@coreiam/auth 1.0.391 → 1.0.392-beta.0

package/dist/core/index.d.ts

@@ -19,6 +19,14 @@ export interface CoreIAMIdentity {
     roles?: string[];
     [key: string]: any;
 }
+export interface DirectoryIdentity {
+    sub: string;
+    email?: string;
+    first_name?: string;
+    last_name?: string;
+    is_active?: boolean;
+    roles: string[];
+}
 /** Accepts a Headers instance, an Express req.headers object, or a raw Cookie string. */
 export type SessionInput = Headers | Record<string, string | string[] | undefined> | string;
 export type SessionFailureReason = 'no_cookie' | 'expired' | 'invalid_claims' | 'invalid_signature' | 'jwks_unavailable';
@@ -60,6 +68,15 @@ export declare class CoreIAM {
     private getJwks;
     /** Optional warm-up: call at boot so the first verification pays no JWKS latency. */
     preloadJwks(): Promise<void>;
+    /**
+      * Tenant directory: all identities (with roles) for the tenant scoped to
+      * this instance's API key. Server-to-server, read-only.
+      * THROWS on failure — an audit must never silently see an empty roster.
+      */
+    listIdentities(): Promise<{
+        users: DirectoryIdentity[];
+        total: number;
+    }>;
     private readCookieHeader;
     private readSessionCookie;
     verifySession(input: SessionInput): Promise<SessionResult>;

package/dist/core/index.js

@@ -67,6 +67,20 @@ class CoreIAM {
             /* expected: no matching key — the fetch is the point */
         }
     }
+    /**
+      * Tenant directory: all identities (with roles) for the tenant scoped to
+      * this instance's API key. Server-to-server, read-only.
+      * THROWS on failure — an audit must never silently see an empty roster.
+      */
+    async listIdentities() {
+        const response = await this.proxy('/api/v1/directory', { method: 'GET' }, new Headers());
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            throw new Error(`listIdentities failed: ${response.status} ${body}`);
+        }
+        const data = await response.json();
+        return { users: data.users ?? [], total: data.total ?? 0 };
+    }
     readCookieHeader(input) {
         if (typeof input === 'string')
             return input;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.391",
+  "version": "1.0.392-beta.0",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {