authhero 8.3.0 → 8.4.0

package/dist/types/types/AuthHeroConfig.d.ts

@@ -3,7 +3,7 @@ import type { RolePermissionHooks, Hooks } from "./Hooks";
 import type { SamlSigner } from "@authhero/saml/core";
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { Handler } from "hono";
-import type { ManagementAudienceResolver } from "../middlewares/authentication";
+import type { ManagementAudienceResolver, IssuerResolver } from "../middlewares/authentication";
 import { EntityHooks } from "./Hooks";
 /**
  * Parameters passed to a custom webhook invoker function.
@@ -495,4 +495,29 @@ export interface AuthHeroConfig {
      * ```
      */
     additionalManagementAudiences?: ManagementAudienceResolver;
+    /**
+     * Resolver returning the list of issuers accepted by the bearer-JWT issuer
+     * check **in addition to** the deployment's own
+     * `getIssuer(env, custom_domain)`. The token's `tenant_id` is passed in, so a
+     * per-tenant or control-plane issuer can be constructed at request time.
+     *
+     * This is needed when control-plane-minted admin tokens are forwarded to a
+     * per-tenant worker: the token's `iss` is the control-plane issuer while the
+     * worker's `env.ISSUER` is per-tenant, so the strict single-issuer check
+     * would otherwise reject it. The signature is still verified normally; this
+     * only widens which `iss` values are accepted.
+     *
+     * authhero stays generic — it never derives or hardcodes any issuer. Scoping
+     * (e.g. only accepting the control-plane issuer for control-plane tokens) is
+     * the host app's job: the resolver receives `tenant_id` and can return `[]`
+     * to refuse. The default issuer is always accepted; the resolver is purely
+     * additive.
+     *
+     * @example
+     * ```ts
+     * additionalIssuers: ({ tenant_id }) =>
+     *   tenant_id ? ["https://token.example.com/"] : [];
+     * ```
+     */
+    additionalIssuers?: IssuerResolver;
 }

package/dist/types/types/IdToken.d.ts

@@ -19,10 +19,10 @@ export declare const idTokenSchema: z.ZodObject<{
 }, z.core.$loose>;
 export declare const userInfoSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
-    given_name: z.ZodOptional<z.ZodString>;
-    family_name: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     sub: z.ZodString;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
     iss: z.ZodString;
     aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
     exp: z.ZodNumber;

package/dist/types/utils/jwks.d.ts

@@ -8,7 +8,7 @@ import { SigningKeyModeOption } from "../types/AuthHeroConfig";
  */
 export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
     alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
-    kty: "EC" | "RSA" | "oct";
+    kty: "RSA" | "EC" | "oct";
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;
@@ -27,7 +27,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
  */
 export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
     alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
-    kty: "EC" | "RSA" | "oct";
+    kty: "RSA" | "EC" | "oct";
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;

package/dist/types/utils/jwt.d.ts

@@ -25,6 +25,15 @@ export interface ValidateJwtTokenOptions {
      * for iss mismatch rather than the 401 this function would raise.
      */
     skipIssuerCheck?: boolean;
+    /**
+     * Additional issuers accepted **in addition to**
+     * `getIssuer(env, custom_domain)`. A token whose `iss` matches the expected
+     * issuer OR any value in this list passes the issuer check. The host app
+     * resolves this list (e.g. from a control-plane issuer) and threads it in;
+     * authhero never derives or hardcodes any issuer itself. Defaults to the
+     * strict single-issuer check when omitted.
+     */
+    additionalIssuers?: string[];
 }
 /**
  * Raised when the subject JWT carried a past `exp`. Extends JSONHTTPException

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "8.3.0",
+  "version": "8.4.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "11.8.9",
-    "@authhero/widget": "0.32.41"
+    "@authhero/widget": "0.32.41",
+    "@authhero/kysely-adapter": "11.8.9"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.0",