@crowdedkingdoms/crowdyjs 7.1.0 → 8.0.0

package/dist/domains/auth.js

@@ -1,207 +1,110 @@
-import { ChangePasswordDocument, ConfirmEmailDocument, LoginDocument, LogoutAllDevicesDocument, LogoutDocument, RegisterDocument, RequestPasswordResetDocument, ResendConfirmationEmailDocument, ResetPasswordDocument, } from '../generated/graphql.js';
-/**
- * Authentication and account-lifecycle flows — exposed as `client.auth`.
- *
- * Targets the **management-api**: every call routes to `managementUrl` (falling
- * back to the game-api endpoint only in legacy single-endpoint mode). The
- * management API owns the `game_tokens` table that backs every login / register
- * / password / email-confirmation flow; the `token` it returns is a
- * `game_tokens` row that game-api validates against the same shared Postgres.
- *
- * {@link login} and {@link register} mint that session token **and** store it on
- * the shared session state automatically, so every later call on *either*
- * endpoint (auth, users, apps, actors, chunks, udp, ...) is authenticated
- * without you threading the token through by hand. Use {@link setToken} to
- * rehydrate a saved token and {@link getToken} to read the current one. `BigInt`
- * ids on the returned user (e.g. `userId`, `orgId`) are decimal strings.
- *
- * **Public — no session required:** {@link login}, {@link register},
- * {@link confirmEmail}, {@link requestPasswordReset}, {@link resetPassword}, and
- * {@link resendConfirmationEmail}. **Require a valid session:** {@link logout},
- * {@link logoutAllDevices}, and {@link changePassword}, which otherwise throw
- * {@link CrowdyGraphQLError} with `UNAUTHENTICATED` when the bearer token is
- * missing, expired, or revoked.
- */
+import { parse } from 'graphql';
+import { LogoutAllDevicesDocument, LogoutDocument } from '../generated/graphql.js';
+const AUTH_RESPONSE_FIELDS = 'token gameTokenId user { userId email gamertag }';
+const IDENTITY_FIELDS = 'identityId provider subject email emailVerified createdAt lastLoginAt';
+const RequestLoginLinkDocument = parse(`mutation RequestLoginLink($input: RequestLoginLinkInput!) { requestLoginLink(input: $input) { sent devToken } }`);
+const CompleteLoginLinkDocument = parse(`mutation CompleteLoginLink($input: CompleteLoginLinkInput!) { completeLoginLink(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+const SocialLoginStartDocument = parse(`mutation SocialLoginStart($input: SocialLoginStartInput!) { socialLoginStart(input: $input) { authorizeUrl state } }`);
+const SocialLoginCompleteDocument = parse(`mutation SocialLoginComplete($input: SocialLoginCompleteInput!) { socialLoginComplete(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+const DevLoginDocument = parse(`mutation DevLogin($input: DevLoginInput!) { devLogin(input: $input) { ${AUTH_RESPONSE_FIELDS} } }`);
+const AvailableLoginProvidersDocument = parse(`query AvailableLoginProviders { availableLoginProviders }`);
+const MyIdentitiesDocument = parse(`query MyIdentities { myIdentities { ${IDENTITY_FIELDS} } }`);
+const LinkIdentityDocument = parse(`mutation LinkIdentity($input: LinkIdentityInput!) { linkIdentity(input: $input) { ${IDENTITY_FIELDS} } }`);
+const UnlinkIdentityDocument = parse(`mutation UnlinkIdentity($identityId: String!) { unlinkIdentity(identityId: $identityId) }`);
 export class AuthAPI {
     constructor(graphql, session) {
         this.graphql = graphql;
         this.session = session;
     }
-    /**
-     * Authenticate with email + password and start a new session. **Public** — no
-     * existing session required.
-     *
-     * On success the returned `token` is minted **and** stored on the shared
-     * session state, so subsequent calls on any sub-client (management-api or
-     * game-api) carry it automatically — no need to call {@link setToken}.
-     *
-     * @param input - Credentials ({@link LoginUserInput}): `email` and `password`
-     *   (min 8 characters).
-     * @returns An {@link AuthResponse}: the opaque session `token` (sent as
-     *   `Authorization: Bearer <token>`), `gameTokenId` (the session row id, a
-     *   string), and the authenticated `user`.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` on invalid credentials, or
-     *   `BAD_USER_INPUT` on malformed input.
