authhero 9.6.4 → 9.8.0

package/dist/types/authentication-flows/common.d.ts

@@ -1,4 +1,4 @@
-import { AuthorizationResponseType, AuthParams, LoginSession, RefreshToken, User, TokenResponse } from "@authhero/adapter-interfaces";
+import { AuthorizationResponseType, AuthParams, LoginSession, LoginSessionAuthStrategy, RefreshToken, User, TokenResponse } from "@authhero/adapter-interfaces";
 import { EnrichedClient } from "../helpers/client";
 import { Context } from "hono";
 import { Bindings, Variables } from "../types";
@@ -82,6 +82,22 @@ export interface CreateRefreshTokenParams {
     login_id: string;
     scope: string;
     audience?: string;
+    /**
+     * The authenticated session this token is issued under — Auth0's
+     * `session_id`. Stored so revoking a session can revoke its tokens in one
+     * hop, and so the refresh grant never has to resolve it through the
+     * short-lived login session. Optional: flows without a session still mint
+     * tokens, and the column is nullable for exactly that reason.
+     */
+    session_id?: string;
+    /**
+     * Auth-event facts, denormalised from the login session. All are immutable
+     * for the life of the token; keeping them here means the grant no longer
+     * degrades silently when the login session has been cleaned up.
+     */
+    organization?: string;
+    auth_connection?: string;
+    auth_strategy?: LoginSessionAuthStrategy;
 }
 export interface CreatedRefreshToken {
     row: RefreshToken;

package/dist/types/constants.d.ts

@@ -1,4 +1,6 @@
 export declare const USERNAME_PASSWORD_PROVIDER = "auth0";
+export declare const JWT_CERT_VALIDITY_DAYS = 365;
+export declare const SAML_CERT_VALIDITY_DAYS: number;
 export declare const JWKS_CACHE_TIMEOUT_IN_SECONDS: number;
 export declare const SILENT_AUTH_MAX_AGE_IN_SECONDS: number;
 export declare const UNIVERSAL_AUTH_SESSION_EXPIRES_IN_SECONDS: number;

package/dist/types/helpers/revoke-user-refresh-tokens.d.ts

@@ -0,0 +1,21 @@
+import { Context } from "hono";
+import { Bindings, Variables } from "../types";
+/**
+ * Soft-revoke every active refresh token belonging to a user.
+ *
+ * Unlike the single-token admin delete (which also hard-removes the row), this
+ * keeps the rows around with `revoked_at` set so the admin UI and the audit
+ * trail can still show what was invalidated and when.
+ *
+ * Delegates to the adapter so the match is a pair of exact predicates rather
+ * than a `q` filter: the Lucene grammar splits on ` OR ` before tokenizing, so
+ * a user id containing ` OR user_id:<other> OR ` would widen a `q`-based
+ * revoke to another user's tokens. The adapter also skips already-revoked
+ * rows, so a concurrent revocation cannot overwrite an existing timestamp.
+ *
+ * Returns the number of tokens revoked.
+ */
+export declare function revokeUserRefreshTokens(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenant_id: string, user_id: string): Promise<number>;

package/dist/types/helpers/signing-keys.d.ts

@@ -17,6 +17,17 @@ export interface ResolveSigningKeysOptions {
 export declare function resolveSigningKeys(keys: KeysAdapter, tenantId: string, modeOption: SigningKeyModeOption | undefined, opts: ResolveSigningKeysOptions): Promise<SigningKey[]>;
 /** A key is signable only if it carries private material, not just a cert. */
 export declare function isSignable(key: SigningKey): boolean;
+/**
+ * A key with `current_since` in the future is *staged*: published so relying
+ * parties can pre-trust it, but not yet signing anything.
+ *
+ * This is what makes a zero-downtime rotation possible for a SAML service
+ * provider that pins the certificate out-of-band. The new certificate appears
+ * in the IdP metadata immediately, the operator gets it to the service
+ * provider, and only then does it start signing — the reverse order breaks
+ * every login in between.
+ */
+export declare function isStaged(key: SigningKey, now?: Date): boolean;
 export interface EnsureSigningKeyOptions {
     /**
      * When set, the key is created tenant-scoped (`tenant_id` stamped) and the