authhero 9.24.0 → 9.25.0

package/dist/types/authentication-flows/password.d.ts

@@ -19,6 +19,12 @@ export declare function clearFailedLogins(data: Bindings["data"], tenantId: stri
  * best-effort — the password is already changed by the time this runs.
  */
 export declare function recordPasswordReset(data: Bindings["data"], tenantId: string, user: User): Promise<void>;
+/**
+ * The password has already changed. Failure to persist the completion notice or
+ * flow state must not turn that successful change into a reported failure.
+ * The credential was consumed before the password write and remains single-use.
+ */
+export declare function recordPasswordResetCompletion(data: Bindings["data"], tenantId: string, loginSessionId: string, requestId: string, fields?: Omit<Partial<LoginSession>, "state_data">): Promise<void>;
 export declare function passwordGrant(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -136,6 +136,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             updated_at: string;
             friendly_name: string;
             id: string;
+            parent_tenant_id?: string | null | undefined;
             audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
@@ -386,7 +387,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                         } | undefined;
                         unique?: boolean | undefined;
                         profile_required?: boolean | undefined;
-                        verification_method?: "code" | "link" | undefined;
+                        verification_method?: "link" | "code" | undefined;
                     } | undefined;
                     username?: {
                         identifier?: {
@@ -436,6 +437,9 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
+            scope?: "shared" | "local" | "platform" | undefined;
+            override?: "none" | "secrets" | "fields" | undefined;
+            enforce?: boolean | undefined;
             id?: string | undefined;
             display_name?: string | undefined;
             enabled_clients?: string[] | undefined;
@@ -561,8 +565,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "sms" | "email" | "username";
-    authConnection: "sms" | "email" | "username";
+    connectionType: "username" | "email" | "sms";
+    authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/generated/locale-types.d.ts

@@ -527,6 +527,7 @@ export interface LoginPasswordScreen {
     sessionExpired: () => string;
     tooManyRequests: () => string;
     unexpectedError: () => string;
+    passwordResetSuccess: () => string;
 }
 export interface LoginPasswordlessScreen {
     authMethodEmail: () => string;

package/dist/types/helpers/audit-target-types.d.ts

@@ -4,3 +4,29 @@
  *  Shared by `helpers/logging.ts` (write path) and
  *  `outbox-destinations/logs.ts` (outbox transform) so the two never drift. */
 export declare const USER_TARGET_TYPES: Set<string>;
+/** The flat log's `user_id` for an audit event: the target for user-scoped
+ *  operations, otherwise the actor. The caller of a management operation is
+ *  carried separately in `request.auth`. */
+export declare function logSubjectUserId(event: {
+    actor: {
+        id?: string;
+    };
+    target?: {
+        type: string;
+        id: string;
+    };
+}): string;
+/** The flat log's `user_name` for an audit event. `actor.email` only names the
+ *  actor, so it is used only when the log subject is the actor — a user-scoped
+ *  operation by an admin must not pair the target's `user_id` with the admin's
+ *  email. */
+export declare function logSubjectUserName(event: {
+    actor: {
+        id?: string;
+        email?: string;
+    };
+    target?: {
+        type: string;
+        id: string;
+    };
+}): string | undefined;

package/dist/types/helpers/client.d.ts

@@ -145,6 +145,7 @@ export declare const enrichedClientSchema: z.ZodObject<{
     tenant: z.ZodObject<{
         created_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
         updated_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
+        parent_tenant_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         audience: z.ZodOptional<z.ZodString>;
         friendly_name: z.ZodString;
         picture_url: z.ZodOptional<z.ZodString>;
@@ -352,6 +353,17 @@ export declare const enrichedClientSchema: z.ZodObject<{
     connections: z.ZodArray<z.ZodObject<{
         created_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
         updated_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            shared: "shared";
+            platform: "platform";
+        }>>;
+        override: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            secrets: "secrets";
+            fields: "fields";
+        }>>;
+        enforce: z.ZodOptional<z.ZodBoolean>;
         id: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         display_name: z.ZodOptional<z.ZodString>;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "sub" | "sid" | "tenant_id" | "org_name" | "scope" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "exp" | "iat" | "tenant_id" | "client_id" | "org_name" | "jti" | "scope" | "gty" | "org_id" | "sid" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "act" | "requested_userinfo_claims")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "sub" | "sid" | "tenant_id" | "org_name" | "scope" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "exp" | "iat" | "tenant_id" | "client_id" | "org_name" | "jti" | "scope" | "azp" | "gty" | "org_id" | "sid" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "act" | "requested_userinfo_claims")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/session-notice.d.ts

@@ -0,0 +1,17 @@
+import { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
+/** Key under `state_data` holding a one-shot notice for the next screen. */
+export declare const SESSION_NOTICE_STATE_KEY = "notice";
+/**
+ * Notices a flow can leave on the login session for the screen the user lands
+ * on next. Stored as a code, never as text, so the screen translates it at
+ * render time and a language switch still shows it in the right language.
+ */
+export type SessionNotice = "password_reset_success";
+export declare function readSessionNotice(loginSession?: LoginSession | null): SessionNotice | undefined;
+export declare function setSessionNotice(data: DataAdapters, tenantId: string, loginSession: LoginSession, notice: SessionNotice): Promise<void>;
+/**
+ * Drops the notice once the user has moved past the screen it was meant for.
+ * Written as "" when nothing else is left in `state_data`: adapters skip
+ * `undefined` properties on update, so omitting the column would leave it be.
+ */
+export declare function clearSessionNotice(data: DataAdapters, tenantId: string, loginSession: LoginSession): Promise<void>;