authhero 9.15.0 → 9.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/assets/u/widget/authhero-widget.esm.js +1 -1
- package/dist/assets/u/widget/index.esm.js +1 -1
- package/dist/assets/u/widget/p-36898e2d.entry.js +1 -0
- package/dist/assets/u/widget/p-Che3Wd7J.js +1 -0
- package/dist/assets/u/widget/p-c6ec4c36.entry.js +1 -0
- package/dist/authhero.cjs +144 -144
- package/dist/authhero.d.ts +419 -287
- package/dist/authhero.mjs +11499 -11341
- package/dist/tsconfig.types.tsbuildinfo +1 -1
- package/dist/types/authentication-flows/passwordless.d.ts +3 -3
- package/dist/types/generated/locale-types.d.ts +1 -0
- package/dist/types/helpers/dcr/metadata-mapping.d.ts +1 -1
- package/dist/types/helpers/reserved-claims.d.ts +2 -2
- package/dist/types/helpers/signing-certificate-authority.d.ts +99 -0
- package/dist/types/helpers/signing-keys.d.ts +7 -0
- package/dist/types/index.d.ts +295 -285
- package/dist/types/middlewares/reject-unknown-hosts.d.ts +13 -0
- package/dist/types/routes/auth-api/index.d.ts +32 -31
- package/dist/types/routes/auth-api/passwordless.d.ts +12 -12
- package/dist/types/routes/auth-api/register/index.d.ts +2 -2
- package/dist/types/routes/auth-api/revoke.d.ts +6 -6
- package/dist/types/routes/auth-api/token.d.ts +10 -10
- package/dist/types/routes/auth-api/well-known.d.ts +2 -1
- package/dist/types/routes/management-api/action-executions.d.ts +1 -1
- package/dist/types/routes/management-api/actions.d.ts +3 -3
- package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
- package/dist/types/routes/management-api/clients.d.ts +8 -8
- package/dist/types/routes/management-api/connections.d.ts +1 -1
- package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
- package/dist/types/routes/management-api/email-templates.d.ts +20 -20
- package/dist/types/routes/management-api/emails.d.ts +2 -2
- package/dist/types/routes/management-api/failed-events.d.ts +1 -1
- package/dist/types/routes/management-api/forms.d.ts +133 -126
- package/dist/types/routes/management-api/guardian.d.ts +5 -5
- package/dist/types/routes/management-api/helpers.d.ts +1 -1
- package/dist/types/routes/management-api/hooks.d.ts +4 -4
- package/dist/types/routes/management-api/index.d.ts +250 -243
- package/dist/types/routes/management-api/keys.d.ts +12 -12
- package/dist/types/routes/management-api/logs.d.ts +4 -4
- package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
- package/dist/types/routes/management-api/organizations.d.ts +8 -8
- package/dist/types/routes/management-api/prompts.d.ts +4 -4
- package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
- package/dist/types/routes/management-api/tenant-operations.d.ts +1 -1
- package/dist/types/routes/management-api/tenants.d.ts +4 -4
- package/dist/types/routes/management-api/token-exchange-profiles.d.ts +12 -6
- package/dist/types/routes/management-api/users.d.ts +24 -24
- package/dist/types/routes/universal-login/common.d.ts +2 -2
- package/dist/types/routes/universal-login/flow-api.d.ts +16 -16
- package/dist/types/routes/universal-login/form-node.d.ts +4 -4
- package/dist/types/routes/universal-login/index.d.ts +4 -4
- package/dist/types/routes/universal-login/u2-form-node.d.ts +2 -2
- package/dist/types/routes/universal-login/u2-index.d.ts +7 -7
- package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
- package/dist/types/state-machines/login-session.d.ts +1 -1
- package/dist/types/types/AuthHeroConfig.d.ts +38 -0
- package/dist/types/types/Bindings.d.ts +3 -0
- package/dist/types/utils/encryption.d.ts +20 -0
- package/dist/types/utils/jwks.d.ts +6 -3
- package/package.json +6 -6
