zyphr 0.1.64 → 0.1.66

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e53e2a25fa6b997b6fd932f7b87f4562ef9109abec1e6ab7781fb740dd14426
-  data.tar.gz: 468e8c41c576a915b01ebe96f341c19f682238fffee101dc6f32ea598baa5d85
+  metadata.gz: f33c2c02adcbf0bd60c921c7dc357478b5726c0b984e1298201125c1e2c65455
+  data.tar.gz: 435e121c0edf7400b7b89b7918eaa5478dc08cafad2c002c76ea356539ae36a3
 SHA512:
-  metadata.gz: f478ec01374b4d9ad883b25b948f66274619ce68114353aa3c34a5cec89bde1844776c3c9f019179d55de972db7f0f6cc956450fc52c5da9628bc3758554ad1b
-  data.tar.gz: 7cc930a3e11f6e7a41b269a5a7391b5d9177341f9d6c12b438fb5fb80c5e1c3d7137fe65130cc4b68bdab331dd4a33ef85adba4c12fcf2537fa9578736a1d99d
+  metadata.gz: d8cdf4f705e2aaad3542d415df6a8c8f71bf7af79020abb0df1e8521ae3d085c119cab00d899096a10ab1b3f35f4e95404728ae5c7275f95daa4b11e633c5161
+  data.tar.gz: e226e4db4034313a4bf73882cf3353680e16df445ed97f499b5eabb0dca84579727c7bec1c50e002a1bd7cb7397e9aa34f03042d7b831907ba74b27fee905f60

data/docs/AuthEmailTemplatesApi.md

@@ -22,7 +22,7 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 Bulk-upsert auth email templates
 
-Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
+Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
 
 ### Examples
 

data/docs/AuthMagicLinksApi.md

@@ -90,7 +90,7 @@ end
 
 Verify a magic link
 
-Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
 
 ### Examples
 

data/docs/AuthUserDirectoryApi.md

@@ -400,7 +400,7 @@ end
 
 Pre-provision (invite) an end user (server-side admin)
 
-Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
 
 ### Examples
 

data/docs/BulkUpsertAuthEmailTemplatesRequest.md

@@ -7,6 +7,8 @@
 | **magic_link** | [**UpsertAuthEmailTemplateRequest**](UpsertAuthEmailTemplateRequest.md) |  | [optional] |
 | **password_reset** | [**UpsertAuthEmailTemplateRequest**](UpsertAuthEmailTemplateRequest.md) |  | [optional] |
 | **email_verification** | [**UpsertAuthEmailTemplateRequest**](UpsertAuthEmailTemplateRequest.md) |  | [optional] |
+| **email_otp** | [**UpsertAuthEmailTemplateRequest**](UpsertAuthEmailTemplateRequest.md) |  | [optional] |
+| **invitation** | [**UpsertAuthEmailTemplateRequest**](UpsertAuthEmailTemplateRequest.md) |  | [optional] |
 
