authhero 9.18.0 → 9.20.0

package/dist/types/helpers/renew-signing-certificates.d.ts

@@ -0,0 +1,61 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { SigningCertificateAuthority } from "./signing-certificate-authority";
+export interface RenewSigningCertificatesConfig {
+    /** Same `DataAdapters` passed to `init()`. */
+    dataAdapter: Pick<DataAdapters, "keys">;
+    /** Same value passed to `init({ signingCertificateAuthority })`. */
+    certificateAuthority: SigningCertificateAuthority;
+    /**
+     * Renew certificates that expire within this many days.
+     *
+     * @default a third of the CA's `validityDays` (10 days for the 30-day
+     * default), and at least one day
+     */
+    renewBeforeDays?: number;
+    /** Clock override for tests. */
+    now?: () => Date;
+}
+export interface RenewSigningCertificatesResult {
+    /** Keys whose certificate was re-issued. The `kid` is unchanged. */
+    renewed: string[];
+    /** CA-issued keys that are not due yet. */
+    notDue: number;
+    failed: {
+        kid: string;
+        error: unknown;
+    }[];
+}
+/** Thrown after every key has been tried, when at least one renewal failed. */
+export declare class SigningCertificateRenewalError extends Error {
+    result: RenewSigningCertificatesResult;
+    constructor(result: RenewSigningCertificatesResult);
+}
+/**
+ * Re-issues CA-issued `jwt_signing` certificates that are close to expiry.
+ *
+ * Renewal keeps the key pair, so the `kid` and every token already signed
+ * stay valid; only the certificate — and therefore the `x5c` a resource
+ * server validates — moves forward. Call it from a scheduled handler at least
+ * daily.
+ *
+ * Only certificates the CA issued are touched. Self-signed keys created
+ * before the CA was configured keep their certificate until they are rotated
+ * out, and public-only rows (a WFP tenant's copy of the control plane's
+ * verify keys) are skipped because there is no private key to certify.
+ *
+ * Every key is tried even if an earlier one fails. If any failed, a
+ * `SigningCertificateRenewalError` carrying the result is thrown at the end.
+ *
+ * @example
+ * ```ts
+ * export default {
+ *   async scheduled(_event, env) {
+ *     await renewSigningCertificates({
+ *       dataAdapter,
+ *       certificateAuthority: signingCertificateAuthority,
+ *     });
+ *   },
+ * };
+ * ```
+ */
+export declare function renewSigningCertificates(config: RenewSigningCertificatesConfig): Promise<RenewSigningCertificatesResult>;

package/dist/types/helpers/request-data.d.ts

@@ -0,0 +1,15 @@
+import { Context } from "hono";
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../types";
+/**
+ * Installs `data` as this request's adapter stack on `ctx.var.data`.
+ *
+ * Also writes it to `ctx.env.data`, a deprecated alias kept for readers that
+ * have not moved to `ctx.var.data` yet, including consumers outside this repo.
+ * The env write is only safe because `applyConfigMiddleware` gives every
+ * request its own shallow copy of `env`. Drop it in the next major (#140).
+ */
+export declare function setRequestData(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, data: DataAdapters): void;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "permissions" | "scope" | "sub" | "auth_time" | "iss" | "aud" | "exp" | "nbf" | "iat" | "jti" | "acr" | "amr" | "act" | "org_id" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "sid" | "scope" | "permissions" | "iat" | "org_id" | "aud" | "auth_time" | "exp" | "iss" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "permissions" | "scope" | "sub" | "auth_time" | "iss" | "aud" | "exp" | "nbf" | "iat" | "jti" | "azp" | "acr" | "amr" | "act" | "org_id" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "sid" | "scope" | "permissions" | "iat" | "org_id" | "aud" | "auth_time" | "exp" | "iss" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/run-outbox-relay.d.ts

@@ -1,5 +1,5 @@
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
-import type { WebhookInvoker } from "../types/AuthHeroConfig";
+import type { ActionExecutionLogCapture, WebhookInvoker } from "../types/AuthHeroConfig";
 import type { OutboxMetricsSink } from "../types/OutboxMetrics";
 export interface RunOutboxRelayConfig {
     /** Same `DataAdapters` passed to `init()`. Must include `outbox` to drain. */
@@ -32,6 +32,12 @@ export interface RunOutboxRelayConfig {
      * silently skipped.
      */
     codeExecutor?: CodeExecutor;
+    /**
+     * Same value as `init({ actionExecutionLogs })`, so code hooks run by this
+     * cron drain persist console output the same way as inline deliveries.
+     * Defaults to `"full"`.
+     */
+    actionExecutionLogs?: ActionExecutionLogCapture;
     /**
      * Optional metrics sink — same shape as `init({ outbox: { metrics } })`.
      * Receives `outbox_events_processed_total`,

package/dist/types/hooks/codehooks.d.ts

@@ -1,6 +1,7 @@
 import { Context } from "hono";
 import { ActionExecutionLogs, ActionExecutionResult, CodeExecutionLog, CodeExecutor, DataAdapters, Hook } from "@authhero/adapter-interfaces";
 import { Bindings, Variables } from "../types";
+import type { ActionExecutionLogCapture } from "../types/AuthHeroConfig";
 import { HookEvent, OnExecuteCredentialsExchangeAPI } from "../types/Hooks";
 import { EnrichedClient } from "../helpers/client";
 /**
@@ -152,12 +153,24 @@ export declare const MAX_PERSISTED_LOG_CHARS = 256;
  * output and is not itself charged against the budget.
  */
 export declare function capActionExecutionLogs(logs: ActionExecutionLogs, budget?: number): ActionExecutionLogs;
+/**
+ * Select the outcomes whose console output may be persisted under the
+ * configured `actionExecutionLogs` mode. `"errors"` keeps only outcomes that
+ * errored or denied access. Any value other than the documented modes (a
+ * JS caller passing `"OFF"`, say) fails closed and persists nothing.
+ */
+export declare function selectPersistedLogOutcomes(outcomes: HandleCodeHookOutcome[], logCapture?: ActionExecutionLogCapture): HandleCodeHookOutcome[];
 /**
  * Aggregate per-action outcomes into an Auth0-shape execution record and
  * persist it via the adapter. Returns the generated execution_id (uuid)
  * so the caller can embed it in the surrounding tenant log.
+ *
+ * `options.logCapture` (from `init({ actionExecutionLogs })`) decides which
+ * console output reaches `logs`; the rest of the record is always written.
  */
-export declare function persistActionExecution(data: Pick<DataAdapters, "actionExecutions">, tenant_id: string, triggerId: string, outcomes: HandleCodeHookOutcome[]): Promise<string | null>;
+export declare function persistActionExecution(data: Pick<DataAdapters, "actionExecutions">, tenant_id: string, triggerId: string, outcomes: HandleCodeHookOutcome[], options?: {
+    logCapture?: ActionExecutionLogCapture;
+}): Promise<string | null>;
 /**
  * Execute code hooks for the credentials-exchange trigger.
  * Filters enabled code hooks from the provided hooks list and executes them.