@apito-io/js-admin-sdk 2.5.0 → 2.7.0

package/README.md

@@ -151,11 +151,13 @@ These calls use the same admin client and system GraphQL endpoint as the rest of
 
 | Method | Description |
 |--------|-------------|
-| `searchTenantUsers(projectId, limit?, offset?)` | List users registered for a project. |
+| `searchTenantUsers(projectId, limit?, offset?)` | List users registered for a project (each row has `email`, `phone`, `tenant_id`). |
 | `searchTenantsByDomain(projectId, domain)` | Exact domain lookup in project scope; returns `{ tenant }` (null if no match). |
-| `createTenantUser(projectId, username, email, password, role)` | Create a local-password user in project scope. |
-| `loginTenantUser(username, password, projectId)` | Password login in project scope; response may include a tenant-scoped token. |
-| `loginTenantUserGoogle(projectId, idToken)` | Google ID token login in project scope. |
+| `createTenantUser(projectId, params)` | Create a local-password user; `params`: `{ password, role?, email?, phone? }` (engine validates required identifier per project). |
+| `loginTenantUser(params)` | General: `{ projectId, password, email? or phone? }`. Google OAuth **code** flow: **`tenantGoogleOAuthState(projectId)`** then redirect; on callback **`loginTenantUser({ projectId, authMethod: 'google', code, state })`**. |
+| `tenantGoogleOAuthState(projectId)` | Returns **`{ state }`** for the Google authorize URL (project must have client id, secret, redirect URI configured). |
+| `updateTenantUser(userId, params)` | Mutate `email`, `phone`, `password`, and/or `role` (omit fields you do not want to send). |
+| `deleteTenantUser(userId)` | Remove a tenant catalog user. |
 
 On the engine system GraphQL API, `createTenant` accepts an optional `domain`; when set, the domain must be unused in the project (otherwise the mutation fails). `updateTenant` enforces the same when setting `domain` to a non-empty value. Call those mutations via `executeGraphQL` if needed.
 
@@ -163,9 +165,17 @@ On the engine system GraphQL API, `createTenant` accepts an optional `domain`; w
 const projectId = 'your-project-id';
 
 const { users, count } = await client.searchTenantUsers(projectId, 50, 0);
-console.log('users:', count, users.map((u) => u.username));
+console.log(
+  'users:',
+  count,
+  users.map((u) => u.email || u.phone || u.id),
+);
 
-const login = await client.loginTenantUser('admin', 'your-password', projectId);
+const login = await client.loginTenantUser({
+  projectId,
+  password: 'your-password',
+  email: 'user@example.com', // use phone: '+15551234567' when project is phone mode
+});
 if (login.token) {
   console.log('tenant-scoped token:', login.token);
 }
@@ -361,7 +371,7 @@ npm install
 npm start
 ```
 
-Pro tenant-user listing (optional `APITO_TENANT_USERNAME` / `APITO_TENANT_PASSWORD` for login):
+Pro tenant-user listing (optional `APITO_TENANT_EMAIL` / `APITO_TENANT_PHONE` + `APITO_TENANT_PASSWORD` for login):
 
