@canopy-io/node 0.3.10 → 0.3.12

package/dist/index.d.ts

@@ -619,6 +619,46 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/identities/{id}/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an identity's active sessions (admin)
+         * @description Lists an identity's active sessions (server-to-server admin): the rows a customer reads to confirm from its own side that a sign-out took, or to show a person where they are signed in. Each row is a session's current refresh token, so `id` changes on every refresh. Returns `404` when the identity has no membership in this Environment.
+         */
+        get: operations["ApiIdentitiesController_listIdentitySessions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/identities/{id}/sessions/{sessionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke one of an identity's sessions (admin)
+         * @description Revokes one of an identity's sessions (server-to-server admin) by marking its refresh token revoked, so the next refresh from that device returns `401` while every other session carries on. Audited as `identity.session.revoked`, the same row the person's own per-session sign-out writes. Returns `204 No Content`; returns `404` when the identity has no membership in this Environment, or when the session is not the identity's or is already revoked.
+         */
+        delete: operations["ApiIdentitiesController_revokeIdentitySession"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/identities/{id}/sessions/revoke": {
         parameters: {
             query?: never;
@@ -2561,6 +2601,20 @@ interface components {
             /** @description New password. 8-64 characters. No composition rules — NIST SP 800-63B aligned. A HaveIBeenPwned breach check runs server-side. The effective policy is published on `GET /v1/identity/auth/config`, so a client can state the rules before submit rather than after. */
             password: string;
         };
+        IdentitySessionResponseDto: {
+            /** @description The session's current refresh token id: what `DELETE /identities/:id/sessions/:sessionId` takes. It changes on every refresh. */
+            id: string;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            expires_at: string;
+            /** @description The address the session was signed in from: the browser's for a hosted sign-in, or the one a trusted backend forwarded in `X-Canopy-Client-IP`. */
+            ip_address?: string | null;
+            /** @description The user agent the session was signed in from: the browser's for a hosted sign-in, or the one a trusted backend forwarded in `X-Canopy-Client-User-Agent`. */
+            user_agent?: string | null;
+            /** @description The organization the session is acting in, the source of its tokens' `org_id` claim. Null when the Environment's organizations container is off or the identity belongs to none. */
+            active_org_node_id?: string | null;
+        };
         MfaFactorResponseDto: {
             /** Format: uuid */
             id: string;
@@ -2935,6 +2989,8 @@ interface components {
             mfa_factor_allowlist: ("totp" | "webauthn" | "email_otp")[];
             /** @enum {string} */
             mfa_after_sso: "exempt" | "require";
+            /** @description The sign-in methods on offer: on the Environment, the ones it has turned on; on the effective policy, those narrowed by the organization, and `["sso"]` alone while it requires SSO. */
+            allowed_sign_in_methods: ("password" | "email_otp" | "sso")[];
             require_sso: boolean;
         };
         OrganizationPolicyResponseDto: {
@@ -2944,6 +3000,8 @@ interface components {
             mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
             /** @enum {string|null} */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The methods the organization keeps of the Environment's, or null to inherit them all. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             require_sso: boolean;
             /** @description The Environment's own settings, the floor this organization's policy tightens from. */
             environment: components["schemas"]["EffectiveOrganizationPolicyDto"];
@@ -2968,6 +3026,8 @@ interface components {
              * @enum {string|null}
              */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The sign-in methods this organization's members may use. A non-empty subset of the methods the Environment offers (`password` unless the Environment turned it off, `email_otp` where the Environment turned it on, and `sso`); a method the Environment does not offer is refused with `organization.policy_loosens`. `null` inherits the Environment's. While `require_sso` is on, SSO is the only method whatever this says. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             /** @description Members must sign in through SSO. Password and email-code logins are refused for the organization's members and for any email whose domain routes to a connection bound to this organization. */
             require_sso?: boolean;
         };
@@ -3008,6 +3068,17 @@ interface components {
              * @enum {string|null}
              */
             domain_outcome: "accepted" | "no_boundary" | "unbound" | "not_listed" | "not_verified" | "unknown" | null;
+            /** @description The required fields the provider's response did not satisfy (`email`, `federated_subject_id`); empty on a pass. */
+            missing_fields: string[];
+            /** @description The attribute names the response carried, sorted. Names only, never values. */
+            received_attributes: string[];
+            /** @description The SAML Name ID format's last segment (`unspecified`, `emailAddress`, `persistent`); null for OIDC or when none came. */
+            name_id_format: string | null;
+            /**
+             * @description The one thing to change, when the test can name it: the provider's Name ID format should be the email address (`set_name_id_email`), an email attribute or scope has to be added (`add_email_attribute`), or a stable subject has to be sent (`send_name_id`). Null when the report of names is the guidance.
+             * @enum {string|null}
+             */
+            hint: "set_name_id_email" | "add_email_attribute" | "send_name_id" | null;
             /** Format: date-time */
             completed_at: string | null;
         };
@@ -3727,6 +3798,11 @@ interface components {
             is_active: boolean;
             /** Format: date-time */
             created_at: string;
+            /**
+             * Format: date-time
+             * @description While a rotation window is open, when the secret the rotation replaced stops verifying; `null` once only the current secret signs.
+             */
+            previous_secret_expires_at?: string | null;
             /** @description HMAC secret — only shown once on creation */
             secret: string;
         };
@@ -3745,6 +3821,11 @@ interface components {
             is_active: boolean;
             /** Format: date-time */
             created_at: string;
+            /**
+             * Format: date-time
+             * @description While a rotation window is open, when the secret the rotation replaced stops verifying; `null` once only the current secret signs.
+             */
+            previous_secret_expires_at?: string | null;
         };
         WebhookEventTypeDto: {
             event_type: string;
@@ -4662,6 +4743,11 @@ interface components {
                     slug: string;
                     /** @description Your own identifier for the organization, when you set one. */
                     external_id: string | null;
+                    /**
+                     * @description How the organization came to be, when it was not created through the API: a self-signup on an Environment that creates one for every new identity.
+                     * @enum {string}
+                     */
+                    source?: "self_signup";
                 };
             };
         };
@@ -4874,6 +4960,8 @@ interface components {
                      * @enum {string|null}
                      */
                     mfa_after_sso: "exempt" | "require" | null;
+                    /** @description The sign-in methods members may use, or null to inherit the Environment's. */
+                    allowed_sign_in_methods: ("password" | "email_otp" | "sso")[] | null;
                     /** @description Whether members must sign in with SSO. */
                     require_sso: boolean;
                 };
@@ -6840,6 +6928,177 @@ interface operations {
             };
         };
     };
+    ApiIdentitiesController_listIdentitySessions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Every session the identity holds that is neither revoked nor expired, newest first: the session's current refresh token id (what the per-session revoke takes), when it was signed in and when it expires, the browser's address and user agent, and the organization it is acting in. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["IdentitySessionResponseDto"][];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Identity not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Identity not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities/{id}/sessions",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiIdentitiesController_revokeIdentitySession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                sessionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The session's refresh token is revoked, so its next refresh returns 401 while the identity's other sessions carry on. In-flight access tokens keep working until their short TTL expires. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The session does not belong to this identity, or is already revoked */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The session does not belong to this identity, or is already revoked",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities/{id}/sessions/{sessionId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
     ApiIdentitiesController_revokeIdentitySessions: {
         parameters: {
             query?: never;
@@ -17637,8 +17896,30 @@ declare class Identities {
      * someone can do.
      */
     permissions(id: string): Promise<ResponseBody<"ApiIdentitiesController_getIdentityPermissions">>;
+    /**
+     * Every session the identity holds that is neither revoked nor expired,
+     * newest first: when and where it was signed in, when it expires, and the
+     * organization it is acting in. Read it back after a revoke to confirm,
+     * from your own side, that a sign-out took.
+     */
+    sessions(id: string): Promise<ResponseBody<"ApiIdentitiesController_listIdentitySessions">>;
+    /**
+     * Ends one session and leaves the identity's others signed in. `sessionId`
+     * is the session's `id` from `sessions`: its current refresh token, which
+     * changes on every refresh, so read it shortly before revoking.
+     */
+    revokeSession(id: string, sessionId: string): Promise<void>;
+    /**
+     * Ends every session the identity holds, so the next refresh on any device
+     * fails and the person signs in again. Access tokens already issued keep
+     * working until their short lifetime runs out. For a suspected compromise;
+     * `deactivate` also refuses the next sign-in.
+     */
+    revokeSessions(id: string): Promise<void>;
 }
 type IdentityItem = ItemOf$3<ResponseBody<"ApiIdentitiesController_listIdentities">>;
+/** One live session from an identity's sessions. */
+type IdentitySessionItem = ItemOf$3<ResponseBody<"ApiIdentitiesController_listIdentitySessions">>;
 /** One role grant from an identity's assignments collection. */
 type IdentityAssignmentItem = ItemOf$3<ResponseBody<"ApiIdentitiesController_getIdentityAssignments">>;
 type ItemOf$3<T> = T extends {
@@ -18372,4 +18653,4 @@ type WebhookEventData<Name extends WebhookEventName> = WebhookEvent<Name>["data"
  */
 declare function isWebhookEvent<Name extends WebhookEventName>(delivery: WebhookDelivery, name: Name): delivery is WebhookEvent<Name>;
 
