@drmhse/sso-sdk 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +39 -0
- package/dist/index.d.mts +219 -2
- package/dist/index.d.ts +219 -2
- package/dist/index.js +209 -1
- package/dist/index.mjs +208 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -210,6 +210,45 @@ await sso.organizations.setSmtp('acme-corp', {
|
|
|
210
210
|
});
|
|
211
211
|
```
|
|
212
212
|
|
|
213
|
+
## Subscription & Billing
|
|
214
|
+
|
|
215
|
+
The SDK provides provider-agnostic billing integration that works with both Stripe and Polar.
|
|
216
|
+
|
|
217
|
+
```typescript
|
|
218
|
+
// Check billing status
|
|
219
|
+
const billingInfo = await sso.organizations.billing.getInfo('acme-corp');
|
|
220
|
+
console.log(billingInfo.has_billing_account); // true/false
|
|
221
|
+
console.log(billingInfo.provider); // "stripe" or "polar"
|
|
222
|
+
|
|
223
|
+
// Open billing portal for subscription management
|
|
224
|
+
const portal = await sso.organizations.billing.createPortalSession('acme-corp', {
|
|
225
|
+
return_url: 'https://app.acme.com/settings/billing'
|
|
226
|
+
});
|
|
227
|
+
// Redirect user to manage their subscription
|
|
228
|
+
window.location.href = portal.url;
|
|
229
|
+
```
|
|
230
|
+
|
|
231
|
+
### BYOP - Bring Your Own Payment
|
|
232
|
+
|
|
233
|
+
Organizations can configure their own billing provider credentials to charge their end-users:
|
|
234
|
+
|
|
235
|
+
```typescript
|
|
236
|
+
// Configure organization's own Stripe credentials
|
|
237
|
+
await sso.organizations.billingCredentials.set('acme-corp', 'stripe', {
|
|
238
|
+
api_key: 'sk_live_...',
|
|
239
|
+
webhook_secret: 'whsec_...',
|
|
240
|
+
mode: 'live' // or 'test'
|
|
241
|
+
});
|
|
242
|
+
|
|
243
|
+
// Check credential status
|
|
244
|
+
const status = await sso.organizations.billingCredentials.get('acme-corp', 'stripe');
|
|
245
|
+
console.log(status.configured); // true
|
|
246
|
+
console.log(status.mode); // "live"
|
|
247
|
+
|
|
248
|
+
// Remove credentials
|
|
249
|
+
await sso.organizations.billingCredentials.delete('acme-corp', 'stripe');
|
|
250
|
+
```
|
|
251
|
+
|
|
213
252
|
## Services & API Keys
|
|
214
253
|
|
|
215
254
|
```typescript
|
package/dist/index.d.mts
CHANGED
|
@@ -2027,6 +2027,14 @@ interface SessionConfig {
|
|
|
2027
2027
|
storageKeyPrefix?: string;
|
|
2028
2028
|
autoRefresh?: boolean;
|
|
2029
2029
|
}
|
|
2030
|
+
/**
|
|
2031
|
+
* Snapshot of the current authentication state.
|
|
2032
|
+
* Useful for hydration in SSR frameworks.
|
|
2033
|
+
*/
|
|
2034
|
+
interface AuthSnapshot {
|
|
2035
|
+
isAuthenticated: boolean;
|
|
2036
|
+
token: string | null;
|
|
2037
|
+
}
|
|
2030
2038
|
declare class SessionManager {
|
|
2031
2039
|
private storage;
|
|
2032
2040
|
private refreshHandler;
|
|
@@ -2061,7 +2069,13 @@ declare class SessionManager {
|
|
|
2061
2069
|
refreshSession(): Promise<string>;
|
|
2062
2070
|
isAuthenticated(): boolean;
|
|
2063
2071
|
/**
|
|
2064
|
-
*
|
|
2072
|
+
* Get a synchronous snapshot of the current auth state.
|
|
2073
|
+
* Useful for SSR hydration and initial state.
|
|
2074
|
+
*/
|
|
2075
|
+
getSnapshot(): AuthSnapshot;
|
|
2076
|
+
/**
|
|
2077
|
+
* Subscribe to auth state changes (useful for UI updates).
|
|
2078
|
+
* The listener is immediately called with the current state upon subscription.
|
|
2065
2079
|
*/
|
|
2066
2080
|
subscribe(listener: (isAuthenticated: boolean) => void): () => void;
|
|
2067
2081
|
private notifyListeners;
|
|
@@ -3688,6 +3702,124 @@ declare class OrganizationsModule {
|
|
|
3688
3702
|
*/
|
|
3689
3703
|
test: (orgSlug: string, configId: string) => Promise<TestConnectionResponse>;
|
|
3690
3704
|
};
|
|
3705
|
+
/**
|
|
3706
|
+
* Billing and subscription management methods
|
|
3707
|
+
*/
|
|
3708
|
+
billing: {
|
|
3709
|
+
/**
|
|
3710
|
+
* Get billing information for an organization.
|
|
3711
|
+
* Returns whether a billing account exists and which provider is being used.
|
|
3712
|
+
* Requires 'owner' or 'admin' role.
|
|
3713
|
+
*
|
|
3714
|
+
* @param orgSlug Organization slug
|
|
3715
|
+
* @returns Billing information
|
|
3716
|
+
*
|
|
3717
|
+
* @example
|
|
3718
|
+
* ```typescript
|
|
3719
|
+
* const info = await sso.organizations.billing.getInfo('acme-corp');
|
|
3720
|
+
* if (info.has_billing_account) {
|
|
3721
|
+
* console.log('Billing provider:', info.provider);
|
|
3722
|
+
* }
|
|
3723
|
+
* ```
|
|
3724
|
+
*/
|
|
3725
|
+
getInfo: (orgSlug: string) => Promise<{
|
|
3726
|
+
has_billing_account: boolean;
|
|
3727
|
+
provider: string | null;
|
|
3728
|
+
}>;
|
|
3729
|
+
/**
|
|
3730
|
+
* Create a billing portal session.
|
|
3731
|
+
* Redirects the user to the billing provider's self-service portal to manage their subscription,
|
|
3732
|
+
* update payment methods, view invoices, etc.
|
|
3733
|
+
* Requires 'owner' role.
|
|
3734
|
+
*
|
|
3735
|
+
* @param orgSlug Organization slug
|
|
3736
|
+
* @param returnUrl URL to redirect the user to after they leave the portal
|
|
3737
|
+
* @returns Object containing the portal session URL
|
|
3738
|
+
*
|
|
3739
|
+
* @example
|
|
3740
|
+
* ```typescript
|
|
3741
|
+
* const session = await sso.organizations.billing.createPortalSession('acme-corp', {
|
|
3742
|
+
* return_url: 'https://app.acme.com/billing'
|
|
3743
|
+
* });
|
|
3744
|
+
* // Redirect user to billing portal
|
|
3745
|
+
* window.location.href = session.url;
|
|
3746
|
+
* ```
|
|
3747
|
+
*/
|
|
3748
|
+
createPortalSession: (orgSlug: string, payload: {
|
|
3749
|
+
return_url: string;
|
|
3750
|
+
}) => Promise<{
|
|
3751
|
+
url: string;
|
|
3752
|
+
}>;
|
|
3753
|
+
};
|
|
3754
|
+
/**
|
|
3755
|
+
* BYOP (Bring Your Own Payment) credential management.
|
|
3756
|
+
* Allows organizations to configure their own billing provider credentials
|
|
3757
|
+
* to charge their end-users directly.
|
|
3758
|
+
*/
|
|
3759
|
+
billingCredentials: {
|
|
3760
|
+
/**
|
|
3761
|
+
* Get the status of billing credentials for a provider.
|
|
3762
|
+
* Returns whether credentials are configured and the mode (test/live).
|
|
3763
|
+
* Requires 'owner' role.
|
|
3764
|
+
*
|
|
3765
|
+
* @param orgSlug Organization slug
|
|
3766
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
3767
|
+
* @returns Credential configuration status
|
|
3768
|
+
*
|
|
3769
|
+
* @example
|
|
3770
|
+
* ```typescript
|
|
3771
|
+
* const status = await sso.organizations.billingCredentials.get('acme-corp', 'stripe');
|
|
3772
|
+
* if (status.configured) {
|
|
3773
|
+
* console.log('Mode:', status.mode); // 'test' or 'live'
|
|
3774
|
+
* console.log('Enabled:', status.enabled);
|
|
3775
|
+
* }
|
|
3776
|
+
* ```
|
|
3777
|
+
*/
|
|
3778
|
+
get: (orgSlug: string, provider: "stripe" | "polar") => Promise<{
|
|
3779
|
+
configured: boolean;
|
|
3780
|
+
provider: string;
|
|
3781
|
+
mode: "test" | "live" | null;
|
|
3782
|
+
enabled: boolean;
|
|
3783
|
+
}>;
|
|
3784
|
+
/**
|
|
3785
|
+
* Set or update billing credentials for a provider.
|
|
3786
|
+
* Enables the organization to charge their end-users using their own
|
|
3787
|
+
* payment provider account.
|
|
3788
|
+
* Requires 'owner' role.
|
|
3789
|
+
*
|
|
3790
|
+
* @param orgSlug Organization slug
|
|
3791
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
3792
|
+
* @param payload Billing credentials
|
|
3793
|
+
*
|
|
3794
|
+
* @example
|
|
3795
|
+
* ```typescript
|
|
3796
|
+
* await sso.organizations.billingCredentials.set('acme-corp', 'stripe', {
|
|
3797
|
+
* api_key: 'sk_live_...',
|
|
3798
|
+
* webhook_secret: 'whsec_...',
|
|
3799
|
+
* mode: 'live'
|
|
3800
|
+
* });
|
|
3801
|
+
* ```
|
|
3802
|
+
*/
|
|
3803
|
+
set: (orgSlug: string, provider: "stripe" | "polar", payload: {
|
|
3804
|
+
api_key: string;
|
|
3805
|
+
webhook_secret: string;
|
|
3806
|
+
mode: "test" | "live";
|
|
3807
|
+
}) => Promise<void>;
|
|
3808
|
+
/**
|
|
3809
|
+
* Delete billing credentials for a provider.
|
|
3810
|
+
* The organization will no longer be able to charge end-users directly.
|
|
3811
|
+
* Requires 'owner' role.
