authhero 9.6.4 → 9.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +138 -138
  3. package/dist/authhero.d.ts +499 -187
  4. package/dist/authhero.mjs +14867 -14543
  5. package/dist/tsconfig.types.tsbuildinfo +1 -1
  6. package/dist/types/authentication-flows/common.d.ts +17 -1
  7. package/dist/types/constants.d.ts +2 -0
  8. package/dist/types/helpers/revoke-user-refresh-tokens.d.ts +21 -0
  9. package/dist/types/helpers/signing-keys.d.ts +11 -0
  10. package/dist/types/index.d.ts +489 -187
  11. package/dist/types/routes/auth-api/index.d.ts +21 -21
  12. package/dist/types/routes/auth-api/passwordless.d.ts +14 -14
  13. package/dist/types/routes/auth-api/revoke.d.ts +6 -6
  14. package/dist/types/routes/auth-api/well-known.d.ts +1 -1
  15. package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
  16. package/dist/types/routes/management-api/connections.d.ts +1 -1
  17. package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
  18. package/dist/types/routes/management-api/forms.d.ts +126 -126
  19. package/dist/types/routes/management-api/index.d.ts +463 -161
  20. package/dist/types/routes/management-api/keys.d.ts +86 -4
  21. package/dist/types/routes/management-api/logs.d.ts +4 -4
  22. package/dist/types/routes/management-api/organizations.d.ts +7 -7
  23. package/dist/types/routes/management-api/prompts.d.ts +4 -4
  24. package/dist/types/routes/management-api/refresh_tokens.d.ts +7 -0
  25. package/dist/types/routes/management-api/roles.d.ts +1 -1
  26. package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
  27. package/dist/types/routes/management-api/tenants.d.ts +4 -4
  28. package/dist/types/routes/management-api/users.d.ts +148 -2
  29. package/dist/types/routes/universal-login/flow-api.d.ts +8 -8
  30. package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
  31. package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
  32. package/dist/types/utils/encryption.d.ts +51 -0
  33. package/dist/types/utils/jwks.d.ts +2 -2
  34. package/dist/types/utils/user-id.d.ts +19 -1
  35. package/package.json +6 -6
package/dist/types/routes/universal-login/flow-api.d.ts CHANGED
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
43
43
  hint?: string | undefined;
44
44
  messages?: {
45
45
  text: string;
46
- type: "error" | "success" | "info" | "warning";
46
+ type: "success" | "error" | "info" | "warning";
47
47
  id?: number | undefined;
48
48
  }[] | undefined;
49
49
  }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
51
51
  description?: string | undefined;
52
52
  messages?: {
53
53
  text: string;
54
- type: "error" | "success" | "info" | "warning";
54
+ type: "success" | "error" | "info" | "warning";
55
55
  id?: number | undefined;
56
56
  }[] | undefined;
57
57
  links?: {
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
123
123
  hint?: string | undefined;
124
124
  messages?: {
125
125
  text: string;
126
- type: "error" | "success" | "info" | "warning";
126
+ type: "success" | "error" | "info" | "warning";
127
127
  id?: number | undefined;
128
128
  }[] | undefined;
129
129
  }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
131
131
  description?: string | undefined;
132
132
  messages?: {
133
133
  text: string;
134
- type: "error" | "success" | "info" | "warning";
134
+ type: "success" | "error" | "info" | "warning";
135
135
  id?: number | undefined;
136
136
  }[] | undefined;
137
137
  links?: {
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
220
220
  hint?: string | undefined;
221
221
  messages?: {
222
222
  text: string;
223
- type: "error" | "success" | "info" | "warning";
223
+ type: "success" | "error" | "info" | "warning";
224
224
  id?: number | undefined;
225
225
  }[] | undefined;
226
226
  }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
228
228
  description?: string | undefined;
229
229
  messages?: {
230
230
  text: string;
231
- type: "error" | "success" | "info" | "warning";
231
+ type: "success" | "error" | "info" | "warning";
232
232
  id?: number | undefined;
233
233
  }[] | undefined;
234
234
  links?: {
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
335
335
