authhero 9.7.0 → 9.9.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -1,10 +1,13 @@
 import { Context } from "hono";
 import { z } from "@hono/zod-openapi";
 import { Bindings, Variables } from "../types";
+import { GrantFlowUserResult } from "../types/GrantFlowResult";
 export declare const passwordlessGrantParamsSchema: z.ZodObject<{
     client_id: z.ZodString;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     otp: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
     authParams: z.ZodOptional<z.ZodObject<{
         client_id: z.ZodString;
         act_as: z.ZodOptional<z.ZodString>;
@@ -42,7 +45,7 @@ export declare const passwordlessGrantParamsSchema: z.ZodObject<{
 export declare function passwordlessGrantUser(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, { client_id, username, otp, authParams, enforceIpCheck, }: z.input<typeof passwordlessGrantParamsSchema>): Promise<{
+}>, { client_id, username, otp, scope, audience, authParams, enforceIpCheck, }: z.input<typeof passwordlessGrantParamsSchema>): Promise<{
     user: {
         connection: string;
         email_verified: boolean;
@@ -372,7 +375,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -389,7 +392,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -406,7 +409,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -554,20 +557,20 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "email" | "username" | "sms";
-    authConnection: "email" | "username" | "sms";
+    connectionType: "username" | "email" | "sms";
+    authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
+        audience?: string | undefined;
+        scope?: string | undefined;
         client_id: string;
         act_as?: string | undefined;
         response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
         redirect_uri?: string | undefined;
-        audience?: string | undefined;
         organization?: string | undefined;
         state?: string | undefined;
         nonce?: string | undefined;
-        scope?: string | undefined;
         prompt?: string | undefined;
         code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
         code_challenge?: string | undefined;
@@ -590,6 +593,26 @@ export declare function passwordlessGrantUser(ctx: Context<{
         vendor_id?: string | undefined;
     };
 }>;
+/**
+ * The `http://auth0.com/oauth/grant-type/passwordless/otp` grant at
+ * /oauth/token.
+ *
+ * Unlike the authorization-code exchange — where /authorize has already
+ * authenticated the login session and created a session — nothing has run for
+ * this login yet: /passwordless/start only stores a PENDING login session and
+ * an OTP. So authenticate it here, which creates the session the auth cookie
+ * and the refresh token below both hang off, then mint a refresh token when
+ * `offline_access` was requested (issue #1273).
+ *
+ * The sibling front-channel path (`passwordlessGrant`, used by
+ * /co/authenticate) does not go through here: createFrontChannelAuthResponse
+ * does both steps itself, and skips the refresh token for code flows so the
+ * exchange issues it instead.
+ */
+export declare function passwordlessOtpGrant(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: z.input<typeof passwordlessGrantParamsSchema>): Promise<GrantFlowUserResult>;
 export declare function passwordlessGrant(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/constants.d.ts

@@ -1,4 +1,6 @@
 export declare const USERNAME_PASSWORD_PROVIDER = "auth0";
+export declare const JWT_CERT_VALIDITY_DAYS = 365;
+export declare const SAML_CERT_VALIDITY_DAYS: number;
 export declare const JWKS_CACHE_TIMEOUT_IN_SECONDS: number;
 export declare const SILENT_AUTH_MAX_AGE_IN_SECONDS: number;
 export declare const UNIVERSAL_AUTH_SESSION_EXPIRES_IN_SECONDS: number;

package/dist/types/helpers/revoke-session-refresh-tokens.d.ts

@@ -0,0 +1,33 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+/**
+ * The parts of a session this cascade needs: its own id, which refresh tokens
+ * point at through `session_id`, and the login session it originated from,
+ * which is the only link rows minted before that column existed carry.
+ */
+export interface RevocableSession {
+    id: string;
+    login_session_id?: string;
+}
+/**
+ * Revoke every refresh token issued under a session.
+ *
+ * Call this only where a session is *deliberately* ended — an admin revoking
+ * or deleting it, or a user being blocked. Natural expiry and cleanup must not
+ * cascade: a refresh token is designed to outlive its session, and killing
+ * tokens on an SSO timeout would log out every long-lived native client on
+ * each timeout. Revocation couples; lifetime does not.
+ *
+ * Two sweeps, run in sequence:
+ *
+ * 1. `session_id` — the ownership edge, and the one that is actually complete.
+ * 2. `login_id` — legacy fallback for rows minted before `session_id` existed.
+ *    `sessions.login_session_id` records only the session's *originating*
+ *    authorization transaction and is never repointed on SSO reuse, so on its
+ *    own it misses every token minted during a later re-authorization. It is
+ *    retained until pre-Stage-2 rows have aged out (#1259) and then dropped.
+ *
+ * Sequential rather than parallel because a row can match both predicates, and
+ * both adapters guard on `revoked_at IS NULL` — so the second sweep skips what
+ * the first already revoked instead of double-counting it.
+ */
+export declare function revokeSessionRefreshTokens(data: DataAdapters, tenant_id: string, session: RevocableSession, revoked_at: string): Promise<number>;

package/dist/types/helpers/signing-keys.d.ts

@@ -17,6 +17,17 @@ export interface ResolveSigningKeysOptions {
 export declare function resolveSigningKeys(keys: KeysAdapter, tenantId: string, modeOption: SigningKeyModeOption | undefined, opts: ResolveSigningKeysOptions): Promise<SigningKey[]>;
 /** A key is signable only if it carries private material, not just a cert. */
 export declare function isSignable(key: SigningKey): boolean;
+/**
+ * A key with `current_since` in the future is *staged*: published so relying
+ * parties can pre-trust it, but not yet signing anything.
+ *
+ * This is what makes a zero-downtime rotation possible for a SAML service
+ * provider that pins the certificate out-of-band. The new certificate appears
+ * in the IdP metadata immediately, the operator gets it to the service
+ * provider, and only then does it start signing — the reverse order breaks
+ * every login in between.
+ */
+export declare function isStaged(key: SigningKey, now?: Date): boolean;
 export interface EnsureSigningKeyOptions {
     /**
      * When set, the key is created tenant-scoped (`tenant_id` stamped) and the