authhero 5.8.1 → 5.9.1

package/dist/types/routes/auth-api/logout.d.ts

@@ -0,0 +1,20 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { Bindings, Variables } from "../../types";
+export declare const logoutRoutes: OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/": {
+        $get: {
+            input: {
+                query: {
+                    client_id: string;
+                    returnTo?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 302;
+        };
+    };
+}, "/">;

package/dist/types/routes/auth-api/oidc-logout.d.ts

@@ -0,0 +1,52 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { Bindings, Variables } from "../../types";
+export declare const oidcLogoutRoutes: OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/": {
+        $get: {
+            input: {
+                query: {
+                    id_token_hint?: string | undefined;
+                    client_id?: string | undefined;
+                    post_logout_redirect_uri?: string | undefined;
+                    state?: string | undefined;
+                    logout_hint?: string | undefined;
+                    ui_locales?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 200;
+        } | {
+            input: {
+                query: {
+                    id_token_hint?: string | undefined;
+                    client_id?: string | undefined;
+                    post_logout_redirect_uri?: string | undefined;
+                    state?: string | undefined;
+                    logout_hint?: string | undefined;
+                    ui_locales?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 302;
+        } | {
+            input: {
+                query: {
+                    id_token_hint?: string | undefined;
+                    client_id?: string | undefined;
+                    post_logout_redirect_uri?: string | undefined;
+                    state?: string | undefined;
+                    logout_hint?: string | undefined;
+                    ui_locales?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 400;
+        };
+    };
+}, "/">;

package/dist/types/routes/auth-api/passwordless.d.ts

@@ -0,0 +1,154 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { AuthorizationResponseType } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../../types";
+export declare const passwordlessRoutes: OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/start": {
+        $post: {
+            input: {
+                json: {
+                    connection: "email";
+                    client_id: string;
+                    email: string;
+                    send: "code" | "link";
+                    authParams: {
+                        state?: string | undefined;
+                        audience?: string | undefined;
+                        response_type?: AuthorizationResponseType | undefined;
+                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
+                        scope?: string | undefined;
+                        username?: string | undefined;
+                        organization?: string | undefined;
+                        nonce?: string | undefined;
+                        redirect_uri?: string | undefined;
+                        act_as?: string | undefined;
+                        prompt?: string | undefined;
+                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+                        code_challenge?: string | undefined;
+                        ui_locales?: string | undefined;
+                        max_age?: number | undefined;
+                        acr_values?: string | undefined;
+                        claims?: {
+                            userinfo?: Record<string, {
+                                essential?: boolean | undefined;
+                                value?: unknown;
+                                values?: unknown[] | undefined;
+                            } | null> | undefined;
+                            id_token?: Record<string, {
+                                essential?: boolean | undefined;
+                                value?: unknown;
+                                values?: unknown[] | undefined;
+                            } | null> | undefined;
+                        } | undefined;
+                        vendor_id?: string | undefined;
+                    };
+                } | {
+                    client_id: string;
+                    connection: "sms";
+                    phone_number: string;
+                    send: "code" | "link";
+                    authParams: {
+                        state?: string | undefined;
+                        audience?: string | undefined;
+                        response_type?: AuthorizationResponseType | undefined;
+                        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
+                        scope?: string | undefined;
+                        username?: string | undefined;
+                        organization?: string | undefined;
+                        nonce?: string | undefined;
+                        redirect_uri?: string | undefined;
+                        act_as?: string | undefined;
+                        prompt?: string | undefined;
+                        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+                        code_challenge?: string | undefined;
+                        ui_locales?: string | undefined;
+                        max_age?: number | undefined;
+                        acr_values?: string | undefined;
+                        claims?: {
+                            userinfo?: Record<string, {
+                                essential?: boolean | undefined;
+                                value?: unknown;
+                                values?: unknown[] | undefined;
+                            } | null> | undefined;
+                            id_token?: Record<string, {
+                                essential?: boolean | undefined;
+                                value?: unknown;
+                                values?: unknown[] | undefined;
+                            } | null> | undefined;
+                        } | undefined;
+                        vendor_id?: string | undefined;
+                    };
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 200;
+        };
+    };
+} & {
+    "/verify_redirect": {
+        $get: {
+            input: {
+                query: {
+                    scope: string;
+                    response_type: AuthorizationResponseType;
+                    redirect_uri: string;
+                    state: string;
+                    verification_code: string;
+                    connection: string;
+                    client_id: string;
+                    email: string;
+                    nonce?: string | undefined;
+                    audience?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 302;
+        } | {
+            input: {
+                query: {
+                    scope: string;
+                    response_type: AuthorizationResponseType;
+                    redirect_uri: string;
+                    state: string;
+                    verification_code: string;
+                    connection: string;
+                    client_id: string;
+                    email: string;
+                    nonce?: string | undefined;
+                    audience?: string | undefined;
+                };
+            };
+            output: {
+                error: string;
+                error_description?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                query: {
+                    scope: string;
+                    response_type: AuthorizationResponseType;
+                    redirect_uri: string;
+                    state: string;
+                    verification_code: string;
+                    connection: string;
+                    client_id: string;
+                    email: string;
+                    nonce?: string | undefined;
+                    audience?: string | undefined;
+                };
+            };
+            output: {
+                error: string;
+                error_description?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+}, "/">;

