authhero 9.6.4 → 9.7.0

package/dist/types/authentication-flows/common.d.ts

@@ -1,4 +1,4 @@
-import { AuthorizationResponseType, AuthParams, LoginSession, RefreshToken, User, TokenResponse } from "@authhero/adapter-interfaces";
+import { AuthorizationResponseType, AuthParams, LoginSession, LoginSessionAuthStrategy, RefreshToken, User, TokenResponse } from "@authhero/adapter-interfaces";
 import { EnrichedClient } from "../helpers/client";
 import { Context } from "hono";
 import { Bindings, Variables } from "../types";
@@ -82,6 +82,22 @@ export interface CreateRefreshTokenParams {
     login_id: string;
     scope: string;
     audience?: string;
+    /**
+     * The authenticated session this token is issued under — Auth0's
+     * `session_id`. Stored so revoking a session can revoke its tokens in one
+     * hop, and so the refresh grant never has to resolve it through the
+     * short-lived login session. Optional: flows without a session still mint
+     * tokens, and the column is nullable for exactly that reason.
+     */
+    session_id?: string;
+    /**
+     * Auth-event facts, denormalised from the login session. All are immutable
+     * for the life of the token; keeping them here means the grant no longer
+     * degrades silently when the login session has been cleaned up.
+     */
+    organization?: string;
+    auth_connection?: string;
+    auth_strategy?: LoginSessionAuthStrategy;
 }
 export interface CreatedRefreshToken {
     row: RefreshToken;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -372,7 +372,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "required" | "optional" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -389,7 +389,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "required" | "optional" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -406,7 +406,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "required" | "optional" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -554,8 +554,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/revoke-user-refresh-tokens.d.ts

@@ -0,0 +1,21 @@
+import { Context } from "hono";
+import { Bindings, Variables } from "../types";
+/**
+ * Soft-revoke every active refresh token belonging to a user.
+ *
+ * Unlike the single-token admin delete (which also hard-removes the row), this
+ * keeps the rows around with `revoked_at` set so the admin UI and the audit
+ * trail can still show what was invalidated and when.
+ *
+ * Delegates to the adapter so the match is a pair of exact predicates rather
+ * than a `q` filter: the Lucene grammar splits on ` OR ` before tokenizing, so
+ * a user id containing ` OR user_id:<other> OR ` would widen a `q`-based
+ * revoke to another user's tokens. The adapter also skips already-revoked
+ * rows, so a concurrent revocation cannot overwrite an existing timestamp.
+ *
+ * Returns the number of tokens revoked.
+ */
+export declare function revokeUserRefreshTokens(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenant_id: string, user_id: string): Promise<number>;