@authyon/server 0.2.0-beta.5 → 0.2.0-beta.8

package/dist/chunk-56H66KLG.js

@@ -0,0 +1,323 @@
+// ../../internal/core/errors/authyonError.ts
+var ErrorCodes = {
+  Unknown: "unknown",
+  NetworkError: "request.network_error",
+  Timeout: "request.timeout",
+  SessionMalformed: "session.malformed",
+  NotAuthenticated: "auth.not_authenticated",
+  InvalidToken: "auth.invalid_token",
+  MissingToken: "auth.missing_token",
+  EmailTaken: "user.email_taken",
+  PasswordWeak: "user.password_weak",
+  PasswordPwned: "user.password_pwned",
+  RateLimited: "rate_limited"
+};
+var AuthyonError = class extends Error {
+  constructor(status, body, options = {}) {
+    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    this.name = "AuthyonError";
+    this.status = status;
+    this.code = body.code ?? "unknown";
+    this.title = body.title ?? "Error";
+    this.detail = body.detail;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
+    this.cause = options.cause;
+  }
+  is(code) {
+    return this.code === code;
+  }
+  isAny(...codes) {
+    return codes.includes(this.code);
+  }
+  hasPrefix(prefix) {
+    return this.code.startsWith(prefix);
+  }
+  isStatus(...statuses) {
+    return statuses.includes(this.status);
+  }
+  /** Stable interpretation for UI decisions, retries, telemetry and support flows. */
+  interpret() {
+    const category = classifyError(this.status, this.code);
+    return {
+      category,
+      action: actionFor(category),
+      retryable: isRetryable(category),
+      ...this.retryAfter !== void 0 ? { retryAfter: this.retryAfter } : {},
+      ...this.requestId !== void 0 ? { requestId: this.requestId } : {}
+    };
+  }
+  get category() {
+    return this.interpret().category;
+  }
+  get retryable() {
+    return this.interpret().retryable;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      status: this.status,
+      code: this.code,
+      title: this.title,
+      detail: this.detail,
+      requestId: this.requestId,
+      retryAfter: this.retryAfter,
+      ...this.interpret()
+    };
+  }
+};
+function classifyError(status, code) {
+  if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.Timeout || status === 408) return "timeout";
+  if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
+  if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
+  if (code === ErrorCodes.PasswordWeak || code === ErrorCodes.PasswordPwned) return "validation";
+  if (code === ErrorCodes.SessionMalformed) return "server";
+  if (code.startsWith("auth.") || status === 401) return "authentication";
+  if (status === 403) return "authorization";
+  if (status === 404) return "not_found";
+  if (status === 400 || status === 422) return "validation";
+  if (status >= 500) return "server";
+  return "unknown";
+}
+function actionFor(category) {
+  switch (category) {
+    case "network":
+    case "timeout":
+    case "rate_limit":
+    case "server":
+      return "retry";
+    case "authentication":
+      return "reauthenticate";
+    case "authorization":
+      return "request_access";
+    case "validation":
+      return "fix_input";
+    case "not_found":
+      return "not_found";
+    case "conflict":
+      return "resolve_conflict";
+    case "unknown":
+      return "contact_support";
+  }
+}
+function isRetryable(category) {
+  return category === "network" || category === "timeout" || category === "rate_limit" || category === "server";
+}
+
+// ../../internal/core/http/httpAdapter.ts
+var FetchHttpAdapter = class {
+  constructor(fetchImpl = fetch.bind(globalThis)) {
+    this.fetchImpl = fetchImpl;
+  }
+  request(request) {
+    return this.fetchImpl(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      signal: request.signal,
+      redirect: "error"
+    });
+  }
+};
+var LoggingHttpAdapter = class {
+  constructor(adapter, options) {
+    this.adapter = adapter;
+    this.options = options;
+  }
+  async request(request) {
+    const startedAt = Date.now();
+    const eventBase = {
+      method: request.method,
+      url: sanitizeUrl(request.url)
+    };
+    this.log({ type: "request", ...eventBase, timestamp: startedAt });
+    try {
+      const response = await this.adapter.request(request);
+      this.log({
+        type: "response",
+        ...eventBase,
+        status: response.status,
+        durationMs: Date.now() - startedAt,
+        requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
+        timestamp: Date.now()
+      });
+      return response;
+    } catch (error) {
+      this.log({
+        type: "error",
+        ...eventBase,
+        errorName: error instanceof Error ? error.name : "UnknownError",
+        durationMs: Date.now() - startedAt,
+        timestamp: Date.now()
+      });
+      throw error;
+    }
+  }
+  log(event) {
+    if (!this.options.enabled) return;
+    const logger = this.options.logger ?? defaultHttpLogger;
