@crowi/api-contract 2.0.0-alpha.14 → 2.0.0-alpha.16

package/dist/generated/openapi.d.mts

@@ -794,15 +794,13 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Top-level navigation that redirects the browser to the named provider */
+        /** Top-level navigation that redirects the browser to the named provider (public sign-in ONLY) */
         get: {
             parameters: {
                 query: {
                     continue: string;
                     handoff_jwk: string;
                     handoff_proof: string;
-                    link?: "1";
-                    link_grant?: string;
                 };
                 header?: never;
                 path: {
@@ -819,7 +817,7 @@ interface paths {
                     };
                     content?: never;
                 };
-                /** @description Malformed continue / sender proof, or an invalid/expired/mismatched link grant */
+                /** @description Malformed continue / sender proof, OR a raw `link` query key is present (any value) — the retired link-via-GET flow is gone entirely; a raw `link` key is always rejected rather than silently downgraded to public sign-in. */
                 400: {
                     headers: {
                         [name: string]: unknown;
@@ -834,36 +832,6 @@ interface paths {
                         };
                     };
                 };
-                /** @description link=1 without a web-session JWT — never downgraded to the public sign-in start */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            error: {
-                                code: components["schemas"]["ErrorCode"];
-                                message: string;
-                                details?: unknown;
-                            };
-                        };
-                    };
-                };
-                /** @description link=1 with a non-web credential (PAT / OAuth access token) */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            error: {
-                                code: components["schemas"]["ErrorCode"];
-                                message: string;
-                                details?: unknown;
-                            };
-                        };
-                    };
-                };
                 /** @description Unknown, unconfigured, or credential-kind provider */
                 404: {
                     headers: {
@@ -928,7 +896,7 @@ interface paths {
             };
             requestBody?: never;
             responses: {
-                /** @description Redirect to the trusted web login/complete page on success, or back to the trusted web /login on failure */
+                /** @description Ordinary sign-in: redirect to the trusted web login/complete page on success, or back to the trusted web /login on failure. Link flow (query `state` in the reserved crowilnk_ namespace): success redirects to `/me?provider=<name>&link_completion=<code>` (provider + completion code ONLY); failure redirects to `/me?provider=<name>&link=link_failed` (provider + the generic marker ONLY — never a completion code, never accountLabel, never the underlying reason). */
                 302: {
                     headers: {
                         [name: string]: unknown;
@@ -1161,7 +1129,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/auth/providers/{name}/link-grants": {
+    "/auth/providers/{name}/link-start": {
         parameters: {
             query?: never;
             header?: never;
@@ -1170,7 +1138,7 @@ interface paths {
         };
         get?: never;
         put?: never;
-        /** Mint a short-lived, opaque grant that authorizes ONE link start for the current web session */
+        /** Mint an IdP authorization URL + flow-specific state cookie for the current web session (stage 1 of 3) */
         post: {
             parameters: {
                 query?: never;
@@ -1180,26 +1148,160 @@ interface paths {
                 };
                 cookie?: never;
             };
-            requestBody?: {
-                content: {
-                    "application/json": {
-                        handoffChallenge: string;
+            requestBody?: never;
+            responses: {
+                /** @description Authorization URL to navigate the browser to. Sets a flow-specific, 300s state cookie. */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** Format: uri */
+                            authorizationUrl: string;
+                        };
+                    };
+                };
+                /** @description The signed link-state cookie value would exceed its per-cookie byte limit, or the aggregate Cookie-header admission budget cannot be satisfied even after pruning — no Set-Cookie or authorizationUrl is returned. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                code: components["schemas"]["ErrorCode"];
+                                message: string;
+                                details?: unknown;
+                            };
+                        };
+                    };
+                };
+                /** @description Authentication required (credential missing/invalid — resolved by middleware before this route's own validation) */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "AUTHENTICATION_REQUIRED";
+                                /** @enum {string} */
+                                message: "Authentication is required";
