@credal/actions 0.2.223 → 0.2.225

package/dist/actions/providers/microsoft/sharepointUtils.d.ts

@@ -0,0 +1,56 @@
+export declare const MISSING_SITES_SCOPE_MESSAGE = "Missing Sites.Read.All: this token only permits file/folder access. Site, page, and site-wide search operations require re-authentication with sites scopes.";
+/**
+ * Encodes a URL into a Microsoft Graph share token usable with the /shares endpoint:
+ * "u!" + unpadded base64url of the URL.
+ */
+export declare function encodeShareUrl(url: string): string;
+export type SharepointDriveItem = {
+    id?: string;
+    name?: string;
+    webUrl?: string;
+    size?: number;
+    lastModifiedDateTime?: string;
+    file?: {
+        mimeType?: string;
+    };
+    folder?: {
+        childCount?: number;
+    };
+    parentReference?: {
+        driveId?: string;
+        siteId?: string;
+    };
+};
+export type ResolvedSharepointItem = {
+    itemType: "file" | "folder";
+    driveId: string;
+    itemId: string;
+    siteId?: string;
+    name?: string;
+    webUrl?: string;
+    mimeType?: string;
+    sizeBytes?: number;
+} | {
+    itemType: "site";
+    siteId: string;
+    name?: string;
+    webUrl?: string;
+} | {
+    itemType: "page";
+    siteId: string;
+    pageId?: string;
+    name?: string;
+    webUrl?: string;
+};
+export declare function isSiteScopeError(error: unknown): boolean;
+/**
+ * Resolves any pasted SharePoint/OneDrive URL (file, folder, Office web-viewer link, bare site,
+ * subsite, root site, site page, OneDrive share link) to Graph identifiers.
+ *
+ * Resolution order: SitePages URLs go to the Pages API; everything else probes /shares first
+ * (files/folders, cheap, Files.Read.All only), then falls back to site resolution on any 4xx —
+ * URL shape cannot distinguish a subsite from a folder path, so probing is the only correct
+ * strategy. Throws Error(MISSING_SITES_SCOPE_MESSAGE) when a site-level call fails with 401/403;
+ * when both probes fail, throws a combined error naming both statuses.
+ */
+export declare function resolveItemFromUrl(authToken: string, url: string): Promise<ResolvedSharepointItem>;

