authhero 9.13.0 → 9.13.1

package/dist/types/middlewares/apply-config.d.ts

@@ -7,6 +7,14 @@ import { AuthHeroConfig, Bindings, Variables } from "../types";
  * Applied both in the outer `init()` app and in each sub-app's middleware
  * chain so that serving a sub-app (oauthApp, managementApp, ...) directly —
  * without routing through the outer app — still sees the config.
+ *
+ * `ctx.env` is replaced with a shallow copy before anything is written to it.
+ * On Cloudflare Workers the runtime hands every request in an isolate the SAME
+ * `env` object, and the routes store per-request state on it (`ctx.env.data =
+ * composeAuthData({ ctx, ... })`). Writing to the shared object let concurrent
+ * requests overwrite each other's adapter stack, so one request awaited
+ * another request's in-flight promises — which the runtime cancels as a hung
+ * Worker once the owning request ends.
  */
 export declare function applyConfigMiddleware(config: AuthHeroConfig): MiddlewareHandler<{
     Bindings: Bindings;

package/dist/types/middlewares/client-info.d.ts

@@ -1,5 +1,31 @@
-import { MiddlewareHandler } from "hono";
+import { Context, MiddlewareHandler } from "hono";
 import { Variables } from "../types/Variables";
+/**
+ * Derive the client IP from the least forgeable header available.
+ *
+ * `X-Forwarded-For` arrives carrying whatever prefix the caller chose to send:
+ * `@authhero/proxy` appends the hop it verified to the end of the inbound
+ * chain and leaves the rest intact, so the leading entries are the client's
+ * own claim. Reading the first one handed a caller full control of
+ * `ctx.var.ip`, which keys the pre-login rate limiter (and its allowlist) and
+ * the passwordless IP check. Order of trust instead:
+ *
+ * 1. `CF-Connecting-IP`, unless it holds one of Cloudflare's own addresses.
+ *    The edge overwrites it on ingress, so on a direct hit it is
+ *    authoritative. When a Worker is reached worker-to-worker — our proxy's
+ *    service binding to this app — the runtime replaces it with the loopback
+ *    source, which is why a Cloudflare-owned value falls through instead of
+ *    being laundered as a visitor.
+ * 2. `X-Real-IP`, which `@authhero/proxy` overwrites with the hop it verified.
+ *    Only reachable when (1) is absent or Cloudflare-owned — off the edge, or
+ *    behind our own proxy — so a caller on the edge cannot reach this branch
+ *    by sending the header itself.
+ * 3. The *last* `X-Forwarded-For` entry: the hop appended by the nearest
+ *    proxy, rather than the first, which anyone can set.
+ */
+export declare function getClientIp(c: Context<{
+    Variables: Variables;
+}>): string | undefined;
 /**
  * Middleware that extracts client information from the request and stores it in context variables
  */

package/dist/types/routes/auth-api/index.d.ts

@@ -739,16 +739,16 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     connection: "email";
                     client_id: string;
                     email: string;
-                    send: "code" | "link";
+                    send: "link" | "code";
                     authParams: {
                         username?: string | undefined;
                         state?: string | undefined;
+                        redirect_uri?: string | undefined;
+                        organization?: string | undefined;
+                        audience?: string | undefined;
                         act_as?: string | undefined;
                         response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
                         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
-                        redirect_uri?: string | undefined;
-                        audience?: string | undefined;
-                        organization?: string | undefined;
                         nonce?: string | undefined;
                         scope?: string | undefined;
                         prompt?: string | undefined;
@@ -775,16 +775,16 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     client_id: string;
                     connection: "sms";
                     phone_number: string;
-                    send: "code" | "link";
+                    send: "link" | "code";
                     authParams: {
                         username?: string | undefined;
                         state?: string | undefined;
+                        redirect_uri?: string | undefined;
+                        organization?: string | undefined;
+                        audience?: string | undefined;
                         act_as?: string | undefined;
                         response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
                         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
-                        redirect_uri?: string | undefined;
-                        audience?: string | undefined;
-                        organization?: string | undefined;
                         nonce?: string | undefined;
                         scope?: string | undefined;
                         prompt?: string | undefined;