@canopy-io/node 0.9.0 → 0.10.0

package/dist/index.d.cts

@@ -6470,7 +6470,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The email or external_id already belongs to an identity in this Account, or the Account has reached its plan's identity signup ceiling */
+            /** @description The email or external_id already belongs to an identity in this Account, the Account has reached its plan's identity signup ceiling, or the starting role is placed beneath an organization, where a new identity holds no membership yet */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -6481,7 +6481,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The email or external_id already belongs to an identity in this Account, or the Account has reached its plan's identity signup ceiling",
+                     *         "message": "The email or external_id already belongs to an identity in this Account, the Account has reached its plan's identity signup ceiling, or the starting role is placed beneath an organization, where a new identity holds no membership yet",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identities",
                      *         "method": "POST"
@@ -8487,6 +8487,8 @@ interface operations {
                 };
                 content: {
                     "application/json": {
+                        /** @description The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing. */
+                        model_version: number;
                         items: components["schemas"]["IdentityGrantResponseDto"][];
                         pagination: components["schemas"]["PageMetaDto"];
                     };
@@ -9491,6 +9493,8 @@ interface operations {
                 };
                 content: {
                     "application/json": {
+                        /** @description The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing. */
+                        model_version: number;
                         items: components["schemas"]["NodeParentEdgeResponseDto"][];
                         pagination: components["schemas"]["PageMetaDto"];
                     };
@@ -17646,7 +17650,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The identity already has this role at this node, or the node belongs to an organization the identity is not a member of */
+            /** @description The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -17657,7 +17661,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The identity already has this role at this node, or the node belongs to an organization the identity is not a member of",
+                     *         "message": "The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments",
                      *         "method": "POST"

package/dist/index.d.ts

@@ -6470,7 +6470,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The email or external_id already belongs to an identity in this Account, or the Account has reached its plan's identity signup ceiling */
+            /** @description The email or external_id already belongs to an identity in this Account, the Account has reached its plan's identity signup ceiling, or the starting role is placed beneath an organization, where a new identity holds no membership yet */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -6481,7 +6481,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The email or external_id already belongs to an identity in this Account, or the Account has reached its plan's identity signup ceiling",
+                     *         "message": "The email or external_id already belongs to an identity in this Account, the Account has reached its plan's identity signup ceiling, or the starting role is placed beneath an organization, where a new identity holds no membership yet",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identities",
                      *         "method": "POST"
@@ -8487,6 +8487,8 @@ interface operations {
                 };
                 content: {
                     "application/json": {
+                        /** @description The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing. */
+                        model_version: number;
                         items: components["schemas"]["IdentityGrantResponseDto"][];
                         pagination: components["schemas"]["PageMetaDto"];
                     };
@@ -9491,6 +9493,8 @@ interface operations {
                 };
                 content: {
                     "application/json": {
+                        /** @description The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing. */
+                        model_version: number;
                         items: components["schemas"]["NodeParentEdgeResponseDto"][];
                         pagination: components["schemas"]["PageMetaDto"];
                     };
@@ -17646,7 +17650,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The identity already has this role at this node, or the node belongs to an organization the identity is not a member of */
+            /** @description The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -17657,7 +17661,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The identity already has this role at this node, or the node belongs to an organization the identity is not a member of",
+                     *         "message": "The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments",
                      *         "method": "POST"

package/dist/index.js

@@ -1153,6 +1153,16 @@ var MAX_WALK_DEPTH = 256;
 var PAGE_SIZE = 100;
 var MAX_PAGES = 1e4;
 var MAX_TREE_WALKS = 3;
+var KNOWN_MODEL_VERSIONS = /* @__PURE__ */ new Set([1]);
+function understood(page, path) {
+  if (!KNOWN_MODEL_VERSIONS.has(page.model_version)) {
+    throw new CanopyAuthorizerError(
+      "authorizer.model_version_unknown",
+      `${path} describes authorization model version ${page.model_version}, which this version of @canopy-io/node does not understand. It knows ${[...KNOWN_MODEL_VERSIONS].join(", ")}. Upgrade @canopy-io/node; until then this authorizer cannot decide, rather than guess.`
+    );
+  }
+  return page;
+}
 var GRANTS_PATH = (identityId) => `/api/v1/identities/${encodeURIComponent(identityId)}/grants`;
 var PARENTS_PATH = "/api/v1/nodes/parents";
 var LocalAuthorizer = class {
@@ -1328,7 +1338,7 @@ var LocalAuthorizer = class {
         return this.client.request("GET", path, {
           ...this.readOptions,
           query
-        });
+        }).then((page) => understood(page, path));
       },
       { page: 1, take: PAGE_SIZE },
       { maxPages: MAX_PAGES }
@@ -1408,12 +1418,15 @@ var LocalAuthorizer = class {
   }
   parentsFirstPage(etag) {
     this.stats.treePages += 1;
-    return this.client.requestConditional(
-      "GET",
-      PARENTS_PATH,
-      etag,
-      { ...this.readOptions, query: { page: 1, take: PAGE_SIZE } }
-    );
+    return this.client.requestConditional("GET", PARENTS_PATH, etag, {
+      ...this.readOptions,
+      query: { page: 1, take: PAGE_SIZE }
+    }).then((result) => {
+      if (result.modified) {
+        understood(result.data, PARENTS_PATH);
+      }
+      return result;
+    });
   }
   /** The first page's edges followed by every later page's. */
   async parentsRemainingPages(first) {
@@ -1427,7 +1440,7 @@ var LocalAuthorizer = class {
         return this.client.request("GET", PARENTS_PATH, {
           ...this.readOptions,
           query
-        });
+        }).then((page) => understood(page, PARENTS_PATH));
       },
       { page: first.pagination.page + 1, take: PAGE_SIZE },
       { maxPages: MAX_PAGES - 1 }