|
|
3812
|
+
*
|
|
3813
|
+
* @param orgSlug Organization slug
|
|
3814
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
3815
|
+
*
|
|
3816
|
+
* @example
|
|
3817
|
+
* ```typescript
|
|
3818
|
+
* await sso.organizations.billingCredentials.delete('acme-corp', 'stripe');
|
|
3819
|
+
* ```
|
|
3820
|
+
*/
|
|
3821
|
+
delete: (orgSlug: string, provider: "stripe" | "polar") => Promise<void>;
|
|
3822
|
+
};
|
|
3691
3823
|
}
|
|
3692
3824
|
|
|
3693
3825
|
/**
|
|
@@ -4348,6 +4480,32 @@ declare class PlatformModule {
|
|
|
4348
4480
|
* ```
|
|
4349
4481
|
*/
|
|
4350
4482
|
updateTier: (orgId: string, payload: UpdateOrganizationTierPayload) => Promise<Organization>;
|
|
4483
|
+
/**
|
|
4484
|
+
* Update an organization's feature overrides.
|
|
4485
|
+
*
|
|
4486
|
+
* @param orgId Organization ID
|
|
4487
|
+
* @param payload Feature override flags
|
|
4488
|
+
* @returns Updated organization
|
|
4489
|
+
*
|
|
4490
|
+
* @example
|
|
4491
|
+
* ```typescript
|
|
4492
|
+
* await sso.platform.organizations.updateFeatures('org-id', {
|
|
4493
|
+
* allow_saml: true,
|
|
4494
|
+
* allow_scim: false,
|
|
4495
|
+
* allow_custom_domain: true,
|
|
4496
|
+
* allow_custom_branding: false
|
|
4497
|
+
* });
|
|
4498
|
+
* ```
|
|
4499
|
+
*/
|
|
4500
|
+
updateFeatures: (orgId: string, payload: {
|
|
4501
|
+
allow_saml?: boolean;
|
|
4502
|
+
allow_scim?: boolean;
|
|
4503
|
+
allow_custom_domain?: boolean;
|
|
4504
|
+
allow_custom_branding?: boolean;
|
|
4505
|
+
allow_advanced_risk_engine?: boolean;
|
|
4506
|
+
allow_siem_integration?: boolean;
|
|
4507
|
+
allow_webhooks?: boolean;
|
|
4508
|
+
}) => Promise<Organization>;
|
|
4351
4509
|
/**
|
|
4352
4510
|
* Delete an organization and all its associated data.
|
|
4353
4511
|
* This is a destructive operation that cannot be undone.
|
|
@@ -5433,6 +5591,19 @@ declare class SsoClient {
|
|
|
5433
5591
|
* Gets the current base URL
|
|
5434
5592
|
*/
|
|
5435
5593
|
getBaseURL(): string;
|
|
5594
|
+
/**
|
|
5595
|
+
* Gets the JWKS (JSON Web Key Set) URL for JWT verification.
|
|
5596
|
+
* Use this for stateless token verification in edge functions or middleware.
|
|
5597
|
+
*
|
|
5598
|
+
* @returns The full URL to the .well-known/jwks.json endpoint
|
|
5599
|
+
*
|
|
5600
|
+
* @example
|
|
5601
|
+
* ```typescript
|
|
5602
|
+
* const jwksUrl = sso.getJwksUrl();
|
|
5603
|
+
* // Returns: "https://sso.example.com/.well-known/jwks.json"
|
|
5604
|
+
* ```
|
|
5605
|
+
*/
|
|
5606
|
+
getJwksUrl(): string;
|
|
5436
5607
|
/**
|
|
5437
5608
|
* Check if the user is currently authenticated
|
|
5438
5609
|
*/
|
|
@@ -5463,6 +5634,52 @@ declare class SsoClient {
|
|
|
5463
5634
|
getToken(): Promise<string | null>;
|
|
5464
5635
|
}
|
|
5465
5636
|
|
|
5637
|
+
/**
|
|
5638
|
+
* Standard authentication error codes returned by the AuthOS API.
|
|
5639
|
+
* Use these to reliably switch UI states based on error type.
|
|
5640
|
+
*/
|
|
5641
|
+
declare enum AuthErrorCodes {
|
|
5642
|
+
/** Multi-factor authentication is required to complete login */
|
|
5643
|
+
MFA_REQUIRED = "MFA_REQUIRED",
|
|
5644
|
+
/** User must select or create an organization */
|
|
5645
|
+
ORG_REQUIRED = "ORG_REQUIRED",
|
|
5646
|
+
/** The provided credentials are invalid */
|
|
5647
|
+
INVALID_CREDENTIALS = "INVALID_CREDENTIALS",
|
|
5648
|
+
/** The JWT token has expired */
|
|
5649
|
+
TOKEN_EXPIRED = "TOKEN_EXPIRED",
|
|
5650
|
+
/** The refresh token is invalid or has been revoked */
|
|
5651
|
+
REFRESH_TOKEN_INVALID = "REFRESH_TOKEN_INVALID",
|
|
5652
|
+
/** The user is not authorized to perform this action */
|
|
5653
|
+
UNAUTHORIZED = "UNAUTHORIZED",
|
|
5654
|
+
/** The user does not have permission for this resource */
|
|
5655
|
+
FORBIDDEN = "FORBIDDEN",
|
|
5656
|
+
/** The requested resource was not found */
|
|
5657
|
+
NOT_FOUND = "NOT_FOUND",
|
|
5658
|
+
/** The request failed validation */
|
|
5659
|
+
VALIDATION_ERROR = "VALIDATION_ERROR",
|
|
5660
|
+
/** The email address is already registered */
|
|
5661
|
+
EMAIL_ALREADY_EXISTS = "EMAIL_ALREADY_EXISTS",
|
|
5662
|
+
/** Email verification is required */
|
|
5663
|
+
EMAIL_NOT_VERIFIED = "EMAIL_NOT_VERIFIED",
|
|
5664
|
+
/** The account has been suspended */
|
|
5665
|
+
ACCOUNT_SUSPENDED = "ACCOUNT_SUSPENDED",
|
|
5666
|
+
/** The organization has been suspended */
|
|
5667
|
+
ORG_SUSPENDED = "ORG_SUSPENDED",
|
|
5668
|
+
/** Rate limit exceeded */
|
|
5669
|
+
RATE_LIMITED = "RATE_LIMITED",
|
|
5670
|
+
/** The password does not meet requirements */
|
|
5671
|
+
WEAK_PASSWORD = "WEAK_PASSWORD",
|
|
5672
|
+
/** The MFA code is invalid */
|
|
5673
|
+
INVALID_MFA_CODE = "INVALID_MFA_CODE",
|
|
5674
|
+
/** The magic link or verification token has expired */
|
|
5675
|
+
LINK_EXPIRED = "LINK_EXPIRED",
|
|
5676
|
+
/** The device code has expired */
|
|
5677
|
+
DEVICE_CODE_EXPIRED = "DEVICE_CODE_EXPIRED",
|
|
5678
|
+
/** Authorization is still pending (device flow) */
|
|
5679
|
+
AUTHORIZATION_PENDING = "AUTHORIZATION_PENDING",
|
|
5680
|
+
/** The passkey authentication failed */
|
|
5681
|
+
PASSKEY_ERROR = "PASSKEY_ERROR"
|
|
5682
|
+
}
|
|
5466
5683
|
/**
|
|
5467
5684
|
* Custom error class for SSO API errors.
|
|
5468
5685
|
* Provides structured error information from the API.
|
|
@@ -5499,4 +5716,4 @@ declare class SsoApiError extends Error {
|
|
|
5499
5716
|
isNotFound(): boolean;
|
|
5500
5717
|
}
|
|
5501
5718
|
|
|
5502
|
-
export { type AcceptInvitationPayload, type AdminLoginUrlParams, type AnalyticsQuery, type ApiKey, type ApiKeyCreateResponse, type ApproveOrganizationPayload, type AuditLog, type AuditLogEntry, type AuditLogQueryParams, type AuditLogResponse, AuthMethod, AuthModule, type AuthenticationResponseJSON, type BackupCodesResponse, type BrandingConfiguration, BrowserStorage, type ChangePasswordRequest, type ChangePasswordResponse, type ConfigureSamlPayload, type ConfigureSamlResponse, type CreateApiKeyPayload, type CreateCheckoutPayload, type CreateCheckoutResponse, type CreateInvitationPayload, type CreateOrganizationPayload, type CreateOrganizationResponse, type CreatePlanPayload, type CreateScimTokenRequest, type CreateServicePayload, type CreateServiceResponse, type CreateSiemConfigRequest, type CreateWebhookRequest, type DeclineInvitationPayload, type DeviceCodeRequest, type DeviceCodeResponse, type DeviceTrust, type DeviceVerifyResponse, type DomainConfiguration, type DomainVerificationMethod, type DomainVerificationResponse, type DomainVerificationResult, type EndUser, type EndUserDetailResponse, type EndUserIdentity, type EndUserListResponse, type EndUserSubscription, type EventTypeInfo, type ExportUserDataResponse, type ForgetUserResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GeolocationData, type GetAuditLogParams, type GetRiskSettingsResponse, type GrowthTrendPoint, type Identity, type ImpersonateRequest, type ImpersonateResponse, type ImpersonationUserInfo, type Invitation, type InvitationStatus, type InvitationWithOrg, InvitationsModule, type JwtClaims, type ListApiKeysResponse, type ListDevicesResponse, type ListEndUsersParams, type ListOrganizationsParams, type ListPlatformOrganizationsParams, type ListScimTokensResponse, type ListSiemConfigsResponse, type LoginActivityPoint, type LoginEventExport, type LoginRequest, type LoginTrendPoint, type LoginUrlParams, type LoginsByProvider, type LoginsByService, type LookupEmailRequest, type LookupEmailResponse, MagicLinks, type MemberListResponse, type MemberRole, type Membership, type MembershipExport, MemoryStorage, type MfaEventExport, type MfaSetupResponse, type MfaStatusResponse, type MfaVerificationRequest, type MfaVerificationResponse, type MfaVerifyRequest, type MfaVerifyResponse, type OAuthCredentials, type OAuthIdentityExport, type OAuthProvider, type Organization, type OrganizationMember, type OrganizationResponse, type OrganizationStatus, type OrganizationStatusBreakdown, type OrganizationTier, OrganizationsModule, type PaginatedResponse, type PaginationInfo, type PaginationParams, type Passkey, type PasskeyAuthFinishRequest, type PasskeyAuthFinishResponse, type PasskeyAuthStartRequest, type PasskeyAuthStartResponse, type PasskeyExport, type PasskeyRegisterFinishRequest, type PasskeyRegisterFinishResponse, type PasskeyRegisterStartRequest, type PasskeyRegisterStartResponse, PasskeysModule, PermissionsModule, type Plan, type PlanResponse, type PlatformAnalyticsDateRangeParams, PlatformModule, type PlatformOrganizationResponse, type PlatformOrganizationsListResponse, type PlatformOverviewMetrics, type PromotePlatformOwnerPayload, type ProviderToken, type ProviderTokenGrant, type RecentLogin, type RecentOrganization, type RefreshTokenRequest, type RefreshTokenResponse, type RegisterRequest, type RegisterResponse, type RegistrationResponseJSON, type RejectOrganizationPayload, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDeviceRequest, type