authhero 5.16.0 → 5.17.1

package/dist/types/middlewares/authentication.d.ts

@@ -13,9 +13,26 @@ export declare const MANAGEMENT_API_AUDIENCE = "urn:authhero:management";
  * token's `aud` includes the management API audience. It must be enabled
  * for the management API and left off for everything else (the `/userinfo`
  * endpoint, for example, takes any access token issued by this tenant).
+ *
+ * `relaxManagementAudience` downgrades that audience check from a hard
+ * rejection to a `console.warn`, letting tokens issued for other audiences
+ * still pass. TRANSITIONAL: use only while migrating clients to request
+ * the management audience; flip back off once warnings stop appearing.
+ *
+ * `additionalManagementAudiences` extends the set of accepted audiences
+ * beyond the built-in `urn:authhero:management`. The resolver receives the
+ * token's `tenant_id` and returns the list of audiences accepted for that
+ * token, so a per-tenant identifier (e.g.
+ * `https://${tenant_id}.token.example.com/v2/api/`) can be constructed at
+ * request time alongside any global legacy identifiers.
  */
+export type ManagementAudienceResolver = (params: {
+    tenant_id?: string;
+}) => string[] | Promise<string[]>;
 export interface AuthMiddlewareOptions {
     requireManagementAudience?: boolean;
+    relaxManagementAudience?: boolean;
+    additionalManagementAudiences?: ManagementAudienceResolver;
 }
 export declare function createAuthMiddleware(app: OpenAPIHono<{
     Bindings: Bindings;

package/dist/types/routes/auth-api/authorize.d.ts

@@ -105,11 +105,17 @@ export declare const authorizeRoutes: OpenAPIHono<{
                     request_uri?: string | undefined;
                 };
             };
-            output: {
-                message: string;
+            output: string | {
+                access_token: string;
+                token_type: string;
+                expires_in: number;
+                id_token?: string | undefined;
+                scope?: string | undefined;
+                state?: string | undefined;
+                refresh_token?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 200;
         } | {
             input: {
                 query: {
@@ -141,17 +147,11 @@ export declare const authorizeRoutes: OpenAPIHono<{
                     request_uri?: string | undefined;
                 };
             };
-            output: string | {
-                access_token: string;
-                token_type: string;
-                expires_in: number;
-                id_token?: string | undefined;
-                scope?: string | undefined;
-                state?: string | undefined;
-                refresh_token?: string | undefined;
+            output: {
+                message: string;
             };
             outputFormat: "json";
-            status: 200;
+            status: 400;
         } | {
             input: {
                 query: {

package/dist/types/routes/auth-api/index.d.ts

@@ -557,11 +557,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     request_uri?: string | undefined;
                 };
             };
-            output: {
-                message: string;
+            output: string | {
+                access_token: string;
+                token_type: string;
+                expires_in: number;
+                id_token?: string | undefined;
+                scope?: string | undefined;
+                state?: string | undefined;
+                refresh_token?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 200;
         } | {
             input: {
                 query: {
@@ -593,17 +599,11 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     request_uri?: string | undefined;
                 };
             };
-            output: string | {
-                access_token: string;
-                token_type: string;
-                expires_in: number;
-                id_token?: string | undefined;
-                scope?: string | undefined;
-                state?: string | undefined;
-                refresh_token?: string | undefined;
+            output: {
+                message: string;
             };
             outputFormat: "json";
-            status: 200;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -723,19 +723,19 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     email: string;
                     send: "code" | "link";
                     authParams: {
-                        audience?: string | undefined;
-                        response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
-                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
-                        scope?: string | undefined;
                         username?: string | undefined;
-                        state?: string | undefined;
-                        act_as?: string | undefined;
-                        redirect_uri?: string | undefined;
+                        scope?: string | undefined;
+                        audience?: string | undefined;
                         organization?: string | undefined;
+                        code_challenge?: string | undefined;
+                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+                        redirect_uri?: string | undefined;
                         nonce?: string | undefined;
+                        state?: string | undefined;
+                        act_as?: string | undefined;
+                        response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
+                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         prompt?: string | undefined;
-                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
-                        code_challenge?: string | undefined;
                         ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
@@ -759,19 +759,19 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     phone_number: string;
                     send: "code" | "link";
                     authParams: {
-                        audience?: string | undefined;
-                        response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
-                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
-                        scope?: string | undefined;
                         username?: string | undefined;
-                        state?: string | undefined;
-                        act_as?: string | undefined;
-                        redirect_uri?: string | undefined;
+                        scope?: string | undefined;
+                        audience?: string | undefined;
                         organization?: string | undefined;
+                        code_challenge?: string | undefined;
+                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+                        redirect_uri?: string | undefined;
                         nonce?: string | undefined;
+                        state?: string | undefined;
+                        act_as?: string | undefined;
+                        response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
+                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         prompt?: string | undefined;
-                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
-                        code_challenge?: string | undefined;
                         ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
@@ -1001,7 +1001,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -1037,7 +1037,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {};
@@ -1078,7 +1078,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -1114,15 +1114,20 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
-                error: string;
-                error_description?: string | undefined;
+                access_token: string;
+                token_type: string;
+                expires_in: number;
+                id_token?: string | undefined;
+                scope?: string | undefined;
+                state?: string | undefined;
+                refresh_token?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 200;
         } | {
             input: {
                 form: {
@@ -1158,7 +1163,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -1194,20 +1199,15 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
-                access_token: string;
-                token_type: string;
-                expires_in: number;
-                id_token?: string | undefined;
-                scope?: string | undefined;
-                state?: string | undefined;
-                refresh_token?: string | undefined;
+                error: string;
+                error_description?: string | undefined;
             };
             outputFormat: "json";
-            status: 200;
+            status: 400;
         } | {
             input: {
                 form: {
@@ -1243,7 +1243,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -1279,7 +1279,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
@@ -1323,7 +1323,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -1359,7 +1359,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
@@ -1566,7 +1566,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 200;
         } | {
             input: {
                 query: {
@@ -1580,7 +1580,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 302;
         } | {
             input: {
                 query: {
@@ -1594,7 +1594,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         };
     };
 }, "/oidc/logout"> & import("hono/types").MergeSchemaPath<{

