@canopy-io/node 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @canopy-io/node
 
+## 0.6.0
+
+### Minor Changes
+
+- 30b76ce: **Breaking:** `identities.deactivate()` and `identities.activate()` are removed, because the API no longer offers them to Environment-scoped keys. An identity's active flag is Account-wide, so a key for one Environment could lock a person out of every other one. To cut an identity off from this key's Environment, use `identities.delete()`, which removes it from this Environment only. Deactivating an identity everywhere is done in the Admin Workspace or through directory sync.
+
+  `identities.update()` no longer accepts `is_active`, for the same reason.
+
+  `identities.create()` now documents that `role_id` and `node_id` go together; the API answers 400 when only one is sent, where it used to create the identity with no assignment.
+
+  Identity invite responses no longer declare `environment_id` and `environment_name`, which the API never returned on an Environment-scoped key. Listing invites accepts `sort_by` (`name`, `email` or `created`) with `order`, which the API now honours.
+
+  An organization's SSO binding (`organizations.ssoConnections`) now carries `owner_organization_node_id` on its `sso_connection`, naming the organization when its administrator set the connection up from the organization portal. Unbinding such a connection from its organization answers 409 `organization.sso_connection_owned_cannot_unbind`; disable or delete it instead. The connection status enum no longer lists `failed`, which nothing ever set.
+
+- 30b76ce: SSO connection responses no longer carry `last_login_failure_at`, `consecutive_failures` or `auto_disabled_at`. Nothing ever set them, so they only ever returned their defaults; a connection is disabled only by a person. `last_login_at` stays and now records each successful sign-in through the connection.
+
+### Patch Changes
+
+- 30b76ce: Types regenerated from the spec, with no shape change: the descriptions now say that a deactivated role grants nothing to its holders (`is_active`, the explain trace's `active`), and that an empty `allowed_children` list makes a node type a leaf.
+
+  `Authorizer.invalidate()` documents deactivating or reactivating a role as a change to clear the whole cache for, since it changes access for everyone holding the role at once.
+
+  The identity invite create and resend descriptions say a `password_reset` invite expires after 24 hours; every other invite still expires after 7 days.
+
 ## 0.5.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -552,29 +552,19 @@ var Identities = class {
       { body: input }
     );
   }
+  /**
+   * Takes the identity out of this key's Environment: its membership here is
+   * deactivated and its role assignments here are dropped. The identity and
+   * its access to other Environments are untouched. Deactivating an identity
+   * everywhere is an Account-level action, not available to an
+   * Environment-scoped key.
+   */
   delete(id) {
     return this.client.request(
       "DELETE",
       `/api/v1/identities/${encodeURIComponent(id)}`
     );
   }
-  /**
-   * Deactivation is the reversible counterpart to `delete` — sessions are
-   * revoked and sign-in refused, but the identity and its assignments survive.
-   * Prefer it for offboarding you may need to undo.
-   */
-  deactivate(id) {
-    return this.client.request(
-      "POST",
-      `/api/v1/identities/${encodeURIComponent(id)}/deactivate`
-    );
-  }
-  activate(id) {
-    return this.client.request(
-      "POST",
-      `/api/v1/identities/${encodeURIComponent(id)}/activate`
-    );
-  }
   /**
    * Every role this identity holds, and where — across all pages.
    *
@@ -636,7 +626,7 @@ var Identities = class {
    * Ends every session the identity holds, so the next refresh on any device
    * fails and the person signs in again. Access tokens already issued keep
    * working until their short lifetime runs out. For a suspected compromise;
-   * `deactivate` also refuses the next sign-in.
+   * `delete` also takes the identity out of this Environment.
    */
   revokeSessions(id) {
     return this.client.request(
@@ -1212,7 +1202,9 @@ var LocalAuthorizer = class {
    * With no argument, everything goes: grants and the hierarchy tree. Not
    * needed in normal operation, where entries expire on their own; useful in
    * tests and after a change whose reach you cannot name (a role's
-   * permissions edited, a node moved).
+   * permissions edited, a role deactivated or reactivated, a node moved). A
+   * deactivated role grants nothing to anyone holding it, so until the cache
+   * is cleared or expires, its holders keep being allowed locally.
    *
    * Multi-instance honesty: an invalidation reaches THIS process only. A
    * webhook lands on one instance behind a load balancer; the others serve