authhero 9.6.1 → 9.6.3

package/dist/types/authentication-flows/passwordless.d.ts

@@ -554,8 +554,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "sms" | "email" | "username";
+    authConnection: "sms" | "email" | "username";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/users.d.ts

@@ -3,6 +3,18 @@ import { EnrichedClient } from "./client";
 import { Context } from "hono";
 import { Bindings, Variables } from "../types";
 export declare function getUsersByEmail(userAdapter: UserDataAdapter, tenantId: string, email: string): Promise<User[]>;
+/**
+ * Every user sharing `email`, across all pages.
+ *
+ * {@link getUsersByEmail} returns a single ten-row page, which is fine for the
+ * Auth0-shaped `/users-by-email` endpoint but not for a uniqueness check:
+ * {@link findEmailConflict} *filters* candidates by connection and cluster, so a
+ * truncated page can hide the one row that genuinely conflicts and let a
+ * duplicate through. An address legitimately spans many rows (one per provider
+ * in a linked cluster), so ten is well within reach. Mirrors the pagination loop
+ * in `resolveLinkCandidates`.
+ */
+export declare function getAllUsersByEmail(userAdapter: UserDataAdapter, tenantId: string, email: string): Promise<User[]>;
 interface GetUserByProviderParams {
     userAdapter: UserDataAdapter;
     tenant_id: string;
@@ -128,6 +140,47 @@ export declare function repointPrimary({ userAdapter, tenant_id, formerPrimary,
  * is email-identified and neither should have its `email` rewritten by a cascade.
  */
 export declare function isEmailIdentifiedUser(user: Pick<User, "provider" | "connection">): boolean;
+interface EmailConflictParams {
+    /** Every user sharing the new address, as returned by {@link getUsersByEmail}. */
+    candidates: User[];
+    /** The identity whose email is being changed. */
+    target: Pick<User, "user_id" | "provider" | "connection">;
+    /**
+     * The cluster root of the patched user. `target` may be the root itself or one
+     * of its linked secondaries (when the caller passed `connection`).
+     */
+    clusterRootId: string;
+}
+/**
+ * Find the user, if any, that genuinely blocks changing `target`'s email to an
+ * address already present on other rows.
+ *
+ * Two rows sharing an email is only a *conflict* when it makes a login ambiguous,
+ * and login lookups are always provider-scoped (`getUserByProvider` filters on
+ * `email:x provider:y`). So the check is scoped the way Auth0 scopes it — per
+ * connection — with one hard floor from the storage layer:
+ *
+ * - **Same provider** → always a conflict, cluster-mate or not. The
+ *   `(tenant_id, provider, email)` unique index makes a second row with that
+ *   address unrepresentable, so the write cannot succeed; a 409 is the honest
+ *   answer where allowing it would surface as a constraint-violation 500.
+ * - **Same connection, different provider** → a conflict *between* clusters. Two
+ *   `Username-Password-Authentication` rows (the `auth0`/`auth2` pair) sharing an
+ *   address are competing login rows for one credential. Unknown/custom
+ *   connections are included, so tenant-specific database connections keep the
+ *   protection they have today.
+ * - **Different connection** → not a conflict. An `sms` identity is keyed by
+ *   `phone_number` and a social identity by its provider sub, so their `email` is
+ *   ordinary profile data that can't shadow an email login. This mirrors the
+ *   `phone_number` carve-out on the same route (#1162) and matches Auth0, where
+ *   one address may exist across connections.
+ * - **Cluster-mates** (the root and its secondaries) → not a conflict, provider
+ *   permitting: they are the same person, and `cascadeEmailToLinkedIdentities`
+ *   deliberately converges the cluster onto one address right after this check.
+ *   Because AuthHero keeps secondaries as real rows (Auth0 folds them into the
+ *   primary's `identities[]`), they'd otherwise surface here as "another user".
+ */
+export declare function findEmailConflict({ candidates, target, clusterRootId, }: EmailConflictParams): User | undefined;
 interface CascadeEmailParams {
     userAdapter: UserDataAdapter;
     tenant_id: string;