- package/dist/assets/u/widget/p-1eb7f287.entry.js +0 -1
- package/dist/assets/u/widget/p-398d72df.entry.js +0 -1
|
@@ -817,12 +817,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
817
817
|
};
|
|
818
818
|
};
|
|
819
819
|
output: {
|
|
820
|
-
created_at: string;
|
|
821
820
|
id: string;
|
|
821
|
+
created_at: string;
|
|
822
822
|
client_id: string;
|
|
823
|
-
rotating: boolean;
|
|
824
823
|
user_id: string;
|
|
825
|
-
|
|
824
|
+
rotating: boolean;
|
|
826
825
|
device: {
|
|
827
826
|
initial_user_agent: string;
|
|
828
827
|
initial_ip: string;
|
|
@@ -831,32 +830,29 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
831
830
|
last_ip: string;
|
|
832
831
|
last_asn: string;
|
|
833
832
|
};
|
|
833
|
+
login_id: string;
|
|
834
834
|
resource_servers: {
|
|
835
835
|
audience: string;
|
|
836
836
|
scopes: string;
|
|
837
837
|
}[];
|
|
838
|
+
revoked_at?: string | undefined;
|
|
838
839
|
expires_at?: string | undefined;
|
|
840
|
+
idle_expires_at?: string | undefined;
|
|
839
841
|
session_id?: string | undefined;
|
|
842
|
+
organization?: string | undefined;
|
|
840
843
|
auth_connection?: string | undefined;
|
|
841
844
|
auth_strategy?: {
|
|
842
845
|
strategy: string;
|
|
843
846
|
strategy_type: string;
|
|
844
847
|
} | undefined;
|
|
845
|
-
organization?: string | undefined;
|
|
846
|
-
revoked_at?: string | undefined;
|
|
847
|
-
idle_expires_at?: string | undefined;
|
|
848
848
|
last_exchanged_at?: string | undefined;
|
|
849
849
|
}[] | {
|
|
850
|
-
start: number;
|
|
851
|
-
limit: number;
|
|
852
|
-
length: number;
|
|
853
850
|
tokens: {
|
|
854
|
-
created_at: string;
|
|
855
851
|
id: string;
|
|
852
|
+
created_at: string;
|
|
856
853
|
client_id: string;
|
|
857
|
-
rotating: boolean;
|
|
858
854
|
user_id: string;
|
|
859
|
-
|
|
855
|
+
rotating: boolean;
|
|
860
856
|
device: {
|
|
861
857
|
initial_user_agent: string;
|
|
862
858
|
initial_ip: string;
|
|
@@ -865,32 +861,34 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
865
861
|
last_ip: string;
|
|
866
862
|
last_asn: string;
|
|
867
863
|
};
|
|
864
|
+
login_id: string;
|
|
868
865
|
resource_servers: {
|
|
869
866
|
audience: string;
|
|
870
867
|
scopes: string;
|
|
871
868
|
}[];
|
|
869
|
+
revoked_at?: string | undefined;
|
|
872
870
|
expires_at?: string | undefined;
|
|
871
|
+
idle_expires_at?: string | undefined;
|
|
873
872
|
session_id?: string | undefined;
|
|
873
|
+
organization?: string | undefined;
|
|
874
874
|
auth_connection?: string | undefined;
|
|
875
875
|
auth_strategy?: {
|
|
876
876
|
strategy: string;
|
|
877
877
|
strategy_type: string;
|
|
878
878
|
} | undefined;
|
|
879
|
-
organization?: string | undefined;
|
|
880
|
-
revoked_at?: string | undefined;
|
|
881
|
-
idle_expires_at?: string | undefined;
|
|
882
879
|
last_exchanged_at?: string | undefined;
|
|
883
880
|
}[];
|
|
884
|
-
total?: number | undefined;
|
|
885
881
|
next?: string | undefined;
|
|
886
882
|
} | {
|
|
883
|
+
start: number;
|
|
884
|
+
limit: number;
|
|
885
|
+
length: number;
|
|
887
886
|
tokens: {
|
|
888
|
-
created_at: string;
|
|
889
887
|
id: string;
|
|
888
|
+
created_at: string;
|
|
890
889
|
client_id: string;
|
|
891
|
-
rotating: boolean;
|
|
892
890
|
user_id: string;
|
|
893
|
-
|
|
891
|
+
rotating: boolean;
|
|
894
892
|
device: {
|
|
895
893
|
initial_user_agent: string;
|
|
896
894
|
initial_ip: string;
|
|
@@ -899,22 +897,24 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
899
897
|
last_ip: string;
|
|
900
898
|
last_asn: string;
|
|
901
899
|
};
|
|
900
|
+
login_id: string;