 ## Example
 
@@ -16,7 +18,9 @@ require 'zyphr'
 instance = Zyphr::BulkUpsertAuthEmailTemplatesRequest.new(
   magic_link: null,
   password_reset: null,
-  email_verification: null
+  email_verification: null,
+  email_otp: null,
+  invitation: null
 )
 ```
 

data/docs/InviteEndUser200ResponseData.md

@@ -6,8 +6,8 @@
 | ---- | ---- | ----------- | ----- |
 | **user_id** | **String** |  | [optional] |
 | **created** | **Boolean** | True when a new user was provisioned; false when an existing user was reused (idempotent on email). | [optional] |
-| **link_sent** | **Boolean** | True when a magic-link or password-reset email was successfully dispatched. | [optional] |
-| **link_suppressed_reason** | **String** | Present only when `send_link` was requested and `link_sent` is false — explains why, so a caller can distinguish \"suppressed by design\" from \"delivery failed\".  Known values:  - `identity_has_other_auth_methods` — the identity has no password but does have a   linked OAuth provider and/or a passkey, so it is not locked out and no   set-password link is sent. The attempt is recorded as a suppressed message,   visible via `GET /emails`. - `user_not_found_in_environment` — the identity could not be resolved in the   calling environment (a race; it was created or resolved immediately prior). - `recipient_not_allowlisted` — the application's `test_recipients` allowlist   blocked the recipient. - `send_failed` — dispatch was attempted and failed with no more specific code.  Not a closed set: a mail-provider error code may be surfaced verbatim, so treat an unrecognised value as a generic failure rather than an error.  | [optional] |
+| **link_sent** | **Boolean** | True when the requested invitation, magic-link or password-reset email was successfully dispatched. | [optional] |
+| **link_suppressed_reason** | **String** | Present only when `send_link` was requested and `link_sent` is false — explains why, so a caller can distinguish \"suppressed by design\" from \"delivery failed\".  Known values:  - `identity_has_other_auth_methods` — the identity has no password but does have a   linked OAuth provider and/or a passkey, so it is not locked out and no   set-password link is sent. The attempt is recorded as a suppressed message,   visible via `GET /emails`.   (For `send_link: \"invitation\"` the reason is returned here only; no   suppressed message is recorded.) - `user_has_password` — `send_link: \"invitation\"` only: the identity already has   a password, so there is nothing to accept. Use `password_reset` to send a reset. - `user_not_found_in_environment` — the identity could not be resolved in the   calling environment (a race; it was created or resolved immediately prior). - `recipient_not_allowlisted` — the application's `test_recipients` allowlist   blocked the recipient. - `send_failed` — dispatch was attempted and failed with no more specific code.  Not a closed set: a mail-provider error code may be surfaced verbatim, so treat an unrecognised value as a generic failure rather than an error.  | [optional] |
 
 ## Example
 

data/docs/MagicLinkVerifyResponseData.md

@@ -4,8 +4,10 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **mfa_required** | **Boolean** |  | [optional] |
 | **user** | [**AuthUser**](AuthUser.md) |  | [optional] |
 | **tokens** | [**AuthTokens**](AuthTokens.md) |  | [optional] |
+| **mfa_challenge** | [**AuthLoginResultMfaChallenge**](AuthLoginResultMfaChallenge.md) |  | [optional] |
 | **is_new_user** | **Boolean** |  | [optional] |
 
 ## Example
@@ -14,8 +16,10 @@
 require 'zyphr'
 
 instance = Zyphr::MagicLinkVerifyResponseData.new(
+  mfa_required: null,
   user: null,
   tokens: null,
+  mfa_challenge: null,
   is_new_user: null
 )
 ```

data/docs/SubscribersApi.md

@@ -101,7 +101,7 @@ end
 
 Create or update a subscriber
 
-Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated.
+Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated; fields you omit keep their existing values. A new subscriber's timezone defaults to UTC and locale to en.
 
 ### Examples
 

data/lib/zyphr/api/auth_email_templates_api.rb

@@ -20,7 +20,7 @@ module Zyphr
       @api_client = api_client
     end
     # Bulk-upsert auth email templates
-    # Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
+    # Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
     # @param bulk_upsert_auth_email_templates_request [BulkUpsertAuthEmailTemplatesRequest] 
     # @param [Hash] opts the optional parameters
     # @return [BulkUpsertAuthEmailTemplatesResponse]
@@ -30,7 +30,7 @@ module Zyphr
     end
 
     # Bulk-upsert auth email templates
-    # Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
+    # Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
     # @param bulk_upsert_auth_email_templates_request [BulkUpsertAuthEmailTemplatesRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(BulkUpsertAuthEmailTemplatesResponse, Integer, Hash)>] BulkUpsertAuthEmailTemplatesResponse data, response status code and response headers

data/lib/zyphr/api/auth_magic_links_api.rb

@@ -88,7 +88,7 @@ module Zyphr
     end
 
     # Verify a magic link
-    # Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+    # Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
     # @param magic_link_verify_request [MagicLinkVerifyRequest] 
     # @param [Hash] opts the optional parameters
     # @return [MagicLinkVerifyResponse]
@@ -98,7 +98,7 @@ module Zyphr
     end
 
     # Verify a magic link
-    # Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+    # Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
     # @param magic_link_verify_request [MagicLinkVerifyRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(MagicLinkVerifyResponse, Integer, Hash)>] MagicLinkVerifyResponse data, response status code and response headers

data/lib/zyphr/api/auth_user_directory_api.rb

@@ -334,7 +334,7 @@ module Zyphr
     end
 
     # Pre-provision (invite) an end user (server-side admin)
-    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
     # @param invite_end_user_request [InviteEndUserRequest] 
     # @param [Hash] opts the optional parameters
     # @return [InviteEndUser200Response]
@@ -344,7 +344,7 @@ module Zyphr
     end
 
