@authyon/auth 0.2.0-beta.5 → 0.2.0-beta.8

package/README.md

@@ -229,7 +229,7 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 
 | Método                                                | Endpoint                                       |
 | ----------------------------------------------------- | ---------------------------------------------- |
-| `organization.list()`                                 | `GET /auth/tenants`                            |
+| `organization.list({ search?, skip?, take? })`        | `GET /auth/tenants`                            |
 | `organization.create(params?)`                        | `POST /auth/tenants`                           |
 | `organization.get(organizationId)`                    | `GET /auth/tenants/{id}`                       |
 | `organization.rename(organizationId, name)`           | `PATCH /auth/tenants/{id}`                     |

package/dist/{ability-g6nBpOQM.d.cts → ability-Ckd9YAQI.d.cts}

@@ -93,6 +93,8 @@ interface Organization {
     name?: string;
     description?: string;
     roles?: string[];
+    /** JSON-encoded metadata visible to members of the organization. */
+    publicMetadata?: string;
 }
 /** POST /auth/tenants — creates an organization owned by the signed-in user. */
 interface CreateOrganizationInput {
@@ -289,6 +291,12 @@ type AuthState = "signed_out" | "authenticated" | "expired";
 interface AuthyonClientOptions {
     /** Publishable environment key (`pk_live_...` / `pk_test_...`). */
     envKey: string;
+    /**
+     * Originating client IP to forward on every API call as `X-Forwarded-For`.
+     * Browsers cannot reliably discover their public IP by themselves; set this
+     * only when your application receives it from trusted infrastructure.
+     */
+    clientIp?: string;
     /** API origin. Defaults to `https://api.authyon.com`; HTTPS is required outside loopback. */
     baseUrl?: string;
     /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
@@ -312,6 +320,7 @@ interface AuthyonClientOptions {
 
 declare class AuthyonClient {
     private readonly envKey;
+    private readonly clientIp?;
     private readonly baseUrl;
     private readonly storage;
     private readonly autoRefresh;
@@ -421,8 +430,10 @@ declare class AuthyonClient {
         confirmPasswordReset: (token: string, newPassword: string) => Promise<void>;
     };
     readonly organization: {
-        /** GET /auth/tenants — all organization memberships. */
-        list: () => Promise<Organization[]>;
+        /** GET /auth/tenants — filterable list of organization memberships. */
+        list: (params?: {
+            search?: string;
+        } & PaginationOptions) => Promise<Organization[]>;
         /**
          * POST /auth/tenants — creates an organization owned by the signed-in
          * user (only available when self-service organization creation is
@@ -578,6 +589,13 @@ interface AuthyonPermissionSource {
     /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
     scope?: string | null;
 }
+/** A declarative group of permissions evaluated against an Authyon permission source. */
+interface PermissionGroup {
+    /** Permissions that must all be granted. */
+    allOf?: readonly string[];
+    /** Permissions where at least one must be granted. */
+    anyOf?: readonly string[];
+}
 interface AuthyonAbilityOptions {
     rules?: readonly AbilityRule[];
     /** Rules added when the source contains a matching Authyon role. */
@@ -611,7 +629,12 @@ declare class AuthyonAbilityBuilder {
 declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
 /** Checks an Authyon permission string using the same wildcard rules as an ability. */
 declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
+/**
+ * Checks a permission group using Authyon's standard permission and wildcard rules.
+ * Empty or omitted groups do not add authorization requirements.
+ */
+declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly string[], group: PermissionGroup): boolean;
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { createAuthyonRules as $, AuthyonClient as A, type SessionControllerOptions as B, type CreateOrganizationInput as C, type SessionInfo as D, type SessionSnapshot as E, FetchHttpAdapter as F, type SessionSnapshotListener as G, type HttpAdapter as H, type IntrospectResult as I, type SessionStatus as J, type SsoProvider as K, LoggingHttpAdapter as L, type TwoFactorChallenge as M, type TwoFactorMethod as N, type Organization as O, type Paged as P, type TwoFactorStatus as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type User as U, type ValidateResult as V, type VerifyTwoFactorInput as W, type WebAuthnAssertion as X, type WebAuthnCeremonyStart as Y, type WebAuthnCredential as Z, createAuthyonAbility as _, type HttpLoggerOptions as a, createClient as a0, hasPermission as a1, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type Role as z };
+export { createAuthyonAbility as $, AuthyonClient as A, type Role as B, type CreateOrganizationInput as C, type SessionControllerOptions as D, type SessionInfo as E, FetchHttpAdapter as F, type SessionSnapshot as G, type HttpAdapter as H, type IntrospectResult as I, type SessionSnapshotListener as J, type SessionStatus as K, LoggingHttpAdapter as L, type SsoProvider as M, type TwoFactorChallenge as N, type Organization as O, type Paged as P, type TwoFactorMethod as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type TwoFactorStatus as U, type User as V, type ValidateResult as W, type VerifyTwoFactorInput as X, type WebAuthnAssertion as Y, type WebAuthnCeremonyStart as Z, type WebAuthnCredential as _, type HttpLoggerOptions as a, createAuthyonRules as a0, createClient as a1, hasPermission as a2, hasPermissionGroup as a3, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type PermissionGroup as z };

