authhero 9.7.0 → 9.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authhero.cjs +132 -132
- package/dist/authhero.d.ts +361 -249
- package/dist/authhero.mjs +11713 -11450
- package/dist/tsconfig.types.tsbuildinfo +1 -1
- package/dist/types/authentication-flows/passwordless.d.ts +31 -8
- package/dist/types/constants.d.ts +2 -0
- package/dist/types/helpers/revoke-session-refresh-tokens.d.ts +33 -0
- package/dist/types/helpers/signing-keys.d.ts +11 -0
- package/dist/types/index.d.ts +351 -249
- package/dist/types/routes/auth-api/index.d.ts +32 -12
- package/dist/types/routes/auth-api/passwordless.d.ts +12 -12
- package/dist/types/routes/auth-api/token.d.ts +20 -0
- package/dist/types/routes/management-api/clients.d.ts +6 -6
- package/dist/types/routes/management-api/connections.d.ts +16 -16
- package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
- package/dist/types/routes/management-api/email-templates.d.ts +18 -18
- package/dist/types/routes/management-api/forms.d.ts +126 -126
- package/dist/types/routes/management-api/guardian.d.ts +5 -5
- package/dist/types/routes/management-api/helpers.d.ts +1 -1
- package/dist/types/routes/management-api/index.d.ts +312 -230
- package/dist/types/routes/management-api/keys.d.ts +92 -10
- package/dist/types/routes/management-api/logs.d.ts +4 -4
- package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
- package/dist/types/routes/management-api/organizations.d.ts +5 -5
- package/dist/types/routes/management-api/prompts.d.ts +4 -4
- package/dist/types/routes/management-api/roles.d.ts +1 -1
- package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
- package/dist/types/routes/management-api/tenants.d.ts +4 -4
- package/dist/types/routes/management-api/users.d.ts +18 -18
- package/dist/types/routes/universal-login/common.d.ts +6 -6
- package/dist/types/routes/universal-login/flow-api.d.ts +12 -12
- package/dist/types/routes/universal-login/identifier.d.ts +2 -2
- package/dist/types/routes/universal-login/index.d.ts +2 -2
- package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
- package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
- package/dist/types/state-machines/login-session.d.ts +1 -1
- package/dist/types/utils/encryption.d.ts +51 -0
- package/package.json +6 -6
|
@@ -361,7 +361,7 @@ export declare function initJSXRoute(ctx: Context<{
|
|
|
361
361
|
active?: boolean | undefined;
|
|
362
362
|
} | undefined;
|
|
363
363
|
signup?: {
|
|
364
|
-
status?: "
|
|
364
|
+
status?: "optional" | "required" | "disabled" | undefined;
|
|
365
365
|
verification?: {
|
|
366
366
|
active?: boolean | undefined;
|
|
367
367
|
} | undefined;
|
|
@@ -378,7 +378,7 @@ export declare function initJSXRoute(ctx: Context<{
|
|
|
378
378
|
active?: boolean | undefined;
|
|
379
379
|
} | undefined;
|
|
380
380
|
signup?: {
|
|
381
|
-
status?: "
|
|
381
|
+
status?: "optional" | "required" | "disabled" | undefined;
|
|
382
382
|
} | undefined;
|
|
383
383
|
validation?: {
|
|
384
384
|
max_length?: number | undefined;
|
|
@@ -395,7 +395,7 @@ export declare function initJSXRoute(ctx: Context<{
|
|
|
395
395
|
active?: boolean | undefined;
|
|
396
396
|
} | undefined;
|
|
397
397
|
signup?: {
|
|
398
|
-
status?: "
|
|
398
|
+
status?: "optional" | "required" | "disabled" | undefined;
|
|
399
399
|
} | undefined;
|
|
400
400
|
} | undefined;
|
|
401
401
|
} | undefined;
|
|
@@ -1094,7 +1094,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
|
|
|
1094
1094
|
