authhero 9.26.0 → 9.27.0

package/dist/types/authentication-flows/device-code.d.ts

@@ -0,0 +1,11 @@
+import { z } from "@hono/zod-openapi";
+import { type DeviceContext } from "../helpers/device-flow";
+import type { EnrichedClient } from "../helpers/client";
+import type { GrantFlowUserResult } from "../types/GrantFlowResult";
+export declare const deviceCodeGrantParamsSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:device_code">;
+    device_code: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare function deviceCodeGrant(ctx: DeviceContext, params: z.infer<typeof deviceCodeGrantParamsSchema>, client: EnrichedClient): Promise<GrantFlowUserResult>;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -137,7 +137,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             friendly_name: string;
             id: string;
             parent_tenant_id?: string | null | undefined;
-            config_sync?: "inherit-on-read" | "synced" | null | undefined;
+            config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
             config_sync_hash?: string | null | undefined;
             config_synced_at?: string | null | undefined;
             audience?: string | undefined;
@@ -243,7 +243,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_state?: "pending" | "failed" | "ready" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -316,6 +316,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
             } | undefined;
             is_control_plane?: boolean | undefined;
+            has_children?: boolean | undefined;
         };
         connections: {
             created_at: string;
@@ -441,7 +442,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
             scope?: "local" | "shared" | "platform" | undefined;
-            override?: "secrets" | "none" | "fields" | undefined;
+            override?: "none" | "secrets" | "fields" | undefined;
             enforce?: boolean | undefined;
             id?: string | undefined;
             display_name?: string | undefined;

package/dist/types/generated/locale-types.d.ts

@@ -254,6 +254,22 @@ export interface DeviceFlowScreen {
         clientName: string;
     }) => string;
     title: () => string;
+    codeLabel: () => string;
+    confirmTitle: () => string;
+    confirmDescription: () => string;
+    requestDescription: (vars: {
+        clientName: string;
+    }) => string;
+    scopesLabel: () => string;
+    audienceLabel: () => string;
+    decisionLabel: () => string;
+    approveText: () => string;
+    denyText: () => string;
+    completeTitle: () => string;
+    approvedDescription: () => string;
+    deniedDescription: () => string;
+    alreadyCompleted: () => string;
+    sessionExpired: () => string;
 }
 export interface EmailOtpChallengeScreen {
     buttonText: () => string;

package/dist/types/helpers/client.d.ts

@@ -149,6 +149,7 @@ export declare const enrichedClientSchema: z.ZodObject<{
         config_sync: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             "inherit-on-read": "inherit-on-read";
             synced: "synced";
+            detached: "detached";
         }>>>;
         config_sync_hash: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         config_synced_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -355,6 +356,7 @@ export declare const enrichedClientSchema: z.ZodObject<{
         }, z.core.$strip>>;
         id: z.ZodString;
         is_control_plane: z.ZodOptional<z.ZodBoolean>;
+        has_children: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
     connections: z.ZodArray<z.ZodObject<{
         created_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;

