@authyon/auth 0.1.4 → 0.1.5

package/dist/index.cjs

@@ -98,6 +98,22 @@ function defaultStorage() {
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.authyon.com";
 var EXPIRY_SKEW_MS = 3e4;
+var FALLBACK_EXPIRES_IN = 1800;
+function readTokens(raw) {
+  const tokens = raw.tokens ?? raw;
+  if (!tokens.accessToken || !tokens.refreshToken) {
+    throw new AuthyonError(502, {
+      code: "session.malformed",
+      title: "Malformed session response",
+      detail: "The session response carried no access/refresh token pair."
+    });
+  }
+  return {
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    expiresIn: tokens.expiresIn ?? FALLBACK_EXPIRES_IN
+  };
+}
 var AuthyonClient = class {
   constructor(options) {
     this.listeners = /* @__PURE__ */ new Set();
@@ -113,7 +129,7 @@ var AuthyonClient = class {
       loginFinish: (assertion) => this.request("/auth/webauthn/login/finish", {
         method: "POST",
         body: assertion
-      }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
+      }).then((data) => this.setSession({ tokens: readTokens(data) }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── Social sign-in (SSO) ─────────────────────────────────────────────────
     this.sso = {
@@ -134,7 +150,7 @@ var AuthyonClient = class {
        * POST /auth/sso/exchange — swaps the one-time code from the provider
        * callback for tokens and stores the session.
        */
-      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
+      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then((data) => this.setSession({ tokens: readTokens(data) }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── User ─────────────────────────────────────────────────────────────────
     this.user = {
@@ -192,11 +208,16 @@ var AuthyonClient = class {
         method: "POST",
         bearer: true,
         body: { tenantSlug: organizationSlug }
-      }).then((data) => this.setSession({ tokens: data.tokens }, "refreshed")).then((session) => this.hydrateUser(session)),
+      }).then((data) => this.setSession({ tokens: readTokens(data) }, "refreshed")).then((session) => this.hydrateUser(session)),
       /** The organization the current session is scoped to, from the cached session — no network call. */
       current: () => this.getSession()?.user?.activeOrganization ?? null,
       members: {
-        /** GET /auth/tenants/{organizationId}/members — list an organization's members. */
+        /**
+         * GET /auth/tenants/{organizationId}/members — paginated list of an
+         * organization's members. Consistent with the confirmed-live
+         * `Page<T>` envelope every other `skip`/`take` endpoint returns
+         * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
+         */
         list: (organizationId, params = {}) => this.request(
           `/auth/tenants/${encodeURIComponent(organizationId)}/members?${toQuery(params)}`,
           { bearer: true }
@@ -414,7 +435,9 @@ var AuthyonClient = class {
     if (data.twoFactor) {
       return { twoFactorRequired: true, ...data.twoFactor };
     }
-    const session = await this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
+    const session = await this.hydrateUser(
+      this.setSession({ tokens: readTokens(data) }, "signed_in")
+    );
     return { twoFactorRequired: false, session };
   }
   /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
@@ -423,7 +446,7 @@ var AuthyonClient = class {
       method: "POST",
       body: params
     });
-    return this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
+    return this.hydrateUser(this.setSession({ tokens: readTokens(data) }, "signed_in"));
   }
   /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
   async refresh() {
@@ -436,7 +459,7 @@ var AuthyonClient = class {
       body: { refreshToken: current.refreshToken }
     }).then(
       (data) => this.setSession(
-        { tokens: data.tokens, user: current.user },
+        { tokens: readTokens(data), user: current.user },
         "refreshed"
       )
     ).catch((error) => {
@@ -471,21 +494,32 @@ var AuthyonClient = class {
     this.clearSession();
   }
   // ── Token verification ───────────────────────────────────────────────────
-  /** POST /auth/introspect — lightweight token introspection. */
+  /**
+   * POST /auth/introspect — lightweight token introspection (RFC 7662).
+   *
+   * ⚠️ Confirmed live: this endpoint requires the CALLER to also
+   * authenticate, with an environment or tenant client-credentials bearer
+   * token — the end user's own access token doesn't satisfy that (401).
+   * A browser app has no client secret to present, so this will fail from
+   * `@authyon/auth` in practice; call it from your backend via
+   * `@authyon/server` instead.
+   */
   async introspect(token) {
     const accessToken = token ?? await this.getAccessToken();
     return this.request("/auth/introspect", { method: "POST", body: { token: accessToken } });
   }
-  /** POST /auth/validate — recommended: cross-checks DB state, returns user + organization. */
+  /**
+   * POST /auth/validate — recommended: cross-checks DB state, catches
+   * revocation immediately. Same caller-authentication requirement (and
+   * the same practical limitation from the browser) as `introspect()`.
+   */
   async validate(token) {
     const accessToken = token ?? await this.getAccessToken();
-    const raw = await this.request("/auth/validate", {
-      method: "POST",
-      headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : void 0
-    });
+    const raw = await this.request("/auth/validate", { method: "POST", body: { token: accessToken } });
     return {
-      user: normalizeUser(raw.user),
-      organization: raw.organization ?? raw.tenant ?? null
+      valid: raw.valid,
+      reason: raw.reason ?? null,
+      user: raw.profile ? normalizeUser(raw.profile) : null
     };
   }
 };

