@cubist-labs/cubesigner-sdk 0.4.279 → 0.4.280

package/package.json

@@ -5,7 +5,7 @@
     "url": "git+https://github.com/cubist-labs/CubeSigner-TypeScript-SDK.git",
     "directory": "packages/sdk"
   },
-  "version": "0.4.279",
+  "version": "0.4.280",
   "type": "module",
   "description": "CubeSigner TypeScript SDK",
   "license": "MIT OR Apache-2.0",

package/src/client/api_client.ts

@@ -440,23 +440,19 @@ export class ApiClient extends BaseClient {
    * that must be answered either by calling {@link TotpChallenge.answer} (or
    * {@link ApiClient.userTotpResetComplete}).
    *
-   * @param issuer Optional issuer; defaults to "Cubist"
+   * @param request Optional request parameters (or just an issuer string); defaults to using "Cubist" as the issuer.
    * @param mfaReceipt MFA receipt(s) to include in HTTP headers
    * @returns A TOTP challenge that must be answered
    */
   async userTotpResetInit(
-    issuer?: string,
+    request?: string | schemas["TotpResetRequest"],
     mfaReceipt?: MfaReceipts,
   ): Promise<CubeSignerResponse<TotpChallenge>> {
     const o = op("/v0/org/{org_id}/user/me/totp", "post");
     const resetTotpFn = async (headers?: HeadersInit) => {
       const data = await this.exec(o, {
         headers,
-        body: issuer
-          ? {
-              issuer,
-            }
-          : null,
+        body: typeof request === "string" ? { issuer: request } : request,
       });
       return mapResponse(data, (totpInfo) => new TotpChallenge(this, totpInfo));
     };
@@ -471,10 +467,14 @@ export class ApiClient extends BaseClient {
    *
    * @param totpId The ID of the TOTP challenge
    * @param code The TOTP code that should verify against the TOTP configuration from the challenge.
+   * @returns TOTP registration response
    */
-  async userTotpResetComplete(totpId: string, code: string): Promise<void> {
+  async userTotpResetComplete(
+    totpId: string,
+    code: string,
+  ): Promise<schemas["TotpRegisterResponse"]> {
     const o = op("/v0/org/{org_id}/user/me/totp", "patch");
-    await this.exec(o, {
+    return await this.exec(o, {
       body: { totp_id: totpId, code },
     });
   }
@@ -543,12 +543,12 @@ export class ApiClient extends BaseClient {
    *
    * @param challengeId The ID of the challenge returned by the remote end.
    * @param credential The answer to the challenge.
-   * @returns An empty response
+   * @returns A FIDO registration response
    */
   async userFidoRegisterComplete(
     challengeId: string,
     credential: PublicKeyCredential,
-  ): Promise<Empty> {
+  ): Promise<schemas["FidoRegisterResponse"]> {
     const o = op("/v0/org/{org_id}/user/me/fido", "patch");
 
     return this.exec(o, {

package/src/mfa.ts

@@ -260,13 +260,14 @@ export class TotpChallenge {
    * Answer the challenge with the code that corresponds to `this.totpUrl`.
    *
    * @param code 6-digit code that corresponds to `this.totpUrl`.
+   * @returns TOTP registration response
    */
   async answer(code: string) {
     if (!/^\d{1,6}$/.test(code)) {
       throw new Error(`Invalid TOTP code: ${code}; it must be a 6-digit string`);
     }
 
-    await this.#api.userTotpResetComplete(this.id, code);
+    return await this.#api.userTotpResetComplete(this.id, code);
   }
 }
 
@@ -294,10 +295,12 @@ export class AddFidoChallenge {
   /**
    * Answers this challenge by using the `CredentialsContainer` API to create a credential
    * based on the the public key credential creation options from this challenge.
+   *
+   * @returns FIDO registration response
    */
   async createCredentialAndAnswer() {
     const cred = await navigator.credentials.create({ publicKey: this.options });
-    await this.answer(cred);
+    return await this.answer(cred);
   }
 
   /**
@@ -310,10 +313,11 @@ export class AddFidoChallenge {
    *
    * @param cred Credential created by calling the `CredentialContainer`'s `create` method
    *                   based on the public key creation options from this challenge.
+   * @returns FIDO registration response
    */
   async answer(cred: any) {
     const answer = credentialToJSON(cred);
-    await this.#api.userFidoRegisterComplete(this.challengeId, answer);
+    return await this.#api.userFidoRegisterComplete(this.challengeId, answer);
   }
 }
 

