@breign/client 1.0.184 → 1.0.185

package/dist/openapi.json

@@ -102,6 +102,9 @@
   }, {
     "description" : "Support page of an organization, its settings and the requests sent from it",
     "name" : "support"
+  }, {
+    "description" : "Breign as an OAuth provider for third-party apps: the authorization bridge used by breign-app, the OAuth clients of an organization and the user's connected applications",
+    "name" : "oauth-provider"
   } ],
   "paths" : {
     "/health" : {
@@ -5233,6 +5236,169 @@
         "tags" : [ "auth" ]
       }
     },
+    "/oauth/provider" : {
+      "get" : {
+        "description" : "Issuer, ressource à passer en `resource` et document de découverte. Répond 404 quand le fournisseur OAuth est désactivé : breign-app s'en sert pour afficher ou non ses écrans.",
+        "operationId" : "getOAuthProvider",
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthProviderInfo"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "404" : {
+            "description" : "OAuth provider disabled"
+          }
+        },
+        "summary" : "Describe the OAuth provider of the platform",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
+    "/oauth/authorizations/resume" : {
+      "post" : {
+        "description" : "Appelée par la page `/oauth/authorize` de breign-app au nom de l'utilisateur connecté (clé plateforme + `x-user-id`). L'utilisateur doit être membre de l'organisation du client.",
+        "operationId" : "resumeOAuthAuthorization",
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/OAuthAuthorizationResumeRequest"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthAuthorizationResume"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "400" : {
+            "description" : "Invalid authorization request, unknown or disabled client (INVALID_CLIENT), missing resource (RESOURCE_REQUIRED)"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not a user account"
+          }
+        },
+        "summary" : "Resume an OAuth authorization request on behalf of the connected user",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
+    "/oauth/authorizations/consent" : {
+      "post" : {
+        "description" : "Appelée par breign-app quand l'utilisateur accepte ou refuse. Un refus est accepté même d'un non-membre, pour renvoyer l'application avec `access_denied`.",
+        "operationId" : "consentOAuthAuthorization",
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/OAuthAuthorizationConsentRequest"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthAuthorizationRedirect"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "400" : {
+            "description" : "Invalid authorization request"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not a user account"
+          }
+        },
+        "summary" : "Answer the consent screen of an OAuth authorization",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
+    "/me/oauth-consents" : {
+      "get" : {
+        "operationId" : "listMyOAuthConsents",
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "items" : {
+                    "$ref" : "#/components/schemas/OAuthConsent"
+                  },
+                  "type" : "array"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not a user account"
+          }
+        },
+        "summary" : "List the applications the current user authorized",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
+    "/me/oauth-consents/{clientId}" : {
+      "delete" : {
+        "description" : "Supprime le consentement et révoque les jetons de l'application pour l'utilisateur.",
+        "operationId" : "revokeMyOAuthConsent",
+        "parameters" : [ {
+          "description" : "client_id of the OAuth client",
+          "in" : "path",
+          "name" : "clientId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "204" : {
+            "description" : "Revoked"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not a user account"
+          },
+          "404" : {
+            "description" : "No access granted to this client"
+          }
+        },
+        "summary" : "Revoke an application the current user authorized",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
     "/.well-known/jwks.json" : {
       "get" : {
         "description" : "Returns the JSON Web Key Set for JWT verification",
@@ -19621,6 +19787,277 @@
         "tags" : [ "support" ]
       }
     },
+    "/organizations/{organizationId}/oauth-clients" : {
+      "get" : {
+        "description" : "Réservé aux admins de l'organisation et aux superadmins.",
+        "operationId" : "listOrganizationOAuthClients",
+        "parameters" : [ {
+          "description" : "ID of the organization",
+          "in" : "path",
+          "name" : "organizationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "items" : {
+                    "$ref" : "#/components/schemas/OAuthClient"
+                  },
+                  "type" : "array"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not an admin of the organization"
+          }
+        },
+        "summary" : "List the OAuth clients of an organization",
+        "tags" : [ "oauth-provider" ]
+      },
+      "post" : {