package/dist/actions/providers/microsoft/sharepointUtils.js

@@ -0,0 +1,153 @@
+import { ApiError, axiosClient } from "../../util/axiosClient.js";
+import { MICROSOFT_GRAPH_API_URL } from "./utils.js";
+export const MISSING_SITES_SCOPE_MESSAGE = "Missing Sites.Read.All: this token only permits file/folder access. Site, page, and site-wide search operations require re-authentication with sites scopes.";
+/**
+ * Encodes a URL into a Microsoft Graph share token usable with the /shares endpoint:
+ * "u!" + unpadded base64url of the URL.
+ */
+export function encodeShareUrl(url) {
+    const base64 = Buffer.from(url, "utf-8").toString("base64");
+    return "u!" + base64.replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+export function isSiteScopeError(error) {
+    return error instanceof ApiError && (error.status === 401 || error.status === 403);
+}
+/** GET /sites/{hostname}:{serverRelativePath} — requires Sites.Read.All. */
+async function getSiteByPath(hostname, serverRelativePath, headers) {
+    const path = serverRelativePath.replace(/\/+$/, "");
+    // An empty path means the tenant's root site, which Graph addresses without the :path suffix
+    const requestUrl = path
+        ? `${MICROSOFT_GRAPH_API_URL}/sites/${hostname}:${path}`
+        : `${MICROSOFT_GRAPH_API_URL}/sites/${hostname}`;
+    try {
+        const response = await axiosClient.get(requestUrl, { headers });
+        return response.data;
+    }
+    catch (error) {
+        // Capability is detected by attempting the call: a 401/403 here means the token lacks site scopes
+        if (isSiteScopeError(error)) {
+            throw new Error(MISSING_SITES_SCOPE_MESSAGE, { cause: error });
+        }
+        throw error;
+    }
+}
+/** Finds a site page's ID by its file name (e.g. "Home.aspx") — requires Sites.Read.All. */
+async function findSitePageByName(siteId, pageName, headers) {
+    const pagesUrl = `${MICROSOFT_GRAPH_API_URL}/sites/${siteId}/pages/microsoft.graph.sitePage`;
+    try {
+        // Try a server-side filter first to avoid enumerating every page in the site.
+        // Caveat: the docs list $filter as supported, but Graph is known to silently
+        // ignore name filters on this endpoint, so treat the response defensively.
+        const escapedName = pageName.replace(/'/g, "''");
+        const filtered = await axiosClient.get(`${pagesUrl}?$filter=${encodeURIComponent(`name eq '${escapedName}'`)}`, { headers });
+        const match = (filtered.data.value ?? []).find(page => page.name?.toLowerCase() === pageName.toLowerCase());
+        if (match != null)
+            return match;
+        // No match and no further pages: whether the filter was honored (empty result) or
+        // ignored (we saw the complete unfiltered set), the page isn't there.
+        if (filtered.data["@odata.nextLink"] == null)
+            return undefined;
+        // No match but more pages exist — the filter was likely ignored (a known Graph gap
+        // for sitePage name filtering); fall through to full enumeration.
+    }
+    catch (error) {
+        if (isSiteScopeError(error)) {
+            throw new Error(MISSING_SITES_SCOPE_MESSAGE, { cause: error });
+        }
+        // Some tenants reject $filter on this endpoint outright — fall back to enumeration
+        if (!(error instanceof ApiError && error.status === 400)) {
+            throw error;
+        }
+    }
+    let nextUrl = `${pagesUrl}?$top=100`;
+    try {
+        while (nextUrl) {
+            const response = await axiosClient.get(nextUrl, { headers });
+            const pages = response.data.value ?? [];
+            const match = pages.find(page => page.name?.toLowerCase() === pageName.toLowerCase());
+            if (match != null)
+                return match;
+            nextUrl = response.data["@odata.nextLink"];
+        }
+    }
+    catch (error) {
+        if (isSiteScopeError(error)) {
+            throw new Error(MISSING_SITES_SCOPE_MESSAGE, { cause: error });
+        }
+        throw error;
+    }
+    return undefined;
+}
+/**
+ * Resolves any pasted SharePoint/OneDrive URL (file, folder, Office web-viewer link, bare site,
+ * subsite, root site, site page, OneDrive share link) to Graph identifiers.
+ *
+ * Resolution order: SitePages URLs go to the Pages API; everything else probes /shares first
+ * (files/folders, cheap, Files.Read.All only), then falls back to site resolution on any 4xx —
+ * URL shape cannot distinguish a subsite from a folder path, so probing is the only correct
+ * strategy. Throws Error(MISSING_SITES_SCOPE_MESSAGE) when a site-level call fails with 401/403;
+ * when both probes fail, throws a combined error naming both statuses.
+ */
+export async function resolveItemFromUrl(authToken, url) {
+    const headers = { Authorization: `Bearer ${authToken}` };
+    const parsed = new URL(url);
+    // Site pages: https://{tenant}.sharepoint.com/sites/{site}/SitePages/{page}.aspx
+    const sitePageMatch = parsed.pathname.match(/^(.*)\/SitePages\/([^/]+\.aspx)$/i);
+    if (sitePageMatch) {
+        const [, sitePath, pageFileName] = sitePageMatch;
+        const pageName = decodeURIComponent(pageFileName);
+        const site = await getSiteByPath(parsed.hostname, sitePath, headers);
+        const page = await findSitePageByName(site.id, pageName, headers);
+        return {
+            itemType: "page",
+            siteId: site.id,
+            pageId: page?.id,
+            name: page?.title ?? page?.name ?? pageName,
+            webUrl: page?.webUrl ?? url,
+        };
+    }
+    // The /shares resolver handles files, folders, Doc.aspx web-viewer links, OneDrive personal
+    // and 1drv.ms share links with Files.Read.All alone
+    let shareError;
+    try {
+        const response = await axiosClient.get(`${MICROSOFT_GRAPH_API_URL}/shares/${encodeShareUrl(url)}/driveItem`, {
+            headers,
+        });
+        const item = response.data;
+        if (item?.id && item?.parentReference?.driveId) {
+            return {
+                itemType: item.folder ? "folder" : "file",
+                driveId: item.parentReference.driveId,
+                itemId: item.id,
+                siteId: item.parentReference.siteId,
+                name: item.name,
+                webUrl: item.webUrl,
+                mimeType: item.file?.mimeType,
+                sizeBytes: item.size,
+            };
+        }
+        throw new Error(`Unable to resolve URL to a drive item: ${url}`);
+    }
+    catch (error) {
+        // A site is not a drive item, so /shares rejects site URLs with a 4xx. URL shape cannot
+        // distinguish a subsite from a folder path, so we always probe /shares first and, on any
+        // client error, fall back to resolving the path as a site. 5xx/network errors are real
+        // failures and are rethrown immediately.
+        if (!(error instanceof ApiError && error.status !== undefined && error.status < 500)) {
+            throw error;
+        }
+        shareError = error;
+    }
+    try {
+        const site = await getSiteByPath(parsed.hostname, parsed.pathname, headers);
+        return { itemType: "site", siteId: site.id, name: site.displayName, webUrl: site.webUrl };
+    }
+    catch (siteError) {
+        // A missing sites scope is the more actionable diagnosis — surface it as-is
+        if (siteError instanceof Error && siteError.message === MISSING_SITES_SCOPE_MESSAGE) {
+            throw siteError;
+        }
+        const siteStatus = siteError instanceof ApiError && siteError.status !== undefined ? siteError.status : "error";
+        throw new Error(`Unable to resolve URL: not a document or folder (/shares: ${shareError?.status ?? "error"}) and not a site (/sites: ${siteStatus}): ${url}`, { cause: siteError });
+    }
+}