|
|
902
901
|
resource_servers: {
|
|
903
902
|
audience: string;
|
|
904
903
|
scopes: string;
|
|
905
904
|
}[];
|
|
905
|
+
revoked_at?: string | undefined;
|
|
906
906
|
expires_at?: string | undefined;
|
|
907
|
+
idle_expires_at?: string | undefined;
|
|
907
908
|
session_id?: string | undefined;
|
|
909
|
+
organization?: string | undefined;
|
|
908
910
|
auth_connection?: string | undefined;
|
|
909
911
|
auth_strategy?: {
|
|
910
912
|
strategy: string;
|
|
911
913
|
strategy_type: string;
|
|
912
914
|
} | undefined;
|
|
913
|
-
organization?: string | undefined;
|
|
914
|
-
revoked_at?: string | undefined;
|
|
915
|
-
idle_expires_at?: string | undefined;
|
|
916
915
|
last_exchanged_at?: string | undefined;
|
|
917
916
|
}[];
|
|
917
|
+
total?: number | undefined;
|
|
918
918
|
next?: string | undefined;
|
|
919
919
|
};
|
|
920
920
|
outputFormat: "json";
|
|
@@ -963,7 +963,7 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
963
963
|
};
|
|
964
964
|
};
|
|
965
965
|
output: {
|
|
966
|
-
type: "
|
|
966
|
+
type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
|
|
967
967
|
date: string;
|
|
968
968
|
isMobile: boolean;
|
|
969
969
|
log_id: string;
|
|
@@ -1002,7 +1002,7 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
1002
1002
|
limit: number;
|
|
1003
1003
|
length: number;
|
|
1004
1004
|
logs: {
|
|
1005
|
-
type: "
|
|
1005
|
+
type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
|
|
1006
1006
|
date: string;
|
|
1007
1007
|
isMobile: boolean;
|
|
1008
1008
|
log_id: string;
|
|
@@ -460,7 +460,7 @@ export declare function initJSXRoute(ctx: Context<{
|
|
|
460
460
|
custom_login_page_preview?: string | undefined;
|
|
461
461
|
form_template?: string | undefined;
|
|
462
462
|
addons?: Record<string, any> | undefined;
|
|
463
|
-
token_endpoint_auth_method?: "
|
|
463
|
+
token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
|
|
464
464
|
client_metadata?: Record<string, string> | undefined;
|
|
465
465
|
hide_sign_up_disabled_error?: boolean | undefined;
|
|
466
466
|
mobile?: Record<string, any> | undefined;
|
|
@@ -1196,7 +1196,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
|
|
|
1196
1196
|
custom_login_page_preview?: string | undefined;
|
|
1197
1197
|
form_template?: string | undefined;
|
|
1198
1198
|
addons?: Record<string, any> | undefined;
|
|
1199
|
-
token_endpoint_auth_method?: "
|
|
1199
|
+
token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
|
|
1200
1200
|
client_metadata?: Record<string, string> | undefined;
|
|
1201
1201
|
hide_sign_up_disabled_error?: boolean | undefined;
|
|
1202
1202
|
mobile?: Record<string, any> | undefined;
|
|
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
27
27
|
output: {
|
|
28
28
|
screen: {
|
|
29
29
|
action: string;
|
|
30
|
-
method: "
|
|
30
|
+
method: "GET" | "POST";
|
|
31
31
|
components: {
|
|
32
32
|
id: string;
|
|
33
33
|
type: string;
|
|
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
43
43
|
hint?: string | undefined;
|
|
44
44
|
messages?: {
|
|
45
45
|
text: string;
|
|
46
|
-
type: "
|
|
46
|
+
type: "error" | "success" | "info" | "warning";
|
|
47
47
|
id?: number | undefined;
|
|
48
48
|
}[] | undefined;
|
|
49
49
|
}[];
|
|
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
51
51
|
description?: string | undefined;
|
|
52
52
|
messages?: {
|
|
53
53
|
text: string;
|
|
54
|
-
type: "
|
|
54
|
+
type: "error" | "success" | "info" | "warning";
|
|
55
55
|
id?: number | undefined;
|
|
56
56
|
}[] | undefined;
|
|
57
57
|
links?: {
|
|
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
107
