authhero 5.21.1 → 7.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +105 -105
  3. package/dist/authhero.d.ts +173 -122
  4. package/dist/authhero.mjs +13563 -10885
  5. package/dist/stats.html +1 -1
  6. package/dist/tsconfig.types.tsbuildinfo +1 -1
  7. package/dist/types/authentication-flows/passwordless.d.ts +3 -3
  8. package/dist/types/helpers/dcr/metadata-mapping.d.ts +1 -1
  9. package/dist/types/index.d.ts +116 -115
  10. package/dist/types/routes/auth-api/index.d.ts +21 -21
  11. package/dist/types/routes/auth-api/passwordless.d.ts +18 -18
  12. package/dist/types/routes/auth-api/register/index.d.ts +2 -2
  13. package/dist/types/routes/auth-api/well-known.d.ts +1 -1
  14. package/dist/types/routes/management-api/action-executions.d.ts +1 -1
  15. package/dist/types/routes/management-api/actions.d.ts +3 -3
  16. package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
  17. package/dist/types/routes/management-api/client-grants.d.ts +8 -8
  18. package/dist/types/routes/management-api/clients.d.ts +7 -7
  19. package/dist/types/routes/management-api/custom-domains.d.ts +7 -7
  20. package/dist/types/routes/management-api/email-templates.d.ts +20 -20
  21. package/dist/types/routes/management-api/emails.d.ts +2 -2
  22. package/dist/types/routes/management-api/failed-events.d.ts +1 -1
  23. package/dist/types/routes/management-api/forms.d.ts +7 -7
  24. package/dist/types/routes/management-api/guardian.d.ts +5 -5
  25. package/dist/types/routes/management-api/index.d.ts +82 -82
  26. package/dist/types/routes/management-api/logs.d.ts +3 -3
  27. package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
  28. package/dist/types/routes/management-api/organizations.d.ts +3 -3
  29. package/dist/types/routes/management-api/prompts.d.ts +4 -4
  30. package/dist/types/routes/management-api/users.d.ts +2 -2
  31. package/dist/types/routes/proxy-control-plane/index.d.ts +21 -7
  32. package/dist/types/routes/proxy-control-plane/verify.d.ts +39 -0
  33. package/dist/types/routes/universal-login/common.d.ts +2 -2
  34. package/dist/types/routes/universal-login/flow-api.d.ts +8 -8
  35. package/dist/types/routes/universal-login/form-node.d.ts +4 -4
  36. package/dist/types/routes/universal-login/index.d.ts +4 -4
  37. package/dist/types/routes/universal-login/u2-form-node.d.ts +2 -2
  38. package/dist/types/routes/universal-login/u2-index.d.ts +8 -8
  39. package/dist/types/routes/universal-login/u2-routes.d.ts +6 -6
  40. package/dist/types/strategies/microsoft-entra.d.ts +23 -0
  41. package/dist/types/strategies/waad.d.ts +24 -0
  42. package/dist/types/strategies/windowslive.d.ts +24 -0
  43. package/dist/types/types/AuthHeroConfig.d.ts +17 -5
  44. package/dist/types/utils/jwks.d.ts +2 -2
  45. package/package.json +5 -5
package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
@@ -258,7 +258,7 @@ export declare const u2Routes: OpenAPIHono<{
258
258
  } | {
259
259
  input: {
260
260
  param: {
261
- screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
261
+ screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
262
262
  };
263
263
  } & {
264
264
  query: {
package/dist/types/strategies/microsoft-entra.d.ts ADDED
@@ -0,0 +1,23 @@
1
+ import { Context } from "hono";
2
+ import { Connection } from "@authhero/adapter-interfaces";
3
+ import { Bindings, Variables } from "../types";
4
+ export declare function microsoftEntraRedirect(ctx: Context<{
5
+ Bindings: Bindings;
6
+ Variables: Variables;
7
+ }>, connection: Connection, loginHint: string | undefined, defaultTenant: string): Promise<{
8
+ redirectUrl: string;
9
+ code: string;
10
+ codeVerifier: string;
11
+ }>;
12
+ export declare function microsoftEntraValidate(ctx: Context<{
13
+ Bindings: Bindings;
14
+ Variables: Variables;
15
+ }>, connection: Connection, code: string, code_verifier: string | undefined, defaultTenant: string): Promise<{