RevokeDeviceResponse, type RevokeSessionsResponse, RiskAction, type RiskAnalytics, type RiskAssessment, type RiskContext, type RiskEnforcementMode, type RiskEngineConfig, type RiskEvent, RiskEventOutcome, type RiskFactor, RiskFactorType, type RiskRule, type RiskRuleCondition, type RiskScore, type RiskSettings, type SamlCertificate, type SamlConfig, type ScimTokenResponse, type Service, ServiceApiModule, type ServiceListResponse, type ServiceResponse, type ServiceType, type ServiceWithDetails, ServicesModule, type SetCustomDomainRequest, type SetOAuthCredentialsPayload, type SetPasswordRequest, type SetPasswordResponse, type SetSmtpRequest, type SiemConfigResponse, type SiemProviderType, type SmtpConfigResponse, SsoApiError, SsoClient, type SsoClientOptions, type StartLinkResponse, type Subscription, type TestConnectionResponse, type TokenRequest, type TokenResponse, type TokenStorage, type TopOrganization, type TransferOwnershipPayload, type UpdateBrandingRequest, type UpdateMemberRolePayload, type UpdateOrganizationPayload, type UpdateOrganizationTierPayload, type UpdatePlanPayload, type UpdateRiskSettingsRequest, type UpdateRiskSettingsResponse, type UpdateServicePayload, type UpdateSiemConfigRequest, type UpdateUserProfilePayload, type UpdateWebhookRequest, type User, type UserDevice, UserModule, type UserProfile, type Webhook, type WebhookDelivery, type WebhookDeliveryListResponse, type WebhookDeliveryQueryParams, type WebhookListResponse, type WebhookResponse };
|
|
5719
|
+
export { type AcceptInvitationPayload, type AdminLoginUrlParams, type AnalyticsQuery, type ApiKey, type ApiKeyCreateResponse, type ApproveOrganizationPayload, type AuditLog, type AuditLogEntry, type AuditLogQueryParams, type AuditLogResponse, AuthErrorCodes, AuthMethod, AuthModule, type AuthSnapshot, type AuthenticationResponseJSON, type BackupCodesResponse, type BrandingConfiguration, BrowserStorage, type ChangePasswordRequest, type ChangePasswordResponse, type ConfigureSamlPayload, type ConfigureSamlResponse, type CreateApiKeyPayload, type CreateCheckoutPayload, type CreateCheckoutResponse, type CreateInvitationPayload, type CreateOrganizationPayload, type CreateOrganizationResponse, type CreatePlanPayload, type CreateScimTokenRequest, type CreateServicePayload, type CreateServiceResponse, type CreateSiemConfigRequest, type CreateWebhookRequest, type DeclineInvitationPayload, type DeviceCodeRequest, type DeviceCodeResponse, type DeviceTrust, type DeviceVerifyResponse, type DomainConfiguration, type DomainVerificationMethod, type DomainVerificationResponse, type DomainVerificationResult, type EndUser, type EndUserDetailResponse, type EndUserIdentity, type EndUserListResponse, type EndUserSubscription, type EventTypeInfo, type ExportUserDataResponse, type ForgetUserResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GeolocationData, type GetAuditLogParams, type GetRiskSettingsResponse, type GrowthTrendPoint, type Identity, type ImpersonateRequest, type ImpersonateResponse, type ImpersonationUserInfo, type Invitation, type InvitationStatus, type InvitationWithOrg, InvitationsModule, type JwtClaims, type ListApiKeysResponse, type ListDevicesResponse, type ListEndUsersParams, type ListOrganizationsParams, type ListPlatformOrganizationsParams, type ListScimTokensResponse, type ListSiemConfigsResponse, type LoginActivityPoint, type LoginEventExport, type LoginRequest, type LoginTrendPoint, type LoginUrlParams, type LoginsByProvider, type LoginsByService, type LookupEmailRequest, type LookupEmailResponse, MagicLinks, type MemberListResponse, type MemberRole, type Membership, type MembershipExport, MemoryStorage, type MfaEventExport, type MfaSetupResponse, type MfaStatusResponse, type MfaVerificationRequest, type MfaVerificationResponse, type MfaVerifyRequest, type MfaVerifyResponse, type OAuthCredentials, type OAuthIdentityExport, type OAuthProvider, type Organization, type OrganizationMember, type OrganizationResponse, type OrganizationStatus, type OrganizationStatusBreakdown, type OrganizationTier, OrganizationsModule, type PaginatedResponse, type PaginationInfo, type PaginationParams, type Passkey, type PasskeyAuthFinishRequest, type PasskeyAuthFinishResponse, type PasskeyAuthStartRequest, type PasskeyAuthStartResponse, type PasskeyExport, type PasskeyRegisterFinishRequest, type PasskeyRegisterFinishResponse, type PasskeyRegisterStartRequest, type PasskeyRegisterStartResponse, PasskeysModule, PermissionsModule, type Plan, type PlanResponse, type PlatformAnalyticsDateRangeParams, PlatformModule, type PlatformOrganizationResponse, type PlatformOrganizationsListResponse, type PlatformOverviewMetrics, type PromotePlatformOwnerPayload, type ProviderToken, type ProviderTokenGrant, type RecentLogin, type RecentOrganization, type RefreshTokenRequest, type RefreshTokenResponse, type RegisterRequest, type RegisterResponse, type RegistrationResponseJSON, type RejectOrganizationPayload, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDeviceRequest, type RevokeDeviceResponse, type RevokeSessionsResponse, RiskAction, type RiskAnalytics, type RiskAssessment, type RiskContext, type RiskEnforcementMode, type RiskEngineConfig, type RiskEvent, RiskEventOutcome, type RiskFactor, RiskFactorType, type RiskRule, type RiskRuleCondition, type RiskScore, type RiskSettings, type SamlCertificate, type SamlConfig, type ScimTokenResponse, type Service, ServiceApiModule, type ServiceListResponse, type ServiceResponse, type ServiceType, type ServiceWithDetails, ServicesModule, type SetCustomDomainRequest, type SetOAuthCredentialsPayload, type SetPasswordRequest, type SetPasswordResponse, type SetSmtpRequest, type SiemConfigResponse, type SiemProviderType, type SmtpConfigResponse, SsoApiError, SsoClient, type SsoClientOptions, type StartLinkResponse, type Subscription, type TestConnectionResponse, type TokenRequest, type TokenResponse, type TokenStorage, type TopOrganization, type TransferOwnershipPayload, type UpdateBrandingRequest, type UpdateMemberRolePayload, type UpdateOrganizationPayload, type UpdateOrganizationTierPayload, type UpdatePlanPayload, type UpdateRiskSettingsRequest, type UpdateRiskSettingsResponse, type UpdateServicePayload, type UpdateSiemConfigRequest, type UpdateUserProfilePayload, type UpdateWebhookRequest, type User, type UserDevice, UserModule, type UserProfile, type Webhook, type WebhookDelivery, type WebhookDeliveryListResponse, type WebhookDeliveryQueryParams, type WebhookListResponse, type WebhookResponse };
|
package/dist/index.d.ts
CHANGED
|
@@ -2027,6 +2027,14 @@ interface SessionConfig {
|
|
|
2027
2027
|
storageKeyPrefix?: string;
|
|
2028
2028
|
autoRefresh?: boolean;
|
|
2029
2029
|
}
|
|
2030
|
+
/**
|
|
2031
|
+
* Snapshot of the current authentication state.
|
|
2032
|
+
* Useful for hydration in SSR frameworks.
|
|
2033
|
+
*/
|
|
2034
|
+
interface AuthSnapshot {
|
|
2035
|
+
isAuthenticated: boolean;
|
|
2036
|
+
token: string | null;
|
|
2037
|
+
}
|
|
2030
2038
|
declare class SessionManager {
|
|
2031
2039
|
private storage;
|
|
2032
2040
|
private refreshHandler;
|
|
@@ -2061,7 +2069,13 @@ declare class SessionManager {
|
|
|
2061
2069
|
refreshSession(): Promise<string>;
|
|
2062
2070
|
isAuthenticated(): boolean;
|
|
2063
2071
|
/**
|
|
2064
|
-
*
|
|
2072
|
+
* Get a synchronous snapshot of the current auth state.
|
|
2073
|
+
* Useful for SSR hydration and initial state.
|
|
2074
|
+
*/
|
|
2075
|
+
getSnapshot(): AuthSnapshot;
|
|
2076
|
+
/**
|
|
2077
|
+
* Subscribe to auth state changes (useful for UI updates).
|
|
2078
|
+
* The listener is immediately called with the current state upon subscription.
|
|
2065
2079
|
*/
|
|
2066
2080
|
subscribe(listener: (isAuthenticated: boolean) => void): () => void;
|
|
2067
2081
|
private notifyListeners;
|
|
@@ -3688,6 +3702,124 @@ declare class OrganizationsModule {
|
|
|
3688
3702
|
*/
|
|
3689
3703
|
test: (orgSlug: string, configId: string) => Promise<TestConnectionResponse>;
|
|
3690
3704
|
};
|
|
3705
|
+
/**
|
|
3706
|
+
* Billing and subscription management methods
|
|
3707
|
+
*/
|
|
3708
|
+
billing: {
|
|
3709
|
+
/**
|
|
3710
|
+
* Get billing information for an organization.
|
|
3711
|
+
* Returns whether a billing account exists and which provider is being used.
|
|
3712
|
+
* Requires 'owner' or 'admin' role.
|
|
3713
|
+
*
|
|
3714
|
+
* @param orgSlug Organization slug
|
|
3715
|
+
* @returns Billing information
|
|
3716
|
+
*
|
|
3717
|
+
* @example
|
|
3718
|
+
* ```typescript
|
|
3719
|
+
* const info = await sso.organizations.billing.getInfo('acme-corp');
|
|
3720
|
+
* if (info.has_billing_account) {
|
|
3721
|
+
* console.log('Billing provider:', info.provider);
|
|
3722
|
+
* }
|
|
3723
|
+
* ```
|
|
3724
|
+
*/
|
|
3725
|
+
getInfo: (orgSlug: string) => Promise<{
|
|
3726
|
+
has_billing_account: boolean;
|
|
3727
|
+
provider: string | null;
|
|
3728
|
+
}>;
|
|
3729
|
+
/**
|
|
3730
|
+
* Create a billing portal session.