package/dist/actions/providers/microsoft/updateDocument.js

@@ -1,6 +1,6 @@
-import { getGraphClient } from "./utils.js";
+import { getDrivePath, getGraphClient } from "./utils.js";
 const updateDocument = async ({ params, authParams, }) => {
-    const { documentId, content, siteId } = params;
+    const { documentId, content, siteId, driveId } = params;
     let client = undefined;
     try {
         client = await getGraphClient(authParams);
@@ -12,10 +12,7 @@ const updateDocument = async ({ params, authParams, }) => {
         };
     }
     try {
-        // Determine the endpoint based on whether siteId is provided
-        const endpoint = siteId
-            ? `/sites/${siteId}/drive/items/${documentId}/content`
-            : `/me/drive/items/${documentId}/content`;
+        const endpoint = `${getDrivePath({ driveId, siteId })}/items/${documentId}/content`;
         const response = await client.api(endpoint).put(content);
         return {
             success: true,

package/dist/actions/providers/microsoft/updateSpreadsheet.js

@@ -1,6 +1,6 @@
-import { getGraphClient } from "./utils.js";
+import { getDrivePath, getGraphClient } from "./utils.js";
 const updateSpreadsheet = async ({ params, authParams, }) => {
-    const { spreadsheetId, range, values, siteId } = params; // Added siteId to destructured params
+    const { spreadsheetId, range, values, siteId, driveId } = params;
     let client = undefined;
     try {
         client = await getGraphClient(authParams);
@@ -11,7 +11,6 @@ const updateSpreadsheet = async ({ params, authParams, }) => {
             error: "Error while authorizing: " + (error instanceof Error ? error.message : "Unknown error"),
         };
     }
-    const apiEndpointPrefix = siteId ? `/sites/${siteId}` : "/me";
     if (!range.includes("!")) {
         return {
             success: false,
@@ -25,7 +24,7 @@ const updateSpreadsheet = async ({ params, authParams, }) => {
             error: "Invalid range format. Both sheet name and cell range must be specified.",
         };
     }
-    const apiEndpoint = `${apiEndpointPrefix}/drive/items/${spreadsheetId}/workbook/worksheets/${sheetName}/range(address='${cellRange}')`;
+    const apiEndpoint = `${getDrivePath({ driveId, siteId })}/items/${spreadsheetId}/workbook/worksheets/${sheetName}/range(address='${cellRange}')`;
     try {
         const response = await client.api(apiEndpoint).patch({ values });
         return {

