@authyon/server 0.2.0-beta.4 → 0.2.0-beta.6

package/README.md

@@ -187,11 +187,30 @@ As credenciais de um tenant são próprias dele — use `authyon.tenant(credenti
 ```ts
 const acme = authyon.tenant({ clientId: acmeClientId, clientSecret: acmeClientSecret });
 
+const identity = await acme.validate(); // POST /tenant/auth/validate
 await acme.members.list();
 await acme.members.add(userId, ["member"]);
 await acme.roles.create({ name: "viewer", permissions: ["reports:read"] });
 ```
 
+`validate()` confirma o bearer tenant-client atual e devolve `tenantId`,
+`credentialId`, `clientId` e as permissões vigentes da credencial. A resposta
+vem do backend depois da checagem de revogação, rotação de secret e tenant
+desabilitado; não confie só na claim `scope` quando precisar do estado atual.
+
+Em middleware, quando você já recebeu o bearer tenant-client na requisição, não
+use `clientId`/`clientSecret`; valide o token diretamente:
+
+```ts
+const validation = await authyon.tenantAuth.validate(tenantBearerToken, {
+  clientIp: "203.0.113.10",
+});
+
+if (!validation.valid) {
+  // responda 401
+}
+```
+
 ## Descoberta
 
 ```ts

package/dist/{authorization-Cwl7YFEZ.d.cts → authorization-BGURVMFT.d.cts}

@@ -315,6 +315,17 @@ interface TokenResult {
     expires_in: number;
     scope?: string;
 }
+/** POST /tenant/auth/validate — validates the current tenant-client bearer. */
+interface TenantClientValidationResult {
+    valid: boolean;
+    reason?: string | null;
+    tenantId: string;
+    workspaceId: string;
+    environmentId: string;
+    credentialId: string;
+    clientId: string;
+    permissions: string[];
+}
 interface JsonWebKeySet {
     keys: Record<string, unknown>[];
 }
@@ -341,6 +352,12 @@ interface AuthyonServerClientOptions {
      */
     clientId?: string;
     clientSecret?: string;
+    /**
+     * Originating end-user IP to forward on every API call as `X-Forwarded-For`.
+     * Only set this from infrastructure you trust; the SDK rejects comma-separated
+     * or whitespace-containing values to avoid forwarded-header injection.
+     */
+    clientIp?: string;
     /** API origin. Defaults to `https://api.authyon.com`. */
     baseUrl?: string;
     /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
@@ -616,6 +633,7 @@ declare class AuthyonServerClient {
     #private;
     private readonly envKey?;
     private readonly clientId?;
+    private readonly clientIp?;
     private readonly transport;
     private readonly http;
     private readonly environmentTokenProvider;
@@ -642,6 +660,8 @@ declare class AuthyonServerClient {
     readonly tenantAuth: {
         /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
         token: (credentials: ClientCredentials) => Promise<TokenResult>;
+        /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+        validate: (accessToken: string, context?: ClientRequestContext) => Promise<TenantClientValidationResult>;
     };
     /**
      * Scopes a client to a single tenant's OAuth credentials — mints and
@@ -812,6 +832,8 @@ declare class TenantScopedClient {
     constructor(server: AuthyonServerClient, credentials: ClientCredentials);
     private getAccessToken;
     private request;
+    /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+    validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
     readonly members: {
         /**
          * GET /tenant/members — members of the token's tenant.
