@faable/auth-sdk 1.3.35 → 2.0.1

package/README.md

@@ -25,53 +25,66 @@ npm install @faable/auth-sdk
 
 ## Authentication
 
-The SDK accepts any auth strategy from [`@faable/sdk-base`](https://www.npmjs.com/package/@faable/sdk-base). Two strategies are typically used:
+Auth is **explicit and pluggable**: you pick an `authStrategy` and pass its
+config in `auth`. The SDK **never reads credentials from the environment** —
+read them yourself and pass them in. The strategy you choose drives the type of
+`auth`, so the editor autocompletes the right fields. The strategies are
+re-exported from `@faable/auth-sdk`, so you only ever import from this package.
+
+> **Breaking change (v2):** the old `createClientCredentials()` /
+> `createApikeyAuth()` helpers (which read `FAABLE_*` env vars automatically)
+> were removed. Use the `authStrategy` + `auth` pair below. `domain` is now
+> **required** — there is no hardcoded default host anymore.
 
 ### Client credentials (recommended)
 
-Reads `FAABLE_CLIENT_ID`, `FAABLE_CLIENT_SECRET` and `FAABLE_DOMAIN` from the environment by default:
+`authClientCredentials` is the **default** strategy, so you only pass `auth`
+with `{ client_id, client_secret }` — no need to set `authStrategy`:
 
 ```ts
 import { FaableAuthApi } from "@faable/auth-sdk";
-import { createClientCredentials } from "@faable/sdk-base";
 
 const api = FaableAuthApi.create({
-  auth: createClientCredentials(),
-  team_id: "team_xxxxxxxxxxxxxxxxxxxxxxxx",
+  domain: "https://<your-account>.auth.faable.link",
+  auth: {
+    client_id: process.env.FAABLEAUTH_CLIENT_ID!,
+    client_secret: process.env.FAABLEAUTH_CLIENT_SECRET!,
+  },
 });
 ```
 
-You may also pass credentials explicitly:
+By default the token is requested from `<domain>/oauth/token`. If your API host
+is **not** the auth server, override it with `auth.domain`:
 
 ```ts
-const auth = createClientCredentials({
-  client_id: process.env.FAABLE_CLIENT_ID!,
-  client_secret: process.env.FAABLE_CLIENT_SECRET!,
-  domain: "faable.auth.faable.link",
-});
+auth: {
+  client_id: "...",
+  client_secret: "...",
+  domain: "https://<your-account>.auth.faable.link", // where /oauth/token lives
+}
 ```
 
 ### API key
 
 ```ts
-import { FaableAuthApi } from "@faable/auth-sdk";
-import { createApikeyAuth } from "@faable/sdk-base";
+import { FaableAuthApi, authApikey } from "@faable/auth-sdk";
 
 const api = FaableAuthApi.create({
-  auth: createApikeyAuth("fak_xxxxxxxxxxxxxxxx"),
-  team_id: "team_xxxxxxxxxxxxxxxxxxxxxxxx",
+  domain: "https://<your-account>.auth.faable.link",
+  authStrategy: authApikey,
+  auth: { apikey: "fak_xxxxxxxxxxxxxxxx" },
 });
 ```
 
 ### Constructor options
 
-| Option       | Type     | Description                                                                                  |
-| ------------ | -------- | -------------------------------------------------------------------------------------------- |
-| `auth`       | strategy | Auth strategy from `@faable/sdk-base`. Required.                                             |
-| `team_id`    | string   | Scopes calls to a specific team (sent as `x-faable-team` header).                            |
-| `account_id` | string   | Scopes calls to a specific FaableAuth account (sent as `x-faableauth-account` header).       |
-| `domain`     | string   | Override the API host. Defaults to `https://faable.auth.faable.link`.                        |
-| `debug`      | boolean  | Enables verbose logging in the underlying fetcher.                                           |
+| Option         | Type                                  | Description                                                                                                                  |
+| -------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `domain`       | string                                | **Required.** The account host to target, e.g. `https://<your-account>.auth.faable.link`. No default.                       |
+| `authStrategy` | strategy builder                      | Auth strategy (`authClientCredentials` \| `authApikey`), re-exported from `@faable/auth-sdk`. Defaults to `authClientCredentials`. |
+| `auth`         | config                                | Config for the chosen strategy. Its shape is inferred from `authStrategy` (e.g. `{ client_id, client_secret }`).            |
+| `debug`        | boolean                               | Enables verbose logging in the underlying fetcher.                                                                          |
+| `headers`      | `{ team_id?; account_id? }`           | Advanced / testing escape hatch — target `domain` but have the server resolve a different team/account (sent as `x-faable-team` / `x-faableauth-account`). |
 
