authhero 8.23.1 → 8.25.0

package/dist/types/routes/management-api/users.d.ts

@@ -162,6 +162,75 @@ export declare const userRoutes: OpenAPIHono<{
                 }[];
                 total?: number | undefined;
                 next?: string | undefined;
+            } | {
+                users: {
+                    created_at: string;
+                    updated_at: string;
+                    connection: string;
+                    user_id: string;
+                    email_verified: boolean;
+                    provider: string;
+                    is_social: boolean;
+                    login_count: number;
+                    name?: string | undefined;
+                    email?: string | undefined;
+                    username?: string | undefined;
+                    given_name?: string | undefined;
+                    phone_number?: string | undefined;
+                    phone_verified?: boolean | undefined;
+                    family_name?: string | undefined;
+                    profileData?: string | undefined;
+                    address?: {
+                        formatted?: string | undefined;
+                        street_address?: string | undefined;
+                        locality?: string | undefined;
+                        region?: string | undefined;
+                        postal_code?: string | undefined;
+                        country?: string | undefined;
+                    } | undefined;
+                    nickname?: string | undefined;
+                    picture?: string | undefined;
+                    locale?: string | undefined;
+                    linked_to?: string | undefined;
+                    app_metadata?: any;
+                    user_metadata?: any;
+                    middle_name?: string | undefined;
+                    preferred_username?: string | undefined;
+                    profile?: string | undefined;
+                    website?: string | undefined;
+                    gender?: string | undefined;
+                    birthdate?: string | undefined;
+                    zoneinfo?: string | undefined;
+                    verify_email?: boolean | undefined;
+                    last_ip?: string | undefined;
+                    last_login?: string | undefined;
+                    identities?: {
+                        connection: string;
+                        user_id: string;
+                        provider: string;
+                        isSocial: boolean;
+                        email?: string | undefined;
+                        email_verified?: boolean | undefined;
+                        phone_number?: string | undefined;
+                        phone_verified?: boolean | undefined;
+                        username?: string | undefined;
+                        access_token?: string | undefined;
+                        access_token_secret?: string | undefined;
+                        refresh_token?: string | undefined;
+                        profileData?: {
+                            [x: string]: any;
+                            email?: string | undefined;
+                            email_verified?: boolean | undefined;
+                            name?: string | undefined;
+                            username?: string | undefined;
+                            given_name?: string | undefined;
+                            phone_number?: string | undefined;
+                            phone_verified?: boolean | undefined;
+                            family_name?: string | undefined;
+                        } | undefined;
+                    }[] | undefined;
+                }[];
+                next?: string | undefined;
             };
             outputFormat: "json";
             status: 200;
@@ -740,7 +809,7 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                type: "fn" | "i" | "sapi" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                 date: string;
                 isMobile: boolean;
                 log_id: string;
@@ -779,7 +848,7 @@ export declare const userRoutes: OpenAPIHono<{
                 limit: number;
                 length: number;
                 logs: {
-                    type: "fn" | "i" | "sapi" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;

package/dist/types/routes/proxy-control-plane/custom-domains.d.ts

@@ -0,0 +1,45 @@
+import { Hono } from "hono";
+import { CustomDomainsAdapter } from "@authhero/adapter-interfaces";
+import { Bindings } from "../../types";
+export type AuthenticateControlPlane = (c: {
+    req: {
+        raw: Request;
+        header(name: string): string | undefined;
+        url: string;
+    };
+    env: Bindings;
+}) => Promise<{
+    ok: true;
+    tenantId?: string;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export interface CustomDomainsControlPlaneOptions {
+    /**
+     * The authoritative adapter. On the control plane this is the Cloudflare
+     * adapter (`@authhero/cloudflare-adapter`) wrapping the control-plane
+     * database, so a write both registers the hostname in the CF-for-SaaS zone
+     * and persists the row where the account credentials live.
+     */
+    customDomains: CustomDomainsAdapter;
+    authenticate: AuthenticateControlPlane;
+}
+type TenantVars = {
+    tenantId: string;
+};
+/**
+ * The authoritative `custom-domains` resource. Tenant shards reach it through
+ * `createControlPlaneCustomDomainsAdapter`; it is the only place that can both
+ * see every tenant's domains (so `login.acme.com` can be claimed exactly once)
+ * and hold the Cloudflare account credentials needed to register the hostname.
+ *
+ * Every operation is bound to the `tenant_id` claim of the verified token. The
+ * scope alone is not authorization: each shard holds it, so a request-supplied
+ * tenant id would let any shard read or delete any other tenant's domains.
+ */
+export declare function createCustomDomainsControlPlaneApp(options: CustomDomainsControlPlaneOptions): Hono<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export {};

