@breign/client 1.0.174 → 1.0.176

package/dist/openapi.json

@@ -4157,6 +4157,58 @@
         "tags" : [ "app" ]
       }
     },
+    "/apps/{appId}/instances/{instanceId}/token" : {
+      "post" : {
+        "description" : "Issue a new token for an ephemeral instance, authenticated either by the instance's own still-valid token or by a user with access to the app. The previous token is revoked. An active instance is simply extended; an inactive one is reactivated (status back to IDLE) only if the app's maximum number of active instances is not reached.\n",
+        "operationId" : "refreshInstanceToken",
+        "parameters" : [ {
+          "description" : "ID of the app",
+          "in" : "path",
+          "name" : "appId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "Instance identifier",
+          "in" : "path",
+          "name" : "instanceId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/EphemeralInstanceToken"
+                }
+              }
+            },
+            "description" : "Token refreshed"
+          },
+          "400" : {
+            "description" : "Maximum number of active instances reached (MAX_INSTANCES_REACHED)"
+          },
+          "401" : {
+            "description" : "Unauthorized"
+          },
+          "403" : {
+            "description" : "Forbidden - no access to this instance, or ephemeral instances not allowed for this app"
+          },
+          "404" : {
+            "description" : "App or ephemeral instance not found"
+          },
+          "409" : {
+            "description" : "Instance changed during the refresh (e.g. deactivated concurrently), retry (INSTANCE_CHANGED)"
+          }
+        },
+        "summary" : "Refresh ephemeral instance token",
+        "tags" : [ "app" ]
+      }
+    },
     "/instances/{instanceId}/context" : {
       "get" : {
         "description" : "Returns the custom context variables for an app instance.",
@@ -4626,6 +4678,181 @@
         "tags" : [ "auth" ]
       }
     },
+    "/auth/authorize" : {
+      "get" : {
+        "description" : "Entry point of the browser authorization of a desktop application (OAuth2 authorization code with PKCE, loopback redirect per RFC 8252). The request is checked, then the browser is redirected to the consent page of Breign App, which issues the code through `POST /auth/authorizations`.\n",
+        "operationId" : "authorizeApplication",
+        "parameters" : [ {
+          "in" : "query",
+          "name" : "response_type",
+          "required" : true,
+          "schema" : {
+            "enum" : [ "code" ],
+            "type" : "string"
+          }
+        }, {
+          "in" : "query",
+          "name" : "client_id",
+          "required" : true,
+          "schema" : {
+            "maxLength" : 100,
+            "type" : "string"
+          }
+        }, {
+          "description" : "Loopback HTTP address with a port, e.g. `http://127.0.0.1:53682/callback`.",
+          "in" : "query",
+          "name" : "redirect_uri",
+          "required" : true,
+          "schema" : {
+            "maxLength" : 200,
+            "type" : "string"
+          }
+        }, {
+          "in" : "query",
+          "name" : "code_challenge",
+          "required" : true,
+          "schema" : {
+            "maxLength" : 128,
+            "minLength" : 43,
+            "type" : "string"
+          }
+        }, {
+          "in" : "query",
+          "name" : "code_challenge_method",
+          "required" : true,
+          "schema" : {
+            "enum" : [ "S256" ],
+            "type" : "string"
+          }
+        }, {
+          "in" : "query",
+          "name" : "state",
+          "required" : false,
+          "schema" : {
+            "maxLength" : 200,
+            "type" : "string"
+          }
+        }, {
+          "description" : "Name of the machine, shown on the consent page and in the API key name.",
+          "in" : "query",
+          "name" : "device_name",
+          "required" : false,
+          "schema" : {
+            "maxLength" : 100,
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "302" : {
+            "description" : "Redirect to the consent page of Breign App"
+          },
+          "400" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/ApplicationTokenError"
+                }
+              }
+            },
+            "description" : "Invalid authorization request (`invalid_request`), never redirected"
+          }
+        },
+        "security" : [ ],
+        "summary" : "Start an application authorization",
+        "tags" : [ "auth" ]
+      }
+    },
+    "/auth/authorizations" : {
+      "post" : {
+        "description" : "Called on behalf of the signed-in user once they consented to the application. Returns a single-use code, valid 5 minutes, bound to the redirect address and the PKCE challenge.\n",
+        "operationId" : "createApplicationAuthorization",
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/ApplicationAuthorizationRequest"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "201" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/ApplicationAuthorizationResponse"
+                }
+              }
+            },
+            "description" : "Authorization code"
+          },
+          "400" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/ApplicationAuthorizationError"
+                }
+              }
+            },
+            "description" : "Invalid authorization request"
