@canopy-io/node 0.3.11 → 0.3.12

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @canopy-io/node
 
+## 0.3.12
+
+### Patch Changes
+
+- 7acdc44: Read and revoke an identity's sessions from your backend. `identities.sessions(id)` lists every live session the identity holds, newest first, with when and where it was signed in, when it expires and the organization it acts in, so you can confirm a sign-out from your own side. `identities.revokeSession(id, sessionId)` ends one of them and leaves the rest signed in, and `identities.revokeSessions(id)` ends them all. `IdentitySessionItem` types one session.
+
+  The generated types also pick up what the API added alongside: an SSO test sign-in result names the `missing_fields`, the `received_attributes`, the SAML `name_id_format` and a `hint` at the fix; a webhook subscription reports `previous_secret_expires_at` while a rotated-out secret still verifies; and the `organization.created` event carries `source: "self_signup"` when the Environment created the organization for a person who registered. No existing caller shape changed. The API's public operation count moves from 136 to 138.
+
 ## 0.3.11
 
 ### Patch Changes

package/dist/index.cjs

@@ -609,6 +609,41 @@ var Identities = class {
       `/api/v1/identities/${encodeURIComponent(id)}/permissions`
     );
   }
+  /**
+   * Every session the identity holds that is neither revoked nor expired,
+   * newest first: when and where it was signed in, when it expires, and the
+   * organization it is acting in. Read it back after a revoke to confirm,
+   * from your own side, that a sign-out took.
+   */
+  sessions(id) {
+    return this.client.request(
+      "GET",
+      `/api/v1/identities/${encodeURIComponent(id)}/sessions`
+    );
+  }
+  /**
+   * Ends one session and leaves the identity's others signed in. `sessionId`
+   * is the session's `id` from `sessions`: its current refresh token, which
+   * changes on every refresh, so read it shortly before revoking.
+   */
+  revokeSession(id, sessionId) {
+    return this.client.request(
+      "DELETE",
+      `/api/v1/identities/${encodeURIComponent(id)}/sessions/${encodeURIComponent(sessionId)}`
+    );
+  }
+  /**
+   * Ends every session the identity holds, so the next refresh on any device
+   * fails and the person signs in again. Access tokens already issued keep
+   * working until their short lifetime runs out. For a suspected compromise;
+   * `deactivate` also refuses the next sign-in.
+   */
+  revokeSessions(id) {
+    return this.client.request(
+      "POST",
+      `/api/v1/identities/${encodeURIComponent(id)}/sessions/revoke`
+    );
+  }
 };
 
 // src/schema.ts