@augstash/sdk 0.2.0 → 0.3.0

package/dist/generated/src/apis/SalesforceOAuthCallbackApi.js

@@ -0,0 +1,101 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SalesforceOAuthCallbackApi = void 0;
+const runtime = __importStar(require("../runtime"));
+/**
+ *
+ */
+class SalesforceOAuthCallbackApi extends runtime.BaseAPI {
+    /**
+     * Verifies the signed state, exchanges the authorization code for a grant, proves the grant can query the org, and stores it — then redirects the browser back into the console. Every outcome is a 302, including every failure: a person is looking at this in a browser and a raw JSON error is not something they can act on. Not called by any client directly — it is the connected app\'s registered Callback URL, and Salesforce matches that value exactly. Spends two Salesforce round trips (the code exchange, then an org query that proves the grant works), so a real connect is dominated by Salesforce\'s own latency: < 2s.
+     * Handle Salesforce\'s connect redirect
+     */
+    async callbackAuthSalesforceRaw(requestParameters, initOverrides) {
+        const queryParameters = {};
+        if (requestParameters['code'] != null) {
+            queryParameters['code'] = requestParameters['code'];
+        }
+        if (requestParameters['state'] != null) {
+            queryParameters['state'] = requestParameters['state'];
+        }
+        if (requestParameters['error'] != null) {
+            queryParameters['error'] = requestParameters['error'];
+        }
+        if (requestParameters['errorDescription'] != null) {
+            queryParameters['error_description'] = requestParameters['errorDescription'];
+        }
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/auth/salesforce/callback`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Verifies the signed state, exchanges the authorization code for a grant, proves the grant can query the org, and stores it — then redirects the browser back into the console. Every outcome is a 302, including every failure: a person is looking at this in a browser and a raw JSON error is not something they can act on. Not called by any client directly — it is the connected app\'s registered Callback URL, and Salesforce matches that value exactly. Spends two Salesforce round trips (the code exchange, then an org query that proves the grant works), so a real connect is dominated by Salesforce\'s own latency: < 2s.
+     * Handle Salesforce\'s connect redirect
+     */
+    async callbackAuthSalesforce(requestParameters = {}, initOverrides) {
+        await this.callbackAuthSalesforceRaw(requestParameters, initOverrides);
+    }
+}
+exports.SalesforceOAuthCallbackApi = SalesforceOAuthCallbackApi;

package/dist/generated/src/apis/SamlApi.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import type { AuthTokenResponse, SamlTicketExchangeRequest } from '../models/index';
+export interface AcsRequest {
+    slug: string;
+    xIdempotencyKey?: string;
+    sAMLResponse?: string;
+    relayState?: string;
+}
+export interface ExchangeAuthRequest {
+    samlTicketExchangeRequest: SamlTicketExchangeRequest;
+    xIdempotencyKey?: string;
+}
+export interface LoginAuthSamlRequest {
+    slug: string;
+    returnTo?: string;
+}
+export interface MetadataRequest {
+    slug: string;
+}
+/**
+ * SamlApi - interface
+ *
+ * @export
+ * @interface SamlApiInterface
+ */
+export interface SamlApiInterface {
+    /**
+     * Webhook-class ingest < 1s: one XML-signature verification plus the user lookup or just-in-time provision. The IdP\'s browser form POSTs SAMLResponse (+ RelayState) here. On success the browser is 302\'d to the FE callback route with a one-time ?ticket= which POST /exchange turns into a session. Every failure is also a 302, with ?error=<ErrorCode>. Not called by any client directly — it is the ACS URL registered with the IdP, matched character for character.
+     * @summary Consume a SAML response (assertion-consumer service)
+     * @param {string} slug
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {string} [sAMLResponse]
+     * @param {string} [relayState]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SamlApiInterface
+     */
+    acsRaw(requestParameters: AcsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Webhook-class ingest < 1s: one XML-signature verification plus the user lookup or just-in-time provision. The IdP\'s browser form POSTs SAMLResponse (+ RelayState) here. On success the browser is 302\'d to the FE callback route with a one-time ?ticket= which POST /exchange turns into a session. Every failure is also a 302, with ?error=<ErrorCode>. Not called by any client directly — it is the ACS URL registered with the IdP, matched character for character.
+     * Consume a SAML response (assertion-consumer service)
+     */
+    acs(requestParameters: AcsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Writes < 300ms. The FE callback route POSTs the ?ticket= it landed with; the answer is the same session shape as password login, and the parent-domain refresh cookie is set exactly as it is there. Single-use: a second exchange of the same ticket is SSO_TICKET_INVALID. No Augstash second factor is challenged — the identity provider owns the person\'s authentication policy.
+     * @summary Exchange a one-time SSO ticket for a session
+     * @param {SamlTicketExchangeRequest} samlTicketExchangeRequest
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SamlApiInterface
+     */
+    exchangeAuthRaw(requestParameters: ExchangeAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthTokenResponse>>;
+    /**
+     * Writes < 300ms. The FE callback route POSTs the ?ticket= it landed with; the answer is the same session shape as password login, and the parent-domain refresh cookie is set exactly as it is there. Single-use: a second exchange of the same ticket is SSO_TICKET_INVALID. No Augstash second factor is challenged — the identity provider owns the person\'s authentication policy.
+     * Exchange a one-time SSO ticket for a session
+     */
+    exchangeAuth(requestParameters: ExchangeAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthTokenResponse>;
+    /**
+     * Reads < 300ms. Builds an AuthnRequest and 302s the browser to the workspace\'s identity provider. The login page sends the browser here (a navigation, not an XHR). returnTo is an FE path to land on afterwards; absolute URLs are dropped. Every failure is ALSO a 302, to the FE callback route with ?error=<ErrorCode>.
+     * @summary Start an SP-initiated SAML sign-in
+     * @param {string} slug
+     * @param {string} [returnTo]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SamlApiInterface
+     */
+    loginAuthSamlRaw(requestParameters: LoginAuthSamlRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Reads < 300ms. Builds an AuthnRequest and 302s the browser to the workspace\'s identity provider. The login page sends the browser here (a navigation, not an XHR). returnTo is an FE path to land on afterwards; absolute URLs are dropped. Every failure is ALSO a 302, to the FE callback route with ?error=<ErrorCode>.
+     * Start an SP-initiated SAML sign-in
+     */
+    loginAuthSaml(requestParameters: LoginAuthSamlRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Reads < 300ms. The document an admin uploads to Okta / Entra (or points them at by URL): our entity id, the assertion-consumer URL, email NameID, assertions signed. Served whether or not SSO is configured yet, so the admin can set the IdP up first. The entity id IS this URL.
+     * @summary The service-provider SAML metadata for a workspace
+     * @param {string} slug
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SamlApiInterface
+     */
+    metadataRaw(requestParameters: MetadataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<string>>;
+    /**
+     * Reads < 300ms. The document an admin uploads to Okta / Entra (or points them at by URL): our entity id, the assertion-consumer URL, email NameID, assertions signed. Served whether or not SSO is configured yet, so the admin can set the IdP up first. The entity id IS this URL.
+     * The service-provider SAML metadata for a workspace
+     */
+    metadata(requestParameters: MetadataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<string>;
+}
+/**
+ *
+ */
+export declare class SamlApi extends runtime.BaseAPI implements SamlApiInterface {
+    /**
+     * Webhook-class ingest < 1s: one XML-signature verification plus the user lookup or just-in-time provision. The IdP\'s browser form POSTs SAMLResponse (+ RelayState) here. On success the browser is 302\'d to the FE callback route with a one-time ?ticket= which POST /exchange turns into a session. Every failure is also a 302, with ?error=<ErrorCode>. Not called by any client directly — it is the ACS URL registered with the IdP, matched character for character.