|
|
3731
|
+
* Redirects the user to the billing provider's self-service portal to manage their subscription,
|
|
3732
|
+
* update payment methods, view invoices, etc.
|
|
3733
|
+
* Requires 'owner' role.
|
|
3734
|
+
*
|
|
3735
|
+
* @param orgSlug Organization slug
|
|
3736
|
+
* @param returnUrl URL to redirect the user to after they leave the portal
|
|
3737
|
+
* @returns Object containing the portal session URL
|
|
3738
|
+
*
|
|
3739
|
+
* @example
|
|
3740
|
+
* ```typescript
|
|
3741
|
+
* const session = await sso.organizations.billing.createPortalSession('acme-corp', {
|
|
3742
|
+
* return_url: 'https://app.acme.com/billing'
|
|
3743
|
+
* });
|
|
3744
|
+
* // Redirect user to billing portal
|
|
3745
|
+
* window.location.href = session.url;
|
|
3746
|
+
* ```
|
|
3747
|
+
*/
|
|
3748
|
+
createPortalSession: (orgSlug: string, payload: {
|
|
3749
|
+
return_url: string;
|
|
3750
|
+
}) => Promise<{
|
|
3751
|
+
url: string;
|
|
3752
|
+
}>;
|
|
3753
|
+
};
|
|
3754
|
+
/**
|
|
3755
|
+
* BYOP (Bring Your Own Payment) credential management.
|
|
3756
|
+
* Allows organizations to configure their own billing provider credentials
|
|
3757
|
+
* to charge their end-users directly.
|
|
3758
|
+
*/
|
|
3759
|
+
billingCredentials: {
|
|
3760
|
+
/**
|
|
3761
|
+
* Get the status of billing credentials for a provider.
|
|
3762
|
+
* Returns whether credentials are configured and the mode (test/live).
|
|
3763
|
+
* Requires 'owner' role.
|
|
3764
|
+
*
|
|
3765
|
+
* @param orgSlug Organization slug
|
|
3766
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
3767
|
+
* @returns Credential configuration status
|
|
3768
|
+
*
|
|
3769
|
+
* @example
|
|
3770
|
+
* ```typescript
|
|
3771
|
+
* const status = await sso.organizations.billingCredentials.get('acme-corp', 'stripe');
|
|
3772
|
+
* if (status.configured) {
|
|
3773
|
+
* console.log('Mode:', status.mode); // 'test' or 'live'
|
|
3774
|
+
* console.log('Enabled:', status.enabled);
|
|
3775
|
+
* }
|
|
3776
|
+
* ```
|
|
3777
|
+
*/
|
|
3778
|
+
get: (orgSlug: string, provider: "stripe" | "polar") => Promise<{
|
|
3779
|
+
configured: boolean;
|
|
3780
|
+
provider: string;
|
|
3781
|
+
mode: "test" | "live" | null;
|
|
3782
|
+
enabled: boolean;
|
|
3783
|
+
}>;
|
|
3784
|
+
/**
|
|
3785
|
+
* Set or update billing credentials for a provider.
|
|
3786
|
+
* Enables the organization to charge their end-users using their own
|
|
3787
|
+
* payment provider account.
|
|
3788
|
+
* Requires 'owner' role.
|
|
3789
|
+
*
|
|
3790
|
+
* @param orgSlug Organization slug
|
|
3791
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
3792
|
+
* @param payload Billing credentials
|
|
3793
|
+
*
|
|
3794
|
+
* @example
|
|
3795
|
+
* ```typescript
|
|
3796
|
+
* await sso.organizations.billingCredentials.set('acme-corp', 'stripe', {
|
|
3797
|
+
* api_key: 'sk_live_...',
|
|
3798
|
+
* webhook_secret: 'whsec_...',
|
|
3799
|
+
* mode: 'live'
|
|
3800
|
+
* });
|
|
3801
|
+
* ```
|
|
3802
|
+
*/
|
|
3803
|
+
set: (orgSlug: string, provider: "stripe" | "polar", payload: {
|
|
3804
|
+
api_key: string;
|
|
3805
|
+
webhook_secret: string;
|
|
3806
|
+
mode: "test" | "live";
|
|
3807
|
+
}) => Promise<void>;
|
|
3808
|
+
/**
|
|
3809
|
+
* Delete billing credentials for a provider.
|
|
3810
|
+
* The organization will no longer be able to charge end-users directly.
|
|
3811
|
+
* Requires 'owner' role.
|
|
3812
|
+
*
|
|
3813
|
+
* @param orgSlug Organization slug
|
|
3814
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
3815
|
+
*
|
|
3816
|
+
* @example
|
|
3817
|
+
* ```typescript
|
|
3818
|
+
* await sso.organizations.billingCredentials.delete('acme-corp', 'stripe');
|
|
3819
|
+
* ```
|
|
3820
|
+
*/
|
|
3821
|
+
delete: (orgSlug: string, provider: "stripe" | "polar") => Promise<void>;
|
|
3822
|
+
};
|
|
3691
3823
|
}
|
|
3692
3824
|
|
|
3693
3825
|
/**
|
|
@@ -4348,6 +4480,32 @@ declare class PlatformModule {
|
|
|
4348
4480
|
* ```
|
|
4349
4481
|
*/
|
|
4350
4482
|
updateTier: (orgId: string, payload: UpdateOrganizationTierPayload) => Promise<Organization>;
|
|
4483
|
+
/**
|
|
4484
|
+
* Update an organization's feature overrides.
|
|
4485
|
+
*
|
|
4486
|
+
* @param orgId Organization ID
|
|
4487
|
+
* @param payload Feature override flags
|
|
4488
|
+
* @returns Updated organization
|
|
4489
|
+
*
|
|
4490
|
+
* @example
|
|
4491
|
+
* ```typescript
|
|
4492
|
+
* await sso.platform.organizations.updateFeatures('org-id', {
|
|
4493
|
+
* allow_saml: true,
|
|
4494
|
+
* allow_scim: false,
|
|
4495
|
+
* allow_custom_domain: true,
|
|
4496
|
+
* allow_custom_branding: false
|
|
4497
|
+
* });
|
|
4498
|
+
* ```
|
|
4499
|
+
*/
|
|
4500
|
+
updateFeatures: (orgId: string, payload: {
|
|
4501
|
+
allow_saml?: boolean;
|
|
4502
|
+
allow_scim?: boolean;
|
|
4503
|
+
allow_custom_domain?: boolean;
|
|
4504
|
+
allow_custom_branding?: boolean;
|
|
4505
|
+
allow_advanced_risk_engine?: boolean;
|
|
4506
|
+
allow_siem_integration?: boolean;
|
|
4507
|
+
allow_webhooks?: boolean;
|
|
4508
|
+
}) => Promise<Organization>;
|
|
4351
4509
|
/**
|
|
4352
4510
|
* Delete an organization and all its associated data.
|
|
4353
4511
|
* This is a destructive operation that cannot be undone.
|
|
@@ -5433,6 +5591,19 @@ declare class SsoClient {
|
|
|
5433
5591
|
* Gets the current base URL
|
|
5434
5592
|
*/
|
|
5435
5593
|
getBaseURL(): string;
|
|
5594
|
+
/**
|
|
5595
|
+
* Gets the JWKS (JSON Web Key Set) URL for JWT verification.
|
|
5596
|
+
* Use this for stateless token verification in edge functions or middleware.
|
|
5597
|
+
*
|
|
5598
|
+
* @returns The full URL to the .well-known/jwks.json endpoint
|
|
5599
|
+
*
|
|
5600
|
+
* @example
|
|
5601
|
+
* ```typescript
|
|
5602
|
+
* const jwksUrl = sso.getJwksUrl();
|
|
5603
|
+
* // Returns: "https://sso.example.com/.well-known/jwks.json"
|
|
5604
|
+
* ```
|
|
5605
|
+
*/
|
|
5606
|
+
getJwksUrl(): string;
|
|
5436
5607
|
/**
|
|
5437
5608
|
* Check if the user is currently authenticated
|
|
5438
5609
|
*/
|
|
@@ -5463,6 +5634,52 @@ declare class SsoClient {
|
|
|
5463
5634
|
getToken(): Promise<string | null>;
|
|
5464
5635
|
}
|
|
5465
5636
|
|
|
5637
|
+
/**
|
|
5638
|
+
* Standard authentication error codes returned by the AuthOS API.
|
|
5639
|
+
* Use these to reliably switch UI states based on error type.
|
|
5640
|
+
*/
|
|
5641
|
+
declare enum AuthErrorCodes {
|
|
5642
|
+
/** Multi-factor authentication is required to complete login */
|
|
5643
|
+
MFA_REQUIRED = "MFA_REQUIRED",
|
|
5644
|
+
/** User must select or create an organization */
|
|
5645
|
+
ORG_REQUIRED = "ORG_REQUIRED",
|
|
5646
|
+
/** The provided credentials are invalid */
|
|
5647
|
+
INVALID_CREDENTIALS = "INVALID_CREDENTIALS",
|
|
5648
|
+
/** The JWT token has expired */
|
|
5649
|
+
TOKEN_EXPIRED = "TOKEN_EXPIRED",
|
|
5650
|
+
/** The refresh token is invalid or has been revoked */
|
|
5651
|
+
REFRESH_TOKEN_INVALID = "REFRESH_TOKEN_INVALID",
|
|
5652
|
+
/** The user is not authorized to perform this action */
|
|
5653
|
+
UNAUTHORIZED = "UNAUTHORIZED",
|
|
5654
|
+
/** The user does not have permission for this resource */
|
|
5655
|
+
FORBIDDEN = "FORBIDDEN",
|
|
5656
|
+
/** The requested resource was not found */
|
|
5657
|
+
NOT_FOUND = "NOT_FOUND",
|
|
5658
|
+
/** The request failed validation */
|
|
5659
|
+
VALIDATION_ERROR = "VALIDATION_ERROR",
|
|
5660
|
+
/** The email address is already registered */
|
|
5661
|
+
EMAIL_ALREADY_EXISTS = "EMAIL_ALREADY_EXISTS",
|
|
5662
|
+
/** Email verification is required */
|
|
5663
|
+
EMAIL_NOT_VERIFIED = "EMAIL_NOT_VERIFIED",
|
|
5664
|
+
/** The account has been suspended */
|
|
5665
|
+
ACCOUNT_SUSPENDED = "ACCOUNT_SUSPENDED",
|
|
5666
|
+
/** The organization has been suspended */
|
|
5667
|
+
ORG_SUSPENDED = "ORG_SUSPENDED",
|
|
5668
|
+
/** Rate limit exceeded */
|
|
5669
|
+
RATE_LIMITED = "RATE_LIMITED",
|
|
5670
|
+
/** The password does not meet requirements */
|
|
5671
|
+
WEAK_PASSWORD = "WEAK_PASSWORD",
|
|
5672
|
+
/** The MFA code is invalid */
|
|
5673
|
+
INVALID_MFA_CODE = "INVALID_MFA_CODE",
|
|
5674
|
+
/** The magic link or verification token has expired */
|
|
5675
|
+
LINK_EXPIRED = "LINK_EXPIRED",
|
|
5676
|
+
/** The device code has expired */
|
|
5677
|
+
DEVICE_CODE_EXPIRED = "DEVICE_CODE_EXPIRED",
|
|
5678
|
+
/** Authorization is still pending (device flow) */
|
|
5679
|
+
AUTHORIZATION_PENDING = "AUTHORIZATION_PENDING",
|
|
5680
|
+
/** The passkey authentication failed */
|
|
5681
|
+
PASSKEY_ERROR = "PASSKEY_ERROR"
|
|
5682
|
+
}
|
|
5466
5683
|
/**
|
|
5467
5684
|
* Custom error class for SSO API errors.