 ---
 

package/dist/FaableAuthApi.d.ts

@@ -1,9 +1,20 @@
 import { TeamCreate, UserCreate, UserUpdate } from "./api/api-types.js";
 import { ApiParams, FaableApi } from "@faable/sdk-base";
 type FaableAuthApiParams = {
-    team_id?: string;
-    account_id?: string;
-    domain?: string;
+    domain: string;
+    /**
+     * Advanced / testing escape hatch: keep targeting `domain` but have the
+     * server resolve a DIFFERENT team or account, via request headers. Only the
+     * dashboard and some tests need this (e.g. point at a concrete host but
+     * resolve another account) — it is intentionally kept out of the normal
+     * config surface. Maps to:
+     *   - `team_id`    → `x-faable-team`
+     *   - `account_id` → `x-faableauth-account`
+     */
+    headers?: {
+        team_id?: string;
+        account_id?: string;
+    };
 } & ApiParams;
 export declare class FaableAuthApi extends FaableApi {
     constructor(params?: FaableAuthApiParams);

package/dist/FaableAuthApi.js

@@ -4,10 +4,12 @@ import { FaableApi } from "@faable/sdk-base";
 import { version } from "./version.js";
 export class FaableAuthApi extends FaableApi {
     constructor(params) {
-        let baseURL = "https://faable.auth.faable.link";
-        if (params?.domain) {
-            baseURL = getDomain(params.domain);
+        if (!params?.domain) {
+            throw new FaableApiError("FaableAuthApi: `domain` is required. Pass your account host, e.g. " +
+                "`new FaableAuthApi({ domain: 'https://<your-account>.auth.faable.link', ... })`. " +
+                "The hardcoded default was removed so SDK calls never target another tenant by accident.");
         }
+        const baseURL = getDomain(params.domain);
         super({
             baseURL,
             ...params,
@@ -20,9 +22,11 @@ export class FaableAuthApi extends FaableApi {
                     // canonical logs). Format: `<name>/<version>`.
                     "x-faable-client": `auth-sdk/${version}`,
                     ...params?.fetcher?.headers,
-                    ...(params?.team_id && { "x-faable-team": params.team_id }),
-                    ...(params?.account_id && {
-                        "x-faableauth-account": params.account_id,
+                    ...(params?.headers?.team_id && {
+                        "x-faable-team": params.headers.team_id,
+                    }),
+                    ...(params?.headers?.account_id && {
+                        "x-faableauth-account": params.headers.account_id,
                     }),
                 },
             },

package/dist/index.d.ts

@@ -1,3 +1,5 @@
 export * from "./FaableAuthApi.js";
 export * from "./api/api-types.js";
 export * from "./api/types.js";
+export { authClientCredentials, authApikey } from "@faable/sdk-base";
+export type { ApiParams, ClientCredentialsConfig, ApikeyConfig, AuthStrategy, AuthStrategyBuilder, AuthStrategyContext, } from "@faable/sdk-base";

package/dist/index.js

@@ -1,3 +1,7 @@
 export * from "./FaableAuthApi.js";
 export * from "./api/api-types.js";
 export * from "./api/types.js";
+// Re-export the auth strategies (and their config/types) from
+// @faable/sdk-base so consumers depend on @faable/auth-sdk ONLY — sdk-base
+// stays a transitive dependency and no app needs to import it directly.
+export { authClientCredentials, authApikey } from "@faable/sdk-base";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "1.3.35",
+  "version": "2.0.1",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@faable/sdk-base": "^1.1.2"
+    "@faable/sdk-base": "^1.5.0"
   },
   "devDependencies": {
     "@ava/typescript": "^5.0.0",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "1.10.10",
+    "version": "1.11.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"