package/dist/types/routes/proxy-control-plane/index.d.ts

@@ -3,6 +3,7 @@ import type { ResolvedHost } from "@authhero/proxy";
 import { CustomDomain, CustomDomainsAdapter, ProxyRoute, ProxyRoutesAdapter } from "@authhero/adapter-interfaces";
 import { SyncEvent } from "../../helpers/control-plane-sync-events";
 import { Bindings } from "../../types";
+import { type TenantMembersControlPlaneOptions } from "./tenant-members";
 export interface ProxyControlPlaneOptions {
     /**
      * Cross-tenant host resolver. Typically delegated to a database adapter's
@@ -16,6 +17,16 @@ export interface ProxyControlPlaneOptions {
      * service binding by inspecting the URL and dispatching accordingly.
      */
     jwksFetch?: (url: string) => Promise<Response>;
+    /**
+     * Optional predicate that widens the set of accepted token issuers beyond
+     * `env.ISSUER` and the inbound host — specifically to a deployment's own
+     * Workers-for-Platforms tenant subdomains, whose per-tenant control-plane
+     * credential `jwksFetch` resolves locally (see #1139). Consulted before any
+     * JWKS fetch, so it still constrains where keys are fetched from; return
+     * `true` only for issuer hosts you serve. Applies to every mounted resource
+     * (custom-domains, tenant-members, sync).
+     */
+    isTrustedIssuer?: (iss: string) => boolean;
     /**
      * Optional handler for `POST /sync` — receives `controlplane.sync.*` events
      * emitted by tenant shards via `ControlPlaneSyncDestination` and replicates
@@ -24,10 +35,37 @@ export interface ProxyControlPlaneOptions {
      *
      * Implementations MUST be idempotent: the outbox retries on transient
      * failures even after the receiver applied the change.
-     * `createDefaultApplySyncEvents` wires this to a local data adapter with
-     * idempotent semantics.
+     * `createApplySyncEvents` wires this to a local adapter with idempotent
+     * semantics.
+     *
+     * Custom domains do NOT flow through here — the control plane is
+     * authoritative for them (see `customDomains` below); only `proxy_route`
+     * replicates upward.
      */
     applySyncEvents?: (events: SyncEvent[]) => Promise<void>;
+    /**
+     * The authoritative custom-domains adapter. When set, mounts the
+     * `/custom-domains` resource that tenant shards call through
+     * `createControlPlaneCustomDomainsAdapter`.
+     *
+     * Pass the Cloudflare adapter (`@authhero/cloudflare`) wrapping the
+     * control-plane database: registering a CF-for-SaaS hostname needs account
+     * credentials that only exist here, and enforcing "one tenant owns
+     * login.acme.com" needs a view across every tenant that only exists here.
+     */
+    customDomains?: CustomDomainsAdapter;
+    /**
+     * The authoritative tenant-team resource. When set, mounts
+     * `/api/v2/proxy/control-plane/tenant-members` — the resource tenant shards
+     * call through `createControlPlaneTenantMembersAdapter` to let their admins
+     * manage who administers the tenant (control-plane organization membership +
+     * org-scoped roles + invitations), rows the shard itself cannot write.
+     *
+     * Wire the backend to the control-plane database (see
+     * `createLocalTenantMembersBackend`); the org is pinned from the verified
+     * token, never the request.
+     */
+    tenantMembers?: TenantMembersControlPlaneOptions;
 }
 /**
  * Returns a Hono app exposing the privileged proxy control-plane endpoint
@@ -46,19 +84,22 @@ export declare function createProxyControlPlaneApp(options: ProxyControlPlaneOpt
     Bindings: Bindings;
 }>;
 export interface CreateApplySyncEventsOptions {
-    customDomains: CustomDomainsAdapter;
-    proxyRoutes?: ProxyRoutesAdapter;
+    proxyRoutes: ProxyRoutesAdapter;
 }
 /**
  * Build an idempotent `applySyncEvents` implementation backed by a local
- * `CustomDomainsAdapter` / `ProxyRoutesAdapter`. Handles the three retry
- * shapes the outbox can produce:
+ * `ProxyRoutesAdapter`. Handles the three retry shapes the outbox can produce:
  *
  *  - duplicate `created` (retry after the previous succeeded but
  *    `markProcessed` failed) — falls back to `update`.
  *  - `updated` for a row that doesn't exist locally yet (a `created`
  *    delivery is still in flight or lost) — falls back to `create`.
  *  - `deleted` for a row that's already gone — no-op success.
+ *
+ * Custom domains are not replicated: the control plane is authoritative for
+ * them and tenant shards write through it (see
+ * `createControlPlaneCustomDomainsAdapter`), so there is no upward sync to
+ * apply.
  */
 export declare function createApplySyncEvents(options: CreateApplySyncEventsOptions): (events: SyncEvent[]) => Promise<void>;
 export type { CustomDomain, ProxyRoute };

