@delopay/sdk 0.3.2 → 0.4.0

package/dist/index.cjs

@@ -2070,21 +2070,29 @@ var Users = class {
     return this.request("POST", "/user/forgot_password", { body: params });
   }
   /**
-   * Reset a user's password using the single-purpose JWT delivered by the
-   * forgot-password email.
+   * Commit a password reset.
    *
-   * The backend validates the token **twice**: first by the
-   * `SinglePurposeJWTAuth` middleware (reads `Authorization: Bearer …`),
-   * then by the handler itself (decodes `body.token` as an `EmailToken` and
-   * looks up the user by the embedded email — see
-   * `crates/router/src/core/user.rs:687`). The same JWT satisfies both, so
-   * the SDK sends it in both places. Callers still pass `{ password, token }`.
+   * The caller is responsible for obtaining a `SinglePurposeToken` with
+   * `purpose: reset_password` via the email-token exchange + TOTP flow
+   * (see `fromEmail`, `beginTotp`, `updateTotp`/`verifyTotp`,
+   * `generateRecoveryCodes`, `terminate2fa`) and setting it on the client
+   * via `setJwtToken` before calling this method. `body.token` must still
+   * be the original `EmailToken` from the reset-link URL — the handler
+   * decodes it a second time to find the user
+   * (`delopay-backend/crates/router/src/core/user.rs:687`).
    */
   async resetPassword(params) {
-    return this.request("POST", "/user/reset_password", {
-      body: params,
-      headers: { Authorization: `Bearer ${params.token}` }
-    });
+    return this.request("POST", "/user/reset_password", { body: params });
+  }
+  /**
+   * Exchange an email-link token (`EmailToken`) for a single-purpose JWT
+   * that drives the next step of the flow (TOTP, verify email, accept
+   * invitation, etc.). No authentication required.
+   *
+   * The `token_type` in the response tells you which step to run next.
+   */
+  async fromEmail(params) {
+    return this.request("POST", "/user/from_email", { body: params });
   }
   async verifyEmail(params) {
     return this.request("POST", "/user/verify_email", { body: params });
@@ -2113,9 +2121,24 @@ var Users = class {
   async acceptInvitation(params) {
     return this.request("POST", "/user/user/invite/accept", { body: params });
   }
+  /**
+   * Start TOTP setup (or no-op if already set).
+   *
+   * Returns the QR-code payload when the user has no TOTP configured yet;
+   * returns `{ secret: null }` when the user is already set up (caller
+   * should then prompt for a 6-digit code and call `verifyTotp`).
+   *
+   * Requires `Authorization: Bearer <SPT{purpose:totp}>`.
+   */
   async beginTotp() {
     return this.request("GET", "/user/2fa/totp/begin");
   }
+  /**
+   * Verify a 6-digit TOTP code for a user whose TOTP is already set up.
+   * Marks the code as used in Redis so subsequent flow steps can advance.
+   *
+   * Requires `Authorization: Bearer <SPT{purpose:totp}>`.
+   */
   async verifyTotp(params) {
     return this.request("POST", "/user/2fa/totp/verify", { body: params });
   }
@@ -2182,13 +2205,29 @@ var Users = class {
   async check2faStatusV2() {
     return this.request("GET", "/user/2fa/v2");
   }
-  /** Update TOTP. `PUT /user/2fa/totp/verify` */
+  /**
+   * Finish first-time TOTP setup: commit the secret generated by `beginTotp`
+   * against a 6-digit code from the user's authenticator app.
+   *
+   * `PUT /user/2fa/totp/verify`. Requires `Authorization: Bearer <SPT{purpose:totp}>`.
+   */
   async updateTotp(params) {
     return this.request("PUT", "/user/2fa/totp/verify", { body: params });
   }
-  /** Terminate 2FA. `GET /user/2fa/terminate` */
-  async terminate2fa() {
-    return this.request("GET", "/user/2fa/terminate");
+  /**
+   * Complete the TOTP step and advance to the next flow stage (e.g.
+   * `reset_password`). Returns a fresh single-purpose token with the
+   * next `token_type`.
+   *
+   * `GET /user/2fa/terminate`. Requires `Authorization: Bearer <SPT{purpose:totp}>`.
+   */
+  async terminate2fa(query) {
+    if (query === void 0) {
+      return this.request("GET", "/user/2fa/terminate");
+    }
+    return this.request("GET", "/user/2fa/terminate", {
+      query
+    });
   }
   /** Create auth method. `POST /user/auth` */
   async createAuthMethod(params) {