@authyon/server 0.2.0-beta.14 → 0.2.0-beta.16

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   JsonHttpClient,
   LoggingHttpAdapter,
   createSharedTransport
-} from "./chunk-TWUVXZOT.js";
+} from "./chunk-TDJNBD3Z.js";
 import {
   AuthorizationError,
   AuthyonAbility,
@@ -146,29 +146,34 @@ async function allCredentials(request, path2) {
   throw new Error("Authyon: use listPage for more than 1000 credential pages.");
 }
 
-// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+// ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
   if (typeof id !== "string" || !id.trim())
-    throw new TypeError("Authyon: a financial authorization id is required.");
+    throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
-function subjectFinancialAuthorizations(request) {
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
   return {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id) => request(path(id)),
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
-    /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
-     *
-     * Pass the authenticator code or passkey assertion to verify the second
-     * factor inline (recommended). Without `input`, the session itself must
-     * have used a passkey or authenticator code within the last 5 minutes,
-     * otherwise the API answers `step_up_required`.
-     */
-    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
   };
 }
 
@@ -200,10 +205,35 @@ var UserScopedClient = class {
         remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
+      },
+      /**
+       * Invites by e-mail or by link, acting as the user. Requires the
+       * `tenants:members:invite` permission on the tenant.
+       */
+      invites: {
+        list: (tenantId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`),
+        /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`, {
+          method: "POST",
+          body: {
+            email: input.email,
+            roles: input.roles,
+            sendEmail: input.sendEmail ?? true,
+            redirectUri: input.redirectUri
+          }
+        }),
+        /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (tenantId, inviteId, input = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}/resend`, {
+          method: "POST",
+          body: { sendEmail: input.sendEmail ?? true }
+        }),
+        revoke: (tenantId, inviteId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
       }
     };
     __privateSet(this, _request, scopedRequest(request, token));
-    this.financialAuthorizations = subjectFinancialAuthorizations(__privateGet(this, _request));
+    this.security = subjectSecurity(__privateGet(this, _request));
   }
 };
 _request = new WeakMap();
@@ -493,6 +523,61 @@ var AuthyonServerClient = class {
             { method: "DELETE", envBearer: true }
           )
         },
+        /**
+         * Invites by e-mail or by link — for addresses that may not have an
+         * account yet; accepting creates it. Managing them needs the
+         * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+         */
+        invites: {
+          /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+          list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, { envBearer: true }),
+          /**
+           * POST /env/tenants/{tenantId}/invites — invite an address. Always
+           * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+           * it and you deliver the link yourself. Valid 7 days, single use, and
+           * not readable again later.
+           */
+          create: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              email: input.email,
+              roles: input.roles,
+              sendEmail: input.sendEmail ?? true,
+              redirectUri: input.redirectUri
+            }
+          }),
+          /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+          resend: (tenantId, inviteId, input = {}) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+            { method: "POST", envBearer: true, body: { sendEmail: input.sendEmail ?? true } }
+          ),
+          /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+          revoke: (tenantId, inviteId) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}`,
+            { method: "DELETE", envBearer: true }
+          ),
+          /**
+           * POST /auth/tenant-invites/preview — for a backend hosting the accept
+           * page. Public: needs only `envKey`, the token is the credential.
+           */
+          preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+          /**
+           * Joins the tenant; for an address with no account, also creates it
+           * (password required) with the e-mail already confirmed. Does not
+           * sign the user in.
+           *
+           * Without metadata: POST /auth/tenant-invites/accept — public, needs
+           * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+           * /env/tenant-invites/accept with the environment credential
+           * (`authyon:users:write`), since only your backend may set them.
+           */
+          accept: (input) => input.publicMetadata !== void 0 || input.privateMetadata !== void 0 ? this.request("/env/tenant-invites/accept", {
+            method: "POST",
+            envBearer: true,
+            body: input
+          }) : this.request("/auth/tenant-invites/accept", { method: "POST", body: input })
+        },
         roles: {
           /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
           list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/roles`, { envBearer: true }),
@@ -555,46 +640,65 @@ var AuthyonServerClient = class {
         /** GET /permissions/reserved — reserved permission names you can't redefine. */
         reserved: () => this.request("/permissions/reserved", { envBearer: true })
       },