+                                redirectTo?: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Non-web credential (PAT / OAuth access token) — linking is a session-level account change */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                code: components["schemas"]["ErrorCode"];
+                                message: string;
+                                details?: unknown;
+                            };
+                        };
+                    };
+                };
+                /** @description Unknown, unconfigured, or credential-kind provider */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                code: components["schemas"]["ErrorCode"];
+                                message: string;
+                                details?: unknown;
+                            };
+                        };
+                    };
+                };
+                /** @description Internal server error (e.g. a declared multi-instance topology with no reachable Redis) */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "INTERNAL_ERROR";
+                                /** @enum {string} */
+                                message: "Internal server error";
+                            };
+                        };
                     };
                 };
             };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/auth/providers/{name}/link-completions/{code}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Read a pending link completion's confirmation details (stage 3a — non-destructive) */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    name: string;
+                    code: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
             responses: {
-                /** @description Opaque single-use grant id */
+                /** @description Pending, unconsumed completion bound to the caller — provider label fallback + optional display-only accountLabel */
                 200: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
                         "application/json": {
-                            linkGrant: string;
+                            provider: string;
+                            accountLabel?: string;
                         };
                     };
                 };
-                /** @description Authentication required */
+                /** @description Authenticated but `{code}` fails the 43-character base64url shape (VALIDATION_ERROR) */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "VALIDATION_ERROR";
+                                message: string;
+                                details?: {
+                                    fieldErrors: {
+                                        [key: string]: string[];
+                                    };
+                                    formErrors: string[];
+                                };
+                            };
+                        };
+                    };
+                };
+                /** @description Authentication required — resolved by middleware before this route's own `{code}` shape validation, so an unauthenticated + malformed code is still 401, never 400 */
                 401: {
                     headers: {
                         [name: string]: unknown;
@@ -1231,7 +1333,7 @@ interface paths {
                         };
                     };
                 };
-                /** @description Unknown, unconfigured, or credential-kind provider */
+                /** @description Never-issued, expired, retention-expired, or bound to a different user/provider/authVersion — all collapse to the same generic NOT_FOUND (no result-unknown code exists) */
                 404: {
                     headers: {
                         [name: string]: unknown;
@@ -1246,6 +1348,148 @@ interface paths {
                         };
                     };
                 };
+                /** @description The caller's own completion was already consumed */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "LINK_COMPLETION_CONSUMED";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Internal server error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "INTERNAL_ERROR";
+                                /** @enum {string} */
+                                message: "Internal server error";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        /** Atomically consume a link completion code and insert the identity (stage 3b — terminal) */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    name: string;
+                    code: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Linked (fresh winner OR an already-consumed replay that resolves to the same owner) — the same body either way */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            result: "linked";
+                        };
+                    };
+                };
+                /** @description Authenticated but `{code}` fails the 43-character base64url shape (VALIDATION_ERROR) */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "VALIDATION_ERROR";
+                                message: string;
+                                details?: {
+                                    fieldErrors: {
+                                        [key: string]: string[];
+                                    };
+                                    formErrors: string[];
+                                };
+                            };
+                        };