package/dist/{ability-g6nBpOQM.d.ts → ability-Ckd9YAQI.d.ts}

@@ -93,6 +93,8 @@ interface Organization {
     name?: string;
     description?: string;
     roles?: string[];
+    /** JSON-encoded metadata visible to members of the organization. */
+    publicMetadata?: string;
 }
 /** POST /auth/tenants — creates an organization owned by the signed-in user. */
 interface CreateOrganizationInput {
@@ -289,6 +291,12 @@ type AuthState = "signed_out" | "authenticated" | "expired";
 interface AuthyonClientOptions {
     /** Publishable environment key (`pk_live_...` / `pk_test_...`). */
     envKey: string;
+    /**
+     * Originating client IP to forward on every API call as `X-Forwarded-For`.
+     * Browsers cannot reliably discover their public IP by themselves; set this
+     * only when your application receives it from trusted infrastructure.
+     */
+    clientIp?: string;
     /** API origin. Defaults to `https://api.authyon.com`; HTTPS is required outside loopback. */
     baseUrl?: string;
     /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
@@ -312,6 +320,7 @@ interface AuthyonClientOptions {
 
 declare class AuthyonClient {
     private readonly envKey;
+    private readonly clientIp?;
     private readonly baseUrl;
     private readonly storage;
     private readonly autoRefresh;
@@ -421,8 +430,10 @@ declare class AuthyonClient {
         confirmPasswordReset: (token: string, newPassword: string) => Promise<void>;
     };
     readonly organization: {
-        /** GET /auth/tenants — all organization memberships. */
-        list: () => Promise<Organization[]>;
+        /** GET /auth/tenants — filterable list of organization memberships. */
+        list: (params?: {
+            search?: string;
+        } & PaginationOptions) => Promise<Organization[]>;
         /**
          * POST /auth/tenants — creates an organization owned by the signed-in
          * user (only available when self-service organization creation is
@@ -578,6 +589,13 @@ interface AuthyonPermissionSource {
     /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
     scope?: string | null;
 }
+/** A declarative group of permissions evaluated against an Authyon permission source. */
+interface PermissionGroup {
+    /** Permissions that must all be granted. */
+    allOf?: readonly string[];
+    /** Permissions where at least one must be granted. */
+    anyOf?: readonly string[];
+}
 interface AuthyonAbilityOptions {
     rules?: readonly AbilityRule[];
     /** Rules added when the source contains a matching Authyon role. */
@@ -611,7 +629,12 @@ declare class AuthyonAbilityBuilder {
 declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
 /** Checks an Authyon permission string using the same wildcard rules as an ability. */
 declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
+/**
+ * Checks a permission group using Authyon's standard permission and wildcard rules.
+ * Empty or omitted groups do not add authorization requirements.
+ */
+declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly string[], group: PermissionGroup): boolean;
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { createAuthyonRules as $, AuthyonClient as A, type SessionControllerOptions as B, type CreateOrganizationInput as C, type SessionInfo as D, type SessionSnapshot as E, FetchHttpAdapter as F, type SessionSnapshotListener as G, type HttpAdapter as H, type IntrospectResult as I, type SessionStatus as J, type SsoProvider as K, LoggingHttpAdapter as L, type TwoFactorChallenge as M, type TwoFactorMethod as N, type Organization as O, type Paged as P, type TwoFactorStatus as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type User as U, type ValidateResult as V, type VerifyTwoFactorInput as W, type WebAuthnAssertion as X, type WebAuthnCeremonyStart as Y, type WebAuthnCredential as Z, createAuthyonAbility as _, type HttpLoggerOptions as a, createClient as a0, hasPermission as a1, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type Role as z };
+export { createAuthyonAbility as $, AuthyonClient as A, type Role as B, type CreateOrganizationInput as C, type SessionControllerOptions as D, type SessionInfo as E, FetchHttpAdapter as F, type SessionSnapshot as G, type HttpAdapter as H, type IntrospectResult as I, type SessionSnapshotListener as J, type SessionStatus as K, LoggingHttpAdapter as L, type SsoProvider as M, type TwoFactorChallenge as N, type Organization as O, type Paged as P, type TwoFactorMethod as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type TwoFactorStatus as U, type User as V, type ValidateResult as W, type VerifyTwoFactorInput as X, type WebAuthnAssertion as Y, type WebAuthnCeremonyStart as Z, type WebAuthnCredential as _, type HttpLoggerOptions as a, createAuthyonRules as a0, createClient as a1, hasPermission as a2, hasPermissionGroup as a3, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type PermissionGroup as z };