 ```bash
 cd examples/tenant_users

package/dist/index.d.mts

@@ -72,8 +72,8 @@ interface CreateAndUpdateRequest {
 /** Tenant catalog user from engine system DB (pro_tenant_users). */
 interface TenantUser {
     id: string;
-    username: string;
     email?: string;
+    phone?: string;
     role: string;
     tenant_id: string;
     provider?: string;
@@ -81,6 +81,36 @@ interface TenantUser {
     created_at?: string;
     updated_at?: string;
 }
+/** Login via system GraphQL `loginTenantUser`. Password path: use `email` or `phone` per project settings. Google OAuth code path: `authMethod: 'google'`, `code`, `state` from redirect (get `state` first via `tenantGoogleOAuthState`). */
+interface TenantLoginParams {
+    projectId: string;
+    /** Required for general (password) login. */
+    password?: string;
+    email?: string;
+    phone?: string;
+    /** `general` (default) or `google`. */
+    authMethod?: string;
+    /** Google authorization code (with `authMethod: 'google'`). */
+    code?: string;
+    /** OAuth state from `tenantGoogleOAuthState` or callback (with `authMethod: 'google'`). */
+    state?: string;
+}
+interface TenantGoogleOAuthStateResponse {
+    state: string;
+}
+interface CreateTenantUserParams {
+    password: string;
+    role?: string;
+    email?: string;
+    phone?: string;
+}
+/** Optional fields for `updateTenantUser`; omitted keys are not sent. */
+interface UpdateTenantUserParams {
+    email?: string;
+    phone?: string;
+    password?: string;
+    role?: string;
+}
 interface TenantLoginResponse {
     token: string;
     user?: TenantUser;
@@ -129,11 +159,13 @@ interface InjectedDBOperationInterface {
     }): Promise<GraphQLResponse>;
     /** @param token Legacy; ignored. Auth uses client API key. */
     generateTenantToken(tenantId: string, duration?: string, role?: string): Promise<string>;
-    loginTenantUser(username: string, password: string, projectId: string): Promise<TenantLoginResponse>;
-    loginTenantUserGoogle(projectId: string, idToken: string): Promise<TenantLoginResponse>;
+    loginTenantUser(params: TenantLoginParams): Promise<TenantLoginResponse>;
+    tenantGoogleOAuthState(projectId: string): Promise<TenantGoogleOAuthStateResponse>;
     searchTenantUsers(projectId: string, limit?: number, offset?: number): Promise<TenantUsersResponse>;
     searchTenantsByDomain(projectId: string, domain: string): Promise<TenantByDomainResponse>;
-    createTenantUser(projectId: string, username: string, email: string, password: string, role: string): Promise<TenantUser>;
+    createTenantUser(projectId: string, params: CreateTenantUserParams): Promise<TenantUser>;
+    updateTenantUser(userId: string, params: UpdateTenantUserParams): Promise<TenantUser>;
+    deleteTenantUser(userId: string): Promise<boolean>;
     getSingleResource(model: string, id: string, singlePageData?: boolean): Promise<DefaultDocumentStructure>;
     searchResources(model: string, filter?: Record<string, any>, aggregate?: boolean): Promise<SearchResult>;
     getRelationDocuments(id: string, connection: Record<string, any>): Promise<SearchResult>;
@@ -191,13 +223,15 @@ declare class ApitoClient implements InjectedDBOperationInterface {
      */
     generateTenantToken(tenantId: string, duration?: string, role?: string): Promise<string>;
     /**
-     * Tenant catalog login (system GraphQL). Returns a tenant-scoped `ak_` API token on success.
+     * Tenant catalog login (system GraphQL `loginTenantUser`). Password path: pass `password` and `email` or `phone` per project Authentication settings. Google OAuth path: `authMethod: 'google'` with `code` and `state` from the redirect; call `tenantGoogleOAuthState(projectId)` before opening Google to obtain `state`.
      */
-    loginTenantUser(username: string, password: string, projectId: string): Promise<TenantLoginResponse>;
+    loginTenantUser(params: TenantLoginParams): Promise<TenantLoginResponse>;
     /**
-     * Google ID token login for tenant users (project must have google_client_id set).
+     * Signed OAuth state for tenant Google login (system query `tenantGoogleOAuthState`). Use in the authorize URL together with project `google_client_id` and the configured redirect URI.
      */
-    loginTenantUserGoogle(projectId: string, idToken: string): Promise<TenantLoginResponse>;
+    tenantGoogleOAuthState(projectId: string): Promise<{
+        state: string;
+    }>;
     /**
      * Search tenant users for a project.
      */
@@ -207,9 +241,17 @@ declare class ApitoClient implements InjectedDBOperationInterface {
      */
     searchTenantsByDomain(projectId: string, domain: string): Promise<TenantByDomainResponse>;
     /**
-     * Create a tenant catalog user (local password).
+     * Create a tenant catalog user (local password). Use `email` and/or `phone` per engine validation for the project identifier mode.
+     */
+    createTenantUser(projectId: string, params: CreateTenantUserParams): Promise<TenantUser>;
+    /**
+     * Update a tenant catalog user. Project scope is implied by the API key. Only include fields to change.
+     */
+    updateTenantUser(userId: string, params: UpdateTenantUserParams): Promise<TenantUser>;
+    /**
+     * Delete a tenant catalog user by id. Project scope is implied by the API key.
      */
-    createTenantUser(projectId: string, username: string, email: string, password: string, role: string): Promise<TenantUser>;
+    deleteTenantUser(userId: string): Promise<boolean>;
     /**
      * Get a single resource by model and ID
      */
@@ -277,10 +319,10 @@ declare class TypedOperations {
 /**
  * Apito JavaScript internal SDK version (kept in sync with package.json for releases)
  */
-declare const Version = "2.5.0";
+declare const Version = "2.7.0";
 /**
  * GetVersion returns the current version of the SDK
  */
 declare function getVersion(): string;
 
