authhero 8.14.0 → 8.14.1

package/dist/authhero.mjs

@@ -8517,7 +8517,7 @@ var ane = (e, t) => {
 }, Yd = (e, t, n, r) => {
 	let i = une(t, n, r);
 	e.header("Set-Cookie", i, { append: !0 });
-}, Xd = "mr4iipyz", dne = /* @__PURE__ */ p({
+}, Xd = "mr4p633u", dne = /* @__PURE__ */ p({
 	common: () => Zd,
 	consent: () => Qd,
 	default: () => fne,
@@ -45621,7 +45621,7 @@ async function LH(e, t, n, r, i = N.USERNAME_PASSWORD) {
 		code: "TOO_MANY_FAILED_LOGINS"
 	});
 	let f = await a.passwords.get(t.tenant.id, u.user_id), p = f && await a_.compare(n.password, f.password);
-	if (!p) {
+	if (!p && !f) {
 		let r = await fH(e, t.tenant.id, u.connection);
 		r?.options?.import_mode === !0 && await DH({
 			ctx: e,
@@ -51659,53 +51659,68 @@ var CY = r.object({
 	handler: async (e) => {
 		let t = e.var.tenant_id, n = e.req.query("include_password_hashes") === "true";
 		n && _Y(e, pY);
-		let r = e.req.query("gzip") !== "false", i = new TextEncoder(), a = sY(e.env.data, t, { includePasswordHashes: n })[Symbol.asyncIterator](), o = 0, s = !1, c;
+		let r = e.req.query("gzip") !== "false", i = new TextEncoder(), a = sY(e.env.data, t, { includePasswordHashes: n })[Symbol.asyncIterator](), o = 0, s = !1, c = [], l = 0, u = !1;
 		try {
-			c = await a.next();
+			for (; c.length < 1e3 && l < 1048576;) {
+				let { value: e, done: t } = await a.next();
+				if (t) {
+					u = !0;
+					break;
+				}
+				let n = i.encode(JSON.stringify(e) + "\n");
+				c.push(n), l += n.byteLength, o += 1;
+			}
 		} catch (r) {
 			throw await P(e, t, {
 				type: M.FAILED_API_OPERATION,
-				description: `Tenant export failed (password_hashes=${n}) by ${e.var.user?.sub ?? "unknown"}: ${r instanceof Error ? r.message : String(r)}`,
+				description: `Tenant export failed after ${o} rows (password_hashes=${n}) by ${e.var.user?.sub ?? "unknown"}: ${r instanceof Error ? r.message : String(r)}`,
 				targetType: "tenant",
 				targetId: t
-			}), new _(500, { message: "Tenant export failed" });
+			}).catch(() => {}), new _(500, { message: "Tenant export failed" });
 		}
-		let l = c, u = new ReadableStream({
+		let d = new ReadableStream({
 			async pull(r) {
+				let l = c.shift();
+				if (l) {
+					r.enqueue(l);
+					return;
+				}
 				try {
-					let { value: c, done: u } = l ?? await a.next();
-					if (l = void 0, u) {
+					let c = u ? void 0 : await a.next();
+					if (!c || c.done) {
 						s || (s = !0, await P(e, t, {
 							type: M.SUCCESS_API_OPERATION,
 							description: `Tenant export (${o} rows, password_hashes=${n}) by ${e.var.user?.sub ?? "unknown"}`,
 							targetType: "tenant",
-							targetId: t
-						})), r.close();
+							targetId: t,
+							waitForCompletion: !0
+						}).catch(() => {})), r.close();
 						return;
 					}
-					o += 1, r.enqueue(i.encode(JSON.stringify(c) + "\n"));
+					o += 1, r.enqueue(i.encode(JSON.stringify(c.value) + "\n"));
 				} catch (i) {
 					s || (s = !0, await P(e, t, {
 						type: M.FAILED_API_OPERATION,
 						description: `Tenant export failed after ${o} rows (password_hashes=${n}) by ${e.var.user?.sub ?? "unknown"}: ${i instanceof Error ? i.message : String(i)}`,
 						targetType: "tenant",
-						targetId: t
-					})), r.error(i);
+						targetId: t,
+						waitForCompletion: !0
+					}).catch(() => {})), r.error(i);
 				}
 			},
 			async cancel() {
 				await a.return?.(void 0);
 			}
 		});
-		if (!r) return new Response(u, {
+		if (!r) return new Response(d, {
 			status: 200,
 			headers: {
 				"content-type": "application/x-ndjson",
 				"content-disposition": `attachment; filename="${t}-export.jsonl"`
 			}
 		});
-		let d = u.pipeThrough(new CompressionStream("gzip"));
-		return new Response(d, {
+		let f = d.pipeThrough(new CompressionStream("gzip"));
+		return new Response(f, {
 			status: 200,
 			headers: {
 				"content-type": "application/gzip",
@@ -58358,7 +58373,8 @@ var l2 = F({
 				allowSubDomainWildcards: !0
 			})) throw new _(400, { message: `Invalid redirect URI - ${O.redirect_uri}` });
 		}
-		if (O.audience) {
+		let le = `${ba(e.env, e.var.custom_domain)}userinfo`;
+		if (O.audience && O.audience !== le) {
 			let { resource_servers: n } = await t.data.resourceServers.list(D.tenant.id);
 			if (!n.some((e) => e.identifier === O.audience)) {
 				let t = {
@@ -58374,19 +58390,19 @@ var l2 = F({
 				throw new _(403, { message: `Service not found: ${O.audience}` });
 			}
 		}
-		let le, ue = Kie(D.tenant.id, e.req.header("cookie"));
-		for (let e of ue) {
+		let ue, de = Kie(D.tenant.id, e.req.header("cookie"));
+		for (let e of de) {
 			let n = await t.data.sessions.get(D.tenant.id, e);
 			if (n && !n.revoked_at) {
-				le = n;
+				ue = n;
 				break;
 			}
 		}
-		if (D.sso_disabled && (le = void 0), h == "none") {
+		if (D.sso_disabled && (ue = void 0), h == "none") {
 			if (!se || !T || !d) throw new _(400, { message: "Missing required parameters for silent auth: redirect_uri, state, and response_type" });
 			return V0({
 				ctx: e,
-				session: le || void 0,
+				session: ue || void 0,
 				redirect_uri: se,
 				state: T,
 				response_type: d,
@@ -58407,17 +58423,17 @@ var l2 = F({
 			let t = await z0(e, D.tenant.id, ee, O, te);
 			return t instanceof Response ? t : e.json(t);
 		}
-		let de = await L0({
+		let fe = await L0({
 			ctx: e,
 			client: D,
 			auth0Client: ne,
 			authParams: O,
-			session: le || void 0,
+			session: ue || void 0,
 			connection: E,
 			login_hint: y,
 			screen_hint: re
 		});
-		return de instanceof Response ? de : e.json(de);
+		return fe instanceof Response ? fe : e.json(fe);
 	}
 }), u2 = F({
 	route: t({