signing in with various providers (social, SAML, email/password),
5859
+ * Provides methods for signing in with various providers (social, SSO, email/password),
5844
5860
  * signing out, and password reset functionality.
5845
5861
  */
5846
5862
  declare class SessionService {
@@ -5913,7 +5929,7 @@ declare class SessionService {
5913
5929
  *
5914
5930
  * @returns The enabled login methods
5915
5931
  */
5916
- getLoginMethods(): Promise<("google" | "microsoft" | "password" | "saml" | "otp")[]>;
5932
+ getLoginMethods(): Promise<("sso" | "google" | "microsoft" | "password" | "otp")[]>;
5917
5933
  /**
5918
5934
  * Initiates social authentication flow with Google or Microsoft.
5919
5935
  *
@@ -5928,17 +5944,18 @@ declare class SessionService {
5928
5944
  */
5929
5945
  signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
5930
5946
  /**
5931
- * Initiates SAML-based Single Sign-On authentication flow.
5947
+ * Initiates the Single Sign-On authentication flow. The provider resolved
5948
+ * from the email's domain determines whether SAML or OIDC is used.
5932
5949
  *
5933
- * @param options - SAML sign-in configuration
5934
- * @param options.email - User's email to determine the SAML provider
5950
+ * @param options - SSO sign-in configuration
5951
+ * @param options.email - User's email to determine the SSO provider
5935
5952
  * @param options.callbackURL - URL to redirect to after successful authentication
5936
5953
  * @param options.errorCallbackURL - URL to redirect to on error
5937
5954
  *
5938
5955
  * @throws {EmailRequired} When email is not provided
5939
5956
  * @throws {InvalidCallbackURL} When callback URLs are malformed
5940
5957
  */
5941
- signInWithSaml({ email, callbackURL, errorCallbackURL, }: SignInWithSamlOptions): Promise<void>;
5958
+ signInWithSso({ email, callbackURL, errorCallbackURL, }: SignInWithSsoOptions): Promise<void>;
5942
5959
  /**
5943
5960
  * Authenticates a user with email and password credentials.
5944
5961
  *
@@ -6424,5 +6441,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
6424
6441
  */
6425
6442
  declare function extractTokenPayload(token: string): DecodedJWTPayload;
6426
6443
 
6427
- export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
6428
- export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
6444
+ export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
6445
+ export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
package/dist/index.mjs CHANGED
@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
21
21
  return nowInSeconds > expirationTime;
22
22
  }
23
23
 
24
- const version = "1.43.0";
24
+ const version = "2.1.0";
25
25
 
26
26
  function parsedEnumValues(schema) {
27
27
  return Object.fromEntries(
@@ -41,6 +41,11 @@ const AMR = z.enum({
41
41
  Otp: "otp",
42
42
  Oauth: "oauth",
43
43
  Sso: "sso",
44
+ /**
45
+ * @deprecated Issued to SSO sessions before SAML and OIDC were unified
46
+ * under `sso`. Still parsed so existing sessions and application policies
47
+ * remain valid, and read as `sso` (see `normalizeAmr`). Never issued.
48
+ */
44
49
  Saml: "saml"
45
50
  }).brand(AMRBrand);
46
51
  const AAL = z.enum({
@@ -55,6 +60,11 @@ const AuthMethod = z.enum({
55
60
  Password: "password",
56
61
  EmailOTP: "email_otp",
57
62
  OAuth: "oauth",
63
+ SSO: "sso",
64
+ /**
65
+ * @deprecated Recorded on SSO sessions before SAML and OIDC were unified
66
+ * under `sso`. Kept so existing sessions still parse; never recorded.
67
+ */
58
68
  SAML: "saml",
59
69
  Unknown: "unknown"
60
70
  }).brand(AuthMethodBrand);
@@ -62,6 +72,9 @@ const AMRs = parsedEnumValues(AMR);
62
72
  const AALs = parsedEnumValues(AAL);
63
73
  const ACRs = parsedEnumValues(ACR);
64
74
  const AuthMethods = parsedEnumValues(AuthMethod);
75
+ function normalizeAmr(amr) {
76
+ return amr === AMRs.Saml ? AMRs.Sso : amr;
77
+ }
65
78
  const assuranceFields = {
66
79
  authMethod: {
67
80
  type: "string",
@@ -1217,7 +1230,8 @@ function isAssuranceSufficientForPolicy(assurance, policy, now = /* @__PURE__ */
1217
1230
  if (!assurance.amr.length) {
1218
1231
  return false;
1219
1232
  }
1220
- if (!assurance.amr.some((amr) => policy.acceptedAmr.includes(amr))) {
1233
+ const acceptedAmr = new Set(policy.acceptedAmr.map(normalizeAmr));
1234
+ if (!assurance.amr.some((amr) => acceptedAmr.has(normalizeAmr(amr)))) {
1221
1235
  return false;
1222
1236
  }
1223
1237
  if (getAalRank(policy.minAal) >= getAalRank(AALs.Aal2)) {
@@ -1314,7 +1328,7 @@ const DEFAULT_SESSION_ASSURANCE_CONFIG = {
1314
1328
  acceptedAmr: [
1315
1329
  AMRs.Pwd,
1316
1330
  AMRs.Oauth,
1317
- AMRs.Saml
1331
+ AMRs.Sso
1318
1332
  ],
1319
1333
  minAal: AALs.Aal1
1320
1334
  };
@@ -1323,7 +1337,7 @@ const DEFAULT_APPLICATION_CONFIG = {
1323
1337
  sessionAssurance: DEFAULT_SESSION_ASSURANCE_CONFIG
1324
1338
  };
1325
1339
  const ApplicationSessionAssuranceConfig = z.object({
1326
- acceptedAmr: AMR.array().optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
1340
+ acceptedAmr: AMR.array().overwrite((amrs) => [...new Set(amrs.map(normalizeAmr))]).optional().default(DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr),
1327
1341
  minAal: AAL.refine(
1328
1342
  (aal) => aal !== AALs.Aal3,
1329
1343
  "Application session assurance currently supports aal1 and aal2 policies"
@@ -1335,7 +1349,7 @@ const ApplicationConfig = z.object({
1335
1349
  });
1336
1350
 
