authhero 9.18.0 → 9.19.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "email" | "sms" | "username";
-    authConnection: "email" | "sms" | "username";
+    connectionType: "username" | "email" | "sms";
+    authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -23,9 +23,9 @@ export declare const dcrRequestSchema: z.ZodObject<{
     grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+        none: "none";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
-        none: "none";
         client_secret_jwt: "client_secret_jwt";
         private_key_jwt: "private_key_jwt";
     }>>;

package/dist/types/helpers/http-certificate-issuer.d.ts

@@ -0,0 +1,55 @@
+import { Hono } from "hono";
+import { CertificateIssuer, SigningCertificateRequest } from "./signing-certificate-authority";
+export interface HttpCertificateIssuerOptions {
+    /** Base URL of a service mounted with `createCertificateIssuerApp`. */
+    url: string;
+    /**
+     * Headers sent with every certificate request — typically the credential
+     * that identifies this caller to the CA service.
+     */
+    headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);
+    /**
+     * How long to cache the issuer certificates used to build `x5c`.
+     *
+     * @default 300
+     */
+    issuerCertificatesTtlSeconds?: number;
+    /** Override for tests or a service binding's `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * A `CertificateIssuer` that asks a remote CA service to certify keys, so the
+ * CA private key never has to live in the auth worker. Pair it with
+ * `createCertificateIssuerApp` on the service side.
+ */
+export declare function createHttpCertificateIssuer(options: HttpCertificateIssuerOptions): CertificateIssuer;
+export interface CertificateIssuerAppOptions {
+    /** The issuer that actually signs, typically `createLocalCertificateIssuer`. */
+    issuer: CertificateIssuer;
+    /**
+     * Decide whether the caller may have this certificate. This is the only
+     * thing stopping one tenant from obtaining a certificate that names another
+     * tenant, or the control plane, so check the caller's identity against
+     * `certificateRequest.uri`.
+     */
+    authorize: (params: {
+        request: Request;
+        certificateRequest: SigningCertificateRequest;
+    }) => boolean | Promise<boolean>;
+    /**
+     * The longest lifetime and time from now until expiry a caller may request.
+     * Keeps a compromised caller
+     * from minting a certificate that outlives its access.
+     *
+     * @default 90
+     */
+    maxValidityDays?: number;
+}
+/**
+ * Serves a `CertificateIssuer` over HTTP for `createHttpCertificateIssuer`.
+ *
+ * - `POST /certificates` issues a leaf after `authorize` approves it.
+ * - `GET /issuer-certificates` returns the intermediates. They are published
+ *   in every JWKS `x5c` anyway, so this route is not authorized.
+ */
+export declare function createCertificateIssuerApp(options: CertificateIssuerAppOptions): Hono;

package/dist/types/helpers/logging.d.ts

@@ -44,6 +44,11 @@ export type LogParams = {
      * both authorizing as the same client).
      */
     redirect_uri?: string;
+    /**
+     * The original `/authorize` URL of the login. Carried on the audit event
+     * (and so to log streams) but not written to the log's `details`.
+     */
+    authorization_url?: string;
     /**
      * Response details to include in the log (for Management API operations)
      */

package/dist/types/helpers/outbox-destinations/log-streams.d.ts

@@ -24,11 +24,14 @@ interface LogStreamData {
             path: string;
             qs?: Record<string, string>;
             body?: unknown;
+            redirect_uri?: string;
+            authorization_url?: string;
         };
         response?: {
             statusCode: number;
             body?: unknown;
         };
+        execution_id?: string;
     };
 }
 interface LogStreamPayload {

package/dist/types/helpers/renew-signing-certificates.d.ts

@@ -0,0 +1,61 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { SigningCertificateAuthority } from "./signing-certificate-authority";
+export interface RenewSigningCertificatesConfig {
+    /** Same `DataAdapters` passed to `init()`. */
+    dataAdapter: Pick<DataAdapters, "keys">;
+    /** Same value passed to `init({ signingCertificateAuthority })`. */
+    certificateAuthority: SigningCertificateAuthority;
+    /**
+     * Renew certificates that expire within this many days.
+     *
+     * @default a third of the CA's `validityDays` (10 days for the 30-day
+     * default), and at least one day
+     */
+    renewBeforeDays?: number;
+    /** Clock override for tests. */
+    now?: () => Date;
+}
+export interface RenewSigningCertificatesResult {
+    /** Keys whose certificate was re-issued. The `kid` is unchanged. */
+    renewed: string[];
+    /** CA-issued keys that are not due yet. */
+    notDue: number;
+    failed: {
+        kid: string;
+        error: unknown;
+    }[];
+}
+/** Thrown after every key has been tried, when at least one renewal failed. */
+export declare class SigningCertificateRenewalError extends Error {
+    result: RenewSigningCertificatesResult;
+    constructor(result: RenewSigningCertificatesResult);
+}
+/**
+ * Re-issues CA-issued `jwt_signing` certificates that are close to expiry.
+ *
+ * Renewal keeps the key pair, so the `kid` and every token already signed
+ * stay valid; only the certificate — and therefore the `x5c` a resource
+ * server validates — moves forward. Call it from a scheduled handler at least
+ * daily.
+ *
+ * Only certificates the CA issued are touched. Self-signed keys created
+ * before the CA was configured keep their certificate until they are rotated
+ * out, and public-only rows (a WFP tenant's copy of the control plane's
+ * verify keys) are skipped because there is no private key to certify.
+ *
+ * Every key is tried even if an earlier one fails. If any failed, a
+ * `SigningCertificateRenewalError` carrying the result is thrown at the end.
+ *
+ * @example
+ * ```ts
+ * export default {
+ *   async scheduled(_event, env) {
+ *     await renewSigningCertificates({
+ *       dataAdapter,
+ *       certificateAuthority: signingCertificateAuthority,
+ *     });
+ *   },
+ * };
+ * ```
+ */
+export declare function renewSigningCertificates(config: RenewSigningCertificatesConfig): Promise<RenewSigningCertificatesResult>;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "permissions" | "scope" | "sub" | "auth_time" | "iss" | "aud" | "exp" | "nbf" | "iat" | "jti" | "acr" | "amr" | "act" | "org_id" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "org_id" | "sid" | "sub" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "permissions" | "scope" | "sub" | "auth_time" | "iss" | "aud" | "exp" | "nbf" | "iat" | "jti" | "azp" | "acr" | "amr" | "act" | "org_id" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "org_id" | "sid" | "sub" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**