package/dist/types/routes/auth-api/oidc-logout.d.ts

@@ -18,7 +18,7 @@ export declare const oidcLogoutRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 200;
         } | {
             input: {
                 query: {
@@ -32,7 +32,7 @@ export declare const oidcLogoutRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 302;
         } | {
             input: {
                 query: {
@@ -46,7 +46,7 @@ export declare const oidcLogoutRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         };
     };
 }, "/">;

package/dist/types/routes/auth-api/passwordless.d.ts

@@ -14,19 +14,19 @@ export declare const passwordlessRoutes: OpenAPIHono<{
                     email: string;
                     send: "code" | "link";
                     authParams: {
-                        audience?: string | undefined;
-                        response_type?: AuthorizationResponseType | undefined;
-                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
-                        scope?: string | undefined;
                         username?: string | undefined;
-                        state?: string | undefined;
-                        act_as?: string | undefined;
-                        redirect_uri?: string | undefined;
+                        scope?: string | undefined;
+                        audience?: string | undefined;
                         organization?: string | undefined;
+                        code_challenge?: string | undefined;
+                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+                        redirect_uri?: string | undefined;
                         nonce?: string | undefined;
+                        state?: string | undefined;
+                        act_as?: string | undefined;
+                        response_type?: AuthorizationResponseType | undefined;
+                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         prompt?: string | undefined;
-                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
-                        code_challenge?: string | undefined;
                         ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
@@ -50,19 +50,19 @@ export declare const passwordlessRoutes: OpenAPIHono<{
                     phone_number: string;
                     send: "code" | "link";
                     authParams: {
-                        audience?: string | undefined;
-                        response_type?: AuthorizationResponseType | undefined;
-                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
-                        scope?: string | undefined;
                         username?: string | undefined;
-                        state?: string | undefined;
-                        act_as?: string | undefined;
-                        redirect_uri?: string | undefined;
+                        scope?: string | undefined;
+                        audience?: string | undefined;
                         organization?: string | undefined;
+                        code_challenge?: string | undefined;
+                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+                        redirect_uri?: string | undefined;
                         nonce?: string | undefined;
+                        state?: string | undefined;
+                        act_as?: string | undefined;
+                        response_type?: AuthorizationResponseType | undefined;
+                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         prompt?: string | undefined;
-                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
-                        code_challenge?: string | undefined;
                         ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;

package/dist/types/routes/auth-api/token.d.ts

@@ -40,7 +40,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -76,7 +76,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {};
@@ -117,7 +117,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -153,15 +153,20 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
-                error: string;
-                error_description?: string | undefined;
+                access_token: string;
+                token_type: string;
+                expires_in: number;
+                id_token?: string | undefined;
+                scope?: string | undefined;
+                state?: string | undefined;
+                refresh_token?: string | undefined;
             };
             outputFormat: "json";
-            status: 400;
+            status: 200;
         } | {
             input: {
                 form: {
@@ -197,7 +202,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -233,20 +238,15 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
-                access_token: string;
-                token_type: string;
-                expires_in: number;
-                id_token?: string | undefined;
-                scope?: string | undefined;
-                state?: string | undefined;
-                refresh_token?: string | undefined;
+                error: string;
+                error_description?: string | undefined;
             };
             outputFormat: "json";
-            status: 200;
+            status: 400;
         } | {
             input: {
                 form: {
@@ -282,7 +282,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -318,7 +318,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {
@@ -362,7 +362,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             } & {
                 json: {
@@ -398,7 +398,7 @@ export declare const tokenRoutes: OpenAPIHono<{
                     client_id: string;
                     username: string;
                     otp: string;
-                    realm: "sms" | "email";
+                    realm: "email" | "sms";
                 };
             };
             output: {