+     * Consume a SAML response (assertion-consumer service)
+     */
+    acsRaw(requestParameters: AcsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Webhook-class ingest < 1s: one XML-signature verification plus the user lookup or just-in-time provision. The IdP\'s browser form POSTs SAMLResponse (+ RelayState) here. On success the browser is 302\'d to the FE callback route with a one-time ?ticket= which POST /exchange turns into a session. Every failure is also a 302, with ?error=<ErrorCode>. Not called by any client directly — it is the ACS URL registered with the IdP, matched character for character.
+     * Consume a SAML response (assertion-consumer service)
+     */
+    acs(requestParameters: AcsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Writes < 300ms. The FE callback route POSTs the ?ticket= it landed with; the answer is the same session shape as password login, and the parent-domain refresh cookie is set exactly as it is there. Single-use: a second exchange of the same ticket is SSO_TICKET_INVALID. No Augstash second factor is challenged — the identity provider owns the person\'s authentication policy.
+     * Exchange a one-time SSO ticket for a session
+     */
+    exchangeAuthRaw(requestParameters: ExchangeAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthTokenResponse>>;
+    /**
+     * Writes < 300ms. The FE callback route POSTs the ?ticket= it landed with; the answer is the same session shape as password login, and the parent-domain refresh cookie is set exactly as it is there. Single-use: a second exchange of the same ticket is SSO_TICKET_INVALID. No Augstash second factor is challenged — the identity provider owns the person\'s authentication policy.
+     * Exchange a one-time SSO ticket for a session
+     */
+    exchangeAuth(requestParameters: ExchangeAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthTokenResponse>;
+    /**
+     * Reads < 300ms. Builds an AuthnRequest and 302s the browser to the workspace\'s identity provider. The login page sends the browser here (a navigation, not an XHR). returnTo is an FE path to land on afterwards; absolute URLs are dropped. Every failure is ALSO a 302, to the FE callback route with ?error=<ErrorCode>.
+     * Start an SP-initiated SAML sign-in
+     */
+    loginAuthSamlRaw(requestParameters: LoginAuthSamlRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Reads < 300ms. Builds an AuthnRequest and 302s the browser to the workspace\'s identity provider. The login page sends the browser here (a navigation, not an XHR). returnTo is an FE path to land on afterwards; absolute URLs are dropped. Every failure is ALSO a 302, to the FE callback route with ?error=<ErrorCode>.
+     * Start an SP-initiated SAML sign-in
+     */
+    loginAuthSaml(requestParameters: LoginAuthSamlRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Reads < 300ms. The document an admin uploads to Okta / Entra (or points them at by URL): our entity id, the assertion-consumer URL, email NameID, assertions signed. Served whether or not SSO is configured yet, so the admin can set the IdP up first. The entity id IS this URL.
+     * The service-provider SAML metadata for a workspace
+     */
+    metadataRaw(requestParameters: MetadataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<string>>;
+    /**
+     * Reads < 300ms. The document an admin uploads to Okta / Entra (or points them at by URL): our entity id, the assertion-consumer URL, email NameID, assertions signed. Served whether or not SSO is configured yet, so the admin can set the IdP up first. The entity id IS this URL.
+     * The service-provider SAML metadata for a workspace
+     */
+    metadata(requestParameters: MetadataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<string>;
+}

package/dist/generated/src/apis/SamlApi.js

@@ -0,0 +1,242 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SamlApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const index_1 = require("../models/index");
+/**
+ *
+ */
+class SamlApi extends runtime.BaseAPI {
+    /**
+     * Webhook-class ingest < 1s: one XML-signature verification plus the user lookup or just-in-time provision. The IdP\'s browser form POSTs SAMLResponse (+ RelayState) here. On success the browser is 302\'d to the FE callback route with a one-time ?ticket= which POST /exchange turns into a session. Every failure is also a 302, with ?error=<ErrorCode>. Not called by any client directly — it is the ACS URL registered with the IdP, matched character for character.
