@camunda/ccma-api 0.1.0 → 0.4.0

package/dist/services/accounts/token-issuer.service.d.ts

@@ -0,0 +1,31 @@
+import type { RequestBaseParams } from '../../types/general.types.js';
+export interface InvalidateTokenParams extends RequestBaseParams {
+    body: {
+        client_id: string;
+        client_secret: string;
+        audience: string;
+        clusterId?: string;
+        orgId?: string;
+    };
+}
+export interface InvalidateTokenByClientParams extends RequestBaseParams {
+    body: {
+        client_id: string;
+        audience: string;
+        clusterId?: string;
+        orgId?: string;
+    };
+}
+/**
+ * Token Issuer admin actions (god-gated), served by the public login host
+ * (`login` base — same URL accounts reaches via `VITE_TOKEN_ISSUER`).
+ */
+export declare class TokenIssuerService {
+    private static post;
+    /** Invalidate a single token (requires the client secret). */
+    static invalidateToken(params: InvalidateTokenParams): Promise<void>;
+    /** Invalidate every token of a client (no secret needed). */
+    static invalidateTokenByClient(params: InvalidateTokenByClientParams): Promise<void>;
+    /** Invalidate all currently-invalid tokens (cleanup sweep). */
+    static invalidateInvalidTokens(params: RequestBaseParams): Promise<void>;
+}

package/dist/services/accounts/token-issuer.service.js

@@ -0,0 +1,63 @@
+import { request } from "../../utils/api.js";
+import { HttpError } from "../../utils/errors.js";
+class TokenIssuerService {
+  static async post(name, url, params, body) {
+    const serviceContext = {
+      method: {
+        name,
+        url,
+        normalizedUrl: url,
+        type: "post"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "login", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "login" },
+      url,
+      method: "post",
+      metricsDetails: serviceContext,
+      body,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Invalidate a single token (requires the client secret). */
+  static async invalidateToken(params) {
+    await TokenIssuerService.post(
+      "TokenIssuerService.invalidateToken",
+      "invalidate",
+      params,
+      params.body
+    );
+  }
+  /** Invalidate every token of a client (no secret needed). */
+  static async invalidateTokenByClient(params) {
+    await TokenIssuerService.post(
+      "TokenIssuerService.invalidateTokenByClient",
+      "invalidate/by-client",
+      params,
+      params.body
+    );
+  }
+  /** Invalidate all currently-invalid tokens (cleanup sweep). */
+  static async invalidateInvalidTokens(params) {
+    await TokenIssuerService.post(
+      "TokenIssuerService.invalidateInvalidTokens",
+      "invalidate/invalid",
+      params,
+      {}
+    );
+  }
+}
+export {
+  TokenIssuerService
+};
+//# sourceMappingURL=token-issuer.service.js.map

package/dist/services/accounts/token-issuer.service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/services/accounts/token-issuer.service.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  RequestBaseParams,\n  RequestBaseServiceContext,\n} from '../../types/general.types.js'\nimport { request } from '../../utils/api.js'\nimport { HttpError } from '../../utils/errors.js'\n\nexport interface InvalidateTokenParams extends RequestBaseParams {\n  body: {\n    client_id: string\n    client_secret: string\n    audience: string\n    clusterId?: string\n    orgId?: string\n  }\n}\n\nexport interface InvalidateTokenByClientParams extends RequestBaseParams {\n  body: {\n    client_id: string\n    audience: string\n    clusterId?: string\n    orgId?: string\n  }\n}\n\n/**\n * Token Issuer admin actions (god-gated), served by the public login host\n * (`login` base \u2014 same URL accounts reaches via `VITE_TOKEN_ISSUER`).\n */\nexport class TokenIssuerService {\n  private static async post(\n    name: string,\n    url: string,\n    params: RequestBaseParams,\n    body: object,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name,\n        url,\n        normalizedUrl: url,\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'login', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'login' },\n      url,\n      method: 'post',\n      metricsDetails: serviceContext,\n      body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Invalidate a single token (requires the client secret). */\n  public static async invalidateToken(\n    params: InvalidateTokenParams,\n  ): Promise<void> {\n    await TokenIssuerService.post(\n      'TokenIssuerService.invalidateToken',\n      'invalidate',\n      params,\n      params.body,\n    )\n  }\n\n  /** Invalidate every token of a client (no secret needed). */\n  public static async invalidateTokenByClient(\n    params: InvalidateTokenByClientParams,\n  ): Promise<void> {\n    await TokenIssuerService.post(\n      'TokenIssuerService.invalidateTokenByClient',\n      'invalidate/by-client',\n      params,\n      params.body,\n    )\n  }\n\n  /** Invalidate all currently-invalid tokens (cleanup sweep). */\n  public static async invalidateInvalidTokens(\n    params: RequestBaseParams,\n  ): Promise<void> {\n    await TokenIssuerService.post(\n      'TokenIssuerService.invalidateInvalidTokens',\n      'invalidate/invalid',\n      params,\n      {},\n    )\n  }\n}\n"],
+  "mappings": "AAUA,SAAS,eAAe;AACxB,SAAS,iBAAiB;AAyBnB,MAAM,mBAAmB;AAAA,EAC9B,aAAqB,KACnB,MACA,KACA,QACA,MACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,SAAS,MAAM,WAAW;AAAA,IAC5C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,QAAQ;AAAA,MACpB;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QAClD,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,gBAClB,QACe;AACf,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,wBAClB,QACe;AACf,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,wBAClB,QACe;AACf,UAAM,mBAAmB;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC;AAAA,IACH;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/services/accounts/users.service.d.ts

