authhero 9.15.0 → 9.16.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "sms" | "email" | "username";
-    authConnection: "sms" | "email" | "username";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/generated/locale-types.d.ts

@@ -99,6 +99,7 @@ export interface LoginScreen {
     editEmailText: () => string;
     emailPlaceholder: () => string;
     enterACodeBtn: () => string;
+    enterACodeShortBtn: () => string;
     federatedConnectionButtonText: (vars: {
         connectionName: string;
     }) => string;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -23,9 +23,9 @@ export declare const dcrRequestSchema: z.ZodObject<{
     grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
-        none: "none";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
+        none: "none";
         client_secret_jwt: "client_secret_jwt";
         private_key_jwt: "private_key_jwt";
     }>>;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "scope" | "sid" | "sub" | "org_name" | "aud" | "auth_time" | "exp" | "iat" | "iss" | "permissions" | "org_id" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "scope" | "sid" | "sub" | "org_name" | "aud" | "auth_time" | "exp" | "iat" | "iss" | "permissions" | "org_id" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/signing-certificate-authority.d.ts

@@ -0,0 +1,99 @@
+import * as x509 from "@peculiar/x509";
+/**
+ * A request to certify a signing key. Everything is plain data so an issuer
+ * can forward it over HTTP: the CA key never has to live in the auth worker.
+ */
+export interface SigningCertificateRequest {
+    /** The key to certify, as an SPKI `PUBLIC KEY` PEM. */
+    publicKey: string;
+    /** Subject distinguished name, e.g. `CN=acme`. */
+    subject: string;
+    /** URI placed in the SubjectAlternativeName, e.g. `urn:authhero:tenant:acme`. */
+    uri: string;
+    notBefore: Date;
+    notAfter: Date;
+}
+/**
+ * Issues signing-key certificates from an intermediate CA.
+ *
+ * `issueCertificate` returns the leaf only. `getIssuerCertificates` returns
+ * every intermediate that may have signed a leaf that is still published —
+ * the current one plus any that were rotated out recently — so the JWKS can
+ * attach the right chain to each key.
+ */
+export interface CertificateIssuer {
+    issueCertificate(request: SigningCertificateRequest): Promise<string>;
+    getIssuerCertificates(): Promise<string[]>;
+}
+export interface SigningCertificateAuthority {
+    issuer: CertificateIssuer;
+    /**
+     * Lifetime of issued certificates, in days. Renewal keeps the key and the
+     * `kid`, so short lifetimes are cheap.
+     *
+     * @default 30
+     */
+    validityDays?: number;
+    /**
+     * The SAN URI that binds a key to its owner. Receives the key's `tenant_id`,
+     * which is undefined for control-plane keys.
+     *
+     * Override this where the storage scope doesn't match ownership — a WFP
+     * tenant worker stores its own keys without a `tenant_id`.
+     *
+     * @default tenant keys → `urn:authhero:tenant:<tenant_id>`, control-plane
+     * keys → `urn:authhero:control-plane`
+     */
+    subjectUri?: (scope: {
+        tenant_id?: string;
+    }) => string;
+}
+export declare const DEFAULT_CA_CERT_VALIDITY_DAYS = 30;
+export declare const TENANT_URI_PREFIX = "urn:authhero:tenant:";
+export declare const CONTROL_PLANE_URI = "urn:authhero:control-plane";
+/** Parameters `createX509Certificate` / `renewX509Certificate` need to issue from the CA. */
+export interface CertificateAuthorityIssuance {
+    issuer: CertificateIssuer;
+    uri: string;
+}
+/**
+ * Resolve how a key should be certified. Only `jwt_signing` keys are
+ * CA-issued: SAML service providers pin certificates for years and gain
+ * nothing from a chain.
+ */
+export declare function certificateAuthorityIssuance(ca: SigningCertificateAuthority | undefined, key: {
+    type: string;
+    tenant_id?: string;
+}): CertificateAuthorityIssuance | undefined;
+export interface LocalCertificateIssuerOptions {
+    /** The issuing (intermediate) CA certificate, PEM. */
+    certificate: string;
+    /** The issuing CA's PKCS#8 private key, PEM. */
+    privateKey: string;
+    /**
+     * Intermediates that were rotated out but may still have signed a
+     * published leaf. They are only used to build `x5c`, never to sign.
+     */
+    previousCertificates?: string[];
+}
+/**
+ * An in-process issuer holding the intermediate's private key. Keep the root
+ * offline; this only ever needs the intermediate.
+ */
+export declare function createLocalCertificateIssuer(options: LocalCertificateIssuerOptions): CertificateIssuer;
+/** True when the certificate was issued by someone other than itself. */
+export declare function isCaIssued(cert: x509.X509Certificate): boolean;
+/**
+ * The published chain for a CA-issued certificate: `x5c` (leaf first, then
+ * its issuer, standard base64 DER per RFC 7517 §4.7) and `x5t#S256`.
+ *
+ * The issuer is matched by name *and* by verifying the leaf's signature, so a
+ * CA that computes key identifiers differently can't produce a wrong chain.
+ * Returns undefined for self-signed certificates and when no known
+ * intermediate signed the leaf — publishing no chain beats publishing a
+ * wrong one.
+ */
+export declare function certificateChainMembers(cert: x509.X509Certificate, issuerCertificates: x509.X509Certificate[]): Promise<{
+    x5c: string[];
+    "x5t#S256": string;
+} | undefined>;

package/dist/types/helpers/signing-keys.d.ts

@@ -1,5 +1,6 @@
 import { SigningKey, KeysAdapter } from "@authhero/adapter-interfaces";
 import { SigningKeyMode, SigningKeyModeOption } from "../types/AuthHeroConfig";
+import { SigningCertificateAuthority } from "./signing-certificate-authority";
 export declare function listControlPlaneKeys(keys: KeysAdapter, type?: string): Promise<SigningKey[]>;
 export declare function resolveSigningKeyMode(option: SigningKeyModeOption | undefined, tenantId: string): Promise<SigningKeyMode>;
 export interface ResolveSigningKeysOptions {
@@ -42,6 +43,12 @@ export interface EnsureSigningKeyOptions {
     name?: string;
     /** Defaults to `"jwt_signing"`. */
     type?: SigningKey["type"];
+    /**
+     * Issue the new key's certificate from this CA (`jwt_signing` only). The
+     * SAN is resolved from `tenantId`, so a WFP tenant worker that stores its
+     * keys without one should set `subjectUri` on the CA config.
+     */
+    certificateAuthority?: SigningCertificateAuthority;
 }
 export interface EnsureSigningKeyResult {
     /** True when a new key was minted; false when a signable key already existed. */