|
|
5468
5685
|
* Provides structured error information from the API.
|
|
@@ -5499,4 +5716,4 @@ declare class SsoApiError extends Error {
|
|
|
5499
5716
|
isNotFound(): boolean;
|
|
5500
5717
|
}
|
|
5501
5718
|
|
|
5502
|
-
export { type AcceptInvitationPayload, type AdminLoginUrlParams, type AnalyticsQuery, type ApiKey, type ApiKeyCreateResponse, type ApproveOrganizationPayload, type AuditLog, type AuditLogEntry, type AuditLogQueryParams, type AuditLogResponse, AuthMethod, AuthModule, type AuthenticationResponseJSON, type BackupCodesResponse, type BrandingConfiguration, BrowserStorage, type ChangePasswordRequest, type ChangePasswordResponse, type ConfigureSamlPayload, type ConfigureSamlResponse, type CreateApiKeyPayload, type CreateCheckoutPayload, type CreateCheckoutResponse, type CreateInvitationPayload, type CreateOrganizationPayload, type CreateOrganizationResponse, type CreatePlanPayload, type CreateScimTokenRequest, type CreateServicePayload, type CreateServiceResponse, type CreateSiemConfigRequest, type CreateWebhookRequest, type DeclineInvitationPayload, type DeviceCodeRequest, type DeviceCodeResponse, type DeviceTrust, type DeviceVerifyResponse, type DomainConfiguration, type DomainVerificationMethod, type DomainVerificationResponse, type DomainVerificationResult, type EndUser, type EndUserDetailResponse, type EndUserIdentity, type EndUserListResponse, type EndUserSubscription, type EventTypeInfo, type ExportUserDataResponse, type ForgetUserResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GeolocationData, type GetAuditLogParams, type GetRiskSettingsResponse, type GrowthTrendPoint, type Identity, type ImpersonateRequest, type ImpersonateResponse, type ImpersonationUserInfo, type Invitation, type InvitationStatus, type InvitationWithOrg, InvitationsModule, type JwtClaims, type ListApiKeysResponse, type ListDevicesResponse, type ListEndUsersParams, type ListOrganizationsParams, type ListPlatformOrganizationsParams, type ListScimTokensResponse, type ListSiemConfigsResponse, type LoginActivityPoint, type LoginEventExport, type LoginRequest, type LoginTrendPoint, type LoginUrlParams, type LoginsByProvider, type LoginsByService, type LookupEmailRequest, type LookupEmailResponse, MagicLinks, type MemberListResponse, type MemberRole, type Membership, type MembershipExport, MemoryStorage, type MfaEventExport, type MfaSetupResponse, type MfaStatusResponse, type MfaVerificationRequest, type MfaVerificationResponse, type MfaVerifyRequest, type MfaVerifyResponse, type OAuthCredentials, type OAuthIdentityExport, type OAuthProvider, type Organization, type OrganizationMember, type OrganizationResponse, type OrganizationStatus, type OrganizationStatusBreakdown, type OrganizationTier, OrganizationsModule, type PaginatedResponse, type PaginationInfo, type PaginationParams, type Passkey, type PasskeyAuthFinishRequest, type PasskeyAuthFinishResponse, type PasskeyAuthStartRequest, type PasskeyAuthStartResponse, type PasskeyExport, type PasskeyRegisterFinishRequest, type PasskeyRegisterFinishResponse, type PasskeyRegisterStartRequest, type PasskeyRegisterStartResponse, PasskeysModule, PermissionsModule, type Plan, type PlanResponse, type PlatformAnalyticsDateRangeParams, PlatformModule, type PlatformOrganizationResponse, type PlatformOrganizationsListResponse, type PlatformOverviewMetrics, type PromotePlatformOwnerPayload, type ProviderToken, type ProviderTokenGrant, type RecentLogin, type RecentOrganization, type RefreshTokenRequest, type RefreshTokenResponse, type RegisterRequest, type RegisterResponse, type RegistrationResponseJSON, type RejectOrganizationPayload, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDeviceRequest, type RevokeDeviceResponse, type RevokeSessionsResponse, RiskAction, type RiskAnalytics, type RiskAssessment, type RiskContext, type RiskEnforcementMode, type RiskEngineConfig, type RiskEvent, RiskEventOutcome, type RiskFactor, RiskFactorType, type RiskRule, type RiskRuleCondition, type RiskScore, type RiskSettings, type SamlCertificate, type SamlConfig, type ScimTokenResponse, type Service, ServiceApiModule, type ServiceListResponse, type ServiceResponse, type ServiceType, type ServiceWithDetails, ServicesModule, type SetCustomDomainRequest, type SetOAuthCredentialsPayload, type SetPasswordRequest, type SetPasswordResponse, type SetSmtpRequest, type SiemConfigResponse, type SiemProviderType, type SmtpConfigResponse, SsoApiError, SsoClient, type SsoClientOptions, type StartLinkResponse, type Subscription, type TestConnectionResponse, type TokenRequest, type TokenResponse, type TokenStorage, type TopOrganization, type TransferOwnershipPayload, type UpdateBrandingRequest, type UpdateMemberRolePayload, type UpdateOrganizationPayload, type UpdateOrganizationTierPayload, type UpdatePlanPayload, type UpdateRiskSettingsRequest, type UpdateRiskSettingsResponse, type UpdateServicePayload, type UpdateSiemConfigRequest, type UpdateUserProfilePayload, type UpdateWebhookRequest, type User, type UserDevice, UserModule, type UserProfile, type Webhook, type WebhookDelivery, type WebhookDeliveryListResponse, type WebhookDeliveryQueryParams, type WebhookListResponse, type WebhookResponse };
|
|
5719
|
+
export { type AcceptInvitationPayload, type AdminLoginUrlParams, type AnalyticsQuery, type ApiKey, type ApiKeyCreateResponse, type ApproveOrganizationPayload, type AuditLog, type AuditLogEntry, type AuditLogQueryParams, type AuditLogResponse, AuthErrorCodes, AuthMethod, AuthModule, type AuthSnapshot, type AuthenticationResponseJSON, type BackupCodesResponse, type BrandingConfiguration, BrowserStorage, type ChangePasswordRequest, type ChangePasswordResponse, type ConfigureSamlPayload, type ConfigureSamlResponse, type CreateApiKeyPayload, type CreateCheckoutPayload, type CreateCheckoutResponse, type CreateInvitationPayload, type CreateOrganizationPayload, type CreateOrganizationResponse, type CreatePlanPayload, type CreateScimTokenRequest, type CreateServicePayload, type CreateServiceResponse, type CreateSiemConfigRequest, type CreateWebhookRequest, type DeclineInvitationPayload, type DeviceCodeRequest, type DeviceCodeResponse, type DeviceTrust, type DeviceVerifyResponse, type DomainConfiguration, type DomainVerificationMethod, type DomainVerificationResponse, type DomainVerificationResult, type EndUser, type EndUserDetailResponse, type EndUserIdentity, type EndUserListResponse, type EndUserSubscription, type EventTypeInfo, type ExportUserDataResponse, type ForgetUserResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GeolocationData, type GetAuditLogParams, type GetRiskSettingsResponse, type GrowthTrendPoint, type Identity, type ImpersonateRequest, type ImpersonateResponse, type ImpersonationUserInfo, type Invitation, type InvitationStatus, type InvitationWithOrg, InvitationsModule, type JwtClaims, type ListApiKeysResponse, type ListDevicesResponse, type ListEndUsersParams, type ListOrganizationsParams, type ListPlatformOrganizationsParams, type ListScimTokensResponse, type ListSiemConfigsResponse, type LoginActivityPoint, type LoginEventExport, type LoginRequest, type LoginTrendPoint, type LoginUrlParams, type LoginsByProvider, type LoginsByService, type LookupEmailRequest, type LookupEmailResponse, MagicLinks, type MemberListResponse, type MemberRole, type Membership, type MembershipExport, MemoryStorage, type MfaEventExport, type MfaSetupResponse, type MfaStatusResponse, type MfaVerificationRequest, type MfaVerificationResponse, type MfaVerifyRequest, type MfaVerifyResponse, type OAuthCredentials, type OAuthIdentityExport, type OAuthProvider, type Organization, type OrganizationMember, type OrganizationResponse, type OrganizationStatus, type OrganizationStatusBreakdown, type OrganizationTier, OrganizationsModule, type PaginatedResponse, type PaginationInfo, type PaginationParams, type Passkey, type PasskeyAuthFinishRequest, type PasskeyAuthFinishResponse, type PasskeyAuthStartRequest, type PasskeyAuthStartResponse, type PasskeyExport, type PasskeyRegisterFinishRequest, type PasskeyRegisterFinishResponse, type PasskeyRegisterStartRequest, type PasskeyRegisterStartResponse, PasskeysModule, PermissionsModule, type Plan, type PlanResponse, type PlatformAnalyticsDateRangeParams, PlatformModule, type PlatformOrganizationResponse, type PlatformOrganizationsListResponse, type PlatformOverviewMetrics, type PromotePlatformOwnerPayload, type ProviderToken, type ProviderTokenGrant, type RecentLogin, type RecentOrganization, type RefreshTokenRequest, type RefreshTokenResponse, type RegisterRequest, type RegisterResponse, type RegistrationResponseJSON, type RejectOrganizationPayload, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDeviceRequest, type