@authyon/server 0.2.0-beta.1 → 0.2.0-beta.2

package/README.md

@@ -5,7 +5,7 @@ SDK server-side para o [Authyon](https://authyon.com) — administração de amb
 ## Instalação da beta
 
 ```bash
-npm install --save-exact @authyon/server@0.2.0-beta.1
+npm install --save-exact @authyon/server@0.2.0-beta.2
 ```
 
 Durante a beta, `npm install @authyon/server@beta` acompanha o prerelease mais recente. Fixar a versão exata é recomendado para builds reproduzíveis.
@@ -93,6 +93,11 @@ Usa as credenciais de ambiente (`clientId`/`clientSecret`) automaticamente — o
 
 ```ts
 const org = await authyon.environment.tenants.create({ name: "Acme", slug: "acme" });
+const tenants = await authyon.environment.tenants.list({
+  search: "acme",
+  skip: 0,
+  take: 20,
+});
 await authyon.environment.tenants.members.add(org.id, userId, ["owner"]);
 await authyon.environment.tenants.members.assignRole(org.id, userId, "billing-admin");
 await authyon.environment.tenants.members.remove(org.id, userId);

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(index_exports, {
   createAuthyonRules: () => createAuthyonRules,
   createClient: () => createClient,
   createExpressAuthorizationMiddleware: () => createExpressAuthorizationMiddleware,
+  hasPermission: () => hasPermission,
   normalizeClientIp: () => normalizeClientIp
 });
 module.exports = __toCommonJS(index_exports);
@@ -663,8 +664,8 @@ var AuthyonServerClient = class {
         )
       },
       tenants: {
-        /** GET /env/tenants — list tenants in the environment. */
-        list: () => this.request("/env/tenants", { envBearer: true }),
+        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
         /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -1080,6 +1081,17 @@ var AuthyonAbilityBuilder = class {
 function createAuthyonAbility(source = {}, options = {}) {
   return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
 }
+function hasPermission(source, requiredPermission) {
+  const requirement = permissionToRule(requiredPermission);
+  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
+    return false;
+  }
+  const permissionSource = isPermissionList(source) ? { permissions: source } : source;
+  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
+}
+function isPermissionList(source) {
+  return Array.isArray(source);
+}
 function createAuthyonRules(source = {}, options = {}) {
   const permissions = /* @__PURE__ */ new Set([
     ...source.permissions ?? [],
@@ -1109,9 +1121,14 @@ function permissionToRule(permission) {
 }
 function matchesToken(value, expected, wildcard) {
   return (Array.isArray(value) ? value : [value]).some(
-    (candidate) => candidate === expected || candidate === wildcard || candidate === "*"
+    (candidate) => candidate === expected || candidate === wildcard || candidate === "*" || matchesSegments(candidate, expected)
   );
 }
+function matchesSegments(pattern, value) {
+  const patternSegments = pattern.split(":");
+  const valueSegments = value.split(":");
+  return patternSegments.length === valueSegments.length && patternSegments.every((segment, index) => segment === "*" || segment === valueSegments[index]);
+}
 function matchesField(pattern, field) {
   if (pattern === "*" || pattern === field) return true;
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
@@ -1324,5 +1341,6 @@ function unauthenticated() {
   createAuthyonRules,
   createClient,
   createExpressAuthorizationMiddleware,
+  hasPermission,
   normalizeClientIp
 });

package/dist/index.d.cts

@@ -118,6 +118,8 @@ interface User {
     id: string;
     email: string;
     username?: string;
+    /** Environment-level roles from the database-validated user profile. */
+    roles?: string[];
     permissions?: string[];
 }
 interface RoleGrant {
@@ -278,8 +280,7 @@ type LoginActivity = AuditEvent;
 /**
  * Envelope every `skip`/`take`-paginated list endpoint returns, confirmed
  * live for `/env/users`, `/env/audit` and `/env/audit/login-activity`.
- * Endpoints without `skip`/`take` params (e.g. `/env/tenants`) return a
- * bare array instead.
+ * Endpoints without `skip`/`take` params return a bare array instead.