107
|
output: {
|
|
108
108
|
screen: {
|
|
109
109
|
action: string;
|
|
110
|
-
method: "
|
|
110
|
+
method: "GET" | "POST";
|
|
111
111
|
components: {
|
|
112
112
|
id: string;
|
|
113
113
|
type: string;
|
|
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
123
123
|
hint?: string | undefined;
|
|
124
124
|
messages?: {
|
|
125
125
|
text: string;
|
|
126
|
-
type: "
|
|
126
|
+
type: "error" | "success" | "info" | "warning";
|
|
127
127
|
id?: number | undefined;
|
|
128
128
|
}[] | undefined;
|
|
129
129
|
}[];
|
|
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
131
131
|
description?: string | undefined;
|
|
132
132
|
messages?: {
|
|
133
133
|
text: string;
|
|
134
|
-
type: "
|
|
134
|
+
type: "error" | "success" | "info" | "warning";
|
|
135
135
|
id?: number | undefined;
|
|
136
136
|
}[] | undefined;
|
|
137
137
|
links?: {
|
|
@@ -173,7 +173,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
173
173
|
};
|
|
174
174
|
output: {};
|
|
175
175
|
outputFormat: string;
|
|
176
|
-
status:
|
|
176
|
+
status: 400;
|
|
177
177
|
} | {
|
|
178
178
|
input: {
|
|
179
179
|
query: {
|
|
@@ -188,7 +188,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
188
188
|
};
|
|
189
189
|
output: {};
|
|
190
190
|
outputFormat: string;
|
|
191
|
-
status:
|
|
191
|
+
status: 404;
|
|
192
192
|
} | {
|
|
193
193
|
input: {
|
|
194
194
|
query: {
|
|
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
204
204
|
output: {
|
|
205
205
|
screen: {
|
|
206
206
|
action: string;
|
|
207
|
-
method: "
|
|
207
|
+
method: "GET" | "POST";
|
|
208
208
|
components: {
|
|
209
209
|
id: string;
|
|
210
210
|
type: string;
|
|
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
220
220
|
hint?: string | undefined;
|
|
221
221
|
messages?: {
|
|
222
222
|
text: string;
|
|
223
|
-
type: "
|
|
223
|
+
type: "error" | "success" | "info" | "warning";
|
|
224
224
|
id?: number | undefined;
|
|
225
225
|
}[] | undefined;
|
|
226
226
|
}[];
|
|
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
228
228
|
description?: string | undefined;
|
|
229
229
|
messages?: {
|
|
230
230
|
text: string;
|
|
231
|
-
type: "
|
|
231
|
+
type: "error" | "success" | "info" | "warning";
|
|
232
232
|
id?: number | undefined;
|
|
233
233
|
}[] | undefined;
|
|
234
234
|
links?: {
|
|
@@ -282,7 +282,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
282
282
|
};
|
|
283
283
|
output: {};
|
|
284
284
|
outputFormat: string;
|
|
285
|
-
status:
|
|
285
|
+
status: 400;
|
|
286
286
|
} | {
|
|
287
287
|
input: {
|
|
288
288
|
param: {
|
|
@@ -300,7 +300,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
300
300
|
};
|
|
301
301
|
output: {};
|
|
302
302
|
outputFormat: string;
|
|
303
|
-
status:
|
|
303
|
+
status: 404;
|
|
304
304
|
} | {
|
|
305
305
|
input: {
|
|
306
306
|
param: {
|
|
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
319
319
|
output: {
|
|
320
320
|
screen: {
|
|
321
321
|
action: string;
|
|
322
|
-
method: "
|
|
322
|
+
method: "GET" | "POST";
|
|
323
323
|
components: {
|
|
324
324
|
id: string;
|
|
325
325
|
type: string;
|
|
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
335
335
|
hint?: string | undefined;
|
|
336
336
|
messages?: {
|
|
337
337
|
text: string;
|
|
338
|
-
type: "
|
|
338
|
+
type: "error" | "success" | "info" | "warning";
|
|
339
339
|
id?: number | undefined;
|
|
340
340
|
}[] | undefined;
|
|
341
341
|
}[];
|
|
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
343
343
|
description?: string | undefined;
|
|
344
344
|
messages?: {
|
|
345
345
|
text: string;
|
|
346
|
-
type: "
|
|
346
|