     # Pre-provision (invite) an end user (server-side admin)
-    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
     # @param invite_end_user_request [InviteEndUserRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(InviteEndUser200Response, Integer, Hash)>] InviteEndUser200Response data, response status code and response headers

data/lib/zyphr/api/subscribers_api.rb

@@ -86,7 +86,7 @@ module Zyphr
     end
 
     # Create or update a subscriber
-    # Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated.
+    # Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated; fields you omit keep their existing values. A new subscriber's timezone defaults to UTC and locale to en.
     # @param create_subscriber_request [CreateSubscriberRequest] 
     # @param [Hash] opts the optional parameters
     # @return [SubscriberResponse]
@@ -96,7 +96,7 @@ module Zyphr
     end
 
     # Create or update a subscriber
-    # Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated.
+    # Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated; fields you omit keep their existing values. A new subscriber's timezone defaults to UTC and locale to en.
     # @param create_subscriber_request [CreateSubscriberRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(SubscriberResponse, Integer, Hash)>] SubscriberResponse data, response status code and response headers

data/lib/zyphr/models/auth_email_type.rb

@@ -18,9 +18,11 @@ module Zyphr
     MAGIC_LINK = "magic_link".freeze
     PASSWORD_RESET = "password_reset".freeze
     EMAIL_VERIFICATION = "email_verification".freeze
+    EMAIL_OTP = "email_otp".freeze
+    INVITATION = "invitation".freeze
 
     def self.all_vars
-      @all_vars ||= [MAGIC_LINK, PASSWORD_RESET, EMAIL_VERIFICATION].freeze
+      @all_vars ||= [MAGIC_LINK, PASSWORD_RESET, EMAIL_VERIFICATION, EMAIL_OTP, INVITATION].freeze
     end
 
     # Builds the enum from string

data/lib/zyphr/models/bulk_upsert_auth_email_templates_request.rb

@@ -14,7 +14,7 @@ require 'date'
 require 'time'
 
 module Zyphr
-  # Atomic upsert of any subset of magic_link, password_reset, email_verification. At least one entry must be provided. 
+  # Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. At least one entry must be provided. 
   class BulkUpsertAuthEmailTemplatesRequest
     attr_accessor :magic_link
 
@@ -22,12 +22,18 @@ module Zyphr
 
     attr_accessor :email_verification
 
+    attr_accessor :email_otp
+
+    attr_accessor :invitation
+
     # Attribute mapping from ruby-style variable name to JSON key.
     def self.attribute_map
       {
         :'magic_link' => :'magic_link',
         :'password_reset' => :'password_reset',
-        :'email_verification' => :'email_verification'
+        :'email_verification' => :'email_verification',
+        :'email_otp' => :'email_otp',
+        :'invitation' => :'invitation'
       }
     end
 
@@ -46,7 +52,9 @@ module Zyphr
       {
         :'magic_link' => :'UpsertAuthEmailTemplateRequest',
         :'password_reset' => :'UpsertAuthEmailTemplateRequest',
-        :'email_verification' => :'UpsertAuthEmailTemplateRequest'
+        :'email_verification' => :'UpsertAuthEmailTemplateRequest',
+        :'email_otp' => :'UpsertAuthEmailTemplateRequest',
+        :'invitation' => :'UpsertAuthEmailTemplateRequest'
       }
     end
 
@@ -83,6 +91,14 @@ module Zyphr
       if attributes.key?(:'email_verification')
         self.email_verification = attributes[:'email_verification']
       end
+
+      if attributes.key?(:'email_otp')
+        self.email_otp = attributes[:'email_otp']
+      end
+
+      if attributes.key?(:'invitation')
+        self.invitation = attributes[:'invitation']
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -107,7 +123,9 @@ module Zyphr
       self.class == o.class &&
           magic_link == o.magic_link &&
           password_reset == o.password_reset &&
-          email_verification == o.email_verification
+          email_verification == o.email_verification &&
+          email_otp == o.email_otp &&
+          invitation == o.invitation
     end
 
     # @see the `==` method
@@ -119,7 +137,7 @@ module Zyphr
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [magic_link, password_reset, email_verification].hash
+      [magic_link, password_reset, email_verification, email_otp, invitation].hash
     end
 
     # Builds the object from hash

data/lib/zyphr/models/invite_end_user200_response_data.rb

@@ -20,10 +20,10 @@ module Zyphr
     # True when a new user was provisioned; false when an existing user was reused (idempotent on email).
     attr_accessor :created
 
-    # True when a magic-link or password-reset email was successfully dispatched.
+    # True when the requested invitation, magic-link or password-reset email was successfully dispatched.
     attr_accessor :link_sent
 
