authhero 9.24.1 → 9.26.0

package/dist/types/adapters/createEncryptedDataAdapter.d.ts

@@ -22,7 +22,8 @@ interface EncryptionOptions {
  * Encrypted columns: clients.client_secret, connections.options
  * (client_secret/app_secret/twilio_token/configuration.client_secret),
  * email_providers.credentials, authentication_methods.totp_secret,
- * migration_sources.credentials.client_secret.
+ * migration_sources.credentials.client_secret, actions.secrets[].value,
+ * action_versions.secrets[].value, hook_code.secrets values.
  *
  * clientConnections.listByClient is also wrapped so its returned Connection
  * objects are decrypted — getEnrichedClient uses this path to load connections

package/dist/types/adapters/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./cache";
 export { createEncryptedDataAdapter, createEncryptedDataAdapterWithKeyRing, } from "./createEncryptedDataAdapter";
 export type { EncryptKeyIdResolver } from "./createEncryptedDataAdapter";
-export { loadEncryptionKey, encryptField, decryptField, encryptFieldWithRing, decryptFieldWithRing, parseKeyId, isEncrypted, } from "../utils/field-encryption";
+export { loadEncryptionKey, encryptField, decryptField, encryptFieldWithRing, decryptFieldWithRing, parseKeyId, isEncrypted, canDecrypt, } from "../utils/field-encryption";
 export type { KeyRing } from "../utils/field-encryption";

package/dist/types/authentication-flows/passwordless.d.ts

@@ -136,6 +136,10 @@ export declare function passwordlessGrantUser(ctx: Context<{
             updated_at: string;
             friendly_name: string;
             id: string;
+            parent_tenant_id?: string | null | undefined;
+            config_sync?: "inherit-on-read" | "synced" | null | undefined;
+            config_sync_hash?: string | null | undefined;
+            config_synced_at?: string | null | undefined;
             audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
@@ -239,7 +243,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "failed" | "ready" | undefined;
+            provisioning_state?: "pending" | "ready" | "failed" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -287,7 +291,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
             } | undefined;
             mfa?: {
-                policy?: "always" | "never" | undefined;
+                policy?: "never" | "always" | undefined;
                 factors?: {
                     sms: boolean;
                     otp: boolean;
@@ -386,7 +390,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                         } | undefined;
                         unique?: boolean | undefined;
                         profile_required?: boolean | undefined;
-                        verification_method?: "link" | "code" | undefined;
+                        verification_method?: "code" | "link" | undefined;
                     } | undefined;
                     username?: {
                         identifier?: {
@@ -436,6 +440,9 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
+            scope?: "local" | "shared" | "platform" | undefined;
+            override?: "secrets" | "none" | "fields" | undefined;
+            enforce?: boolean | undefined;
             id?: string | undefined;
             display_name?: string | undefined;
             enabled_clients?: string[] | undefined;
@@ -561,8 +568,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/errors/management-api-error.d.ts

