authhero 0.151.0 → 0.153.0

package/dist/authhero.d.ts

@@ -8594,6 +8594,9 @@ export declare const codeInsertSchema: z.ZodObject<{
 		"plain",
 		"S256"
 	]>>;
+	redirect_uri: z.ZodOptional<z.ZodString>;
+	nonce: z.ZodOptional<z.ZodString>;
+	state: z.ZodOptional<z.ZodString>;
 	expires_at: z.ZodString;
 	used_at: z.ZodOptional<z.ZodString>;
 	user_id: z.ZodOptional<z.ZodString>;
@@ -8603,6 +8606,9 @@ export declare const codeInsertSchema: z.ZodObject<{
 	code_type: "password_reset" | "email_verification" | "otp" | "authorization_code" | "oauth2_state" | "ticket";
 	expires_at: string;
 	user_id?: string | undefined;
+	redirect_uri?: string | undefined;
+	state?: string | undefined;
+	nonce?: string | undefined;
 	code_challenge_method?: "S256" | "plain" | undefined;
 	code_challenge?: string | undefined;
 	connection_id?: string | undefined;
@@ -8614,6 +8620,9 @@ export declare const codeInsertSchema: z.ZodObject<{
 	code_type: "password_reset" | "email_verification" | "otp" | "authorization_code" | "oauth2_state" | "ticket";
 	expires_at: string;
 	user_id?: string | undefined;
+	redirect_uri?: string | undefined;
+	state?: string | undefined;
+	nonce?: string | undefined;
 	code_challenge_method?: "S256" | "plain" | undefined;
 	code_challenge?: string | undefined;
 	connection_id?: string | undefined;
@@ -8640,6 +8649,9 @@ export declare const codeSchema: z.ZodObject<{
 		"plain",
 		"S256"
 	]>>;
+	redirect_uri: z.ZodOptional<z.ZodString>;
+	nonce: z.ZodOptional<z.ZodString>;
+	state: z.ZodOptional<z.ZodString>;
 	expires_at: z.ZodString;
 	used_at: z.ZodOptional<z.ZodString>;
 	user_id: z.ZodOptional<z.ZodString>;
@@ -8650,6 +8662,9 @@ export declare const codeSchema: z.ZodObject<{
 	code_type: "password_reset" | "email_verification" | "otp" | "authorization_code" | "oauth2_state" | "ticket";
 	expires_at: string;
 	user_id?: string | undefined;
+	redirect_uri?: string | undefined;
+	state?: string | undefined;
+	nonce?: string | undefined;
 	code_challenge_method?: "S256" | "plain" | undefined;
 	code_challenge?: string | undefined;
 	connection_id?: string | undefined;
@@ -8662,6 +8677,9 @@ export declare const codeSchema: z.ZodObject<{
 	code_type: "password_reset" | "email_verification" | "otp" | "authorization_code" | "oauth2_state" | "ticket";
 	expires_at: string;
 	user_id?: string | undefined;
+	redirect_uri?: string | undefined;
+	state?: string | undefined;
+	nonce?: string | undefined;
 	code_challenge_method?: "S256" | "plain" | undefined;
 	code_challenge?: string | undefined;
 	connection_id?: string | undefined;

