authhero 9.24.1 → 9.25.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -136,6 +136,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             updated_at: string;
             friendly_name: string;
             id: string;
+            parent_tenant_id?: string | null | undefined;
             audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
@@ -239,7 +240,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "failed" | "ready" | undefined;
+            provisioning_state?: "pending" | "ready" | "failed" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -287,7 +288,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
             } | undefined;
             mfa?: {
-                policy?: "always" | "never" | undefined;
+                policy?: "never" | "always" | undefined;
                 factors?: {
                     sms: boolean;
                     otp: boolean;
@@ -436,6 +437,9 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
+            scope?: "shared" | "local" | "platform" | undefined;
+            override?: "none" | "secrets" | "fields" | undefined;
+            enforce?: boolean | undefined;
             id?: string | undefined;
             display_name?: string | undefined;
             enabled_clients?: string[] | undefined;

package/dist/types/helpers/audit-target-types.d.ts

@@ -4,3 +4,29 @@
  *  Shared by `helpers/logging.ts` (write path) and
  *  `outbox-destinations/logs.ts` (outbox transform) so the two never drift. */
 export declare const USER_TARGET_TYPES: Set<string>;
+/** The flat log's `user_id` for an audit event: the target for user-scoped
+ *  operations, otherwise the actor. The caller of a management operation is
+ *  carried separately in `request.auth`. */
+export declare function logSubjectUserId(event: {
+    actor: {
+        id?: string;
+    };
+    target?: {
+        type: string;
+        id: string;
+    };
+}): string;
+/** The flat log's `user_name` for an audit event. `actor.email` only names the
+ *  actor, so it is used only when the log subject is the actor — a user-scoped
+ *  operation by an admin must not pair the target's `user_id` with the admin's
+ *  email. */
+export declare function logSubjectUserName(event: {
+    actor: {
+        id?: string;
+        email?: string;
+    };
+    target?: {
+        type: string;
+        id: string;
+    };
+}): string | undefined;

package/dist/types/helpers/client.d.ts

@@ -145,6 +145,7 @@ export declare const enrichedClientSchema: z.ZodObject<{
     tenant: z.ZodObject<{
         created_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
         updated_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
+        parent_tenant_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         audience: z.ZodOptional<z.ZodString>;
         friendly_name: z.ZodString;
         picture_url: z.ZodOptional<z.ZodString>;
@@ -352,6 +353,17 @@ export declare const enrichedClientSchema: z.ZodObject<{
     connections: z.ZodArray<z.ZodObject<{
         created_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
         updated_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            shared: "shared";
+            platform: "platform";
+        }>>;
+        override: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            secrets: "secrets";
+            fields: "fields";
+        }>>;
+        enforce: z.ZodOptional<z.ZodBoolean>;
         id: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         display_name: z.ZodOptional<z.ZodString>;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "tenant_id" | "client_id" | "org_name" | "scope" | "permissions" | "org_id" | "sid" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "exp" | "iat" | "tenant_id" | "client_id" | "org_name" | "jti" | "scope" | "gty" | "org_id" | "sid" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "act" | "requested_userinfo_claims")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "tenant_id" | "client_id" | "org_name" | "scope" | "permissions" | "org_id" | "sid" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "exp" | "iat" | "tenant_id" | "client_id" | "org_name" | "jti" | "scope" | "azp" | "gty" | "org_id" | "sid" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "act" | "requested_userinfo_claims")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**