package/dist/types/helpers/codes-cleanup.d.ts

@@ -25,4 +25,4 @@ export interface CodesCleanupParams {
  * }
  * ```
  */
-export declare function cleanupCodes(codes: CodesAdapter, params?: CodesCleanupParams): Promise<number>;
+export declare function cleanupCodes(codes: Pick<CodesAdapter, "cleanup">, params?: CodesCleanupParams): Promise<number>;

package/dist/types/helpers/device-flow.d.ts

@@ -0,0 +1,25 @@
+import type { Context } from "hono";
+import type { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
+import type { Bindings, Variables } from "../types";
+import type { EnrichedClient } from "./client";
+export type DeviceContext = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+export declare const DEVICE_CODE_LIFETIME = 600;
+export declare const DEVICE_POLL_INTERVAL = 5;
+export declare function hashDeviceCode(value: string): Promise<string>;
+export declare function normalizeUserCode(value: string): string;
+export declare function requireDeviceCodes(data: DataAdapters): import("@authhero/adapter-interfaces").DeviceCodesAdapter;
+export declare function assertDeviceGrantAllowed(client: EnrichedClient): void;
+export declare function authenticateDeviceClient(ctx: DeviceContext, client: EnrichedClient, secret?: string, basic?: boolean): void;
+/** Fixed windows are persisted, so limits survive isolate restarts and work without a rate-limit binding. */
+export declare function limitDeviceRequests(ctx: DeviceContext, tenantId: string, purpose: string, limit: number, identity?: string): Promise<void>;
+export declare function deviceFlowData(session: LoginSession): {
+    deviceCodeHash?: string;
+    userCode?: string;
+    ready?: boolean;
+} | undefined;
+export declare function isDeviceLoginSession(raw?: string | null): boolean;
+export declare function deviceBrowserCookie(session: LoginSession): string;
+export declare function assertDeviceBrowser(ctx: DeviceContext, session: LoginSession): void;

package/dist/types/helpers/hook-events.d.ts

@@ -5,6 +5,10 @@ type HookCtx = Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>;
+interface HookChangeContext {
+    previousUser?: User;
+    updates?: Partial<User>;
+}
 /**
  * Whether the outbox is configured for this request. When false, hook dispatch
  * falls back to inline webhook invocation (no retry / dead-letter).
@@ -21,7 +25,7 @@ export declare function outboxEnabled(ctx: HookCtx): boolean;
  * up front, the caller can relay it with {@link relayOutboxEvent} once the
  * write commits without needing a return value from the adapter.
  */
-export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, triggerId: string, user: User): OutboxEventInsert | undefined;
+export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, triggerId: string, user: User, changes?: HookChangeContext): OutboxEventInsert | undefined;
 /**
  * Relay an outbox event that has already been persisted (atomically with its
  * business write) so the outbox middleware picks it up for delivery. Mirrors
@@ -31,10 +35,10 @@ export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, trigg
  */
 export declare function relayOutboxEvent(ctx: HookCtx, id: string): void;
 /**
- * Fallback dispatch for when the outbox is not configured: invoke the
- * post-hook webhooks inline (fire-and-forget via `waitUntil`). No retry /
+ * Fallback dispatch for when the outbox is not configured: invoke post-hook
+ * webhooks and update/deletion Actions via `waitUntil`. No retry /
  * dead-letter support in this mode — configure the outbox for durable
  * delivery.
  */
-export declare function dispatchPostHookInline(ctx: HookCtx, tenantId: string, triggerId: string, user: User): void;
+export declare function dispatchPostHookInline(ctx: HookCtx, tenantId: string, triggerId: string, user: User, changes?: HookChangeContext): void;
 export {};

package/dist/types/helpers/hook-user-payload.d.ts

@@ -6,3 +6,5 @@ export type ExternalUser = Omit<User, "registration_completed_at">;
  * `onExecutePostLogin` event, outbox `target.after`, etc.).
  */
 export declare function stripInternalUserFields(user: User): ExternalUser;
+/** Update payloads can arrive from internal callers as well as validated APIs. */
+export declare function sanitizeUserUpdates(updates: Partial<User>): Partial<User>;

package/dist/types/helpers/logging.d.ts

@@ -58,7 +58,8 @@ export type LogParams = {
     };
     /**
      * When provided, replaces the auto-generated `{ request, response? }` details
-     * object entirely. Use this to store a compact, pre-built details payload
+     * object, except for verified caller attribution. Use this to store a compact,
+     * pre-built details payload
      * (e.g. for webhook logs) that fits within storage limits (Analytics Engine
      * blob: 1024 bytes). `execution_id` is still merged on top when set — pass it
      * via its own field rather than inlining it here, or the request block is lost.

package/dist/types/helpers/outbox-destinations/code-hooks.d.ts

@@ -8,6 +8,9 @@ interface CodeHookInvocation {
     triggerId: string;
     /** Serialized user snapshot from the audit event (`target.after`). */
     user?: unknown;