-     * @example
-     * ```ts
-     * const { user } = await client.auth.login({ email, password });
-     * // the session token is now stored; later calls are authenticated for you
-     * await client.users.me();
-     * ```
-     */
-    async login(input) {
-        const data = await this.graphql.request(LoginDocument, { input });
-        if (data.login?.token) {
-            this.session.setToken(data.login.token);
-        }
-        return data.login;
-    }
-    /**
-     * Create a new (initially unconfirmed) account, send a confirmation email, and
-     * return a session for immediate login. **Public** — no existing session
-     * required. Same token-persistence behaviour as {@link login}: the new `token`
-     * is stored on the shared session state automatically.
-     *
-     * @param input - New-account details ({@link RegisterUserInput}): `email`
-     *   (where the confirmation email is sent), `password` (min 8 characters), and
-     *   an optional initial `gamertag` (min 3 characters; can also be set later via
-     *   `client.users.updateGamertag`).
-     * @returns An {@link AuthResponse} (session `token`, `gameTokenId`, and the new
-     *   `user`).
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the email already exists or
-     *   the input is invalid.
-     */
-    async register(input) {
-        const data = await this.graphql.request(RegisterDocument, { input });
-        if (data.register?.token) {
-            this.session.setToken(data.register.token);
-        }
-        return data.register;
+    /** The federated sign-in providers currently enabled (e.g. `['google']`). */
+    async availableLoginProviders() {
+        const data = await this.graphql.request(AvailableLoginProvidersDocument);
+        return data.availableLoginProviders;
     }
     /**
-     * Single-device logout: revoke the `game_tokens` row that authenticated this
-     * request; other devices/tokens are unaffected. After a successful server-side
-     * revoke the in-memory token is cleared from the shared session state so the
-     * other sub-clients stop using it. Requires a valid session.
-     *
-     * @returns `true` if a token was revoked, or `false` if the request carried no
-     *   game token.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
+     * Passwordless: email the address a one-time magic sign-in link (creating the
+     * account on first sign-in). Always resolves `sent: true` (no enumeration). In
+     * development (`DEV_AUTH_BYPASS`) the response also carries `devToken`, the
+     * token to pass straight to {@link completeLoginLink} without an inbox.
      */
-    async logout() {
-        const data = await this.graphql.request(LogoutDocument);
-        this.session.setToken(null);
-        return data.logout;
+    async requestLoginLink(input) {
+        const data = await this.graphql.request(RequestLoginLinkDocument, { input });
+        return data.requestLoginLink;
     }
-    /**
-     * Revoke **every** active session for the authenticated user (deletes all
-     * their `game_tokens` rows and records revocations). Requires a valid session;
-     * use {@link logout} to end only the current one.
-     *
-     * Note: unlike {@link logout}, this does not clear the SDK's in-memory token —
-     * call {@link setToken}`(null)` afterwards if you also want to drop it locally.
-     *
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` if the session is invalid.
-     */
-    async logoutAllDevices() {
-        const data = await this.graphql.request(LogoutAllDevicesDocument);
-        return data.logoutAllDevices;
-    }
-    /**
-     * Confirm a user's email address using the token from the confirmation email.
-     * **Public** — the token itself authorizes the call.
-     *
-     * @param token - The confirmation token from the emailed link.
-     * @returns `true` on success, or `false` if the token is invalid or expired.
-     * @throws {CrowdyGraphQLError} on transport/validation failures (invalid or
-     *   expired tokens resolve to `false` rather than throwing).
-     */
-    async confirmEmail(token) {
-        const data = await this.graphql.request(ConfirmEmailDocument, { token });
-        return data.confirmEmail;
+    /** Complete a magic-link sign-in; stores the session token on success. */
+    async completeLoginLink(token) {
+        const data = await this.graphql.request(CompleteLoginLinkDocument, {
+            input: { token },
+        });
+        if (data.completeLoginLink?.token)
+            this.session.setToken(data.completeLoginLink.token);
+        return data.completeLoginLink;
     }
     /**
-     * Start the password-reset flow by emailing a reset link to the address.
-     * **Public**. Always returns `true` regardless of whether the email exists or
-     * is confirmed, to prevent account enumeration.
-     *
-     * @param email - Email address to send the password-reset link to.
-     * @returns `true` (always, even when no such account exists).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
+     * Begin a federated (social) sign-in. Returns an `authorizeUrl` to redirect the
+     * user to and an opaque `state` to round-trip back to {@link socialLoginComplete}.
      */
-    async requestPasswordReset(email) {
-        const data = await this.graphql.request(RequestPasswordResetDocument, {
-            email,
+    async socialLoginStart(provider, redirectUri) {
+        const data = await this.graphql.request(SocialLoginStartDocument, {
+            input: { provider, redirectUri },
         });
-        return data.requestPasswordReset;
+        return data.socialLoginStart;
     }
-    /**
-     * Complete a password reset using the reset token and a new password.