package/dist/index.d.cts

@@ -15,10 +15,14 @@ interface CreateOrganizationParams {
     slug?: string;
     description?: string;
 }
+/** GET /auth/tenants/{organizationId}/members — confirmed against the live API. */
 interface OrganizationMember {
     userId: string;
     email?: string;
+    username?: string;
     roles?: string[];
+    createdAt?: string;
+    lastLoginAt?: string | null;
 }
 /** POST /auth/tenants/{tenantId}/members — invites a member by e-mail. */
 interface InviteMemberParams {
@@ -181,17 +185,32 @@ interface SessionInfo {
     lastUsedAt?: string | null;
     lastUsedFromIp?: string | null;
 }
+/** POST /auth/introspect (RFC 7662) — confirmed against the live API. */
 interface IntrospectResult {
     active: boolean;
     sub?: string;
+    username?: string | null;
+    email?: string | null;
+    roles?: string[] | null;
+    permissions?: string[];
     client_id?: string;
     scope?: string;
     exp?: number;
+    iat?: number;
+    jti?: string;
     token_type?: string;
 }
+/**
+ * POST /auth/validate — confirmed against the live API. The wire shape is
+ * `{ valid, reason, profile }`, not `{ user, organization }` as the
+ * OpenAPI schema (which didn't document response bodies) suggested.
+ * `profile` is `null` for machine tokens (there's no user behind them) and
+ * for tokens that fail validation.
+ */
 interface ValidateResult {
-    user: User;
-    organization?: Organization | null;
+    valid: boolean;
+    reason?: string | null;
+    user: User | null;
 }
 type AuthEvent = {
     type: "signed_in";
@@ -349,8 +368,13 @@ declare class AuthyonClient {
         /** The organization the current session is scoped to, from the cached session — no network call. */
         current: () => Organization | null;
         members: {
-            /** GET /auth/tenants/{organizationId}/members — list an organization's members. */
-            list: (organizationId: string, params?: PageParams) => Promise<OrganizationMember[]>;
+            /**
+             * GET /auth/tenants/{organizationId}/members — paginated list of an
+             * organization's members. Consistent with the confirmed-live
+             * `Page<T>` envelope every other `skip`/`take` endpoint returns
+             * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
+             */
+            list: (organizationId: string, params?: PageParams) => Promise<Page<OrganizationMember>>;
             /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
             invite: (organizationId: string, params: InviteMemberParams) => Promise<void>;
             /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
@@ -405,9 +429,22 @@ declare class AuthyonClient {
             assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
         };
     };
-    /** POST /auth/introspect — lightweight token introspection. */
+    /**
+     * POST /auth/introspect — lightweight token introspection (RFC 7662).
+     *
+     * ⚠️ Confirmed live: this endpoint requires the CALLER to also
+     * authenticate, with an environment or tenant client-credentials bearer
+     * token — the end user's own access token doesn't satisfy that (401).
+     * A browser app has no client secret to present, so this will fail from
+     * `@authyon/auth` in practice; call it from your backend via
+     * `@authyon/server` instead.
+     */
     introspect(token?: string): Promise<IntrospectResult>;
-    /** POST /auth/validate — recommended: cross-checks DB state, returns user + organization. */
+    /**
+     * POST /auth/validate — recommended: cross-checks DB state, catches
+     * revocation immediately. Same caller-authentication requirement (and
+     * the same practical limitation from the browser) as `introspect()`.
+     */
     validate(token?: string): Promise<ValidateResult>;
 }
 /** Convenience factory: `const authyon = createClient({ envKey: "pk_live_..." })`. */