+    userId?: string;
+    previousUser?: unknown;
+    updates?: unknown;
     /** Serialized request context from the audit event. */
     request?: unknown;
 }
@@ -35,9 +38,9 @@ interface CodeHookInvocation {
  * Constructed per-request (via `getDestinations(ctx)`) so it can close over
  * `ctx.env.codeExecutor`. The same class is used by the cron `drainOutbox`
  * safety net when a `codeExecutor` is supplied to `createDefaultDestinations`.
- * When no executor is configured, code hooks cannot run (nor be deployed), so
- * `deliver` is a no-op success — matching the inline `handleCodeHook` which
- * returns `null` without an executor.
+ * Missing executors fail delivery for post-update/deletion so the event can be
+ * retried when the configuration is repaired. Registration retains its legacy
+ * no-op behavior without an executor.
  */
 export declare class CodeHookDestination implements EventDestination {
     name: string;
@@ -48,7 +51,9 @@ export declare class CodeHookDestination implements EventDestination {
         logCapture?: ActionExecutionLogCapture;
     });
     accepts(event: AuditEvent): boolean;
+    /** Recover the user write and stable delivery ID from a persisted hook event. */
     transform(event: AuditEvent): CodeHookInvocation;
+    /** Run matching Actions, record outcomes, and fail delivery when the relay must retry. */
     deliver(invocations: CodeHookInvocation[]): Promise<void>;
     /**
      * Fetch every hook for the tenant, paging past the adapter's default page

package/dist/types/helpers/outbox-destinations/webhooks.d.ts

@@ -15,6 +15,8 @@ interface WebhookInvocation {
         trigger_id: string;
         user?: unknown;
         request?: unknown;
+        previous_user?: unknown;
+        updates?: unknown;
     };
 }
 export interface WebhookDestinationOptions {
@@ -49,6 +51,7 @@ export declare class WebhookDestination implements EventDestination {
     private webhookInvoker?;
     constructor(hooks: HooksAdapter, getServiceToken: GetServiceToken, options?: WebhookDestinationOptions);
     accepts(event: AuditEvent): boolean;
+    /** Build the webhook payload from the event's committed user and update snapshots. */
     transform(event: AuditEvent): WebhookInvocation;
     deliver(events: WebhookInvocation[]): Promise<void>;
     private invokeCustom;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "scope" | "sid" | "permissions" | "jti" | "org_id" | "iat" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "sub" | "org_name" | "scope" | "sid" | "permissions" | "iat" | "jti" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sub" | "scope" | "sid" | "permissions" | "jti" | "org_id" | "iat" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "sub" | "org_name" | "scope" | "sid" | "permissions" | "iat" | "jti" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/scopes-permissions.d.ts

@@ -13,7 +13,7 @@ interface ClientCredentialsScopesAndPermissionsParams extends BaseScopesAndPermi
     userId?: never;
 }
 interface UserBasedScopesAndPermissionsParams extends BaseScopesAndPermissionsParams {
-    grantType?: GrantType.AuthorizationCode | GrantType.RefreshToken | GrantType.Password | GrantType.Passwordless | GrantType.OTP | GrantType.TokenExchange | undefined;
+    grantType?: GrantType.DeviceCode | GrantType.AuthorizationCode | GrantType.RefreshToken | GrantType.Password | GrantType.Passwordless | GrantType.OTP | GrantType.TokenExchange | undefined;
     userId: string;
 }
 export type CalculateScopesAndPermissionsParams = ClientCredentialsScopesAndPermissionsParams | UserBasedScopesAndPermissionsParams;

package/dist/types/hooks/lifecycle-codehooks.d.ts

@@ -0,0 +1,16 @@
+import { Context } from "hono";
+import { Bindings, Variables } from "../types";
+import { CodeHookEventInput } from "./codehooks";
+/** Blocking policies run before signup validation or a write, and fail closed. */
+export declare function runBlockingActions(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, triggerId: "validate-registration-username" | "pre-user-update" | "pre-user-deletion", event: CodeHookEventInput): Promise<{
+    allowed: boolean;
+    reason?: string;
+}>;
+/** Cancel lifecycle writes when a blocking Action denies or fails. */
+export declare function runPreUserActions(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, triggerId: "pre-user-update" | "pre-user-deletion", event: CodeHookEventInput): Promise<void>;

package/dist/types/hooks/user-deletion.d.ts

@@ -12,3 +12,12 @@ export declare function createUserDeletionHooks(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, data: DataAdapters): (tenant_id: string, user_id: string) => Promise<boolean>;
+/**
+ * Approve deletion before a caller performs retryable access/mapping cleanup.
+ * The returned commit runs the existing transactional delete and post hooks;
+ * it never repeats pre hooks. If cleanup fails, the user still exists for retry.
+ */
+export declare function prepareUserDeletion(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, data: DataAdapters, tenant_id: string, user_id: string): Promise<(() => Promise<boolean>) | null>;