authhero 9.13.1 → 9.15.0

package/dist/types/authentication-flows/custom-token-exchange.d.ts

@@ -0,0 +1,21 @@
+import { Context } from "hono";
+import { z } from "@hono/zod-openapi";
+import { Bindings, Variables, GrantFlowUserResult } from "../types";
+import { EnrichedClient } from "../helpers/client";
+export declare const customTokenExchangeParamsSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    organization: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CustomTokenExchangeParams = z.infer<typeof customTokenExchangeParamsSchema>;
+type Ctx = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+export declare function customTokenExchangeGrant(ctx: Ctx, params: CustomTokenExchangeParams, client: EnrichedClient): Promise<GrantFlowUserResult>;
+export {};

package/dist/types/authentication-flows/passwordless.d.ts

@@ -501,6 +501,9 @@ export declare function passwordlessGrantUser(ctx: Context<{
         owner_user_id?: string | undefined;
         registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
         registration_metadata?: Record<string, any> | undefined;
+        token_exchange?: {
+            allow_any_profile_of_type?: "custom_authentication"[] | undefined;
+        } | undefined;
         user_linking_mode?: "builtin" | "off" | undefined;
     };
     loginSession: {
@@ -558,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "sms" | "email" | "username";
+    authConnection: "sms" | "email" | "username";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/authentication-flows/token-exchange.d.ts

@@ -2,6 +2,7 @@ import { Context } from "hono";
 import { z } from "@hono/zod-openapi";
 import { Bindings, Variables, GrantFlowUserResult } from "../types";
 import { EnrichedClient } from "../helpers/client";
+export declare const SUBJECT_TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
 export declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 export declare const tokenExchangeParamsSchema: z.ZodObject<{
     grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
@@ -18,3 +19,21 @@ export declare function tokenExchangeGrant(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, params: TokenExchangeParams, preloadedClient?: EnrichedClient): Promise<GrantFlowUserResult>;
+/**
+ * Resolve the organization a token-exchange request asks for and check the
+ * user may act in it: a member, or a holder of the global
+ * `admin:organizations` permission when the tenant opts into inheriting it.
+ * Shared by the org-switch exchange and Custom Token Exchange.
+ */
+export declare function authorizeOrganizationAccess(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: {
+    tenantId: string;
+    userId: string;
+    organizationId: string;
+    failLog: (description: string) => void;
+}): Promise<{
+    id: string;
+    name: string;
+}>;

package/dist/types/emails/index.d.ts

@@ -1,5 +1,5 @@
 import { Context } from "hono";
-import { Bindings, Variables } from "../types";
+import { Bindings, RequestContext, Variables } from "../types";
 import { AuthParams, EmailTemplateName, User } from "@authhero/adapter-interfaces";
 export type SendEmailParams = {
     to: string;
@@ -10,10 +10,7 @@ export type SendEmailParams = {
     data: Record<string, string>;
     from?: string;
 };
-export declare function sendEmail(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, params: SendEmailParams): Promise<void>;
+export declare function sendEmail(ctx: RequestContext, params: SendEmailParams, tenantIdOverride?: string): Promise<void>;
 export type SendSmsParams = {
     to: string;
     from?: string;
@@ -63,11 +60,13 @@ export interface SendInvitationParams {
     organizationName: string;
     ttlSec: number;
     language?: string;
+    /**
+     * Tenant whose email provider, branding, templates and locales are used.
+     * Defaults to the request's tenant.
+     */
+    tenantId?: string;
 }
-export declare function sendInvitation(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, { to, invitationUrl, inviterName, organizationName, ttlSec, language, }: SendInvitationParams): Promise<void>;
+export declare function sendInvitation(ctx: RequestContext, { to, invitationUrl, inviterName, organizationName, ttlSec, language, tenantId: tenantIdOverride, }: SendInvitationParams): Promise<void>;
 export interface SendTestEmailParams {
     to: string;
     templateName: EmailTemplateName;

package/dist/types/emails/render.d.ts

@@ -1,7 +1,6 @@
-import { Context } from "hono";
 import { Liquid } from "liquidjs";
 import { EmailTemplateName } from "@authhero/adapter-interfaces";
-import { Bindings, Variables } from "../types";
+import { RequestContext } from "../types";
 export declare function getLiquid(): Liquid;
 export interface RenderedEmail {
     subject: string;
@@ -29,10 +28,7 @@ export type RenderResult = {
  *   2. Bundled default (compiled from MJML at build time).
  *   3. `{ kind: "none" }` if neither exists.
  */
-export declare function renderEmailTemplate(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, templateName: EmailTemplateName, vars: Record<string, unknown>, fallbackFrom: string): Promise<RenderResult>;
+export declare function renderEmailTemplate(ctx: RequestContext, templateName: EmailTemplateName, vars: Record<string, unknown>, fallbackFrom: string, tenantId: string): Promise<RenderResult>;
 /**
  * Render the bundled default template directly, without consulting the
  * adapter. Exposed for tests and tooling.