+                    };
+                };
+                /** @description Authentication required — resolved by middleware before this route's own `{code}` shape validation, so an unauthenticated + malformed code is still 401, never 400 */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "AUTHENTICATION_REQUIRED";
+                                /** @enum {string} */
+                                message: "Authentication is required";
+                                redirectTo?: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Non-web credential (PAT / OAuth access token) */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                code: components["schemas"]["ErrorCode"];
+                                message: string;
+                                details?: unknown;
+                            };
+                        };
+                    };
+                };
+                /** @description Never-issued, expired, retention-expired, or bound to a different user/provider — all collapse to the same generic NOT_FOUND */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                code: components["schemas"]["ErrorCode"];
+                                message: string;
+                                details?: unknown;
+                            };
+                        };
+                    };
+                };
+                /** @description FEDERATED_IDENTITY_IN_USE (provider account owned by someone else, or this user already has a different account of this provider), FEDERATED_LINK_AUTH_STATE_CHANGED (fresh User re-read found the session inactive or authVersion changed since link-start), or FEDERATED_LINK_NOT_LINKED (an already-consumed replay whose original insert has not landed) — no other conflict code exists. */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "FEDERATED_IDENTITY_IN_USE" | "FEDERATED_LINK_AUTH_STATE_CHANGED" | "FEDERATED_LINK_NOT_LINKED";
+                                message: string;
+                            };
+                        };
+                    };
+                };
                 /** @description Internal server error */
                 500: {
                     headers: {
@@ -12298,6 +12542,7 @@ interface paths {
                                 admin?: boolean;
                                 /** @enum {integer} */
                                 status?: 1 | 2 | 3 | 4 | 5;
+                                linkedProviders: string[];
                             }[];
                             pager: {
                                 page: number;
@@ -12743,7 +12988,7 @@ interface paths {
         };
         options?: never;
         head?: never;
-        /** Update a user's name and email */
+        /** Update a user's name (email changes go through PUT /admin/users/{id}/email) */
         patch: {
             parameters: {
                 query?: never;
@@ -12757,8 +13002,6 @@ interface paths {
                 content: {
                     "application/json": {
                         name: string;
-                        /** Format: email */
-                        email: string;
                     };
                 };
             };
@@ -12857,21 +13100,6 @@ interface paths {
                         };
                     };
                 };
-                /** @description Email already in use by another user */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            error: {
-                                /** @enum {string} */
-                                code: "CONFLICT";
-                                message: string;
-                            };
-                        };
-                    };
-                };
                 /** @description Internal server error */
                 500: {
                     headers: {
@@ -13847,7 +14075,7 @@ interface paths {
                         };
                     };
                 };
-                /** @description Email already in use by another user */
+                /** @description Email already in use by another user, or locked by a linked federated identity */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -13859,6 +14087,12 @@ interface paths {
                                 code: "CONFLICT";
                                 message: string;
                             };
+                        } | {
+                            error: {
+                                /** @enum {string} */
+                                code: "EMAIL_LOCKED_BY_FEDERATED_IDENTITY";
+                                message: string;
+                            };
                         };
                     };
                 };
@@ -13887,6 +14121,163 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/users/{id}/identities/{provider}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Unlink a user's federated identity for a provider (admin-initiated) */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    provider: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Identity removed; passwordIssued/newPassword report whether a password was generated */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            user: {
+                                _id: string;
+                                id?: string;
+                                username: string;
+                                name: string;
+                                /** Format: email */
+                                email: string;