package/src/schema.ts

@@ -6183,7 +6183,7 @@ export interface components {
     /** @default null */
     Empty: unknown;
     EmptyImpl: {
-      status: string;
+      status: components["schemas"]["StatusOk"];
     };
     /**
      * @description Request to create a set of EOTS nonces for a specified chain-id, starting
@@ -6945,6 +6945,19 @@ export interface components {
     };
     /** @description Declares intent to register a new FIDO key */
     FidoCreateRequest: {
+      /**
+       * @description If set, the attestation answering this registration challenge additionally counts as an
+       * approving vote on pending MFA request `mfa_id`.
+       *
+       * This exists so that a user who must register their first second factor in order to complete
+       * an operation (most commonly logging in) does not have to perform two authenticator
+       * ceremonies back to back: one to enroll the credential and another to immediately prove
+       * possession of it. The attestation is a full WebAuthn ceremony over a server-issued
+       * challenge, so it is no weaker than the separate assertion it replaces.
+       *
+       * Requires the 'manage:mfa:vote:fido' scope in addition to 'manage:mfa:register:fido'.
+       */
+      approve_mfa?: string | null;
       /** @description Whether this key can be used for passwordless login */
       discoverable?: boolean;
       /**
@@ -6961,6 +6974,11 @@ export interface components {
        */
       request_device_identifier?: boolean;
     };
+    /** @description Result of registering a FIDO key */
+    FidoRegisterResponse: {
+      mfa?: components["schemas"]["MfaRequestInfo"];
+      status: components["schemas"]["StatusOk"];
+    };
     /** @enum {string} */
     ForbiddenErrorCode:
       | "AlienKeyCreate"
@@ -10717,6 +10735,16 @@ export interface components {
         };
       };
     };
+    /**
+     * @description The `status` field carried by [`Empty`] responses. Always serializes as `"ok"`.
+     *
+     * Endpoints that used to return [`Empty`] and now return something richer must keep emitting
+     * this field, because generated clients bind [`Empty`] to a struct with a *required* `status`
+     * and would otherwise fail to deserialize a successful response. Use this type rather than a
+     * bare `String` so the one acceptable value is not something anyone has to remember.
+     * @enum {string}
+     */
+    StatusOk: "ok";
     /**
      * @description A single asset balance entry returned by [`SubAccountAssetsResponse`].
      *
@@ -11137,8 +11165,25 @@ export interface components {
        */
       totp_url: string;
     };
+    /** @description Result of registering (resetting) TOTP */
+    TotpRegisterResponse: {
+      mfa?: components["schemas"]["MfaRequestInfo"];
+      status: components["schemas"]["StatusOk"];
+    };
     /** @description Request to reset TOTP. */
     TotpResetRequest: {
+      /**
+       * @description If set, the code answering this challenge additionally counts as an approving vote on
+       * pending MFA request `mfa_id`.
+       *
+       * This exists so that a user who must register their first second factor in order to complete
+       * an operation (most commonly logging in) does not have to enter two TOTP codes back to back:
+       * one to confirm enrollment and another to immediately approve the pending request. Answering
+       * the challenge already proves possession of the new secret.
+       *
+       * Requires the 'manage:mfa:vote:totp' scope in addition to 'manage:mfa:register:totp'.
+       */
+      approve_mfa?: string | null;
       /** @description The name of the issuer; defaults to "Cubist". */
       issuer?: string | null;
     };
@@ -12774,7 +12819,7 @@ export interface components {
     EmptyImpl: {
       content: {
         "application/json": {
-          status: string;
+          status: components["schemas"]["StatusOk"];
         };
       };
     };
@@ -12840,6 +12885,15 @@ export interface components {
         };
       };
     };
+    /** @description Result of registering a FIDO key */
+    FidoRegisterResponse: {
+      content: {
+        "application/json": {
+          mfa?: components["schemas"]["MfaRequestInfo"];
+          status: components["schemas"]["StatusOk"];
+        };
+      };
+    };
     /** @description The email sender configuration (without sensitive auth details) */
     GetEmailConfigResponse: {
       content: {
@@ -14030,6 +14084,15 @@ export interface components {
         };
       };
     };
+    /** @description Result of registering (resetting) TOTP */
+    TotpRegisterResponse: {
+      content: {
+        "application/json": {
+          mfa?: components["schemas"]["MfaRequestInfo"];
+          status: components["schemas"]["StatusOk"];
+        };
+      };
+    };
     /** @description A response to sign an eth2 unstake request. */
     UnstakeResponse: {
       content: {
@@ -19500,7 +19563,7 @@ export interface operations {
       };
     };
     responses: {
-      200: components["responses"]["EmptyImpl"];
+      200: components["responses"]["FidoRegisterResponse"];
       default: {
         content: {
           "application/json": components["schemas"]["ErrorResponse"];
@@ -19647,7 +19710,7 @@ export interface operations {
       };
     };
     responses: {
-      200: components["responses"]["EmptyImpl"];
+      200: components["responses"]["TotpRegisterResponse"];
       default: {
         content: {
           "application/json": components["schemas"]["ErrorResponse"];