+
type: "error" | "success" | "info" | "warning";
|
|
347
347
|
id?: number | undefined;
|
|
348
348
|
}[] | undefined;
|
|
349
349
|
links?: {
|
|
@@ -18,7 +18,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
18
18
|
};
|
|
19
19
|
output: {};
|
|
20
20
|
outputFormat: string;
|
|
21
|
-
status:
|
|
21
|
+
status: 200;
|
|
22
22
|
} | {
|
|
23
23
|
input: {
|
|
24
24
|
param: {
|
|
@@ -32,7 +32,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
32
32
|
};
|
|
33
33
|
output: {};
|
|
34
34
|
outputFormat: string;
|
|
35
|
-
status:
|
|
35
|
+
status: 404;
|
|
36
36
|
};
|
|
37
37
|
};
|
|
38
38
|
} & {
|
|
@@ -52,7 +52,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
52
52
|
};
|
|
53
53
|
output: {};
|
|
54
54
|
outputFormat: string;
|
|
55
|
-
status:
|
|
55
|
+
status: 200;
|
|
56
56
|
} | {
|
|
57
57
|
input: {
|
|
58
58
|
param: {
|
|
@@ -68,7 +68,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
|
|
|
68
68
|
};
|
|
69
69
|
output: {};
|
|
70
70
|
outputFormat: string;
|
|
71
|
-
status:
|
|
71
|
+
status: 404;
|
|
72
72
|
};
|
|
73
73
|
};
|
|
74
74
|
}, "/">;
|
|
@@ -63,7 +63,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
63
63
|
};
|
|
64
64
|
output: {};
|
|
65
65
|
outputFormat: string;
|
|
66
|
-
status:
|
|
66
|
+
status: 200;
|
|
67
67
|
} | {
|
|
68
68
|
input: {
|
|
69
69
|
param: {
|
|
@@ -77,7 +77,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
77
77
|
};
|
|
78
78
|
output: {};
|
|
79
79
|
outputFormat: string;
|
|
80
|
-
status:
|
|
80
|
+
status: 404;
|
|
81
81
|
};
|
|
82
82
|
};
|
|
83
83
|
} & {
|
|
@@ -97,7 +97,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
97
97
|
};
|
|
98
98
|
output: {};
|
|
99
99
|
outputFormat: string;
|
|
100
|
-
status:
|
|
100
|
+
status: 200;
|
|
101
101
|
} | {
|
|
102
102
|
input: {
|
|
103
103
|
param: {
|
|
@@ -113,7 +113,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
113
113
|
};
|
|
114
114
|
output: {};
|
|
115
115
|
outputFormat: string;
|
|
116
|
-
status:
|
|
116
|
+
status: 404;
|
|
117
117
|
};
|
|
118
118
|
};
|
|
119
119
|
}, "/forms"> & import("hono/types").MergeSchemaPath<{
|
|
@@ -28,7 +28,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
|
|
|
28
28
|
};
|
|
29
29
|
output: {};
|
|
30
30
|
outputFormat: string;
|
|
31
|
-
status:
|
|
31
|
+
status: 200;
|
|
32
32
|
} | {
|
|
33
33
|
input: {
|
|
34
34
|
param: {
|
|
@@ -42,7 +42,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
|
|
|
42
42
|
};
|
|
43
43
|
output: {};
|
|
44
44
|
outputFormat: string;
|
|
45
|
-
status:
|
|
45
|
+
status: 404;
|
|
46
46
|
};
|
|
47
47
|
};
|
|
48
48
|
} & {
|
|
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
165
165
|
$get: {
|
|
166
166
|
input: {
|
|
167
167
|
param: {
|
|
168
|
-
screen: "
|
|
168
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
169
169
|
};
|
|
170
170
|
} & {
|
|
171
171
|
query: {
|
|
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
181
181
|
} | {
|
|
182
182
|
input: {
|
|
183
183
|
param: {
|
|
184
|
-
screen: "
|
|
184
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
185
185
|
};
|
|
186
186
|
} & {
|
|
187
187
|
query: {
|
|
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
197
197
|
} | {
|
|
198
198
|
input: {
|
|
199
199
|
param: {
|
|
200
|
-
screen: "
|
|
200
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
201
201
|
};
|
|
202
202
|
} & {
|
|
203
203
|
query: {
|
|
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
217
217
|
$post: {
|
|
218
218
|
input: {
|
|
219
219
|
param: {
|
|
220
|
-
screen: "
|
|
220
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