  hint?: string | undefined;
336
336
  messages?: {
337
337
  text: string;
338
- type: "error" | "success" | "info" | "warning";
338
+ type: "success" | "error" | "info" | "warning";
339
339
  id?: number | undefined;
340
340
  }[] | undefined;
341
341
  }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
343
343
  description?: string | undefined;
344
344
  messages?: {
345
345
  text: string;
346
- type: "error" | "success" | "info" | "warning";
346
+ type: "success" | "error" | "info" | "warning";
347
347
  id?: number | undefined;
348
348
  }[] | undefined;
349
349
  links?: {
package/dist/types/routes/universal-login/u2-index.d.ts CHANGED
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
165
165
  $get: {
166
166
  input: {
167
167
  param: {
168
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
168
+ screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
169
169
  };
170
170
  } & {
171
171
  query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
181
181
  } | {
182
182
  input: {
183
183
  param: {
184
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
184
+ screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
185
185
  };
186
186
  } & {
187
187
  query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
197
197
  } | {
198
198
  input: {
199
199
  param: {
200
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
200
+ screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
201
201
  };
202
202
  } & {
203
203
  query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
217
217
  $post: {
218
218
  input: {
219
219
  param: {
220
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
220
+ screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
221
221
  };
222
222
  } & {
223
223
  query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
235
235
  } | {
236
236
  input: {
237
237
  param: {
238
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
238
+ screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
239
239
  };
240
240
  } & {
241
241
  query: {
package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
package/dist/types/utils/encryption.d.ts CHANGED
@@ -14,8 +14,59 @@ export interface CreateX509CertificateParams {
14
14
  * backwards compatibility with existing tenants.
15
15
  */
16
16
  keyType?: SigningKeyType;
17
+ /**
18
+ * How long the certificate stays valid, in days. Defaults to
19
+ * `DEFAULT_CERT_VALIDITY_DAYS` (one year).
20
+ *
21
+ * Relying parties that fetch JWKS re-read the key on every rotation, so a
22
+ * short life is cheap there. A SAML service provider, by contrast, pins the
23
+ * certificate out-of-band and only learns about a new one when someone
24
+ * emails it over — so SAML keys want years, not months.
25
+ */
26
+ validityDays?: number;
17
27
  }
28
+ /** Default certificate lifetime when a caller doesn't ask for one. */
29
+ export declare const DEFAULT_CERT_VALIDITY_DAYS = 365;
30
+ /**
31
+ * Upper bound on a caller-supplied lifetime. Ten years is already generous for
32
+ * a signing certificate; beyond that the value is far more likely to be a
33
+ * mistake than an intention.
34
+ */
35
+ export declare const MAX_CERT_VALIDITY_DAYS = 3650;
18
36
  export declare function createX509Certificate(params: CreateX509CertificateParams): Promise<SigningKey>;
37
+ export interface RenewX509CertificateParams {
38
+ /**
39
+ * The key's current certificate. Supplies the subject CN to carry over and
40
+ * the public key we assert the private key still matches.
41
+ */
42
+ cert: string;
43
+ /** The key's private key, PEM-encoded (the `pkcs7` column). */
44
+ pkcs7: string;
45
+ /** Subject/issuer CN for the new certificate. Defaults to the current CN. */
46
+ name?: string;
47
+ validityDays?: number;
48
+ }
49
+ export interface RenewX509CertificateResult {
50
+ /** The re-issued certificate, PEM-encoded. */
51
+ cert: string;
52
+ /** SHA-1 of the new certificate's DER — changes, the cert bytes changed. */
53
+ thumbprint: string;
54
+ /** RFC 7638 thumbprint of the public key — unchanged by definition. */
55
+ fingerprint: string;
56
+ }
57
+ /**
58
+ * Re-issue a certificate over an existing key pair.