active?: boolean | undefined;
|
|
1095
1095
|
} | undefined;
|
|
1096
1096
|
signup?: {
|
|
1097
|
-
status?: "
|
|
1097
|
+
status?: "optional" | "required" | "disabled" | undefined;
|
|
1098
1098
|
verification?: {
|
|
1099
1099
|
active?: boolean | undefined;
|
|
1100
1100
|
} | undefined;
|
|
@@ -1111,7 +1111,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
|
|
|
1111
1111
|
active?: boolean | undefined;
|
|
1112
1112
|
} | undefined;
|
|
1113
1113
|
signup?: {
|
|
1114
|
-
status?: "
|
|
1114
|
+
status?: "optional" | "required" | "disabled" | undefined;
|
|
1115
1115
|
} | undefined;
|
|
1116
1116
|
validation?: {
|
|
1117
1117
|
max_length?: number | undefined;
|
|
@@ -1128,7 +1128,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
|
|
|
1128
1128
|
active?: boolean | undefined;
|
|
1129
1129
|
} | undefined;
|
|
1130
1130
|
signup?: {
|
|
1131
|
-
status?: "
|
|
1131
|
+
status?: "optional" | "required" | "disabled" | undefined;
|
|
1132
1132
|
} | undefined;
|
|
1133
1133
|
} | undefined;
|
|
1134
1134
|
} | undefined;
|
|
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
27
27
|
output: {
|
|
28
28
|
screen: {
|
|
29
29
|
action: string;
|
|
30
|
-
method: "
|
|
30
|
+
method: "POST" | "GET";
|
|
31
31
|
components: {
|
|
32
32
|
id: string;
|
|
33
33
|
type: string;
|
|
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
43
43
|
hint?: string | undefined;
|
|
44
44
|
messages?: {
|
|
45
45
|
text: string;
|
|
46
|
-
type: "
|
|
46
|
+
type: "success" | "error" | "info" | "warning";
|
|
47
47
|
id?: number | undefined;
|
|
48
48
|
}[] | undefined;
|
|
49
49
|
}[];
|
|
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
51
51
|
description?: string | undefined;
|
|
52
52
|
messages?: {
|
|
53
53
|
text: string;
|
|
54
|
-
type: "
|
|
54
|
+
type: "success" | "error" | "info" | "warning";
|
|
55
55
|
id?: number | undefined;
|
|
56
56
|
}[] | undefined;
|
|
57
57
|
links?: {
|
|
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
107
107
|
output: {
|
|
108
108
|
screen: {
|
|
109
109
|
action: string;
|
|
110
|
-
method: "
|
|
110
|
+
method: "POST" | "GET";
|
|
111
111
|
components: {
|
|
112
112
|
id: string;
|
|
113
113
|
type: string;
|
|
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
123
123
|
hint?: string | undefined;
|
|
124
124
|
messages?: {
|
|
125
125
|
text: string;
|
|
126
|
-
type: "
|
|
126
|
+
type: "success" | "error" | "info" | "warning";
|
|
127
127
|
id?: number | undefined;
|
|
128
128
|
}[] | undefined;
|
|
129
129
|
}[];
|
|
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
131
131
|
description?: string | undefined;
|
|
132
132
|
messages?: {
|
|
133
133
|
text: string;
|
|
134
|
-
type: "
|
|
134
|
+
type: "success" | "error" | "info" | "warning";
|
|
135
135
|
id?: number | undefined;
|
|
136
136
|
}[] | undefined;
|
|
137
137
|
links?: {
|
|
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
204
204
|
output: {
|
|
205
205
|
screen: {
|
|
206
206
|
action: string;
|
|
207
|
-
method: "
|
|
207
|
+
method: "POST" | "GET";
|
|
208
208
|
components: {
|
|
209
209
|
id: string;
|
|
210
210
|
type: string;
|
|
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
220
220
|
hint?: string | undefined;
|
|
221
221
|
messages?: {
|
|
222
222
|
text: string;
|
|
223
|
-
type: "
|
|
223
|
+
type: "success" | "error" | "info" | "warning";
|
|
224
224
|
id?: number | undefined;
|
|
225
225
|
}[] | undefined;
|
|
226
226
|
}[];
|
|
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