package/dist/{chunk-EHZEUM47.js → chunk-3XJY6BCI.js}

@@ -201,6 +201,11 @@ function hasPermission(source, requiredPermission) {
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
   return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
 }
+function hasPermissionGroup(source, group) {
+  const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
+  const hasAny = !group.anyOf?.length || group.anyOf.some((permission) => hasPermission(source, permission));
+  return hasAll && hasAny;
+}
 function isPermissionList(source) {
   return Array.isArray(source);
 }
@@ -319,5 +324,6 @@ export {
   AuthyonAbilityBuilder,
   createAuthyonAbility,
   hasPermission,
+  hasPermissionGroup,
   createAuthyonRules
 };

package/dist/index.cjs

@@ -35,7 +35,8 @@ __export(index_exports, {
   createDefaultStorage: () => createDefaultStorage,
   createLocalStorage: () => createLocalStorage,
   createMemoryStorage: () => createMemoryStorage,
-  hasPermission: () => hasPermission
+  hasPermission: () => hasPermission,
+  hasPermissionGroup: () => hasPermissionGroup
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -403,6 +404,28 @@ var JsonHttpClient = class {
   }
 };
 
+// ../../internal/core/http/clientIp.ts
+function clientIpHeaders(context) {
+  if (!context?.clientIp) return {};
+  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+}
+function normalizeClientIp(value) {
+  let ip = value.trim();
+  if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
+  if (!ip || ip.length > 45 || ip.includes(",") || /[\r\n\s]/.test(ip) || !/^[0-9a-f:.]+$/i.test(ip) || !ip.includes(".") && !ip.includes(":")) {
+    throw invalidClientIp();
+  }
+  try {
+    new URL(ip.includes(":") ? `http://[${ip}]` : `http://${ip}`);
+  } catch {
+    throw invalidClientIp();
+  }
+  return ip;
+}
+function invalidClientIp() {
+  return new Error("Authyon: `clientIp` must be a single valid IPv4 or IPv6 address");
+}
+
 // src/client/authyonClient.ts
 var FALLBACK_EXPIRES_IN = 1800;
 function readTokens(raw) {
@@ -490,8 +513,8 @@ var AuthyonClient = class {
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {
-      /** GET /auth/tenants — all organization memberships. */
-      list: () => this.request("/auth/tenants", { bearer: true }),
+      /** GET /auth/tenants — filterable list of organization memberships. */
+      list: (params = {}) => this.request(appendQuery("/auth/tenants", params), { bearer: true }),
       /**
        * POST /auth/tenants — creates an organization owned by the signed-in
        * user (only available when self-service organization creation is
@@ -618,6 +641,7 @@ var AuthyonClient = class {
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -730,6 +754,7 @@ var AuthyonClient = class {
   async request(path, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
+      ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
     };
     if (options.bearer) {
@@ -894,6 +919,10 @@ var AuthyonClientBuilder = class {
     this.options.autoRefresh = enabled;
     return this;
   }
+  withClientIp(clientIp) {
+    this.options.clientIp = clientIp;
+    return this;
+  }
   withTimeout(timeoutMs) {
     this.options.timeoutMs = timeoutMs;
     return this;
@@ -1114,6 +1143,11 @@ function hasPermission(source, requiredPermission) {
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
   return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
 }
+function hasPermissionGroup(source, group) {
+  const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
+  const hasAny = !group.anyOf?.length || group.anyOf.some((permission) => hasPermission(source, permission));
+  return hasAll && hasAny;
+}
 function isPermissionList(source) {
   return Array.isArray(source);
 }
@@ -1242,5 +1276,6 @@ function isAbilityRule(value) {
   createDefaultStorage,
   createLocalStorage,
   createMemoryStorage,
-  hasPermission
+  hasPermission,
+  hasPermissionGroup
 });

