authhero 9.8.0 → 9.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (36) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +543 -344
  3. package/dist/authhero.d.ts +158 -138
  4. package/dist/authhero.mjs +12631 -12103
  5. package/dist/tsconfig.types.tsbuildinfo +1 -1
  6. package/dist/types/authentication-flows/grant-tokens.d.ts +16 -0
  7. package/dist/types/authentication-flows/passwordless.d.ts +26 -3
  8. package/dist/types/helpers/refresh-token-lifetime.d.ts +103 -0
  9. package/dist/types/helpers/revoke-session-refresh-tokens.d.ts +33 -0
  10. package/dist/types/hooks/addDataHooks.d.ts +4 -3
  11. package/dist/types/index.d.ts +158 -138
  12. package/dist/types/routes/auth-api/index.d.ts +59 -39
  13. package/dist/types/routes/auth-api/passwordless.d.ts +6 -6
  14. package/dist/types/routes/auth-api/revoke.d.ts +6 -6
  15. package/dist/types/routes/auth-api/token.d.ts +44 -24
  16. package/dist/types/routes/auth-api/well-known.d.ts +1 -1
  17. package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
  18. package/dist/types/routes/management-api/failed-events.d.ts +1 -1
  19. package/dist/types/routes/management-api/forms.d.ts +126 -126
  20. package/dist/types/routes/management-api/index.d.ts +69 -69
  21. package/dist/types/routes/management-api/keys.d.ts +16 -16
  22. package/dist/types/routes/management-api/logs.d.ts +4 -4
  23. package/dist/types/routes/management-api/organizations.d.ts +2 -2
  24. package/dist/types/routes/management-api/prompts.d.ts +4 -4
  25. package/dist/types/routes/management-api/roles.d.ts +1 -1
  26. package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
  27. package/dist/types/routes/management-api/tenants.d.ts +2 -2
  28. package/dist/types/routes/management-api/users.d.ts +17 -17
  29. package/dist/types/routes/universal-login/info-code-exchange.d.ts +27 -0
  30. package/dist/types/routes/universal-login/token-info-page.d.ts +26 -0
  31. package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
  32. package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
  33. package/dist/types/state-machines/login-session.d.ts +1 -1
  34. package/dist/types/utils/email.d.ts +21 -9
  35. package/dist/types/utils/jwks.d.ts +2 -2
  36. package/package.json +8 -8
package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
package/dist/types/state-machines/login-session.d.ts CHANGED
@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
140
140
  } | {
141
141
  type: "setFailureReason";
142
142
  params: import("xstate").NonReducibleUnknown;
143
- }, never, never, "pending" | "failed" | "authenticated" | "expired" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
143
+ }, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
144
144
  id: "loginSession";
145
145
  states: {
146
146
  readonly pending: {};
package/dist/types/utils/email.d.ts CHANGED
@@ -1,16 +1,28 @@
1
1
  export declare const EMAIL_REGEX: RegExp;
2
2
  export declare function isValidEmail(value: string): boolean;
3
3
  /**
4
- * Return `payload` with `email` lowercased, or unchanged when there is nothing
5
- * to normalize.
4
+ * Canonical form of an email identifier: surrounding whitespace stripped, then
5
+ * lowercased.
6
6
  *
7
- * Emails are case-insensitive identifiers: every lookup (identifier-first
8
- * login, `getPrimaryUserByEmail`, email-based auto-linking) lowercases its
9
- * input, so a mixed-case stored email is unreachable and spawns duplicate
10
- * accounts. The zod request-schema transform only covers validated bodies —
11
- * emails sourced upstream (SCIM provisioning, Auth0 lazy migration, IdP
12
- * profiles) and emails assigned by lifecycle hooks never pass through it.
