Repository navigation
feat: v0.20 routes and recovery sessions in every adapter #232
Description
What the v0.20 API (epic fells-code/seamless-auth-api#386) needs from the adapters. Contract: @seamless-auth/types 0.30.0 (fells-code/seamless-auth-types#108).
Recovery sessions (fells-code/seamless-auth-api#491)
- An access token may carry
recovery: true.requireAuth(and the Next.js / Go / Python / Rust equivalents) refuses it by default with 403enrollment_required, with an option to allow it, so an app does not treat a half-recovered account as signed in. - After passkey registration or TOTP enrollment from a recovery session, the API lifts the restriction on the session; the adapter should refresh so the cookie's access token drops the claim.
Routes
Manifest-driven (public / pre-auth; picked up from /.well-known/seamless-adapter.json, verify they work):
POST /recovery-codes/redeem(preAuth -> session)POST /recovery/start,/recovery/verify,GET /recovery/status,POST /recovery/complete(preAuth; complete -> session),POST /recovery/cancel(public) (feat: self-service account recovery with a delay and notices seamless-auth-api#493)
Access routes needing explicit passthroughs (no catch-all proxy; see the seven-file checklist):
GET /recovery-codes,POST /recovery-codesGET /system-config/policy,PUT /system-config/policy/draft,DELETE /system-config/policy/draft,POST /system-config/policy/publish,POST /system-config/policy/rollback,GET /system-config/policy/versions,POST /system-config/policy/dry-run(feat: stage, publish, roll back and dry-run auth policy changes seamless-auth-api#492)
Pass through unchanged
403 step_up_requiredwith its status fields on every admin write (feat(admin): require a fresh step-up on admin writes seamless-auth-api#490),409 secret_requiredwithvariable(#489),409 policy_version_conflict(#492).
Related: #231 (placeholder secrets), #225-#230 (hardening). Ship in the one v0.20 adapter release, before API 0.20.0.
Activity
Bccorb commentedon Oct 24, 2026
Also from fells-code/seamless-auth-api#490:
DELETE /users/delete(a user deleting their own account) now needs a fresh step-up and answers403 step_up_requiredwith the step-up status fields otherwise. Pass it through unchanged; the React SDK's account deletion needs to step up first (and an account with no passkey or TOTP cannot delete itself).Bccorb commentedon Oct 25, 2026
From fells-code/seamless-auth-api#498:
POST /recovery/verifycan now answer503withrecovery_notice_failed(the request is voided when the owner could not be notified). When the/recovery/*passthroughs land, pass that status and body through unchanged, and don't sendx-seamless-auth-delivery-mode: externalon/recovery/verifyuntil fells-code/seamless-auth-api#499 adds a delivery kind for the notice.Bccorb commentedon Oct 25, 2026
Contract from fells-code/seamless-auth-api#500 (types
@seamless-auth/types0.31.0):account_notice_email(to, subject, text, notice, cancelUrl?) andaccount_notice_sms(to, text, notice, cancelUrl?).cancelUrlcarries a credential: send it only toto, never log it.notices: true(todayPOST /recovery/verify), send external delivery plusx-seamless-auth-delivery-kinds: account_notice_email,account_notice_sms, deliver every item in the response'sdeliveriesarray, and strip it before answering the client. Do not send that header unless every listed kind is actually delivered, because the API counts a returned notice as the owner being told.otp_email/otp_smsmay carrypurpose: 'account_recovery': word that message as a recovery warning.GET /recovery/requestsandDELETE /recovery/requests/:idneed no adapter-specific code where the manifest catch-all is used.POST /recovery/verifycan answer503 recovery_notice_failed; pass it through.feat: recovery sessions and account notices for the v0.20 auth server (…
Bccorb commentedon Oct 29, 2026
Done: the recovery-session refusal and account notices shipped in #233, the hardening in #234, and the bundled manifest carries every v0.20 route (policy, recovery codes, recovery). Released in core/express 0.22.0, fastify 0.13.0, nextjs 0.6.0. The refresh-after-enrollment parity is #235, now in v0.21.