authhero 9.6.0 → 9.6.3

package/dist/types/authentication-flows/password.d.ts

@@ -37,4 +37,4 @@ export declare function changePassword(ctx: Context<{
 export declare function requestPasswordReset(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, client: EnrichedClient, email: string, state: string, verification_method?: "link" | "code", routePrefix?: string): Promise<void>;
+}>, client: EnrichedClient, emailInput: string, state: string, verification_method?: "link" | "code", routePrefix?: string): Promise<void>;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -372,7 +372,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -389,7 +389,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -406,7 +406,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -471,7 +471,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -554,8 +554,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "sms" | "email" | "username";
+    authConnection: "sms" | "email" | "username";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/users.d.ts

@@ -3,6 +3,18 @@ import { EnrichedClient } from "./client";
 import { Context } from "hono";
 import { Bindings, Variables } from "../types";
 export declare function getUsersByEmail(userAdapter: UserDataAdapter, tenantId: string, email: string): Promise<User[]>;
+/**
+ * Every user sharing `email`, across all pages.
+ *
+ * {@link getUsersByEmail} returns a single ten-row page, which is fine for the
+ * Auth0-shaped `/users-by-email` endpoint but not for a uniqueness check:
+ * {@link findEmailConflict} *filters* candidates by connection and cluster, so a
+ * truncated page can hide the one row that genuinely conflicts and let a
+ * duplicate through. An address legitimately spans many rows (one per provider
+ * in a linked cluster), so ten is well within reach. Mirrors the pagination loop
+ * in `resolveLinkCandidates`.
+ */
+export declare function getAllUsersByEmail(userAdapter: UserDataAdapter, tenantId: string, email: string): Promise<User[]>;
 interface GetUserByProviderParams {
     userAdapter: UserDataAdapter;
     tenant_id: string;
@@ -128,6 +140,47 @@ export declare function repointPrimary({ userAdapter, tenant_id, formerPrimary,
  * is email-identified and neither should have its `email` rewritten by a cascade.
  */
 export declare function isEmailIdentifiedUser(user: Pick<User, "provider" | "connection">): boolean;
+interface EmailConflictParams {
+    /** Every user sharing the new address, as returned by {@link getUsersByEmail}. */
+    candidates: User[];
+    /** The identity whose email is being changed. */
+    target: Pick<User, "user_id" | "provider" | "connection">;
+    /**
+     * The cluster root of the patched user. `target` may be the root itself or one
+     * of its linked secondaries (when the caller passed `connection`).
+     */
+    clusterRootId: string;
+}
+/**
+ * Find the user, if any, that genuinely blocks changing `target`'s email to an
+ * address already present on other rows.
+ *
+ * Two rows sharing an email is only a *conflict* when it makes a login ambiguous,
+ * and login lookups are always provider-scoped (`getUserByProvider` filters on
+ * `email:x provider:y`). So the check is scoped the way Auth0 scopes it — per
+ * connection — with one hard floor from the storage layer:
+ *
+ * - **Same provider** → always a conflict, cluster-mate or not. The
+ *   `(tenant_id, provider, email)` unique index makes a second row with that
+ *   address unrepresentable, so the write cannot succeed; a 409 is the honest
+ *   answer where allowing it would surface as a constraint-violation 500.
+ * - **Same connection, different provider** → a conflict *between* clusters. Two
+ *   `Username-Password-Authentication` rows (the `auth0`/`auth2` pair) sharing an
+ *   address are competing login rows for one credential. Unknown/custom
+ *   connections are included, so tenant-specific database connections keep the
+ *   protection they have today.
+ * - **Different connection** → not a conflict. An `sms` identity is keyed by
+ *   `phone_number` and a social identity by its provider sub, so their `email` is
+ *   ordinary profile data that can't shadow an email login. This mirrors the
+ *   `phone_number` carve-out on the same route (#1162) and matches Auth0, where
+ *   one address may exist across connections.
+ * - **Cluster-mates** (the root and its secondaries) → not a conflict, provider
+ *   permitting: they are the same person, and `cascadeEmailToLinkedIdentities`
+ *   deliberately converges the cluster onto one address right after this check.
+ *   Because AuthHero keeps secondaries as real rows (Auth0 folds them into the
+ *   primary's `identities[]`), they'd otherwise surface here as "another user".
+ */
+export declare function findEmailConflict({ candidates, target, clusterRootId, }: EmailConflictParams): User | undefined;
 interface CascadeEmailParams {
     userAdapter: UserDataAdapter;
     tenant_id: string;

package/dist/types/hooks/addDataHooks.d.ts

@@ -9,6 +9,12 @@ import { Bindings, Variables } from "../types";
  * that run pre/post hooks, apply the narrow transactional commits, and
  * dispatch post-event outbox messages. `users.rawCreate` is NOT decorated —
  * commit paths call it directly to bypass the hook layer by design.
+ *
+ * `email` is lowercased on the way in so the pre-commit hooks and lookups
+ * (`preUserSignupHook`, the email→primary linking query) see the same
+ * normalized value that will be stored. Hooks can assign `email` themselves
+ * after this point, so the decorators normalize again just before their
+ * commit — see `createUserHooks` / `createUserUpdateHooks`.
  */
 export declare function addDataHooks(ctx: Context<{
     Bindings: Bindings;