@faable/auth-sdk 2.6.16 → 2.6.18

package/dist/api/generated-client.d.ts

@@ -2165,6 +2165,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `GET /internal/usage/sms` — operationId: `internal/smsUsage`
+     *
+     * SMS sent per tenant in a month (platform)
+     */
+    internalSmsUsage(params?: OpQuery<"internal/smsUsage">): Promise<{
+        month: string;
+        rows: {
+            account_id: string;
+            team: string | null;
+            sent: number;
+        }[];
+    }>;
     /**
      * `GET /log/{log_id}` — operationId: `log/get`
      *
@@ -4285,6 +4298,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             createdAt: string;
             expires_at: string;
             ttl: number;
+            channel: string;
             link?: string | undefined;
         }[];
     }>;
@@ -4297,6 +4311,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "sent";
         credential_id: string;
         ticket_id: string;
+        channel: "email" | "sms" | "whatsapp" | "factor";
     }>;
     /**
      * `POST /user/{user_id}/tickets/{ticket_id}/revoke` — operationId: `user/revokeTicket`

package/dist/api/generated-client.js

@@ -412,6 +412,14 @@ export class GeneratedFaableAuthApi extends FaableApi {
     identityList(params) {
         return this.paginator({ url: `/identity`, params });
     }
+    /**
+     * `GET /internal/usage/sms` — operationId: `internal/smsUsage`
+     *
+     * SMS sent per tenant in a month (platform)
+     */
+    internalSmsUsage(params) {
+        return this.fetcher.request({ method: "GET", url: `/internal/usage/sms`, params });
+    }
     /**
      * `GET /log/{log_id}` — operationId: `log/get`
      *

