authhero 8.14.1 → 8.16.0

package/dist/types/routes/universal-login/index.d.ts

@@ -27,7 +27,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -36,7 +36,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         } | {
             input: {
                 query: {
@@ -165,7 +165,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -178,7 +178,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         };
     };
 }, "/impersonate"> & import("hono/types").MergeSchemaPath<{
@@ -515,12 +515,12 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "code" | "password" | undefined;
+                    login_selection?: "password" | "code" | undefined;
                 };
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -529,12 +529,12 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "code" | "password" | undefined;
+                    login_selection?: "password" | "code" | undefined;
                 };
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         };
     };
 }, "/login/identifier"> & import("hono/types").MergeSchemaPath<{

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -193,7 +193,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         } | {
             input: {
                 param: {
@@ -209,7 +209,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         };
     };
 } & {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -198,7 +198,7 @@ export declare const u2Routes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         } | {
             input: {
                 param: {
@@ -214,7 +214,7 @@ export declare const u2Routes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         };
     };
 } & {

package/dist/types/types/AuthHeroConfig.d.ts

@@ -1,4 +1,4 @@
-import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant } from "@authhero/adapter-interfaces";
+import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
 import type { RolePermissionHooks, Hooks } from "./Hooks";
 import type { SamlSigner } from "@authhero/saml/core";
 import type { OpenAPIHono } from "@hono/zod-openapi";
@@ -99,6 +99,21 @@ export interface ManagementApiExtension {
      */
     router: OpenAPIHono<any, any, any>;
 }
+/**
+ * Enqueues a durable tenant lifecycle operation (issue #1026): creates
+ * the `tenant_operations` row and starts execution on the configured
+ * engine. The inline engine resolves with a terminal row; durable engines
+ * resolve as soon as the run is enqueued — clients poll
+ * `GET /api/v2/operations/{id}`.
+ */
+export interface TenantOperationExecutorBinding {
+    engine: string;
+    enqueue(params: {
+        kind: TenantOperationKind;
+        tenant_id: string | null;
+        initiated_by?: string;
+    }): Promise<TenantOperation>;
+}
 /**
  * Configuration for the transactional outbox pattern.
  * When enabled, audit events are written atomically with entity mutations
@@ -146,11 +161,11 @@ export type UserLinkingModeOption = UserLinkingMode | UserLinkingModeResolver;
 /**
  * Resolver for the per-tenant username/password provider value.
  *
- * The native database provider has historically been written as `"auth2"`.
- * Returning `"auth0"` for selected tenants lets you migrate them onto the
- * `"auth0"` provider value (matching what the legacy Auth0 import format
- * used) one tenant at a time. Reads always accept both values, so existing
- * `auth2|*` rows keep resolving during and after the cutover.
+ * The native database provider has historically been written as `"auth2"`;
+ * new rows now default to `"auth0"`. Returning `"auth2"` for selected
+ * tenants pins them on the legacy value during a staged cutover. Reads
+ * always accept both values, so existing `auth2|*` rows keep resolving
+ * during and after the cutover.
  *
  * TRANSITIONAL: this resolver and the dual-read fallback can be removed
  * once every tenant has been migrated to a single value.
@@ -380,6 +395,16 @@ export interface AuthHeroConfig {
      * ```
      */
     tenantUpgrade?: (tenantId: string) => Promise<void>;
+    /**
+     * Optional executor for durable tenant lifecycle operations (issue
+     * #1026). When set together with the `tenantOperations` /
+     * `tenantOperationEvents` adapters, `POST /api/v2/tenants/{id}/operations`
+     * enqueues operations through it. Kept structural so authhero core
+     * depends on neither `@authhero/multi-tenancy` nor any engine —
+     * `@authhero/multi-tenancy`'s `enqueueTenantOperation` + executors
+     * satisfy this shape.
+     */
+    tenantOperationExecutor?: TenantOperationExecutorBinding;
     /**
      * Optional powered-by logo to display at the bottom left of the login widget.
      * This is only configurable in code, not stored in the database.
@@ -489,11 +514,12 @@ export interface AuthHeroConfig {
     userLinkingMode?: UserLinkingModeOption;
     /**
      * Per-tenant override for the username/password provider value used on
-     * NEW user rows. Returning `"auth0"` for a tenant migrates new signups,
-     * password resets, etc. onto the `auth0|*` user_id format. Existing
+     * NEW user rows. Omit to write `"auth0"` for every tenant — new signups,
+     * password resets, etc. use the `auth0|*` user_id format. Existing
      * `auth2|*` rows keep working — reads accept either value.
      *
-     * Omit to keep the legacy `"auth2"` value for every tenant.
+     * Returning `"auth2"` pins a tenant on the legacy value during a staged
+     * cutover.
      *
      * TRANSITIONAL: this hook and the dual-read fallback in the password
      * flows can be removed once all tenants have been backfilled.