228
228
|
description?: string | undefined;
|
|
229
229
|
messages?: {
|
|
230
230
|
text: string;
|
|
231
|
-
type: "
|
|
231
|
+
type: "success" | "error" | "info" | "warning";
|
|
232
232
|
id?: number | undefined;
|
|
233
233
|
}[] | undefined;
|
|
234
234
|
links?: {
|
|
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
319
319
|
output: {
|
|
320
320
|
screen: {
|
|
321
321
|
action: string;
|
|
322
|
-
method: "
|
|
322
|
+
method: "POST" | "GET";
|
|
323
323
|
components: {
|
|
324
324
|
id: string;
|
|
325
325
|
type: string;
|
|
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
335
335
|
hint?: string | undefined;
|
|
336
336
|
messages?: {
|
|
337
337
|
text: string;
|
|
338
|
-
type: "
|
|
338
|
+
type: "success" | "error" | "info" | "warning";
|
|
339
339
|
id?: number | undefined;
|
|
340
340
|
}[] | undefined;
|
|
341
341
|
}[];
|
|
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
|
|
|
343
343
|
description?: string | undefined;
|
|
344
344
|
messages?: {
|
|
345
345
|
text: string;
|
|
346
|
-
type: "
|
|
346
|
+
type: "success" | "error" | "info" | "warning";
|
|
347
347
|
id?: number | undefined;
|
|
348
348
|
}[] | undefined;
|
|
349
349
|
links?: {
|
|
@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
|
|
|
30
30
|
} & {
|
|
31
31
|
form: {
|
|
32
32
|
username: string;
|
|
33
|
-
login_selection?: "
|
|
33
|
+
login_selection?: "code" | "password" | undefined;
|
|
34
34
|
};
|
|
35
35
|
};
|
|
36
36
|
output: {};
|
|
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
|
|
|
44
44
|
} & {
|
|
45
45
|
form: {
|
|
46
46
|
username: string;
|
|
47
|
-
login_selection?: "
|
|
47
|
+
login_selection?: "code" | "password" | undefined;
|
|
48
48
|
};
|
|
49
49
|
};
|
|
50
50
|
output: {};
|
|
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
515
515
|
} & {
|
|
516
516
|
form: {
|
|
517
517
|
username: string;
|
|
518
|
-
login_selection?: "
|
|
518
|
+
login_selection?: "code" | "password" | undefined;
|
|
519
519
|
};
|
|
520
520
|
};
|
|
521
521
|
output: {};
|
|
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
529
529
|
} & {
|
|
530
530
|
form: {
|
|
531
531
|
username: string;
|
|
532
|
-
login_selection?: "
|
|
532
|
+
login_selection?: "code" | "password" | undefined;
|
|
533
533
|
};
|
|
534
534
|
};
|
|
535
535
|
output: {};
|
|
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
165
165
|
$get: {
|
|
166
166
|
input: {
|
|
167
167
|
param: {
|
|
168
|
-
screen: "signup" | "
|
|
168
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
169
169
|
};
|
|
170
170
|
} & {
|
|
171
171
|
query: {
|
|
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
181
181
|
} | {
|
|
182
182
|
input: {
|
|
183
183
|
param: {
|
|
184
|
-
screen: "signup" | "
|
|
184
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
185
185
|
};
|
|
186
186
|
} & {
|
|
187
187
|
query: {
|
|
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
197
197
|
} | {
|
|
198
198
|
input: {
|
|
199
199
|
param: {
|
|
200
|
-
screen: "signup" | "
|
|
200
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
201
201
|
};
|
|
202
202
|
} & {
|
|
203
203
|
query: {
|
|
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
217
217
|
$post: {
|
|
218
218
|
input: {
|
|
219
219
|
param: {
|
|
220
|
-
screen: "signup" | "
|
|
220
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
221
221
|
};
|
|
222
222
|
} & {
|
|
223
223
|
query: {
|
|
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
235
235
|
} | {