package/dist/index.d.ts

@@ -15,10 +15,14 @@ interface CreateOrganizationParams {
     slug?: string;
     description?: string;
 }
+/** GET /auth/tenants/{organizationId}/members — confirmed against the live API. */
 interface OrganizationMember {
     userId: string;
     email?: string;
+    username?: string;
     roles?: string[];
+    createdAt?: string;
+    lastLoginAt?: string | null;
 }
 /** POST /auth/tenants/{tenantId}/members — invites a member by e-mail. */
 interface InviteMemberParams {
@@ -181,17 +185,32 @@ interface SessionInfo {
     lastUsedAt?: string | null;
     lastUsedFromIp?: string | null;
 }
+/** POST /auth/introspect (RFC 7662) — confirmed against the live API. */
 interface IntrospectResult {
     active: boolean;
     sub?: string;
+    username?: string | null;
+    email?: string | null;
+    roles?: string[] | null;
+    permissions?: string[];
     client_id?: string;
     scope?: string;
     exp?: number;
+    iat?: number;
+    jti?: string;
     token_type?: string;
 }
+/**
+ * POST /auth/validate — confirmed against the live API. The wire shape is
+ * `{ valid, reason, profile }`, not `{ user, organization }` as the
+ * OpenAPI schema (which didn't document response bodies) suggested.
+ * `profile` is `null` for machine tokens (there's no user behind them) and
+ * for tokens that fail validation.
+ */
 interface ValidateResult {
-    user: User;
-    organization?: Organization | null;
+    valid: boolean;
+    reason?: string | null;
+    user: User | null;
 }
 type AuthEvent = {
     type: "signed_in";
@@ -349,8 +368,13 @@ declare class AuthyonClient {
         /** The organization the current session is scoped to, from the cached session — no network call. */
         current: () => Organization | null;
         members: {
-            /** GET /auth/tenants/{organizationId}/members — list an organization's members. */
-            list: (organizationId: string, params?: PageParams) => Promise<OrganizationMember[]>;
+            /**
+             * GET /auth/tenants/{organizationId}/members — paginated list of an
+             * organization's members. Consistent with the confirmed-live
+             * `Page<T>` envelope every other `skip`/`take` endpoint returns
+             * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
+             */
+            list: (organizationId: string, params?: PageParams) => Promise<Page<OrganizationMember>>;
             /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
             invite: (organizationId: string, params: InviteMemberParams) => Promise<void>;
             /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
@@ -405,9 +429,22 @@ declare class AuthyonClient {
             assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
         };
     };
-    /** POST /auth/introspect — lightweight token introspection. */
+    /**
+     * POST /auth/introspect — lightweight token introspection (RFC 7662).
+     *
+     * ⚠️ Confirmed live: this endpoint requires the CALLER to also
+     * authenticate, with an environment or tenant client-credentials bearer
+     * token — the end user's own access token doesn't satisfy that (401).
+     * A browser app has no client secret to present, so this will fail from
+     * `@authyon/auth` in practice; call it from your backend via
+     * `@authyon/server` instead.
+     */
     introspect(token?: string): Promise<IntrospectResult>;
-    /** POST /auth/validate — recommended: cross-checks DB state, returns user + organization. */
+    /**
+     * POST /auth/validate — recommended: cross-checks DB state, catches
+     * revocation immediately. Same caller-authentication requirement (and
+     * the same practical limitation from the browser) as `introspect()`.
+     */
     validate(token?: string): Promise<ValidateResult>;
 }
 /** Convenience factory: `const authyon = createClient({ envKey: "pk_live_..." })`. */