16
+ sub: string;
17
+ email: string | undefined;
18
+ given_name: string | undefined;
19
+ family_name: string | undefined;
20
+ name: string | undefined;
21
+ picture: unknown;
22
+ }>;
23
+ export declare const microsoftLogoDataUri = "data:image/svg+xml,%3Csvg%20width%3D%2245%22%20height%3D%2245%22%20viewBox%3D%220%200%2045%2045%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22%23F25022%22%20d%3D%22M0%200H21.43V21.43H0V0Z%22%2F%3E%3Cpath%20fill%3D%22%237FBA00%22%20d%3D%22M23.57%200H45V21.43H23.57V0Z%22%2F%3E%3Cpath%20fill%3D%22%2300A4EF%22%20d%3D%22M0%2023.57H21.43V45H0V23.57Z%22%2F%3E%3Cpath%20fill%3D%22%23FFB900%22%20d%3D%22M23.57%2023.57H45V45H23.57V23.57Z%22%2F%3E%3C%2Fsvg%3E";
package/dist/types/strategies/waad.d.ts ADDED
@@ -0,0 +1,24 @@
1
+ import { Context } from "hono";
2
+ import { Connection } from "@authhero/adapter-interfaces";
3
+ import { Bindings, Variables } from "../types";
4
+ export declare const displayName = "Microsoft Azure AD";
5
+ export declare const logoDataUri = "data:image/svg+xml,%3Csvg%20width%3D%2245%22%20height%3D%2245%22%20viewBox%3D%220%200%2045%2045%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22%23F25022%22%20d%3D%22M0%200H21.43V21.43H0V0Z%22%2F%3E%3Cpath%20fill%3D%22%237FBA00%22%20d%3D%22M23.57%200H45V21.43H23.57V0Z%22%2F%3E%3Cpath%20fill%3D%22%2300A4EF%22%20d%3D%22M0%2023.57H21.43V45H0V23.57Z%22%2F%3E%3Cpath%20fill%3D%22%23FFB900%22%20d%3D%22M23.57%2023.57H45V45H23.57V23.57Z%22%2F%3E%3C%2Fsvg%3E";
6
+ export declare function getRedirect(ctx: Context<{
7
+ Bindings: Bindings;
8
+ Variables: Variables;
9
+ }>, connection: Connection, loginHint?: string): Promise<{
10
+ redirectUrl: string;
11
+ code: string;
12
+ codeVerifier: string;
13
+ }>;
14
+ export declare function validateAuthorizationCodeAndGetUser(ctx: Context<{
15
+ Bindings: Bindings;
16
+ Variables: Variables;
17
+ }>, connection: Connection, code: string, code_verifier?: string): Promise<{
18
+ sub: string;
19
+ email: string | undefined;
20
+ given_name: string | undefined;
21
+ family_name: string | undefined;
22
+ name: string | undefined;
23
+ picture: unknown;
24
+ }>;
package/dist/types/strategies/windowslive.d.ts ADDED
@@ -0,0 +1,24 @@
1
+ import { Context } from "hono";
2
+ import { Connection } from "@authhero/adapter-interfaces";
3
+ import { Bindings, Variables } from "../types";
4
+ export declare const displayName = "Microsoft Account";
5
+ export declare const logoDataUri = "data:image/svg+xml,%3Csvg%20width%3D%2245%22%20height%3D%2245%22%20viewBox%3D%220%200%2045%2045%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20fill%3D%22%23F25022%22%20d%3D%22M0%200H21.43V21.43H0V0Z%22%2F%3E%3Cpath%20fill%3D%22%237FBA00%22%20d%3D%22M23.57%200H45V21.43H23.57V0Z%22%2F%3E%3Cpath%20fill%3D%22%2300A4EF%22%20d%3D%22M0%2023.57H21.43V45H0V23.57Z%22%2F%3E%3Cpath%20fill%3D%22%23FFB900%22%20d%3D%22M23.57%2023.57H45V45H23.57V23.57Z%22%2F%3E%3C%2Fsvg%3E";
6
+ export declare function getRedirect(ctx: Context<{
7
+ Bindings: Bindings;
8
+ Variables: Variables;
9
+ }>, connection: Connection, loginHint?: string): Promise<{
10
+ redirectUrl: string;
11
+ code: string;
12
+ codeVerifier: string;
13
+ }>;
14
+ export declare function validateAuthorizationCodeAndGetUser(ctx: Context<{
15
+ Bindings: Bindings;
16
+ Variables: Variables;
17
+ }>, connection: Connection, code: string, code_verifier?: string): Promise<{
18
+ sub: string;
19
+ email: string | undefined;
20
+ given_name: string | undefined;
21
+ family_name: string | undefined;
22
+ name: string | undefined;
23
+ picture: unknown;
24
+ }>;
package/dist/types/types/AuthHeroConfig.d.ts CHANGED
@@ -283,14 +283,26 @@ export interface AuthHeroConfig {
283
283
  * data plane. When set, mounts `GET /api/v2/proxy/control-plane/hosts/:host`
284
284
  * which returns the cross-tenant `ResolvedHost` for the given hostname.