+        "description" : "Réservé aux admins de l'organisation et aux superadmins. Le secret d'un client confidentiel n'est renvoyé qu'ici et à sa rotation.",
+        "operationId" : "createOrganizationOAuthClient",
+        "parameters" : [ {
+          "description" : "ID of the organization",
+          "in" : "path",
+          "name" : "organizationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/OAuthClientCreate"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "201" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthClientWithSecret"
+                }
+              }
+            },
+            "description" : "Created"
+          },
+          "400" : {
+            "description" : "Invalid client (redirect URI"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not an admin of the organization"
+          }
+        },
+        "summary" : "Create an OAuth client for an organization",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
+    "/organizations/{organizationId}/oauth-clients/{clientId}" : {
+      "delete" : {
+        "description" : "Ses jetons et les consentements donnés sont supprimés avec lui.",
+        "operationId" : "deleteOrganizationOAuthClient",
+        "parameters" : [ {
+          "description" : "ID of the organization",
+          "in" : "path",
+          "name" : "organizationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "client_id of the OAuth client",
+          "in" : "path",
+          "name" : "clientId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "204" : {
+            "description" : "Deleted"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not an admin of the organization"
+          },
+          "404" : {
+            "description" : "Unknown client"
+          }
+        },
+        "summary" : "Delete an OAuth client of an organization",
+        "tags" : [ "oauth-provider" ]
+      },
+      "get" : {
+        "operationId" : "getOrganizationOAuthClient",
+        "parameters" : [ {
+          "description" : "ID of the organization",
+          "in" : "path",
+          "name" : "organizationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "client_id of the OAuth client",
+          "in" : "path",
+          "name" : "clientId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthClient"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not an admin of the organization"
+          },
+          "404" : {
+            "description" : "Unknown client"
+          }
+        },
+        "summary" : "Get an OAuth client of an organization",
+        "tags" : [ "oauth-provider" ]
+      },
+      "patch" : {
+        "operationId" : "updateOrganizationOAuthClient",
+        "parameters" : [ {
+          "description" : "ID of the organization",
+          "in" : "path",
+          "name" : "organizationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "client_id of the OAuth client",
+          "in" : "path",
+          "name" : "clientId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/OAuthClientUpdate"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthClient"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "400" : {
+            "description" : "Invalid update"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not an admin of the organization"
+          },
+          "404" : {
+            "description" : "Unknown client"
+          }
+        },
+        "summary" : "Update an OAuth client of an organization",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
+    "/organizations/{organizationId}/oauth-clients/{clientId}/rotate-secret" : {
+      "post" : {
+        "description" : "L'ancien secret cesse de fonctionner ; le nouveau n'est affiché qu'ici.",
+        "operationId" : "rotateOrganizationOAuthClientSecret",
+        "parameters" : [ {
+          "description" : "ID of the organization",
+          "in" : "path",
+          "name" : "organizationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "client_id of the OAuth client",
+          "in" : "path",
+          "name" : "clientId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/OAuthClientWithSecret"
+                }
+              }
+            },
+            "description" : "OK"
+          },
+          "400" : {
+            "description" : "A public client has no secret (PUBLIC_CLIENT_HAS_NO_SECRET)"
+          },
+          "401" : {
+            "description" : "Unauthenticated"
+          },
+          "403" : {
+            "description" : "Not an admin of the organization"
+          },
+          "404" : {
+            "description" : "Unknown client"
+          }
+        },
+        "summary" : "Rotate the secret of a confidential OAuth client",
+        "tags" : [ "oauth-provider" ]
+      }
+    },
     "/execution-nodes/{nodeId}/sessions/{sessionId}" : {
       "get" : {
         "operationId" : "getExecutionNodeSession",
@@ -21597,6 +22034,15 @@
           "type" : "string"
         }
       },
+      "oauthClientIdPath" : {
+        "description" : "client_id of the OAuth client",
+        "in" : "path",
+        "name" : "clientId",
+        "required" : true,
+        "schema" : {
+          "type" : "string"
+        }
+      },
       "toolIdPath" : {
         "description" : "Tool identifier",
         "in" : "path",
@@ -25917,6 +26363,130 @@