221
221
|
};
|
|
222
222
|
} & {
|
|
223
223
|
query: {
|
|
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
235
235
|
} | {
|
|
236
236
|
input: {
|
|
237
237
|
param: {
|
|
238
|
-
screen: "
|
|
238
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
239
239
|
};
|
|
240
240
|
} & {
|
|
241
241
|
query: {
|
|
@@ -267,7 +267,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
267
267
|
};
|
|
268
268
|
output: {};
|
|
269
269
|
outputFormat: string;
|
|
270
|
-
status:
|
|
270
|
+
status: 200;
|
|
271
271
|
} | {
|
|
272
272
|
input: {
|
|
273
273
|
param: {
|
|
@@ -281,7 +281,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
281
281
|
};
|
|
282
282
|
output: {};
|
|
283
283
|
outputFormat: string;
|
|
284
|
-
status:
|
|
284
|
+
status: 404;
|
|
285
285
|
};
|
|
286
286
|
};
|
|
287
287
|
} & {
|
|
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
170
170
|
$get: {
|
|
171
171
|
input: {
|
|
172
172
|
param: {
|
|
173
|
-
screen: "
|
|
173
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
174
174
|
};
|
|
175
175
|
} & {
|
|
176
176
|
query: {
|
|
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
186
186
|
} | {
|
|
187
187
|
input: {
|
|
188
188
|
param: {
|
|
189
|
-
screen: "
|
|
189
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
190
190
|
};
|
|
191
191
|
} & {
|
|
192
192
|
query: {
|
|
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
202
202
|
} | {
|
|
203
203
|
input: {
|
|
204
204
|
param: {
|
|
205
|
-
screen: "
|
|
205
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
206
206
|
};
|
|
207
207
|
} & {
|
|
208
208
|
query: {
|
|
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
222
222
|
$post: {
|
|
223
223
|
input: {
|
|
224
224
|
param: {
|
|
225
|
-
screen: "
|
|
225
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
226
226
|
};
|
|
227
227
|
} & {
|
|
228
228
|
query: {
|
|
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
240
240
|
} | {
|
|
241
241
|
input: {
|
|
242
242
|
param: {
|
|
243
|
-
screen: "
|
|
243
|
+
screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
244
244
|
};
|
|
245
245
|
} & {
|
|
246
246
|
query: {
|
|
@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
|
|
|
140
140
|
} | {
|
|
141
141
|
type: "setFailureReason";
|
|
142
142
|
params: import("xstate").NonReducibleUnknown;
|
|
143
|
-
}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation"
|
|
143
|
+
}, never, never, "pending" | "failed" | "expired" | "completed" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
|
|
144
144
|
id: "loginSession";
|
|
145
145
|
states: {
|
|
146
146
|
readonly pending: {};
|
|
@@ -2,6 +2,7 @@ import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAda
|
|
|
2
2
|
import type { RolePermissionHooks, Hooks } from "./Hooks";
|
|
3
3
|
import type { OutboxMetricsSink } from "./OutboxMetrics";
|
|
4
4
|
import type { SamlSigner } from "@authhero/saml/core";
|
|
5
|
+
import type { SigningCertificateAuthority } from "../helpers/signing-certificate-authority";
|
|
5
6
|
import type { OpenAPIHono } from "@hono/zod-openapi";
|
|
6
7
|
import type { Handler, MiddlewareHandler } from "hono";
|
|
7
8
|
import type { ManagementAudienceResolver, IssuerResolver } from "../middlewares/authentication";
|
|
@@ -690,6 +691,43 @@ export interface AuthHeroConfig {
|
|
|
690
691
|
* @default "control-plane"
|
|
691
692
|
*/
|
|
692
693
|
signingKeyMode?: SigningKeyModeOption;
|
|
694
|
+
/**
|
|
695
|
+
* Issue `jwt_signing` certificates from an intermediate CA instead of
|
|
696
|
+
* self-signing them, and publish the chain (`x5c`, `x5t#S256`) in the JWKS.
