@seamless-auth/types 0.28.0 → 0.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/README.md +22 -1
  3. package/dist/schemas/oauth/schema.d.ts +2 -0
  4. package/dist/schemas/oauth/schema.d.ts.map +1 -1
  5. package/dist/schemas/oauth/schema.js +8 -0
  6. package/dist/schemas/oauth/schema.js.map +1 -1
  7. package/package.json +4 -3
  8. package/src/schemas/oauth/schema.ts +8 -0
package/CHANGELOG.md CHANGED
@@ -1,5 +1,18 @@
1
1
  # @seamless-auth/types
2
2
 
3
+ ## 0.29.0
4
+
5
+ ### Minor Changes
6
+
7
+ - c386361: Add `binding` to the OAuth start response and the callback request. The auth server returns a
8
+ random `binding` from `/oauth/:providerId/start` and checks it on `/oauth/:providerId/callback`,
9
+ so a `state` can only be finished by the client that started the sign-in. Both fields are
10
+ optional in the schemas so a client can still parse a response from an older auth server.
11
+
12
+ ### Patch Changes
13
+
14
+ - 14077a9: Raise the `zod` dependency floor from `^4.3.6` to `^4.5.0`. The published declarations use the two-argument `ZodPreprocess` type, which zod 4.3.x does not export and zod 4.4.x declares with a single type parameter, so a consumer resolving zod below 4.5.0 with `skipLibCheck: false` got TS2724 or TS2707 from this package's `.d.ts` files. Consumers pinned to zod 4.4.x or older should upgrade to zod 4.5.0 or later.
15
+
3
16
  ## 0.28.0
4
17
 
5
18
  ### Minor Changes
package/README.md CHANGED
@@ -19,6 +19,23 @@ contracts built on top of them. Every layer of the stack validates against the s
19
19
  Because everything downstream imports these contracts, a change here is treated as
20
20
  breaking by default. See [Versioning and stability](#versioning-and-stability).
21
21
 
22
+ ## Start here
23
+
24
+ New to Seamless Auth? The [self-hosted quickstart](https://docs.seamlessauth.com/start/quickstart/) runs the full stack locally with Docker. If Seamless hosts your auth instance, follow the [managed quickstart](https://docs.seamlessauth.com/start/managed-quickstart/) instead.
25
+
26
+ This package is not a node in the diagram below because it sits under all of them: `seamless-auth-api`, the server adapters (through `@seamless-auth/core`), the React and React Native SDKs, the admin dashboard, and the CLI all validate against these schemas.
27
+
28
+ ```mermaid
29
+ flowchart LR
30
+ browser["Browser<br/>@seamless-auth/react"] -- "signed httpOnly cookies" --> backend
31
+ native["Native app<br/>@seamless-auth/react-native"] -- "bearer tokens" --> backend
32
+ backend["Your backend<br/>@seamless-auth/express, fastify, or nextjs<br/>mounted at /auth"] -- "bearer token + service token" --> api
33
+ api["seamless-auth-api<br/>owns the session"] --> db[("Postgres")]
34
+ backend -. "verifies tokens with JWKS" .-> api
35
+ ```
36
+
37
+ [How the pieces connect](https://docs.seamlessauth.com/start/overview/#how-the-pieces-connect) explains each hop. [Compatibility matrix](https://docs.seamlessauth.com/build/ecosystem/#compatibility-matrix) lists which package versions work together.
38
+
22
39
  ## Requirements
23
40
 
24
41
  | | |
@@ -185,7 +202,7 @@ history.
185
202
  ## Security
186
203
 
187
204
  Do not open a public issue for a vulnerability. Report it privately to
188
- **security@seamlessauth.com**. See [SECURITY.md](SECURITY.md) for what to include, our
205
+ **security@fellscode.com**. See [SECURITY.md](SECURITY.md) for what to include, our
189
206
  acknowledgement window, and the coordinated disclosure process.
190
207
 
191
208
  ## Development
@@ -224,6 +241,10 @@ existing schema as breaking until you can argue otherwise.
224
241
 
225
242
  [Apache-2.0](LICENSE) © Fells Code, LLC
226
243
 
244
+ Project governance, including the
245
+ [Seamless Auth License Pledge](https://github.com/fells-code/.github/blob/main/GOVERNANCE.md#the-seamless-auth-license-pledge),
246
+ is in the fells-code [GOVERNANCE.md](https://github.com/fells-code/.github/blob/main/GOVERNANCE.md).
247
+
227
248
  ## Links
228
249
 
