authhero 9.9.0 → 9.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/assets/u/widget/index.esm.js +1 -1
- package/dist/authhero.cjs +543 -344
- package/dist/authhero.d.ts +135 -135
- package/dist/authhero.mjs +12205 -11732
- package/dist/tsconfig.types.tsbuildinfo +1 -1
- package/dist/types/authentication-flows/grant-tokens.d.ts +16 -0
- package/dist/types/helpers/refresh-token-lifetime.d.ts +103 -0
- package/dist/types/hooks/addDataHooks.d.ts +4 -3
- package/dist/types/index.d.ts +135 -135
- package/dist/types/routes/auth-api/index.d.ts +32 -32
- package/dist/types/routes/auth-api/passwordless.d.ts +2 -2
- package/dist/types/routes/auth-api/token.d.ts +24 -24
- package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
- package/dist/types/routes/management-api/failed-events.d.ts +1 -1
- package/dist/types/routes/management-api/forms.d.ts +126 -126
- package/dist/types/routes/management-api/guardian.d.ts +5 -5
- package/dist/types/routes/management-api/helpers.d.ts +1 -1
- package/dist/types/routes/management-api/index.d.ts +80 -80
- package/dist/types/routes/management-api/keys.d.ts +8 -8
- package/dist/types/routes/management-api/organizations.d.ts +5 -5
- package/dist/types/routes/management-api/prompts.d.ts +4 -4
- package/dist/types/routes/management-api/roles.d.ts +1 -1
- package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
- package/dist/types/routes/management-api/tenants.d.ts +1 -1
- package/dist/types/routes/management-api/users.d.ts +20 -20
- package/dist/types/routes/universal-login/identifier.d.ts +2 -2
- package/dist/types/routes/universal-login/index.d.ts +2 -2
- package/dist/types/routes/universal-login/info-code-exchange.d.ts +27 -0
- package/dist/types/routes/universal-login/token-info-page.d.ts +26 -0
- package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
- package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
- package/dist/types/utils/email.d.ts +21 -9
- package/package.json +8 -8
|
@@ -22,10 +22,10 @@ export declare const keyRoutes: OpenAPIHono<{
|
|
|
22
22
|
fingerprint: string;
|
|
23
23
|
thumbprint: string;
|
|
24
24
|
revoked_at?: string | undefined;
|
|
25
|
-
|
|
25
|
+
next?: boolean | undefined;
|
|
26
26
|
connection?: string | undefined;
|
|
27
|
+
tenant_id?: string | undefined;
|
|
27
28
|
current?: boolean | undefined;
|
|
28
|
-
next?: boolean | undefined;
|
|
29
29
|
previous?: boolean | undefined;
|
|
30
30
|
current_since?: string | undefined;
|
|
31
31
|
current_until?: string | undefined;
|
|
@@ -61,10 +61,10 @@ export declare const keyRoutes: OpenAPIHono<{
|
|
|
61
61
|
fingerprint: string;
|
|
62
62
|
thumbprint: string;
|
|
63
63
|
revoked_at?: string | undefined;
|
|
64
|
-
|
|
64
|
+
next?: boolean | undefined;
|
|
65
65
|
connection?: string | undefined;
|
|
66
|
+
tenant_id?: string | undefined;
|
|
66
67
|
current?: boolean | undefined;
|
|
67
|
-
next?: boolean | undefined;
|
|
68
68
|
previous?: boolean | undefined;
|
|
69
69
|
current_since?: string | undefined;
|
|
70
70
|
current_until?: string | undefined;
|
|
@@ -99,10 +99,10 @@ export declare const keyRoutes: OpenAPIHono<{
|
|
|
99
99
|
fingerprint: string;
|
|
100
100
|
thumbprint: string;
|
|
101
101
|
revoked_at?: string | undefined;
|
|
102
|
-
|
|
102
|
+
next?: boolean | undefined;
|
|
103
103
|
connection?: string | undefined;
|
|
104
|
+
tenant_id?: string | undefined;
|
|
104
105
|
current?: boolean | undefined;
|
|
105
|
-
next?: boolean | undefined;
|
|
106
106
|
previous?: boolean | undefined;
|
|
107
107
|
current_since?: string | undefined;
|
|
108
108
|
current_until?: string | undefined;
|
|
@@ -139,10 +139,10 @@ export declare const keyRoutes: OpenAPIHono<{
|
|
|
139
139
|
fingerprint: string;