package/dist/types/routes/proxy-control-plane/scopes.d.ts

@@ -0,0 +1,20 @@
+import { PROXY_RESOLVE_HOST_SCOPE } from "@authhero/proxy";
+/**
+ * Scope carried by the tokens `ControlPlaneSyncDestination` mints for
+ * `POST /api/v2/proxy/control-plane/sync`.
+ */
+export declare const CONTROL_PLANE_SYNC_SCOPE = "controlplane:sync";
+/**
+ * Scope required by the authoritative `/custom-domains` resource on the
+ * control plane. Tenant shards mint a token with this scope through
+ * `createControlPlaneCustomDomainsAdapter`.
+ */
+export declare const CONTROL_PLANE_CUSTOM_DOMAINS_SCOPE = "controlplane:custom_domains";
+/**
+ * Scope required by the authoritative `/tenant-members` resource on the control
+ * plane — a tenant's team (organization membership + org-scoped roles +
+ * invitations) that only the control plane can write. Tenant shards mint a
+ * token with this scope through `createControlPlaneTenantMembersAdapter`.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBERS_SCOPE = "controlplane:tenant_members";
+export { PROXY_RESOLVE_HOST_SCOPE };

package/dist/types/routes/proxy-control-plane/tenant-members.d.ts

@@ -0,0 +1,37 @@
+import { Hono, type Context } from "hono";
+import { Bindings } from "../../types";
+import { TenantMembersBackend } from "../../tenant-members/types";
+import type { AuthenticateControlPlane } from "./custom-domains";
+type TenantVars = {
+    tenantId: string;
+};
+/** Context seen by the control-plane resource: env + the pinned tenant id. */
+type CpCtx = Context<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export interface TenantMembersControlPlaneOptions {
+    /**
+     * Build the backend for a request. Bound to the control-plane database
+     * (`c.env.data`) and, optionally, an email sender at wire-up time. The tenant
+     * is pinned separately from the verified token, so the factory does not need
+     * it.
+     */
+    getBackend: (c: CpCtx) => TenantMembersBackend | Promise<TenantMembersBackend>;
+    authenticate: AuthenticateControlPlane;
+}
+/**
+ * The authoritative `tenant-members` resource. Tenant shards reach it through
+ * `createControlPlaneTenantMembersAdapter`; it manages the control-plane
+ * organization that models a tenant's team — rows the shard cannot write.
+ *
+ * Every operation is bound to the `tenant_id` claim of the verified token. The
+ * scope alone is not authorization: each shard holds it, so a request-supplied
+ * tenant id would let any shard read or edit any other tenant's team. Mount
+ * under `/api/v2/proxy/control-plane/tenant-members`.
+ */
+export declare function createTenantMembersControlPlaneApp(options: TenantMembersControlPlaneOptions): Hono<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export {};