package/dist/types/types/Bindings.d.ts

@@ -1,7 +1,7 @@
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
 import type { SamlSigner } from "@authhero/saml/core";
 import { Hooks } from "./Hooks";
-import { EntityHooksConfig, OutboxConfig, SigningKeyModeOption, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
+import { EntityHooksConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
 import { StrategyHandler } from "../strategies";
 export type Bindings = {
     ENVIRONMENT: string;
@@ -34,6 +34,7 @@ export type Bindings = {
     codeExecutor?: CodeExecutor;
     webhookInvoker?: WebhookInvoker;
     tenantUpgrade?: (tenantId: string) => Promise<void>;
+    tenantOperationExecutor?: TenantOperationExecutorBinding;
     outbox?: OutboxConfig;
     userLinkingMode?: UserLinkingModeOption;
     usernamePasswordProvider?: UsernamePasswordProviderResolver;

package/dist/types/utils/username-password-provider.d.ts

@@ -6,15 +6,15 @@ import { EnrichedClient } from "../helpers/client";
  * TRANSITIONAL helpers for the auth2 → auth0 provider migration.
  *
  * Historically every native database user has been stored with
- * `provider = "auth2"` and `user_id = "auth2|<id>"`. We're moving onto the
- * `"auth0"` provider value, one tenant at a time, by setting
- * `init({ usernamePasswordProvider })` to return `"auth0"` for the
- * migrated tenants.
+ * `provider = "auth2"` and `user_id = "auth2|<id>"`. New rows are now
+ * written with the `"auth0"` provider value everywhere; the
+ * `init({ usernamePasswordProvider })` resolver only exists to pin a
+ * tenant back onto `"auth2"` during a staged cutover.
  *
  * Two surfaces are exposed:
  *
  * - {@link resolveUsernamePasswordProvider} — used at WRITE sites to pick
- *   the value to stamp on a new row. Defaults to `"auth2"`.
+ *   the value to stamp on a new row. Defaults to `"auth0"`.
  * - {@link isUsernamePasswordProvider} / {@link getUsernamePasswordUser} /
  *   {@link getPrimaryUsernamePasswordUser} — used at READ sites to match
  *   existing rows under EITHER value, so a tenant can have a mix of
@@ -25,7 +25,21 @@ import { EnrichedClient } from "../helpers/client";
  */
 declare const LEGACY_PROVIDER = "auth2";
 declare const TARGET_PROVIDER = "auth0";
+/**
+ * True when a connection's `strategy` field marks it as a native database
+ * (username/password) connection. Legacy tenants persist the provider
+ * literal ("auth2") in the strategy field instead of the canonical Auth0
+ * strategy name, and either provider literal must never leak into new
+ * user rows as the provider — write sites go through
+ * {@link resolveUsernamePasswordProvider} instead.
+ */
+export declare function isDatabaseConnectionStrategy(strategy: string | undefined | null): boolean;
 export type UsernamePasswordProviderValue = typeof LEGACY_PROVIDER | typeof TARGET_PROVIDER;
+/**
+ * Both native database provider values, legacy first — for read sites
+ * that need to enumerate rather than predicate-match.
+ */
+export declare const USERNAME_PASSWORD_PROVIDERS: readonly UsernamePasswordProviderValue[];
 export declare function resolveUsernamePasswordProvider(env: Bindings, tenant_id: string): Promise<UsernamePasswordProviderValue>;
 export declare function isUsernamePasswordProvider(provider: string | undefined | null): boolean;
 interface DualReadParams {

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "8.14.1",
+  "version": "8.16.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/widget": "0.34.5",
-    "@authhero/kysely-adapter": "11.12.0"
+    "@authhero/kysely-adapter": "11.13.1",
+    "@authhero/widget": "0.34.7"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.0",
@@ -82,8 +82,8 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "3.5.0",
-    "@authhero/proxy": "0.8.1",
+    "@authhero/adapter-interfaces": "3.7.0",
+    "@authhero/proxy": "0.8.3",
     "@authhero/saml": "0.4.2"
   },
   "peerDependencies": {