|
|
236
236
|
input: {
|
|
237
237
|
param: {
|
|
238
|
-
screen: "signup" | "
|
|
238
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
239
239
|
};
|
|
240
240
|
} & {
|
|
241
241
|
query: {
|
|
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
170
170
|
$get: {
|
|
171
171
|
input: {
|
|
172
172
|
param: {
|
|
173
|
-
screen: "signup" | "
|
|
173
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
174
174
|
};
|
|
175
175
|
} & {
|
|
176
176
|
query: {
|
|
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
186
186
|
} | {
|
|
187
187
|
input: {
|
|
188
188
|
param: {
|
|
189
|
-
screen: "signup" | "
|
|
189
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
190
190
|
};
|
|
191
191
|
} & {
|
|
192
192
|
query: {
|
|
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
202
202
|
} | {
|
|
203
203
|
input: {
|
|
204
204
|
param: {
|
|
205
|
-
screen: "signup" | "
|
|
205
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
206
206
|
};
|
|
207
207
|
} & {
|
|
208
208
|
query: {
|
|
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
222
222
|
$post: {
|
|
223
223
|
input: {
|
|
224
224
|
param: {
|
|
225
|
-
screen: "signup" | "
|
|
225
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
226
226
|
};
|
|
227
227
|
} & {
|
|
228
228
|
query: {
|
|
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
240
240
|
} | {
|
|
241
241
|
input: {
|
|
242
242
|
param: {
|
|
243
|
-
screen: "signup" | "
|
|
243
|
+
screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
244
244
|
};
|
|
245
245
|
} & {
|
|
246
246
|
query: {
|
|
@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
|
|
|
140
140
|
} | {
|
|
141
141
|
type: "setFailureReason";
|
|
142
142
|
params: import("xstate").NonReducibleUnknown;
|
|
143
|
-
}, never, never, "pending" | "failed" | "
|
|
143
|
+
}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
|
|
144
144
|
id: "loginSession";
|
|
145
145
|
states: {
|
|
146
146
|
readonly pending: {};
|
|
@@ -14,8 +14,59 @@ export interface CreateX509CertificateParams {
|
|
|
14
14
|
* backwards compatibility with existing tenants.
|
|
15
15
|
*/
|
|
16
16
|
keyType?: SigningKeyType;
|
|
17
|
+
/**
|
|
18
|
+
* How long the certificate stays valid, in days. Defaults to
|
|
19
|
+
* `DEFAULT_CERT_VALIDITY_DAYS` (one year).
|
|
20
|
+
*
|
|
21
|
+
* Relying parties that fetch JWKS re-read the key on every rotation, so a
|
|
22
|
+
* short life is cheap there. A SAML service provider, by contrast, pins the
|
|
23
|
+
* certificate out-of-band and only learns about a new one when someone
|
|
24
|
+
* emails it over — so SAML keys want years, not months.
|
|
25
|
+
*/
|
|
26
|
+
validityDays?: number;
|
|
17
27
|
}
|
|
28
|
+
/** Default certificate lifetime when a caller doesn't ask for one. */
|
|
29
|
+
export declare const DEFAULT_CERT_VALIDITY_DAYS = 365;
|
|
30
|
+
/**
|
|
31
|
+
* Upper bound on a caller-supplied lifetime. Ten years is already generous for
|
|
32
|
+
* a signing certificate; beyond that the value is far more likely to be a
|
|
33
|
+
* mistake than an intention.
|
|
34
|
+
*/
|
|
35
|
+
export declare const MAX_CERT_VALIDITY_DAYS = 3650;
|
|
18
36
|
export declare function createX509Certificate(params: CreateX509CertificateParams): Promise<SigningKey>;
|
|
37
|
+
export interface RenewX509CertificateParams {
|
|
38
|
+
/**
|
|
39
|
+
* The key's current certificate. Supplies the subject CN to carry over and
|
|
40
|
+
* the public key we assert the private key still matches.