-export { ApitoClient, ApitoError, type ClientConfig, type ConnectionOptions, type CreateAndUpdateRequest, type DefaultDocumentStructure, type Filter, GraphQLError, type GraphQLErrorLocation, type GraphQLResponse, type InjectedDBOperationInterface, type MetaField, type RequestOptions, type SearchOptions, type SearchResult, type TenantByDomainResponse, type TenantCatalogSearchRow, type TenantLoginResponse, type TenantUser, type TenantUsersResponse, type TypedDocumentStructure, TypedOperations, type TypedSearchResult, ValidationError, Version, createClient, ApitoClient as default, getVersion };
+export { ApitoClient, ApitoError, type ClientConfig, type ConnectionOptions, type CreateAndUpdateRequest, type CreateTenantUserParams, type DefaultDocumentStructure, type Filter, GraphQLError, type GraphQLErrorLocation, type GraphQLResponse, type InjectedDBOperationInterface, type MetaField, type RequestOptions, type SearchOptions, type SearchResult, type TenantByDomainResponse, type TenantCatalogSearchRow, type TenantGoogleOAuthStateResponse, type TenantLoginParams, type TenantLoginResponse, type TenantUser, type TenantUsersResponse, type TypedDocumentStructure, TypedOperations, type TypedSearchResult, type UpdateTenantUserParams, ValidationError, Version, createClient, ApitoClient as default, getVersion };

package/dist/index.d.ts

@@ -72,8 +72,8 @@ interface CreateAndUpdateRequest {
 /** Tenant catalog user from engine system DB (pro_tenant_users). */
 interface TenantUser {
     id: string;
-    username: string;
     email?: string;
+    phone?: string;
     role: string;
     tenant_id: string;
     provider?: string;
@@ -81,6 +81,36 @@ interface TenantUser {
     created_at?: string;
     updated_at?: string;
 }
+/** Login via system GraphQL `loginTenantUser`. Password path: use `email` or `phone` per project settings. Google OAuth code path: `authMethod: 'google'`, `code`, `state` from redirect (get `state` first via `tenantGoogleOAuthState`). */
+interface TenantLoginParams {
+    projectId: string;
+    /** Required for general (password) login. */
+    password?: string;
+    email?: string;
+    phone?: string;
+    /** `general` (default) or `google`. */
+    authMethod?: string;
+    /** Google authorization code (with `authMethod: 'google'`). */
+    code?: string;
+    /** OAuth state from `tenantGoogleOAuthState` or callback (with `authMethod: 'google'`). */
+    state?: string;
+}
+interface TenantGoogleOAuthStateResponse {
+    state: string;
+}
+interface CreateTenantUserParams {
+    password: string;
+    role?: string;
+    email?: string;
+    phone?: string;
+}
+/** Optional fields for `updateTenantUser`; omitted keys are not sent. */
+interface UpdateTenantUserParams {
+    email?: string;
+    phone?: string;
+    password?: string;
+    role?: string;
+}
 interface TenantLoginResponse {
     token: string;
     user?: TenantUser;
@@ -129,11 +159,13 @@ interface InjectedDBOperationInterface {
     }): Promise<GraphQLResponse>;
     /** @param token Legacy; ignored. Auth uses client API key. */
     generateTenantToken(tenantId: string, duration?: string, role?: string): Promise<string>;
-    loginTenantUser(username: string, password: string, projectId: string): Promise<TenantLoginResponse>;
-    loginTenantUserGoogle(projectId: string, idToken: string): Promise<TenantLoginResponse>;
+    loginTenantUser(params: TenantLoginParams): Promise<TenantLoginResponse>;
+    tenantGoogleOAuthState(projectId: string): Promise<TenantGoogleOAuthStateResponse>;
     searchTenantUsers(projectId: string, limit?: number, offset?: number): Promise<TenantUsersResponse>;
     searchTenantsByDomain(projectId: string, domain: string): Promise<TenantByDomainResponse>;
-    createTenantUser(projectId: string, username: string, email: string, password: string, role: string): Promise<TenantUser>;
+    createTenantUser(projectId: string, params: CreateTenantUserParams): Promise<TenantUser>;
+    updateTenantUser(userId: string, params: UpdateTenantUserParams): Promise<TenantUser>;
+    deleteTenantUser(userId: string): Promise<boolean>;
     getSingleResource(model: string, id: string, singlePageData?: boolean): Promise<DefaultDocumentStructure>;
     searchResources(model: string, filter?: Record<string, any>, aggregate?: boolean): Promise<SearchResult>;
     getRelationDocuments(id: string, connection: Record<string, any>): Promise<SearchResult>;
@@ -191,13 +223,15 @@ declare class ApitoClient implements InjectedDBOperationInterface {
      */
     generateTenantToken(tenantId: string, duration?: string, role?: string): Promise<string>;
     /**
-     * Tenant catalog login (system GraphQL). Returns a tenant-scoped `ak_` API token on success.
+     * Tenant catalog login (system GraphQL `loginTenantUser`). Password path: pass `password` and `email` or `phone` per project Authentication settings. Google OAuth path: `authMethod: 'google'` with `code` and `state` from the redirect; call `tenantGoogleOAuthState(projectId)` before opening Google to obtain `state`.
      */
-    loginTenantUser(username: string, password: string, projectId: string): Promise<TenantLoginResponse>;
+    loginTenantUser(params: TenantLoginParams): Promise<TenantLoginResponse>;
     /**
-     * Google ID token login for tenant users (project must have google_client_id set).
+     * Signed OAuth state for tenant Google login (system query `tenantGoogleOAuthState`). Use in the authorize URL together with project `google_client_id` and the configured redirect URI.
      */
-    loginTenantUserGoogle(projectId: string, idToken: string): Promise<TenantLoginResponse>;
+    tenantGoogleOAuthState(projectId: string): Promise<{
+        state: string;
+    }>;
     /**
      * Search tenant users for a project.
      */
@@ -207,9 +241,17 @@ declare class ApitoClient implements InjectedDBOperationInterface {
      */
     searchTenantsByDomain(projectId: string, domain: string): Promise<TenantByDomainResponse>;
     /**
-     * Create a tenant catalog user (local password).
+     * Create a tenant catalog user (local password). Use `email` and/or `phone` per engine validation for the project identifier mode.
+     */
+    createTenantUser(projectId: string, params: CreateTenantUserParams): Promise<TenantUser>;
+    /**
+     * Update a tenant catalog user. Project scope is implied by the API key. Only include fields to change.
+     */
+    updateTenantUser(userId: string, params: UpdateTenantUserParams): Promise<TenantUser>;
+    /**
+     * Delete a tenant catalog user by id. Project scope is implied by the API key.
      */
-    createTenantUser(projectId: string, username: string, email: string, password: string, role: string): Promise<TenantUser>;
+    deleteTenantUser(userId: string): Promise<boolean>;
     /**
      * Get a single resource by model and ID
      */
@@ -277,10 +319,10 @@ declare class TypedOperations {
 /**
  * Apito JavaScript internal SDK version (kept in sync with package.json for releases)
  */
-declare const Version = "2.5.0";
+declare const Version = "2.7.0";
 /**
  * GetVersion returns the current version of the SDK
  */
 declare function getVersion(): string;
 