@@ -0,0 +1,113 @@
+import { Context } from "hono";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { JSONHTTPException } from "./json-http-exception";
+/**
+ * Management API errors in Auth0's wire shape. Auth0 SDKs (go-auth0, the
+ * Terraform provider, node-auth0) parse `{ statusCode, error, message,
+ * errorCode }` and branch on `errorCode`.
+ *
+ * The bodies below are a superset of Auth0's: where Auth0 returns a message or
+ * errorCode we return the same bytes (captured from a live tenant, see
+ * apps/docs/api/error-codes.md), and where Auth0 omits `errorCode` we add one.
+ * Every added code is listed under "AuthHero extensions" in that doc page —
+ * keep the two in sync.
+ */
+export declare const ERROR_TEXT_BY_STATUS: Record<number, string>;
+export interface ManagementErrorBody {
+    statusCode: number;
+    error: string;
+    message: string;
+    errorCode?: string;
+}
+export declare function managementErrorBody(status: number, message: string, errorCode?: string): ManagementErrorBody;
+export declare function managementError(status: ContentfulStatusCode, message: string, errorCode?: string): JSONHTTPException;
+/**
+ * 404s per resource. Messages marked "auth0" are byte-identical to Auth0
+ * (including its inconsistent trailing periods); the rest are AuthHero
+ * resources or Auth0 resources without an errorCode, and follow the
+ * `The <resource> does not exist.` / `inexistent_<resource>` convention.
+ */
+export declare const notFound: {
+    user: () => JSONHTTPException;
+    users: () => JSONHTTPException;
+    client: () => JSONHTTPException;
+    clientOnUpdate: () => JSONHTTPException;
+    connection: () => JSONHTTPException;
+    resourceServer: () => JSONHTTPException;
+    resourceServerByIdentifier: (identifier: string) => JSONHTTPException;
+    clientGrant: () => JSONHTTPException;
+    log: () => JSONHTTPException;
+    job: () => JSONHTTPException;
+    customDomain: (id: string) => JSONHTTPException;
+    key: (kid: string) => JSONHTTPException;
+    hook: () => JSONHTTPException;
+    enrollment: () => JSONHTTPException;
+    role: () => JSONHTTPException;
+    roleOnUpdate: () => JSONHTTPException;
+    organization: () => JSONHTTPException;
+    action: () => JSONHTTPException;
+    tenant: () => JSONHTTPException;
+    invitation: () => JSONHTTPException;
+    member: () => JSONHTTPException;
+    identity: () => JSONHTTPException;
+    session: () => JSONHTTPException;
+    refreshToken: () => JSONHTTPException;
+    grant: () => JSONHTTPException;
+    logStream: () => JSONHTTPException;
+    form: () => JSONHTTPException;
+    flow: () => JSONHTTPException;
+    emailTemplate: () => JSONHTTPException;
+    emailProvider: () => JSONHTTPException;
+    authenticationMethod: () => JSONHTTPException;
+    actionExecution: () => JSONHTTPException;
+    actionVersion: () => JSONHTTPException;
+    hookCode: () => JSONHTTPException;
+    failedEvent: () => JSONHTTPException;
+    migrationSource: () => JSONHTTPException;
+    proxyRoute: () => JSONHTTPException;
+    scimConfiguration: () => JSONHTTPException;
+    scimToken: () => JSONHTTPException;
+    tenantOperation: () => JSONHTTPException;
+    rollout: () => JSONHTTPException;
+    tokenExchangeProfile: () => JSONHTTPException;
+};
+/**
+ * 409s. `userExists`, `resourceServer` and `organizationName` are Auth0's
+ * bodies (the "identifer" typo is Auth0's, kept byte-identical); the
+ * organization errorCode is added.
+ */
+export declare const conflict: {
+    userExists: () => JSONHTTPException;
+    resourceServer: (identifier: string) => JSONHTTPException;
+    organizationName: () => JSONHTTPException;
+    /** Any other AuthHero conflict: own message, shared code. */
+    other: (message: string) => JSONHTTPException;
+};
+export declare const authErrors: {
+    missingAuthentication: () => JSONHTTPException;
+    invalidToken: (message?: string) => JSONHTTPException;
+    insufficientScope: (expected: string[]) => JSONHTTPException;
+};
+/**
+ * Formats zod issues the way Auth0 does:
+ * `Payload validation error: 'Missing required property: name'.`, joined with
+ * ` (also) ` when there are several. Auth0 also appends each property's
+ * schema description, which we don't have at this layer.
+ */
+export declare function formatValidationMessage(target: string, issues: unknown[], data: unknown): ManagementErrorBody;
+/**
+ * `defaultHook` for every management-api OpenAPIHono app. The hook is the only
+ * place zod-openapi exposes which part of the request failed, which is what
+ * picks Auth0's invalid_body / invalid_query_string / invalid_uri code.
+ */
+export declare function managementValidationHook(result: {
+    success: boolean;
+    target: string;
+    data?: unknown;
+    error?: unknown;
+}, ctx: Context): (Response & import("hono").TypedResponse<{
+    statusCode: number;
+    error: string;
+    message: string;
+    errorCode?: string | undefined;
+}, 400, "json">) | undefined;

package/dist/types/helpers/audit-target-types.d.ts

@@ -4,3 +4,29 @@
  *  Shared by `helpers/logging.ts` (write path) and
  *  `outbox-destinations/logs.ts` (outbox transform) so the two never drift. */
 export declare const USER_TARGET_TYPES: Set<string>;
+/** The flat log's `user_id` for an audit event: the target for user-scoped
+ *  operations, otherwise the actor. The caller of a management operation is
+ *  carried separately in `request.auth`. */
+export declare function logSubjectUserId(event: {
+    actor: {
+        id?: string;
+    };
+    target?: {
+        type: string;
+        id: string;
+    };
+}): string;
+/** The flat log's `user_name` for an audit event. `actor.email` only names the
+ *  actor, so it is used only when the log subject is the actor — a user-scoped
+ *  operation by an admin must not pair the target's `user_id` with the admin's
+ *  email. */
+export declare function logSubjectUserName(event: {
+    actor: {
+        id?: string;
+        email?: string;
+    };
+    target?: {
+        type: string;
+        id: string;
+    };
+}): string | undefined;