RevokeDeviceResponse, type RevokeSessionsResponse, RiskAction, type RiskAnalytics, type RiskAssessment, type RiskContext, type RiskEnforcementMode, type RiskEngineConfig, type RiskEvent, RiskEventOutcome, type RiskFactor, RiskFactorType, type RiskRule, type RiskRuleCondition, type RiskScore, type RiskSettings, type SamlCertificate, type SamlConfig, type ScimTokenResponse, type Service, ServiceApiModule, type ServiceListResponse, type ServiceResponse, type ServiceType, type ServiceWithDetails, ServicesModule, type SetCustomDomainRequest, type SetOAuthCredentialsPayload, type SetPasswordRequest, type SetPasswordResponse, type SetSmtpRequest, type SiemConfigResponse, type SiemProviderType, type SmtpConfigResponse, SsoApiError, SsoClient, type SsoClientOptions, type StartLinkResponse, type Subscription, type TestConnectionResponse, type TokenRequest, type TokenResponse, type TokenStorage, type TopOrganization, type TransferOwnershipPayload, type UpdateBrandingRequest, type UpdateMemberRolePayload, type UpdateOrganizationPayload, type UpdateOrganizationTierPayload, type UpdatePlanPayload, type UpdateRiskSettingsRequest, type UpdateRiskSettingsResponse, type UpdateServicePayload, type UpdateSiemConfigRequest, type UpdateUserProfilePayload, type UpdateWebhookRequest, type User, type UserDevice, UserModule, type UserProfile, type Webhook, type WebhookDelivery, type WebhookDeliveryListResponse, type WebhookDeliveryQueryParams, type WebhookListResponse, type WebhookResponse };
|
package/dist/index.js
CHANGED
|
@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
|
|
|
20
20
|
// src/index.ts
|
|
21
21
|
var index_exports = {};
|
|
22
22
|
__export(index_exports, {
|
|
23
|
+
AuthErrorCodes: () => AuthErrorCodes,
|
|
23
24
|
AuthMethod: () => AuthMethod,
|
|
24
25
|
AuthModule: () => AuthModule,
|
|
25
26
|
BrowserStorage: () => BrowserStorage,
|
|
@@ -42,6 +43,29 @@ __export(index_exports, {
|
|
|
42
43
|
module.exports = __toCommonJS(index_exports);
|
|
43
44
|
|
|
44
45
|
// src/errors.ts
|
|
46
|
+
var AuthErrorCodes = /* @__PURE__ */ ((AuthErrorCodes2) => {
|
|
47
|
+
AuthErrorCodes2["MFA_REQUIRED"] = "MFA_REQUIRED";
|
|
48
|
+
AuthErrorCodes2["ORG_REQUIRED"] = "ORG_REQUIRED";
|
|
49
|
+
AuthErrorCodes2["INVALID_CREDENTIALS"] = "INVALID_CREDENTIALS";
|
|
50
|
+
AuthErrorCodes2["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
|
|
51
|
+
AuthErrorCodes2["REFRESH_TOKEN_INVALID"] = "REFRESH_TOKEN_INVALID";
|
|
52
|
+
AuthErrorCodes2["UNAUTHORIZED"] = "UNAUTHORIZED";
|
|
53
|
+
AuthErrorCodes2["FORBIDDEN"] = "FORBIDDEN";
|
|
54
|
+
AuthErrorCodes2["NOT_FOUND"] = "NOT_FOUND";
|
|
55
|
+
AuthErrorCodes2["VALIDATION_ERROR"] = "VALIDATION_ERROR";
|
|
56
|
+
AuthErrorCodes2["EMAIL_ALREADY_EXISTS"] = "EMAIL_ALREADY_EXISTS";
|
|
57
|
+
AuthErrorCodes2["EMAIL_NOT_VERIFIED"] = "EMAIL_NOT_VERIFIED";
|
|
58
|
+
AuthErrorCodes2["ACCOUNT_SUSPENDED"] = "ACCOUNT_SUSPENDED";
|
|
59
|
+
AuthErrorCodes2["ORG_SUSPENDED"] = "ORG_SUSPENDED";
|
|
60
|
+
AuthErrorCodes2["RATE_LIMITED"] = "RATE_LIMITED";
|
|
61
|
+
AuthErrorCodes2["WEAK_PASSWORD"] = "WEAK_PASSWORD";
|
|
62
|
+
AuthErrorCodes2["INVALID_MFA_CODE"] = "INVALID_MFA_CODE";
|
|
63
|
+
AuthErrorCodes2["LINK_EXPIRED"] = "LINK_EXPIRED";
|
|
64
|
+
AuthErrorCodes2["DEVICE_CODE_EXPIRED"] = "DEVICE_CODE_EXPIRED";
|
|
65
|
+
AuthErrorCodes2["AUTHORIZATION_PENDING"] = "AUTHORIZATION_PENDING";
|
|
66
|
+
AuthErrorCodes2["PASSKEY_ERROR"] = "PASSKEY_ERROR";
|
|
67
|
+
return AuthErrorCodes2;
|
|
68
|
+
})(AuthErrorCodes || {});
|
|
45
69
|
var SsoApiError = class _SsoApiError extends Error {
|
|
46
70
|
constructor(message, statusCode, errorCode, timestamp) {
|
|
47
71
|
super(message);
|
|
@@ -334,10 +358,22 @@ var SessionManager = class {
|
|
|
334
358
|
return !!this.accessToken;
|
|
335
359
|
}
|
|
336
360
|
/**
|
|
337
|
-
*
|
|
361
|
+
* Get a synchronous snapshot of the current auth state.
|
|
362
|
+
* Useful for SSR hydration and initial state.
|
|
363
|
+
*/
|
|
364
|
+
getSnapshot() {
|
|
365
|
+
return {
|
|
366
|
+
isAuthenticated: !!this.accessToken,
|
|
367
|
+
token: this.accessToken
|
|
368
|
+
};
|
|
369
|
+
}
|
|
370
|
+
/**
|
|
371
|
+
* Subscribe to auth state changes (useful for UI updates).
|
|
372
|
+
* The listener is immediately called with the current state upon subscription.
|
|
338
373
|
*/
|
|
339
374
|
subscribe(listener) {
|
|
340
375
|
this.listeners.push(listener);
|
|
376
|
+
listener(this.isAuthenticated());
|
|
341
377
|
return () => {
|
|
342
378
|
this.listeners = this.listeners.filter((l) => l !== listener);
|
|
343
379
|
};
|
|
@@ -1986,6 +2022,137 @@ var OrganizationsModule = class {
|
|
|
1986
2022
|
return response.data;
|
|
1987
2023
|
}
|
|
1988
2024
|
};
|
|
2025
|
+
// ============================================================================
|
|
2026
|
+
// BILLING
|
|
2027
|
+
// ============================================================================
|
|
2028
|
+
/**
|
|
2029
|
+
* Billing and subscription management methods
|
|
2030
|
+
*/
|
|
2031
|
+
this.billing = {
|
|
2032
|
+
/**
|
|
2033
|
+
* Get billing information for an organization.
|
|
2034
|
+
* Returns whether a billing account exists and which provider is being used.
|
|
2035
|
+
* Requires 'owner' or 'admin' role.
|
|
2036
|
+
*
|
|
2037
|
+
* @param orgSlug Organization slug
|
|
2038
|
+
* @returns Billing information
|
|
2039
|
+
*
|
|
2040
|
+
* @example
|
|
2041
|
+
* ```typescript
|
|
2042
|
+
* const info = await sso.organizations.billing.getInfo('acme-corp');
|
|
2043
|
+
* if (info.has_billing_account) {
|
|
2044
|
+
* console.log('Billing provider:', info.provider);
|
|
2045
|
+
* }
|
|
2046
|
+
* ```
|
|
2047
|
+
*/
|
|
2048
|
+
getInfo: async (orgSlug) => {
|
|
2049
|
+
const response = await this.http.get(
|
|
2050
|
+
`/api/organizations/${orgSlug}/billing/info`
|
|
2051
|
+
);
|
|
2052
|
+
return response.data;
|
|
2053
|
+
},
|
|
2054
|
+
/**
|
|
2055
|
+
* Create a billing portal session.
|
|
2056
|
+
* Redirects the user to the billing provider's self-service portal to manage their subscription,
|
|
2057
|
+
* update payment methods, view invoices, etc.
|
|
2058
|
+
* Requires 'owner' role.
|
|
2059
|
+
*
|
|
2060
|
+
* @param orgSlug Organization slug
|
|
2061
|
+
* @param returnUrl URL to redirect the user to after they leave the portal
|
|
2062
|
+
* @returns Object containing the portal session URL
|
|
2063
|
+
*
|
|
2064
|
+
* @example
|
|
2065
|
+
* ```typescript
|
|
2066
|
+
* const session = await sso.organizations.billing.createPortalSession('acme-corp', {
|
|
2067
|
+
* return_url: 'https://app.acme.com/billing'
|
|
2068
|
+
* });
|
|
2069
|
+
* // Redirect user to billing portal
|
|
2070
|
+
* window.location.href = session.url;
|
|
2071
|
+
* ```
|
|
2072
|
+
*/
|
|
2073
|
+
createPortalSession: async (orgSlug, payload) => {
|
|
2074
|
+
const response = await this.http.post(
|
|
2075
|
+
`/api/organizations/${orgSlug}/billing/portal`,
|
|
2076
|
+
payload
|
|
2077
|
+
);
|
|
2078
|
+
return response.data;
|
|
2079
|
+
}
|
|
2080
|
+
};
|
|
2081
|
+
// ============================================================================
|
|
2082
|
+
// BYOP - BRING YOUR OWN PAYMENT
|
|
2083
|
+
// ============================================================================
|
|
2084
|
+
/**
|
|
2085
|
+
* BYOP (Bring Your Own Payment) credential management.
|
|
2086
|
+
* Allows organizations to configure their own billing provider credentials
|
|
2087
|
+
* to charge their end-users directly.
|
|
2088
|
+
*/
|
|
2089
|
+
this.billingCredentials = {
|
|
2090
|
+
/**
|
|
2091
|
+
* Get the status of billing credentials for a provider.
|
|
2092
|
+
* Returns whether credentials are configured and the mode (test/live).
|
|
2093
|
+
* Requires 'owner' role.
|
|
2094
|
+
*
|
|
2095
|
+
* @param orgSlug Organization slug
|
|
2096
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
2097
|
+
* @returns Credential configuration status
|
|
2098
|
+
*
|
|
2099
|
+
* @example
|
|
2100
|
+
* ```typescript
|
|
2101
|
+
* const status = await sso.organizations.billingCredentials.get('acme-corp', 'stripe');
|
|
2102
|
+
* if (status.configured) {
|
|
2103
|
+
* console.log('Mode:', status.mode); // 'test' or 'live'
|
|
2104
|
+
* console.log('Enabled:', status.enabled);
|
|
2105
|
+
* }
|
|
2106
|
+
* ```
|
|
2107
|
+
*/
|
|
2108
|
+
get: async (orgSlug, provider) => {
|
|
2109
|
+
const response = await this.http.get(`/api/organizations/${orgSlug}/billing-credentials/${provider}`);
|
|
2110
|
+
return response.data;
|
|
2111
|
+
},
|
|
2112
|
+
/**
|
|
2113
|
+
* Set or update billing credentials for a provider.
