feat!: removed default defaultMaxAge from all built-in claims

Author: porcellus

CHANGELOG.md

@@ -9,13 +9,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 -   Added register credential endpoint for the WebAuthn recipe
 
-## [23.0.0] - 2025-06-27
+## [23.0.0] - 2025-07-21
+
+### Breaking changes
 
 -   The `getConsentRequest`, `acceptConsentRequest`, `rejectConsentRequest`, `acceptLoginRequest`, `rejectLoginRequest` and `introspectToken` can now possibly return an `ErrorOAuth2`.
 -   The `/oauth/introspect` can now possibly return an `ErrorAuth2`.
--   The `User` class now has a `fromApi` function to normalize the user object returned from the API.
+-   Removed default defaultMaxAge from all built-in claims/validators. You can optionally set them when adding the validators. This should help with unexpected API calls during session verification.
+
+### Refactors
+
 -   Refactors querier to use dynamic request body and response body types inference.
 -   Refactor internal network calls made with querier to use the new dynamic types.
+-   The `User` class now has a `fromApi` function to normalize the user object returned from the API.
 -   Added experimental support for plugins. Please note that the experimental nature of this feature means that we might break the interface in non-major version updates.
 
 ## [22.1.1] - 2025-06-20
@@ -972,7 +978,7 @@ Session.init({
                             input.userId,
                             input.recipeUserId,
                             input.tenantId,
-                            input.userContext,
+                            input.userContext
                         )),
                     };
 
@@ -1000,7 +1006,7 @@ Session.init({
                             input.recipeUserId,
                             input.tenantId,
                             input.accessTokenPayload,
-                            input.userContext,
+                            input.userContext
                         )),
                     };
 

add-ts-no-check.js

@@ -12,6 +12,7 @@ glob(__dirname + "/lib/**/*.d.ts", (err, files) => {
                 newContents += `\n${line}`;
             }
         }
+        newContents = newContents.replaceAll("\n// @ts-nocheck", "");
         writeFileSync(file, newContents);
     }
 });

lib/build/recipe/multitenancy/allowedDomainsClaim.js

@@ -1,11 +1,4 @@
 // @ts-nocheck
-// @ts-nocheck
-// @ts-nocheck
-// @ts-nocheck
-// @ts-nocheck
-// @ts-nocheck
-// @ts-nocheck
-// @ts-nocheck
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.

lib/build/recipe/oauth2provider/constants.js

@@ -16,7 +16,7 @@ export class AllowedDomainsClaimClass extends PrimitiveArrayClaim<string> {
                 }
                 return await recipe.getAllowedDomainsForTenantId(tenantId, userContext);
             },
-            defaultMaxAgeInSeconds: 3600,
+            defaultMaxAgeInSeconds: undefined,
         });
     }
 }

lib/build/recipe/session/constants.js

@@ -34,7 +34,6 @@ export class PermissionClaimClass extends PrimitiveArrayClaim<string> {
 
                 return Array.from(userPermissions);
             },
-            defaultMaxAgeInSeconds: 300,
         });
     }
 }