@@ -55,6 +55,30 @@ export interface UpdateUserRoleRequest extends RequestBaseParams {
         'x-camunda-email'?: string;
     };
 }
+export interface ChangeUserEmailRequest extends RequestBaseParams {
+    params: {
+        userId: string;
+        email: string;
+    };
+}
+export interface ChangeUserNameRequest extends RequestBaseParams {
+    params: {
+        userId: string;
+        firstname: string;
+        lastname: string;
+    };
+}
+export interface UserIdRequest extends RequestBaseParams {
+    params: {
+        userId: string;
+    };
+}
+export interface SetDefaultOrgRequest extends RequestBaseParams {
+    params: {
+        userId: string;
+        orgId: string;
+    };
+}
 export declare class UsersService {
     static search(params: SearchParams): Promise<User[]>;
     static simpleSearch(params: SimpleSearchParams): Promise<{
@@ -63,8 +87,43 @@ export declare class UsersService {
     static getUserInfo(params: {
         userId: string;
         basic?: boolean;
+        roles?: boolean;
     } & RequestBaseParams): Promise<User | undefined>;
     static addUserToOrganization(params: AddUserToOrganizationRequest): Promise<void>;
+    static changeEmail(params: ChangeUserEmailRequest): Promise<void>;
+    static changeName(params: ChangeUserNameRequest): Promise<void>;
+    /** Admin-activate a user without an email token (POST api/admin/activate). */
+    static activateWithoutToken(params: UserIdRequest): Promise<void>;
+    /** Refresh the verification token and resend the welcome mail. */
+    static resendWelcomeMail(params: UserIdRequest): Promise<void>;
+    static deleteUser(params: UserIdRequest): Promise<void>;
+    /**
+     * Auth0 brute-force blocks for a user (`GET api/users/:userId/blocks`). The
+     * entries are Auth0's block records (identifier/IP), returned opaque for the
+     * caller to render.
+     */
+    static getBlocks(params: UserIdRequest): Promise<unknown[]>;
+    /** Clear a user's Auth0 blocks (`DELETE api/users/:userId/blocks`). */
+    static clearBlocks(params: UserIdRequest): Promise<void>;
+    /** Replace a user's Auth0 `app_metadata` (god-gated raw JSON edit). */
+    static updateAppMetadata(params: {
+        params: {
+            userId: string;
+        };
+        body: {
+            appMetadata: object;
+        };
+    } & RequestBaseParams): Promise<void>;
+    /** Replace a user's Auth0 `user_metadata` (god-gated raw JSON edit). */
+    static updateUserMetadata(params: {
+        params: {
+            userId: string;
+        };
+        body: {
+            userMetadata: object;
+        };
+    } & RequestBaseParams): Promise<void>;
+    static setDefaultOrg(params: SetDefaultOrgRequest): Promise<void>;
     static removeUserFromOrganization(params: RemoveUserFromOrganizationRequest): Promise<void>;
     /**
      * Update a user's role by adding or removing a single role.