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-g6nBpOQM.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, R as RegisterInput, z as Role, S as Session, B as SessionControllerOptions, D as SessionInfo, E as SessionSnapshot, G as SessionSnapshotListener, J as SessionStatus, K as SsoProvider, M as TwoFactorChallenge, N as TwoFactorMethod, Q as TwoFactorStatus, U as User, V as ValidateResult, W as VerifyTwoFactorInput, X as WebAuthnAssertion, Y as WebAuthnCeremonyStart, Z as WebAuthnCredential, _ as createAuthyonAbility, $ as createAuthyonRules, a0 as createClient, a1 as hasPermission } from './ability-g6nBpOQM.cjs';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Ckd9YAQI.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, z as PermissionGroup, R as RegisterInput, B as Role, S as Session, D as SessionControllerOptions, E as SessionInfo, G as SessionSnapshot, J as SessionSnapshotListener, K as SessionStatus, M as SsoProvider, N as TwoFactorChallenge, Q as TwoFactorMethod, U as TwoFactorStatus, V as User, W as ValidateResult, X as VerifyTwoFactorInput, Y as WebAuthnAssertion, Z as WebAuthnCeremonyStart, _ as WebAuthnCredential, $ as createAuthyonAbility, a0 as createAuthyonRules, a1 as createClient, a2 as hasPermission, a3 as hasPermissionGroup } from './ability-Ckd9YAQI.cjs';
 
 /** Builds an Authyon browser client through explicit, progressive configuration. */
 declare class AuthyonClientBuilder {
@@ -8,6 +8,7 @@ declare class AuthyonClientBuilder {
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withStorage(storage: TokenStorage): this;
     withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;
     withHttpLogger(httpLogger: HttpLoggerOptions): this;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-g6nBpOQM.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, R as RegisterInput, z as Role, S as Session, B as SessionControllerOptions, D as SessionInfo, E as SessionSnapshot, G as SessionSnapshotListener, J as SessionStatus, K as SsoProvider, M as TwoFactorChallenge, N as TwoFactorMethod, Q as TwoFactorStatus, U as User, V as ValidateResult, W as VerifyTwoFactorInput, X as WebAuthnAssertion, Y as WebAuthnCeremonyStart, Z as WebAuthnCredential, _ as createAuthyonAbility, $ as createAuthyonRules, a0 as createClient, a1 as hasPermission } from './ability-g6nBpOQM.js';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Ckd9YAQI.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, z as PermissionGroup, R as RegisterInput, B as Role, S as Session, D as SessionControllerOptions, E as SessionInfo, G as SessionSnapshot, J as SessionSnapshotListener, K as SessionStatus, M as SsoProvider, N as TwoFactorChallenge, Q as TwoFactorMethod, U as TwoFactorStatus, V as User, W as ValidateResult, X as VerifyTwoFactorInput, Y as WebAuthnAssertion, Z as WebAuthnCeremonyStart, _ as WebAuthnCredential, $ as createAuthyonAbility, a0 as createAuthyonRules, a1 as createClient, a2 as hasPermission, a3 as hasPermissionGroup } from './ability-Ckd9YAQI.js';
 
