authhero 9.14.0 → 9.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/assets/u/widget/authhero-widget.esm.js +1 -1
- package/dist/assets/u/widget/index.esm.js +1 -1
- package/dist/assets/u/widget/{p-1471c0f2.entry.js → p-1eb7f287.entry.js} +1 -1
- package/dist/assets/u/widget/p-398d72df.entry.js +1 -0
- package/dist/authhero.cjs +144 -144
- package/dist/authhero.d.ts +280 -129
- package/dist/authhero.mjs +13812 -12841
- package/dist/tsconfig.types.tsbuildinfo +1 -1
- package/dist/types/authentication-flows/custom-token-exchange.d.ts +21 -0
- package/dist/types/authentication-flows/passwordless.d.ts +6 -3
- package/dist/types/authentication-flows/token-exchange.d.ts +19 -0
- package/dist/types/generated/locale-types.d.ts +2 -0
- package/dist/types/helpers/client-assertion-replay.d.ts +17 -0
- package/dist/types/helpers/client-keys.d.ts +9 -0
- package/dist/types/helpers/client.d.ts +3 -0
- package/dist/types/helpers/dcr/metadata-mapping.d.ts +1 -1
- package/dist/types/helpers/organization-branding.d.ts +18 -0
- package/dist/types/helpers/reserved-claims.d.ts +2 -2
- package/dist/types/index.d.ts +277 -129
- package/dist/types/routes/auth-api/index.d.ts +156 -46
- package/dist/types/routes/auth-api/passwordless.d.ts +12 -12
- package/dist/types/routes/auth-api/register/index.d.ts +2 -2
- package/dist/types/routes/auth-api/revoke.d.ts +8 -8
- package/dist/types/routes/auth-api/token.d.ts +132 -22
- package/dist/types/routes/auth-api/well-known.d.ts +2 -2
- package/dist/types/routes/management-api/action-executions.d.ts +1 -1
- package/dist/types/routes/management-api/actions.d.ts +3 -3
- package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
- package/dist/types/routes/management-api/client-grants.d.ts +9 -9
- package/dist/types/routes/management-api/clients.d.ts +32 -8
- package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
- package/dist/types/routes/management-api/email-templates.d.ts +20 -20
- package/dist/types/routes/management-api/emails.d.ts +2 -2
- package/dist/types/routes/management-api/failed-events.d.ts +1 -1
- package/dist/types/routes/management-api/forms.d.ts +14 -0
- package/dist/types/routes/management-api/guardian.d.ts +5 -5
- package/dist/types/routes/management-api/helpers.d.ts +1 -1
- package/dist/types/routes/management-api/hooks.d.ts +4 -4
- package/dist/types/routes/management-api/index.d.ts +135 -97
- package/dist/types/routes/management-api/keys.d.ts +8 -8
- package/dist/types/routes/management-api/logs.d.ts +4 -4
- package/dist/types/routes/management-api/organizations.d.ts +7 -7
- package/dist/types/routes/management-api/prompts.d.ts +4 -4
- package/dist/types/routes/management-api/roles.d.ts +1 -1
- package/dist/types/routes/management-api/tenants.d.ts +6 -6
- package/dist/types/routes/management-api/token-exchange-profiles.d.ts +321 -0
- package/dist/types/routes/management-api/users.d.ts +11 -11
- package/dist/types/routes/universal-login/common.d.ts +6 -0
- package/dist/types/routes/universal-login/flow-api.d.ts +8 -8
- package/dist/types/routes/universal-login/form-node.d.ts +4 -4
- package/dist/types/routes/universal-login/index.d.ts +4 -4
- package/dist/types/routes/universal-login/screens/login-otp.d.ts +17 -0
- package/dist/types/routes/universal-login/screens/types.d.ts +6 -0
- package/dist/types/routes/universal-login/u2-form-node.d.ts +2 -2
- package/dist/types/routes/universal-login/u2-index.d.ts +7 -7
- package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
