@atlasauth/js 0.23.1 → 0.25.0

package/dist/uma.d.ts

@@ -0,0 +1,86 @@
+import type { FapiClient } from './fapi';
+/**
+ * User-Managed Access, from the two browser-side seats.
+ *
+ * The RESOURCE OWNER (signed in, cookie-authenticated through the {@link FapiClient}): list what they own and who
+ * it is shared with, share and stop sharing, and answer access requests (`/v1/client/me/uma/*`).
+ *
+ * The CLIENT acting for a requesting party: build the claims-gathering URL for a `need_info` answer that carries
+ * `redirect_user`, and read the ticket / error from the redirect back.
+ */
+export interface UmaPolicy {
+    object: 'uma_policy';
+    id: string;
+    resource_id: string;
+    subject: {
+        type: 'user' | 'group' | 'org';
+        id: string;
+    };
+    scopes: string[];
+    created_at: number;
+}
+export interface UmaOwnedResource {
+    object: 'uma_resource';
+    id: string;
+    name: string;
+    type: string | null;
+    uri: string | null;
+    resource_scopes: string[];
+    app: string | null;
+    policies: UmaPolicy[];
+}
+export interface UmaAccessRequest {
+    object: 'uma_access_request';
+    id: string;
+    resource_id: string;
+    resource_name?: string;
+    requester_user_id: string;
+    /** The requester's email address. */
+    requester?: string | null;
+    scopes: string[];
+    status: 'pending' | 'approved' | 'denied';
+    created_at: number;
+    decided_at: number | null;
+}
+/** A refused request; `code` is the server's stable error code. */
+export declare class UmaError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** The resources the signed-in user owns, with who each is shared with. */
+export declare function listUmaResources(client: FapiClient): Promise<UmaOwnedResource[]>;
+/** Share a resource with a person (verified `email`) or a `subject` (user, group, org). Replaces an earlier share to the same subject. */
+export declare function shareUmaResource(client: FapiClient, resourceId: string, target: {
+    email: string;
+} | {
+    subject: {
+        type: 'user' | 'group' | 'org';
+        id: string;
+    };
+}, scopes: string[]): Promise<UmaPolicy>;
+export declare function unshareUmaResource(client: FapiClient, resourceId: string, subject: {
+    type: string;
+    id: string;
+}): Promise<void>;
+/** Access requests for the user's resources (the owner-approval queue). */
+export declare function listUmaAccessRequests(client: FapiClient, status?: UmaAccessRequest['status']): Promise<UmaAccessRequest[]>;
+/** Approve (optionally narrowing `scopes`) or deny a pending request. A request is decided once. */
+export declare function decideUmaAccessRequest(client: FapiClient, requestId: string, decision: 'approve' | 'deny', scopes?: string[]): Promise<UmaAccessRequest>;
+/**
+ * The URL to send the requesting party to for interactive claims gathering. `redirectUser` is the `redirect_user`
+ * from the `need_info` answer; `ticket` is that answer's (rotated) ticket. `claimsRedirectUri` must be one of the
+ * client's registered claims redirect URIs.
+ */
+export declare function umaClaimsUrl(redirectUser: string, params: {
+    clientId: string;
+    ticket: string;
+    claimsRedirectUri?: string;
+    state?: string;
+}): string;
+/** Read the redirect back from claims gathering: a new `ticket`, or an `error` (the person cancelled). */
+export declare function parseUmaClaimsRedirect(redirectUrl: string): {
+    ticket?: string;
+    error?: string;
+    state?: string;
+};