  */
 /** OAuth 2.0 client-credentials pair minted in the Authyon console. */
 interface ClientCredentials {
@@ -476,8 +477,10 @@ declare class AuthyonServerClient {
             removeTenant: (userId: string, tenantId: string) => Promise<void>;
         };
         tenants: {
-            /** GET /env/tenants — list tenants in the environment. */
-            list: () => Promise<Organization[]>;
+            /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+            list: (params?: {
+                search?: string;
+            } & PaginationOptions) => Promise<Paged<Organization>>;
             /** POST /env/tenants — create a tenant in the environment. */
             create: (input: CreateOrganizationInput) => Promise<Organization>;
             /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -733,6 +736,8 @@ declare class AuthyonAbilityBuilder {
 }
 /** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
 declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
+/** Checks an Authyon permission string using the same wildcard rules as an ability. */
+declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
@@ -798,4 +803,4 @@ declare function createExpressAuthorizationMiddleware(client: AuthyonServerClien
 /** Converts an authorization error into a Fetch Response suitable for Next.js. */
 declare function createAuthorizationErrorResponse(error: unknown): Response;
 
-export { type AbilityConditions, type AbilityEvent, type AbilityListener, type AbilityRequirement, type AbilityRule, type AbilitySubject, type AuditEvent, type AuthorizationContext, AuthorizationError, type AuthorizationOptions, AuthyonAbility, AuthyonAbilityBuilder, type AuthyonAbilityOptions, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, type AuthyonJwksDiscoveryOptions, type AuthyonJwtClaims, type AuthyonPermissionSource, AuthyonServerClient, AuthyonServerClientBuilder, type AuthyonServerClientOptions, type ClientCredentials, type ClientRequestContext, type CreateOrganizationInput, type CreatePermissionInput, type CreateUserInput, type EnvironmentUser, ErrorCodes, type ExpressAuthorizationMiddlewareOptions, type ExpressNext, type ExpressRequestLike, type ExpressResponseLike, FetchHttpAdapter, type HttpAdapter, type HttpAdapterRequest, type HttpLogEvent, type HttpLogger, type HttpLoggerOptions, type IntrospectResult, type JsonWebKeySet, JwksTokenVerifier, type JwksTokenVerifierOptions, type KnownErrorCode, LoggingHttpAdapter, type LoginActivity, type OpenIdConfiguration, type Organization, type Paged, type PaginationOptions, type Permission, type PermissionsByRole, type RequestAuthorizationOptions, type ReservedPermissions, type Role, type RoleGrant, type RoleInput, type RoleList, type RolePermissions, type SafeJwtAlgorithm, type TenantMembership, TenantScopedClient, type TokenResult, TokenVerificationError, type TokenVerificationErrorCode, type UpdateOrganizationInput, type User, type ValidateResult, type VerifiedAccessToken, authorizeRequest, authorizeToken, createAuthorizationErrorResponse, createAuthyonAbility, createAuthyonRules, createClient, createExpressAuthorizationMiddleware, normalizeClientIp };
+export { type AbilityConditions, type AbilityEvent, type AbilityListener, type AbilityRequirement, type AbilityRule, type AbilitySubject, type AuditEvent, type AuthorizationContext, AuthorizationError, type AuthorizationOptions, AuthyonAbility, AuthyonAbilityBuilder, type AuthyonAbilityOptions, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, type AuthyonJwksDiscoveryOptions, type AuthyonJwtClaims, type AuthyonPermissionSource, AuthyonServerClient, AuthyonServerClientBuilder, type AuthyonServerClientOptions, type ClientCredentials, type ClientRequestContext, type CreateOrganizationInput, type CreatePermissionInput, type CreateUserInput, type EnvironmentUser, ErrorCodes, type ExpressAuthorizationMiddlewareOptions, type ExpressNext, type ExpressRequestLike, type ExpressResponseLike, FetchHttpAdapter, type HttpAdapter, type HttpAdapterRequest, type HttpLogEvent, type HttpLogger, type HttpLoggerOptions, type IntrospectResult, type JsonWebKeySet, JwksTokenVerifier, type JwksTokenVerifierOptions, type KnownErrorCode, LoggingHttpAdapter, type LoginActivity, type OpenIdConfiguration, type