+          },
+          "403" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/ApplicationAuthorizationError"
+                }
+              }
+            },
+            "description" : "No user account behind the call"
+          }
+        },
+        "summary" : "Issue an application authorization code",
+        "tags" : [ "auth" ]
+      }
+    },
+    "/auth/token" : {
+      "post" : {
+        "description" : "Exchanges the code issued by `POST /auth/authorizations` for an API key of the user, after checking the PKCE verifier, the client and the redirect address. The code is single use. Errors follow RFC 6749 section 5.2.\n",
+        "operationId" : "exchangeApplicationAuthorizationCode",
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/ApplicationTokenRequest"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/ApplicationTokenResponse"
+                }
+              }
+            },
+            "description" : "API key of the user"
+          },
+          "400" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/ApplicationTokenError"
+                }
+              }
+            },
+            "description" : "OAuth error (`invalid_request`, `invalid_grant`, `unsupported_grant_type`)"
+          }
+        },
+        "security" : [ ],
+        "summary" : "Exchange an application authorization code",
+        "tags" : [ "auth" ]
+      }
+    },
     "/.well-known/jwks.json" : {
       "get" : {
         "description" : "Returns the JSON Web Key Set for JWT verification",
@@ -23462,6 +23689,19 @@
         "required" : [ "message" ],
         "type" : "object"
       },
+      "EphemeralInstanceToken" : {
+        "allOf" : [ {
+          "$ref" : "#/components/schemas/EphemeralInstance"
+        }, {
+          "properties" : {
+            "expiresAt" : {
+              "type" : "string"
+            }
+          },
+          "required" : [ "expiresAt" ],
+          "type" : "object"
+        } ]
+      },
       "InstanceContext" : {
         "additionalProperties" : false,
         "properties" : {
@@ -23652,6 +23892,117 @@
         "required" : [ "message" ],
         "type" : "object"
       },
+      "ApplicationTokenError" : {
+        "properties" : {
+          "error" : {
+            "type" : "string"
+          },
+          "error_description" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "error" ],
+        "type" : "object"
+      },
+      "ApplicationAuthorizationRequest" : {
+        "additionalProperties" : false,
+        "properties" : {
+          "clientId" : {
+            "maxLength" : 100,
+            "minLength" : 1,
+            "type" : "string"
+          },
+          "redirectUri" : {
+            "description" : "Loopback HTTP address with a port, e.g. `http://127.0.0.1:53682/callback`.",
+            "maxLength" : 200,
+            "minLength" : 1,
+            "type" : "string"
+          },
+          "codeChallenge" : {
+            "maxLength" : 128,
+            "minLength" : 43,
+            "type" : "string"
+          },
+          "codeChallengeMethod" : {
+            "enum" : [ "S256" ],
+            "type" : "string"
+          },
+          "deviceName" : {
+            "maxLength" : 100,
+            "type" : "string"
+          }
+        },
+        "required" : [ "clientId", "codeChallenge", "codeChallengeMethod", "redirectUri" ],
+        "type" : "object"
+      },
+      "ApplicationAuthorizationResponse" : {
+        "properties" : {
+          "code" : {
+            "type" : "string"
+          },
+          "expiresIn" : {
+            "description" : "Lifetime of the code, in seconds.",
+            "type" : "integer"
+          }
+        },
+        "required" : [ "code", "expiresIn" ],
+        "type" : "object"
+      },
+      "ApplicationAuthorizationError" : {
+        "properties" : {
+          "message" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "message" ],
+        "type" : "object"
+      },
+      "ApplicationTokenRequest" : {
+        "properties" : {
+          "grant_type" : {
+            "enum" : [ "authorization_code" ],
+            "type" : "string"
+          },
+          "code" : {
+            "type" : "string"
+          },
+          "code_verifier" : {
+            "type" : "string"
+          },
+          "redirect_uri" : {
+            "type" : "string"
+          },
+          "client_id" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "client_id", "code", "code_verifier", "grant_type", "redirect_uri" ],
+        "type" : "object"
+      },
+      "ApplicationTokenResponse" : {
+        "properties" : {
+          "access_token" : {
+            "description" : "API key, to send in the `x-api-key` header.",
+            "type" : "string"
+          },
+          "token_type" : {
+            "enum" : [ "api_key" ],
+            "type" : "string"
+          },
+          "key_id" : {
+            "type" : "string"
+          },
+          "key_name" : {
+            "type" : "string"
+          },
+          "email" : {
+            "nullable" : true,
+            "type" : "string"
+          }
+        },
+        "required" : [ "access_token", "key_id", "key_name", "token_type" ],
+        "type" : "object"
+      },
       "Chunk" : {
         "properties" : {
           "id" : {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@breign/client",
-  "version": "1.0.174",
+  "version": "1.0.176",
   "main": "dist/index.js",
   "exports": {
     ".": "./dist/index.js",