package/dist/types/routes/auth-api/register/index.d.ts

@@ -0,0 +1,159 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { Bindings, Variables } from "../../../types";
+export declare const registerRoutes: OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/": {
+        $post: {
+            input: {
+                json: {
+                    redirect_uris?: string[] | undefined;
+                    client_name?: string | undefined;
+                    client_uri?: string | undefined;
+                    logo_uri?: string | undefined;
+                    tos_uri?: string | undefined;
+                    policy_uri?: string | undefined;
+                    contacts?: string[] | undefined;
+                    scope?: string | undefined;
+                    grant_types?: string[] | undefined;
+                    response_types?: string[] | undefined;
+                    token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+                    jwks_uri?: string | undefined;
+                    jwks?: Record<string, unknown> | undefined;
+                    software_id?: string | undefined;
+                    software_version?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    audience?: string | undefined;
+                };
+            };
+            output: {
+                client_id: string;
+                registration_client_uri: string;
+                client_secret?: string | undefined;
+                client_id_issued_at?: number | undefined;
+                client_secret_expires_at?: number | undefined;
+                registration_access_token?: string | undefined;
+                client_name?: string | undefined;
+                redirect_uris?: string[] | undefined;
+                grant_types?: string[] | undefined;
+                response_types?: string[] | undefined;
+                token_endpoint_auth_method?: string | undefined;
+                logo_uri?: string | undefined;
+                client_uri?: string | undefined;
+                tos_uri?: string | undefined;
+                policy_uri?: string | undefined;
+                contacts?: string[] | undefined;
+                scope?: string | undefined;
+                jwks_uri?: string | undefined;
+                software_id?: string | undefined;
+                software_version?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 201;
+        };
+    };
+} & {
+    "/:client_id": {
+        $get: {
+            input: {
+                param: {
+                    client_id: string;
+                };
+            };
+            output: {
+                client_id: string;
+                registration_client_uri: string;
+                client_secret?: string | undefined;
+                client_id_issued_at?: number | undefined;
+                client_secret_expires_at?: number | undefined;
+                registration_access_token?: string | undefined;
+                client_name?: string | undefined;
+                redirect_uris?: string[] | undefined;
+                grant_types?: string[] | undefined;
+                response_types?: string[] | undefined;
+                token_endpoint_auth_method?: string | undefined;
+                logo_uri?: string | undefined;
+                client_uri?: string | undefined;
+                tos_uri?: string | undefined;
+                policy_uri?: string | undefined;
+                contacts?: string[] | undefined;
+                scope?: string | undefined;
+                jwks_uri?: string | undefined;
+                software_id?: string | undefined;
+                software_version?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/:client_id": {
+        $put: {
+            input: {
+                param: {
+                    client_id: string;
+                };
+            } & {
+                json: {
+                    redirect_uris?: string[] | undefined;
+                    client_name?: string | undefined;
+                    client_uri?: string | undefined;
+                    logo_uri?: string | undefined;
+                    tos_uri?: string | undefined;
+                    policy_uri?: string | undefined;
+                    contacts?: string[] | undefined;
+                    scope?: string | undefined;
+                    grant_types?: string[] | undefined;
+                    response_types?: string[] | undefined;
+                    token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+                    jwks_uri?: string | undefined;
+                    jwks?: Record<string, unknown> | undefined;
+                    software_id?: string | undefined;
+                    software_version?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    audience?: string | undefined;
+                };
+            };
+            output: {
+                client_id: string;
+                registration_client_uri: string;
+                client_secret?: string | undefined;
+                client_id_issued_at?: number | undefined;
+                client_secret_expires_at?: number | undefined;
+                registration_access_token?: string | undefined;
+                client_name?: string | undefined;
+                redirect_uris?: string[] | undefined;
+                grant_types?: string[] | undefined;
+                response_types?: string[] | undefined;
+                token_endpoint_auth_method?: string | undefined;
+                logo_uri?: string | undefined;
+                client_uri?: string | undefined;
+                tos_uri?: string | undefined;
+                policy_uri?: string | undefined;
+                contacts?: string[] | undefined;
+                scope?: string | undefined;
+                jwks_uri?: string | undefined;
+                software_id?: string | undefined;
+                software_version?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/:client_id": {
+        $delete: {
+            input: {
+                param: {
+                    client_id: string;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+}, "/">;

