authhero 9.26.0 → 9.27.0

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation";
                 };
             } & {
                 query: {

package/dist/types/state-machines/login-session.d.ts

@@ -22,6 +22,11 @@ export interface LoginSessionData {
     inviter_name?: string;
     roles?: string[];
     connect?: Record<string, unknown>;
+    deviceFlow?: {
+        deviceCodeHash?: string;
+        userCode?: string;
+        ready?: boolean;
+    };
     try_connection_result?: unknown;
 }
 /** The on-disk JSON shape stays flat for compatibility with existing sessions. */

package/dist/types/tenant-members/request-notifier.d.ts

@@ -0,0 +1,9 @@
+import type { ControlPlaneClient } from "../helpers/control-plane-client";
+import type { AfterTenantMemberRequestRegistered } from "./requests";
+/**
+ * Tells the control plane, over the shared control-plane client, that a
+ * request is waiting, and records that it was told. If the control plane is
+ * down the request simply stays unnotified and a control-plane sweep finds it
+ * later, so this never throws.
+ */
+export declare function createControlPlaneRequestNotifier(client: ControlPlaneClient): AfterTenantMemberRequestRegistered;

package/dist/types/tenant-members/request-notify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/requests.d.ts

@@ -0,0 +1,79 @@
+import { z } from "@hono/zod-openapi";
+import type { Context } from "hono";
+import type { TenantMemberRequest } from "@authhero/adapter-interfaces";
+import type { Bindings, Variables } from "../types";
+import { TenantMembersBackend } from "./types";
+/** What each kind of request carries in `payload`. */
+export declare const tenantMemberRequestPayloadSchemas: {
+    invite: z.ZodObject<{
+        invitee: z.ZodObject<{
+            email: z.ZodString;
+        }, z.core.$strip>;
+        inviter: z.ZodDefault<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        roles: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        send_invitation_email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        ttl_sec: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    add_members: z.ZodObject<{
+        user_ids: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    remove_members: z.ZodObject<{
+        user_ids: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    assign_roles: z.ZodObject<{
+        user_id: z.ZodString;
+        roles: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    remove_roles: z.ZodObject<{
+        user_id: z.ZodString;
+        roles: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    revoke_invitation: z.ZodObject<{
+        invitation_id: z.ZodString;
+    }, z.core.$strip>;
+};
+type Ctx = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+/**
+ * What a deployment does once a request is stored, given the stored row. A
+ * shard tells the control plane (`createControlPlaneRequestNotifier`), a
+ * single-instance deployment runs it right away. A failure here never fails
+ * the registration: the request stays `pending` and is picked up later.
+ */
+export type AfterTenantMemberRequestRegistered = (ctx: Ctx, request: TenantMemberRequest) => Promise<void>;
+export interface TenantMemberRequestsConfig {
+    afterRegister?: AfterTenantMemberRequestRegistered;
+}
+/**
+ * The request cannot be carried out, for a reason an admin may read: it is not
+ * a failure of the system, so it is not retried.
+ */
+export declare class TenantMemberRequestRejected extends Error {
+    constructor(reason: string);
+}
+export interface ExecuteTenantMemberRequestOptions {
+    /**
+     * Whether the requester may still change this tenant's team. Defaults to
+     * holding at least one role in the tenant's organization.
+     */
+    isRequesterAllowed?: (backend: TenantMembersBackend, tenantId: string, userId: string) => Promise<boolean>;
+}
+/**
+ * Carries out one request against the control-plane team of its tenant.
+ *
+ * `tenantId` is the tenant the caller proved it speaks for (the verified
+ * service token's `tenant_id`); a request that names another tenant is
+ * refused. The requester is checked again here because the request may have
+ * waited a while. Running it twice is safe: membership and role changes are
+ * idempotent, and an invitation that was already created for the same address
+ * is reused instead of created again.
+ *
+ * Returns what the request produced, to store on the row. Throws
+ * {@link TenantMemberRequestRejected} when it must not or cannot run.
+ */
+export declare function executeTenantMemberRequest(backend: TenantMembersBackend, tenantId: string, request: Pick<TenantMemberRequest, "tenant_id" | "kind" | "requested_by" | "payload" | "result">, options?: ExecuteTenantMemberRequestOptions): Promise<Record<string, unknown> | null>;
+export {};

package/dist/types/tenant-members/requests.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/wire.d.ts

@@ -26,3 +26,13 @@ export declare const createInvitationBodySchema: z.ZodObject<{
     ttl_sec: z.ZodOptional<z.ZodNumber>;
     tenant_id: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * A shard tells the control plane that a team-change request is waiting
+ * (issue #1550). Only the id travels: the control plane reads the request from
+ * the shard, so what was asked never rests on what the notification claims.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBER_REQUESTS_NOTIFY_PATH = "/api/v2/proxy/control-plane/tenant-members/requests/notify";
+export declare const notifyMemberRequestBodySchema: z.ZodObject<{
+    request_id: z.ZodString;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/types/types/AuthHeroConfig.d.ts

@@ -482,6 +482,16 @@ export interface AuthHeroConfig {
      */
     tenantMembers?: {
         getBackend: import("../routes/management-api/tenant-members").GetTenantMembersBackend;
+        /**
+         * Register team changes as requests instead of making them in the request
+         * (issue #1550). Needs `tenantMemberRequests` on the data adapter. A write
+         * then answers `202` with the request id, `GET /tenant-members/requests`
+         * lists them, and `afterRegister` decides what happens next: a shard tells
+         * the control plane (`createControlPlaneRequestNotifier`), a
+         * single-instance deployment runs the request right away. Unset keeps the
+         * synchronous writes.
+         */
+        requests?: import("../tenant-members/requests").TenantMemberRequestsConfig;
     };
     /**
      * Optional outbox-driven replication of `proxy_routes` mutations to a global

package/dist/types/types/Variables.d.ts

@@ -1,4 +1,4 @@
-import { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
+import { DataAdapters, LoginSession, RequestAuth } from "@authhero/adapter-interfaces";
 import { CountryCode } from "libphonenumber-js";
 import { Auth0Client } from "./Auth0Client";
 import type { PreferState } from "../middlewares/prefer";
@@ -39,6 +39,8 @@ export type Variables = {
     client_id?: string;
     user_id?: string;
     username?: string;
+    /** Verified account-session caller, captured before account mutations. */
+    sessionAuth?: RequestAuth;
     connection?: string;
     body?: any;
     /**

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "9.26.0",
+  "version": "9.27.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.17.0",
-    "@authhero/widget": "0.41.5"
+    "@authhero/kysely-adapter": "12.18.0",
+    "@authhero/widget": "0.41.7"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.23.0",
-    "@authhero/proxy": "0.11.9",
-    "@authhero/saml": "0.6.2"
+    "@authhero/adapter-interfaces": "4.24.0",
+    "@authhero/proxy": "0.11.10",
+    "@authhero/saml": "0.6.3"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",