@@ -973,4 +995,4 @@ declare function createExpressAuthorizationMiddleware(client: AuthyonServerClien
 /** Converts an authorization error into a Fetch Response suitable for Next.js. */
 declare function createAuthorizationErrorResponse(error: unknown): Response;
 
-export { type Organization as $, AuthyonServerClient as A, type CredentialCreator as B, type ClientCredentials as C, type CredentialDetail as D, type CredentialListOptions as E, type CredentialPermissionsInput as F, type CredentialScope as G, type HttpAdapter as H, type EnvironmentUser as I, type ExpressAuthorizationMiddlewareOptions as J, type ExpressNext as K, type ExpressRequestLike as L, type ExpressResponseLike as M, FetchHttpAdapter as N, type HttpAdapterRequest as O, type HttpLogEvent as P, type HttpLogger as Q, type RequestAuthorizationOptions as R, type IntrospectResult as S, type InviteTenantMemberInput as T, type InviteWorkspaceMemberInput as U, type JsonWebKeySet as V, JwksTokenVerifier as W, type JwksTokenVerifierOptions as X, LoggingHttpAdapter as Y, type LoginActivity as Z, type OpenIdConfiguration as _, type AbilitySubject as a, type Paged as a0, type PaginationOptions as a1, type Permission as a2, type PermissionsByRole as a3, PlatformScopedClient as a4, type ReservedPermissions as a5, type Role as a6, type RoleGrant as a7, type RoleInput as a8, type RoleList as a9, authorizeToken as aA, createAuthorizationErrorResponse as aB, createAuthyonAbility as aC, createAuthyonRules as aD, createClient as aE, createExpressAuthorizationMiddleware as aF, hasPermission as aG, normalizeClientIp as aH, type RolePermissions as aa, type SafeJwtAlgorithm as ab, type TenantCredentialIssued as ac, type TenantCredentialSummary as ad, type TenantManagementScope as ae, type TenantMember as af, type TenantMemberPage as ag, type TenantMembership as ah, TenantScopedClient as ai, type TokenResult as aj, TokenVerificationError as ak, type TokenVerificationErrorCode as al, type UpdateOrganizationInput as am, type User as an, UserScopedClient as ao, type ValidateResult as ap, type VerifiedAccessToken as aq, type WorkspaceInvite as ar, type WorkspaceInviteAccepted as as, type WorkspaceInviteIssued as at, type WorkspaceInvitePreview as au, WorkspaceInvitesClient as av, type WorkspaceMember as aw, type WorkspaceRole as ax, type WorkspaceTeam as ay, authorizeRequest as az, AuthorizationError as b, type HttpLoggerOptions as c, type AbilityConditions as d, type AbilityEvent as e, type AbilityListener as f, type AbilityRequirement as g, type AbilityRule as h, type AcceptWorkspaceInviteInput as i, type AccessTokenSource as j, type AuditEvent as k, type AuthorizationContext as l, type AuthorizationOptions as m, AuthyonAbility as n, AuthyonAbilityBuilder as o, type AuthyonAbilityOptions as p, type AuthyonJwksDiscoveryOptions as q, type AuthyonJwtClaims as r, type AuthyonPermissionSource as s, type AuthyonServerClientOptions as t, type ClientRequestContext as u, type CreateCredentialInput as v, type CreateOrganizationInput as w, type CreatePermissionInput as x, type CreateTenantCredentialInput as y, type CreateUserInput as z };
+export { type Organization as $, AuthyonServerClient as A, type CredentialCreator as B, type ClientCredentials as C, type CredentialDetail as D, type CredentialListOptions as E, type CredentialPermissionsInput as F, type CredentialScope as G, type HttpAdapter as H, type EnvironmentUser as I, type ExpressAuthorizationMiddlewareOptions as J, type ExpressNext as K, type ExpressRequestLike as L, type ExpressResponseLike as M, FetchHttpAdapter as N, type HttpAdapterRequest as O, type HttpLogEvent as P, type HttpLogger as Q, type RequestAuthorizationOptions as R, type IntrospectResult as S, type InviteTenantMemberInput as T, type InviteWorkspaceMemberInput as U, type JsonWebKeySet as V, JwksTokenVerifier as W, type JwksTokenVerifierOptions as X, LoggingHttpAdapter as Y, type LoginActivity as Z, type OpenIdConfiguration as _, type AbilitySubject as a, type Paged as a0, type PaginationOptions as a1, type Permission as a2, type PermissionsByRole as a3, PlatformScopedClient as a4, type ReservedPermissions as a5, type Role as a6, type RoleGrant as a7, type RoleInput as a8, type RoleList as a9, authorizeRequest as aA, authorizeToken as aB, createAuthorizationErrorResponse as aC, createAuthyonAbility as aD, createAuthyonRules as aE, createClient as aF, createExpressAuthorizationMiddleware as aG, hasPermission as aH, normalizeClientIp as aI, type RolePermissions as aa, type SafeJwtAlgorithm as ab, type TenantClientValidationResult as ac, type TenantCredentialIssued as ad, type TenantCredentialSummary as ae, type TenantManagementScope as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, type WorkspaceInvite as as, type WorkspaceInviteAccepted as at, type WorkspaceInviteIssued as au, type WorkspaceInvitePreview as av, WorkspaceInvitesClient as aw, type WorkspaceMember as ax, type WorkspaceRole as ay, type WorkspaceTeam as az, AuthorizationError as b, type HttpLoggerOptions as c, type AbilityConditions as d, type AbilityEvent as e, type AbilityListener as f, type AbilityRequirement as g, type AbilityRule as h, type AcceptWorkspaceInviteInput as i, type AccessTokenSource as j, type AuditEvent as k, type AuthorizationContext as l, type AuthorizationOptions as m, AuthyonAbility as n, AuthyonAbilityBuilder as o, type AuthyonAbilityOptions as p, type AuthyonJwksDiscoveryOptions as q, type AuthyonJwtClaims as r, type AuthyonPermissionSource as s, type AuthyonServerClientOptions as t, type ClientRequestContext as u, type CreateCredentialInput as v, type CreateOrganizationInput as w, type CreatePermissionInput as x, type CreateTenantCredentialInput as y, type CreateUserInput as z };

package/dist/{authorization-Cwl7YFEZ.d.ts → authorization-BGURVMFT.d.ts}

@@ -315,6 +315,17 @@ interface TokenResult {
     expires_in: number;
     scope?: string;
 }
+/** POST /tenant/auth/validate — validates the current tenant-client bearer. */
+interface TenantClientValidationResult {
+    valid: boolean;
+    reason?: string | null;
+    tenantId: string;
+    workspaceId: string;
+    environmentId: string;
+    credentialId: string;
+    clientId: string;
+    permissions: string[];
+}
 interface JsonWebKeySet {
     keys: Record<string, unknown>[];
 }
@@ -341,6 +352,12 @@ interface AuthyonServerClientOptions {
      */
     clientId?: string;
     clientSecret?: string;
+    /**
+     * Originating end-user IP to forward on every API call as `X-Forwarded-For`.