-export { ApitoClient, ApitoError, type ClientConfig, type ConnectionOptions, type CreateAndUpdateRequest, type DefaultDocumentStructure, type Filter, GraphQLError, type GraphQLErrorLocation, type GraphQLResponse, type InjectedDBOperationInterface, type MetaField, type RequestOptions, type SearchOptions, type SearchResult, type TenantByDomainResponse, type TenantCatalogSearchRow, type TenantLoginResponse, type TenantUser, type TenantUsersResponse, type TypedDocumentStructure, TypedOperations, type TypedSearchResult, ValidationError, Version, createClient, ApitoClient as default, getVersion };
+export { ApitoClient, ApitoError, type ClientConfig, type ConnectionOptions, type CreateAndUpdateRequest, type CreateTenantUserParams, type DefaultDocumentStructure, type Filter, GraphQLError, type GraphQLErrorLocation, type GraphQLResponse, type InjectedDBOperationInterface, type MetaField, type RequestOptions, type SearchOptions, type SearchResult, type TenantByDomainResponse, type TenantCatalogSearchRow, type TenantGoogleOAuthStateResponse, type TenantLoginParams, type TenantLoginResponse, type TenantUser, type TenantUsersResponse, type TypedDocumentStructure, TypedOperations, type TypedSearchResult, type UpdateTenantUserParams, ValidationError, Version, createClient, ApitoClient as default, getVersion };

