@amerged/ohmyhost-mcp 0.1.47 → 0.1.49

package/src/packages/sdk-ts/src/generated/sdk.gen.ts

@@ -6105,11 +6105,12 @@ export const streamOperationEvents = <ThrowOnError extends boolean = true>(
 /**
  * List audit events
  *
- * Returns events visible to the authenticated organization in stable descending order.
+ * Returns events visible in an authorized workspace in stable descending order. Select a workspace when the credential has multiple workspaces and no active workspace context.
  */
 export const listAuditEvents = <ThrowOnError extends boolean = true>(
   parameters?: {
     "X-Request-Id"?: string;
+    organization_id?: Ulid;
     project_id?: Ulid;
     operation_id?: Ulid;
     cursor?: string;
@@ -6123,6 +6124,7 @@ export const listAuditEvents = <ThrowOnError extends boolean = true>(
       {
         args: [
           { in: "headers", key: "X-Request-Id" },
+          { in: "query", key: "organization_id" },
           { in: "query", key: "project_id" },
           { in: "query", key: "operation_id" },
           { in: "query", key: "cursor" },

package/src/packages/sdk-ts/src/generated/types.gen.ts

@@ -10188,6 +10188,10 @@ export type ListAuditEventsData = {
   };
   path?: never;
   query?: {
+    /**
+     * Authorized workspace to query; defaults to the active or only workspace.
+     */
+    organization_id?: Ulid;
     /**
      * Restricts the page to one visible project.
      */

package/src/packages/workos-auth-contracts/src/tokens.ts

@@ -56,6 +56,7 @@ export interface WorkosConnectUserClaims {
   readonly issuedAt: number;
   readonly notBefore?: number;
   readonly scopes: readonly string[];
+  readonly authorizationRestriction?: Readonly<Record<string, readonly string[]>>;
 }
 
 export interface WorkosRsaJwk {
@@ -186,6 +187,26 @@ export function parseWorkosTokenClaims(
       throw new WorkosContractError("invalid_consent", "Connect consent identifier is invalid");
     }
     const tokenId = expectString(input["jti"], "jti", { optional: true });
+    const restriction = input["ohmyhost_authorization"];
+    let authorizationRestriction: Record<string, readonly string[]> | undefined;
+    if (restriction !== undefined) {
+      const raw = expectRecord(restriction, "invalid_claim");
+      const keys = ["actions", "organizationIds", "projectIds", "mailDomainIds"];
+      authorizationRestriction = {};
+      for (const [key, value] of Object.entries(raw)) {
+        if (
+          !keys.includes(key) ||
+          !Array.isArray(value) ||
+          value.length > 1000 ||
+          !value.every((item) => typeof item === "string" && item.length > 0 && item.length <= 128)
+        )
+          throw new WorkosContractError(
+            "invalid_claim",
+            "Token authorization restriction is invalid",
+          );
+        authorizationRestriction[key] = [...new Set(value as string[])].sort();
+      }
+    }
     return {
       kind,
       ...common,
@@ -196,6 +217,7 @@ export function parseWorkosTokenClaims(
       ...(tokenId === undefined ? {} : { tokenId }),
       ...(notBefore === undefined ? {} : { notBefore }),
       scopes: parseScopes(input["scope"]),
+      ...(authorizationRestriction === undefined ? {} : { authorizationRestriction }),
     };
   }
   if (kind === "m2m") {