package/dist/api/types.d.ts

@@ -148,6 +148,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/internal/usage/sms": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * SMS sent per tenant in a month (platform)
+         * @description Per-account count of recovery/verification SMS sent in the given month, read from the monthly quota counters. Consumed by the billing usage job. Platform token with `read:usage`.
+         */
+        get: operations["internal/smsUsage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/connection": {
         parameters: {
             query?: never;
@@ -2793,6 +2813,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/reset-code/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Redeem a password-reset code sent by SMS/WhatsApp
+         * @description Second entry point to the new-password screen, for a reset delivered as a 6-digit code instead of a link. Answers the same `redirect_url` that the emailed link would land on. Five wrong codes consume the ticket; the error is always `invalid_code` and reveals nothing about the account.
+         */
+        post: operations["reset_code_verify"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/dbconnections/recovery_options": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Recovery channels to offer for an identifier
+         * @description For the forgot-password screen. With the tenant's `visible` list empty (the default) it answers from configuration alone and never looks the account up. Otherwise it returns the channels the user can pick, with masked destinations.
+         */
+        post: operations["recovery_options"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/dbconnections/signup": {
         parameters: {
             query?: never;
@@ -5735,6 +5795,36 @@ export interface operations {
             };
         };
     };
+    "internal/smsUsage": {
+        parameters: {
+            query: {
+                /** @description YYYY-MM, UTC. Defaults to the current month. */
+                month: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        month: string;
+                        rows: {
+                            account_id: string;
+                            team: string | null;
+                            sent: number;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
     "connection/list": {
         parameters: {
             query?: {
@@ -7800,6 +7890,8 @@ export interface operations {
                 "application/json": {
                     /** @description Optional connection_name to disambiguate when the tenant has more than one database connection. Defaults to the tenant database connection. */
                     connection?: string;
+                    /** @description How to deliver it: `email` (the link) or `sms` / `whatsapp` (a 6-digit code to the verified phone on file). Falls back to the tenant default when not available for this user; the response says which channel was used. */
+                    channel?: "email" | "sms" | "whatsapp" | "factor";
                 };
             };
         };
@@ -7815,6 +7907,7 @@ export interface operations {
                         status: "sent";
                         credential_id: string;
                         ticket_id: string;
+                        channel: "email" | "sms" | "whatsapp" | "factor";
                     };
                 };
             };
@@ -7846,6 +7939,8 @@ export interface operations {
                             createdAt: string;
                             expires_at: string;
                             ttl: number;
+                            /** @description How this ticket reaches the person: `email` (the link), `sms` / `whatsapp` (a code), `factor`. Older tickets are `email`. */
+                            channel: string;
                             /** @description The link from the ticket email. Present only while the ticket is usable — a dead link is noise, not a recovery path. */
                             link?: string;
                         }[];
@@ -13328,6 +13423,8 @@ export interface operations {
             content: {
                 "application/json": {
                     email: string;
+                    /** @description How to deliver the reset: `email` (link), `sms` / `whatsapp` (a 6-digit code to the verified phone on file). Silently falls back to the tenant default when the channel is not available for this user — the response never says which channels an account has. */
+                    channel?: "email" | "sms" | "whatsapp" | "factor";
                 };
             };
         };
@@ -13391,6 +13488,69 @@ export interface operations {
             };
         };
     };
+    reset_code_verify: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    email: string;
+                    code: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        redirect_url: string;
+                    };
+                };
+            };
+        };
+    };
+    recovery_options: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    email: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Whether the screen should offer a choice. False when the tenant keeps `visible` empty — then nothing here depends on the account existing. */
+                        picker: boolean;
+                        default: "email" | "sms" | "whatsapp" | "factor";
+                        channels: {
+                            channel: "email" | "sms" | "whatsapp" | "factor";
+                            destination_masked?: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
     signup: {
         parameters: {
             query?: never;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.6.16";
+export const version = "2.6.18";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "c04402e";
+export const commit = "5c6ffbe";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.6.16",
+  "version": "2.6.18",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.17.0",
+    "version": "2.19.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -10158,6 +10158,83 @@
         }
       }
     },
+    "/internal/usage/sms": {
+      "get": {
+        "operationId": "internal/smsUsage",
+        "summary": "SMS sent per tenant in a month (platform)",
+        "tags": [
+          "account"
+        ],
+        "description": "Per-account count of recovery/verification SMS sent in the given month, read from the monthly quota counters. Consumed by the billing usage job. Platform token with `read:usage`.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "pattern": "^\\d{4}-\\d{2}$"
+            },
+            "in": "query",
+            "name": "month",
+            "required": true,
+            "description": "YYYY-MM, UTC. Defaults to the current month."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "month",
+                    "rows"
+                  ],
+                  "properties": {
+                    "month": {
+                      "type": "string"
+                    },
+                    "rows": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "account_id",
+                          "team",
+                          "sent"
+                        ],
+                        "properties": {
+                          "account_id": {
+                            "type": "string"
+                          },
+                          "team": {
+                            "anyOf": [
+                              {
+                                "type": "string"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
+                          },
+                          "sent": {
+                            "type": "integer"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/connection": {
       "get": {
         "operationId": "connection/list",
@@ -16713,6 +16790,39 @@
                   "connection": {
                     "type": "string",
                     "description": "Optional connection_name to disambiguate when the tenant has more than one database connection. Defaults to the tenant database connection."
+                  },
+                  "channel": {
+                    "anyOf": [
+                      {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "enum": [
+                              "email"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "sms"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "whatsapp"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "factor"
+                            ]
+                          }
+                        ]
+                      }
+                    ],
+                    "description": "How to deliver it: `email` (the link) or `sms` / `whatsapp` (a 6-digit code to the verified phone on file). Falls back to the tenant default when not available for this user; the response says which channel was used."
                   }
                 },
                 "additionalProperties": false
@@ -16745,7 +16855,8 @@
                   "required": [
                     "status",
                     "credential_id",
-                    "ticket_id"
+                    "ticket_id",
+                    "channel"
                   ],
                   "properties": {
                     "status": {
@@ -16759,6 +16870,34 @@
                     },
                     "ticket_id": {
                       "type": "string"
+                    },
+                    "channel": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "sms"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "whatsapp"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "factor"
+                          ]
+                        }
+                      ]
                     }
                   }
                 }
@@ -16813,7 +16952,8 @@
                           "email",
                           "createdAt",
                           "expires_at",
-                          "ttl"
+                          "ttl",
+                          "channel"
                         ],
                         "properties": {
                           "id": {
@@ -16856,6 +16996,10 @@
                           "ttl": {
                             "type": "number"
                           },
+                          "channel": {
+                            "type": "string",
+                            "description": "How this ticket reaches the person: `email` (the link), `sms` / `whatsapp` (a code), `factor`. Older tickets are `email`."
+                          },
                           "link": {
                             "type": "string",
                             "description": "The link from the ticket email. Present only while the ticket is usable — a dead link is noise, not a recovery path."
@@ -33840,6 +33984,39 @@
                 "properties": {
                   "email": {
                     "type": "string"
+                  },
+                  "channel": {
+                    "anyOf": [
+                      {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "enum": [
+                              "email"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "sms"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "whatsapp"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "factor"
+                            ]
+                          }
+                        ]
+                      }
+                    ],
+                    "description": "How to deliver the reset: `email` (link), `sms` / `whatsapp` (a 6-digit code to the verified phone on file). Silently falls back to the tenant default when the channel is not available for this user — the response never says which channels an account has."
                   }
                 }
               }
@@ -33934,6 +34111,183 @@
         }
       }
     },
+    "/reset-code/verify": {
+      "post": {
+        "operationId": "reset_code_verify",
+        "summary": "Redeem a password-reset code sent by SMS/WhatsApp",
+        "tags": [
+          "dbconnection"
+        ],
+        "description": "Second entry point to the new-password screen, for a reset delivered as a 6-digit code instead of a link. Answers the same `redirect_url` that the emailed link would land on. Five wrong codes consume the ticket; the error is always `invalid_code` and reveals nothing about the account.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "email",
+                  "code"
+                ],
+                "properties": {
+                  "email": {
+                    "type": "string"
+                  },
+                  "code": {
+                    "type": "string",
+                    "minLength": 4,
+                    "maxLength": 12
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "redirect_url"
+                  ],
+                  "properties": {
+                    "redirect_url": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/dbconnections/recovery_options": {
+      "post": {
+        "operationId": "recovery_options",
+        "summary": "Recovery channels to offer for an identifier",
+        "tags": [
+          "dbconnection"
+        ],
+        "description": "For the forgot-password screen. With the tenant's `visible` list empty (the default) it answers from configuration alone and never looks the account up. Otherwise it returns the channels the user can pick, with masked destinations.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "email"
+                ],
+                "properties": {
+                  "email": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "picker",
+                    "default",
+                    "channels"
+                  ],
+                  "properties": {
+                    "picker": {
+                      "type": "boolean",
+                      "description": "Whether the screen should offer a choice. False when the tenant keeps `visible` empty — then nothing here depends on the account existing."
+                    },
+                    "default": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "sms"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "whatsapp"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "factor"
+                          ]
+                        }
+                      ]
+                    },
+                    "channels": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "channel"
+                        ],
+                        "properties": {
+                          "channel": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "email"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "sms"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "whatsapp"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "factor"
+                                ]
+                              }
+                            ]
+                          },
+                          "destination_masked": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/dbconnections/signup": {
       "post": {
         "operationId": "signup",