package/dist/actions/providers/microsoft/utils.d.ts

@@ -1,9 +1,19 @@
 import { Client } from "@microsoft/microsoft-graph-client";
 import type { AuthParamsType } from "../../autogen/types.js";
 export declare function getGraphClient(authParams: AuthParamsType): Promise<Client>;
+/**
+ * Builds the Graph API path prefix addressing a drive. Item IDs are scoped to a drive, so a
+ * driveId (when known) addresses the exact document library; /sites/{siteId}/drive only ever
+ * reaches the site's default library, and /me/drive the user's personal OneDrive.
+ */
+export declare function getDrivePath({ driveId, siteId }: {
+    driveId?: string;
+    siteId?: string;
+}): string;
 /**
  * Validates and sanitizes a filename for SharePoint or OneDrive.
  * @param fileName The original filename to validate and sanitize.
  * @returns A sanitized filename that is safe to use.
  */
 export declare function validateAndSanitizeFileName(fileName: string): string;
+export declare const MICROSOFT_GRAPH_API_URL = "https://graph.microsoft.com/v1.0";

package/dist/actions/providers/microsoft/utils.js

@@ -10,6 +10,14 @@ export async function getGraphClient(authParams) {
         },
     });
 }
+/**
+ * Builds the Graph API path prefix addressing a drive. Item IDs are scoped to a drive, so a
+ * driveId (when known) addresses the exact document library; /sites/{siteId}/drive only ever
+ * reaches the site's default library, and /me/drive the user's personal OneDrive.
+ */
+export function getDrivePath({ driveId, siteId }) {
+    return driveId ? `/drives/${driveId}` : siteId ? `/sites/${siteId}/drive` : "/me/drive";
+}
 /**
  * Validates and sanitizes a filename for SharePoint or OneDrive.
  * @param fileName The original filename to validate and sanitize.
@@ -33,3 +41,4 @@ export function validateAndSanitizeFileName(fileName) {
     }
     return sanitizedFileName;
 }
+export const MICROSOFT_GRAPH_API_URL = "https://graph.microsoft.com/v1.0";

package/dist/actions/providers/okta/addUserToGroup.d.ts

@@ -0,0 +1,3 @@
+import type { oktaAddUserToGroupFunction } from "../../autogen/types.js";
+declare const addUserToGroup: oktaAddUserToGroupFunction;
+export default addUserToGroup;

package/dist/actions/providers/okta/addUserToGroup.js

@@ -0,0 +1,56 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AxiosError } from "axios";
+import { axiosClient } from "../../util/axiosClient.js";
+const addUserToGroup = (_a) => __awaiter(void 0, [_a], void 0, function* ({ authParams, params, }) {
+    var _b, _c;
+    const { authToken, baseUrl } = authParams;
+    if (!authToken || !baseUrl) {
+        return {
+            success: false,
+            error: "Missing Okta OAuth token (authToken) or base URL (baseUrl) in authParams.",
+        };
+    }
+    try {
+        const requestConfig = {
+            headers: {
+                Authorization: `Bearer ${authToken}`,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+        };
+        const endpointUrl = new URL(`/api/v1/groups/${params.groupId}/users/${params.userId}`, baseUrl).toString();
+        const response = yield axiosClient.put(endpointUrl, {}, requestConfig);
+        if (response.status === 204) {
+            return { success: true };
+        }
+        else {
+            const errorDetail = ((_b = response.data) === null || _b === void 0 ? void 0 : _b.errorSummary) || ((_c = response.data) === null || _c === void 0 ? void 0 : _c.message) || `Okta API responded with status ${response.status}`;
+            return { success: false, error: `Failed to add user to group: ${errorDetail}` };
+        }
+    }
+    catch (error) {
+        console.error("Error adding user to group:", error);
+        let errorMessage = "Unknown error while adding user to group";
+        if (error instanceof AxiosError && error.response) {
+            const oktaError = error.response.data;
+            errorMessage =
+                (oktaError === null || oktaError === void 0 ? void 0 : oktaError.errorSummary) || (oktaError === null || oktaError === void 0 ? void 0 : oktaError.message) || `Okta API request failed with status ${error.response.status}`;
+        }
+        else if (error instanceof Error) {
+            errorMessage = error.message;
+        }
+        return {
+            success: false,
+            error: errorMessage,
+        };
+    }
+});
+export default addUserToGroup;