package/dist/index.js

@@ -1,18 +1,18 @@
 // @apito-io/js-admin-sdk - Admin SDK for Apito GraphQL API
-var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var w=Object.getPrototypeOf,b=Object.prototype.hasOwnProperty;var x=(i,e)=>{for(var t in e)m(i,t,{get:e[t],enumerable:!0})},f=(i,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of $(e))!b.call(i,n)&&n!==t&&m(i,n,{get:()=>e[n],enumerable:!(r=D(e,n))||r.enumerable});return i};var U=(i,e,t)=>(t=i!=null?S(w(i)):{},f(e||!i||!i.__esModule?m(t,"default",{value:i,enumerable:!0}):t,i)),v=i=>f(m({},"__esModule",{value:!0}),i);var I={};x(I,{ApitoClient:()=>l,ApitoError:()=>u,GraphQLError:()=>g,TypedOperations:()=>y,ValidationError:()=>o,Version:()=>_,createClient:()=>T,default:()=>l,getVersion:()=>R});module.exports=v(I);var h=U(require("axios"));var u=class extends Error{constructor(t,r,n,s){super(t);this.code=r;this.statusCode=n;this.details=s;this.name="ApitoError"}},g=class extends u{constructor(t,r,n){super(t,"GRAPHQL_ERROR");this.graphQLErrors=r;this.response=n;this.name="GraphQLError"}get partialData(){return this.response?.data}},o=class extends u{constructor(t,r){super(t,"VALIDATION_ERROR");this.field=r;this.name="ValidationError"}};var l=class{constructor(e){this.baseURL=e.baseURL,this.apiKey=e.apiKey,this.tenantId=e.tenantId,this.httpClient=h.default.create({timeout:e.timeout||3e4,headers:{"Content-Type":"application/json",...this.apiKey.startsWith("cli-")||this.apiKey.startsWith("sdk-")?{"X-Apito-Sync-Key":this.apiKey}:{"X-Apito-Key":this.apiKey}},...e.httpClient}),this.tenantId&&(this.httpClient.defaults.headers["X-Apito-Tenant-ID"]=this.tenantId)}async executeGraphQL(e,t,r){try{let n={query:e,variables:t||{}},s={"Content-Type":"application/json",...this.apiKey.startsWith("cli-")||this.apiKey.startsWith("sdk-")?{"X-Apito-Sync-Key":this.apiKey}:{"X-Apito-Key":this.apiKey}};(r?.tenantId||this.tenantId)&&(s["X-Apito-Tenant-ID"]=r?.tenantId||this.tenantId);let a=await this.httpClient.post(this.baseURL,n,{headers:s});if(a.data.errors&&a.data.errors.length>0)throw new g("GraphQL query failed",a.data.errors,a.data);return a.data}catch(n){throw h.default.isAxiosError(n)?new u(n.response?.data?.message||n.message,"HTTP_ERROR",n.response?.status,n.response?.data):n}}async generateTenantToken(e,t,r){let n=(t??"").trim();if(!n){let c=new Date;n=`${c.getUTCFullYear()+1}-${String(c.getUTCMonth()+1).padStart(2,"0")}-${String(c.getUTCDate()).padStart(2,"0")}`}let s=`
+var S=Object.create;var m=Object.defineProperty;var $=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var U=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var b=(i,e)=>{for(var t in e)m(i,t,{get:e[t],enumerable:!0})},_=(i,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of D(e))!x.call(i,n)&&n!==t&&m(i,n,{get:()=>e[n],enumerable:!(r=$(e,n))||r.enumerable});return i};var P=(i,e,t)=>(t=i!=null?S(U(i)):{},_(e||!i||!i.__esModule?m(t,"default",{value:i,enumerable:!0}):t,i)),v=i=>_(m({},"__esModule",{value:!0}),i);var I={};b(I,{ApitoClient:()=>l,ApitoError:()=>u,GraphQLError:()=>g,TypedOperations:()=>h,ValidationError:()=>o,Version:()=>f,createClient:()=>R,default:()=>l,getVersion:()=>w});module.exports=v(I);var y=P(require("axios"));var u=class extends Error{constructor(t,r,n,a){super(t);this.code=r;this.statusCode=n;this.details=a;this.name="ApitoError"}},g=class extends u{constructor(t,r,n){super(t,"GRAPHQL_ERROR");this.graphQLErrors=r;this.response=n;this.name="GraphQLError"}get partialData(){return this.response?.data}},o=class extends u{constructor(t,r){super(t,"VALIDATION_ERROR");this.field=r;this.name="ValidationError"}};var l=class{constructor(e){this.baseURL=e.baseURL,this.apiKey=e.apiKey,this.tenantId=e.tenantId,this.httpClient=y.default.create({timeout:e.timeout||3e4,headers:{"Content-Type":"application/json",...this.apiKey.startsWith("cli-")||this.apiKey.startsWith("sdk-")?{"X-Apito-Sync-Key":this.apiKey}:{"X-Apito-Key":this.apiKey}},...e.httpClient}),this.tenantId&&(this.httpClient.defaults.headers["X-Apito-Tenant-ID"]=this.tenantId)}async executeGraphQL(e,t,r){try{let n={query:e,variables:t||{}},a={"Content-Type":"application/json",...this.apiKey.startsWith("cli-")||this.apiKey.startsWith("sdk-")?{"X-Apito-Sync-Key":this.apiKey}:{"X-Apito-Key":this.apiKey}};(r?.tenantId||this.tenantId)&&(a["X-Apito-Tenant-ID"]=r?.tenantId||this.tenantId);let s=await this.httpClient.post(this.baseURL,n,{headers:a});if(s.data.errors&&s.data.errors.length>0)throw new g("GraphQL query failed",s.data.errors,s.data);return s.data}catch(n){throw y.default.isAxiosError(n)?new u(n.response?.data?.message||n.message,"HTTP_ERROR",n.response?.status,n.response?.data):n}}async generateTenantToken(e,t,r){let n=(t??"").trim();if(!n){let p=new Date;n=`${p.getUTCFullYear()+1}-${String(p.getUTCMonth()+1).padStart(2,"0")}-${String(p.getUTCDate()).padStart(2,"0")}`}let a=`