|
|
2114
|
+
* Enables the organization to charge their end-users using their own
|
|
2115
|
+
* payment provider account.
|
|
2116
|
+
* Requires 'owner' role.
|
|
2117
|
+
*
|
|
2118
|
+
* @param orgSlug Organization slug
|
|
2119
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
2120
|
+
* @param payload Billing credentials
|
|
2121
|
+
*
|
|
2122
|
+
* @example
|
|
2123
|
+
* ```typescript
|
|
2124
|
+
* await sso.organizations.billingCredentials.set('acme-corp', 'stripe', {
|
|
2125
|
+
* api_key: 'sk_live_...',
|
|
2126
|
+
* webhook_secret: 'whsec_...',
|
|
2127
|
+
* mode: 'live'
|
|
2128
|
+
* });
|
|
2129
|
+
* ```
|
|
2130
|
+
*/
|
|
2131
|
+
set: async (orgSlug, provider, payload) => {
|
|
2132
|
+
await this.http.post(
|
|
2133
|
+
`/api/organizations/${orgSlug}/billing-credentials/${provider}`,
|
|
2134
|
+
payload
|
|
2135
|
+
);
|
|
2136
|
+
},
|
|
2137
|
+
/**
|
|
2138
|
+
* Delete billing credentials for a provider.
|
|
2139
|
+
* The organization will no longer be able to charge end-users directly.
|
|
2140
|
+
* Requires 'owner' role.
|
|
2141
|
+
*
|
|
2142
|
+
* @param orgSlug Organization slug
|
|
2143
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
2144
|
+
*
|
|
2145
|
+
* @example
|
|
2146
|
+
* ```typescript
|
|
2147
|
+
* await sso.organizations.billingCredentials.delete('acme-corp', 'stripe');
|
|
2148
|
+
* ```
|
|
2149
|
+
*/
|
|
2150
|
+
delete: async (orgSlug, provider) => {
|
|
2151
|
+
await this.http.delete(
|
|
2152
|
+
`/api/organizations/${orgSlug}/billing-credentials/${provider}`
|
|
2153
|
+
);
|
|
2154
|
+
}
|
|
2155
|
+
};
|
|
1989
2156
|
this.auditLogs = new AuditLogsModule(http);
|
|
1990
2157
|
this.webhooks = new WebhooksModule(http);
|
|
1991
2158
|
}
|
|
@@ -3122,6 +3289,30 @@ var PlatformModule = class {
|
|
|
3122
3289
|
);
|
|
3123
3290
|
return response.data;
|
|
3124
3291
|
},
|
|
3292
|
+
/**
|
|
3293
|
+
* Update an organization's feature overrides.
|
|
3294
|
+
*
|
|
3295
|
+
* @param orgId Organization ID
|
|
3296
|
+
* @param payload Feature override flags
|
|
3297
|
+
* @returns Updated organization
|
|
3298
|
+
*
|
|
3299
|
+
* @example
|
|
3300
|
+
* ```typescript
|
|
3301
|
+
* await sso.platform.organizations.updateFeatures('org-id', {
|
|
3302
|
+
* allow_saml: true,
|
|
3303
|
+
* allow_scim: false,
|
|
3304
|
+
* allow_custom_domain: true,
|
|
3305
|
+
* allow_custom_branding: false
|
|
3306
|
+
* });
|
|
3307
|
+
* ```
|
|
3308
|
+
*/
|
|
3309
|
+
updateFeatures: async (orgId, payload) => {
|
|
3310
|
+
const response = await this.http.patch(
|
|
3311
|
+
`/api/platform/organizations/${orgId}/features`,
|
|
3312
|
+
payload
|
|
3313
|
+
);
|
|
3314
|
+
return response.data;
|
|
3315
|
+
},
|
|
3125
3316
|
/**
|
|
3126
3317
|
* Delete an organization and all its associated data.
|
|
3127
3318
|
* This is a destructive operation that cannot be undone.
|
|
@@ -4329,6 +4520,22 @@ var SsoClient = class {
|
|
|
4329
4520
|
getBaseURL() {
|
|
4330
4521
|
return this.http.defaults.baseURL || "";
|
|
4331
4522
|
}
|
|
4523
|
+
/**
|
|
4524
|
+
* Gets the JWKS (JSON Web Key Set) URL for JWT verification.
|
|
4525
|
+
* Use this for stateless token verification in edge functions or middleware.
|
|
4526
|
+
*
|
|
4527
|
+
* @returns The full URL to the .well-known/jwks.json endpoint
|
|
4528
|
+
*
|
|
4529
|
+
* @example
|
|
4530
|
+
* ```typescript
|
|
4531
|
+
* const jwksUrl = sso.getJwksUrl();
|
|
4532
|
+
* // Returns: "https://sso.example.com/.well-known/jwks.json"
|
|
4533
|
+
* ```
|
|
4534
|
+
*/
|
|
4535
|
+
getJwksUrl() {
|
|
4536
|
+
const baseUrl = this.getBaseURL().replace(/\/$/, "");
|
|
4537
|
+
return `${baseUrl}/.well-known/jwks.json`;
|
|
4538
|
+
}
|
|
4332
4539
|
/**
|
|
4333
4540
|
* Check if the user is currently authenticated
|
|
4334
4541
|
*/
|
|
@@ -4406,6 +4613,7 @@ var RiskEventOutcome = /* @__PURE__ */ ((RiskEventOutcome2) => {
|
|
|
4406
4613
|
})(RiskEventOutcome || {});
|
|
4407
4614
|
// Annotate the CommonJS export names for ESM import in node:
|
|
4408
4615
|
0 && (module.exports = {
|
|
4616
|
+
AuthErrorCodes,
|
|
4409
4617
|
AuthMethod,
|
|
4410
4618
|
AuthModule,
|
|
4411
4619
|
BrowserStorage,
|
package/dist/index.mjs
CHANGED
|
@@ -1,4 +1,27 @@
|
|
|
1
1
|
// src/errors.ts
|
|
2
|
+
var AuthErrorCodes = /* @__PURE__ */ ((AuthErrorCodes2) => {
|
|
3
|
+
AuthErrorCodes2["MFA_REQUIRED"] = "MFA_REQUIRED";
|
|
4
|
+
AuthErrorCodes2["ORG_REQUIRED"] = "ORG_REQUIRED";
|
|
5
|
+
AuthErrorCodes2["INVALID_CREDENTIALS"] = "INVALID_CREDENTIALS";
|
|
6
|
+
AuthErrorCodes2["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
|
|
7
|
+
AuthErrorCodes2["REFRESH_TOKEN_INVALID"] = "REFRESH_TOKEN_INVALID";
|
|
8
|
+
AuthErrorCodes2["UNAUTHORIZED"] = "UNAUTHORIZED";
|
|
9
|
+
AuthErrorCodes2["FORBIDDEN"] = "FORBIDDEN";
|
|
10
|
+
AuthErrorCodes2["NOT_FOUND"] = "NOT_FOUND";
|
|
11
|
+
AuthErrorCodes2["VALIDATION_ERROR"] = "VALIDATION_ERROR";
|
|
12
|
+
AuthErrorCodes2["EMAIL_ALREADY_EXISTS"] = "EMAIL_ALREADY_EXISTS";
|
|
13
|
+
AuthErrorCodes2["EMAIL_NOT_VERIFIED"] = "EMAIL_NOT_VERIFIED";
|
|
14
|
+
AuthErrorCodes2["ACCOUNT_SUSPENDED"] = "ACCOUNT_SUSPENDED";
|
|
15
|
+
AuthErrorCodes2["ORG_SUSPENDED"] = "ORG_SUSPENDED";
|
|
16
|
+
AuthErrorCodes2["RATE_LIMITED"] = "RATE_LIMITED";
|
|
17
|
+
AuthErrorCodes2["WEAK_PASSWORD"] = "WEAK_PASSWORD";
|
|
18
|
+
AuthErrorCodes2["INVALID_MFA_CODE"] = "INVALID_MFA_CODE";
|
|
19
|
+
AuthErrorCodes2["LINK_EXPIRED"] = "LINK_EXPIRED";
|
|
20
|
+
AuthErrorCodes2["DEVICE_CODE_EXPIRED"] = "DEVICE_CODE_EXPIRED";
|
|
21
|
+
AuthErrorCodes2["AUTHORIZATION_PENDING"] = "AUTHORIZATION_PENDING";
|
|
22
|
+
AuthErrorCodes2["PASSKEY_ERROR"] = "PASSKEY_ERROR";
|
|
23
|
+
return AuthErrorCodes2;
|
|
24
|
+
})(AuthErrorCodes || {});
|
|
2
25
|
var SsoApiError = class _SsoApiError extends Error {
|
|
3
26
|
constructor(message, statusCode, errorCode, timestamp) {
|
|
4
27
|
super(message);
|
|
@@ -291,10 +314,22 @@ var SessionManager = class {
|
|
|
291
314
|
return !!this.accessToken;
|
|
292
315
|
}
|
|
293
316
|
/**
|
|
294
|
-
*
|
|
317
|
+
* Get a synchronous snapshot of the current auth state.
|
|
318
|
+
* Useful for SSR hydration and initial state.
|
|
319
|
+
*/
|
|
320
|
+
getSnapshot() {
|
|
321
|
+
return {
|
|
322
|
+
isAuthenticated: !!this.accessToken,
|
|
323
|
+
token: this.accessToken
|
|
324
|
+
};
|
|
325
|
+
}
|
|
326
|
+
/**
|
|
327
|
+
* Subscribe to auth state changes (useful for UI updates).
|
|
328
|
+
* The listener is immediately called with the current state upon subscription.
|
|
295
329
|
*/
|
|
296
330
|
subscribe(listener) {
|
|
297
331
|
this.listeners.push(listener);
|
|
332
|
+
listener(this.isAuthenticated());
|
|
298
333
|
return () => {
|
|
299
334
|
this.listeners = this.listeners.filter((l) => l !== listener);
|
|
300
335
|
};
|
|
@@ -1943,6 +1978,137 @@ var OrganizationsModule = class {
|
|
|
1943
1978
|
return response.data;
|
|
1944
1979
|
}
|
|
1945
1980
|
};
|
|
1981
|
+
// ============================================================================
|
|
1982
|
+
// BILLING
|
|
1983
|
+
// ============================================================================
|
|
1984
|
+
/**
|
|
1985
|
+
* Billing and subscription management methods
|
|
1986
|
+
*/
|
|
1987
|
+
this.billing = {
|
|
1988
|
+
/**
|
|
1989
|
+
* Get billing information for an organization.