+     * Consume a SAML response (assertion-consumer service)
+     */
+    async acsRaw(requestParameters, initOverrides) {
+        if (requestParameters['slug'] == null) {
+            throw new runtime.RequiredError('slug', 'Required parameter "slug" was null or undefined when calling acs().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        const consumes = [
+            { contentType: 'application/x-www-form-urlencoded' },
+        ];
+        // @ts-ignore: canConsumeForm may be unused
+        const canConsumeForm = runtime.canConsumeForm(consumes);
+        let formParams;
+        let useForm = false;
+        if (useForm) {
+            formParams = new FormData();
+        }
+        else {
+            formParams = new URLSearchParams();
+        }
+        if (requestParameters['sAMLResponse'] != null) {
+            formParams.append('SAMLResponse', requestParameters['sAMLResponse']);
+        }
+        if (requestParameters['relayState'] != null) {
+            formParams.append('RelayState', requestParameters['relayState']);
+        }
+        let urlPath = `/api/v1/auth/saml/{slug}/acs`;
+        urlPath = urlPath.replace(`{${"slug"}}`, encodeURIComponent(String(requestParameters['slug'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: formParams,
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Webhook-class ingest < 1s: one XML-signature verification plus the user lookup or just-in-time provision. The IdP\'s browser form POSTs SAMLResponse (+ RelayState) here. On success the browser is 302\'d to the FE callback route with a one-time ?ticket= which POST /exchange turns into a session. Every failure is also a 302, with ?error=<ErrorCode>. Not called by any client directly — it is the ACS URL registered with the IdP, matched character for character.
+     * Consume a SAML response (assertion-consumer service)
+     */
+    async acs(requestParameters, initOverrides) {
+        await this.acsRaw(requestParameters, initOverrides);
+    }
+    /**
+     * Writes < 300ms. The FE callback route POSTs the ?ticket= it landed with; the answer is the same session shape as password login, and the parent-domain refresh cookie is set exactly as it is there. Single-use: a second exchange of the same ticket is SSO_TICKET_INVALID. No Augstash second factor is challenged — the identity provider owns the person\'s authentication policy.
+     * Exchange a one-time SSO ticket for a session
+     */
+    async exchangeAuthRaw(requestParameters, initOverrides) {
+        if (requestParameters['samlTicketExchangeRequest'] == null) {
+            throw new runtime.RequiredError('samlTicketExchangeRequest', 'Required parameter "samlTicketExchangeRequest" was null or undefined when calling exchangeAuth().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/auth/saml/exchange`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, index_1.SamlTicketExchangeRequestToJSON)(requestParameters['samlTicketExchangeRequest']),
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.AuthTokenResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Writes < 300ms. The FE callback route POSTs the ?ticket= it landed with; the answer is the same session shape as password login, and the parent-domain refresh cookie is set exactly as it is there. Single-use: a second exchange of the same ticket is SSO_TICKET_INVALID. No Augstash second factor is challenged — the identity provider owns the person\'s authentication policy.
+     * Exchange a one-time SSO ticket for a session
+     */
+    async exchangeAuth(requestParameters, initOverrides) {
+        const response = await this.exchangeAuthRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Reads < 300ms. Builds an AuthnRequest and 302s the browser to the workspace\'s identity provider. The login page sends the browser here (a navigation, not an XHR). returnTo is an FE path to land on afterwards; absolute URLs are dropped. Every failure is ALSO a 302, to the FE callback route with ?error=<ErrorCode>.