- package/dist/types/state-machines/login-session.d.ts +1 -1
- package/dist/types/utils/jwks.d.ts +4 -4
- package/dist/types/utils/jws-verify.d.ts +46 -0
- package/package.json +6 -6
- package/dist/assets/u/widget/p-c2744f87.entry.js +0 -1
|
@@ -817,11 +817,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
817
817
|
};
|
|
818
818
|
};
|
|
819
819
|
output: {
|
|
820
|
-
user_id: string;
|
|
821
|
-
id: string;
|
|
822
820
|
created_at: string;
|
|
821
|
+
id: string;
|
|
823
822
|
client_id: string;
|
|
824
823
|
rotating: boolean;
|
|
824
|
+
user_id: string;
|
|
825
825
|
login_id: string;
|
|
826
826
|
device: {
|
|
827
827
|
initial_user_agent: string;
|
|
@@ -842,8 +842,8 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
842
842
|
strategy: string;
|
|
843
843
|
strategy_type: string;
|
|
844
844
|
} | undefined;
|
|
845
|
-
revoked_at?: string | undefined;
|
|
846
845
|
organization?: string | undefined;
|
|
846
|
+
revoked_at?: string | undefined;
|
|
847
847
|
idle_expires_at?: string | undefined;
|
|
848
848
|
last_exchanged_at?: string | undefined;
|
|
849
849
|
}[] | {
|
|
@@ -851,11 +851,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
851
851
|
limit: number;
|
|
852
852
|
length: number;
|
|
853
853
|
tokens: {
|
|
854
|
-
user_id: string;
|
|
855
|
-
id: string;
|
|
856
854
|
created_at: string;
|
|
855
|
+
id: string;
|
|
857
856
|
client_id: string;
|
|
858
857
|
rotating: boolean;
|
|
858
|
+
user_id: string;
|
|
859
859
|
login_id: string;
|
|
860
860
|
device: {
|
|
861
861
|
initial_user_agent: string;
|
|
@@ -876,8 +876,8 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
876
876
|
strategy: string;
|
|
877
877
|
strategy_type: string;
|
|
878
878
|
} | undefined;
|
|
879
|
-
revoked_at?: string | undefined;
|
|
880
879
|
organization?: string | undefined;
|
|
880
|
+
revoked_at?: string | undefined;
|
|
881
881
|
idle_expires_at?: string | undefined;
|
|
882
882
|
last_exchanged_at?: string | undefined;
|
|
883
883
|
}[];
|
|
@@ -885,11 +885,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
885
885
|
next?: string | undefined;
|
|
886
886
|
} | {
|
|
887
887
|
tokens: {
|
|
888
|
-
user_id: string;
|
|
889
|
-
id: string;
|
|
890
888
|
created_at: string;
|
|
889
|
+
id: string;
|
|
891
890
|
client_id: string;
|
|
892
891
|
rotating: boolean;
|
|
892
|
+
user_id: string;
|
|
893
893
|
login_id: string;
|
|
894
894
|
device: {
|
|
895
895
|
initial_user_agent: string;
|
|
@@ -910,8 +910,8 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
910
910
|
strategy: string;
|
|
911
911
|
strategy_type: string;
|
|
912
912
|
} | undefined;
|
|
913
|
-
revoked_at?: string | undefined;
|
|
914
913
|
organization?: string | undefined;
|
|
914
|
+
revoked_at?: string | undefined;
|
|
915
915
|
idle_expires_at?: string | undefined;
|
|
916
916
|
last_exchanged_at?: string | undefined;
|
|
917
917
|
}[];
|
|
@@ -963,7 +963,7 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
963
963
|
};
|
|
964
964
|
};
|
|
965
965
|
output: {
|
|
966
|
-
type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "
|
|
966
|
+
type: "cs" | "fi" | "sv" | "fn" | "sapi" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
|
|
967
967
|
date: string;
|
|
968
968
|
isMobile: boolean;
|
|
969
969
|
log_id: string;
|
|
@@ -1002,7 +1002,7 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
1002
1002
|
limit: number;
|
|
1003
1003
|
length: number;
|
|
1004
1004
|
logs: {
|
|
1005
|
-
type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "
|
|
1005
|
+
type: "cs" | "fi" | "sv" | "fn" | "sapi" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
|
|
1006
1006
|
date: string;
|
|
1007
1007
|
isMobile: boolean;
|
|
1008
1008
|
log_id: string;
|
|
@@ -486,6 +486,9 @@ export declare function initJSXRoute(ctx: Context<{
|
|
|
486
486
|
owner_user_id?: string | undefined;
|
|
487
487
|
registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
|
|
488
488
|
registration_metadata?: Record<string, any> | undefined;
|
|
489
|
+
token_exchange?: {
|
|
490
|
+
allow_any_profile_of_type?: "custom_authentication"[] | undefined;
|
|
491
|
+
} | undefined;
|
|
489
492
|
user_linking_mode?: "builtin" | "off" | undefined;
|
|
490
493
|
};
|
|
491
494
|
tenant: {
|
|
@@ -1219,6 +1222,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
|
|
|
1219
1222
|
owner_user_id?: string | undefined;
|
|
1220
1223
|
registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
|
|
1221
1224
|
registration_metadata?: Record<string, any> | undefined;
|
|
1225
|
+
token_exchange?: {
|
|
1226
|
+
allow_any_profile_of_type?: "custom_authentication"[] | undefined;
|
|
1227
|
+
} | undefined;
|
|
1222
1228
|
user_linking_mode?: "builtin" | "off" | undefined;
|
|
1223
1229
|
};
|
|
1224
1230
|
user: {
|
|
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
27
27
|
output: {
|
|
28
28
|
screen: {
|
|
29
29
|
action: string;
|
|
30
|
-
method: "
|
|
30
|
+
method: "POST" | "GET";
|
|
31
31
|
components: {
|
|
32
32
|
id: string;
|
|
33
33
|
type: string;
|
|
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
107
107
|
output: {
|
|
108
108
|
screen: {
|
|
109
109
|
action: string;
|
|
110
|
-
method: "
|
|
110
|
+
method: "POST" | "GET";
|
|
111
111
|
components: {
|
|
112
112
|
id: string;
|
|
113
113
|
type: string;
|
|
@@ -173,7 +173,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
173
173
|
};
|
|
174
174
|
output: {};
|
|
175
175
|
outputFormat: string;
|
|
176
|
-
status:
|
|
176
|
+
status: 404;
|
|
177
177
|
} | {
|
|
178
178
|
input: {
|
|
179
179
|
query: {
|
|
@@ -188,7 +188,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
188
188
|
};
|
|
189
189
|
output: {};
|
|
190
190
|
outputFormat: string;
|
|
191
|
-
status:
|
|
191
|
+
status: 400;
|
|
192
192
|
} | {
|
|
193
193
|
input: {
|
|
194
194
|
query: {
|
|
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
204
204
|
output: {
|
|
205
205
|
screen: {
|
|
206
206
|
action: string;
|
|
207
|
-
method: "
|
|
207
|
+
method: "POST" | "GET";
|
|
208
208
|
components: {
|
|
209
209
|
id: string;
|
|
210
210
|
type: string;
|
|
@@ -282,7 +282,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
282
282
|
};
|
|
283
283
|
output: {};
|
|
284
284
|
outputFormat: string;
|
|
285
|
-
status:
|
|
285
|
+
status: 404;
|
|
286
286
|
} | {
|
|
287
287
|
input: {
|
|
288
288
|
param: {
|
|
@@ -300,7 +300,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
300
300
|
};
|
|
301
301
|
output: {};
|
|
302
302
|
outputFormat: string;
|
|
303
|
-
status:
|
|
303
|
+
status: 400;
|
|
304
304
|
} | {
|
|
305
305
|
input: {
|
|
306
306
|
param: {
|
|
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
319
319
|
output: {
|
|
320
320
|
screen: {
|
|
321
321
|
action: string;
|
|
322
|
-
method: "
|
|
322
|
+
method: "POST" | "GET";
|
|
323
323
|
components: {
|
|
324
324
|
id: string;
|
|
325
325
|
type: string;
|
|
@@ -18,7 +18,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
18
18
|
};
|
|
19
19
|
output: {};