285
285
  *
286
- * This endpoint is read by remote proxy deployments via
287
- * `createHttpProxyAdapter`. It is **cross-tenant** — gate it with a
288
- * dedicated credential (shared secret, mTLS, or a JWT scoped to
289
- * `proxy:resolve_host`), never with a tenant token.
286
+ * Authentication is opinionated and built in: incoming requests must
287
+ * carry a `Bearer` JWT signed by a key in `jwksUrl`, with `iss` matching
288
+ * the runtime `env.ISSUER` (strict URL equality after trailing-slash
289
+ * normalization) and the `proxy:resolve_host` scope. The matching
290
+ * client-side helper is `createHttpProxyAdapter` in `@authhero/proxy`.
290
291
  */
291
292
  proxyControlPlane?: {
292
293
  resolveHost: (host: string) => Promise<import("@authhero/proxy").ResolvedHost | null>;
293
- authenticate: (request: Request) => Promise<boolean> | boolean;
294
+ /**
295
+ * JWKS document URL used to verify the bearer token. On a single-shard
296
+ * deployment this is typically `${env.ISSUER}/.well-known/jwks.json`.
297
+ */
298
+ jwksUrl: string;
299
+ /**
300
+ * Optional fetch override for `jwksUrl`. Defaults to global `fetch`.
301
+ * Hosts on Cloudflare Workers can pass
302
+ * `(url) => env.JWKS_SERVICE.fetch(url)` to route through a service
303
+ * binding instead of the public network.
304
+ */
305
+ jwksFetch?: (url: string) => Promise<Response>;
294
306
  /**
295
307
  * Optional receiver for `POST /sync` events emitted by tenant shards via
296
308
  * the `ControlPlaneSyncDestination`. Mount on the control-plane authhero
package/dist/types/utils/jwks.d.ts CHANGED
@@ -9,7 +9,7 @@ import { SigningKeyModeOption } from "../types/AuthHeroConfig";
9
9
  */
10
10
  export declare function getJwksFromDatabase(data: DataAdapters): Promise<{
11
11
  alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
12
- kty: "EC" | "RSA" | "oct";
12
+ kty: "RSA" | "EC" | "oct";
13
13
  kid?: string | undefined;
14
14
  use?: "sig" | "enc" | undefined;
15
15
  n?: string | undefined;
@@ -28,7 +28,7 @@ export declare function getJwksFromDatabase(data: DataAdapters): Promise<{
28
28
  */
29
29
  export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
30
30
  alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
31
- kty: "EC" | "RSA" | "oct";
31
+ kty: "RSA" | "EC" | "oct";
32
32
  kid?: string | undefined;
33
33
  use?: "sig" | "enc" | undefined;
34
34
  n?: string | undefined;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/markusahlstrand/authhero"
13
13
  },
14
- "version": "5.21.1",
14
+ "version": "7.0.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -62,8 +62,8 @@
62
62
  "vite": "^8.0.14",
63
63
  "vite-plugin-dts": "^4.5.4",
64
64
  "vitest": "^4.1.7",
65
- "@authhero/kysely-adapter": "11.8.1",
66
- "@authhero/widget": "0.32.38"
65
+ "@authhero/kysely-adapter": "11.8.3",
66
+ "@authhero/widget": "0.32.39"
67
67
  },
68
68
  "dependencies": {
69
69
  "@peculiar/x509": "^1.14.0",
@@ -81,8 +81,8 @@
81
81
  "qrcode": "^1.5.4",
82
82
  "sanitize-html": "^2.17.4",
83
83
  "xstate": "^5.31.1",
84
- "@authhero/adapter-interfaces": "2.13.1",
85
- "@authhero/proxy": "0.4.4",
84
+ "@authhero/adapter-interfaces": "3.0.0",
85
+ "@authhero/proxy": "0.5.0",
86
86
  "@authhero/saml": "0.4.1"
87
87
  },
88
88
  "peerDependencies": {