7
+ * Both halves matter. Emails are case-insensitive identifiers, so a mixed-case
8
+ * stored address is unreachable from a lowercasing lookup. Whitespace is worse:
9
+ * `"user@example.com "` is stored verbatim, passes every uniqueness check
10
+ * against its trimmed twin, and produces a second account for the same person
11
+ * on the same connection (issue #1279). Every read and write path must agree on
12
+ * this single definition or the two halves diverge again.
13
13
  */
14
- export declare function withLowercasedEmail<T extends {
14
+ export declare function normalizeEmail(email: string): string;
15
+ /**
16
+ * Return `payload` with `email` normalized via {@link normalizeEmail}, or
17
+ * unchanged when there is nothing to normalize.
18
+ *
19
+ * This is the write-path chokepoint: every lookup (identifier-first login,
20
+ * `getPrimaryUserByEmail`, email-based auto-linking) normalizes its input, so
21
+ * an un-normalized stored email is unreachable and spawns duplicate accounts.
22
+ * The zod request-schema transform only covers validated bodies — emails
23
+ * sourced upstream (SCIM provisioning, Auth0 lazy migration, IdP profiles) and
24
+ * emails assigned by lifecycle hooks never pass through it.
25
+ */
26
+ export declare function withNormalizedEmail<T extends {
15
27
  email?: string;
16
28
  }>(payload: T): T;
package/dist/types/utils/jwks.d.ts CHANGED
@@ -8,7 +8,7 @@ import { SigningKeyModeOption } from "../types/AuthHeroConfig";
8
8
  */
9
9
  export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
10
10
  alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
11
- kty: "RSA" | "EC" | "oct";
11
+ kty: "EC" | "RSA" | "oct";
12
12
  kid?: string | undefined;
13
13
  use?: "sig" | "enc" | undefined;
14
14
  n?: string | undefined;
@@ -27,7 +27,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
27
27
  */
28
28
  export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
29
29
  alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
30
- kty: "RSA" | "EC" | "oct";
30
+ kty: "EC" | "RSA" | "oct";
31
31
  kid?: string | undefined;
32
32
  use?: "sig" | "enc" | undefined;
33
33
  n?: string | undefined;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/markusahlstrand/authhero"
13
13
  },
14
- "version": "9.8.0",
14
+ "version": "9.9.1",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -33,8 +33,7 @@
33
33
  "@ape-egg/tailwind-rows-columns": "^1.0.2",
34
34
  "@hono/node-server": "^1.19.14",
35
35
  "@hono/zod-openapi": "^1.4.0",
36
- "@react-email/components": "^1.0.12",
37
- "@react-email/render": "^2.0.6",
36
+ "@react-email/render": "^2.1.0",
38
37
  "@storybook/react": "^10.4.1",
39
38
  "@storybook/react-vite": "^10.4.1",
40
39
  "@types/node": "^24.12.4",
@@ -53,6 +52,7 @@
53
52
  "postcss": "8.5.15",
54
53
  "react": "^19.2.6",
55
54
  "react-dom": "^19.2.6",
55
+ "react-email": "^6.9.3",
56
56
  "rollup": "^4.54.0",
57
57
  "rollup-plugin-dts": "^6.4.1",
58
58
  "rollup-plugin-visualizer": "^6.0.5",
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/widget": "0.38.4",
67
- "@authhero/kysely-adapter": "12.5.0"
66
+ "@authhero/kysely-adapter": "12.6.1",
67
+ "@authhero/widget": "0.38.6"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.0",
@@ -80,9 +80,9 @@
80
80
  "qrcode": "^1.5.4",
81
81
  "sanitize-html": "^2.17.4",
82
82
  "xstate": "^5.31.1",
83
- "@authhero/adapter-interfaces": "4.9.0",
84
- "@authhero/proxy": "0.10.8",
85
- "@authhero/saml": "0.5.7"
83
+ "@authhero/adapter-interfaces": "4.11.0",
84
+ "@authhero/proxy": "0.10.10",
85
+ "@authhero/saml": "0.5.9"
86
86
  },
87
87
  "peerDependencies": {
88
88
  "@authhero/widget": "^0.1.0",