authhero 8.22.0 → 8.23.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -448,7 +448,15 @@ export declare function passwordlessGrantUser(ctx: Context<{
         allowed_clients?: string[] | undefined;
         allowed_logout_urls?: string[] | undefined;
         session_transfer?: Record<string, any> | undefined;
-        oidc_logout?: Record<string, any> | undefined;
+        oidc_logout?: {
+            [x: string]: unknown;
+            backchannel_logout_urls?: string[] | undefined;
+            backchannel_logout_initiators?: {
+                [x: string]: unknown;
+                mode?: "custom" | "all" | undefined;
+                selected_initiators?: string[] | undefined;
+            } | undefined;
+        } | undefined;
         grant_types?: string[] | undefined;
         jwt_configuration?: Record<string, any> | undefined;
         signing_keys?: Record<string, any>[] | undefined;
@@ -458,7 +466,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -541,8 +549,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/backchannel-logout.d.ts

@@ -0,0 +1,19 @@
+import { Context } from "hono";
+import { Session } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../types";
+type BackchannelSession = Pick<Session, "id" | "user_id" | "clients">;
+/**
+ * Notify every RP that participated in `session` and registered
+ * `oidc_logout.backchannel_logout_urls` that the session has ended, by
+ * POSTing a signed logout token (§2.5) to each registered URL.
+ *
+ * Delivery is best-effort and runs in the background (`waitUntil`): a dead RP
+ * endpoint must never block or fail the logout that triggered it. Call this
+ * AFTER the session revocation has committed, so an RP that reacts to the
+ * token by hitting the OP observes the session as already gone.
+ */
+export declare function sendBackchannelLogout(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenant_id: string, session: BackchannelSession): void;
+export {};

package/dist/types/helpers/client.d.ts

@@ -53,7 +53,16 @@ export declare const enrichedClientSchema: z.ZodObject<{
     allowed_clients: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     allowed_logout_urls: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     session_transfer: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
-    oidc_logout: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+    oidc_logout: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        backchannel_logout_urls: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        backchannel_logout_initiators: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodOptional<z.ZodEnum<{
+                custom: "custom";
+                all: "all";
+            }>>;
+            selected_initiators: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>>;
     grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     jwt_configuration: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
     signing_keys: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodAny>>>>;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
+        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
-        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;