-     * **Public** — the reset token authorizes the call. Existing sessions are
-     * **not** revoked.
-     *
-     * @param input - {@link ResetPasswordInput}: the `token` from the emailed reset
-     *   link and the `newPassword` to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `BAD_USER_INPUT` if the token is invalid or
-     *   expired.
-     */
-    async resetPassword(input) {
-        const data = await this.graphql.request(ResetPasswordDocument, {
+    /** Complete a federated sign-in from the provider callback; stores the token. */
+    async socialLoginComplete(input) {
+        const data = await this.graphql.request(SocialLoginCompleteDocument, {
             input,
         });
-        return data.resetPassword;
+        if (data.socialLoginComplete?.token)
+            this.session.setToken(data.socialLoginComplete.token);
+        return data.socialLoginComplete;
     }
     /**
-     * Re-send the email-confirmation link. **Public**. Always returns `true`
-     * regardless of whether the account exists or is already confirmed (prevents
-     * enumeration); the email is only actually sent for existing unconfirmed
-     * accounts.
-     *
-     * @param email - Email address of the account to re-send confirmation to.
-     * @returns `true` (always).
-     * @throws {CrowdyGraphQLError} on transport/validation failures.
+     * DEV ONLY bypass sign-in (active only when the server has `DEV_AUTH_BYPASS`).
+     * Returns a session for `email` without email/social verification; stores it.
+     * Throws `FORBIDDEN` when the bypass is disabled (e.g. production).
      */
-    async resendConfirmationEmail(email) {
-        const data = await this.graphql.request(ResendConfirmationEmailDocument, {
-            email,
+    async devLogin(email) {
+        const data = await this.graphql.request(DevLoginDocument, {
+            input: { email },
         });
-        return data.resendConfirmationEmail;
+        if (data.devLogin?.token)
+            this.session.setToken(data.devLogin.token);
+        return data.devLogin;
     }
-    /**
-     * Change the authenticated user's password after verifying the current one.
-     * Requires a valid session. Existing sessions are **not** revoked.
-     *
-     * @param currentPassword - The user's current password, for verification.
-     * @param newPassword - The new password to set (min 8 characters).
-     * @returns `true` on success.
-     * @throws {CrowdyGraphQLError} `UNAUTHENTICATED` without a valid session, or
-     *   `BAD_USER_INPUT` if the current password is wrong.
-     */
-    async changePassword(currentPassword, newPassword) {
-        const data = await this.graphql.request(ChangePasswordDocument, {
-            currentPassword,
-            newPassword,
+    /** The signed-in user's linked sign-in identities. Requires a session. */
+    async myIdentities() {
+        const data = await this.graphql.request(MyIdentitiesDocument);
+        return data.myIdentities;
+    }
+    /** Link an additional federated identity (from a social callback). */
+    async linkIdentity(input) {
+        const data = await this.graphql.request(LinkIdentityDocument, { input });
+        return data.linkIdentity;
+    }
+    /** Unlink a federated identity (cannot remove the last sign-in method). */
+    async unlinkIdentity(identityId) {
+        const data = await this.graphql.request(UnlinkIdentityDocument, {
+            identityId,
         });
-        return data.changePassword;
+        return data.unlinkIdentity;
     }
-    /**
-     * Imperatively replace the in-memory bearer token on the shared session state
-     * (e.g. to rehydrate a token persisted to disk). Affects every sub-client.
-     * Local only — performs no network call. Pass `null` to clear it.
-     *
-     * @param token - The bearer token to use, or `null` to clear the session.
-     */
+    /** Single-device logout; clears the in-memory token on success. */
+    async logout() {
+        const data = await this.graphql.request(LogoutDocument);
+        this.session.setToken(null);
+        return data.logout;
+    }
+    /** Revoke every active session for the user. Requires a session. */
+    async logoutAllDevices() {
+        const data = await this.graphql.request(LogoutAllDevicesDocument);
+        return data.logoutAllDevices;
+    }
+    /** Imperatively set the in-memory bearer token (e.g. rehydrate). */
     setToken(token) {
         this.session.setToken(token);
     }
-    /**
-     * Read the current in-memory bearer token from the shared session state. Local
-     * only — performs no network call.
-     *
-     * @returns The current bearer token, or `null` if none is set.