-    # Present only when `send_link` was requested and `link_sent` is false — explains why, so a caller can distinguish \"suppressed by design\" from \"delivery failed\".  Known values:  - `identity_has_other_auth_methods` — the identity has no password but does have a   linked OAuth provider and/or a passkey, so it is not locked out and no   set-password link is sent. The attempt is recorded as a suppressed message,   visible via `GET /emails`. - `user_not_found_in_environment` — the identity could not be resolved in the   calling environment (a race; it was created or resolved immediately prior). - `recipient_not_allowlisted` — the application's `test_recipients` allowlist   blocked the recipient. - `send_failed` — dispatch was attempted and failed with no more specific code.  Not a closed set: a mail-provider error code may be surfaced verbatim, so treat an unrecognised value as a generic failure rather than an error. 
+    # Present only when `send_link` was requested and `link_sent` is false — explains why, so a caller can distinguish \"suppressed by design\" from \"delivery failed\".  Known values:  - `identity_has_other_auth_methods` — the identity has no password but does have a   linked OAuth provider and/or a passkey, so it is not locked out and no   set-password link is sent. The attempt is recorded as a suppressed message,   visible via `GET /emails`.   (For `send_link: \"invitation\"` the reason is returned here only; no   suppressed message is recorded.) - `user_has_password` — `send_link: \"invitation\"` only: the identity already has   a password, so there is nothing to accept. Use `password_reset` to send a reset. - `user_not_found_in_environment` — the identity could not be resolved in the   calling environment (a race; it was created or resolved immediately prior). - `recipient_not_allowlisted` — the application's `test_recipients` allowlist   blocked the recipient. - `send_failed` — dispatch was attempted and failed with no more specific code.  Not a closed set: a mail-provider error code may be surfaced verbatim, so treat an unrecognised value as a generic failure rather than an error. 
     attr_accessor :link_suppressed_reason
 
     # Attribute mapping from ruby-style variable name to JSON key.

data/lib/zyphr/models/invite_end_user_request.rb

@@ -143,7 +143,7 @@ module Zyphr
     def valid?
       warn '[DEPRECATED] the `valid?` method is obsolete'
       return false if @email.nil?
-      send_link_validator = EnumAttributeValidator.new('String', ["magic", "password_reset", "none"])
+      send_link_validator = EnumAttributeValidator.new('String', ["invitation", "magic", "password_reset", "none"])
       return false unless send_link_validator.valid?(@send_link)
       true
     end
@@ -161,7 +161,7 @@ module Zyphr
     # Custom attribute writer method checking allowed values (enum).
     # @param [Object] send_link Object to be assigned
     def send_link=(send_link)
-      validator = EnumAttributeValidator.new('String', ["magic", "password_reset", "none"])
+      validator = EnumAttributeValidator.new('String', ["invitation", "magic", "password_reset", "none"])
       unless validator.valid?(send_link)
         fail ArgumentError, "invalid value for \"send_link\", must be one of #{validator.allowable_values}."
       end

data/lib/zyphr/models/magic_link_verify_response_data.rb

@@ -15,17 +15,23 @@ require 'time'
 
 module Zyphr
   class MagicLinkVerifyResponseData
+    attr_accessor :mfa_required
+
     attr_accessor :user
 
     attr_accessor :tokens
 
+    attr_accessor :mfa_challenge
+
     attr_accessor :is_new_user
 
     # Attribute mapping from ruby-style variable name to JSON key.
     def self.attribute_map
       {
+        :'mfa_required' => :'mfa_required',
         :'user' => :'user',
         :'tokens' => :'tokens',
+        :'mfa_challenge' => :'mfa_challenge',
         :'is_new_user' => :'is_new_user'
       }
     end
@@ -43,8 +49,10 @@ module Zyphr
     # Attribute type mapping.
     def self.openapi_types
       {
+        :'mfa_required' => :'Boolean',
         :'user' => :'AuthUser',
         :'tokens' => :'AuthTokens',
+        :'mfa_challenge' => :'AuthLoginResultMfaChallenge',
         :'is_new_user' => :'Boolean'
       }
     end
@@ -58,7 +66,7 @@ module Zyphr
     # List of class defined in allOf (OpenAPI v3)
     def self.openapi_all_of
       [
-      :'AuthResult'
+      :'AuthLoginResult'
       ]
     end
 