+    try {
+      logger(event);
+    } catch {
+    }
+  }
+};
+function defaultHttpLogger(event) {
+  console.debug("[Authyon HTTP]", event);
+}
+function sanitizeUrl(value) {
+  const url = new URL(value);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
+  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
+  const queryKeys = /* @__PURE__ */ new Set();
+  url.searchParams.forEach((_value, key) => queryKeys.add(key));
+  url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
+  return url.toString();
+}
+
+// ../../internal/core/config/defaults.ts
+var DEFAULT_BASE_URL = "https://api.authyon.com";
+var DEFAULT_EXPIRY_SKEW_MS = 3e4;
+
+// ../../internal/core/http/transport.ts
+var DEFAULT_TIMEOUT_MS = 15e3;
+var SharedTransportError = class extends Error {
+  constructor(code, cause) {
+    super(code === "request.timeout" ? "Request timed out" : "Network request failed");
+    this.name = "SharedTransportError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+function createSharedTransport(options) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp ?? false);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
+    throw new Error("Authyon: `timeoutMs` must be a non-negative finite number");
+  }
+  if (options.httpAdapter && options.fetch) {
+    throw new Error("Authyon: use either `httpAdapter` or `fetch`, not both");
+  }
+  const baseAdapter = options.httpAdapter ?? new FetchHttpAdapter(options.fetch);
+  const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
+  return {
+    baseUrl,
+    async request(path, init) {
+      const controller = new AbortController();
+      const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+      try {
+        return await httpAdapter.request({
+          url: `${baseUrl}${path}`,
+          method: init.method ?? "GET",
+          headers: normalizeHeaders(init.headers),
+          body: init.body,
+          signal: controller.signal
+        });
+      } catch (cause) {
+        throw new SharedTransportError(
+          controller.signal.aborted ? ErrorCodes.Timeout : ErrorCodes.NetworkError,
+          cause
+        );
+      } finally {
+        if (timeout !== void 0) clearTimeout(timeout);
+      }
+    }
+  };
+}
+function normalizeHeaders(headers) {
+  const normalized = {};
+  new Headers(headers).forEach((value, key) => {
+    normalized[key] = value;
+  });
+  return normalized;
+}
+function responseMetadata(response) {
+  const retryAfterHeader = response.headers.get("retry-after");
+  const retryAfter = retryAfterHeader ? Number(retryAfterHeader) : void 0;
+  return {
+    requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
+    retryAfter: Number.isFinite(retryAfter) ? retryAfter : void 0
+  };
+}
+function normalizeBaseUrl(value, allowInsecureHttp) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Authyon: `baseUrl` must be an absolute URL");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
+    throw new Error(
+      "Authyon: `baseUrl` must use HTTPS (HTTP is allowed only for loopback or with `allowInsecureHttp`)"
+    );
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error(
+      "Authyon: `baseUrl` cannot contain credentials, query parameters, or fragments"
+    );
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+
+// ../../internal/core/http/query.ts
+function appendQuery(path, params) {
+  if (!params) return path;
+  const query = new URLSearchParams();
+  for (const [key, value2] of Object.entries(params)) {
+    if (value2 !== void 0) query.set(key, String(value2));
+  }
+  const value = query.toString();
+  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+}
+
+// ../../internal/core/http/jsonHttpClient.ts
+var JsonHttpClient = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async send(path, options = {}) {
+    const headers = { ...options.headers };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    try {
+      return await this.transport.request(appendQuery(path, options.query), {
+        method: options.method ?? "GET",
+        headers,
+        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+      });
+    } catch (cause) {
+      if (!(cause instanceof SharedTransportError)) throw cause;
+      throw new AuthyonError(0, { code: cause.code, title: cause.message }, { cause: cause.cause });
+    }
+  }
+  async parse(response) {
+    if (!response.ok) {
+      let body = {};
+      try {
+        body = await response.json();
+      } catch {
+      }
+      throw new AuthyonError(response.status, body, responseMetadata(response));
+    }
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async request(path, options = {}) {
+    return this.parse(await this.send(path, options));
+  }
+};
+
+export {
+  ErrorCodes,
+  AuthyonError,
+  DEFAULT_BASE_URL,
+  DEFAULT_EXPIRY_SKEW_MS,
+  FetchHttpAdapter,
+  LoggingHttpAdapter,
+  createSharedTransport,
+  JsonHttpClient
+};