|
|
1990
|
+
* Returns whether a billing account exists and which provider is being used.
|
|
1991
|
+
* Requires 'owner' or 'admin' role.
|
|
1992
|
+
*
|
|
1993
|
+
* @param orgSlug Organization slug
|
|
1994
|
+
* @returns Billing information
|
|
1995
|
+
*
|
|
1996
|
+
* @example
|
|
1997
|
+
* ```typescript
|
|
1998
|
+
* const info = await sso.organizations.billing.getInfo('acme-corp');
|
|
1999
|
+
* if (info.has_billing_account) {
|
|
2000
|
+
* console.log('Billing provider:', info.provider);
|
|
2001
|
+
* }
|
|
2002
|
+
* ```
|
|
2003
|
+
*/
|
|
2004
|
+
getInfo: async (orgSlug) => {
|
|
2005
|
+
const response = await this.http.get(
|
|
2006
|
+
`/api/organizations/${orgSlug}/billing/info`
|
|
2007
|
+
);
|
|
2008
|
+
return response.data;
|
|
2009
|
+
},
|
|
2010
|
+
/**
|
|
2011
|
+
* Create a billing portal session.
|
|
2012
|
+
* Redirects the user to the billing provider's self-service portal to manage their subscription,
|
|
2013
|
+
* update payment methods, view invoices, etc.
|
|
2014
|
+
* Requires 'owner' role.
|
|
2015
|
+
*
|
|
2016
|
+
* @param orgSlug Organization slug
|
|
2017
|
+
* @param returnUrl URL to redirect the user to after they leave the portal
|
|
2018
|
+
* @returns Object containing the portal session URL
|
|
2019
|
+
*
|
|
2020
|
+
* @example
|
|
2021
|
+
* ```typescript
|
|
2022
|
+
* const session = await sso.organizations.billing.createPortalSession('acme-corp', {
|
|
2023
|
+
* return_url: 'https://app.acme.com/billing'
|
|
2024
|
+
* });
|
|
2025
|
+
* // Redirect user to billing portal
|
|
2026
|
+
* window.location.href = session.url;
|
|
2027
|
+
* ```
|
|
2028
|
+
*/
|
|
2029
|
+
createPortalSession: async (orgSlug, payload) => {
|
|
2030
|
+
const response = await this.http.post(
|
|
2031
|
+
`/api/organizations/${orgSlug}/billing/portal`,
|
|
2032
|
+
payload
|
|
2033
|
+
);
|
|
2034
|
+
return response.data;
|
|
2035
|
+
}
|
|
2036
|
+
};
|
|
2037
|
+
// ============================================================================
|
|
2038
|
+
// BYOP - BRING YOUR OWN PAYMENT
|
|
2039
|
+
// ============================================================================
|
|
2040
|
+
/**
|
|
2041
|
+
* BYOP (Bring Your Own Payment) credential management.
|
|
2042
|
+
* Allows organizations to configure their own billing provider credentials
|
|
2043
|
+
* to charge their end-users directly.
|
|
2044
|
+
*/
|
|
2045
|
+
this.billingCredentials = {
|
|
2046
|
+
/**
|
|
2047
|
+
* Get the status of billing credentials for a provider.
|
|
2048
|
+
* Returns whether credentials are configured and the mode (test/live).
|
|
2049
|
+
* Requires 'owner' role.
|
|
2050
|
+
*
|
|
2051
|
+
* @param orgSlug Organization slug
|
|
2052
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
2053
|
+
* @returns Credential configuration status
|
|
2054
|
+
*
|
|
2055
|
+
* @example
|
|
2056
|
+
* ```typescript
|
|
2057
|
+
* const status = await sso.organizations.billingCredentials.get('acme-corp', 'stripe');
|
|
2058
|
+
* if (status.configured) {
|
|
2059
|
+
* console.log('Mode:', status.mode); // 'test' or 'live'
|
|
2060
|
+
* console.log('Enabled:', status.enabled);
|
|
2061
|
+
* }
|
|
2062
|
+
* ```
|
|
2063
|
+
*/
|
|
2064
|
+
get: async (orgSlug, provider) => {
|
|
2065
|
+
const response = await this.http.get(`/api/organizations/${orgSlug}/billing-credentials/${provider}`);
|
|
2066
|
+
return response.data;
|
|
2067
|
+
},
|
|
2068
|
+
/**
|
|
2069
|
+
* Set or update billing credentials for a provider.
|
|
2070
|
+
* Enables the organization to charge their end-users using their own
|
|
2071
|
+
* payment provider account.
|
|
2072
|
+
* Requires 'owner' role.
|
|
2073
|
+
*
|
|
2074
|
+
* @param orgSlug Organization slug
|
|
2075
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
2076
|
+
* @param payload Billing credentials
|
|
2077
|
+
*
|
|
2078
|
+
* @example
|
|
2079
|
+
* ```typescript
|
|
2080
|
+
* await sso.organizations.billingCredentials.set('acme-corp', 'stripe', {
|
|
2081
|
+
* api_key: 'sk_live_...',
|
|
2082
|
+
* webhook_secret: 'whsec_...',
|
|
2083
|
+
* mode: 'live'
|
|
2084
|
+
* });
|
|
2085
|
+
* ```
|
|
2086
|
+
*/
|
|
2087
|
+
set: async (orgSlug, provider, payload) => {
|
|
2088
|
+
await this.http.post(
|
|
2089
|
+
`/api/organizations/${orgSlug}/billing-credentials/${provider}`,
|
|
2090
|
+
payload
|
|
2091
|
+
);
|
|
2092
|
+
},
|
|
2093
|
+
/**
|
|
2094
|
+
* Delete billing credentials for a provider.
|
|
2095
|
+
* The organization will no longer be able to charge end-users directly.
|
|
2096
|
+
* Requires 'owner' role.
|
|
2097
|
+
*
|
|
2098
|
+
* @param orgSlug Organization slug
|
|
2099
|
+
* @param provider Billing provider ('stripe' or 'polar')
|
|
2100
|
+
*
|
|
2101
|
+
* @example
|
|
2102
|
+
* ```typescript
|
|
2103
|
+
* await sso.organizations.billingCredentials.delete('acme-corp', 'stripe');
|
|
2104
|
+
* ```
|
|
2105
|
+
*/
|
|
2106
|
+
delete: async (orgSlug, provider) => {
|
|
2107
|
+
await this.http.delete(
|
|
2108
|
+
`/api/organizations/${orgSlug}/billing-credentials/${provider}`
|
|
2109
|
+
);
|
|
2110
|
+
}
|
|
2111
|
+
};
|
|
1946
2112
|
this.auditLogs = new AuditLogsModule(http);
|
|
1947
2113
|
this.webhooks = new WebhooksModule(http);
|
|
1948
2114
|
}
|
|
@@ -3079,6 +3245,30 @@ var PlatformModule = class {
|
|
|
3079
3245
|
);
|
|
3080
3246
|
return response.data;
|
|
3081
3247
|
},
|
|
3248
|
+
/**
|
|
3249
|
+
* Update an organization's feature overrides.
|
|
3250
|
+
*
|
|
3251
|
+
* @param orgId Organization ID
|
|
3252
|
+
* @param payload Feature override flags
|
|
3253
|
+
* @returns Updated organization
|
|
3254
|
+
*
|
|
3255
|
+
* @example
|
|
3256
|
+
* ```typescript
|
|
3257
|
+
* await sso.platform.organizations.updateFeatures('org-id', {
|
|
3258
|
+
* allow_saml: true,
|
|
3259
|
+
* allow_scim: false,
|
|
3260
|
+
* allow_custom_domain: true,
|
|
3261
|
+
* allow_custom_branding: false
|
|
3262
|
+
* });
|
|
3263
|
+
* ```
|
|
3264
|
+
*/
|
|
3265
|
+
updateFeatures: async (orgId, payload) => {
|
|
3266
|
+
const response = await this.http.patch(
|
|
3267
|
+
`/api/platform/organizations/${orgId}/features`,
|
|
3268
|
+
payload
|
|
3269
|
+
);
|
|
3270
|
+
return response.data;
|
|
3271
|
+
},
|
|
3082
3272
|
/**
|
|
3083
3273
|
* Delete an organization and all its associated data.
|
|
3084
3274
|
* This is a destructive operation that cannot be undone.
|
|
@@ -4286,6 +4476,22 @@ var SsoClient = class {
|
|
|
4286
4476
|
getBaseURL() {
|
|
4287
4477
|
return this.http.defaults.baseURL || "";
|
|
4288
4478
|
}
|
|
4479
|
+
/**
|
|
4480
|
+
* Gets the JWKS (JSON Web Key Set) URL for JWT verification.
|
|
4481
|
+
* Use this for stateless token verification in edge functions or middleware.
|
|
4482
|
+
*
|
|
4483
|
+
* @returns The full URL to the .well-known/jwks.json endpoint
|
|
4484
|
+
*
|
|
4485
|
+
* @example
|
|
4486
|
+
* ```typescript
|
|
4487
|
+
* const jwksUrl = sso.getJwksUrl();
|
|
4488
|
+
* // Returns: "https://sso.example.com/.well-known/jwks.json"
|
|
4489
|
+
* ```
|
|
4490
|
+
*/
|
|
4491
|
+
getJwksUrl() {
|
|
4492
|
+
const baseUrl = this.getBaseURL().replace(/\/$/, "");
|
|
4493
|
+
return `${baseUrl}/.well-known/jwks.json`;
|
|
4494
|
+
}
|
|
4289
4495
|
/**
|
|
4290
4496
|
* Check if the user is currently authenticated
|
|
4291
4497
|
*/
|
|
@@ -4362,6 +4568,7 @@ var RiskEventOutcome = /* @__PURE__ */ ((RiskEventOutcome2) => {
|
|
|
4362
4568
|
return RiskEventOutcome2;
|
|
4363
4569
|
})(RiskEventOutcome || {});
|
|
4364
4570
|
export {
|
|
4571
|
+
AuthErrorCodes,
|
|
4365
4572
|
AuthMethod,
|
|
4366
4573
|
AuthModule,
|
|
4367
4574
|
BrowserStorage,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@drmhse/sso-sdk",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.4",
|
|
4
4
|
"description": "Zero-dependency TypeScript SDK for AuthOS, the multi-tenant authentication platform",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.mjs",
|
|
@@ -60,4 +60,4 @@
|
|
|
60
60
|
"publishConfig": {
|
|
61
61
|
"access": "public"
|
|
62
62
|
}
|
|
63
|
-
}
|
|
63
|
+
}
|