@drmhse/sso-sdk 0.3.13 → 0.4.0

package/README.md

@@ -98,7 +98,9 @@ const loginUrl = sso.auth.getLoginUrl('github', {
 await sso.auth.login({
   email: 'user@example.com',
   password: 'SecurePass123!',
-  org_slug: 'acme-corp'  // Optional: scopes JWT to this org
+  org_slug: 'acme-corp',   // Optional: scopes JWT to this org
+  service_slug: 'main-app',
+  redirect_uri: 'https://app.acme.com/callback'
 });
 // JWT contains: { org: 'acme-corp', ... }
 ```
@@ -138,11 +140,15 @@ const loginUrl = sso.auth.getLoginUrl('github', {
 });
 window.location.href = loginUrl;
 
-// Handle callback - initialize client with token from OAuth callback
-const params = new URLSearchParams(window.location.search);
-const accessToken = params.get('access_token');
+// Handle callback - tokens are returned in URL fragment (#) for security
+// (prevents tokens from being logged in server access logs)
+const hashParams = new URLSearchParams(window.location.hash.substring(1));
+const accessToken = hashParams.get('access_token');
 
 if (accessToken) {
+  // Clear hash from URL for security
+  window.history.replaceState(null, '', window.location.pathname);
+
   // Initialize SDK with OAuth token - automatically stored
   const sso = new SsoClient({
     baseURL: 'https://sso.example.com',
@@ -183,6 +189,48 @@ const result = await sso.user.mfa.verify('123456'); // TOTP code from authentica
 console.log('Backup codes:', result.backup_codes); // Save these securely!
 ```
 
+### Hosted Auth Context & Passwordless
+
+```typescript
+const context = await sso.auth.getContext({
+  org: 'acme-corp',
+  service: 'main-app',
+  redirect_uri: 'https://app.acme.com/callback'
+});
+
+console.log(context.organization?.name);
+console.log(context.available_providers); // ['github', 'google', 'microsoft']
+
+await sso.magicLinks.request({
+  email: 'user@example.com',
+  org_slug: 'acme-corp',
+  service_slug: 'main-app',
+  redirect_uri: 'https://app.acme.com/callback'
+});
+
+const passkeyLogin = await sso.passkeys.login('user@example.com', {
+  org_slug: 'acme-corp',
+  service_slug: 'main-app',
+  redirect_uri: 'https://app.acme.com/callback'
+});
+
+await sso.setSession({
+  access_token: passkeyLogin.access_token,
+  refresh_token: passkeyLogin.refresh_token
+});
+```
+
+### Passkey Self-Service
+
+```typescript
+const passkeys = await sso.passkeys.list();
+
+if (passkeys.length > 0) {
+  await sso.passkeys.updateName(passkeys[0].id, 'Work Laptop');
+  await sso.passkeys.delete(passkeys[0].id);
+}
+```
+
 ### Device Flow (for CLIs)
 
 ```typescript
@@ -251,7 +299,7 @@ if (currentRefreshToken) {
 
 ```typescript
 // Create organization
-const org = await sso.organizations.createPublic({
+const org = await sso.organizations.create({
   name: 'Acme Corp',
   slug: 'acme-corp'
 });
@@ -263,7 +311,7 @@ await sso.organizations.oauthCredentials.set('acme-corp', 'github', {
 });
 
 // Invite team members
-await sso.organizations.invitations.create('acme-corp', {
+await sso.invitations.create('acme-corp', {
   email: 'member@acme.com',
   role: 'admin'
 });
@@ -341,6 +389,26 @@ const backendClient = new SsoClient({
   baseURL: 'https://sso.example.com',
   apiKey: apiKey.key
 });
+
+const rotated = await sso.services.rotateSecret('acme-corp', 'main-app');
+console.log('New client secret:', rotated.client_secret);
+```
+
+## Fine-Grained Member Access
+
+```typescript
+const access = await sso.organizations.members.updateServiceAccess(
+  'acme-corp',
+  'user-id',
+  {
+    grants: [
+      { service_slug: 'main-app', access: 'manager' },
+      { service_slug: 'docs-app', access: 'viewer' }
+    ]
+  }
+);
+
+console.log(access);
 ```
 
 ## Analytics
@@ -420,6 +488,10 @@ console.log(overview); // { total_users, total_orgs, total_logins, ... }
 
 // Search users across all organizations
 const users = await sso.platform.users.search('user@example.com');
+
+// Inspect operational health
+const ops = await sso.platform.getOperationsStatus();
+console.log(ops.jobs_pending, ops.webhook_deliveries_failed);
 ```
 
 ## TypeScript Support