|
|
41
|
+
*/
|
|
42
|
+
cert: string;
|
|
43
|
+
/** The key's private key, PEM-encoded (the `pkcs7` column). */
|
|
44
|
+
pkcs7: string;
|
|
45
|
+
/** Subject/issuer CN for the new certificate. Defaults to the current CN. */
|
|
46
|
+
name?: string;
|
|
47
|
+
validityDays?: number;
|
|
48
|
+
}
|
|
49
|
+
export interface RenewX509CertificateResult {
|
|
50
|
+
/** The re-issued certificate, PEM-encoded. */
|
|
51
|
+
cert: string;
|
|
52
|
+
/** SHA-1 of the new certificate's DER — changes, the cert bytes changed. */
|
|
53
|
+
thumbprint: string;
|
|
54
|
+
/** RFC 7638 thumbprint of the public key — unchanged by definition. */
|
|
55
|
+
fingerprint: string;
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* Re-issue a certificate over an existing key pair.
|
|
59
|
+
*
|
|
60
|
+
* This is renewal, not rotation: the key material is untouched, so the public
|
|
61
|
+
* key, its RFC 7638 fingerprint and therefore the `kid` all stay the same —
|
|
62
|
+
* only the validity window (and the certificate bytes carrying it) move. A
|
|
63
|
+
* SAML service provider that validates against the public key it already
|
|
64
|
+
* holds keeps working with no coordination at all; one that pinned the
|
|
65
|
+
* certificate itself still needs the new bytes, same as a full rotation.
|
|
66
|
+
*
|
|
67
|
+
* Use `createX509Certificate` when you actually want new key material.
|
|
68
|
+
*/
|
|
69
|
+
export declare function renewX509Certificate(params: RenewX509CertificateParams): Promise<RenewX509CertificateResult>;
|
|
19
70
|
export declare function convertPKCS7ToPem(keyType: "PRIVATE" | "PUBLIC", binaryData: ArrayBuffer): string;
|
|
20
71
|
export declare function toJWKS(key: CryptoKey): Promise<JsonWebKey>;
|
|
21
72
|
export declare function getJWKThumbprint(cert: x509.X509Certificate): Promise<string>;
|
package/package.json
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
"type": "git",
|
|
12
12
|
"url": "https://github.com/markusahlstrand/authhero"
|
|
13
13
|
},
|
|
14
|
-
"version": "9.
|
|
14
|
+
"version": "9.9.0",
|
|
15
15
|
"files": [
|
|
16
16
|
"dist"
|
|
17
17
|
],
|
|
@@ -63,8 +63,8 @@
|
|
|
63
63
|
"vite": "^8.0.14",
|
|
64
64
|
"vite-plugin-dts": "^4.5.4",
|
|
65
65
|
"vitest": "^4.1.7",
|
|
66
|
-
"@authhero/kysely-adapter": "12.
|
|
67
|
-
"@authhero/widget": "0.38.
|
|
66
|
+
"@authhero/kysely-adapter": "12.6.0",
|
|
67
|
+
"@authhero/widget": "0.38.5"
|
|
68
68
|
},
|
|
69
69
|
"dependencies": {
|
|
70
70
|
"@peculiar/x509": "^1.14.0",
|
|
@@ -80,9 +80,9 @@
|
|
|
80
80
|
"qrcode": "^1.5.4",
|
|
81
81
|
"sanitize-html": "^2.17.4",
|
|
82
82
|
"xstate": "^5.31.1",
|
|
83
|
-
"@authhero/adapter-interfaces": "4.
|
|
84
|
-
"@authhero/proxy": "0.10.
|
|
85
|
-
"@authhero/saml": "0.5.
|
|
83
|
+
"@authhero/adapter-interfaces": "4.10.0",
|
|
84
|
+
"@authhero/proxy": "0.10.9",
|
|
85
|
+
"@authhero/saml": "0.5.8"
|
|
86
86
|
},
|
|
87
87
|
"peerDependencies": {
|
|
88
88
|
"@authhero/widget": "^0.1.0",
|