|
|
140
140
|
thumbprint: string;
|
|
141
141
|
revoked_at?: string | undefined;
|
|
142
|
-
|
|
142
|
+
next?: boolean | undefined;
|
|
143
143
|
connection?: string | undefined;
|
|
144
|
+
tenant_id?: string | undefined;
|
|
144
145
|
current?: boolean | undefined;
|
|
145
|
-
next?: boolean | undefined;
|
|
146
146
|
previous?: boolean | undefined;
|
|
147
147
|
current_since?: string | undefined;
|
|
148
148
|
current_until?: string | undefined;
|
|
@@ -729,19 +729,19 @@ export declare const organizationRoutes: OpenAPIHono<{
|
|
|
729
729
|
} & {
|
|
730
730
|
json: {
|
|
731
731
|
client_id: string;
|
|
732
|
-
invitee: {
|
|
733
|
-
email?: string | undefined;
|
|
734
|
-
};
|
|
735
732
|
inviter: {
|
|
736
733
|
name?: string | undefined;
|
|
737
734
|
};
|
|
738
|
-
|
|
735
|
+
invitee: {
|
|
736
|
+
email?: string | undefined;
|
|
737
|
+
};
|
|
739
738
|
app_metadata?: Record<string, any> | undefined;
|
|
740
739
|
user_metadata?: Record<string, any> | undefined;
|
|
740
|
+
id?: string | undefined;
|
|
741
741
|
connection_id?: string | undefined;
|
|
742
|
+
ttl_sec?: number | undefined;
|
|
742
743
|
roles?: string[] | undefined;
|
|
743
744
|
send_invitation_email?: boolean | undefined;
|
|
744
|
-
ttl_sec?: number | undefined;
|
|
745
745
|
};
|
|
746
746
|
};
|
|
747
747
|
output: {
|
|
@@ -52,7 +52,7 @@ export declare const promptsRoutes: OpenAPIHono<{
|
|
|
52
52
|
};
|
|
53
53
|
};
|
|
54
54
|
output: {
|
|
55
|
-
prompt: "status" | "mfa" | "
|
|
55
|
+
prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "invitation" | "signup-password" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "captcha" | "custom-form";
|
|
56
56
|
language: string;
|
|
57
57
|
}[];
|
|
58
58
|
outputFormat: "json";
|
|
@@ -90,7 +90,7 @@ export declare const promptsRoutes: OpenAPIHono<{
|
|
|
90
90
|
$get: {
|
|
91
91
|
input: {
|
|
92
92
|
param: {
|
|
93
|
-
prompt: "status" | "mfa" | "
|
|
93
|
+
prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "invitation" | "signup-password" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "captcha" | "custom-form";
|
|
94
94
|
language: string;
|
|
95
95
|
};
|
|
96
96
|
} & {
|
|
@@ -112,7 +112,7 @@ export declare const promptsRoutes: OpenAPIHono<{
|
|
|
112
112
|
$put: {
|
|
113
113
|
input: {
|
|
114
114
|
param: {
|
|
115
|
-
prompt: "status" | "mfa" | "
|
|
115
|
+
prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "invitation" | "signup-password" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "captcha" | "custom-form";
|
|
116
116
|
language: string;
|
|
117
117
|
};
|
|
118
118
|
} & {
|
|
@@ -136,7 +136,7 @@ export declare const promptsRoutes: OpenAPIHono<{
|
|
|
136
136
|
$delete: {
|
|
137
137
|
input: {
|
|
138
138
|
param: {
|
|
139
|
-
prompt: "status" | "mfa" | "
|
|
139
|
+
prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "invitation" | "signup-password" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "captcha" | "custom-form";
|
|
140
140
|
language: string;
|
|
141
141
|
};
|
|
142
142
|
} & {
|
|
@@ -221,8 +221,8 @@ export declare const roleRoutes: OpenAPIHono<{
|
|
|
221
221
|
} & {
|
|
222
222
|
query: {
|
|
223
223
|
page?: string | undefined;
|
|
224
|
-
from?: string | undefined;
|
|
225
224
|
include_totals?: string | undefined;
|
|
225
|
+
from?: string | undefined;
|
|
226
226
|
per_page?: string | undefined;
|
|
227
227
|
take?: string | undefined;
|
|
228
228
|
};
|
|
@@ -8,8 +8,8 @@ export declare const tenantExportImportRoutes: OpenAPIHono<{
|
|
|
8
8
|
$get: {
|
|
9
9
|
input: {
|
|
10
10
|
query: {
|
|
11
|
-
include_password_hashes?: "
|
|
12
|
-
gzip?: "
|
|
11
|
+
include_password_hashes?: "false" | "true" | undefined;
|
|
12
|
+
