@canopy-io/node 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @canopy-io/node
 
+## 0.3.9
+
+### Patch Changes
+
+- dc7525d: `organizations.setDirectoryGrantableRoles` with an empty list now returns the organization to the Environment's list when one is set, under a connected directory too. It is refused only when there is no Environment list to fall back on. Types regenerated from the live spec; no signatures change.
+
+## 0.3.8
+
+### Patch Changes
+
+- a96ec16: `organizations.resetMemberMfa(id, identityId)` clears a member's second factor (factors, recovery codes and remembered devices) so they enrol again at their next sign-in.
+
+  Types regenerated from the live spec: the organization's SSO connection can be created without `default_role_id` and reports it as nullable, `GET /api/v1/organizations/:id/sso-connection/arrival-roles` lists the roles its sign-ins may arrive with (`is_default`, `administers_organization`), and the directory detail carries `grantable_roles_source` (`organization`, `environment` or `none`). The arrival-roles route is reachable through `canopy.client.request`, like the rest of that connection's routes.
+
 ## 0.3.7
 
 ### Patch Changes

package/dist/index.cjs

@@ -698,6 +698,18 @@ var Organizations = class {
       `/api/v1/organizations/${enc(id)}/members/${enc(identityId)}`
     );
   }
+  /**
+   * Clears a member's second factor, for one who lost their authenticator:
+   * their factors, recovery codes and remembered devices go, and they enrol
+   * again at their next sign-in. Sessions already open are left alone. The
+   * identity must be a member of the organization.
+   */
+  resetMemberMfa(id, identityId) {
+    return this.client.request(
+      "POST",
+      `/api/v1/organizations/${enc(id)}/members/${enc(identityId)}/mfa/reset`
+    );
+  }
   // ── Invitations: pending membership, carrying the role the recipient will hold ──
   listInvites(id, query = {}) {
     return paginate(
@@ -786,9 +798,11 @@ var Organizations = class {
    * Replace the list in one act, which is how directory sync is opened for
    * an organization. Exactly one role is `default_role_id`, the one people
    * arrive with. Withdrawing a role unmaps the groups naming it and keeps
-   * their members in the organization; an empty list is refused while a
-   * directory is connected. Your API key only: an organization admin's
-   * token can read the list but is refused changing it.
+   * their members in the organization. An empty list removes the
+   * organization's own list: it then holds the Environment's list when one
+   * is set, and otherwise directory sync closes for it, which is refused
+   * while a directory is connected. Your API key only: an organization
+   * admin's token can read the list but is refused changing it.
    */
   setDirectoryGrantableRoles(id, input) {
     return this.client.request(