package/dist/actions/providers/okta/getOktaGroup.d.ts

@@ -0,0 +1,3 @@
+import type { oktaGetOktaGroupFunction } from "../../autogen/types.js";
+declare const getOktaGroup: oktaGetOktaGroupFunction;
+export default getOktaGroup;

package/dist/actions/providers/okta/getOktaGroup.js

@@ -0,0 +1,73 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AxiosError } from "axios";
+import { axiosClient } from "../../util/axiosClient.js";
+const getOktaGroup = (_a) => __awaiter(void 0, [_a], void 0, function* ({ authParams, params, }) {
+    var _b, _c, _d, _e, _f;
+    const { authToken, baseUrl } = authParams;
+    if (!authToken || !baseUrl) {
+        return {
+            success: false,
+            error: "Missing Okta OAuth token (authToken) or base URL (baseUrl) in authParams.",
+        };
+    }
+    try {
+        const requestConfig = {
+            headers: {
+                Authorization: `Bearer ${authToken}`,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+        };
+        const endpointUrl = new URL(`/api/v1/groups/${params.groupId}`, baseUrl).toString();
+        const response = yield axiosClient.get(endpointUrl, requestConfig);
+        if (response.status === 200 && response.data) {
+            const group = {
+                id: response.data.id,
+                created: response.data.created,
+                lastUpdated: response.data.lastUpdated,
+                lastMembershipUpdated: response.data.lastMembershipUpdated,
+                objectClass: response.data.objectClass,
+                type: response.data.type,
+                profile: {
+                    name: response.data.profile.name,
+                    description: response.data.profile.description,
+                },
+                _links: {
+                    logo: ((_b = response.data._links) === null || _b === void 0 ? void 0 : _b.logo) || [],
+                    users: ((_c = response.data._links) === null || _c === void 0 ? void 0 : _c.users) || {},
+                    apps: ((_d = response.data._links) === null || _d === void 0 ? void 0 : _d.apps) || {},
+                },
+            };
+            return { success: true, group };
+        }
+        else {
+            const errorDetail = ((_e = response.data) === null || _e === void 0 ? void 0 : _e.errorSummary) || ((_f = response.data) === null || _f === void 0 ? void 0 : _f.message) || `Okta API responded with status ${response.status}`;
+            return { success: false, error: `Failed to retrieve group details: ${errorDetail}` };
+        }
+    }
+    catch (error) {
+        console.error("Error retrieving group details:", error);
+        let errorMessage = "Unknown error while retrieving group details";
+        if (error instanceof AxiosError && error.response) {
+            const oktaError = error.response.data;
+            errorMessage =
+                (oktaError === null || oktaError === void 0 ? void 0 : oktaError.errorSummary) || (oktaError === null || oktaError === void 0 ? void 0 : oktaError.message) || `Okta API request failed with status ${error.response.status}`;
+        }
+        else if (error instanceof Error) {
+            errorMessage = error.message;
+        }
+        return {
+            success: false,
+            error: errorMessage,
+        };
+    }
+});
+export default getOktaGroup;

package/dist/actions/providers/okta/getOktaUser.d.ts

@@ -0,0 +1,3 @@
+import type { oktaGetOktaUserFunction } from "../../autogen/types.js";
+declare const getOktaUser: oktaGetOktaUserFunction;
+export default getOktaUser;