-export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, Identities, type IdentityAssignmentItem, type IdentityItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, type OffsetPagination, type OperationId, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type WebhookDelivery, type WebhookEvent, type WebhookEventData, type WebhookEventName, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, type operations, orgContext, paginate, type paths, withConcurrency };
+export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, Identities, type IdentityAssignmentItem, type IdentityItem, type IdentitySessionItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, type OffsetPagination, type OperationId, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type WebhookDelivery, type WebhookEvent, type WebhookEventData, type WebhookEventName, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, type operations, orgContext, paginate, type paths, withConcurrency };

package/dist/index.js

@@ -607,6 +607,41 @@ var Identities = class {
       `/api/v1/identities/${encodeURIComponent(id)}/permissions`
     );
   }
+  /**
+   * Every session the identity holds that is neither revoked nor expired,
+   * newest first: when and where it was signed in, when it expires, and the
+   * organization it is acting in. Read it back after a revoke to confirm,
+   * from your own side, that a sign-out took.
+   */
+  sessions(id) {
+    return this.client.request(
+      "GET",
+      `/api/v1/identities/${encodeURIComponent(id)}/sessions`
+    );
+  }
+  /**
+   * Ends one session and leaves the identity's others signed in. `sessionId`
+   * is the session's `id` from `sessions`: its current refresh token, which
+   * changes on every refresh, so read it shortly before revoking.
+   */
+  revokeSession(id, sessionId) {
+    return this.client.request(
+      "DELETE",
+      `/api/v1/identities/${encodeURIComponent(id)}/sessions/${encodeURIComponent(sessionId)}`
+    );
+  }
+  /**
+   * Ends every session the identity holds, so the next refresh on any device
+   * fails and the person signs in again. Access tokens already issued keep
+   * working until their short lifetime runs out. For a suspected compromise;
+   * `deactivate` also refuses the next sign-in.
+   */
+  revokeSessions(id) {
+    return this.client.request(
+      "POST",
+      `/api/v1/identities/${encodeURIComponent(id)}/sessions/revoke`
+    );
+  }
 };
 
 // src/schema.ts