@delopay/sdk 0.13.0 → 0.14.0

package/dist/internal.cjs

@@ -3011,11 +3011,9 @@ var AdminPortal = class {
    * immediately — no email round-trip is sent.
    */
   async createUserForMerchant(customerId, body) {
-    return this.request(
-      "POST",
-      `/admin-portal/customers/${encodeURIComponent(customerId)}/users`,
-      { body }
-    );
+    return this.request("POST", `/admin-portal/customers/${encodeURIComponent(customerId)}/users`, {
+      body
+    });
   }
   /**
    * Edit a user record. Any subset of fields may be supplied. `role_id`
@@ -3035,6 +3033,22 @@ var AdminPortal = class {
   async deleteUser(userId) {
     return this.request("DELETE", `/admin-portal/users/${encodeURIComponent(userId)}`);
   }
+  /**
+   * Set a target merchant's shop iframe-allowed origins. Internal-admin
+   * route — accepts an admin JWT or admin API key without requiring the
+   * caller to be scoped to the target merchant. Pass `null` (or an empty
+   * array) to clear the allowlist back to same-origin only.
+   *
+   * Server validates each origin: full origin (scheme + host[:port]),
+   * no path/query/fragment, no wildcards.
+   */
+  async updateShopIframeOrigins(merchantId, profileId, origins) {
+    return this.request(
+      "POST",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/business_profile/${encodeURIComponent(profileId)}/iframe-origins`,
+      { body: { iframe_allowed_origins: origins } }
+    );
+  }
 };
 
 // src/internal/resources/auditLogs.ts