authhero 9.8.0 → 9.9.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -1,10 +1,13 @@
 import { Context } from "hono";
 import { z } from "@hono/zod-openapi";
 import { Bindings, Variables } from "../types";
+import { GrantFlowUserResult } from "../types/GrantFlowResult";
 export declare const passwordlessGrantParamsSchema: z.ZodObject<{
     client_id: z.ZodString;
     username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     otp: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
     authParams: z.ZodOptional<z.ZodObject<{
         client_id: z.ZodString;
         act_as: z.ZodOptional<z.ZodString>;
@@ -42,7 +45,7 @@ export declare const passwordlessGrantParamsSchema: z.ZodObject<{
 export declare function passwordlessGrantUser(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, { client_id, username, otp, authParams, enforceIpCheck, }: z.input<typeof passwordlessGrantParamsSchema>): Promise<{
+}>, { client_id, username, otp, scope, audience, authParams, enforceIpCheck, }: z.input<typeof passwordlessGrantParamsSchema>): Promise<{
     user: {
         connection: string;
         email_verified: boolean;
@@ -558,16 +561,16 @@ export declare function passwordlessGrantUser(ctx: Context<{
     authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
+        audience?: string | undefined;
+        scope?: string | undefined;
         client_id: string;
         act_as?: string | undefined;
         response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
         redirect_uri?: string | undefined;
-        audience?: string | undefined;
         organization?: string | undefined;
         state?: string | undefined;
         nonce?: string | undefined;
-        scope?: string | undefined;
         prompt?: string | undefined;
         code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
         code_challenge?: string | undefined;
@@ -590,6 +593,26 @@ export declare function passwordlessGrantUser(ctx: Context<{
         vendor_id?: string | undefined;
     };
 }>;
+/**
+ * The `http://auth0.com/oauth/grant-type/passwordless/otp` grant at
+ * /oauth/token.
+ *
+ * Unlike the authorization-code exchange — where /authorize has already
+ * authenticated the login session and created a session — nothing has run for
+ * this login yet: /passwordless/start only stores a PENDING login session and
+ * an OTP. So authenticate it here, which creates the session the auth cookie
+ * and the refresh token below both hang off, then mint a refresh token when
+ * `offline_access` was requested (issue #1273).
+ *
+ * The sibling front-channel path (`passwordlessGrant`, used by
+ * /co/authenticate) does not go through here: createFrontChannelAuthResponse
+ * does both steps itself, and skips the refresh token for code flows so the
+ * exchange issues it instead.
+ */
+export declare function passwordlessOtpGrant(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: z.input<typeof passwordlessGrantParamsSchema>): Promise<GrantFlowUserResult>;
 export declare function passwordlessGrant(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/helpers/revoke-session-refresh-tokens.d.ts

@@ -0,0 +1,33 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+/**
+ * The parts of a session this cascade needs: its own id, which refresh tokens
+ * point at through `session_id`, and the login session it originated from,
+ * which is the only link rows minted before that column existed carry.
+ */
+export interface RevocableSession {
+    id: string;
+    login_session_id?: string;
+}
+/**
+ * Revoke every refresh token issued under a session.
+ *
+ * Call this only where a session is *deliberately* ended — an admin revoking
+ * or deleting it, or a user being blocked. Natural expiry and cleanup must not
+ * cascade: a refresh token is designed to outlive its session, and killing
+ * tokens on an SSO timeout would log out every long-lived native client on
+ * each timeout. Revocation couples; lifetime does not.
+ *
+ * Two sweeps, run in sequence:
+ *
+ * 1. `session_id` — the ownership edge, and the one that is actually complete.
+ * 2. `login_id` — legacy fallback for rows minted before `session_id` existed.
+ *    `sessions.login_session_id` records only the session's *originating*
+ *    authorization transaction and is never repointed on SSO reuse, so on its
+ *    own it misses every token minted during a later re-authorization. It is
+ *    retained until pre-Stage-2 rows have aged out (#1259) and then dropped.
+ *
+ * Sequential rather than parallel because a row can match both predicates, and
+ * both adapters guard on `revoked_at IS NULL` — so the second sweep skips what
+ * the first already revoked instead of double-counting it.
+ */
+export declare function revokeSessionRefreshTokens(data: DataAdapters, tenant_id: string, session: RevocableSession, revoked_at: string): Promise<number>;