         "required" : [ "access_token", "key_id", "key_name", "token_type" ],
         "type" : "object"
       },
+      "OAuthProviderInfo" : {
+        "description" : "Le fournisseur OAuth de la plateforme. Répond 404 quand il est désactivé.",
+        "properties" : {
+          "issuer" : {
+            "type" : "string"
+          },
+          "resource" : {
+            "description" : "La valeur exacte que les applications passent en `resource`.",
+            "type" : "string"
+          },
+          "discoveryUrl" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "discoveryUrl", "issuer", "resource" ],
+        "type" : "object"
+      },
+      "OAuthAuthorizationResumeRequest" : {
+        "properties" : {
+          "oauthQuery" : {
+            "description" : "La requête d'autorisation signée, telle que le fournisseur l'a passée à la page `/oauth/authorize` de breign-app (sa query string, sans le `?`).",
+            "type" : "string"
+          }
+        },
+        "required" : [ "oauthQuery" ],
+        "type" : "object"
+      },
+      "OAuthAuthorizationResume" : {
+        "description" : "`redirect` : l'utilisateur a déjà consenti (ou le client s'en dispense), envoyer le navigateur sur `redirectUrl`. `consent_required` : afficher l'écran de consentement.",
+        "properties" : {
+          "status" : {
+            "enum" : [ "redirect", "consent_required" ],
+            "type" : "string"
+          },
+          "redirectUrl" : {
+            "description" : "Présent quand `status` vaut `redirect`.",
+            "type" : "string"
+          },
+          "client" : {
+            "$ref" : "#/components/schemas/OAuthAuthorizationResume_client"
+          },
+          "organization" : {
+            "$ref" : "#/components/schemas/OAuthAuthorizationResume_organization"
+          },
+          "scopes" : {
+            "description" : "Scopes demandés par l'application. Présent quand `status` vaut `consent_required`.",
+            "items" : {
+              "type" : "string"
+            },
+            "type" : "array"
+          },
+          "oauthQuery" : {
+            "description" : "La requête signée à renvoyer à `consent` avec la réponse de l'utilisateur. Présent quand `status` vaut `consent_required` ; elle peut différer de celle passée à `resume`.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "status" ],
+        "type" : "object"
+      },
+      "OAuthAuthorizationConsentRequest" : {
+        "properties" : {
+          "oauthQuery" : {
+            "type" : "string"
+          },
+          "accept" : {
+            "description" : "Un refus renvoie l'application avec `error=access_denied`.",
+            "type" : "boolean"
+          },
+          "scope" : {
+            "description" : "Scopes accordés, séparés par des espaces : un sous-ensemble de ceux demandés. Par défaut, tous.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "accept", "oauthQuery" ],
+        "type" : "object"
+      },
+      "OAuthAuthorizationRedirect" : {
+        "properties" : {
+          "redirectUrl" : {
+            "description" : "Où envoyer le navigateur : l'adresse de retour de l'application, avec le code ou l'erreur.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "redirectUrl" ],
+        "type" : "object"
+      },
+      "OAuthConsent" : {
+        "description" : "Une application que l'utilisateur a autorisée.",
+        "properties" : {
+          "clientId" : {
+            "type" : "string"
+          },
+          "clientName" : {
+            "nullable" : true,
+            "type" : "string"
+          },
+          "clientIcon" : {
+            "nullable" : true,
+            "type" : "string"
+          },
+          "clientUri" : {
+            "nullable" : true,
+            "type" : "string"
+          },
+          "scopes" : {
+            "items" : {
+              "type" : "string"
+            },
+            "type" : "array"
+          },
+          "createdAt" : {
+            "format" : "date-time",
+            "nullable" : true,
+            "type" : "string"
+          },
+          "updatedAt" : {
+            "format" : "date-time",
+            "nullable" : true,
+            "type" : "string"
+          }
+        },
+        "required" : [ "clientIcon", "clientId", "clientName", "clientUri", "createdAt", "scopes", "updatedAt" ],
+        "type" : "object"
+      },
       "Chunk" : {
         "properties" : {
           "id" : {
@@ -32865,6 +33435,150 @@
         "required" : [ "duplicate", "eventId" ],
         "type" : "object"
       },
+      "OAuthClient" : {
+        "description" : "Une application tierce autorisée à connecter les utilisateurs de l'organisation.",
+        "properties" : {
+          "clientId" : {
+            "type" : "string"
+          },
+          "name" : {
+            "nullable" : true,
+            "type" : "string"
+          },
+          "type" : {
+            "$ref" : "#/components/schemas/OAuthClientType"
+          },
+          "applicationType" : {
+            "description" : "`native` pour une appli mobile ou desktop (retour en loopback ou schéma privé).",
+            "enum" : [ "web", "native" ],
+            "type" : "string"
+          },
