authhero 9.16.0 → 9.17.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authhero.cjs +141 -141
- package/dist/authhero.d.ts +144 -144
- package/dist/authhero.mjs +11926 -11904
- package/dist/tsconfig.types.tsbuildinfo +1 -1
- package/dist/types/authentication-flows/passwordless.d.ts +3 -3
- package/dist/types/helpers/reserved-claims.d.ts +2 -2
- package/dist/types/helpers/scopes-permissions.d.ts +51 -12
- package/dist/types/index.d.ts +144 -144
- package/dist/types/middlewares/authentication.d.ts +1 -0
- package/dist/types/routes/auth-api/index.d.ts +21 -21
- package/dist/types/routes/auth-api/passwordless.d.ts +18 -18
- package/dist/types/routes/auth-api/register/index.d.ts +2 -2
- package/dist/types/routes/auth-api/well-known.d.ts +1 -1
- package/dist/types/routes/management-api/action-executions.d.ts +1 -1
- package/dist/types/routes/management-api/actions.d.ts +1 -1
- package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
- package/dist/types/routes/management-api/branding.d.ts +1 -1
- package/dist/types/routes/management-api/client-grants.d.ts +9 -9
- package/dist/types/routes/management-api/clients.d.ts +8 -8
- package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
- package/dist/types/routes/management-api/email-templates.d.ts +18 -18
- package/dist/types/routes/management-api/failed-events.d.ts +1 -1
- package/dist/types/routes/management-api/guardian.d.ts +5 -5
- package/dist/types/routes/management-api/index.d.ts +118 -118
- package/dist/types/routes/management-api/keys.d.ts +8 -8
- package/dist/types/routes/management-api/logs.d.ts +4 -4
- package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
- package/dist/types/routes/management-api/organizations.d.ts +3 -3
- package/dist/types/routes/management-api/prompts.d.ts +4 -4
- package/dist/types/routes/management-api/tenant-operations.d.ts +5 -5
- package/dist/types/routes/management-api/tenants.d.ts +4 -4
- package/dist/types/routes/management-api/token-exchange-profiles.d.ts +6 -6
- package/dist/types/routes/management-api/users.d.ts +42 -42
- package/dist/types/routes/universal-login/common.d.ts +2 -2
- package/dist/types/routes/universal-login/flow-api.d.ts +4 -4
- package/dist/types/routes/universal-login/screens/connect-authz.d.ts +16 -0
- package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
- package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
- package/dist/types/utils/jwks.d.ts +2 -2
- package/package.json +3 -3
|
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
27
27
|
output: {
|
|
28
28
|
screen: {
|
|
29
29
|
action: string;
|
|
30
|
-
method: "
|
|
30
|
+
method: "POST" | "GET";
|
|
31
31
|
components: {
|
|
32
32
|
id: string;
|
|
33
33
|
type: string;
|
|
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
107
107
|
output: {
|
|
108
108
|
screen: {
|
|
109
109
|
action: string;
|
|
110
|
-
method: "
|
|
110
|
+
method: "POST" | "GET";
|
|
111
111
|
components: {
|
|
112
112
|
id: string;
|
|
113
113
|
type: string;
|
|
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
204
204
|
output: {
|
|
205
205
|
screen: {
|
|
206
206
|
action: string;
|
|
207
|
-
method: "
|
|
207
|
+
method: "POST" | "GET";
|
|
208
208
|
components: {
|
|
209
209
|
id: string;
|
|
210
210
|
type: string;
|
|
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
319
319
|
output: {
|
|
320
320
|
screen: {
|
|
321
321
|
action: string;
|
|
322
|
-
method: "
|
|
322
|
+
method: "POST" | "GET";
|
|
323
323
|
components: {
|
|
324
324
|
id: string;
|
|
325
325
|
type: string;
|
|
@@ -21,6 +21,20 @@ export declare const DCR_REGISTER_PERMISSION = "create:clients";
|
|
|
21
21
|
* Management API audience so unrelated API permissions can't satisfy it.
|
|
22
22
|
*/
|
|
23
23
|
export declare function userHasGlobalOrgAdmin(context: ScreenContext, userId: string): Promise<boolean>;
|
|
24
|
+
/**
|
|
25
|
+
* True when the user holds the global `access:all_organizations` permission
|
|
26
|
+
* (directly or through a role, Management API audience). Such a user may open
|
|
27
|
+
* any control-plane org without being a member, but is NOT a tenant admin:
|
|
28
|
+
* registering a DCR client still needs `create:clients`, which for these
|
|
29
|
+
* users can come from their global roles (#1437).
|
|
30
|
+
*/
|
|
31
|
+
export declare function userHasAccessAllOrganizations(context: ScreenContext, userId: string): Promise<boolean>;
|
|
32
|
+
/**
|
|
33
|
+
* True when the user holds `create:clients` at global scope (Management API
|
|
34
|
+
* audience). For a user with `access:all_organizations` this lets them
|
|
35
|
+
* register on any child tenant without an org-scoped role.
|
|
36
|
+
*/
|
|
37
|
+
export declare function userCanRegisterGlobally(context: ScreenContext, userId: string): Promise<boolean>;
|
|
24
38
|
/**
|
|
25
39
|
* True when the user holds the DCR register permission on the given
|
|
26
40
|
* control-plane organization (scoped to the Management API audience).
