@attlaz/client 1.100.0 → 1.102.0

package/dist/Http/Transport/DirectTransport.d.ts

@@ -4,6 +4,14 @@ export interface DirectTransportRoute {
     prefix: string;
     baseUrl: string;
 }
+/**
+ * The actor an internal call runs as. Backends resolve access against this, so a caller that reaches
+ * user-owned resources must name one — an anonymous session can only reach unguarded routes.
+ */
+export interface DirectTransportPrincipal {
+    id: string;
+    name: string;
+}
 /**
  * Transport for internal service-to-service calls that bypasses Gateway OAuth.
  * Authenticates via HMAC-signed session headers instead of an OAuth token.
@@ -29,9 +37,13 @@ export declare class DirectTransport implements ITransport {
     private readonly sortedRoutes;
     private parseErrorHandler;
     /**
-     * Creates the default session payload for internal service-to-service calls.
+     * Creates the session payload for internal service-to-service calls.
+     *
+     * Pass `user` when the call reaches resources an access policy guards (typically the platform
+     * SYSTEM user); omit it only for routes that need no actor. The payload is what the receiving
+     * backend authenticates as, so it must be re-signed whenever it changes.
      */
-    static createSessionPayload(): string;
+    static createSessionPayload(user?: DirectTransportPrincipal | null): string;
     constructor(defaultBaseUrl: string, sessionPayload: string, sessionSignature: string, routes?: DirectTransportRoute[]);
     request<T>(action: string, parameters?: Parameters, method?: string, _signWithOauthToken?: boolean): Promise<T>;
     private resolveClient;

package/dist/Http/Transport/DirectTransport.js

@@ -25,12 +25,16 @@ export class DirectTransport {
     sortedRoutes;
     parseErrorHandler = null;
     /**
-     * Creates the default session payload for internal service-to-service calls.
+     * Creates the session payload for internal service-to-service calls.
+     *
+     * Pass `user` when the call reaches resources an access policy guards (typically the platform
+     * SYSTEM user); omit it only for routes that need no actor. The payload is what the receiving
+     * backend authenticates as, so it must be re-signed whenever it changes.
      */
-    static createSessionPayload() {
+    static createSessionPayload(user = null) {
         return JSON.stringify({
             api_version: 'latest',
-            user: null,
+            user: user,
             client: null,
             ip: 'internal',
             roles: [],

package/dist/Model/User/PasswordCheck.d.ts

@@ -17,6 +17,17 @@ export declare class PasswordCheck {
      * Treat it as a display hint, not a policy: the server owns the threshold, and a low score with
      * `code === null` still means accepted.
      */
-    strength: number | null;
-    isAcceptable(): boolean;
+    strength: PasswordStrength | null;
+}
+export type PasswordStrength = 0 | 1 | 2 | 3 | 4;
+export declare namespace PasswordStrength {
+    /**
+     * Throws on anything outside 0–4, rather than degrading to null.
+     *
+     * Null does not mean "unknown" here — it means the password was refused before it could be
+     * scored, and a caller may rely on that: a strength of null with no code is a state the API never
+     * produces. Mapping an unexpected number to null would fabricate exactly that combination.
+     * Throwing surfaces as a failed check, which callers already handle.
+     */
+    const fromRaw: (input: unknown) => PasswordStrength | null;
 }

package/dist/Model/User/PasswordCheck.js

@@ -11,7 +11,24 @@ export class PasswordCheck {
      * `code === null` still means accepted.
      */
     strength = null;
-    isAcceptable() {
-        return this.code === null;
-    }
 }
+export var PasswordStrength;
+(function (PasswordStrength) {
+    /**
+     * Throws on anything outside 0–4, rather than degrading to null.
+     *
+     * Null does not mean "unknown" here — it means the password was refused before it could be
+     * scored, and a caller may rely on that: a strength of null with no code is a state the API never
+     * produces. Mapping an unexpected number to null would fabricate exactly that combination.
+     * Throwing surfaces as a failed check, which callers already handle.
+     */
+    PasswordStrength.fromRaw = (input) => {
+        if (input === null || input === undefined) {
+            return null;
+        }
+        if (input === 0 || input === 1 || input === 2 || input === 3 || input === 4) {
+            return input;
+        }
+        throw new Error('Unable to parse PasswordStrength: expected 0-4 or null, got "' + String(input) + '"');
+    };
+})(PasswordStrength || (PasswordStrength = {}));

package/dist/Service/UserEndpoint.js

@@ -2,7 +2,7 @@ import { path } from '../Http/Data/Path.js';
 import { UserAuthProvider } from '../Model/User/UserAuthProvider.js';
 import { User } from '../Model/User/User.js';
 import { UserSummary } from '../Model/User/UserSummary.js';
-import { PasswordCheck } from '../Model/User/PasswordCheck.js';
+import { PasswordCheck, PasswordStrength } from '../Model/User/PasswordCheck.js';
 import { Endpoint } from './Endpoint.js';
 import { UserNotificationSession } from '../Model/User/UserNotificationSession.js';
 import { QueryString } from '../Http/Data/QueryString.js';
@@ -149,7 +149,7 @@ export class UserEndpoint extends Endpoint {
         const check = new PasswordCheck();
         check.code = (raw.code ?? null);
         check.error = (raw.error ?? null);
-        check.strength = (raw.strength ?? null);
+        check.strength = PasswordStrength.fromRaw(raw.strength);
         return check;
     }
     async resetPassword(code, password) {

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { HttpClientRequest } from './Http/HttpClientRequest.js';
 export { HttpClientResponse } from './Http/HttpClientResponse.js';
 export { ITransport } from './Http/Transport/ITransport.js';
 export { DirectTransport } from './Http/Transport/DirectTransport.js';
-export type { DirectTransportRoute } from './Http/Transport/DirectTransport.js';
+export type { DirectTransportRoute, DirectTransportPrincipal } from './Http/Transport/DirectTransport.js';
 export { OAuthClient } from './Http/Transport/OAuthClient.js';
 export { OAuthClientOptions } from './Http/OAuthClientOptions.js';
 export { OAuthClientToken } from './Http/OAuthClientToken.js';
@@ -210,7 +210,7 @@ export type { UserActionFilter } from './Model/User/UserActionFilter.js';
 export { UserSummary } from './Model/User/UserSummary.js';
 export type { UserSummaryType } from './Model/User/UserSummary.js';
 export { PasswordCheck } from './Model/User/PasswordCheck.js';
-export type { PasswordCheckCode } from './Model/User/PasswordCheck.js';
+export type { PasswordCheckCode, PasswordStrength } from './Model/User/PasswordCheck.js';
 export { RunnerImage } from './Model/Runner/RunnerImage.js';
 export { Component } from './Model/Component/Component.js';
 export { ComponentKind } from './Model/Component/ComponentKind.js';

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.99.0";
+export declare const VERSION = "1.101.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "1.99.0";
+export const VERSION = "1.101.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attlaz/client",
-  "version": "1.100.0",
+  "version": "1.102.0",
   "description": "Javascript Client to access Attlaz API",
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",