|
|
20
20
|
outputFormat: string;
|
|
21
|
-
status:
|
|
21
|
+
status: 404;
|
|
22
22
|
} | {
|
|
23
23
|
input: {
|
|
24
24
|
param: {
|
|
@@ -32,7 +32,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
32
32
|
};
|
|
33
33
|
output: {};
|
|
34
34
|
outputFormat: string;
|
|
35
|
-
status:
|
|
35
|
+
status: 200;
|
|
36
36
|
};
|
|
37
37
|
};
|
|
38
38
|
} & {
|
|
@@ -52,7 +52,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
52
52
|
};
|
|
53
53
|
output: {};
|
|
54
54
|
outputFormat: string;
|
|
55
|
-
status:
|
|
55
|
+
status: 404;
|
|
56
56
|
} | {
|
|
57
57
|
input: {
|
|
58
58
|
param: {
|
|
@@ -68,7 +68,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
68
68
|
};
|
|
69
69
|
output: {};
|
|
70
70
|
outputFormat: string;
|
|
71
|
-
status:
|
|
71
|
+
status: 200;
|
|
72
72
|
};
|
|
73
73
|
};
|
|
74
74
|
}, "/">;
|
|
@@ -63,7 +63,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
63
63
|
};
|
|
64
64
|
output: {};
|
|
65
65
|
outputFormat: string;
|
|
66
|
-
status:
|
|
66
|
+
status: 404;
|
|
67
67
|
} | {
|
|
68
68
|
input: {
|
|
69
69
|
param: {
|
|
@@ -77,7 +77,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
77
77
|
};
|
|
78
78
|
output: {};
|
|
79
79
|
outputFormat: string;
|
|
80
|
-
status:
|
|
80
|
+
status: 200;
|
|
81
81
|
};
|
|
82
82
|
};
|
|
83
83
|
} & {
|
|
@@ -97,7 +97,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
97
97
|
};
|
|
98
98
|
output: {};
|
|
99
99
|
outputFormat: string;
|
|
100
|
-
status:
|
|
100
|
+
status: 404;
|
|
101
101
|
} | {
|
|
102
102
|
input: {
|
|
103
103
|
param: {
|
|
@@ -113,7 +113,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
113
113
|
};
|
|
114
114
|
output: {};
|
|
115
115
|
outputFormat: string;
|
|
116
|
-
status:
|
|
116
|
+
status: 200;
|
|
117
117
|
};
|
|
118
118
|
};
|
|
119
119
|
}, "/forms"> & import("hono/types").MergeSchemaPath<{
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import type { Context } from "hono";
|
|
2
|
+
import type { LoginSession } from "@authhero/adapter-interfaces";
|
|
3
|
+
import type { EnrichedClient } from "../../../helpers/client";
|
|
4
|
+
import type { Bindings, Variables } from "../../../types";
|
|
5
|
+
/**
|
|
6
|
+
* Create a one-time code bound to the login session and deliver it to the
|
|
7
|
+
* user, either as a code or (for magic-link email connections) as a link.
|
|
8
|
+
*/
|
|
9
|
+
export declare function sendLoginOtp(ctx: Context<{
|
|
10
|
+
Bindings: Bindings;
|
|
11
|
+
Variables: Variables;
|
|
12
|
+
}>, { client, loginSession, to, magicLink, }: {
|
|
13
|
+
client: EnrichedClient;
|
|
14
|
+
loginSession: LoginSession;
|
|
15
|
+
to: string;
|
|
16
|
+
magicLink: boolean;
|
|
17
|
+
}): Promise<void>;
|
|
@@ -165,6 +165,12 @@ export interface ScreenDefinition {
|
|
|
165
165
|
* Returns "/u2/login" for password-first or "/u2/login/identifier" for identifier-first.
|
|
166
166
|
*/
|
|
167
167
|
export declare function getLoginPath(context: ScreenContext): Promise<string>;
|
|
168
|
+
/**
|
|
169
|
+
* Whether the login flow starts on the identifier screen. On the combined
|
|
170
|
+
* password-first login page the user picks password or code up front, so the
|
|
171
|
+
* "or" switch between the two challenge screens is only offered here.
|
|
172
|
+
*/
|
|
173
|
+
export declare function isIdentifierFirstLogin(context: ScreenContext): Promise<boolean>;
|
|
168
174
|
/**
|
|
169
175
|
* Resolve the "Last used" connection hint for the identifier/login screens.