package/dist/types/routes/management-api/action-executions.d.ts

@@ -31,7 +31,7 @@ export declare const actionExecutionsRoutes: OpenAPIHono<{
             output: {
                 id: string;
                 trigger_id: string;
-                status: "pending" | "unspecified" | "final" | "partial" | "canceled" | "suspended";
+                status: "unspecified" | "pending" | "final" | "partial" | "canceled" | "suspended";
                 results: {
                     action_name: string;
                     error: {
@@ -78,7 +78,7 @@ export declare const actionExecutionsRoutes: OpenAPIHono<{
                 logs: {
                     action_name: string;
                     lines: {
-                        level: "error" | "log" | "info" | "warn" | "debug";
+                        level: "log" | "error" | "info" | "warn" | "debug";
                         message: string;
                     }[];
                 }[];

package/dist/types/routes/management-api/actions.d.ts

@@ -661,7 +661,7 @@ export declare const actionsRoutes: OpenAPIHono<{
                     args: import("hono/utils/types").JSONValue[];
                 }[];
                 logs: {
-                    level: "error" | "log" | "info" | "warn" | "debug";
+                    level: "log" | "error" | "info" | "warn" | "debug";
                     message: string;
                 }[];
                 error?: string | undefined;

package/dist/types/routes/management-api/authentication-methods.d.ts

@@ -37,7 +37,7 @@ export declare const authenticationMethodsRoutes: OpenAPIHono<{
                 };
             } & {
                 json: {
-                    type: "push" | "email" | "passkey" | "phone" | "totp" | "webauthn-roaming" | "webauthn-platform";
+                    type: "email" | "push" | "passkey" | "phone" | "totp" | "webauthn-roaming" | "webauthn-platform";
                     phone_number?: string | undefined;
                     totp_secret?: string | undefined;
                     credential_id?: string | undefined;

package/dist/types/routes/management-api/branding.d.ts

@@ -27,7 +27,7 @@ export declare const brandingRoutes: OpenAPIHono<{
                     base_focus_color: string;
                     base_hover_color: string;
                     body_text: string;
-                    captcha_widget_theme: "auto" | "light" | "dark";
+                    captcha_widget_theme: "dark" | "light" | "auto";
                     error: string;
                     header: string;
                     icons: string;
@@ -117,7 +117,7 @@ export declare const brandingRoutes: OpenAPIHono<{
                         base_focus_color: string;
                         base_hover_color: string;
                         body_text: string;
-                        captcha_widget_theme: "auto" | "light" | "dark";
+                        captcha_widget_theme: "dark" | "light" | "auto";
                         error: string;
                         header: string;
                         icons: string;
@@ -196,7 +196,7 @@ export declare const brandingRoutes: OpenAPIHono<{
                     base_focus_color: string;
                     base_hover_color: string;
                     body_text: string;
-                    captcha_widget_theme: "auto" | "light" | "dark";
+                    captcha_widget_theme: "dark" | "light" | "auto";
                     error: string;
                     header: string;
                     icons: string;
@@ -286,7 +286,7 @@ export declare const brandingRoutes: OpenAPIHono<{
                 font?: {
                     url: string;
                 } | undefined;
-                dark_mode?: "auto" | "light" | "dark" | undefined;
+                dark_mode?: "dark" | "light" | "auto" | undefined;
             };
             outputFormat: "json";
             status: 200;
@@ -316,7 +316,7 @@ export declare const brandingRoutes: OpenAPIHono<{
                     font?: {
                         url: string;
                     } | undefined;
-                    dark_mode?: "auto" | "light" | "dark" | undefined;
+                    dark_mode?: "dark" | "light" | "auto" | undefined;
                 };
             };
             output: {
@@ -335,7 +335,7 @@ export declare const brandingRoutes: OpenAPIHono<{
                 font?: {
                     url: string;
                 } | undefined;
-                dark_mode?: "auto" | "light" | "dark" | undefined;
+                dark_mode?: "dark" | "light" | "auto" | undefined;
             };
             outputFormat: "json";
             status: 200;
@@ -370,7 +370,7 @@ export declare const brandingRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 204;
         } | {
             input: {
                 header: {
@@ -383,7 +383,7 @@ export declare const brandingRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 204;
+            status: 400;
         };
     };
 } & {

package/dist/types/routes/management-api/connections.d.ts

@@ -852,7 +852,7 @@ export declare const connectionRoutes: OpenAPIHono<{
                 };
             } | {
                 mode: "inline";
-                status: "error" | "success";
+                status: "success" | "error";
                 connection_id: string;
                 connection_name: string;
                 strategy: string;