package/dist/uma.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UmaError = void 0;
+exports.listUmaResources = listUmaResources;
+exports.shareUmaResource = shareUmaResource;
+exports.unshareUmaResource = unshareUmaResource;
+exports.listUmaAccessRequests = listUmaAccessRequests;
+exports.decideUmaAccessRequest = decideUmaAccessRequest;
+exports.umaClaimsUrl = umaClaimsUrl;
+exports.parseUmaClaimsRedirect = parseUmaClaimsRedirect;
+/** A refused request; `code` is the server's stable error code. */
+class UmaError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'UmaError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.UmaError = UmaError;
+async function call(client, path, init) {
+    const res = await client.request(path, init);
+    if (!res.ok) {
+        const first = res.errors[0];
+        throw new UmaError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+const json = (method, body) => ({ method, body: JSON.stringify(body), headers: { 'content-type': 'application/json' } });
+const enc = encodeURIComponent;
+/** The resources the signed-in user owns, with who each is shared with. */
+async function listUmaResources(client) {
+    return (await call(client, '/v1/client/me/uma/resources', { method: 'GET' })).data ?? [];
+}
+/** Share a resource with a person (verified `email`) or a `subject` (user, group, org). Replaces an earlier share to the same subject. */
+function shareUmaResource(client, resourceId, target, scopes) {
+    return call(client, `/v1/client/me/uma/resources/${enc(resourceId)}/policies`, json('PUT', { ...target, scopes }));
+}
+async function unshareUmaResource(client, resourceId, subject) {
+    await call(client, `/v1/client/me/uma/resources/${enc(resourceId)}/policies/${enc(subject.type)}/${enc(subject.id)}`, { method: 'DELETE' });
+}
+/** Access requests for the user's resources (the owner-approval queue). */
+async function listUmaAccessRequests(client, status) {
+    const q = status ? `?status=${enc(status)}` : '';
+    return (await call(client, `/v1/client/me/uma/requests${q}`, { method: 'GET' })).data ?? [];
+}
+/** Approve (optionally narrowing `scopes`) or deny a pending request. A request is decided once. */
+function decideUmaAccessRequest(client, requestId, decision, scopes) {
+    return call(client, `/v1/client/me/uma/requests/${enc(requestId)}/decision`, json('POST', { decision, ...(scopes ? { scopes } : {}) }));
+}
+/**
+ * The URL to send the requesting party to for interactive claims gathering. `redirectUser` is the `redirect_user`
+ * from the `need_info` answer; `ticket` is that answer's (rotated) ticket. `claimsRedirectUri` must be one of the
+ * client's registered claims redirect URIs.
+ */
+function umaClaimsUrl(redirectUser, params) {
+    const url = new URL(redirectUser);
+    url.searchParams.set('client_id', params.clientId);
+    url.searchParams.set('ticket', params.ticket);
+    if (params.claimsRedirectUri)
+        url.searchParams.set('claims_redirect_uri', params.claimsRedirectUri);
+    if (params.state)
+        url.searchParams.set('state', params.state);
+    return url.toString();
+}
+/** Read the redirect back from claims gathering: a new `ticket`, or an `error` (the person cancelled). */
+function parseUmaClaimsRedirect(redirectUrl) {
+    const p = new URL(redirectUrl).searchParams;
+    return { ticket: p.get('ticket') ?? undefined, error: p.get('error') ?? undefined, state: p.get('state') ?? undefined };
+}
+//# sourceMappingURL=uma.js.map

package/dist/uma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uma.js","sourceRoot":"","sources":["../src/uma.ts"],"names":[],"mappings":";;;AAuEA,4CAEC;AAGD,4CAOC;AAED,gDAEC;AAGD,sDAGC;AAGD,wDAEC;AAOD,oCAOC;AAGD,wDAGC;AAxED,mEAAmE;AACnE,MAAa,QAAS,SAAQ,KAAK;IACxB,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,4BASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,GAAG,CAAC,IAAS,CAAC;AACvB,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAe,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACvJ,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,2EAA2E;AACpE,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,OAAO,CAAC,MAAM,IAAI,CAAgC,MAAM,EAAE,6BAA6B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC1H,CAAC;AAED,0IAA0I;AAC1I,SAAgB,gBAAgB,CAC9B,MAAkB,EAClB,UAAkB,EAClB,MAAuF,EACvF,MAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,+BAA+B,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACrH,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,UAAkB,EAAE,OAAqC;IACpH,MAAM,IAAI,CAAC,MAAM,EAAE,+BAA+B,GAAG,CAAC,UAAU,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9I,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,qBAAqB,CAAC,MAAkB,EAAE,MAAmC;IACjG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,MAAM,IAAI,CAAgC,MAAM,EAAE,6BAA6B,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC7H,CAAC;AAED,oGAAoG;AACpG,SAAgB,sBAAsB,CAAC,MAAkB,EAAE,SAAiB,EAAE,QAA4B,EAAE,MAAiB;IAC3H,OAAO,IAAI,CAAC,MAAM,EAAE,8BAA8B,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1I,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,YAAoB,EAAE,MAAwF;IACzI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,iBAAiB;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,0GAA0G;AAC1G,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;AAC1H,CAAC"}

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-export declare const ATLAS_JS_VERSION = "0.23.1";
+export declare const ATLAS_JS_VERSION = "0.25.0";

package/dist/version.js

@@ -7,5 +7,5 @@ exports.ATLAS_JS_VERSION = void 0;
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-exports.ATLAS_JS_VERSION = '0.23.1';
+exports.ATLAS_JS_VERSION = '0.25.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.23.1",
+  "version": "0.25.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -20,7 +20,7 @@
     "vitest": "^2.1.4"
   },
   "dependencies": {
-    "@atlasauth/authz": "0.2.0"
+    "@atlasauth/authz": "0.3.0"
   },
   "publishConfig": {
     "access": "public"