|
|
170
176
|
*
|
|
@@ -28,7 +28,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
|
|
|
28
28
|
};
|
|
29
29
|
output: {};
|
|
30
30
|
outputFormat: string;
|
|
31
|
-
status:
|
|
31
|
+
status: 404;
|
|
32
32
|
} | {
|
|
33
33
|
input: {
|
|
34
34
|
param: {
|
|
@@ -42,7 +42,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
|
|
|
42
42
|
};
|
|
43
43
|
output: {};
|
|
44
44
|
outputFormat: string;
|
|
45
|
-
status:
|
|
45
|
+
status: 200;
|
|
46
46
|
};
|
|
47
47
|
};
|
|
48
48
|
} & {
|
|
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
165
165
|
$get: {
|
|
166
166
|
input: {
|
|
167
167
|
param: {
|
|
168
|
-
screen: "
|
|
168
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
169
169
|
};
|
|
170
170
|
} & {
|
|
171
171
|
query: {
|
|
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
181
181
|
} | {
|
|
182
182
|
input: {
|
|
183
183
|
param: {
|
|
184
|
-
screen: "
|
|
184
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
185
185
|
};
|
|
186
186
|
} & {
|
|
187
187
|
query: {
|
|
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
197
197
|
} | {
|
|
198
198
|
input: {
|
|
199
199
|
param: {
|
|
200
|
-
screen: "
|
|
200
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
201
201
|
};
|
|
202
202
|
} & {
|
|
203
203
|
query: {
|
|
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
217
217
|
$post: {
|
|
218
218
|
input: {
|
|
219
219
|
param: {
|
|
220
|
-
screen: "
|
|
220
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
221
221
|
};
|
|
222
222
|
} & {
|
|
223
223
|
query: {
|
|
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
235
235
|
} | {
|
|
236
236
|
input: {
|
|
237
237
|
param: {
|
|
238
|
-
screen: "
|
|
238
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
239
239
|
};
|
|
240
240
|
} & {
|
|
241
241
|
query: {
|
|
@@ -267,7 +267,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
267
267
|
};
|
|
268
268
|
output: {};
|
|
269
269
|
outputFormat: string;
|
|
270
|
-
status:
|
|
270
|
+
status: 404;
|
|
271
271
|
} | {
|
|
272
272
|
input: {
|
|
273
273
|
param: {
|
|
@@ -281,7 +281,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
281
281
|
};
|
|
282
282
|
output: {};
|
|
283
283
|
outputFormat: string;
|
|
284
|
-
status:
|
|
284
|
+
status: 200;
|
|
285
285
|
};
|
|
286
286
|
};
|
|
287
287
|
} & {
|
|
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
170
170
|
$get: {
|
|
171
171
|
input: {
|
|
172
172
|
param: {
|
|
173
|
-
screen: "
|
|
173
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
174
174
|
};
|
|
175
175
|
} & {
|
|
176
176
|
query: {
|
|
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
186
186
|
} | {
|
|
187
187
|
input: {
|
|
188
188
|
param: {
|
|
189
|
-
screen: "
|
|
189
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
190
190
|
};
|
|
191
191
|
} & {
|
|
192
192
|
query: {
|
|
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
202
202
|
} | {
|
|
203
203
|
input: {
|
|
204
204
|
param: {
|
|
205
|
-
screen: "
|
|
205
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
206
206
|
};
|
|
207
207
|
} & {
|
|
208
208
|
query: {
|
|
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
222
222
|
$post: {
|
|
223
223
|
input: {
|
|
224
224
|
param: {
|
|
225
|
-
screen: "
|
|
225
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
226
226
|
};
|
|
227
227
|
} & {
|
|
228
228
|
query: {
|
|
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
240
240
|
} | {
|
|
241
241
|
input: {
|
|
242
242
|
param: {
|
|
243
|
-
screen: "
|
|
243
|
+
screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
244
244
|
};
|
|
245
245
|
} & {
|
|
246
246
|
query: {
|
|
@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
|
|
|
140
140
|
} | {
|
|
141
141
|
type: "setFailureReason";
|
|
142
142
|
params: import("xstate").NonReducibleUnknown;
|
|
143
|
-
}, never, never, "pending" | "failed" | "
|
|
143
|
+
}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
|
|
144
144
|
id: "loginSession";
|
|
145
145
|
states: {
|
|
146
146
|
readonly pending: {};
|
|
@@ -7,8 +7,8 @@ import { SigningKeyModeOption } from "../types/AuthHeroConfig";
|
|
|
7
7
|
* still verify during the per-tenant key rollout.
|
|
8
8
|
*/
|
|
9
9
|
export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
|
|
10
|
-
|
|
11
|
-
|
|
10
|
+
kty: "EC" | "RSA" | "oct";
|
|
11
|
+
alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
|
|
12
12
|
kid?: string | undefined;
|
|
13
13
|
use?: "sig" | "enc" | undefined;
|
|
14
14
|
n?: string | undefined;
|
|
@@ -26,8 +26,8 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
|
|
|
26
26
|
* subdomain), only control-plane-signed tokens are accepted.
|
|
27
27
|
*/
|
|
28
28
|
export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
|
|
29
|
-
|
|
30
|
-
|
|
29
|
+
kty: "EC" | "RSA" | "oct";
|
|
30
|
+
alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
|
|
31
31
|
kid?: string | undefined;
|
|
32
32
|
use?: "sig" | "enc" | undefined;
|
|
33
33
|
n?: string | undefined;
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
import { Jwk } from "@authhero/adapter-interfaces";
|
|
2
|
+
import { SupportedAlg } from "./jwk-alg";
|
|
3
|
+
/**
|
|
4
|
+
* Asymmetric JWS signature verification against a set of public JWKs.