package/dist/types/generated/locale-types.d.ts

@@ -64,6 +64,7 @@ export interface EmailOtpChallengeScreen {
     sessionExpired: () => string;
     title: () => string;
     unexpectedError: () => string;
+    usePasswordText: () => string;
 }
 export interface EmailVerificationScreen {
     description: (vars: {
@@ -269,6 +270,7 @@ export interface LoginPasswordScreen {
     unverifiedEmail: () => string;
     "user-blocked": () => string;
     "wrong-credentials": () => string;
+    sendCodeText: () => string;
 }
 export interface LoginPasswordlessScreen {
     authMethodEmail: () => string;

package/dist/types/helpers/client-assertion-replay.d.ts

@@ -1,5 +1,22 @@
 import { Context } from "hono";
+import { CodeType } from "@authhero/adapter-interfaces";
 import { Bindings, Variables } from "../types";
+/**
+ * Record a presented token's `jti` as spent.
+ *
+ * @returns false when the same `(namespace, jti)` was already spent, true
+ *   otherwise.
+ */
+export declare function consumeSingleUseJti(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, params: {
+    codeType: Extract<CodeType, "client_assertion_jti" | "subject_token_jti">;
+    namespace: string;
+    jti: string;
+    /** The token's `exp`, in seconds — when the marker becomes collectable. */
+    exp: number;
+}): Promise<boolean>;
 export interface ConsumeClientAssertionJtiParams {
     clientId: string;
     /** The assertion's `jti`. When absent there is nothing to spend. */

package/dist/types/helpers/client-keys.d.ts

@@ -25,3 +25,12 @@ export interface ClientWithKeys {
  * asymmetric algs do).
  */
 export declare function loadClientJwks(client: ClientWithKeys, opts?: LoadClientKeysOptions): Promise<Jwk[]>;
+/**
+ * Resolve verification keys published inline (`jwks`) or by reference
+ * (`jwks_uri`). Inline takes precedence. The remote fetch goes through the
+ * SSRF guard. Returns an empty array when neither is set.
+ */
+export declare function loadJwks(source: {
+    jwks?: unknown;
+    jwks_uri?: unknown;
+}, opts?: LoadClientKeysOptions): Promise<Jwk[]>;

package/dist/types/helpers/client.d.ts

@@ -134,6 +134,9 @@ export declare const enrichedClientSchema: z.ZodObject<{
         iat_dcr: "iat_dcr";
     }>>;
     registration_metadata: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+    token_exchange: z.ZodOptional<z.ZodObject<{
+        allow_any_profile_of_type: z.ZodOptional<z.ZodArray<z.ZodLiteral<"custom_authentication">>>;
+    }, z.core.$strip>>;
     user_linking_mode: z.ZodOptional<z.ZodEnum<{
         builtin: "builtin";
         off: "off";

package/dist/types/helpers/connection.d.ts

@@ -1,6 +1,5 @@
-import { Context } from "hono";
 import { LoginSession, User } from "@authhero/adapter-interfaces";
-import { Bindings, Variables } from "../types";
+import { RequestContext } from "../types";
 import { HookEvent } from "../types/Hooks";
 export type ConnectionInfo = NonNullable<HookEvent["connection"]>;
 export interface ConnectionNameSources {
@@ -34,7 +33,4 @@ export declare function resolveConnectionName(sources: ConnectionNameSources): s
  * Returns `undefined` when the name is empty or doesn't resolve to a known
  * connection — callers decide whether to synthesize a fallback.
  */
-export declare function getConnectionInfo(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, connectionName: string | undefined, user?: Pick<User, "provider"> | null): Promise<ConnectionInfo | undefined>;
+export declare function getConnectionInfo(ctx: RequestContext, tenantId: string, connectionName: string | undefined, user?: Pick<User, "provider"> | null): Promise<ConnectionInfo | undefined>;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
+        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/logging.d.ts

