@canopy-io/node 0.3.10 → 0.3.11

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @canopy-io/node
 
+## 0.3.11
+
+### Patch Changes
+
+- 4b08934: Organization policy types regenerated from the live spec. `updatePolicy` accepts `allowed_sign_in_methods`, a non-empty subset of the methods the Environment offers (`password`, `email_otp`, `sso`) or `null` to inherit them all; a method the Environment has off is refused with `organization.policy_loosens`. `getPolicy` returns the field on the organization's own values, on `environment` (what is offered) and on `effective` (what members may use, `["sso"]` alone while `require_sso` is on).
+
 ## 0.3.10
 
 ### Patch Changes

package/README.md

@@ -147,7 +147,12 @@ await canopy.organizations.addMember(acme.id, {
   role_id: ownerRoleId,
 });
 
-await canopy.organizations.updatePolicy(acme.id, { mfa_required: true });
+// An organization only tightens the Environment: a second factor where the
+// Environment leaves it optional, and only some of the Environment's ways in.
+await canopy.organizations.updatePolicy(acme.id, {
+  mfa_required: true,
+  allowed_sign_in_methods: ["password", "sso"],
+});
 ```
 
 Directory sync (SCIM) opens when you name the roles an organization's identity

package/dist/index.d.cts

@@ -2935,6 +2935,8 @@ interface components {
             mfa_factor_allowlist: ("totp" | "webauthn" | "email_otp")[];
             /** @enum {string} */
             mfa_after_sso: "exempt" | "require";
+            /** @description The sign-in methods on offer: on the Environment, the ones it has turned on; on the effective policy, those narrowed by the organization, and `["sso"]` alone while it requires SSO. */
+            allowed_sign_in_methods: ("password" | "email_otp" | "sso")[];
             require_sso: boolean;
         };
         OrganizationPolicyResponseDto: {
@@ -2944,6 +2946,8 @@ interface components {
             mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
             /** @enum {string|null} */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The methods the organization keeps of the Environment's, or null to inherit them all. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             require_sso: boolean;
             /** @description The Environment's own settings, the floor this organization's policy tightens from. */
             environment: components["schemas"]["EffectiveOrganizationPolicyDto"];
@@ -2968,6 +2972,8 @@ interface components {
              * @enum {string|null}
              */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The sign-in methods this organization's members may use. A non-empty subset of the methods the Environment offers (`password` unless the Environment turned it off, `email_otp` where the Environment turned it on, and `sso`); a method the Environment does not offer is refused with `organization.policy_loosens`. `null` inherits the Environment's. While `require_sso` is on, SSO is the only method whatever this says. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             /** @description Members must sign in through SSO. Password and email-code logins are refused for the organization's members and for any email whose domain routes to a connection bound to this organization. */
             require_sso?: boolean;
         };
@@ -4874,6 +4880,8 @@ interface components {
                      * @enum {string|null}
                      */
                     mfa_after_sso: "exempt" | "require" | null;
+                    /** @description The sign-in methods members may use, or null to inherit the Environment's. */
+                    allowed_sign_in_methods: ("password" | "email_otp" | "sso")[] | null;
                     /** @description Whether members must sign in with SSO. */
                     require_sso: boolean;
                 };

package/dist/index.d.ts

@@ -2935,6 +2935,8 @@ interface components {
             mfa_factor_allowlist: ("totp" | "webauthn" | "email_otp")[];
             /** @enum {string} */
             mfa_after_sso: "exempt" | "require";
+            /** @description The sign-in methods on offer: on the Environment, the ones it has turned on; on the effective policy, those narrowed by the organization, and `["sso"]` alone while it requires SSO. */
+            allowed_sign_in_methods: ("password" | "email_otp" | "sso")[];
             require_sso: boolean;
         };
         OrganizationPolicyResponseDto: {
@@ -2944,6 +2946,8 @@ interface components {
             mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
             /** @enum {string|null} */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The methods the organization keeps of the Environment's, or null to inherit them all. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             require_sso: boolean;
             /** @description The Environment's own settings, the floor this organization's policy tightens from. */
             environment: components["schemas"]["EffectiveOrganizationPolicyDto"];
@@ -2968,6 +2972,8 @@ interface components {
              * @enum {string|null}
              */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The sign-in methods this organization's members may use. A non-empty subset of the methods the Environment offers (`password` unless the Environment turned it off, `email_otp` where the Environment turned it on, and `sso`); a method the Environment does not offer is refused with `organization.policy_loosens`. `null` inherits the Environment's. While `require_sso` is on, SSO is the only method whatever this says. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             /** @description Members must sign in through SSO. Password and email-code logins are refused for the organization's members and for any email whose domain routes to a connection bound to this organization. */
             require_sso?: boolean;
         };
@@ -4874,6 +4880,8 @@ interface components {
                      * @enum {string|null}
                      */
                     mfa_after_sso: "exempt" | "require" | null;
+                    /** @description The sign-in methods members may use, or null to inherit the Environment's. */
+                    allowed_sign_in_methods: ("password" | "email_otp" | "sso")[] | null;
                     /** @description Whether members must sign in with SSO. */
                     require_sso: boolean;
                 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canopy-io/node",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "description": "Official TypeScript SDK for Canopy — hierarchical identity and access management.",
   "license": "MIT",
   "author": "Canopy Identity Inc.",