authhero 9.16.0 → 9.17.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "email" | "username" | "sms";
-    authConnection: "email" | "username" | "sms";
+    connectionType: "email" | "sms" | "username";
+    authConnection: "email" | "sms" | "username";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "scope" | "sid" | "sub" | "org_name" | "aud" | "auth_time" | "exp" | "iat" | "iss" | "permissions" | "org_id" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "permissions" | "scope" | "sub" | "auth_time" | "iss" | "aud" | "exp" | "nbf" | "iat" | "jti" | "acr" | "amr" | "act" | "org_id" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "scope" | "sid" | "sub" | "org_name" | "aud" | "auth_time" | "exp" | "iat" | "iss" | "permissions" | "org_id" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "permissions" | "scope" | "sub" | "auth_time" | "iss" | "aud" | "exp" | "nbf" | "iat" | "jti" | "azp" | "acr" | "amr" | "act" | "org_id" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/scopes-permissions.d.ts

@@ -24,23 +24,62 @@ export interface ScopesAndPermissionsResult {
     token_lifetime_for_web: number;
 }
 /**
- * True when the user holds the global `admin:organizations` escape hatch — the
- * single canonical key for "may act on any organization without being a
- * member". It is a management-plane permission, so it is always matched against
- * the Management API audience, never the requested token's audience.
+ * Management API permission that lets a user act on any organization without
+ * being a member. Doubles as a tenant-admin permission on the multi-tenancy
+ * `/tenants` routes, and only bypasses org membership when the tenant has the
+ * `inherit_global_permissions_in_organizations` flag.
+ */
+export declare const ADMIN_ORGANIZATIONS_PERMISSION = "admin:organizations";
+/**
+ * Management API permission that lets a user get org-scoped tokens for (and
+ * list) every organization without being a member. Unlike
+ * `admin:organizations` it carries no tenant-admin rights and needs no tenant
+ * flag: holding the permission is the opt-in.
+ */
+export declare const ACCESS_ALL_ORGANIZATIONS_PERMISSION = "access:all_organizations";
+/**
+ * True when the user holds `permissionName` at global scope on the Management
+ * API audience, directly or through a role.
+ */
+export declare function userHasGlobalManagementPermission(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, userId: string, permissionName: string): Promise<boolean>;
+/**
+ * Single rule for "may this user get an org-scoped token for an organization
+ * they are not a member of?". Used by every org-membership gate
+ * (calculateScopesAndPermissions, token exchange, refresh token) so they can
+ * never disagree.
  *
- * "Global" means an assignment with an empty organization scope (`""`). Both
- * directly-assigned user permissions AND role-derived permissions count, so a
- * user granted the permission either way is treated consistently (see #1198).
+ * True when the user holds, at global scope on the Management API audience:
+ *  - `access:all_organizations` (no tenant flag needed), or
+ *  - `admin:organizations` AND the tenant has
+ *    `inherit_global_permissions_in_organizations` (legacy behaviour).
  *
- * The caller is responsible for gating on the
- * `inherit_global_permissions_in_organizations` tenant flag; this helper only
- * answers whether the permission is present.
+ * Pass `tenant` when the caller already loaded it to skip a second fetch.
+ */
+export declare function userCanAccessAllOrganizations(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, userId: string, tenant?: {
+    flags?: {
+        inherit_global_permissions_in_organizations?: boolean;
+    };
+} | null): Promise<boolean>;
+/**
+ * True when the user may get an org-scoped token for `organizationId`: either
+ * they may access every organization (see `userCanAccessAllOrganizations`) or
+ * they are a member of it. Every org gate (login, silent auth, token grants)
+ * goes through here so they apply the same rule.
  */
-export declare function userHasGlobalOrgAdminPermission(ctx: Context<{
+export declare function userCanAccessOrganization(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, tenantId: string, userId: string): Promise<boolean>;
+}>, tenantId: string, userId: string, organizationId: string, tenant?: {
+    flags?: {
+        inherit_global_permissions_in_organizations?: boolean;
+    };
+} | null): Promise<boolean>;
 /**
  * Returns the subset of `scopes` that the resource server matching `audience`
  * does not define — the scopes that would silently vanish from an issued token.