package/dist/types/helpers/client.d.ts

@@ -145,6 +145,13 @@ export declare const enrichedClientSchema: z.ZodObject<{
     tenant: z.ZodObject<{
         created_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
         updated_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
+        parent_tenant_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        config_sync: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            "inherit-on-read": "inherit-on-read";
+            synced: "synced";
+        }>>>;
+        config_sync_hash: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        config_synced_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         audience: z.ZodOptional<z.ZodString>;
         friendly_name: z.ZodString;
         picture_url: z.ZodOptional<z.ZodString>;
@@ -352,6 +359,17 @@ export declare const enrichedClientSchema: z.ZodObject<{
     connections: z.ZodArray<z.ZodObject<{
         created_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
         updated_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            local: "local";
+            shared: "shared";
+            platform: "platform";
+        }>>;
+        override: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            secrets: "secrets";
+            fields: "fields";
+        }>>;
+        enforce: z.ZodOptional<z.ZodBoolean>;
         id: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         display_name: z.ZodOptional<z.ZodString>;

package/dist/types/helpers/control-plane-caller.d.ts

@@ -0,0 +1,15 @@
+/**
+ * True when the caller's token comes from the control plane (or the deployment
+ * is single-tenant, which is effectively a control plane). Organization-scoped
+ * tokens are tenant-level credentials and do not count.
+ */
+export declare function callerIsControlPlane(ctx: {
+    env: {
+        data: {
+            multiTenancyConfig?: {
+                controlPlaneTenantId?: string;
+            };
+        };
+    };
+    var: object;
+}): boolean;

package/dist/types/helpers/platform-rows.d.ts

@@ -0,0 +1,27 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+/**
+ * Hides `scope: "platform"` rows that a config sync delivered into a tenant
+ * from that tenant's own management API. Such rows must run (the code-hook
+ * executor reads them through other adapters) but their code and secrets are
+ * never shown, listed, edited or referenced by the tenant's admins.
+ *
+ * A row is hidden when it is platform-scoped **and** has a synced id. The
+ * control plane's own origin rows are platform-scoped too, but they are
+ * owned by the tenant that publishes them and stay visible there. Operators
+ * (control-plane credentials) see everything.
+ *
+ * A hidden row behaves as if it did not exist: `get` returns `null`, lists omit
+ * it, and writes against it are refused as not found. List totals and
+ * checkpoint cursors are not adjusted for hidden rows.
+ *
+ * Limit: this protects against the tenant's management API. The code and
+ * (encrypted) secrets are still stored in the tenant's database, so anyone
+ * with access to the database or the worker environment can read them.
+ */
+export interface PlatformRowsOptions {
+    /** The tenant whose management API is being served. */
+    tenantId: string;
+    /** Control-plane credentials see platform rows. */
+    isOperator: boolean;
+}
+export declare function withPlatformRowsHidden(data: DataAdapters, options: PlatformRowsOptions): DataAdapters;

package/dist/types/helpers/request-data.d.ts

@@ -13,6 +13,18 @@ export declare function setRequestData(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, data: DataAdapters): void;
+/**
+ * The adapter stack code-hook and webhook execution reads.
+ *
+ * The management API hides platform-scoped rows that a config sync delivered
+ * from `ctx.var.data`, but hooks that run inline inside a management request
+ * (pre-registration, pre-deletion, ...) must still see and run them. Where no
+ * separate stack was installed this is the request's own stack.
+ */
+export declare function getExecutorData(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>): DataAdapters;
 /**
  * The raw adapter a route group composes its per-request stack on: the base
  * an earlier middleware installed on `ctx.var.baseData` (per-tenant database

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "tenant_id" | "client_id" | "org_name" | "scope" | "permissions" | "org_id" | "sid" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "scope" | "sid" | "permissions" | "jti" | "org_id" | "iat" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "tenant_id" | "client_id" | "org_name" | "scope" | "permissions" | "org_id" | "sid" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "scope" | "sid" | "permissions" | "jti" | "org_id" | "iat" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/synced-rows.d.ts

@@ -0,0 +1 @@
+export declare function isSyncedRowId(id: string | undefined | null): boolean;