gzip?: "false" | "true" | undefined;
|
|
13
13
|
};
|
|
14
14
|
} & {
|
|
15
15
|
header: {
|
|
@@ -22,8 +22,8 @@ export declare const tenantExportImportRoutes: OpenAPIHono<{
|
|
|
22
22
|
} | {
|
|
23
23
|
input: {
|
|
24
24
|
query: {
|
|
25
|
-
include_password_hashes?: "
|
|
26
|
-
gzip?: "
|
|
25
|
+
include_password_hashes?: "false" | "true" | undefined;
|
|
26
|
+
gzip?: "false" | "true" | undefined;
|
|
27
27
|
};
|
|
28
28
|
} & {
|
|
29
29
|
header: {
|
|
@@ -42,7 +42,7 @@ export declare const tenantExportImportRoutes: OpenAPIHono<{
|
|
|
42
42
|
$post: {
|
|
43
43
|
input: {
|
|
44
44
|
query: {
|
|
45
|
-
include_password_hashes?: "
|
|
45
|
+
include_password_hashes?: "false" | "true" | undefined;
|
|
46
46
|
};
|
|
47
47
|
} & {
|
|
48
48
|
header: {
|
|
@@ -214,12 +214,12 @@ export declare const tenantRoutes: OpenAPIHono<{
|
|
|
214
214
|
oidc_logout_prompt_enabled?: boolean | undefined;
|
|
215
215
|
} | undefined;
|
|
216
216
|
id?: string | undefined;
|
|
217
|
-
audience?: string | undefined;
|
|
218
217
|
allowed_logout_urls?: string[] | undefined;
|
|
219
218
|
oidc_logout?: {
|
|
220
219
|
rp_logout_end_session_endpoint_discovery?: boolean | undefined;
|
|
221
220
|
} | undefined;
|
|
222
221
|
default_organization?: string | undefined;
|
|
222
|
+
audience?: string | undefined;
|
|
223
223
|
friendly_name?: string | undefined;
|
|
224
224
|
picture_url?: string | undefined;
|
|
225
225
|
support_email?: string | undefined;
|
|
@@ -818,8 +818,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
818
818
|
};
|
|
819
819
|
output: {
|
|
820
820
|
created_at: string;
|
|
821
|
-
id: string;
|
|
822
821
|
user_id: string;
|
|
822
|
+
client_id: string;
|
|
823
|
+
rotating: boolean;
|
|
824
|
+
id: string;
|
|
825
|
+
login_id: string;
|
|
823
826
|
device: {
|
|
824
827
|
initial_user_agent: string;
|
|
825
828
|
initial_ip: string;
|
|
@@ -828,16 +831,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
828
831
|
last_ip: string;
|
|
829
832
|
last_asn: string;
|
|
830
833
|
};
|
|
831
|
-
client_id: string;
|
|
832
|
-
rotating: boolean;
|
|
833
|
-
login_id: string;
|
|
834
834
|
resource_servers: {
|
|
835
835
|
audience: string;
|
|
836
836
|
scopes: string;
|
|
837
837
|
}[];
|
|
838
|
-
revoked_at?: string | undefined;
|
|
839
838
|
expires_at?: string | undefined;
|
|
840
|
-
idle_expires_at?: string | undefined;
|
|
841
839
|
session_id?: string | undefined;
|
|
842
840
|
auth_connection?: string | undefined;
|
|
843
841
|
auth_strategy?: {
|
|
@@ -845,6 +843,8 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
845
843
|
strategy_type: string;
|
|
846
844
|
} | undefined;
|
|
847
845
|
organization?: string | undefined;
|
|
846
|
+
revoked_at?: string | undefined;
|
|
847
|
+
idle_expires_at?: string | undefined;
|
|
848
848
|
last_exchanged_at?: string | undefined;
|
|
849
849
|
}[] | {
|
|
850
850
|
start: number;
|
|
@@ -852,8 +852,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
852
852
|
length: number;
|
|
853
853
|
tokens: {
|
|
854
854
|
created_at: string;
|
|
855
|
-
id: string;
|
|
856
855
|
user_id: string;
|
|
856
|
+
client_id: string;
|
|
857
|
+
rotating: boolean;
|
|
858
|
+
id: string;
|
|
859
|
+
login_id: string;
|
|
857
860
|
device: {
|
|
858
861
|
initial_user_agent: string;
|
|
859
862
|
initial_ip: string;
|
|
@@ -862,16 +865,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
862
865
|
last_ip: string;
|
|
863
866
|
last_asn: string;
|
|
864
867
|
};
|
|
865
|
-
client_id: string;
|
|
866
|
-
rotating: boolean;
|
|
867
|
-
login_id: string;
|
|
868
868
|
resource_servers: {
|
|
869
869
|
audience: string;
|
|
870
870
|
scopes: string;
|
|
871
871
|
}[];
|
|
872
|
-