+     * Only set this from infrastructure you trust; the SDK rejects comma-separated
+     * or whitespace-containing values to avoid forwarded-header injection.
+     */
+    clientIp?: string;
     /** API origin. Defaults to `https://api.authyon.com`. */
     baseUrl?: string;
     /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
@@ -616,6 +633,7 @@ declare class AuthyonServerClient {
     #private;
     private readonly envKey?;
     private readonly clientId?;
+    private readonly clientIp?;
     private readonly transport;
     private readonly http;
     private readonly environmentTokenProvider;
@@ -642,6 +660,8 @@ declare class AuthyonServerClient {
     readonly tenantAuth: {
         /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
         token: (credentials: ClientCredentials) => Promise<TokenResult>;
+        /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+        validate: (accessToken: string, context?: ClientRequestContext) => Promise<TenantClientValidationResult>;
     };
     /**
      * Scopes a client to a single tenant's OAuth credentials — mints and
@@ -812,6 +832,8 @@ declare class TenantScopedClient {
     constructor(server: AuthyonServerClient, credentials: ClientCredentials);
     private getAccessToken;
     private request;
+    /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+    validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
     readonly members: {
         /**
          * GET /tenant/members — members of the token's tenant.
@@ -973,4 +995,4 @@ declare function createExpressAuthorizationMiddleware(client: AuthyonServerClien
 /** Converts an authorization error into a Fetch Response suitable for Next.js. */
 declare function createAuthorizationErrorResponse(error: unknown): Response;
 
-export { type Organization as $, AuthyonServerClient as A, type CredentialCreator as B, type ClientCredentials as C, type CredentialDetail as D, type CredentialListOptions as E, type CredentialPermissionsInput as F, type CredentialScope as G, type HttpAdapter as H, type EnvironmentUser as I, type ExpressAuthorizationMiddlewareOptions as J, type ExpressNext as K, type ExpressRequestLike as L, type ExpressResponseLike as M, FetchHttpAdapter as N, type HttpAdapterRequest as O, type HttpLogEvent as P, type HttpLogger as Q, type RequestAuthorizationOptions as R, type IntrospectResult as S, type InviteTenantMemberInput as T, type InviteWorkspaceMemberInput as U, type JsonWebKeySet as V, JwksTokenVerifier as W, type JwksTokenVerifierOptions as X, LoggingHttpAdapter as Y, type LoginActivity as Z, type OpenIdConfiguration as _, type AbilitySubject as a, type Paged as a0, type PaginationOptions as a1, type Permission as a2, type PermissionsByRole as a3, PlatformScopedClient as a4, type ReservedPermissions as a5, type Role as a6, type RoleGrant as a7, type RoleInput as a8, type RoleList as a9, authorizeToken as aA, createAuthorizationErrorResponse as aB, createAuthyonAbility as aC, createAuthyonRules as aD, createClient as aE, createExpressAuthorizationMiddleware as aF, hasPermission as aG, normalizeClientIp as aH, type RolePermissions as aa, type SafeJwtAlgorithm as ab, type TenantCredentialIssued as ac, type TenantCredentialSummary as ad, type TenantManagementScope as ae, type TenantMember as af, type TenantMemberPage as ag, type TenantMembership as ah, TenantScopedClient as ai, type TokenResult as aj, TokenVerificationError as ak, type TokenVerificationErrorCode as al, type UpdateOrganizationInput as am, type User as an, UserScopedClient as ao, type ValidateResult as ap, type VerifiedAccessToken as aq, type WorkspaceInvite as ar, type WorkspaceInviteAccepted as as, type WorkspaceInviteIssued as at, type WorkspaceInvitePreview as au, WorkspaceInvitesClient as av, type WorkspaceMember as aw, type WorkspaceRole as ax, type WorkspaceTeam as ay, authorizeRequest as az, AuthorizationError as b, type HttpLoggerOptions as c, type AbilityConditions as d, type AbilityEvent as e, type AbilityListener as f, type AbilityRequirement as g, type AbilityRule as h, type AcceptWorkspaceInviteInput as i, type AccessTokenSource as j, type AuditEvent as k, type AuthorizationContext as l, type AuthorizationOptions as m, AuthyonAbility as n, AuthyonAbilityBuilder as o, type AuthyonAbilityOptions as p, type AuthyonJwksDiscoveryOptions as q, type AuthyonJwtClaims as r, type AuthyonPermissionSource as s, type AuthyonServerClientOptions as t, type ClientRequestContext as u, type CreateCredentialInput as v, type CreateOrganizationInput as w, type CreatePermissionInput as x, type CreateTenantCredentialInput as y, type CreateUserInput as z };