package/dist/types/routes/proxy-control-plane/verify.d.ts

@@ -9,6 +9,13 @@ import { PROXY_RESOLVE_HOST_SCOPE } from "@authhero/proxy";
 export declare function isAllowedIssuer(iss: string, expected: string): boolean;
 export type VerifyControlPlaneTokenResult = {
     ok: true;
+    /**
+     * The verified `tenant_id` claim, when the token carries one. Service
+     * tokens minted by `createServiceTokenCore` always do; a client-credentials
+     * token minted for a proxy may not. Callers that act on a tenant's data
+     * MUST bind to this rather than to a tenant id taken from the request.
+     */
+    tenantId?: string;
 } | {
     ok: false;
     reason: string;
@@ -25,8 +32,26 @@ export interface VerifyControlPlaneTokenOptions {
      * so any host you list here must publish its own JWKS at that path.
      */
     expectedIssuers: string[];
-    /** Required `scope` (space-separated). Defaults to `proxy:resolve_host`. */
-    requiredScope?: string;
+    /**
+     * Required `scope` (the token's `scope` claim is space-separated). Pass an
+     * array to accept any one of several scopes. Defaults to
+     * `proxy:resolve_host`.
+     */
+    requiredScope?: string | string[];
+    /**
+     * Optional predicate consulted IN ADDITION to `expectedIssuers`, for issuers
+     * that can't be enumerated ahead of time — specifically a deployment's own
+     * Workers-for-Platforms tenant subdomains (`https://{tenant}.{host}/`), whose
+     * per-tenant control-plane credential the accompanying `jwksFetch` resolves
+     * locally (see #1139).
+     *
+     * Like `expectedIssuers`, it runs BEFORE the JWKS fetch, so it still gates
+     * where the verifier will fetch keys from: return `true` only for issuer
+     * hosts you actually serve. The signature must still verify against the
+     * resolved key, so this does not broaden trust beyond "a caller holding that
+     * tenant's registered private key."
+     */
+    isTrustedIssuer?: (iss: string) => boolean;
 }
 /**
  * Verify a bearer token for the proxy control plane. Returns `{ ok: true }`
@@ -34,8 +59,8 @@ export interface VerifyControlPlaneTokenOptions {
  * logs only and must not be surfaced to the caller.
  *
  * Accepted algs: RS256/384/512, ES256/384/512. The JWK's `alg` must match
- * the token header's `alg`. The token must carry the configured required
- * scope (`proxy:resolve_host` by default) and an `iss` that strictly equals
+ * the token header's `alg`. The token must carry one of the configured
+ * required scopes (`proxy:resolve_host` by default) and an `iss` that strictly equals
  * one of `expectedIssuers` after URL normalization. The JWKS document is
  * fetched from `<iss>/.well-known/jwks.json` AFTER the `iss` is allow-listed,
  * so an attacker cannot redirect the verifier to a JWKS they control.

package/dist/types/routes/proxy-control-plane/verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/routes/universal-login/common.d.ts

@@ -357,7 +357,7 @@ export declare function initJSXRoute(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -374,7 +374,7 @@ export declare function initJSXRoute(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -391,7 +391,7 @@ export declare function initJSXRoute(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -456,7 +456,7 @@ export declare function initJSXRoute(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -1086,7 +1086,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -1103,7 +1103,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -1120,7 +1120,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -1185,7 +1185,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {

package/dist/types/routes/universal-login/identifier.d.ts

@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};

package/dist/types/routes/universal-login/index.d.ts

@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};