package/dist/authhero.mjs

@@ -1852,6 +1852,15 @@ const k1 = o.enum([
   code_challenge_method: o.enum(["plain", "S256"]).optional().openapi({
     description: "The code challenge method used in PKCE in outbound flows"
   }),
+  redirect_uri: o.string().optional().openapi({
+    description: "The redirect URI associated with the code"
+  }),
+  nonce: o.string().optional().openapi({
+    description: "The nonce value used for security in OIDC flows"
+  }),
+  state: o.string().optional().openapi({
+    description: "The state parameter used for CSRF protection in OAuth flows"
+  }),
   expires_at: o.string(),
   used_at: o.string().optional(),
   user_id: o.string().optional()
@@ -5979,7 +5988,10 @@ async function Fh(t, e) {
         Date.now() + h_ * 1e3
       ).toISOString(),
       code_challenge: e.authParams.code_challenge,
-      code_challenge_method: e.authParams.code_challenge_method
+      code_challenge_method: e.authParams.code_challenge_method,
+      redirect_uri: e.authParams.redirect_uri,
+      state: e.authParams.state,
+      nonce: e.authParams.nonce
     })).code_id,
     state: e.authParams.state
   };
@@ -6068,7 +6080,10 @@ async function Zt(t, e) {
       code_type: "ticket",
       login_id: e.loginSession.id,
       expires_at: new Date(Date.now() + m_).toISOString(),
-      code_verifier: [b, v].join("|")
+      code_verifier: [b, v].join("|"),
+      redirect_uri: n.redirect_uri,
+      state: n.state,
+      nonce: n.nonce
     });
     return t.json({
       login_ticket: E.code_id,
@@ -19829,7 +19844,7 @@ async function pb(t, e) {
     if (!os(a, r.code_challenge))
       throw new A(403, { message: "Invalid client credentials" });
   }
-  if (i.authParams.redirect_uri && i.authParams.redirect_uri !== e.redirect_uri)
+  if (r.redirect_uri && r.redirect_uri !== e.redirect_uri)
     throw new A(403, { message: "Invalid redirect uri" });
   const s = await t.env.data.users.get(n.tenant.id, r.user_id);
   if (!s)
@@ -19840,6 +19855,9 @@ async function pb(t, e) {
     loginSession: i,
     authParams: {
       ...i.authParams,
+      // Use the state and nonce from the code as it might differ if it's a silent auth login
+      state: r.state,
+      nonce: r.nonce,
       // Ensure WEB_MESSAGE is explicitly passed, as createAuthResponse relies on it
       response_mode: an.WEB_MESSAGE,
       // Pass through other relevant authParams from the loginSession or original request if necessary
@@ -22277,7 +22295,8 @@ const A4 = new ae().openapi(
       code_id: Dn(),
       code_type: "otp",
       login_id: m.id,
-      expires_at: new Date(Date.now() + es).toISOString()
+      expires_at: new Date(Date.now() + es).toISOString(),
+      redirect_uri: s.redirect_uri
     });
     return i === "link" ? await Vl(t, {
       to: d,
@@ -22696,7 +22715,8 @@ async function C4({
       login_id: u.id,
       expires_at: new Date(
         Date.now() + Zr * 1e3
-      ).toISOString()
+      ).toISOString(),
+      redirect_uri: r.redirect_uri
     }), await Vl(t, {
       code: f,
       to: s,
@@ -24221,7 +24241,8 @@ const g$ = new ae().openapi(
       code_id: u,
       code_type: "otp",
       login_id: s.id,
-      expires_at: new Date(Date.now() + es).toISOString()
+      expires_at: new Date(Date.now() + es).toISOString(),
+      redirect_uri: s.authParams.redirect_uri
     }), w = h$(
       s.auth0Client
     ), { connection: h } = hi(d);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authhero",
-  "version": "0.151.0",
+  "version": "0.153.0",
   "files": [
     "dist"
   ],
@@ -36,7 +36,7 @@
     "vite": "^5.4.11",
     "vite-plugin-dts": "^4.3.0",
     "vitest": "^2.1.5",
-    "@authhero/kysely-adapter": "^10.18.0"
+    "@authhero/kysely-adapter": "^10.19.0"
   },
   "dependencies": {
     "@peculiar/x509": "^1.12.3",
@@ -49,7 +49,7 @@
     "libphonenumber-js": "^1.12.8",
     "nanoid": "^5.0.8",
     "oslo": "^1.2.1",
-    "@authhero/adapter-interfaces": "^0.68.0"
+    "@authhero/adapter-interfaces": "^0.70.0"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^0.19.2",