revoked_at?: string | undefined;
|
|
873
872
|
expires_at?: string | undefined;
|
|
874
|
-
idle_expires_at?: string | undefined;
|
|
875
873
|
session_id?: string | undefined;
|
|
876
874
|
auth_connection?: string | undefined;
|
|
877
875
|
auth_strategy?: {
|
|
@@ -879,6 +877,8 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
879
877
|
strategy_type: string;
|
|
880
878
|
} | undefined;
|
|
881
879
|
organization?: string | undefined;
|
|
880
|
+
revoked_at?: string | undefined;
|
|
881
|
+
idle_expires_at?: string | undefined;
|
|
882
882
|
last_exchanged_at?: string | undefined;
|
|
883
883
|
}[];
|
|
884
884
|
total?: number | undefined;
|
|
@@ -886,8 +886,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
886
886
|
} | {
|
|
887
887
|
tokens: {
|
|
888
888
|
created_at: string;
|
|
889
|
-
id: string;
|
|
890
889
|
user_id: string;
|
|
890
|
+
client_id: string;
|
|
891
|
+
rotating: boolean;
|
|
892
|
+
id: string;
|
|
893
|
+
login_id: string;
|
|
891
894
|
device: {
|
|
892
895
|
initial_user_agent: string;
|
|
893
896
|
initial_ip: string;
|
|
@@ -896,16 +899,11 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
896
899
|
last_ip: string;
|
|
897
900
|
last_asn: string;
|
|
898
901
|
};
|
|
899
|
-
client_id: string;
|
|
900
|
-
rotating: boolean;
|
|
901
|
-
login_id: string;
|
|
902
902
|
resource_servers: {
|
|
903
903
|
audience: string;
|
|
904
904
|
scopes: string;
|
|
905
905
|
}[];
|
|
906
|
-
revoked_at?: string | undefined;
|
|
907
906
|
expires_at?: string | undefined;
|
|
908
|
-
idle_expires_at?: string | undefined;
|
|
909
907
|
session_id?: string | undefined;
|
|
910
908
|
auth_connection?: string | undefined;
|
|
911
909
|
auth_strategy?: {
|
|
@@ -913,6 +911,8 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
913
911
|
strategy_type: string;
|
|
914
912
|
} | undefined;
|
|
915
913
|
organization?: string | undefined;
|
|
914
|
+
revoked_at?: string | undefined;
|
|
915
|
+
idle_expires_at?: string | undefined;
|
|
916
916
|
last_exchanged_at?: string | undefined;
|
|
917
917
|
}[];
|
|
918
918
|
next?: string | undefined;
|
|
@@ -963,7 +963,7 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
963
963
|
};
|
|
964
964
|
};
|
|
965
965
|
output: {
|
|
966
|
-
type: "
|
|
966
|
+
type: "fs" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
|
|
967
967
|
date: string;
|
|
968
968
|
isMobile: boolean;
|
|
969
969
|
log_id: string;
|
|
@@ -1002,7 +1002,7 @@ export declare const userRoutes: OpenAPIHono<{
|
|
|
1002
1002
|
limit: number;
|
|
1003
1003
|
length: number;
|
|
1004
1004
|
logs: {
|
|
1005
|
-
type: "
|
|
1005
|
+
type: "fs" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
|
|
1006
1006
|
date: string;
|
|
1007
1007
|
isMobile: boolean;
|
|
1008
1008
|
log_id: string;
|
|
@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
|
|
|
30
30
|
} & {
|
|
31
31
|
form: {
|
|
32
32
|
username: string;
|
|
33
|
-
login_selection?: "
|
|
33
|
+
login_selection?: "password" | "code" | undefined;
|
|
34
34
|
};
|
|
35
35
|
};
|
|
36
36
|
output: {};
|
|
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
|
|
|
44
44
|
} & {
|
|
45
45
|
form: {
|
|
46
46
|
username: string;
|
|
47
|
-
login_selection?: "
|
|
47
|
+
login_selection?: "password" | "code" | undefined;
|
|
48
48
|
};
|
|
49
49
|
};
|
|
50
50
|
output: {};
|
|
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
515
515
|
} & {
|
|
516
516
|
form: {
|
|
517
517
|
username: string;
|
|
518
|
-
login_selection?: "
|
|
518
|
+
login_selection?: "password" | "code" | undefined;
|
|
519
519
|
};
|
|
520
520
|
};
|
|
521
521
|
output: {};
|
|
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
529
529
|
} & {
|
|
530
530
|
form: {
|
|
531