package/dist/chunk-77J4NURK.js

@@ -0,0 +1,13 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+
+export {
+  __privateGet,
+  __privateAdd,
+  __privateSet
+};

package/dist/{chunk-24IFDJ73.js → chunk-NKWQMYB3.js}

@@ -1,11 +1,3 @@
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
-var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
-var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
-
 // ../../internal/core/http/clientIp.ts
 function clientIpHeaders(context) {
   if (!context?.clientIp) return {};
@@ -237,6 +229,11 @@ function hasPermission(source, requiredPermission) {
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
   return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
 }
+function hasPermissionGroup(source, group) {
+  const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
+  const hasAny = !group.anyOf?.length || group.anyOf.some((permission) => hasPermission(source, permission));
+  return hasAll && hasAny;
+}
 function isPermissionList(source) {
   return Array.isArray(source);
 }
@@ -470,9 +467,6 @@ function unauthenticated() {
 }
 
 export {
-  __privateGet,
-  __privateAdd,
-  __privateSet,
   clientIpHeaders,
   normalizeClientIp,
   TokenVerificationError,
@@ -481,6 +475,7 @@ export {
   AuthyonAbilityBuilder,
   createAuthyonAbility,
   hasPermission,
+  hasPermissionGroup,
   createAuthyonRules,
   AuthorizationError,
   authorizeToken,

package/dist/index.cjs

@@ -50,6 +50,7 @@ __export(index_exports, {
   createClient: () => createClient,
   createExpressAuthorizationMiddleware: () => createExpressAuthorizationMiddleware,
   hasPermission: () => hasPermission,
+  hasPermissionGroup: () => hasPermissionGroup,
   normalizeClientIp: () => normalizeClientIp
 });
 module.exports = __toCommonJS(index_exports);
@@ -835,6 +836,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     this.workspaceInvites = new WorkspaceInvitesClient(
@@ -953,7 +962,11 @@ var AuthyonServerClient = class {
           create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
             method: "POST",
             envBearer: true,
-            body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
           }),
           /** Returns a new secret once while keeping the same client id. */
           rotate: (tenantId, credentialId) => this.request(
@@ -984,7 +997,18 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+        /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+        updateMetadata: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/metadata`, {
+          method: "PUT",
+          envBearer: true,
+          body: input
+        }),
+        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
+          method: "POST",
+          envBearer: true
+        }),
+        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -1119,6 +1143,7 @@ var AuthyonServerClient = class {
     this.envKey = options.envKey;
     this.clientId = options.clientId;
     __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -1145,7 +1170,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -1296,8 +1324,8 @@ var TenantScopedClient = class {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
-  validate() {
-    return this.request("/tenant/auth/validate", { method: "POST" });
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
   }
 };
 function createClient(options = {}) {
@@ -1319,6 +1347,10 @@ var AuthyonServerClientBuilder = class {
     __privateGet(this, _options).clientSecret = clientSecret;
     return this;
   }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
     __privateGet(this, _options).baseUrl = baseUrl;
     __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;
@@ -1412,6 +1444,11 @@ function hasPermission(source, requiredPermission) {
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
   return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
 }
+function hasPermissionGroup(source, group) {
+  const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
+  const hasAny = !group.anyOf?.length || group.anyOf.some((permission) => hasPermission(source, permission));
+  return hasAll && hasAny;
+}
 function isPermissionList(source) {
   return Array.isArray(source);
 }
@@ -1668,5 +1705,6 @@ function unauthenticated() {
   createClient,
   createExpressAuthorizationMiddleware,
   hasPermission,
+  hasPermissionGroup,
   normalizeClientIp
 });