|
|
@@ -33,6 +47,8 @@ export declare function userCanRegisterOnOrg(context: ScreenContext, userId: str
|
|
|
33
47
|
*
|
|
34
48
|
* Access is granted when either:
|
|
35
49
|
* - the user holds the global `admin:organizations` escape hatch, or
|
|
50
|
+
* - the user holds global `access:all_organizations` AND `create:clients`
|
|
51
|
+
* (globally or on that org), with no membership needed, or
|
|
36
52
|
* - the user is a member of the control-plane org whose `name` equals the
|
|
37
53
|
* target tenant id AND holds `create:clients` on their role for that org.
|
|
38
54
|
*
|
|
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
165
165
|
$get: {
|
|
166
166
|
input: {
|
|
167
167
|
param: {
|
|
168
|
-
screen: "impersonate" | "signup" | "
|
|
168
|
+
screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
169
169
|
};
|
|
170
170
|
} & {
|
|
171
171
|
query: {
|
|
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
181
181
|
} | {
|
|
182
182
|
input: {
|
|
183
183
|
param: {
|
|
184
|
-
screen: "impersonate" | "signup" | "
|
|
184
|
+
screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
185
185
|
};
|
|
186
186
|
} & {
|
|
187
187
|
query: {
|
|
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
197
197
|
} | {
|
|
198
198
|
input: {
|
|
199
199
|
param: {
|
|
200
|
-
screen: "impersonate" | "signup" | "
|
|
200
|
+
screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
201
201
|
};
|
|
202
202
|
} & {
|
|
203
203
|
query: {
|
|
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
217
217
|
$post: {
|
|
218
218
|
input: {
|
|
219
219
|
param: {
|
|
220
|
-
screen: "
|
|
220
|
+
screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
221
221
|
};
|
|
222
222
|
} & {
|
|
223
223
|
query: {
|
|
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
235
235
|
} | {
|
|
236
236
|
input: {
|
|
237
237
|
param: {
|
|
238
|
-
screen: "
|
|
238
|
+
screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
239
239
|
};
|
|
240
240
|
} & {
|
|
241
241
|
query: {
|
|
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
170
170
|
$get: {
|
|
171
171
|
input: {
|
|
172
172
|
param: {
|
|
173
|
-
screen: "impersonate" | "signup" | "
|
|
173
|
+
screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
174
174
|
};
|
|
175
175
|
} & {
|
|
176
176
|
query: {
|
|
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
186
186
|
} | {
|
|
187
187
|
input: {
|
|
188
188
|
param: {
|
|
189
|
-
screen: "impersonate" | "signup" | "
|
|
189
|
+
screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
190
190
|
};
|
|
191
191
|
} & {
|
|
192
192
|
query: {
|
|
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
202
202
|
} | {
|
|
203
203
|
input: {
|
|
204
204
|
param: {
|
|
205
|
-
screen: "impersonate" | "signup" | "
|
|
205
|
+
screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
206
206
|
};
|
|
207
207
|
} & {
|
|
208
208
|
query: {
|
|
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
222
222
|
$post: {
|
|
223
223
|
input: {
|
|
224
224
|
param: {
|
|
225
|
-
screen: "
|
|
225
|
+
screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
226
226
|
};
|
|
227
227
|
} & {
|
|
228
228
|
query: {
|
|
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
240
240
|
} | {
|
|
241
241
|
input: {
|
|
242
242
|
param: {
|
|
243
|
-
screen: "
|
|
243
|
+
screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
244
244
|
};
|
|
245
245
|
} & {
|
|
246
246
|
query: {
|
|
@@ -8,7 +8,7 @@ import { CertificateIssuer } from "../helpers/signing-certificate-authority";
|
|
|
8
8
|
* still verify during the per-tenant key rollout.
|
|
9
9
|
*/
|
|
10
10
|
export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined, certificateIssuer?: CertificateIssuer): Promise<{
|
|
11
|
-
kty: "
|
|
11
|
+
kty: "EC" | "RSA" | "oct";
|
|
12
12
|
alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
|
|
13
13
|
kid?: string | undefined;
|
|
14
14
|
use?: "sig" | "enc" | undefined;
|
|
@@ -28,7 +28,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
|
|
|
28
28
|
* subdomain), only control-plane-signed tokens are accepted.
|
|
29
29
|
*/
|
|
30
30
|
export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
|
|
31
|
-
kty: "
|
|
31
|
+
kty: "EC" | "RSA" | "oct";
|
|
32
32
|
alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
|
|
33
33
|
kid?: string | undefined;
|
|
34
34
|
use?: "sig" | "enc" | undefined;
|
package/package.json
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
"type": "git",
|
|
12
12
|
"url": "https://github.com/markusahlstrand/authhero"
|
|
13
13
|
},
|
|
14
|
-
"version": "9.
|
|
14
|
+
"version": "9.17.0",
|
|
15
15
|
"files": [
|
|
16
16
|
"dist"
|
|
17
17
|
],
|
|
@@ -81,8 +81,8 @@
|
|
|
81
81
|
"sanitize-html": "^2.17.4",
|
|
82
82
|
"xstate": "^5.31.1",
|
|
83
83
|
"@authhero/adapter-interfaces": "4.16.0",
|
|
84
|
-
"@authhero/
|
|
85
|
-
"@authhero/
|
|
84
|
+
"@authhero/saml": "0.5.14",
|
|
85
|
+
"@authhero/proxy": "0.11.2"
|
|
86
86
|
},
|
|
87
87
|
"peerDependencies": {
|
|
88
88
|
"@authhero/widget": "^0.1.0",
|