|
|
697
|
+
*
|
|
698
|
+
* Each certificate carries its owner in a SubjectAlternativeName URI
|
|
699
|
+
* (`urn:authhero:tenant:<id>`, or `urn:authhero:control-plane`), so a
|
|
700
|
+
* relying party can pin one root and trust a key for a tenant without
|
|
701
|
+
* knowing which hosts that tenant is served on.
|
|
702
|
+
*
|
|
703
|
+
* Applies to keys created or renewed after it is set. Existing
|
|
704
|
+
* self-signed keys keep working and are published without a chain until
|
|
705
|
+
* they are rotated out. SAML keys are never CA-issued.
|
|
706
|
+
*
|
|
707
|
+
* @example
|
|
708
|
+
* ```ts
|
|
709
|
+
* signingCertificateAuthority: {
|
|
710
|
+
* issuer: createLocalCertificateIssuer({
|
|
711
|
+
* certificate: env.SIGNING_CA_CERT,
|
|
712
|
+
* privateKey: env.SIGNING_CA_KEY,
|
|
713
|
+
* }),
|
|
714
|
+
* }
|
|
715
|
+
* ```
|
|
716
|
+
*/
|
|
717
|
+
signingCertificateAuthority?: SigningCertificateAuthority;
|
|
718
|
+
/**
|
|
719
|
+
* Answer 404 on `/.well-known/*` when the request host doesn't belong to
|
|
720
|
+
* this deployment: not the ISSUER host, not a `{tenant}.{issuer}`
|
|
721
|
+
* subdomain of an existing tenant, and not a registered custom domain.
|
|
722
|
+
*
|
|
723
|
+
* Without it, discovery and JWKS are served for any host that reaches the
|
|
724
|
+
* worker, falling back to the control-plane keys and apex metadata. Turn it
|
|
725
|
+
* on once every host the deployment is reached on is one of the above
|
|
726
|
+
* (watch for `*.workers.dev` URLs and unregistered domain aliases).
|
|
727
|
+
*
|
|
728
|
+
* @default false
|
|
729
|
+
*/
|
|
730
|
+
rejectUnknownHosts?: boolean;
|
|
693
731
|
/**
|
|
694
732
|
* Relax the management API audience check from a hard 403 to a
|
|
695
733
|
* `console.warn`. Tokens issued for any other audience will still be
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { SigningCertificateAuthority } from "../helpers/signing-certificate-authority";
|
|
1
2
|
import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
|
|
2
3
|
import type { SamlSigner } from "@authhero/saml/core";
|
|
3
4
|
import { Hooks } from "./Hooks";
|
|
@@ -42,6 +43,8 @@ export type Bindings = {
|
|
|
42
43
|
userLinkingMode?: UserLinkingModeOption;
|
|
43
44
|
usernamePasswordProvider?: UsernamePasswordProviderResolver;
|
|
44
45
|
signingKeyMode?: SigningKeyModeOption;
|
|
46
|
+
signingCertificateAuthority?: SigningCertificateAuthority;
|
|
47
|
+
rejectUnknownHosts?: boolean;
|
|
45
48
|
mcp?: McpConfig;
|
|
46
49
|
/**
|
|
47
50
|
* Allow outbound fetches (jwks_uri, request_uri) to localhost / private IP
|