package/dist/index.d.cts

@@ -1,5 +1,6 @@
-import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-NQe6R3am.cjs';
-export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-NQe6R3am.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D8r47VSq.cjs';
+export { b as AcceptWorkspaceInviteInput, c as AccessTokenSource, d as AuditEvent, e as AuthyonJwksDiscoveryOptions, f as AuthyonJwtClaims, g as AuthyonServerClientOptions, C as ClientCredentials, h as ClientRequestContext, i as CreateCredentialInput, j as CreateOrganizationInput, k as CreatePermissionInput, l as CreateTenantCredentialInput, m as CreateUserInput, n as CredentialCreator, o as CredentialDetail, p as CredentialListOptions, q as CredentialPermissionsInput, r as CredentialScope, E as EnvironmentUser, F as FetchHttpAdapter, s as HttpAdapterRequest, t as HttpLogEvent, u as HttpLogger, I as IntrospectResult, v as InviteTenantMemberInput, w as InviteWorkspaceMemberInput, J as JsonWebKeySet, x as JwksTokenVerifier, y as JwksTokenVerifierOptions, L as LoggingHttpAdapter, z as LoginActivity, O as OpenIdConfiguration, B as Organization, P as Paged, D as PaginationOptions, G as Permission, K as PermissionsByRole, M as PlatformScopedClient, R as ReservedPermissions, N as Role, Q as RoleGrant, S as RoleInput, T as RoleList, U as RolePermissions, V as SafeJwtAlgorithm, W as TenantClientValidationResult, X as TenantCredentialIssued, Y as TenantCredentialSummary, Z as TenantManagementScope, _ as TenantMember, $ as TenantMemberPage, a0 as TenantMembership, a1 as TenantScopedClient, a2 as TokenResult, a3 as TokenVerificationError, a4 as TokenVerificationErrorCode, a5 as UpdateOrganizationInput, a6 as User, a7 as UserScopedClient, a8 as ValidateResult, a9 as VerifiedAccessToken, aa as WorkspaceInvite, ab as WorkspaceInviteAccepted, ac as WorkspaceInviteIssued, ad as WorkspaceInvitePreview, ae as WorkspaceInvitesClient, af as WorkspaceMember, ag as WorkspaceRole, ah as WorkspaceTeam, ai as createClient, aj as normalizeClientIp } from './authyonServerClient-D8r47VSq.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-DPlRA9qM.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -59,6 +60,7 @@ declare class AuthyonServerClientBuilder {
     #private;
     withEnvironmentKey(envKey: string): this;
     withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-NQe6R3am.js';
-export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-NQe6R3am.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D8r47VSq.js';
+export { b as AcceptWorkspaceInviteInput, c as AccessTokenSource, d as AuditEvent, e as AuthyonJwksDiscoveryOptions, f as AuthyonJwtClaims, g as AuthyonServerClientOptions, C as ClientCredentials, h as ClientRequestContext, i as CreateCredentialInput, j as CreateOrganizationInput, k as CreatePermissionInput, l as CreateTenantCredentialInput, m as CreateUserInput, n as CredentialCreator, o as CredentialDetail, p as CredentialListOptions, q as CredentialPermissionsInput, r as CredentialScope, E as EnvironmentUser, F as FetchHttpAdapter, s as HttpAdapterRequest, t as HttpLogEvent, u as HttpLogger, I as IntrospectResult, v as InviteTenantMemberInput, w as InviteWorkspaceMemberInput, J as JsonWebKeySet, x as JwksTokenVerifier, y as JwksTokenVerifierOptions, L as LoggingHttpAdapter, z as LoginActivity, O as OpenIdConfiguration, B as Organization, P as Paged, D as PaginationOptions, G as Permission, K as PermissionsByRole, M as PlatformScopedClient, R as ReservedPermissions, N as Role, Q as RoleGrant, S as RoleInput, T as RoleList, U as RolePermissions, V as SafeJwtAlgorithm, W as TenantClientValidationResult, X as TenantCredentialIssued, Y as TenantCredentialSummary, Z as TenantManagementScope, _ as TenantMember, $ as TenantMemberPage, a0 as TenantMembership, a1 as TenantScopedClient, a2 as TokenResult, a3 as TokenVerificationError, a4 as TokenVerificationErrorCode, a5 as UpdateOrganizationInput, a6 as User, a7 as UserScopedClient, a8 as ValidateResult, a9 as VerifiedAccessToken, aa as WorkspaceInvite, ab as WorkspaceInviteAccepted, ac as WorkspaceInviteIssued, ad as WorkspaceInvitePreview, ae as WorkspaceInvitesClient, af as WorkspaceMember, ag as WorkspaceRole, ah as WorkspaceTeam, ai as createClient, aj as normalizeClientIp } from './authyonServerClient-D8r47VSq.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BZTzR6iu.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -59,6 +60,7 @@ declare class AuthyonServerClientBuilder {
     #private;
     withEnvironmentKey(envKey: string): this;
     withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;