+                                image?: string | null;
+                                introduction?: string;
+                                createdAt: string;
+                                admin?: boolean;
+                                /** @enum {integer} */
+                                status?: 1 | 2 | 3 | 4 | 5;
+                            };
+                            passwordIssued: boolean;
+                            newPassword?: string;
+                        };
+                    };
+                };
+                /** @description Invalid id */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "VALIDATION_ERROR";
+                                message: string;
+                                details?: {
+                                    fieldErrors: {
+                                        [key: string]: string[];
+                                    };
+                                    formErrors: string[];
+                                };
+                            };
+                        };
+                    };
+                };
+                /** @description Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "AUTHENTICATION_REQUIRED";
+                                /** @enum {string} */
+                                message: "Authentication is required";
+                                redirectTo?: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Admin permission required */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "ADMIN_REQUIRED";
+                                /** @enum {string} */
+                                message: "Admin permission required";
+                                redirectTo?: string;
+                            };
+                        };
+                    };
+                };
+                /** @description User not found, or the user has no identity for this provider */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "NOT_FOUND" | "NOT_LINKED";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Refused: the target is the operating admin themself, or password auth is disabled instance-wide */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "CANNOT_UNLINK_SELF" | "PASSWORD_AUTH_DISABLED";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Internal server error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "INTERNAL_ERROR";
+                                /** @enum {string} */
+                                message: "Internal server error";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/users/pending-count": {
         parameters: {
             query?: never;
@@ -15087,7 +15478,7 @@ interface components {
             };
         };
         /** @enum {string} */
-        ErrorCode: "AUTHENTICATION_REQUIRED" | "ADMIN_REQUIRED" | "THIRD_PARTY_AUTH_REQUIRED" | "USER_REGISTERED" | "USER_SUSPENDED" | "USER_INVITED" | "USER_NOT_ACTIVE" | "EMAIL_NOT_CONFIRMED" | "INTERNAL_ERROR" | "VALIDATION_ERROR" | "INVALID_REQUEST" | "NOT_FOUND" | "CONFLICT" | "SERVICE_UNAVAILABLE" | "APPLICATION_NOT_INSTALLED" | "INVALID_PAGE_ID" | "PAGE_NOT_FOUND" | "PAGE_NOT_GRANTED" | "PAGE_REVISION_ERROR" | "PAGE_TWIN_EXISTS" | "INVALID_GRANT" | "COMMENT_NOT_FOUND" | "NOTIFICATION_NOT_FOUND" | "USER_NOT_FOUND" | "USER_EXISTS" | "USERNAME_TAKEN" | "EMAIL_TAKEN" | "EMAIL_NOT_ALLOWED" | "INVALID_ACTIVATION_TOKEN" | "INVALID_INVITE_TOKEN" | "INVITE_ALREADY_ACCEPTED" | "INVALID_RESET_TOKEN" | "INVALID_EMAIL_CHANGE_TOKEN" | "INVALID_CREDENTIALS" | "REFRESH_TOKEN_REQUIRED" | "REGISTRATION_CLOSED" | "FEDERATED_HANDOFF_INVALID" | "FEDERATED_HANDOFF_CONSUMED" | "ENCRYPTION_NOT_CONFIGURED" | "MAIL_FROM_NOT_CONFIGURED" | "MAIL_TEST_FAILED" | "PLUGIN_NOT_FOUND" | "PLUGIN_CONFIG_VALIDATION_FAILED";
+        ErrorCode: "AUTHENTICATION_REQUIRED" | "ADMIN_REQUIRED" | "THIRD_PARTY_AUTH_REQUIRED" | "USER_REGISTERED" | "USER_SUSPENDED" | "USER_INVITED" | "USER_NOT_ACTIVE" | "EMAIL_NOT_CONFIRMED" | "INTERNAL_ERROR" | "VALIDATION_ERROR" | "INVALID_REQUEST" | "NOT_FOUND" | "CONFLICT" | "SERVICE_UNAVAILABLE" | "APPLICATION_NOT_INSTALLED" | "INVALID_PAGE_ID" | "PAGE_NOT_FOUND" | "PAGE_NOT_GRANTED" | "PAGE_REVISION_ERROR" | "PAGE_TWIN_EXISTS" | "INVALID_GRANT" | "COMMENT_NOT_FOUND" | "NOTIFICATION_NOT_FOUND" | "USER_NOT_FOUND" | "USER_EXISTS" | "USERNAME_TAKEN" | "EMAIL_TAKEN" | "EMAIL_NOT_ALLOWED" | "INVALID_ACTIVATION_TOKEN" | "INVALID_INVITE_TOKEN" | "INVITE_ALREADY_ACCEPTED" | "INVALID_RESET_TOKEN" | "INVALID_EMAIL_CHANGE_TOKEN" | "INVALID_CREDENTIALS" | "REFRESH_TOKEN_REQUIRED" | "REGISTRATION_CLOSED" | "FEDERATED_HANDOFF_INVALID" | "FEDERATED_HANDOFF_CONSUMED" | "FEDERATED_IDENTITY_IN_USE" | "FEDERATED_LINK_AUTH_STATE_CHANGED" | "FEDERATED_LINK_NOT_LINKED" | "LINK_COMPLETION_CONSUMED" | "ENCRYPTION_NOT_CONFIGURED" | "MAIL_FROM_NOT_CONFIGURED" | "MAIL_TEST_FAILED" | "PLUGIN_NOT_FOUND" | "PLUGIN_CONFIG_VALIDATION_FAILED";
         ApplicationNotInstalledError: {
             error: {
                 /** @enum {string} */
@@ -16570,6 +16961,7 @@ interface components {
                 admin?: boolean;
                 /** @enum {integer} */
                 status?: 1 | 2 | 3 | 4 | 5;
+                linkedProviders: string[];
             }[];
             pager: {
                 page: number;
@@ -16638,8 +17030,6 @@ interface components {
         };
         EditAdminUserRequest: {
             name: string;
-            /** Format: email */
-            email: string;
         };
         ResetPasswordResponse: {
             user: {