@calimero-network/mero-js 27.5.0 → 28.0.0

package/dist/index.mjs

@@ -2046,19 +2046,25 @@ var CalimeroClient = class _CalimeroClient {
   me() {
     return this.get("auth/me");
   }
-  /** Add another passkey (another device) to the signed-in account; answers its credential id. */
-  async addPasskey(passkey) {
+  /**
+   * Add another passkey (another device, `passkey`) to the signed-in account;
+   * answers its credential id. The node asks for the approval of a passkey
+   * the account already has (`412 CONFIRM_REQUIRED`, never the new one),
+   * which `approver` gives.
+   */
+  async addPasskey(passkey, approver) {
     const begin = await this.post("auth/passkeys/add/begin");
     const registration = await passkey.create(begin.options);
-    const { credentialId } = await this.post("auth/passkeys/add/finish", {
-      challengeId: begin.challengeId,
-      registration
-    });
+    const { credentialId } = await this.postConfirmed(
+      "auth/passkeys/add/finish",
+      { challengeId: begin.challengeId, registration },
+      approver
+    );
     return credentialId;
   }
-  /** Remove one of the account's passkeys (not the last). */
-  async removePasskey(credentialId) {
-    await this.delete(`auth/passkeys/${seg(credentialId)}`);
+  /** Remove one of the account's passkeys (not the last), approved with `passkey` (one it has). */
+  async removePasskey(credentialId, passkey) {
+    await this.deleteConfirmed(`auth/passkeys/${seg(credentialId)}`, passkey);
   }
   /** Name one of the account's passkeys (a device label); `''` clears the name. */
   async labelPasskey(credentialId, label) {
@@ -2086,9 +2092,13 @@ var CalimeroClient = class _CalimeroClient {
   async revokeApiKey(keyId) {
     await this.delete(`auth/apikeys/${seg(keyId)}`);
   }
-  /** Create an API key for an agent or server. The key is returned once. */
-  createApiKey(options) {
-    return this.post("auth/apikeys", options);
+  /**
+   * Create an API key for an agent or server, approved with the account's
+   * `passkey` (`412 CONFIRM_REQUIRED`); needs a passkey session (an API key
+   * is refused `403`). The key is returned once.
+   */
+  createApiKey(options, passkey) {
+    return this.postConfirmed("auth/apikeys", { ...options }, passkey);
   }
   // ---------------------------------------------------------------- apps
   /** Upload a raw WASM bundle (development clusters only); answers its hash. */
@@ -2196,12 +2206,19 @@ var CalimeroClient = class _CalimeroClient {
   }
   /**
    * POST `body` to `path`, answering a `412 CONFIRM_REQUIRED` with `passkey`'s
-   * assertion over the node's challenge (deleting an org, approving a release, ...).
+   * assertion over the node's challenge (deleting an org, approving a release,
+   * adding a member, ...): the same body again, with `confirm`. Without a
+   * passkey (a caller in plain JavaScript passing none) the `412` reaches the
+   * caller as {@link ConfirmRequired}, carrying the challenge.
    */
   postConfirmed(path, body, passkey) {
     return this.confirmed("POST", path, body, passkey);
   }
-  /** {@link postConfirmed} for a DELETE (deleting an organization). */
+  /**
+   * {@link postConfirmed} for a DELETE (deleting an organization, removing a
+   * member or a passkey): `body` (`{}` by default) goes as JSON, and the
+   * confirmed retry carries `confirm` beside it.
+   */
   deleteConfirmed(path, passkey, body = {}) {
     return this.confirmed("DELETE", path, body, passkey);
   }
@@ -2209,7 +2226,7 @@ var CalimeroClient = class _CalimeroClient {
     try {
       return await send(body);
     } catch (error) {
-      if (!(error instanceof ConfirmRequired)) throw error;
+      if (!(error instanceof ConfirmRequired) || !passkey) throw error;
       const d = error.details;
       let assertion;
       try {
@@ -2533,20 +2550,24 @@ var CalimeroClient = class _CalimeroClient {
   async liftReleaseDeadline(version) {
     await this.delete(`ops/releases/${seg(version)}/deadline`);
   }
-  /** Add a member, or change their role. */
-  async setMember(org, account, role) {
-    await this.post(`orgs/${seg(org)}/members`, { account, role });
+  /** Add a member, or change their role, approved with the caller's `passkey`. */
+  async setMember(org, account, role, passkey) {
+    await this.postConfirmed(`orgs/${seg(org)}/members`, { account, role }, passkey);
   }
-  removeMember(org, account) {
-    return this.delete(`orgs/${seg(org)}/members/${seg(account)}`);
+  /**
+   * Remove a member, or leave (`account` the caller's own), approved with the
+   * caller's `passkey`.
+   */
+  removeMember(org, account, passkey) {
+    return this.deleteConfirmed(`orgs/${seg(org)}/members/${seg(account)}`, passkey);
   }
   /**
    * Set capability bits ({@link ORG_CAPABILITIES}): for a member (`account`),
    * for a member of one team (`account` and `team`), or the organization's
-   * default (neither).
+   * default (neither). Approved with the caller's `passkey`.
    */
-  async setCapabilities(org, capabilities, at = {}) {
-    await this.post(`orgs/${seg(org)}/capabilities`, { capabilities, ...at });
+  async setCapabilities(org, capabilities, passkey, at = {}) {
+    await this.postConfirmed(`orgs/${seg(org)}/capabilities`, { capabilities, ...at }, passkey);
   }
   async createTeam(org, name, join, parent) {
     const { teamId } = await this.post(`orgs/${seg(org)}/teams`, { name, join, parent });
@@ -2566,15 +2587,28 @@ var CalimeroClient = class _CalimeroClient {
   async deleteTeam(org, team) {
     await this.delete(`orgs/${seg(org)}/teams/${seg(team)}`);
   }
-  /** Add a member to a team, or change their row: role, lead, capability bits. */
-  async setTeamMember(org, team, account, row = {}) {
-    await this.post(`orgs/${seg(org)}/teams/${seg(team)}/members`, { account, ...row });
+  /**
+   * Add a member to a team, or change their row: role, lead, capability bits.
+   * Approved with the caller's `passkey`.
+   */
+  async setTeamMember(org, team, account, passkey, row = {}) {
+    await this.postConfirmed(`orgs/${seg(org)}/teams/${seg(team)}/members`, { account, ...row }, passkey);
   }
-  async removeTeamMember(org, team, account) {
-    await this.delete(`orgs/${seg(org)}/teams/${seg(team)}/members/${seg(account)}`);
+  /** Remove a member from a team, approved with the caller's `passkey`. */
+  async removeTeamMember(org, team, account, passkey) {
+    await this.deleteConfirmed(`orgs/${seg(org)}/teams/${seg(team)}/members/${seg(account)}`, passkey);
   }
-  async invite(org, role, teams = [], options = {}) {
-    const { token } = await this.post(`orgs/${seg(org)}/invites`, { role, teams, ...options });
+  /**
+   * Make an invite into `org` (and `teams`), approved with the caller's
+   * `passkey`; answers its token, which {@link redeemInvite} takes (no
+   * approval there).
+   */
+  async invite(org, role, passkey, teams = [], options = {}) {
+    const { token } = await this.postConfirmed(
+      `orgs/${seg(org)}/invites`,
+      { role, teams, ...options },
+      passkey
+    );
     return token;
   }
   redeemInvite(token) {