59
+ *
60
+ * This is renewal, not rotation: the key material is untouched, so the public
61
+ * key, its RFC 7638 fingerprint and therefore the `kid` all stay the same —
62
+ * only the validity window (and the certificate bytes carrying it) move. A
63
+ * SAML service provider that validates against the public key it already
64
+ * holds keeps working with no coordination at all; one that pinned the
65
+ * certificate itself still needs the new bytes, same as a full rotation.
66
+ *
67
+ * Use `createX509Certificate` when you actually want new key material.
68
+ */
69
+ export declare function renewX509Certificate(params: RenewX509CertificateParams): Promise<RenewX509CertificateResult>;
19
70
  export declare function convertPKCS7ToPem(keyType: "PRIVATE" | "PUBLIC", binaryData: ArrayBuffer): string;
20
71
  export declare function toJWKS(key: CryptoKey): Promise<JsonWebKey>;
21
72
  export declare function getJWKThumbprint(cert: x509.X509Certificate): Promise<string>;
package/dist/types/utils/jwks.d.ts CHANGED
@@ -8,7 +8,7 @@ import { SigningKeyModeOption } from "../types/AuthHeroConfig";
8
8
  */
9
9
  export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
10
10
  alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
11
- kty: "EC" | "RSA" | "oct";
11
+ kty: "RSA" | "EC" | "oct";
12
12
  kid?: string | undefined;
13
13
  use?: "sig" | "enc" | undefined;
14
14
  n?: string | undefined;
@@ -27,7 +27,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
27
27
  */
28
28
  export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
29
29
  alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
30
- kty: "EC" | "RSA" | "oct";
30
+ kty: "RSA" | "EC" | "oct";
31
31
  kid?: string | undefined;
32
32
  use?: "sig" | "enc" | undefined;
33
33
  n?: string | undefined;
package/dist/types/utils/user-id.d.ts CHANGED
@@ -1,2 +1,20 @@
1
1
  export declare function userIdGenerate(): string;
2
- export declare function userIdParse(userId: string): string | undefined;
2
+ /**
3
+ * The bare id inside an Auth0-style `provider|id` identifier — everything after
4
+ * the *first* pipe, which is how Auth0 reports `identities[].user_id`.
5
+ *
6
+ * Splits on the first pipe only: enterprise identifiers embed pipes of their
7
+ * own (`samlp|okta-connection|jane` is provider `samlp` plus bare id
8
+ * `okta-connection|jane`), and returning just `okta-connection` would report an
9
+ * id that resolves to no user.
10
+ */
11
+ export declare function userIdParse(userId: string): string;
12
+ /**
13
+ * Drop a leading `provider|` from a user_id, leaving anything else untouched.
14
+ *
15
+ * Callers that accept both shapes of the same identifier (Auth0's account-link
16
+ * body takes the bare id; some clients send the whole thing) need to normalize
17
+ * without guessing: unlike {@link userIdParse} this only removes the one prefix
18
+ * it is told about, so a bare id that happens to contain a pipe survives.
19
+ */
20
+ export declare function stripProviderPrefix(userId: string, provider: string): string;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/markusahlstrand/authhero"
13
13
  },
14
- "version": "9.6.4",
14
+ "version": "9.8.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/kysely-adapter": "12.4.2",
67
- "@authhero/widget": "0.38.3"
66
+ "@authhero/widget": "0.38.4",
67
+ "@authhero/kysely-adapter": "12.5.0"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.0",
@@ -80,9 +80,9 @@
80
80
  "qrcode": "^1.5.4",
81
81
  "sanitize-html": "^2.17.4",
82
82
  "xstate": "^5.31.1",
83
- "@authhero/adapter-interfaces": "4.8.1",
84
- "@authhero/proxy": "0.10.7",
85
- "@authhero/saml": "0.5.6"
83
+ "@authhero/adapter-interfaces": "4.9.0",
84
+ "@authhero/proxy": "0.10.8",
85
+ "@authhero/saml": "0.5.7"
86
86
  },
87
87
  "peerDependencies": {
88
88
  "@authhero/widget": "^0.1.0",