authhero 8.22.0 → 8.23.0

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "login" | "signup" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "signup" | "reset-password" | "consent" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/types/IdToken.d.ts

@@ -22,9 +22,9 @@ export declare const userInfoSchema: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
     given_name: z.ZodOptional<z.ZodString>;
     family_name: z.ZodOptional<z.ZodString>;
-    iss: z.ZodString;
     sub: z.ZodString;
-    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
     exp: z.ZodNumber;
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
 }, z.core.$loose>;
 export type IdToken = z.infer<typeof idTokenSchema>;

package/dist/types/utils/crypto.d.ts

@@ -1,2 +1,5 @@
 export declare function pemToBuffer(pem: string): ArrayBuffer;
+/** A high-entropy PKCE code verifier (RFC 7636 §4.1): 32 random bytes,
+ * base64url-encoded to 43 characters. */
+export declare function generateCodeVerifier(): string;
 export declare function computeCodeChallenge(codeVerifier: string, method: "plain" | "S256"): Promise<string>;

package/dist/types/utils/jwt.d.ts

@@ -1,5 +1,34 @@
 import { Context } from "hono";
 import { JSONHTTPException } from "../errors/json-http-exception";
+import type { TokenHeader } from "hono/utils/jwt/jwt";
+import type { JWTPayload } from "hono/utils/jwt/types";
+export type JWTSigningAlg = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
+export interface SignJWTOptions {
+    /** Sets `exp` to now + this many seconds. */
+    expiresInSeconds?: number;
+    /** Sets `iat` to now. */
+    includeIssuedTimestamp?: boolean;
+    /** Extra JOSE header members (e.g. `kid`); merged over `alg`/`typ`. */
+    headers?: Record<string, unknown>;
+}
+/**
+ * Sign a JWT (compact JWS) on Web Crypto. `key` is the raw HMAC secret for
+ * HS* or a PKCS#8 private key for RS* and ES*. ECDSA signatures use the raw
+ * `r ‖ s` form Web Crypto produces, as JWS requires.
+ */
+export declare function signJWT(algorithm: JWTSigningAlg, key: ArrayBuffer | Uint8Array, payloadClaims: Record<string, unknown>, options?: SignJWTOptions): Promise<string>;
+export interface ParsedJWT {
+    header: TokenHeader;
+    payload: JWTPayload;
+}
+/**
+ * Decode a compact JWT without verifying its signature; null on malformed
+ * input. For reading claims out of tokens we minted ourselves or received
+ * over a channel that authenticates the issuer (e.g. an IdP token
+ * endpoint). Anything accepted from the outside goes through
+ * `validateJwtToken` or the JWKS verifiers in helpers/ instead.
+ */
+export declare function parseJWT(jwt: string): ParsedJWT | null;
 export interface JwtPayload {
     sub: string;
     iss: string;

package/dist/types/utils/request-origin.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Check whether a request's Origin header matches one of the allowed
+ * domains, comparing by URL host (replaces oslo/request). Entries may be
+ * bare hosts or full origins; comparison ignores scheme and path.
+ */
+export declare function verifyRequestOrigin(origin: string | null | undefined, allowedDomains: string[]): boolean;

package/dist/types/utils/totp.d.ts

@@ -0,0 +1,10 @@
+/** The TOTP code for the current 30-second period. */
+export declare function generateTOTP(secret: Uint8Array): Promise<string>;
+/**
+ * Verify a code against the current period ±1 (RFC 6238 §6 recommends
+ * tolerating one step of transmission delay / clock drift, and oslo's
+ * current-slice-only check made codes fail at period boundaries).
+ */
+export declare function verifyTOTP(code: string, secret: Uint8Array): Promise<boolean>;
+/** otpauth:// URI for enrolling the secret in an authenticator app. */
+export declare function createTOTPKeyURI(issuer: string, accountName: string, secret: Uint8Array): string;

package/dist/types/variables.d.ts

@@ -1,4 +1,12 @@
 import { Bindings } from "./types";
 export declare function getIssuer(env: Bindings, customDomain?: string): string;
 export declare function getUniversalLoginUrl(env: Bindings, customDomain?: string, routePrefix?: string): string;
+/**
+ * Wildcard callback entries that always allow redirecting back to the auth
+ * server itself (e.g. the /u/info and /u2/info test screens) without
+ * per-client registration. The bases usually end in "/", so normalize before
+ * appending "*" — a naive `${base}/*` yields a "//*" path whose wildcard
+ * regex never matches a real pathname.
+ */
+export declare function getSelfCallbackWildcards(env: Bindings, customDomain?: string): string[];
 export declare function getAuthUrl(env: Bindings, customDomain?: string): string;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "8.22.0",
+  "version": "8.23.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "11.17.0",
-    "@authhero/widget": "0.34.11"
+    "@authhero/kysely-adapter": "11.18.0",
+    "@authhero/widget": "0.34.13"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.0",
@@ -78,13 +78,12 @@
     "libphonenumber-js": "^1.13.3",
     "liquidjs": "^10.27.0",
     "nanoid": "^5.1.11",
-    "oslo": "^1.2.1",
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "3.11.0",
-    "@authhero/proxy": "0.9.1",
-    "@authhero/saml": "0.4.2"
+    "@authhero/adapter-interfaces": "4.0.0",
+    "@authhero/proxy": "0.9.3",
+    "@authhero/saml": "0.4.4"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",