1337
1351
  function allowsDefaultAmrPolicy(config) {
1338
- const acceptedAmr = new Set(config.sessionAssurance.acceptedAmr);
1352
+ const acceptedAmr = new Set(config.sessionAssurance.acceptedAmr.map(normalizeAmr));
1339
1353
  const defaultAcceptedAmr = DEFAULT_SESSION_ASSURANCE_CONFIG.acceptedAmr;
1340
1354
  return config.sessionAssurance.minAal === DEFAULT_SESSION_ASSURANCE_CONFIG.minAal && defaultAcceptedAmr.every((amr) => acceptedAmr.has(amr));
1341
1355
  }
@@ -2017,17 +2031,18 @@ class SessionService {
2017
2031
  });
2018
2032
  }
2019
2033
  /**
2020
- * Initiates SAML-based Single Sign-On authentication flow.
2034
+ * Initiates the Single Sign-On authentication flow. The provider resolved
2035
+ * from the email's domain determines whether SAML or OIDC is used.
2021
2036
  *
2022
- * @param options - SAML sign-in configuration
2023
- * @param options.email - User's email to determine the SAML provider
2037
+ * @param options - SSO sign-in configuration
2038
+ * @param options.email - User's email to determine the SSO provider
2024
2039
  * @param options.callbackURL - URL to redirect to after successful authentication
2025
2040
  * @param options.errorCallbackURL - URL to redirect to on error
2026
2041
  *
2027
2042
  * @throws {EmailRequired} When email is not provided
2028
2043
  * @throws {InvalidCallbackURL} When callback URLs are malformed
2029
2044
  */
2030
- async signInWithSaml({
2045
+ async signInWithSso({
2031
2046
  email,
2032
2047
  callbackURL,
2033
2048
  errorCallbackURL
@@ -2045,8 +2060,7 @@ class SessionService {
2045
2060
  await this.client.signIn.sso({
2046
2061
  email,
2047
2062
  callbackURL,
2048
- errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
2049
- providerType: "saml"
2063
+ errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
2050
2064
  });
2051
2065
  }
2052
2066
  /**
@@ -2352,7 +2366,7 @@ const ApiKeyMetadata = z.object({
2352
2366
  }).optional().nullable()
2353
2367
  });
2354
2368
 
2355
- const LOGIN_METHODS = ["password", "google", "microsoft", "saml", "otp"];
2369
+ const LOGIN_METHODS = ["password", "google", "microsoft", "sso", "otp"];
2356
2370
 
2357
2371
  class AuthClient {
2358
2372
  /**
@@ -2555,4 +2569,4 @@ function extractTokenPayload(token) {
2555
2569
  return payload;
2556
2570
  }
2557
2571
 
2558
- export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
2572
+ export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@meistrari/auth-core",
3
- "version": "1.43.0",
3
+ "version": "2.1.0",
4
4
  "type": "module",
5
5
  "exports": {
6
6
  ".": {