package/dist/services/accounts/users.service.js

@@ -113,19 +113,21 @@ class UsersService {
     return response.body;
   }
   static async getUserInfo(params) {
-    const cacheKey = params.basic === true ? `basic-${params.userId}` : params.userId;
+    const cacheKey = `${params.basic === true ? "basic-" : ""}${params.roles === true ? "roles-" : ""}${params.userId}`;
     if (!params.cacheControl?.ignoreCache) {
       const inCache = userCache.get(cacheKey);
       if (inCache) {
         return inCache;
       }
     }
-    let queryParams = "";
+    const searchParams = new URLSearchParams();
     if (params.basic === true) {
-      const searchParams = new URLSearchParams();
       searchParams.append("basic", "true");
-      queryParams = `?${searchParams.toString()}`;
     }
+    if (params.roles === true) {
+      searchParams.append("roles", "true");
+    }
+    const queryParams = searchParams.toString() ? `?${searchParams.toString()}` : "";
     const serviceContext = {
       method: {
         name: `UsersService.getUserInfo`,
@@ -191,6 +193,296 @@ class UsersService {
       );
     }
   }
+  static async changeEmail(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.changeEmail",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/email`,
+        normalizedUrl: "api/users/:userId/email",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: { email: params.params.email },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  static async changeName(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.changeName",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/name`,
+        normalizedUrl: "api/users/:userId/name",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: {
+        firstname: params.params.firstname,
+        lastname: params.params.lastname
+      },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Admin-activate a user without an email token (POST api/admin/activate). */
+  static async activateWithoutToken(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.activateWithoutToken",
+        url: "api/admin/activate",
+        normalizedUrl: "api/admin/activate",
+        type: "post"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: { userId: params.params.userId },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Refresh the verification token and resend the welcome mail. */
+  static async resendWelcomeMail(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.resendWelcomeMail",
+        url: "api/admin/resend-welcome-mail",
+        normalizedUrl: "api/admin/resend-welcome-mail",
+        type: "post"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: { userId: params.params.userId },
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  static async deleteUser(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.deleteUser",
+        url: `api/users/${encodeURIComponent(params.params.userId)}`,
+        normalizedUrl: "api/users/:userId",
+        type: "delete"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /**
+   * Auth0 brute-force blocks for a user (`GET api/users/:userId/blocks`). The
+   * entries are Auth0's block records (identifier/IP), returned opaque for the
+   * caller to render.
+   */
+  static async getBlocks(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.getBlocks",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,
+        normalizedUrl: "api/users/:userId/blocks",
+        type: "get"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      ...params,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "json"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+    return response.body ?? [];
+  }
+  /** Clear a user's Auth0 blocks (`DELETE api/users/:userId/blocks`). */
+  static async clearBlocks(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.clearBlocks",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,
+        normalizedUrl: "api/users/:userId/blocks",
+        type: "delete"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Replace a user's Auth0 `app_metadata` (god-gated raw JSON edit). */
+  static async updateAppMetadata(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.updateAppMetadata",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/appmetadata`,
+        normalizedUrl: "api/users/:userId/appmetadata",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: params.body,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  /** Replace a user's Auth0 `user_metadata` (god-gated raw JSON edit). */
+  static async updateUserMetadata(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.updateUserMetadata",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/usermetadata`,
+        normalizedUrl: "api/users/:userId/usermetadata",
+        type: "put"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      body: params.body,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
+  static async setDefaultOrg(params) {
+    const serviceContext = {
+      method: {
+        name: "UsersService.setDefaultOrg",
+        url: `api/users/${encodeURIComponent(params.params.userId)}/organizations/${encodeURIComponent(params.params.orgId)}/default`,
+        normalizedUrl: "api/users/:userId/organizations/:orgId/default",
+        type: "patch"
+      },
+      source: params.config.metrics?.source || "unset",
+      target: { name: "accounts", type: "internal" }
+    };
+    const response = await request({
+      config: params.config,
+      base: { id: "accounts" },
+      url: serviceContext.method.url,
+      method: serviceContext.method.type,
+      metricsDetails: serviceContext,
+      responseType: "none"
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+  }
   static async removeUserFromOrganization(params) {
     const serviceContext = {
       method: {