-     */
+    /** Read the current in-memory bearer token. */
     getToken() {
         return this.session.getToken();
     }

package/dist/domains/portal.d.ts

@@ -60,6 +60,30 @@ export declare class BrowserSessionPkceStore implements PkceStore {
     set(state: string, verifier: string): void;
     remove(state: string): void;
 }
+export interface PortalConsentState {
+    appId: string;
+    appName: string | null;
+    /** True for first-party/trusted apps (consent always skipped). */
+    trusted: boolean;
+    alreadyGranted: boolean;
+    /** True if the Overworld must show a consent screen before minting a code. */
+    consentRequired: boolean;
+}
+export interface AppAuthorizationGrant {
+    grantId: string;
+    appId: string;
+    appName: string | null;
+    scopes: string[];
+    status: string;
+    grantedAt: string;
+    revokedAt: string | null;
+}
+/** Thrown by {@link PortalAPI.handleAuthorizeRequest} when the user must consent. */
+export declare class PortalConsentRequiredError extends Error {
+    readonly appId: string;
+    readonly appName: string | null;
+    constructor(appId: string, appName: string | null);
+}
 export interface BeginEntryParams {
     /** Target app id (decimal string). */
     appId: string;
@@ -105,6 +129,21 @@ export declare class PortalAPI {
      * through the Overworld. Requires the current app token on this session.
      */
     refresh(): Promise<AppTokenResponse>;
+    /** Whether portaling into an app needs a consent prompt (Overworld side). */
+    getConsent(appId: string): Promise<PortalConsentState>;
+    /** Record the user's consent for an app (call from the consent screen). */
+    authorizeApp(appId: string, scopes?: string[]): Promise<AppAuthorizationGrant>;
+    /** Revoke a prior authorization; also revokes the user's live tokens for it. */
+    revokeAppAuthorization(appId: string): Promise<boolean>;
+    /** The user's active app authorizations ("connected apps"). */
+    myAuthorizedApps(): Promise<AppAuthorizationGrant[]>;
+    /** Register/update an app's portal client settings (requires manage_apps). */
+    setAppClientSettings(input: {
+        appId: string;
+        redirectUris?: string[];
+        clientType?: string;
+        launchUrl?: string;
+    }): Promise<PortalConsentState>;
     /**
      * Destination-game side, step 1: generate a PKCE pair, persist the verifier,
      * and return the Overworld authorize URL to navigate to. The caller does
@@ -116,7 +155,10 @@ export declare class PortalAPI {
      * game's params from the URL, mints a code with the session token, and returns
      * the URL to redirect the player back to (carrying `code` + `state`).
      */
-    handleAuthorizeRequest(search?: string): Promise<string>;
+    handleAuthorizeRequest(search?: string, options?: {
+        grantConsent?: boolean;
+        scopes?: string[];
+    }): Promise<string>;
     /**
      * Destination-game side, step 3: read `code` + `state` from the callback URL,
      * load the stored verifier, exchange for an app token, and store it. Returns

package/dist/domains/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/domains/portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,YAAW,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,SAAmB;IACtD,OAAO,CAAC,EAAE;IAGV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAGjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAG1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG5B;AAqCD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,YAAY,EACrB,SAAS,GAAE,SAAyC;IAGvE;;;;;OAKG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D;;;;OAIG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQpC;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAQ1C;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3D;;;;OAIG;IACG,sBAAsB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyB9D;;;;;OAKG;IACG,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAUvE"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/domains/portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,YAAW,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,SAAmB;IACtD,OAAO,CAAC,EAAE;IAGV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAGjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAG1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG5B;AAqCD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,qFAAqF;AACrF,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,KAAK,EAAE,MAAM;aACb,OAAO,EAAE,MAAM,GAAG,IAAI;gBADtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AA4CD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,YAAY,EACrB,SAAS,GAAE,SAAyC;IAGvE;;;;;OAKG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D;;;;OAIG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQpC;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAQ1C,6EAA6E;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,2EAA2E;IACrE,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAOjC,gFAAgF;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7D,+DAA+D;IACzD,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAK1D,8EAA8E;IACxE,oBAAoB,CAAC,KAAK,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS/B;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3D;;;;OAIG;IACG,sBAAsB,CAC1B,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACtD,OAAO,CAAC,MAAM,CAAC;IAoClB;;;;;OAKG;IACG,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAUvE"}