|
|
5
|
+
*
|
|
6
|
+
* Shared by RFC 7523 client assertions (`helpers/client-assertion.ts`) and
|
|
7
|
+
* Custom Token Exchange subject tokens, which both verify a compact JWS signed
|
|
8
|
+
* by a party that registered its keys with us. Claim validation is left to
|
|
9
|
+
* the caller because the two differ (iss/sub/aud rules).
|
|
10
|
+
*/
|
|
11
|
+
export declare const ASYMMETRIC_JWS_ALGS: readonly SupportedAlg[];
|
|
12
|
+
export declare function isAsymmetricJwsAlg(alg: unknown): alg is SupportedAlg;
|
|
13
|
+
export declare function jwkMatchesAlg(jwk: Jwk, alg: SupportedAlg): boolean;
|
|
14
|
+
export type JwsKeySelection = {
|
|
15
|
+
verified: true;
|
|
16
|
+
} | {
|
|
17
|
+
verified: false;
|
|
18
|
+
reason: "no_matching_key" | "bad_signature";
|
|
19
|
+
};
|
|
20
|
+
/**
|
|
21
|
+
* Verify `signature` over `signedInput` with the JWKs that could have produced
|
|
22
|
+
* it: the one named by `kid` when the header carries one, otherwise every key
|
|
23
|
+
* compatible with `alg`. Keys that fail to import are skipped.
|
|
24
|
+
*/
|
|
25
|
+
export declare function verifyAsymmetricJwsSignature(params: {
|
|
26
|
+
signedInput: Uint8Array<ArrayBuffer>;
|
|
27
|
+
signature: Uint8Array<ArrayBuffer>;
|
|
28
|
+
alg: SupportedAlg;
|
|
29
|
+
kid?: string;
|
|
30
|
+
jwks: Jwk[];
|
|
31
|
+
}): Promise<JwsKeySelection>;
|
|
32
|
+
export interface DecodedCompactJws {
|
|
33
|
+
header: {
|
|
34
|
+
alg?: unknown;
|
|
35
|
+
kid?: unknown;
|
|
36
|
+
typ?: unknown;
|
|
37
|
+
};
|
|
38
|
+
payload: Record<string, unknown>;
|
|
39
|
+
signedInput: Uint8Array<ArrayBuffer>;
|
|
40
|
+
signature: Uint8Array<ArrayBuffer>;
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Split and decode a compact JWS without verifying it. Returns null when the
|
|
44
|
+
* token is not a 3-part JWS with JSON-object header and payload.
|
|
45
|
+
*/
|
|
46
|
+
export declare function decodeCompactJws(token: string): DecodedCompactJws | null;
|
package/package.json
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
"type": "git",
|
|
12
12
|
"url": "https://github.com/markusahlstrand/authhero"
|
|
13
13
|
},
|
|
14
|
-
"version": "9.
|
|
14
|
+
"version": "9.15.0",
|
|
15
15
|
"files": [
|
|
16
16
|
"dist"
|
|
17
17
|
],
|
|
@@ -63,8 +63,8 @@
|
|
|
63
63
|
"vite": "^8.0.14",
|
|
64
64
|
"vite-plugin-dts": "^4.5.4",
|
|
65
65
|
"vitest": "^4.1.7",
|
|
66
|
-
"@authhero/kysely-adapter": "12.
|
|
67
|
-
"@authhero/widget": "0.39.
|
|
66
|
+
"@authhero/kysely-adapter": "12.9.0",
|
|
67
|
+
"@authhero/widget": "0.39.1"
|
|
68
68
|
},
|
|
69
69
|
"dependencies": {
|
|
70
70
|
"@peculiar/x509": "^1.14.3",
|
|
@@ -80,9 +80,9 @@
|
|
|
80
80
|
"qrcode": "^1.5.4",
|
|
81
81
|
"sanitize-html": "^2.17.4",
|
|
82
82
|
"xstate": "^5.31.1",
|
|
83
|
-
"@authhero/adapter-interfaces": "4.
|
|
84
|
-
"@authhero/proxy": "0.11.
|
|
85
|
-
"@authhero/saml": "0.5.
|
|
83
|
+
"@authhero/adapter-interfaces": "4.15.0",
|
|
84
|
+
"@authhero/proxy": "0.11.1",
|
|
85
|
+
"@authhero/saml": "0.5.13"
|
|
86
86
|
},
|
|
87
87
|
"peerDependencies": {
|
|
88
88
|
"@authhero/widget": "^0.1.0",
|