531
|
username: string;
|
|
532
|
-
login_selection?: "
|
|
532
|
+
login_selection?: "password" | "code" | undefined;
|
|
533
533
|
};
|
|
534
534
|
};
|
|
535
535
|
output: {};
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
import { Context } from "hono";
|
|
2
|
+
import { TokenResponse, User } from "@authhero/adapter-interfaces";
|
|
3
|
+
import { Bindings, Variables } from "../../types";
|
|
4
|
+
import { EnrichedClient } from "../../helpers/client";
|
|
5
|
+
export type InfoCodeExchangeResult = {
|
|
6
|
+
ok: true;
|
|
7
|
+
tokens: TokenResponse;
|
|
8
|
+
user: User;
|
|
9
|
+
client: EnrichedClient;
|
|
10
|
+
} | {
|
|
11
|
+
ok: false;
|
|
12
|
+
error: string;
|
|
13
|
+
error_description: string;
|
|
14
|
+
};
|
|
15
|
+
/**
|
|
16
|
+
* Redeem an authorization code that was issued with the info page itself as
|
|
17
|
+
* `redirect_uri`, using the client's own credentials on the server side.
|
|
18
|
+
*
|
|
19
|
+
* The page lives on the auth server, so it can complete the exchange without
|
|
20
|
+
* the browser ever seeing a client secret. The redirect_uri guard is
|
|
21
|
+
* load-bearing: without it a code intercepted from any other redirect target
|
|
22
|
+
* could be pasted into this page and redeemed with the client's secret.
|
|
23
|
+
*/
|
|
24
|
+
export declare function exchangeInfoPageCode(ctx: Context<{
|
|
25
|
+
Bindings: Bindings;
|
|
26
|
+
Variables: Variables;
|
|
27
|
+
}>, tenantId: string, code: string): Promise<InfoCodeExchangeResult>;
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Signed-in landing page for the /u2/info test redirect target.
|
|
3
|
+
*
|
|
4
|
+
* Shows the outcome of a server-side authorization code exchange: buttons
|
|
5
|
+
* that copy the issued tokens to the clipboard, and a grid with the claims
|
|
6
|
+
* from the ID token (or the user's profile when no ID token was issued).
|
|
7
|
+
*/
|
|
8
|
+
import type { Theme, TokenResponse, User } from "@authhero/adapter-interfaces";
|
|
9
|
+
import type { DarkModePreference } from "./u2-widget-page";
|
|
10
|
+
import type { ErrorPageProps } from "./error-page";
|
|
11
|
+
export type TokenInfoPageProps = {
|
|
12
|
+
tokens: TokenResponse;
|
|
13
|
+
user: User;
|
|
14
|
+
branding?: ErrorPageProps["branding"];
|
|
15
|
+
theme?: Theme | null;
|
|
16
|
+
darkMode?: DarkModePreference;
|
|
17
|
+
};
|
|
18
|
+
type ClaimRow = {
|
|
19
|
+
key: string;
|
|
20
|
+
value: string;
|
|
21
|
+
};
|
|
22
|
+
/** Decode a JWT payload without verifying it — the server just minted it. */
|
|
23
|
+
export declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
|
|
24
|
+
export declare function buildClaimRows(tokens: TokenResponse, user: User): ClaimRow[];
|
|
25
|
+
export declare function TokenInfoPage({ tokens, user, branding, theme, darkMode, }: TokenInfoPageProps): import("hono/jsx/jsx-dev-runtime").JSX.Element;
|
|
26
|
+
export {};
|
|
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
165
165
|
$get: {
|
|
166
166
|
input: {
|
|
167
167
|
param: {
|
|
168
|
-
screen: "
|
|
168
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
169
169
|
};
|
|
170
170
|
} & {
|
|
171
171
|
query: {
|
|
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
181
181
|
} | {
|
|
182
182
|
input: {
|
|
183
183
|
param: {
|
|
184
|
-
screen: "
|
|
184
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
185
185
|
};
|
|
186
186
|
} & {
|
|
187
187
|
query: {
|
|
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
197
197
|
} | {
|
|
198
198
|
input: {
|
|
199
199
|
param: {
|
|
200
|
-
screen: "
|
|
200
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
201
201
|
};
|
|
202
202
|
} & {
|
|
203
203
|
query: {
|
|
