authhero 8.17.4 → 8.18.0

package/dist/types/helpers/provision-tenant-clients.d.ts

@@ -0,0 +1,65 @@
+import { Client, DataAdapters } from "@authhero/adapter-interfaces";
+/**
+ * Whether a client can anchor interactive, user-facing flows (universal login,
+ * the DCR `/connect/start` consent bounce, etc.).
+ *
+ * A client is considered interactive unless it is explicitly machine-to-machine:
+ * `non_interactive`/`resource_server` app types, or a grant list that only
+ * allows `client_credentials`. Clients with no explicit `grant_types` are
+ * treated as interactive — that matches how a freshly created "Default App"
+ * (which relies on the authorize flow) behaves in AuthHero and Auth0.
+ */
+export declare function isInteractiveClient(client: Pick<Client, "app_type" | "grant_types">): boolean;
+/** A single Management API scope entry (`{ value, description }`). */
+export interface ManagementApiScope {
+    value: string;
+    description?: string;
+}
+export interface ProvisionDefaultClientsOptions {
+    /** Display name for an auto-created Default App. Defaults to "Default App". */
+    defaultAppName?: string;
+    /** Callback URLs for an auto-created Default App. */
+    callbacks?: string[];
+    /** Allowed logout URLs for an auto-created Default App. */
+    allowedLogoutUrls?: string[];
+    /** Allowed web origins for an auto-created Default App. */
+    webOrigins?: string[];
+    /**
+     * Also provision an M2M "API Explorer" client authorized against the
+     * Management API (Auth0 parity). Defaults to `true`. Requires
+     * `managementApiScopes` to seed the resource server when it is missing.
+     */
+    createManagementClient?: boolean;
+    /** Management API identifier. Defaults to `urn:authhero:management`. */
+    managementApiIdentifier?: string;
+    /**
+     * Scopes used to seed the Management API resource server when it does not
+     * yet exist, and to authorize the M2M client's grant. When omitted, the
+     * resource server is assumed to already exist and the grant is created with
+     * no explicit scope.
+     */
+    managementApiScopes?: ManagementApiScope[];
+    /** Emit progress logs (used by the seed script). */
+    debug?: boolean;
+}
+export interface ProvisionDefaultClientsResult {
+    /** The client the tenant's `default_client_id` now points at. */
+    defaultClientId: string;
+    /** The auto-provisioned M2M Management API client, if one was created/found. */
+    managementClientId?: string;
+}
+/**
+ * Ensures a tenant has a designated interactive default client and (optionally)
+ * an M2M Management API client, then points `tenant.default_client_id` at the
+ * former.
+ *
+ * Idempotent and import-safe:
+ * - Respects an already-set, still-valid `default_client_id`.
+ * - Reuses an existing interactive client instead of creating a duplicate.
+ * - Skips the M2M client when one already exists.
+ *
+ * Shared by every tenant-creation path (the seed/bootstrap script and the
+ * multi-tenancy provisioning hook) so new tenants come with a sensible anchor
+ * client by construction — see issue #1007.
+ */
+export declare function provisionDefaultClients(adapters: DataAdapters, tenantId: string, options?: ProvisionDefaultClientsOptions): Promise<ProvisionDefaultClientsResult>;