+          "redirectUris" : {
+            "items" : {
+              "type" : "string"
+            },
+            "type" : "array"
+          },
+          "uri" : {
+            "description" : "Site de l'application, affiché sur l'écran de consentement.",
+            "nullable" : true,
+            "type" : "string"
+          },
+          "icon" : {
+            "description" : "Logo de l'application, affiché sur l'écran de consentement.",
+            "nullable" : true,
+            "type" : "string"
+          },
+          "skipConsent" : {
+            "description" : "Application de confiance, les utilisateurs ne voient pas l'écran de consentement.",
+            "type" : "boolean"
+          },
+          "disabled" : {
+            "type" : "boolean"
+          },
+          "createdAt" : {
+            "format" : "date-time",
+            "nullable" : true,
+            "type" : "string"
+          }
+        },
+        "required" : [ "applicationType", "clientId", "createdAt", "disabled", "icon", "name", "redirectUris", "skipConsent", "type", "uri" ],
+        "type" : "object"
+      },
+      "OAuthClientType" : {
+        "description" : "`confidential` : application avec serveur, qui garde un secret. `public` : SPA, mobile ou desktop, sans secret, PKCE obligatoire.",
+        "enum" : [ "confidential", "public" ],
+        "type" : "string"
+      },
+      "OAuthClientCreate" : {
+        "properties" : {
+          "name" : {
+            "maxLength" : 200,
+            "minLength" : 1,
+            "type" : "string"
+          },
+          "type" : {
+            "$ref" : "#/components/schemas/OAuthClientType"
+          },
+          "applicationType" : {
+            "default" : "web",
+            "enum" : [ "web", "native" ],
+            "type" : "string"
+          },
+          "redirectUris" : {
+            "items" : {
+              "format" : "uri",
+              "type" : "string"
+            },
+            "maxItems" : 20,
+            "minItems" : 1,
+            "type" : "array"
+          },
+          "uri" : {
+            "format" : "uri",
+            "type" : "string"
+          },
+          "icon" : {
+            "format" : "uri",
+            "type" : "string"
+          },
+          "skipConsent" : {
+            "default" : false,
+            "type" : "boolean"
+          }
+        },
+        "required" : [ "name", "redirectUris", "type" ],
+        "type" : "object"
+      },
+      "OAuthClientWithSecret" : {
+        "allOf" : [ {
+          "$ref" : "#/components/schemas/OAuthClient"
+        }, {
+          "properties" : {
+            "clientSecret" : {
+              "description" : "Le secret d'un client confidentiel, affiché une seule fois (création, rotation). Null pour un client public.",
+              "nullable" : true,
+              "type" : "string"
+            }
+          },
+          "required" : [ "clientSecret" ],
+          "type" : "object"
+        } ]
+      },
+      "OAuthClientUpdate" : {
+        "minProperties" : 1,
+        "properties" : {
+          "name" : {
+            "maxLength" : 200,
+            "minLength" : 1,
+            "type" : "string"
+          },
+          "redirectUris" : {
+            "items" : {
+              "format" : "uri",
+              "type" : "string"
+            },
+            "maxItems" : 20,
+            "minItems" : 1,
+            "type" : "array"
+          },
+          "uri" : {
+            "description" : "URL du site, ou chaîne vide pour l'effacer.",
+            "type" : "string"
+          },
+          "icon" : {
+            "description" : "URL du logo, ou chaîne vide pour l'effacer.",
+            "type" : "string"
+          },
+          "skipConsent" : {
+            "type" : "boolean"
+          },
+          "disabled" : {
+            "type" : "boolean"
+          }
+        },
+        "type" : "object"
+      },
       "NodeSessionDetail" : {
         "allOf" : [ {
           "$ref" : "#/components/schemas/NodeSession"
@@ -36002,6 +36716,42 @@
         "required" : [ "email" ],
         "type" : "object"
       },
+      "OAuthAuthorizationResume_client" : {
+        "description" : "Présent quand `status` vaut `consent_required`.",
+        "properties" : {
+          "clientId" : {
+            "type" : "string"
+          },
+          "name" : {
+            "nullable" : true,
+            "type" : "string"
+          },
+          "uri" : {
+            "nullable" : true,
+            "type" : "string"
+          },
+          "icon" : {
+            "nullable" : true,
+            "type" : "string"
+          }
+        },
+        "required" : [ "clientId", "icon", "name", "uri" ],
+        "type" : "object"
+      },
+      "OAuthAuthorizationResume_organization" : {
+        "description" : "Présent quand `status` vaut `consent_required`.",
+        "properties" : {
+          "id" : {
+            "type" : "string"
+          },
+          "name" : {
+            "nullable" : true,
+            "type" : "string"
+          }
+        },
+        "required" : [ "id", "name" ],
+        "type" : "object"
+      },
       "ChunkCreateRequest_content_inner" : {
         "additionalProperties" : false,
         "properties" : {