authhero 9.20.0 → 9.21.0

package/dist/types/authentication-flows/auth0-migration.d.ts

@@ -43,8 +43,8 @@ interface AttemptUpstreamPasswordParams {
  * via the password-realm grant. On success, creates the local user (if
  * missing), stores the bcrypt hash of the password locally, and returns the
  * user. On any failure, returns null — the caller surfaces the existing
- * INVALID_PASSWORD/USER_NOT_FOUND error so the upstream's existence is not
- * leaked to clients.
+ * INVALID_CREDENTIALS error so the upstream's existence is not leaked to
+ * clients.
  *
  * Subsequent logins are served entirely locally because the password row now
  * exists on our side.

package/dist/types/authentication-flows/passwordless.d.ts

@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/generated/locale-types.d.ts

@@ -2,6 +2,7 @@ export type Locale = "cs" | "da" | "en" | "fi" | "it" | "nb" | "pl" | "sv";
 export interface CommonScreen {
     alertListTitle: () => string;
     backText: () => string;
+    backToLoginText: () => string;
     cancelText: () => string;
     closeText: () => string;
     contactSupportText: () => string;

package/dist/types/helpers/request-data.d.ts

@@ -13,3 +13,12 @@ export declare function setRequestData(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, data: DataAdapters): void;
+/**
+ * The raw adapter a route group composes its per-request stack on: the base
+ * an earlier middleware installed on `ctx.var.baseData` (per-tenant database
+ * isolation), or `fallback`, the startup adapter from the config.
+ */
+export declare function getBaseData(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, fallback: DataAdapters): DataAdapters;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "sid" | "scope" | "permissions" | "iat" | "org_id" | "aud" | "auth_time" | "exp" | "iss" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "permissions" | "tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "sid" | "scope" | "permissions" | "iat" | "org_id" | "aud" | "auth_time" | "exp" | "iss" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "permissions" | "tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**