 /** Builds an Authyon browser client through explicit, progressive configuration. */
 declare class AuthyonClientBuilder {
@@ -8,6 +8,7 @@ declare class AuthyonClientBuilder {
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withStorage(storage: TokenStorage): this;
     withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;
     withHttpLogger(httpLogger: HttpLoggerOptions): this;

package/dist/index.js

@@ -4,8 +4,9 @@ import {
   AuthyonSessionController,
   createAuthyonAbility,
   createAuthyonRules,
-  hasPermission
-} from "./chunk-EHZEUM47.js";
+  hasPermission,
+  hasPermissionGroup
+} from "./chunk-3XJY6BCI.js";
 
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
@@ -371,6 +372,28 @@ var JsonHttpClient = class {
   }
 };
 
+// ../../internal/core/http/clientIp.ts
+function clientIpHeaders(context) {
+  if (!context?.clientIp) return {};
+  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+}
+function normalizeClientIp(value) {
+  let ip = value.trim();
+  if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
+  if (!ip || ip.length > 45 || ip.includes(",") || /[\r\n\s]/.test(ip) || !/^[0-9a-f:.]+$/i.test(ip) || !ip.includes(".") && !ip.includes(":")) {
+    throw invalidClientIp();
+  }
+  try {
+    new URL(ip.includes(":") ? `http://[${ip}]` : `http://${ip}`);
+  } catch {
+    throw invalidClientIp();
+  }
+  return ip;
+}
+function invalidClientIp() {
+  return new Error("Authyon: `clientIp` must be a single valid IPv4 or IPv6 address");
+}
+
 // src/client/authyonClient.ts
 var FALLBACK_EXPIRES_IN = 1800;
 function readTokens(raw) {
@@ -458,8 +481,8 @@ var AuthyonClient = class {
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {
-      /** GET /auth/tenants — all organization memberships. */
-      list: () => this.request("/auth/tenants", { bearer: true }),
+      /** GET /auth/tenants — filterable list of organization memberships. */
+      list: (params = {}) => this.request(appendQuery("/auth/tenants", params), { bearer: true }),
       /**
        * POST /auth/tenants — creates an organization owned by the signed-in
        * user (only available when self-service organization creation is
@@ -586,6 +609,7 @@ var AuthyonClient = class {
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -698,6 +722,7 @@ var AuthyonClient = class {
   async request(path, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
+      ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
     };
     if (options.bearer) {
@@ -862,6 +887,10 @@ var AuthyonClientBuilder = class {
     this.options.autoRefresh = enabled;
     return this;
   }
+  withClientIp(clientIp) {
+    this.options.clientIp = clientIp;
+    return this;
+  }
   withTimeout(timeoutMs) {
     this.options.timeoutMs = timeoutMs;
     return this;
@@ -894,5 +923,6 @@ export {
   createDefaultStorage,
   createLocalStorage,
   createMemoryStorage,
-  hasPermission
+  hasPermission,
+  hasPermissionGroup
 };

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { U as User, B as SessionControllerOptions, A as AuthyonClient, E as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-g6nBpOQM.cjs';
-export { q as AuthyonSessionController, G as SessionSnapshotListener, J as SessionStatus } from '../ability-g6nBpOQM.cjs';
+import { V as User, D as SessionControllerOptions, A as AuthyonClient, G as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-Ckd9YAQI.cjs';
+export { q as AuthyonSessionController, J as SessionSnapshotListener, K as SessionStatus } from '../ability-Ckd9YAQI.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { U as User, B as SessionControllerOptions, A as AuthyonClient, E as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-g6nBpOQM.js';
-export { q as AuthyonSessionController, G as SessionSnapshotListener, J as SessionStatus } from '../ability-g6nBpOQM.js';
+import { V as User, D as SessionControllerOptions, A as AuthyonClient, G as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-Ckd9YAQI.js';
+export { q as AuthyonSessionController, J as SessionSnapshotListener, K as SessionStatus } from '../ability-Ckd9YAQI.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.js

@@ -2,7 +2,7 @@
 import {
   AuthyonSessionController,
   createAuthyonAbility
-} from "../chunk-EHZEUM47.js";
+} from "../chunk-3XJY6BCI.js";
 
 // src/react/index.tsx
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.5",
+  "version": "0.2.0-beta.8",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",