229
250
  - [npm package](https://www.npmjs.com/package/@seamless-auth/types)
package/dist/schemas/oauth/schema.d.ts CHANGED
@@ -31,11 +31,13 @@ export declare const StartOAuthLoginResponseSchema: z.ZodObject<{
31
31
  }, z.core.$strip>;
32
32
  state: z.ZodString;
33
33
  authorizationUrl: z.ZodURL;
34
+ binding: z.ZodOptional<z.ZodString>;
34
35
  }, z.core.$strip>;
35
36
  export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSchema>;
36
37
  export declare const FinishOAuthLoginRequestSchema: z.ZodObject<{
37
38
  code: z.ZodString;
38
39
  state: z.ZodString;
40
+ binding: z.ZodOptional<z.ZodString>;
39
41
  }, z.core.$strip>;
40
42
  export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSchema>;
41
43
  export declare const OAuthLoginSuccessResponseSchema: z.ZodObject<{
package/dist/schemas/oauth/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAoB1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,2IAOpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;iBAUxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAoB1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,2IAOpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
package/dist/schemas/oauth/schema.js CHANGED
@@ -22,10 +22,18 @@ export const StartOAuthLoginResponseSchema = z.object({
22
22
  provider: PublicOAuthProviderSchema,
23
23
  state: z.string(),
24
24
  authorizationUrl: z.url(),
25
+ /**
26
+ * Binds `state` to the client that started the sign-in. The client keeps it and sends
27
+ * it back with the callback; it never goes to the provider. Optional only so a client
28
+ * can parse a response from an auth server that predates it.
29
+ */
30
+ binding: z.string().optional(),
25
31
  });
26
32
  export const FinishOAuthLoginRequestSchema = z.object({
27
33
  code: z.string().trim().min(1),
28
34
  state: z.string().trim().min(1),
35
+ /** The `binding` the start response returned to this client. */
36
+ binding: z.string().trim().min(1).optional(),
29
37
  });
30
38
  export const OAuthLoginSuccessResponseSchema = RefreshSuccessResponseSchema.omit({
31
39
  sessionId: true,
package/dist/schemas/oauth/schema.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR;;;;;;;;OAQG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,iFAAiF;IACjF,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gEAAgE;IAChE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR;;;;;;;;OAQG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,iFAAiF;IACjF,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@seamless-auth/types",
3
- "version": "0.28.0",
3
+ "version": "0.29.0",
4
4
  "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
5
5
  "author": "Fells Code, LLC",
6
6
  "license": "Apache-2.0",
@@ -60,6 +60,7 @@
60
60
  "prepublishOnly": "npm run build",
61
61
  "test": "vitest run",
62
62
  "test:watch": "vitest",
63
+ "test:zod-floor": "node scripts/check-zod-floor.mjs",
63
64
  "changeset": "changeset",
64
65
  "version-packages": "changeset version",
65
66
  "release:stable": "npm run build && changeset publish",
@@ -75,7 +76,7 @@
75
76
  ]
76
77
  },
77
78
  "dependencies": {
78
- "zod": "^4.3.6"
79
+ "zod": "^4.5.0"
79
80
  },
80
81
  "devDependencies": {
81
82
  "@changesets/cli": "^3.0.2",
@@ -87,7 +88,7 @@
87
88
  "eslint-config-prettier": "^10.1.8",
88
89
  "husky": "^9.1.7",
89
90
  "lint-staged": "^17.2.0",
90
- "prettier": "3.9.9",
91
+ "prettier": "3.9.10",
91
92
  "typescript": "^5.9.3",
92
93
  "vitest": "^5.0.3"
93
94
  },
package/src/schemas/oauth/schema.ts CHANGED
@@ -35,6 +35,12 @@ export const StartOAuthLoginResponseSchema = z.object({
35
35
  provider: PublicOAuthProviderSchema,
36
36
  state: z.string(),
37
37
  authorizationUrl: z.url(),
38
+ /**
39
+ * Binds `state` to the client that started the sign-in. The client keeps it and sends
40
+ * it back with the callback; it never goes to the provider. Optional only so a client
41
+ * can parse a response from an auth server that predates it.
42
+ */
43
+ binding: z.string().optional(),
38
44
  });
39
45
 
40
46
  export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSchema>;
@@ -42,6 +48,8 @@ export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSche
42
48
  export const FinishOAuthLoginRequestSchema = z.object({
43
49
  code: z.string().trim().min(1),
44
50
  state: z.string().trim().min(1),
51
+ /** The `binding` the start response returned to this client. */
52
+ binding: z.string().trim().min(1).optional(),
45
53
  });
46
54
 
47
55
  export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSchema>;