package/dist/actions/providers/okta/getOktaUser.js

@@ -0,0 +1,40 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { axiosClient } from "../../util/axiosClient.js";
+const getOktaUser = (_a) => __awaiter(void 0, [_a], void 0, function* ({ authParams, params, }) {
+    const { authToken, baseUrl } = authParams;
+    if (!authToken || !baseUrl) {
+        return {
+            success: false,
+            error: "Missing Okta OAuth token (authToken) or base URL (baseUrl) in authParams.",
+        };
+    }
+    try {
+        const requestConfig = {
+            headers: {
+                Authorization: `Bearer ${authToken}`,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+        };
+        const endpointUrl = new URL(`/api/v1/users/${params.userId}`, baseUrl).toString();
+        const response = yield axiosClient.get(endpointUrl, requestConfig);
+        if (response.status === 200 && response.data) {
+            return { success: true, user: response.data };
+        }
+        else {
+            return { success: false, error: "Failed to retrieve user details" };
+        }
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : "Unknown error occurred" };
+    }
+});
+export default getOktaUser;

package/dist/actions/providers/okta/listMFA.d.ts

@@ -0,0 +1,3 @@
+import type { oktaListMFAFunction } from "../../autogen/types.js";
+declare const listMFA: oktaListMFAFunction;
+export default listMFA;

package/dist/actions/providers/okta/listMFA.js

@@ -0,0 +1,52 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AxiosError } from "axios";
+import { axiosClient } from "../../util/axiosClient.js";
+const listMFA = (_a) => __awaiter(void 0, [_a], void 0, function* ({ authParams, params, }) {
+    var _b, _c;
+    const { authToken, baseUrl } = authParams;
+    if (!authToken || !baseUrl) {
+        return {
+            success: false,
+            error: "Missing Okta OAuth token (authToken) or base URL (baseUrl) in authParams.",
+        };
+    }
+    try {
+        const endpointUrl = new URL(`/api/v1/users/${params.userId}/factors`, baseUrl).toString();
+        const requestConfig = {
+            headers: {
+                Authorization: `Bearer ${authToken}`,
+                Accept: "application/json",
+            },
+        };
+        const response = yield axiosClient.get(endpointUrl, requestConfig);
+        if (response.status === 200) {
+            return { success: true, factors: response.data };
+        }
+        else {
+            const errorDetail = ((_b = response.data) === null || _b === void 0 ? void 0 : _b.errorSummary) || ((_c = response.data) === null || _c === void 0 ? void 0 : _c.message) || `Okta API responded with status ${response.status}`;
+            return { success: false, error: `Failed to list MFA factors: ${errorDetail}` };
+        }
+    }
+    catch (error) {
+        console.error("Error listing MFA factors:", error);
+        let errorMessage = "Unknown error while listing MFA factors";
+        if (error instanceof AxiosError && error.response) {
+            const oktaError = error.response.data;
+            errorMessage =
+                (oktaError === null || oktaError === void 0 ? void 0 : oktaError.errorSummary) || (oktaError === null || oktaError === void 0 ? void 0 : oktaError.message) || `Okta API request failed with status ${error.response.status}`;
+        }
+        else if (error instanceof Error) {
+            errorMessage = error.message;
+        }
+        return { success: false, error: errorMessage };
+    }
+});
+export default listMFA;

package/dist/actions/providers/okta/listOktaGroupMembers.d.ts

@@ -0,0 +1,3 @@
+import type { oktaListOktaGroupMembersFunction } from "../../autogen/types.js";
+declare const listOktaGroupMembers: oktaListOktaGroupMembersFunction;
+export default listOktaGroupMembers;

