@attlaz/client 1.101.0 → 1.102.0

package/dist/Http/Transport/DirectTransport.d.ts

@@ -4,6 +4,14 @@ export interface DirectTransportRoute {
     prefix: string;
     baseUrl: string;
 }
+/**
+ * The actor an internal call runs as. Backends resolve access against this, so a caller that reaches
+ * user-owned resources must name one — an anonymous session can only reach unguarded routes.
+ */
+export interface DirectTransportPrincipal {
+    id: string;
+    name: string;
+}
 /**
  * Transport for internal service-to-service calls that bypasses Gateway OAuth.
  * Authenticates via HMAC-signed session headers instead of an OAuth token.
@@ -29,9 +37,13 @@ export declare class DirectTransport implements ITransport {
     private readonly sortedRoutes;
     private parseErrorHandler;
     /**
-     * Creates the default session payload for internal service-to-service calls.
+     * Creates the session payload for internal service-to-service calls.
+     *
+     * Pass `user` when the call reaches resources an access policy guards (typically the platform
+     * SYSTEM user); omit it only for routes that need no actor. The payload is what the receiving
+     * backend authenticates as, so it must be re-signed whenever it changes.
      */
-    static createSessionPayload(): string;
+    static createSessionPayload(user?: DirectTransportPrincipal | null): string;
     constructor(defaultBaseUrl: string, sessionPayload: string, sessionSignature: string, routes?: DirectTransportRoute[]);
     request<T>(action: string, parameters?: Parameters, method?: string, _signWithOauthToken?: boolean): Promise<T>;
     private resolveClient;

package/dist/Http/Transport/DirectTransport.js

@@ -25,12 +25,16 @@ export class DirectTransport {
     sortedRoutes;
     parseErrorHandler = null;
     /**
-     * Creates the default session payload for internal service-to-service calls.
+     * Creates the session payload for internal service-to-service calls.
+     *
+     * Pass `user` when the call reaches resources an access policy guards (typically the platform
+     * SYSTEM user); omit it only for routes that need no actor. The payload is what the receiving
+     * backend authenticates as, so it must be re-signed whenever it changes.
      */
-    static createSessionPayload() {
+    static createSessionPayload(user = null) {
         return JSON.stringify({
             api_version: 'latest',
-            user: null,
+            user: user,
             client: null,
             ip: 'internal',
             roles: [],

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { HttpClientRequest } from './Http/HttpClientRequest.js';
 export { HttpClientResponse } from './Http/HttpClientResponse.js';
 export { ITransport } from './Http/Transport/ITransport.js';
 export { DirectTransport } from './Http/Transport/DirectTransport.js';
-export type { DirectTransportRoute } from './Http/Transport/DirectTransport.js';
+export type { DirectTransportRoute, DirectTransportPrincipal } from './Http/Transport/DirectTransport.js';
 export { OAuthClient } from './Http/Transport/OAuthClient.js';
 export { OAuthClientOptions } from './Http/OAuthClientOptions.js';
 export { OAuthClientToken } from './Http/OAuthClientToken.js';

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.100.0";
+export declare const VERSION = "1.101.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "1.100.0";
+export const VERSION = "1.101.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attlaz/client",
-  "version": "1.101.0",
+  "version": "1.102.0",
   "description": "Javascript Client to access Attlaz API",
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",