@delopay/sdk 0.60.0 → 0.62.0

package/dist/index.cjs

@@ -175,6 +175,92 @@ var ApiKeys = class {
   async list(merchantId) {
     return this.request("GET", `/api-keys/${encodeURIComponent(merchantId)}/list`);
   }
+  // --- Profile-scoped (shop-level) API keys ---------------------------------
+  //
+  // JWT-authenticated routes under `/account/{merchantId}/profile/api-keys`.
+  // The caller's shop (business profile) comes from the JWT, never from the
+  // request, so a shop-scoped user can only mint/list/manage keys pinned to
+  // their own shop. Requires a backend with profile-scoped API key support
+  // (DeloPay-net/delopay-backend#344).
+  /**
+   * Create a new API key pinned to the caller's shop (business profile).
+   * `POST /account/{merchantId}/profile/api-keys`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param params - Key creation parameters (name, expiry, etc.).
+   * @returns The newly created key including the plaintext secret (shown once
+   *   only) and the `profile_id` it is pinned to.
+   *
+   * @example
+   * ```typescript
+   * const { api_key } = await delopay.apiKeys.createByProfile('merch_123', {
+   *   name: 'Shop key',
+   *   expiration: 'never',
+   * });
+   * ```
+   */
+  async createByProfile(merchantId, params) {
+    return this.request("POST", `/account/${encodeURIComponent(merchantId)}/profile/api-keys`, {
+      body: params
+    });
+  }
+  /**
+   * List API keys pinned to the caller's shop (business profile) only.
+   * `GET /account/{merchantId}/profile/api-keys`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param params - Optional pagination constraints (`limit`, `skip`).
+   * @returns Array of API key metadata objects belonging to the caller's shop.
+   */
+  async listByProfile(merchantId, params) {
+    return this.request("GET", `/account/${encodeURIComponent(merchantId)}/profile/api-keys`, {
+      query: params
+    });
+  }
+  /**
+   * Retrieve metadata about a shop-pinned API key (does not return the
+   * plaintext secret). `GET /account/{merchantId}/profile/api-keys/{keyId}`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param keyId - The API key ID.
+   * @returns The API key metadata.
+   */
+  async retrieveByProfile(merchantId, keyId) {
+    return this.request(
+      "GET",
+      `/account/${encodeURIComponent(merchantId)}/profile/api-keys/${encodeURIComponent(keyId)}`
+    );
+  }
+  /**
+   * Update a shop-pinned API key's name, description, or expiry.
+   * `POST /account/{merchantId}/profile/api-keys/{keyId}`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param keyId - The API key ID to update.
+   * @param params - Fields to update.
+   * @returns The updated API key metadata.
+   */
+  async updateByProfile(merchantId, keyId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(merchantId)}/profile/api-keys/${encodeURIComponent(keyId)}`,
+      { body: params }
+    );
+  }
+  /**
+   * Revoke a shop-pinned API key, immediately invalidating it.
+   * `DELETE /account/{merchantId}/profile/api-keys/{keyId}`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param keyId - The API key ID to revoke.
+   * @returns Revocation confirmation.
+   */
+  async revokeByProfile(merchantId, keyId) {
+    return this.request(
+      "DELETE",
+      `/account/${encodeURIComponent(merchantId)}/profile/api-keys/${encodeURIComponent(keyId)}`
+    );
+  }
 };
 
 // src/resources/authentication.ts
@@ -2329,6 +2415,23 @@ var Users = class {
   async addUser(params) {
     return this.request("POST", "/user/employees/add", { body: params });
   }
+  /**
+   * Impersonate one of your own team members — `POST /user/employees/impersonate`.
+   *
+   * Mints a session token **as** the given member, so the dashboard renders
+   * exactly what they see (useful for support and role verification). The
+   * caller needs the *Impersonation* permission, and the member's role must
+   * rank **strictly below** the caller's (`Profile < Merchant < Organization`);
+   * the server rejects self-impersonation, cross-merchant targets, and
+   * equal/higher roles.
+   *
+   * The returned token is tab-scoped by design: open it in a fresh tab (e.g.
+   * `/auth/impersonate?token=…`) rather than replacing the caller's own
+   * session. No auth cookie is set on the response.
+   */
+  async impersonateEmployee(params) {
+    return this.request("POST", "/user/employees/impersonate", { body: params });
+  }
   async acceptInvitation(params) {
     return this.request("POST", "/user/employees/invite/accept", { body: params });
   }