Organization, type Paged, type PaginationOptions, type Permission, type PermissionsByRole, type RequestAuthorizationOptions, type ReservedPermissions, type Role, type RoleGrant, type RoleInput, type RoleList, type RolePermissions, type SafeJwtAlgorithm, type TenantMembership, TenantScopedClient, type TokenResult, TokenVerificationError, type TokenVerificationErrorCode, type UpdateOrganizationInput, type User, type ValidateResult, type VerifiedAccessToken, authorizeRequest, authorizeToken, createAuthorizationErrorResponse, createAuthyonAbility, createAuthyonRules, createClient, createExpressAuthorizationMiddleware, hasPermission, normalizeClientIp };

package/dist/index.d.ts

@@ -118,6 +118,8 @@ interface User {
     id: string;
     email: string;
     username?: string;
+    /** Environment-level roles from the database-validated user profile. */
+    roles?: string[];
     permissions?: string[];
 }
 interface RoleGrant {
@@ -278,8 +280,7 @@ type LoginActivity = AuditEvent;
 /**
  * Envelope every `skip`/`take`-paginated list endpoint returns, confirmed
  * live for `/env/users`, `/env/audit` and `/env/audit/login-activity`.
- * Endpoints without `skip`/`take` params (e.g. `/env/tenants`) return a
- * bare array instead.
+ * Endpoints without `skip`/`take` params return a bare array instead.
  */
 /** OAuth 2.0 client-credentials pair minted in the Authyon console. */
 interface ClientCredentials {
@@ -476,8 +477,10 @@ declare class AuthyonServerClient {
             removeTenant: (userId: string, tenantId: string) => Promise<void>;
         };
         tenants: {
-            /** GET /env/tenants — list tenants in the environment. */
-            list: () => Promise<Organization[]>;
+            /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+            list: (params?: {
+                search?: string;
+            } & PaginationOptions) => Promise<Paged<Organization>>;
             /** POST /env/tenants — create a tenant in the environment. */
             create: (input: CreateOrganizationInput) => Promise<Organization>;
             /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -733,6 +736,8 @@ declare class AuthyonAbilityBuilder {
 }
 /** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
 declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
+/** Checks an Authyon permission string using the same wildcard rules as an ability. */
+declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
@@ -798,4 +803,4 @@ declare function createExpressAuthorizationMiddleware(client: AuthyonServerClien
 /** Converts an authorization error into a Fetch Response suitable for Next.js. */
 declare function createAuthorizationErrorResponse(error: unknown): Response;
 
-export { type AbilityConditions, type AbilityEvent, type AbilityListener, type AbilityRequirement, type AbilityRule, type AbilitySubject, type AuditEvent, type AuthorizationContext, AuthorizationError, type AuthorizationOptions, AuthyonAbility, AuthyonAbilityBuilder, type AuthyonAbilityOptions, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, type AuthyonJwksDiscoveryOptions, type AuthyonJwtClaims, type AuthyonPermissionSource, AuthyonServerClient, AuthyonServerClientBuilder, type AuthyonServerClientOptions, type ClientCredentials, type ClientRequestContext, type CreateOrganizationInput, type CreatePermissionInput, type CreateUserInput, type EnvironmentUser, ErrorCodes, type ExpressAuthorizationMiddlewareOptions, type ExpressNext, type ExpressRequestLike, type ExpressResponseLike, FetchHttpAdapter, type HttpAdapter, type HttpAdapterRequest, type HttpLogEvent, type HttpLogger, type HttpLoggerOptions, type IntrospectResult, type JsonWebKeySet, JwksTokenVerifier, type JwksTokenVerifierOptions, type KnownErrorCode, LoggingHttpAdapter, type LoginActivity, type OpenIdConfiguration, type Organization, type Paged, type PaginationOptions, type Permission, type PermissionsByRole, type RequestAuthorizationOptions, type ReservedPermissions, type Role, type RoleGrant, type RoleInput, type RoleList, type RolePermissions, type SafeJwtAlgorithm, type TenantMembership, TenantScopedClient, type TokenResult, TokenVerificationError, type TokenVerificationErrorCode, type UpdateOrganizationInput, type User, type ValidateResult, type VerifiedAccessToken, authorizeRequest, authorizeToken, createAuthorizationErrorResponse, createAuthyonAbility, createAuthyonRules, createClient, createExpressAuthorizationMiddleware, normalizeClientIp };
