authhero 9.23.1 → 9.24.1

package/dist/types/authentication-flows/password.d.ts

@@ -19,6 +19,12 @@ export declare function clearFailedLogins(data: Bindings["data"], tenantId: stri
  * best-effort — the password is already changed by the time this runs.
  */
 export declare function recordPasswordReset(data: Bindings["data"], tenantId: string, user: User): Promise<void>;
+/**
+ * The password has already changed. Failure to persist the completion notice or
+ * flow state must not turn that successful change into a reported failure.
+ * The credential was consumed before the password write and remains single-use.
+ */
+export declare function recordPasswordResetCompletion(data: Bindings["data"], tenantId: string, loginSessionId: string, requestId: string, fields?: Omit<Partial<LoginSession>, "state_data">): Promise<void>;
 export declare function passwordGrant(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -239,7 +239,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_state?: "pending" | "failed" | "ready" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -287,7 +287,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
             } | undefined;
             mfa?: {
-                policy?: "never" | "always" | undefined;
+                policy?: "always" | "never" | undefined;
                 factors?: {
                     sms: boolean;
                     otp: boolean;
@@ -386,7 +386,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                         } | undefined;
                         unique?: boolean | undefined;
                         profile_required?: boolean | undefined;
-                        verification_method?: "code" | "link" | undefined;
+                        verification_method?: "link" | "code" | undefined;
                     } | undefined;
                     username?: {
                         identifier?: {
@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "sms" | "email" | "username";
-    authConnection: "sms" | "email" | "username";
+    connectionType: "username" | "email" | "sms";
+    authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/generated/locale-types.d.ts

@@ -527,6 +527,7 @@ export interface LoginPasswordScreen {
     sessionExpired: () => string;
     tooManyRequests: () => string;
     unexpectedError: () => string;
+    passwordResetSuccess: () => string;
 }
 export interface LoginPasswordlessScreen {
     authMethodEmail: () => string;

package/dist/types/helpers/logging.d.ts

@@ -70,6 +70,13 @@ export type LogParams = {
      * linking to the execution (Auth0 reaches executions via the tenant logs).
      */
     execution_id?: string;
+    /**
+     * The login session (the `state`) this event belongs to. Merged into
+     * `details` so one login flow can be traced across /authorize, /u/* and
+     * /samlp/* log entries. Defaults to `ctx.var.loginSession?.id` when the
+     * request has resolved a login session.
+     */
+    login_session_id?: string;
     /**
      * If true, wait for the log to complete before returning.
      * If false (default), execute logging asynchronously in the background.

package/dist/types/helpers/outbox-destinations/log-streams.d.ts

@@ -32,6 +32,8 @@ interface LogStreamData {
             body?: unknown;
         };
         execution_id?: string;
+        login_session_id?: string;
+        [key: string]: unknown;
     };
 }
 interface LogStreamPayload {

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "tenant_id" | "client_id" | "org_name" | "scope" | "permissions" | "org_id" | "sid" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "tenant_id" | "client_id" | "org_name" | "scope" | "permissions" | "org_id" | "sid" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/session-notice.d.ts

@@ -0,0 +1,17 @@
+import { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
+/** Key under `state_data` holding a one-shot notice for the next screen. */
+export declare const SESSION_NOTICE_STATE_KEY = "notice";
+/**
+ * Notices a flow can leave on the login session for the screen the user lands
+ * on next. Stored as a code, never as text, so the screen translates it at
+ * render time and a language switch still shows it in the right language.
+ */
+export type SessionNotice = "password_reset_success";
+export declare function readSessionNotice(loginSession?: LoginSession | null): SessionNotice | undefined;
+export declare function setSessionNotice(data: DataAdapters, tenantId: string, loginSession: LoginSession, notice: SessionNotice): Promise<void>;
+/**
+ * Drops the notice once the user has moved past the screen it was meant for.
+ * Written as "" when nothing else is left in `state_data`: adapters skip
+ * `undefined` properties on update, so omitting the column would leave it be.
+ */
+export declare function clearSessionNotice(data: DataAdapters, tenantId: string, loginSession: LoginSession): Promise<void>;

package/dist/types/helpers/users.d.ts

@@ -162,6 +162,11 @@ interface LinkUserToParams {
  * hook, or internal linking code — is safe by construction rather than by
  * remembering to call the right helper.
  *
+ * This performs several writes (repoint, and on promotion also unlink), so
+ * direct callers should pass an adapter bound to a transaction. The user-update
+ * hook already does this via `data.transaction`, so callers going through
+ * `users.update(id, { linked_to })` get atomicity automatically.
+ *
  * Returns the cluster root `userId` was actually linked to, which may differ
  * from the requested `primaryId`.
  */