+      audit: {
+        /** GET /env/audit — paginated list of the environment's audit events. */
+        list: (params = {}) => this.request("/env/audit", { envBearer: true, query: params }),
+        /** GET /env/audit/login-activity — paginated login activity in the environment. */
+        loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
+      }
+    };
+    // ── Security: one-time codes and approvals ───────────────────────────────
+    //
+    // Everything here runs with the environment credential: `otp` needs the
+    // `authyon:otp:verify` scope, `approvals` needs `authyon:financial:authorize`.
+    // Keep those credentials on the server.
+    this.security = {
+      otp: {
+        /**
+         * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+         * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+         * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+         * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+         * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+         * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
+         */
+        check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
+          method: "POST",
+          envBearer: true,
+          body: { code }
+        })
+      },
       /**
-       * Transaction-bound step-up for financial operations. The environment
-       * credential needs the `authyon:financial:authorize` scope.
+       * The customer approves a payload with their authenticator code or
+       * passkey, once.
        *
-       * 1. `create()` the authorization for the transaction and the customer.
-       * 2. The customer approves it with their authenticator code or passkey
-       *    (`@authyon/auth` → `financialAuthorizations.confirm`).
-       * 3. `consume()` it with the same transaction right before executing it.
+       * 1. `create()` the approval with the payload and the customer.
+       * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+       * 3. `consume()` it right before executing, and execute the returned payload.
        */
-      financialAuthorizations: {
-        /** POST /env/authorizations — registers a transaction awaiting the customer's approval. */
+      approvals: {
+        /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
         create: (input) => {
           const { idempotencyKey, ...body } = input;
-          if (typeof idempotencyKey !== "string" || !idempotencyKey.trim())
-            throw new TypeError("Authyon: `idempotencyKey` is required.");
           return this.request("/env/authorizations", {
             method: "POST",
             envBearer: true,
-            headers: { "Idempotency-Key": idempotencyKey },
+            headers: idempotencyKey ? { "Idempotency-Key": idempotencyKey } : void 0,
             body
           });
         },
         /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
         get: (id) => this.request(`/env/authorizations/${segment(id)}`, { envBearer: true }),
         /**
-         * POST /env/authorizations/{id}/consume — redeems an approved
-         * authorization exactly once. Resend the same transaction given to
-         * `create()`; any difference fails with `transaction_mismatch`.
+         * POST /env/authorizations/{id}/consume — redeems an approved approval
+         * exactly once and returns the approved payload. Pass `payload` to have
+         * the API check it matches (`payload_mismatch` otherwise).
          */
-        consume: (id, transaction) => this.request(`/env/authorizations/${segment(id)}/consume`, {
+        consume: (id, payload) => this.request(`/env/authorizations/${segment(id)}/consume`, {
           method: "POST",
           envBearer: true,
-          body: transaction
+          body: payload === void 0 ? void 0 : { payload }
         })
-      },
-      audit: {
-        /** GET /env/audit — paginated list of the environment's audit events. */
-        list: (params = {}) => this.request("/env/audit", { envBearer: true, query: params }),
-        /** GET /env/audit/login-activity — paginated login activity in the environment. */
-        loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
       }
     };
     // ── Generic permission grants ─────────────────────────────────────────────
@@ -720,6 +824,28 @@ var AuthyonServerClient = class {
 _clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
+    /** Invites to the token's tenant, by e-mail or by link. */
+    this.invites = {
+      /** GET /tenant/invites — every invite with its status, newest first. */
+      list: () => this.request("/tenant/invites"),
+      /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+      create: (input) => this.request("/tenant/invites", {
+        method: "POST",
+        body: {
+          email: input.email,
+          roles: input.roles,
+          sendEmail: input.sendEmail ?? true,
+          redirectUri: input.redirectUri
+        }
+      }),
+      /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+      resend: (inviteId, input = {}) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}/resend`, {
+        method: "POST",
+        body: { sendEmail: input.sendEmail ?? true }
+      }),
+      /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+      revoke: (inviteId) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE" })
+    };
     this.members = {
       /**
        * GET /tenant/members — members of the token's tenant.

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-B7ynKAud.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-C0Mg5gUv.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BF015NDJ.js';
-import { A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BvjIWPcU.js';
+import { A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.14",
+  "version": "0.2.0-beta.16",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",