+export { type AbilityConditions, type AbilityEvent, type AbilityListener, type AbilityRequirement, type AbilityRule, type AbilitySubject, type AuditEvent, type AuthorizationContext, AuthorizationError, type AuthorizationOptions, AuthyonAbility, AuthyonAbilityBuilder, type AuthyonAbilityOptions, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, type AuthyonJwksDiscoveryOptions, type AuthyonJwtClaims, type AuthyonPermissionSource, AuthyonServerClient, AuthyonServerClientBuilder, type AuthyonServerClientOptions, type ClientCredentials, type ClientRequestContext, type CreateOrganizationInput, type CreatePermissionInput, type CreateUserInput, type EnvironmentUser, ErrorCodes, type ExpressAuthorizationMiddlewareOptions, type ExpressNext, type ExpressRequestLike, type ExpressResponseLike, FetchHttpAdapter, type HttpAdapter, type HttpAdapterRequest, type HttpLogEvent, type HttpLogger, type HttpLoggerOptions, type IntrospectResult, type JsonWebKeySet, JwksTokenVerifier, type JwksTokenVerifierOptions, type KnownErrorCode, LoggingHttpAdapter, type LoginActivity, type OpenIdConfiguration, type Organization, type Paged, type PaginationOptions, type Permission, type PermissionsByRole, type RequestAuthorizationOptions, type ReservedPermissions, type Role, type RoleGrant, type RoleInput, type RoleList, type RolePermissions, type SafeJwtAlgorithm, type TenantMembership, TenantScopedClient, type TokenResult, TokenVerificationError, type TokenVerificationErrorCode, type UpdateOrganizationInput, type User, type ValidateResult, type VerifiedAccessToken, authorizeRequest, authorizeToken, createAuthorizationErrorResponse, createAuthyonAbility, createAuthyonRules, createClient, createExpressAuthorizationMiddleware, hasPermission, normalizeClientIp };

package/dist/index.js

@@ -622,8 +622,8 @@ var AuthyonServerClient = class {
         )
       },
       tenants: {
-        /** GET /env/tenants — list tenants in the environment. */
-        list: () => this.request("/env/tenants", { envBearer: true }),
+        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
         /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -1039,6 +1039,17 @@ var AuthyonAbilityBuilder = class {
 function createAuthyonAbility(source = {}, options = {}) {
   return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
 }
+function hasPermission(source, requiredPermission) {
+  const requirement = permissionToRule(requiredPermission);
+  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
+    return false;
+  }
+  const permissionSource = isPermissionList(source) ? { permissions: source } : source;
+  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
+}
+function isPermissionList(source) {
+  return Array.isArray(source);
+}
 function createAuthyonRules(source = {}, options = {}) {
   const permissions = /* @__PURE__ */ new Set([
     ...source.permissions ?? [],
@@ -1068,9 +1079,14 @@ function permissionToRule(permission) {
 }
 function matchesToken(value, expected, wildcard) {
   return (Array.isArray(value) ? value : [value]).some(
-    (candidate) => candidate === expected || candidate === wildcard || candidate === "*"
+    (candidate) => candidate === expected || candidate === wildcard || candidate === "*" || matchesSegments(candidate, expected)
   );
 }
+function matchesSegments(pattern, value) {
+  const patternSegments = pattern.split(":");
+  const valueSegments = value.split(":");
+  return patternSegments.length === valueSegments.length && patternSegments.every((segment, index) => segment === "*" || segment === valueSegments[index]);
+}
 function matchesField(pattern, field) {
   if (pattern === "*" || pattern === field) return true;
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
@@ -1282,5 +1298,6 @@ export {
   createAuthyonRules,
   createClient,
   createExpressAuthorizationMiddleware,
+  hasPermission,
   normalizeClientIp
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.1",
+  "version": "0.2.0-beta.2",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",