       mutation GenerateTenantToken($tenantId: String!, $duration: String!, $role: String) {
         generateTenantToken(tenant_id: $tenantId, duration: $duration, role: $role) {
           token
         }
       }
-    `,a={tenantId:e,duration:n,role:r!==void 0&&r.trim()!==""?r.trim():null},p=(await this.executeGraphQL(s,a,{tenantId:e})).data?.generateTenantToken;if(!p?.token)throw new o("Invalid response format for tenant token");return p.token}async loginTenantUser(e,t,r){let n=`
-      query LoginTenantUser($project_id: String!, $username: String!, $password: String!) {
-        loginTenantUser(project_id: $project_id, username: $username, password: $password) {
+    `,s={tenantId:e,duration:n,role:r!==void 0&&r.trim()!==""?r.trim():null},c=(await this.executeGraphQL(a,s,{tenantId:e})).data?.generateTenantToken;if(!c?.token)throw new o("Invalid response format for tenant token");return c.token}async loginTenantUser(e){let t=(e.authMethod??"general").trim().toLowerCase()||"general",r={project_id:e.projectId};if(t==="google"){r.auth_method="google";let d=(e.code??"").trim(),c=(e.state??"").trim();if(!d||!c)throw new o("code and state are required for Google login");r.code=d,r.state=c}else{let d=(e.password??"").trim();if(!d)throw new o("password is required");r.password=d;let c=(e.email??"").trim(),p=(e.phone??"").trim();if(!c&&!p)throw new o("email or phone is required");c&&(r.email=c),p&&(r.phone=p)}let s=(await this.executeGraphQL(`
+      query LoginTenantUser($project_id: String!, $password: String, $auth_method: String, $email: String, $phone: String, $code: String, $state: String) {
+        loginTenantUser(project_id: $project_id, password: $password, auth_method: $auth_method, email: $email, phone: $phone, code: $code, state: $state) {
           token
           user {
             id
-            username
             email
+            phone
             role
             provider
             tenant_id
@@ -22,31 +22,20 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           }
         }
       }
-    `,s={project_id:r,username:e,password:t},d=(await this.executeGraphQL(n,s)).data?.loginTenantUser;if(!d?.token)throw new o("Invalid response format for loginTenantUser");return{token:d.token,user:d.user}}async loginTenantUserGoogle(e,t){let r=`
-      mutation LoginTenantUserGoogle($project_id: String!, $id_token: String!) {
-        loginTenantUserGoogle(project_id: $project_id, id_token: $id_token) {
-          token
-          user {
-            id
-            username
-            email
-            role
-            provider
-            tenant_id
-            status
-            created_at
-            updated_at
-          }
+    `,r)).data?.loginTenantUser;if(!s?.token)throw new o("Invalid response format for loginTenantUser");return{token:s.token,user:s.user}}async tenantGoogleOAuthState(e){let t=`
+      query TenantGoogleOAuthState($project_id: String!) {
+        tenantGoogleOAuthState(project_id: $project_id) {
+          state
         }
       }
-    `,n={project_id:e,id_token:t},a=(await this.executeGraphQL(r,n)).data?.loginTenantUserGoogle;if(!a?.token)throw new o("Invalid response format for loginTenantUserGoogle");return{token:a.token,user:a.user}}async searchTenantUsers(e,t,r){let n=`
+    `,r={project_id:e},a=(await this.executeGraphQL(t,r)).data?.tenantGoogleOAuthState,s=typeof a?.state=="string"?a.state.trim():"";if(!s)throw new o("Invalid response format for tenantGoogleOAuthState");return{state:s}}async searchTenantUsers(e,t,r){let n=`
       query SearchTenantUsers($project_id: String!, $limit: Int, $offset: Int) {
         searchTenantUsers(project_id: $project_id, limit: $limit, offset: $offset) {
           count
           users {
             id
-            username
             email
+            phone
             role
             provider
             tenant_id
@@ -56,7 +45,7 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           }
         }
       }
-    `,s={project_id:e};t!==void 0&&(s.limit=t),r!==void 0&&(s.offset=r);let d=(await this.executeGraphQL(n,s)).data?.searchTenantUsers;if(!d)throw new o("Invalid response format for searchTenantUsers");let p=0;return typeof d.count=="number"&&(p=d.count),{users:d.users??[],count:p}}async searchTenantsByDomain(e,t){let r=`
+    `,a={project_id:e};t!==void 0&&(a.limit=t),r!==void 0&&(a.offset=r);let d=(await this.executeGraphQL(n,a)).data?.searchTenantUsers;if(!d)throw new o("Invalid response format for searchTenantUsers");let c=0;return typeof d.count=="number"&&(c=d.count),{users:d.users??[],count:c}}async searchTenantsByDomain(e,t){let r=`