+export { type Organization as $, AuthyonServerClient as A, type CredentialCreator as B, type ClientCredentials as C, type CredentialDetail as D, type CredentialListOptions as E, type CredentialPermissionsInput as F, type CredentialScope as G, type HttpAdapter as H, type EnvironmentUser as I, type ExpressAuthorizationMiddlewareOptions as J, type ExpressNext as K, type ExpressRequestLike as L, type ExpressResponseLike as M, FetchHttpAdapter as N, type HttpAdapterRequest as O, type HttpLogEvent as P, type HttpLogger as Q, type RequestAuthorizationOptions as R, type IntrospectResult as S, type InviteTenantMemberInput as T, type InviteWorkspaceMemberInput as U, type JsonWebKeySet as V, JwksTokenVerifier as W, type JwksTokenVerifierOptions as X, LoggingHttpAdapter as Y, type LoginActivity as Z, type OpenIdConfiguration as _, type AbilitySubject as a, type Paged as a0, type PaginationOptions as a1, type Permission as a2, type PermissionsByRole as a3, PlatformScopedClient as a4, type ReservedPermissions as a5, type Role as a6, type RoleGrant as a7, type RoleInput as a8, type RoleList as a9, authorizeRequest as aA, authorizeToken as aB, createAuthorizationErrorResponse as aC, createAuthyonAbility as aD, createAuthyonRules as aE, createClient as aF, createExpressAuthorizationMiddleware as aG, hasPermission as aH, normalizeClientIp as aI, type RolePermissions as aa, type SafeJwtAlgorithm as ab, type TenantClientValidationResult as ac, type TenantCredentialIssued as ad, type TenantCredentialSummary as ae, type TenantManagementScope as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, type WorkspaceInvite as as, type WorkspaceInviteAccepted as at, type WorkspaceInviteIssued as au, type WorkspaceInvitePreview as av, WorkspaceInvitesClient as aw, type WorkspaceMember as ax, type WorkspaceRole as ay, type WorkspaceTeam as az, AuthorizationError as b, type HttpLoggerOptions as c, type AbilityConditions as d, type AbilityEvent as e, type AbilityListener as f, type AbilityRequirement as g, type AbilityRule as h, type AcceptWorkspaceInviteInput as i, type AccessTokenSource as j, type AuditEvent as k, type AuthorizationContext as l, type AuthorizationOptions as m, AuthyonAbility as n, AuthyonAbilityBuilder as o, type AuthyonAbilityOptions as p, type AuthyonJwksDiscoveryOptions as q, type AuthyonJwtClaims as r, type AuthyonPermissionSource as s, type AuthyonServerClientOptions as t, type ClientRequestContext as u, type CreateCredentialInput as v, type CreateOrganizationInput as w, type CreatePermissionInput as x, type CreateTenantCredentialInput as y, type CreateUserInput as z };

package/dist/index.cjs

@@ -835,6 +835,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     this.workspaceInvites = new WorkspaceInvitesClient(
@@ -953,7 +961,11 @@ var AuthyonServerClient = class {
           create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
             method: "POST",
             envBearer: true,
-            body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
           }),
           /** Returns a new secret once while keeping the same client id. */
           rotate: (tenantId, credentialId) => this.request(
@@ -1119,6 +1131,7 @@ var AuthyonServerClient = class {
     this.envKey = options.envKey;
     this.clientId = options.clientId;
     __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -1145,7 +1158,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -1295,6 +1311,10 @@ var TenantScopedClient = class {
   async request(path, options = {}) {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
+  /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
+  }
 };
 function createClient(options = {}) {
   return new AuthyonServerClient(options);
@@ -1315,6 +1335,10 @@ var AuthyonServerClientBuilder = class {
     __privateGet(this, _options).clientSecret = clientSecret;
     return this;
   }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
     __privateGet(this, _options).baseUrl = baseUrl;
     __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-Cwl7YFEZ.cjs';