@@ -1,6 +1,6 @@
 import { Context } from "hono";
 import { DataAdapters, LogType } from "@authhero/adapter-interfaces";
-import { Variables, Bindings } from "../types";
+import { Variables, Bindings, RequestContext } from "../types";
 export type LogParams = {
     type: LogType;
     description?: string;
@@ -80,10 +80,7 @@ export type LogParams = {
     /** Entity ID being mutated */
     targetId?: string;
 };
-export declare function logMessage(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, params: LogParams): Promise<void>;
+export declare function logMessage(ctx: RequestContext, tenantId: string, params: LogParams): Promise<void>;
 /**
  * Transactional variant of {@link logMessage}. Writes the audit event to the
  * outbox through the caller-provided `trxData` so the insert commits (or rolls

package/dist/types/helpers/organization-branding.d.ts

@@ -0,0 +1,18 @@
+import { Branding, Organization, Theme } from "@authhero/adapter-interfaces";
+type OrganizationBranding = NonNullable<Organization["branding"]>;
+/**
+ * Layer an organization's branding over the tenant's branding and theme, the
+ * way Auth0 does when a login runs in the context of an organization.
+ *
+ * The login pages let the theme win over branding (`theme.widget.logo_url`
+ * before `branding.logo_url`, `theme.colors.primary_button` before
+ * `branding.colors.primary`, `theme.page_background` before
+ * `branding.colors.page_background`), and a theme always exists because of
+ * the DEFAULT_THEME fallback. So each org value is written into both, or it
+ * would never be visible.
+ */
+export declare function applyOrganizationBranding(branding: Branding | null, theme: Theme, orgBranding: OrganizationBranding | undefined): {
+    branding: Branding | null;
+    theme: Theme;
+};
+export {};

package/dist/types/helpers/reserved-claims.d.ts

@@ -1,5 +1,4 @@
-import { Context } from "hono";
-import { Bindings, Variables } from "../types";
+import { RequestContext } from "../types";
 /** RFC 9068 §2.2 + AuthHero-owned access-token claims. */
 export declare const ACCESS_TOKEN_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "exp", "nbf", "iat", "jti", "client_id", "azp", "scope", "auth_time", "acr", "amr", "act", "sid", "permissions", "tenant_id", "org_id", "org_name", "requested_userinfo_claims", "gty"];
 /** OIDC Core ID-token claims: the access-token set plus the ID-token-only ones. */
@@ -15,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**
@@ -58,10 +57,7 @@ export interface ApplyCustomClaimOptions {
      */
     source: string;
     /** Request context, when there is one — the warning goes to the tenant log. */
-    ctx?: Context<{
-        Bindings: Bindings;
-        Variables: Variables;
-    }>;
+    ctx?: RequestContext;
     /** Tenant to log against. Defaults to `ctx.var.tenant_id`. */
     tenantId?: string;
 }

package/dist/types/helpers/service-token.d.ts

@@ -1,6 +1,6 @@
 import { Context } from "hono";
 import { KeysAdapter, TenantsDataAdapter } from "@authhero/adapter-interfaces";
-import { Bindings, Variables } from "../types";
+import { Bindings, RequestContext, Variables } from "../types";
 import { SigningKeyModeOption } from "../types/AuthHeroConfig";
 declare const AUTH_SERVICE_CLIENT_ID = "auth-service";
 export interface ServiceTokenResponse {
@@ -89,8 +89,5 @@ export interface CreateClientServiceTokenOptions {
  * Fails closed: rejects if the client has no grant for the (audience), or if
  * any requested scope is not in `grant.scope`.
  */
-export declare function createClientServiceToken(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, params: CreateClientServiceTokenParams, options?: CreateClientServiceTokenOptions): Promise<ServiceTokenResponse>;
+export declare function createClientServiceToken(ctx: RequestContext, tenantId: string, params: CreateClientServiceTokenParams, options?: CreateClientServiceTokenOptions): Promise<ServiceTokenResponse>;
 export { AUTH_SERVICE_CLIENT_ID };

package/dist/types/helpers/wait-until.d.ts

@@ -12,7 +12,9 @@ import { Context } from "hono";
  * webhook dispatches) completes, producing flaky test behavior and requests
  * that occasionally lose tail work if the process exits.
  */
-export declare function waitUntil(ctx: Context, promise: Promise<unknown>): void;
+export declare function waitUntil(ctx: Pick<Context, "executionCtx" | "var"> & {
+    set(key: "backgroundPromises", value: Promise<void>[]): void;
+}, promise: Promise<unknown>): void;
 /**
  * Await any `waitUntil` promises registered during the current request. Invoke
  * from a middleware's finally block (after `await next()`) so non-Workers