       query SearchTenantsByDomain($project_id: String!, $domain: String!) {
         searchTenantsByDomain(project_id: $project_id, domain: $domain) {
           tenant {
@@ -68,12 +57,12 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           }
         }
       }
-    `,n={project_id:e,domain:t},a=(await this.executeGraphQL(r,n)).data?.searchTenantsByDomain;if(!a)throw new o("Invalid response format for searchTenantsByDomain");return{tenant:a.tenant??null}}async createTenantUser(e,t,r,n,s){let a=`
-      mutation CreateTenantUser($project_id: String!, $username: String!, $password: String!, $role: String, $email: String) {
-        createTenantUser(project_id: $project_id, username: $username, password: $password, role: $role, email: $email) {
+    `,n={project_id:e,domain:t},s=(await this.executeGraphQL(r,n)).data?.searchTenantsByDomain;if(!s)throw new o("Invalid response format for searchTenantsByDomain");return{tenant:s.tenant??null}}async createTenantUser(e,t){let r=(t.password??"").trim();if(!r)throw new o("password is required");let n=`
+      mutation CreateTenantUser($project_id: String!, $password: String!, $role: String, $email: String, $phone: String) {
+        createTenantUser(project_id: $project_id, password: $password, role: $role, email: $email, phone: $phone) {
           id
-          username
           email
+          phone
           role
           provider
           tenant_id
@@ -82,7 +71,25 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           updated_at
         }
       }
-    `,d={project_id:e,username:t,password:n,email:r,role:s},c=(await this.executeGraphQL(a,d)).data?.createTenantUser;if(!c?.id)throw new o("Invalid response format for createTenantUser");return c}async getSingleResource(e,t,r=!1){let n=`
+    `,a={project_id:e,password:r},s=(t.role??"").trim();s&&(a.role=s);let d=(t.email??"").trim();d&&(a.email=d);let c=(t.phone??"").trim();c&&(a.phone=c);let T=(await this.executeGraphQL(n,a)).data?.createTenantUser;if(!T?.id)throw new o("Invalid response format for createTenantUser");return T}async updateTenantUser(e,t){let r=(e??"").trim();if(!r)throw new o("userId is required");if(t.email===void 0&&t.phone===void 0&&t.password===void 0&&t.role===void 0)throw new o("at least one field must be provided");let n=`
+      mutation UpdateTenantUser($user_id: String!, $email: String, $phone: String, $password: String, $role: String) {
+        updateTenantUser(user_id: $user_id, email: $email, phone: $phone, password: $password, role: $role) {
+          id
+          email
+          phone
+          role
+          provider
+          tenant_id
+          status
+          created_at
+          updated_at
+        }
+      }
+    `,a={user_id:r};t.email!==void 0&&(a.email=t.email),t.phone!==void 0&&(a.phone=t.phone),t.password!==void 0&&(a.password=t.password),t.role!==void 0&&(a.role=t.role);let d=(await this.executeGraphQL(n,a)).data?.updateTenantUser;if(!d?.id)throw new o("Invalid response format for updateTenantUser");return d}async deleteTenantUser(e){let t=(e??"").trim();if(!t)throw new o("userId is required");let a=(await this.executeGraphQL(`
+      mutation DeleteTenantUser($user_id: String!) {
+        deleteTenantUser(user_id: $user_id)
+      }
+    `,{user_id:t})).data?.deleteTenantUser;if(typeof a!="boolean")throw new o("Invalid response format for deleteTenantUser");return a}async getSingleResource(e,t,r=!1){let n=`
       query GetSingleData($model: String, $_id: String!, $single_page_data: Boolean) {
         getSingleData(model: $model, _id: $_id, single_page_data: $single_page_data) {
           _key
@@ -100,7 +107,7 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           type
         }
       }
-    `,s={model:e,_id:t,single_page_data:r},a=await this.executeGraphQL(n,s);if(!a.data?.getSingleData)throw new o("Resource not found");return a.data.getSingleData}async searchResources(e,t={},r=!1){let n=`
+    `,a={model:e,_id:t,single_page_data:r},s=await this.executeGraphQL(n,a);if(!s.data?.getSingleData)throw new o("Resource not found");return s.data.getSingleData}async searchResources(e,t={},r=!1){let n=`
       query GetModelData(
         $model: String!
         $page: Int
@@ -133,7 +140,7 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           count
         }
       }
-    `,s={model:e};t&&typeof t=="object"&&(t._key!==void 0&&(s._key=t._key),t.page!==void 0&&(s.page=t.page),t.limit!==void 0&&(s.limit=t.limit),t.where!==void 0&&(s.where=t.where),t.search!==void 0&&(s.search=t.search));let a=await this.executeGraphQL(n,s);if(!a.data?.getModelData)throw new o("Invalid search response format");return a.data.getModelData}async getRelationDocuments(e,t){let r=`
