@calimero-network/mero-js 26.7.0 → 26.9.0

package/dist/index.mjs

@@ -1740,6 +1740,53 @@ var AdminApiClient = class {
       )
     );
   }
+  /**
+   * Issue an access grant: a token whose holder may call `request.methods` in
+   * `contextId`, as this node, with no session of its own.
+   *
+   * A grant only narrows: each method must be one this session's own token may
+   * execute in the context (`403` otherwise), and an account session is refused
+   * (`403`), since a granted call runs as the node. The token is in the answer
+   * once and never again; the node keeps only its hash.
+   */
+  async createAccessGrant(contextId, request) {
+    return unwrap(
+      await this.httpClient.post(
+        `/admin-api/contexts/${pathSegment(contextId)}/grants`,
+        { methods: request.methods, label: request.label ?? "", notAfter: request.notAfter ?? null }
+      )
+    );
+  }
+  /** The access grants of `contextId` this session could have issued. */
+  async listAccessGrants(contextId) {
+    return unwrap(
+      await this.httpClient.get(
+        `/admin-api/contexts/${pathSegment(contextId)}/grants`
+      )
+    );
+  }
+  /** Revoke an access grant. A grant this session cannot see is a `404`. */
+  async revokeAccessGrant(contextId, grantId) {
+    return unwrap(
+      await this.httpClient.delete(
+        `/admin-api/contexts/${pathSegment(contextId)}/grants/${pathSegment(grantId)}`
+      )
+    );
+  }
+  /**
+   * Call one method under an access grant. The token is the whole credential:
+   * the route is public on every node, so this works from a client holding no
+   * session at all. A method the grant does not name, an unknown or revoked
+   * token, and an expired grant are each a `403`.
+   */
+  async callWithAccessGrant(contextId, request) {
+    return unwrap(
+      await this.httpClient.post(
+        `/admin-api/contexts/${pathSegment(contextId)}/grant-calls`,
+        request
+      )
+    );
+  }
   /**
    * Ask what this node can do for a member in `contextId`, before they sign
    * anything.
@@ -13135,8 +13182,9 @@ async function verifySignedAgentPolicy(policy, bundle, options = {}) {
   } catch {
     throw new Error("The signed agent policy is not JSON");
   }
-  if (parsed?.role !== "agent") {
-    throw new Error(`The signed file is a ${JSON.stringify(parsed?.role)} policy, not an agent one`);
+  const role2 = options.role ?? "agent";
+  if (parsed?.role !== role2) {
+    throw new Error(`The signed file is a ${JSON.stringify(parsed?.role)} policy, not an ${role2} one`);
   }
   const profile = options.profile ?? PRODUCTION_PROFILE;
   if (parsed.profile !== profile) {