package/dist/index.js

@@ -66,6 +66,22 @@ function defaultStorage() {
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.authyon.com";
 var EXPIRY_SKEW_MS = 3e4;
+var FALLBACK_EXPIRES_IN = 1800;
+function readTokens(raw) {
+  const tokens = raw.tokens ?? raw;
+  if (!tokens.accessToken || !tokens.refreshToken) {
+    throw new AuthyonError(502, {
+      code: "session.malformed",
+      title: "Malformed session response",
+      detail: "The session response carried no access/refresh token pair."
+    });
+  }
+  return {
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    expiresIn: tokens.expiresIn ?? FALLBACK_EXPIRES_IN
+  };
+}
 var AuthyonClient = class {
   constructor(options) {
     this.listeners = /* @__PURE__ */ new Set();
@@ -81,7 +97,7 @@ var AuthyonClient = class {
       loginFinish: (assertion) => this.request("/auth/webauthn/login/finish", {
         method: "POST",
         body: assertion
-      }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
+      }).then((data) => this.setSession({ tokens: readTokens(data) }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── Social sign-in (SSO) ─────────────────────────────────────────────────
     this.sso = {
@@ -102,7 +118,7 @@ var AuthyonClient = class {
        * POST /auth/sso/exchange — swaps the one-time code from the provider
        * callback for tokens and stores the session.
        */
-      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
+      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then((data) => this.setSession({ tokens: readTokens(data) }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── User ─────────────────────────────────────────────────────────────────
     this.user = {
@@ -160,11 +176,16 @@ var AuthyonClient = class {
         method: "POST",
         bearer: true,
         body: { tenantSlug: organizationSlug }
-      }).then((data) => this.setSession({ tokens: data.tokens }, "refreshed")).then((session) => this.hydrateUser(session)),
+      }).then((data) => this.setSession({ tokens: readTokens(data) }, "refreshed")).then((session) => this.hydrateUser(session)),
       /** The organization the current session is scoped to, from the cached session — no network call. */
       current: () => this.getSession()?.user?.activeOrganization ?? null,
       members: {
-        /** GET /auth/tenants/{organizationId}/members — list an organization's members. */
+        /**
+         * GET /auth/tenants/{organizationId}/members — paginated list of an
+         * organization's members. Consistent with the confirmed-live
+         * `Page<T>` envelope every other `skip`/`take` endpoint returns
+         * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
+         */
         list: (organizationId, params = {}) => this.request(
           `/auth/tenants/${encodeURIComponent(organizationId)}/members?${toQuery(params)}`,
           { bearer: true }
@@ -382,7 +403,9 @@ var AuthyonClient = class {
     if (data.twoFactor) {
       return { twoFactorRequired: true, ...data.twoFactor };
     }
-    const session = await this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
+    const session = await this.hydrateUser(
+      this.setSession({ tokens: readTokens(data) }, "signed_in")
+    );
     return { twoFactorRequired: false, session };
   }
   /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
@@ -391,7 +414,7 @@ var AuthyonClient = class {
       method: "POST",
       body: params
     });
-    return this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
+    return this.hydrateUser(this.setSession({ tokens: readTokens(data) }, "signed_in"));
   }
   /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
   async refresh() {
@@ -404,7 +427,7 @@ var AuthyonClient = class {
       body: { refreshToken: current.refreshToken }
     }).then(
       (data) => this.setSession(
-        { tokens: data.tokens, user: current.user },
+        { tokens: readTokens(data), user: current.user },
         "refreshed"
       )
     ).catch((error) => {
@@ -439,21 +462,32 @@ var AuthyonClient = class {
     this.clearSession();
   }
   // ── Token verification ───────────────────────────────────────────────────
-  /** POST /auth/introspect — lightweight token introspection. */
+  /**
+   * POST /auth/introspect — lightweight token introspection (RFC 7662).
+   *
+   * ⚠️ Confirmed live: this endpoint requires the CALLER to also
+   * authenticate, with an environment or tenant client-credentials bearer
+   * token — the end user's own access token doesn't satisfy that (401).
+   * A browser app has no client secret to present, so this will fail from
+   * `@authyon/auth` in practice; call it from your backend via
+   * `@authyon/server` instead.
+   */
   async introspect(token) {
     const accessToken = token ?? await this.getAccessToken();
     return this.request("/auth/introspect", { method: "POST", body: { token: accessToken } });
   }
-  /** POST /auth/validate — recommended: cross-checks DB state, returns user + organization. */
+  /**
+   * POST /auth/validate — recommended: cross-checks DB state, catches
+   * revocation immediately. Same caller-authentication requirement (and
+   * the same practical limitation from the browser) as `introspect()`.
+   */
   async validate(token) {
     const accessToken = token ?? await this.getAccessToken();
-    const raw = await this.request("/auth/validate", {
-      method: "POST",
-      headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : void 0
-    });
+    const raw = await this.request("/auth/validate", { method: "POST", body: { token: accessToken } });
     return {
-      user: normalizeUser(raw.user),
-      organization: raw.organization ?? raw.tenant ?? null
+      valid: raw.valid,
+      reason: raw.reason ?? null,
+      user: raw.profile ? normalizeUser(raw.profile) : null
     };
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",