+    `,a={model:e};t&&typeof t=="object"&&(t._key!==void 0&&(a._key=t._key),t.page!==void 0&&(a.page=t.page),t.limit!==void 0&&(a.limit=t.limit),t.where!==void 0&&(a.where=t.where),t.search!==void 0&&(a.search=t.search));let s=await this.executeGraphQL(n,a);if(!s.data?.getModelData)throw new o("Invalid search response format");return s.data.getModelData}async getRelationDocuments(e,t){let r=`
       query GetModelData($model: String!, $page: Int, $limit: Int, $where: JSON, $search: String, $connection : ListAllDataDetailedOfAModelConnectionPayload) {
         getModelData(model: $model, page: $page, limit: $limit, where: $where, search: $search, connection: $connection) {
           results {
@@ -152,7 +159,7 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           count
         }
       }
-    `,n={connection:t};if(t.model)n.model=t.model;else throw new o("model is required in connection parameters");if(t.filter){let a=t.filter;a.page!==void 0&&(n.page=a.page),a.limit!==void 0&&(n.limit=a.limit),a.where!==void 0&&(n.where=a.where),a.search!==void 0&&(n.search=a.search)}let s=await this.executeGraphQL(r,n);if(!s.data?.getModelData)throw new o("Invalid relation documents response format");return s.data.getModelData}async createNewResource(e){if(!e.model)throw new o("model is required");if(!e.payload)throw new o("payload is required");let t=`
+    `,n={connection:t};if(t.model)n.model=t.model;else throw new o("model is required in connection parameters");if(t.filter){let s=t.filter;s.page!==void 0&&(n.page=s.page),s.limit!==void 0&&(n.limit=s.limit),s.where!==void 0&&(n.where=s.where),s.search!==void 0&&(n.search=s.search)}let a=await this.executeGraphQL(r,n);if(!a.data?.getModelData)throw new o("Invalid relation documents response format");return a.data.getModelData}async createNewResource(e){if(!e.model)throw new o("model is required");if(!e.payload)throw new o("payload is required");let t=`
       mutation CreateNewData($model: String!, $single_page_data: Boolean, $payload: JSON!, $connect: JSON) {
         upsertModelData(
           connect: $connect
@@ -208,5 +215,5 @@ var S=Object.create;var m=Object.defineProperty;var D=Object.getOwnPropertyDescr
           data
         }
       }
-    `,n={stage:e,data:t};return(await this.executeGraphQL(r,n)).data?.debug}};function T(i){return new l(i)}var y=class i{constructor(e){this.client=e}static toTypedDocument(e){let t=JSON.parse(JSON.stringify(e.data));return{_key:e._key,_id:e._id,data:t,meta:e.meta,id:e.id,expire_at:e.expire_at,relation_doc_id:e.relation_doc_id,last_revision_doc_id:e.last_revision_doc_id,type:e.type,tenant_id:e.tenant_id,tenant_model:e.tenant_model}}async getSingleResourceTyped(e,t,r=!1){let n=await this.client.getSingleResource(e,t,r);return i.toTypedDocument(n)}async searchResourcesTyped(e,t={},r=!1){let n=await this.client.searchResources(e,t,r);return{results:n.results.map(s=>i.toTypedDocument(s)),count:n.count}}async getRelationDocumentsTyped(e,t){let r=await this.client.getRelationDocuments(e,t);return{results:r.results.map(n=>i.toTypedDocument(n)),count:r.count}}async createNewResourceTyped(e){let t=await this.client.createNewResource(e);return i.toTypedDocument(t)}async updateResourceTyped(e){let t=await this.client.updateResource(e);return i.toTypedDocument(t)}};var _="2.5.0";function R(){return _}0&&(module.exports={ApitoClient,ApitoError,GraphQLError,TypedOperations,ValidationError,Version,createClient,getVersion});
+    `,n={stage:e,data:t};return(await this.executeGraphQL(r,n)).data?.debug}};function R(i){return new l(i)}var h=class i{constructor(e){this.client=e}static toTypedDocument(e){let t=JSON.parse(JSON.stringify(e.data));return{_key:e._key,_id:e._id,data:t,meta:e.meta,id:e.id,expire_at:e.expire_at,relation_doc_id:e.relation_doc_id,last_revision_doc_id:e.last_revision_doc_id,type:e.type,tenant_id:e.tenant_id,tenant_model:e.tenant_model}}async getSingleResourceTyped(e,t,r=!1){let n=await this.client.getSingleResource(e,t,r);return i.toTypedDocument(n)}async searchResourcesTyped(e,t={},r=!1){let n=await this.client.searchResources(e,t,r);return{results:n.results.map(a=>i.toTypedDocument(a)),count:n.count}}async getRelationDocumentsTyped(e,t){let r=await this.client.getRelationDocuments(e,t);return{results:r.results.map(n=>i.toTypedDocument(n)),count:r.count}}async createNewResourceTyped(e){let t=await this.client.createNewResource(e);return i.toTypedDocument(t)}async updateResourceTyped(e){let t=await this.client.updateResource(e);return i.toTypedDocument(t)}};var f="2.7.0";function w(){return f}0&&(module.exports={ApitoClient,ApitoError,GraphQLError,TypedOperations,ValidationError,Version,createClient,getVersion});
 //# sourceMappingURL=index.js.map