+     * Start an SP-initiated SAML sign-in
+     */
+    async loginAuthSamlRaw(requestParameters, initOverrides) {
+        if (requestParameters['slug'] == null) {
+            throw new runtime.RequiredError('slug', 'Required parameter "slug" was null or undefined when calling loginAuthSaml().');
+        }
+        const queryParameters = {};
+        if (requestParameters['returnTo'] != null) {
+            queryParameters['returnTo'] = requestParameters['returnTo'];
+        }
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/auth/saml/{slug}/login`;
+        urlPath = urlPath.replace(`{${"slug"}}`, encodeURIComponent(String(requestParameters['slug'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Reads < 300ms. Builds an AuthnRequest and 302s the browser to the workspace\'s identity provider. The login page sends the browser here (a navigation, not an XHR). returnTo is an FE path to land on afterwards; absolute URLs are dropped. Every failure is ALSO a 302, to the FE callback route with ?error=<ErrorCode>.
+     * Start an SP-initiated SAML sign-in
+     */
+    async loginAuthSaml(requestParameters, initOverrides) {
+        await this.loginAuthSamlRaw(requestParameters, initOverrides);
+    }
+    /**
+     * Reads < 300ms. The document an admin uploads to Okta / Entra (or points them at by URL): our entity id, the assertion-consumer URL, email NameID, assertions signed. Served whether or not SSO is configured yet, so the admin can set the IdP up first. The entity id IS this URL.
+     * The service-provider SAML metadata for a workspace
+     */
+    async metadataRaw(requestParameters, initOverrides) {
+        if (requestParameters['slug'] == null) {
+            throw new runtime.RequiredError('slug', 'Required parameter "slug" was null or undefined when calling metadata().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/auth/saml/{slug}/metadata`;
+        urlPath = urlPath.replace(`{${"slug"}}`, encodeURIComponent(String(requestParameters['slug'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        if (this.isJsonMime(response.headers.get('content-type'))) {
+            return new runtime.JSONApiResponse(response);
+        }
+        else {
+            return new runtime.TextApiResponse(response);
+        }
+    }
+    /**
+     * Reads < 300ms. The document an admin uploads to Okta / Entra (or points them at by URL): our entity id, the assertion-consumer URL, email NameID, assertions signed. Served whether or not SSO is configured yet, so the admin can set the IdP up first. The entity id IS this URL.
+     * The service-provider SAML metadata for a workspace
+     */
+    async metadata(requestParameters, initOverrides) {
+        const response = await this.metadataRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}
+exports.SamlApi = SamlApi;

package/dist/generated/src/apis/ScimDiscoveryApi.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+/**
+ * ScimDiscoveryApi - interface
+ *
+ * @export
+ * @interface ScimDiscoveryApiInterface
+ */
+export interface ScimDiscoveryApiInterface {
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * @summary SCIM: resource types
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ScimDiscoveryApiInterface
+     */
+    resourceTypesRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: resource types
+     */
+    resourceTypes(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{
+        [key: string]: any;
+    }>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * @summary SCIM: schemas
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ScimDiscoveryApiInterface
+     */
+    schemasRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: schemas
+     */
+    schemas(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{
+        [key: string]: any;
+    }>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * @summary SCIM: service provider configuration
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ScimDiscoveryApiInterface
+     */
+    serviceProviderConfigRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: service provider configuration
+     */
+    serviceProviderConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{
+        [key: string]: any;
+    }>;
+}
+/**
+ *
+ */
+export declare class ScimDiscoveryApi extends runtime.BaseAPI implements ScimDiscoveryApiInterface {
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: resource types
+     */
+    resourceTypesRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: resource types
+     */
+    resourceTypes(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{
+        [key: string]: any;
+    }>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: schemas
+     */
+    schemasRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: schemas
+     */
+    schemas(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{
+        [key: string]: any;
+    }>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: service provider configuration
+     */
+    serviceProviderConfigRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<{
+        [key: string]: any;
+    }>>;
+    /**
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * SCIM: service provider configuration
+     */
+    serviceProviderConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<{
+        [key: string]: any;
+    }>;
+}