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
217
217
|
$post: {
|
|
218
218
|
input: {
|
|
219
219
|
param: {
|
|
220
|
-
screen: "
|
|
220
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
221
221
|
};
|
|
222
222
|
} & {
|
|
223
223
|
query: {
|
|
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
|
|
|
235
235
|
} | {
|
|
236
236
|
input: {
|
|
237
237
|
param: {
|
|
238
|
-
screen: "
|
|
238
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
239
239
|
};
|
|
240
240
|
} & {
|
|
241
241
|
query: {
|
|
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
170
170
|
$get: {
|
|
171
171
|
input: {
|
|
172
172
|
param: {
|
|
173
|
-
screen: "
|
|
173
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
174
174
|
};
|
|
175
175
|
} & {
|
|
176
176
|
query: {
|
|
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
186
186
|
} | {
|
|
187
187
|
input: {
|
|
188
188
|
param: {
|
|
189
|
-
screen: "
|
|
189
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
190
190
|
};
|
|
191
191
|
} & {
|
|
192
192
|
query: {
|
|
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
202
202
|
} | {
|
|
203
203
|
input: {
|
|
204
204
|
param: {
|
|
205
|
-
screen: "
|
|
205
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
206
206
|
};
|
|
207
207
|
} & {
|
|
208
208
|
query: {
|
|
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
222
222
|
$post: {
|
|
223
223
|
input: {
|
|
224
224
|
param: {
|
|
225
|
-
screen: "
|
|
225
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
226
226
|
};
|
|
227
227
|
} & {
|
|
228
228
|
query: {
|
|
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
|
|
|
240
240
|
} | {
|
|
241
241
|
input: {
|
|
242
242
|
param: {
|
|
243
|
-
screen: "
|
|
243
|
+
screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
|
|
244
244
|
};
|
|
245
245
|
} & {
|
|
246
246
|
query: {
|
|
@@ -1,16 +1,28 @@
|
|
|
1
1
|
export declare const EMAIL_REGEX: RegExp;
|
|
2
2
|
export declare function isValidEmail(value: string): boolean;
|
|
3
3
|
/**
|
|
4
|
-
*
|
|
5
|
-
*
|
|
4
|
+
* Canonical form of an email identifier: surrounding whitespace stripped, then
|
|
5
|
+
* lowercased.
|
|
6
6
|
*
|
|
7
|
-
* Emails are case-insensitive identifiers
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
7
|
+
* Both halves matter. Emails are case-insensitive identifiers, so a mixed-case
|
|
8
|
+
* stored address is unreachable from a lowercasing lookup. Whitespace is worse:
|
|
9
|
+
* `"user@example.com "` is stored verbatim, passes every uniqueness check
|
|
10
|
+
* against its trimmed twin, and produces a second account for the same person
|
|
11
|
+
* on the same connection (issue #1279). Every read and write path must agree on
|
|
12
|
+
* this single definition or the two halves diverge again.
|
|
13
13
|
*/
|
|
14
|
-
export declare function
|
|
14
|
+
export declare function normalizeEmail(email: string): string;
|
|
15
|
+
/**
|
|
16
|
+
* Return `payload` with `email` normalized via {@link normalizeEmail}, or
|
|
17
|
+
* unchanged when there is nothing to normalize.
|
|
18
|
+
*
|
|
19
|
+
* This is the write-path chokepoint: every lookup (identifier-first login,
|
|
20
|
+
* `getPrimaryUserByEmail`, email-based auto-linking) normalizes its input, so
|
|
21
|
+
* an un-normalized stored email is unreachable and spawns duplicate accounts.
|
|
22
|
+
* The zod request-schema transform only covers validated bodies — emails
|
|
23
|
+
* sourced upstream (SCIM provisioning, Auth0 lazy migration, IdP profiles) and
|
|
24
|
+
* emails assigned by lifecycle hooks never pass through it.
|
|
25
|
+
*/
|
|
26
|
+
export declare function withNormalizedEmail<T extends {
|
|
15
27
|
email?: string;
|
|
16
28
|
}>(payload: T): T;
|