@@ -78,6 +86,10 @@ module Zyphr
         h[k.to_sym] = v
       }
 
+      if attributes.key?(:'mfa_required')
+        self.mfa_required = attributes[:'mfa_required']
+      end
+
       if attributes.key?(:'user')
         self.user = attributes[:'user']
       end
@@ -86,6 +98,10 @@ module Zyphr
         self.tokens = attributes[:'tokens']
       end
 
+      if attributes.key?(:'mfa_challenge')
+        self.mfa_challenge = attributes[:'mfa_challenge']
+      end
+
       if attributes.key?(:'is_new_user')
         self.is_new_user = attributes[:'is_new_user']
       end
@@ -111,8 +127,10 @@ module Zyphr
     def ==(o)
       return true if self.equal?(o)
       self.class == o.class &&
+          mfa_required == o.mfa_required &&
           user == o.user &&
           tokens == o.tokens &&
+          mfa_challenge == o.mfa_challenge &&
           is_new_user == o.is_new_user
     end
 
@@ -125,7 +143,7 @@ module Zyphr
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [user, tokens, is_new_user].hash
+      [mfa_required, user, tokens, mfa_challenge, is_new_user].hash
     end
 
     # Builds the object from hash

data/spec/api/auth_email_templates_api_spec.rb

@@ -34,7 +34,7 @@ describe 'AuthEmailTemplatesApi' do
 
   # unit tests for bulk_upsert_auth_email_templates
   # Bulk-upsert auth email templates
-  # Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
+  # Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
   # @param bulk_upsert_auth_email_templates_request 
   # @param [Hash] opts the optional parameters
   # @return [BulkUpsertAuthEmailTemplatesResponse]

data/spec/api/auth_magic_links_api_spec.rb

@@ -46,7 +46,7 @@ describe 'AuthMagicLinksApi' do
 
   # unit tests for verify_magic_link
   # Verify a magic link
-  # Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+  # Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
   # @param magic_link_verify_request 
   # @param [Hash] opts the optional parameters
   # @return [MagicLinkVerifyResponse]

data/spec/api/auth_user_directory_api_spec.rb

@@ -94,7 +94,7 @@ describe 'AuthUserDirectoryApi' do
 
   # unit tests for invite_end_user
   # Pre-provision (invite) an end user (server-side admin)
-  # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+  # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
   # @param invite_end_user_request 
   # @param [Hash] opts the optional parameters
   # @return [InviteEndUser200Response]

data/spec/api/subscribers_api_spec.rb

@@ -45,7 +45,7 @@ describe 'SubscribersApi' do
 
   # unit tests for create_subscriber
   # Create or update a subscriber
-  # Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated.
+  # Upsert a subscriber by external_id. If a subscriber with the given external_id already exists, it will be updated; fields you omit keep their existing values. A new subscriber's timezone defaults to UTC and locale to en.
   # @param create_subscriber_request 
   # @param [Hash] opts the optional parameters
   # @return [SubscriberResponse]

data/spec/models/bulk_upsert_auth_email_templates_request_spec.rb

@@ -45,4 +45,16 @@ describe Zyphr::BulkUpsertAuthEmailTemplatesRequest do
     end
   end
 
+  describe 'test attribute "email_otp"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  describe 'test attribute "invitation"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
 end

data/spec/models/invite_end_user_request_spec.rb

@@ -48,7 +48,7 @@ describe Zyphr::InviteEndUserRequest do
   describe 'test attribute "send_link"' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
-      # validator = Petstore::EnumTest::EnumAttributeValidator.new('String', ["magic", "password_reset", "none"])
+      # validator = Petstore::EnumTest::EnumAttributeValidator.new('String', ["invitation", "magic", "password_reset", "none"])
       # validator.allowable_values.each do |value|
       #   expect { instance.send_link = value }.not_to raise_error
       # end

data/spec/models/magic_link_verify_response_data_spec.rb

@@ -27,6 +27,12 @@ describe Zyphr::MagicLinkVerifyResponseData do
     end
   end
 
+  describe 'test attribute "mfa_required"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   describe 'test attribute "user"' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
@@ -39,6 +45,12 @@ describe Zyphr::MagicLinkVerifyResponseData do
     end
   end
 
+  describe 'test attribute "mfa_challenge"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   describe 'test attribute "is_new_user"' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/

data/zyphr.gemspec

@@ -17,7 +17,7 @@ require "zyphr/version"
 
 Gem::Specification.new do |s|
   s.name        = "zyphr"
-  s.version = '0.1.64'
+  s.version = '0.1.66'
   s.platform    = Gem::Platform::RUBY
   s.authors     = ["Zyphr"]
   s.email       = ["support@zyphr.dev"]