authhero 9.9.0 → 9.9.1

package/dist/types/authentication-flows/grant-tokens.d.ts

@@ -0,0 +1,16 @@
+import { Context } from "hono";
+import { GrantType, TokenResponse } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../types";
+import { GrantFlowResult } from "../types/GrantFlowResult";
+/**
+ * Turn a resolved grant into wire tokens: narrow the requested scopes to what
+ * the user/client is actually granted for the audience, pick the token
+ * lifetime from the resource server, then mint the tokens.
+ *
+ * Shared by the /oauth/token endpoint and the server-side code exchange on the
+ * /u2/info test page so both mint identical tokens for the same grant.
+ */
+export declare function issueTokensForGrant(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, grantResult: GrantFlowResult, grantType: GrantType): Promise<TokenResponse>;

package/dist/types/helpers/refresh-token-lifetime.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Refresh-token lifetimes (issue #1260).
+ *
+ * Auth0 keeps refresh-token expiry and session expiry as two separate
+ * concepts: the former is configured per *client* (`client.refresh_token.*`,
+ * in seconds), the latter per *tenant* (`session_lifetime` /
+ * `idle_session_lifetime`, in hours). AuthHero historically derived
+ * refresh-token expiry from the tenant session lifetimes only, which made
+ * `infinite_token_lifetime` — the setting native/mobile clients rely on —
+ * unrepresentable.
+ *
+ * These helpers resolve the effective lifetime: per-client config wins when
+ * set, otherwise we fall back to the tenant-derived behaviour so existing
+ * tenants see no change.
+ */
+/**
+ * A resolved refresh-token lifetime.
+ *
+ * - `seconds` — expires this many seconds after the anchor point.
+ * - `infinite` — explicitly configured never to expire.
+ * - `unset` — nothing configured at either level. Distinct from `infinite`
+ *   so callers can tell "the operator asked for no expiry" from "no opinion":
+ *   at mint both mean no expiry, but on rotation only `infinite` clears an
+ *   expiry the parent row already carried.
+ */
+export type RefreshTokenLifetime = {
+    kind: "seconds";
+    seconds: number;
+} | {
+    kind: "infinite";
+} | {
+    kind: "unset";
+};
+/** The subset of a client this module reads. */
+export interface RefreshTokenLifetimeClient {
+    refresh_token?: {
+        expiration_type?: "expiring" | "non-expiring";
+        token_lifetime?: number;
+        infinite_token_lifetime?: boolean;
+        idle_token_lifetime?: number;
+        infinite_idle_token_lifetime?: boolean;
+    };
+    tenant: {
+        session_lifetime?: number;
+        idle_session_lifetime?: number;
+    };
+}
+/**
+ * Absolute ("hard") refresh-token lifetime: how long the token is valid for,
+ * regardless of use.
+ */
+export declare function resolveAbsoluteRefreshTokenLifetime(client: RefreshTokenLifetimeClient): RefreshTokenLifetime;
+/**
+ * Idle ("sliding") refresh-token lifetime: how long the token survives without
+ * being exchanged. Refreshed on every successful exchange.
+ */
+export declare function resolveIdleRefreshTokenLifetime(client: RefreshTokenLifetimeClient): RefreshTokenLifetime;
+/**
+ * Turn a lifetime into an ISO expiry timestamp measured from `from`.
+ * `infinite` and `unset` both yield `undefined` — no expiry column is written.
+ */
+export declare function lifetimeToExpiresAt(lifetime: RefreshTokenLifetime, from?: number): string | undefined;
+/**
+ * Both expiry timestamps for a freshly minted refresh token.
+ */
+export declare function resolveRefreshTokenExpiry(client: RefreshTokenLifetimeClient, from?: number): {
+    expires_at?: string;
+    idle_expires_at?: string;
+};
+/**
+ * The idle expiry a token should carry after a successful exchange.
+ *
+ * Sliding only applies to a token that already had an idle window: a row minted
+ * without one is not retro-fitted with an expiry mid-life. The exception is an
+ * explicit `infinite` config, which clears an existing window so a client
+ * switched to non-expiring stops being cut off by expiries stamped earlier.
+ */
+export declare function slideIdleExpiry(client: RefreshTokenLifetimeClient, currentIdleExpiresAt: string | undefined, from?: number): string | undefined;
+/**
+ * The expiry columns an in-place (non-rotating) exchange should write.
+ *
+ * Three-valued per column, matching the adapter's update contract:
+ * `undefined` leaves the stored value alone, a string overwrites it, `null`
+ * clears it.
+ *
+ * Rotation reconciles a changed client config for free — the child row is
+ * minted from the current lifetimes — but the non-rotating path keeps handing
+ * back the row it was given, so it has to say so explicitly:
+ *
+ * - Idle window: slides by the resolved lifetime, and is cleared when the
+ *   client is configured never to idle-expire. A row minted without an idle
+ *   window is not retro-fitted with one mid-life.
+ * - Absolute window: never extended — refreshing must not let a bounded token
+ *   outlive the expiry stamped at mint — and only cleared when the client is
+ *   configured never to expire.
+ */
+export declare function resolveExchangeExpiryUpdate(client: RefreshTokenLifetimeClient, current: {
+    expires_at?: string;
+    idle_expires_at?: string;
+}, from?: number): {
+    expires_at?: null;
+    idle_expires_at?: string | null;
+};

package/dist/types/hooks/addDataHooks.d.ts

@@ -10,9 +10,10 @@ import { Bindings, Variables } from "../types";
  * dispatch post-event outbox messages. `users.rawCreate` is NOT decorated —
  * commit paths call it directly to bypass the hook layer by design.
  *
- * `email` is lowercased on the way in so the pre-commit hooks and lookups
- * (`preUserSignupHook`, the email→primary linking query) see the same
- * normalized value that will be stored. Hooks can assign `email` themselves
+ * `email` is normalized (trimmed and lowercased) on the way in so the
+ * pre-commit hooks and lookups (`preUserSignupHook`, the email→primary linking
+ * query) see the same normalized value that will be stored. Hooks can assign
+ * `email` themselves
  * after this point, so the decorators normalize again just before their
  * commit — see `createUserHooks` / `createUserUpdateHooks`.
  */