package/dist/actions/providers/okta/listOktaGroupMembers.js

@@ -0,0 +1,99 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AxiosError } from "axios";
+import { axiosClient } from "../../util/axiosClient.js";
+// page limit recommended by Okta documentation
+// https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers
+const DEFAULT_LIMIT = 200;
+const listOktaGroupMembers = (_a) => __awaiter(void 0, [_a], void 0, function* ({ authParams, params, }) {
+    var _b, _c, _d, _e;
+    const { authToken, baseUrl } = authParams;
+    if (!authToken || !baseUrl) {
+        return {
+            success: false,
+            error: "Missing Okta OAuth token (authToken) or base URL (baseUrl) in authParams.",
+        };
+    }
+    try {
+        const requestConfig = {
+            headers: {
+                Authorization: `Bearer ${authToken}`,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+        };
+        const endpointUrl = new URL(`/api/v1/groups/${params.groupId}/users`, baseUrl);
+        endpointUrl.searchParams.set("limit", Math.min(DEFAULT_LIMIT, params.maxResults || DEFAULT_LIMIT).toString());
+        let nextUrl = endpointUrl.toString();
+        let members = [];
+        let totalFetched = 0;
+        while (nextUrl) {
+            const remainingResults = params.maxResults ? params.maxResults - totalFetched : DEFAULT_LIMIT;
+            const adjustedUrl = new URL(nextUrl);
+            if (params.maxResults && remainingResults < DEFAULT_LIMIT) {
+                adjustedUrl.searchParams.set("limit", Math.min(DEFAULT_LIMIT, remainingResults).toString());
+            }
+            console.debug("Fetching group members from URL:", adjustedUrl.toString());
+            const response = yield axiosClient.get(adjustedUrl.toString(), requestConfig);
+            if (response.status === 200 && Array.isArray(response.data)) {
+                members = members.concat(response.data.map(user => ({
+                    id: user.id,
+                    status: user.status,
+                    created: user.created,
+                    activated: user.activated,
+                    statusChanged: user.statusChanged,
+                    lastLogin: user.lastLogin,
+                    lastUpdated: user.lastUpdated,
+                    passwordChanged: user.passwordChanged,
+                    type: user.type,
+                    profile: {
+                        firstName: user.profile.firstName,
+                        lastName: user.profile.lastName,
+                        mobilePhone: user.profile.mobilePhone,
+                        secondEmail: user.profile.secondEmail,
+                        login: user.profile.login,
+                        email: user.profile.email,
+                    },
+                })));
+                totalFetched += response.data.length;
+                if (params.maxResults && totalFetched >= params.maxResults) {
+                    members = members.slice(0, params.maxResults);
+                    break;
+                }
+                nextUrl = ((_c = (_b = response.headers.link) === null || _b === void 0 ? void 0 : _b.match(/<([^>]+)>;\s*rel="next"/)) === null || _c === void 0 ? void 0 : _c[1]) || null;
+                if (nextUrl) {
+                    console.debug("Next page URL:", nextUrl);
+                }
+            }
+            else {
+                const errorDetail = ((_d = response.data) === null || _d === void 0 ? void 0 : _d.errorSummary) || ((_e = response.data) === null || _e === void 0 ? void 0 : _e.message) || `Okta API responded with status ${response.status}`;
+                return { success: false, error: `Failed to list group members: ${errorDetail}` };
+            }
+        }
+        return { success: true, members };
+    }
+    catch (error) {
+        console.error("Error listing group members:", error);
+        let errorMessage = "Unknown error while listing group members";
+        if (error instanceof AxiosError && error.response) {
+            const oktaError = error.response.data;
+            errorMessage =
+                (oktaError === null || oktaError === void 0 ? void 0 : oktaError.errorSummary) || (oktaError === null || oktaError === void 0 ? void 0 : oktaError.message) || `Okta API request failed with status ${error.response.status}`;
+        }
+        else if (error instanceof Error) {
+            errorMessage = error.message;
+        }
+        return {
+            success: false,
+            error: errorMessage,
+        };
+    }
+});
+export default listOktaGroupMembers;

package/dist/actions/providers/okta/listOktaGroups.d.ts

@@ -0,0 +1,3 @@
+import type { oktaListOktaGroupsFunction } from "../../autogen/types.js";
+declare const listOktaGroups: oktaListOktaGroupsFunction;
+export default listOktaGroups;