authhero 9.11.0 → 9.11.1

package/dist/types/helpers/reserved-claims.d.ts

@@ -15,9 +15,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "sid" | "tenant_id" | "sub" | "org_name" | "permissions" | "iat" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "sid" | "tenant_id" | "iss" | "sub" | "aud" | "exp" | "nbf" | "iat" | "jti" | "auth_time" | "acr" | "amr" | "act" | "permissions" | "org_id" | "org_name" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "sid" | "tenant_id" | "sub" | "org_name" | "permissions" | "iat" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "sid" | "tenant_id" | "iss" | "sub" | "aud" | "exp" | "nbf" | "iat" | "jti" | "azp" | "auth_time" | "acr" | "amr" | "act" | "permissions" | "org_id" | "org_name" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**
@@ -31,7 +31,23 @@ export type ServerOwnedAccessTokenClaims = Partial<Record<AccessTokenReservedCla
 export type ServerOwnedIdTokenClaims = Partial<Record<IdTokenReservedClaim, unknown>>;
 /** Which payload a custom claim is being written to. */
 export type ClaimPayloadKind = "access_token" | "id_token" | "userinfo" | "service_token" | "client_service_token";
-export declare function isReservedClaim(claim: string, kind: ClaimPayloadKind): boolean;
+/**
+ * Transitional escape hatch for `init({ unsafeAllowAzpCustomClaim: true })`.
+ *
+ * A deployment that shipped `azp` as a tenant-owned claim before this module
+ * existed cannot un-reserve it atomically: every downstream service reading
+ * `azp` has to be moved off it first, and until then reserving the name simply
+ * deletes the claim from the token (the mint never emits `azp` itself). The
+ * flag keeps those tokens intact while that migration runs.
+ *
+ * It is unsafe because `middlewares/authentication.ts` reads `azp` as the
+ * calling client's id, so a hook-supplied value lands in the request context
+ * where a registered client id is expected. Enable it only to buy time, and
+ * only where the hooks writing `azp` are first-party code.
+ */
+export declare function isReservedClaim(claim: string, kind: ClaimPayloadKind, options?: {
+    allowAzpOverride?: boolean;
+}): boolean;
 export interface ApplyCustomClaimOptions {
     /** Which payload is being written to — selects the reserved set. */
     kind: ClaimPayloadKind;