package/dist/domains/portal.js

@@ -48,6 +48,20 @@ const MintAppTokenDocument = parse(`mutation MintAppToken($input: MintAppTokenIn
 const CreatePortalAuthorizationCodeDocument = parse(`mutation CreatePortalAuthorizationCode($input: CreatePortalAuthorizationCodeInput!) { createPortalAuthorizationCode(input: $input) { code redirectUri expiresAt } }`);
 const ExchangePortalCodeDocument = parse(`mutation ExchangePortalCode($input: ExchangePortalCodeInput!) { exchangePortalCode(input: $input) { ${APP_TOKEN_FIELDS} } }`);
 const RefreshAppTokenDocument = parse(`mutation RefreshAppToken { refreshAppToken { ${APP_TOKEN_FIELDS} } }`);
+/** Thrown by {@link PortalAPI.handleAuthorizeRequest} when the user must consent. */
+export class PortalConsentRequiredError extends Error {
+    constructor(appId, appName) {
+        super(`Consent required for app ${appId}`);
+        this.appId = appId;
+        this.appName = appName;
+        this.name = 'PortalConsentRequiredError';
+    }
+}
+const PortalConsentDocument = parse(`query PortalConsent($appId: BigInt!) { portalConsent(appId: $appId) { appId appName trusted alreadyGranted consentRequired } }`);
+const AuthorizeAppDocument = parse(`mutation AuthorizeApp($input: AuthorizeAppInput!) { authorizeApp(input: $input) { grantId appId status scopes } }`);
+const RevokeAppAuthorizationDocument = parse(`mutation RevokeAppAuthorization($appId: BigInt!) { revokeAppAuthorization(appId: $appId) }`);
+const MyAuthorizedAppsDocument = parse(`query MyAuthorizedApps { myAuthorizedApps { grantId appId appName scopes status grantedAt revokedAt } }`);
+const SetAppClientSettingsDocument = parse(`mutation SetAppClientSettings($input: SetAppClientSettingsInput!) { setAppClientSettings(input: $input) { appId appName trusted consentRequired } }`);
 export class PortalAPI {
     constructor(management, session, pkceStore = new BrowserSessionPkceStore()) {
         this.management = management;
@@ -97,6 +111,38 @@ export class PortalAPI {
         this.session.setToken(data.refreshAppToken.token);
         return data.refreshAppToken;
     }
+    // ----- Consent + connected apps ------------------------------------------
+    /** Whether portaling into an app needs a consent prompt (Overworld side). */
+    async getConsent(appId) {
+        const data = await this.management.request(PortalConsentDocument, { appId });
+        return data.portalConsent;
+    }
+    /** Record the user's consent for an app (call from the consent screen). */
+    async authorizeApp(appId, scopes) {
+        const data = await this.management.request(AuthorizeAppDocument, {
+            input: { appId, scopes },
+        });
+        return data.authorizeApp;
+    }
+    /** Revoke a prior authorization; also revokes the user's live tokens for it. */
+    async revokeAppAuthorization(appId) {
+        const data = await this.management.request(RevokeAppAuthorizationDocument, {
+            appId,
+        });
+        return data.revokeAppAuthorization;
+    }
+    /** The user's active app authorizations ("connected apps"). */
+    async myAuthorizedApps() {
+        const data = await this.management.request(MyAuthorizedAppsDocument);
+        return data.myAuthorizedApps;
+    }
+    /** Register/update an app's portal client settings (requires manage_apps). */
+    async setAppClientSettings(input) {
+        const data = await this.management.request(SetAppClientSettingsDocument, {
+            input,
+        });
+        return data.setAppClientSettings;
+    }
     // ----- Browser PKCE redirect helpers -------------------------------------
     /**
      * Destination-game side, step 1: generate a PKCE pair, persist the verifier,
@@ -120,7 +166,7 @@ export class PortalAPI {
      * game's params from the URL, mints a code with the session token, and returns
      * the URL to redirect the player back to (carrying `code` + `state`).
      */
-    async handleAuthorizeRequest(search) {
+    async handleAuthorizeRequest(search, options) {
         const params = new URLSearchParams(search ?? defaultSearch());
         const appId = params.get('app_id');
         const codeChallenge = params.get('code_challenge');
@@ -130,6 +176,18 @@ export class PortalAPI {
         if (!appId || !codeChallenge || !redirectUri) {
             throw new Error('authorize request missing app_id, code_challenge, or redirect_uri');
         }
+        // Consent gate: trusted apps + already-granted apps proceed silently. For an
+        // untrusted, not-yet-granted app, either record consent (when the user
+        // approved on the consent screen) or signal the caller to show one.
+        const consent = await this.getConsent(appId);
+        if (consent.consentRequired) {
+            if (options?.grantConsent) {
+                await this.authorizeApp(appId, options.scopes);
+            }
+            else {
+                throw new PortalConsentRequiredError(appId, consent.appName);
+            }
+        }
         const result = await this.createAuthorizationCode({
             appId,
             codeChallenge,