package/dist/types/routes/auth-api/register/shared.d.ts

@@ -0,0 +1,30 @@
+import { Context } from "hono";
+import { Bindings, Variables } from "../../../types";
+import type { Client, ClientRegistrationToken, ClientRegistrationTokensAdapter, DataAdapters, Tenant } from "@authhero/adapter-interfaces";
+export type Ctx = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+export declare function registrationClientUri(ctx: Ctx, client_id: string): string;
+export declare function loadTenantOrFail(ctx: Ctx): Promise<Tenant>;
+export declare function assertDcrEnabled(tenant: Tenant): void;
+/**
+ * Resolve the `clientRegistrationTokens` adapter or fail with a clear
+ * server error. The adapter is optional on `DataAdapters` so that hosts not
+ * using DCR don't need to implement it, but DCR routes cannot run without it.
+ */
+export declare function requireClientRegistrationTokens(data: DataAdapters): ClientRegistrationTokensAdapter;
+/**
+ * Authenticate a POST /oidc/register request. Returns the IAT record if
+ * bearer auth was used and validated; returns `undefined` for valid open
+ * DCR. Throws 401 if IAT is required/invalid.
+ */
+export declare function authenticateRegistrationRequest(ctx: Ctx, tenant: Tenant): Promise<ClientRegistrationToken | undefined>;
+/**
+ * Authenticate a RFC 7592 management request. Returns the RAT record
+ * bound to the URL client_id. Throws 401 on failure.
+ */
+export declare function authenticateManagementRequest(ctx: Ctx, client_id: string): Promise<ClientRegistrationToken>;
+export declare function isClientSoftDeleted(client: Client): boolean;
+export declare function generateClientId(): string;
+export declare function generateClientSecret(): string;

package/dist/types/routes/auth-api/revoke.d.ts

@@ -0,0 +1,73 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { Bindings, Variables } from "../../types";
+export declare const revokeRoutes: OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/": {
+        $post: {
+            input: {
+                form: {
+                    token: string;
+                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                };
+            } & {
+                json: {
+                    token: string;
+                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 200;
+        } | {
+            input: {
+                form: {
+                    token: string;
+                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                };
+            } & {
+                json: {
+                    token: string;
+                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                };
+            };
+            output: {
+                error: string;
+                error_description?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                form: {
+                    token: string;
+                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                };
+            } & {
+                json: {
+                    token: string;
+                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                };
+            };
+            output: {
+                error: string;
+                error_description?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        };
+    };
+}, "/">;