-export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantCredentialIssued, ad as TenantCredentialSummary, ae as TenantManagementScope, af as TenantMember, ag as TenantMemberPage, ah as TenantMembership, ai as TenantScopedClient, aj as TokenResult, ak as TokenVerificationError, al as TokenVerificationErrorCode, am as UpdateOrganizationInput, an as User, ao as UserScopedClient, ap as ValidateResult, aq as VerifiedAccessToken, ar as WorkspaceInvite, as as WorkspaceInviteAccepted, at as WorkspaceInviteIssued, au as WorkspaceInvitePreview, av as WorkspaceInvitesClient, aw as WorkspaceMember, ax as WorkspaceRole, ay as WorkspaceTeam, az as authorizeRequest, aA as authorizeToken, aB as createAuthorizationErrorResponse, aC as createAuthyonAbility, aD as createAuthyonRules, aE as createClient, aF as createExpressAuthorizationMiddleware, aG as hasPermission, aH as normalizeClientIp } from './authorization-Cwl7YFEZ.cjs';
+import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-BGURVMFT.cjs';
+export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-BGURVMFT.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -59,6 +59,7 @@ declare class AuthyonServerClientBuilder {
     #private;
     withEnvironmentKey(envKey: string): this;
     withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-Cwl7YFEZ.js';
-export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantCredentialIssued, ad as TenantCredentialSummary, ae as TenantManagementScope, af as TenantMember, ag as TenantMemberPage, ah as TenantMembership, ai as TenantScopedClient, aj as TokenResult, ak as TokenVerificationError, al as TokenVerificationErrorCode, am as UpdateOrganizationInput, an as User, ao as UserScopedClient, ap as ValidateResult, aq as VerifiedAccessToken, ar as WorkspaceInvite, as as WorkspaceInviteAccepted, at as WorkspaceInviteIssued, au as WorkspaceInvitePreview, av as WorkspaceInvitesClient, aw as WorkspaceMember, ax as WorkspaceRole, ay as WorkspaceTeam, az as authorizeRequest, aA as authorizeToken, aB as createAuthorizationErrorResponse, aC as createAuthyonAbility, aD as createAuthyonRules, aE as createClient, aF as createExpressAuthorizationMiddleware, aG as hasPermission, aH as normalizeClientIp } from './authorization-Cwl7YFEZ.js';
+import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-BGURVMFT.js';
+export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-BGURVMFT.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -59,6 +59,7 @@ declare class AuthyonServerClientBuilder {
     #private;
     withEnvironmentKey(envKey: string): this;
     withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;

package/dist/index.js

@@ -642,6 +642,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     this.workspaceInvites = new WorkspaceInvitesClient(
@@ -760,7 +768,11 @@ var AuthyonServerClient = class {
           create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
             method: "POST",
             envBearer: true,
-            body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
           }),
           /** Returns a new secret once while keeping the same client id. */
           rotate: (tenantId, credentialId) => this.request(
@@ -926,6 +938,7 @@ var AuthyonServerClient = class {
     this.envKey = options.envKey;
     this.clientId = options.clientId;
     __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -952,7 +965,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -1102,6 +1118,10 @@ var TenantScopedClient = class {
   async request(path, options = {}) {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
+  /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
+  }
 };
 function createClient(options = {}) {
   return new AuthyonServerClient(options);
@@ -1122,6 +1142,10 @@ var AuthyonServerClientBuilder = class {
     __privateGet(this, _options).clientSecret = clientSecret;
     return this;
   }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
     __privateGet(this, _options).baseUrl = baseUrl;
     __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;

package/dist/next.d.cts

@@ -1,5 +1,5 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-Cwl7YFEZ.cjs';
+import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-BGURVMFT.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-Cwl7YFEZ.js';
+import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-BGURVMFT.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.4",
+  "version": "0.2.0-beta.6",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",