@faable/auth-sdk 2.7.57 → 2.7.59

package/dist/api/generated-client.d.ts

@@ -4743,6 +4743,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "active" | "revoked";
         ip?: string | undefined;
         user_agent?: string | undefined;
+        device_name?: string | undefined;
         client?: unknown;
         connection?: unknown;
         issuer?: string | undefined;
@@ -4782,6 +4783,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             status: "active" | "revoked";
             ip?: string | undefined;
             user_agent?: string | undefined;
+            device_name?: string | undefined;
             client?: unknown;
             connection?: unknown;
             issuer?: string | undefined;
@@ -4803,6 +4805,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             status: "active" | "revoked";
             ip?: string | undefined;
             user_agent?: string | undefined;
+            device_name?: string | undefined;
             client?: unknown;
             connection?: unknown;
             issuer?: string | undefined;
@@ -4827,6 +4830,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             status: "active" | "revoked";
             ip?: string | undefined;
             user_agent?: string | undefined;
+            device_name?: string | undefined;
             client?: unknown;
             connection?: unknown;
             issuer?: string | undefined;
@@ -4867,6 +4871,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "active" | "revoked";
         ip?: string | undefined;
         user_agent?: string | undefined;
+        device_name?: string | undefined;
         client?: unknown;
         connection?: unknown;
         issuer?: string | undefined;

package/dist/api/types.d.ts

@@ -4016,6 +4016,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/oauth/session-from-ticket": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Open the hosted session from a ticket
+         * @description Consumes a ticket from `POST /oauth/link_ticket`, establishes the cookie session for its user and redirects to `redirect_to`, a hosted screen of this host. For Relying Parties that signed the user in with a direct grant (e.g. passwordless OTP) and so hold no cookie session, when they send the user to an account screen such as `/flow/account/security`.
+         */
+        get: operations["oauth/sessionFromTicket"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/oauth/token": {
         parameters: {
             query?: never;
@@ -6225,6 +6245,8 @@ export interface components {
             ip?: string;
             /** @description Raw `User-Agent` header at the last authentication. */
             user_agent?: string;
+            /** @description The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one. */
+            device_name?: string;
             client?: components["schemas"]["Client"] | string | unknown;
             connection?: components["schemas"]["Connection"] | string | unknown;
             /** @description Issuer URL the session was minted on. */
@@ -24420,6 +24442,8 @@ export interface operations {
                         ip?: string;
                         /** @description Raw `User-Agent` header at the last authentication. */
                         user_agent?: string;
+                        /** @description The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one. */
+                        device_name?: string;
                         client?: components["schemas"]["Client"] | string | unknown;
                         connection?: components["schemas"]["Connection"] | string | unknown;
                         /** @description Issuer URL the session was minted on. */
@@ -24573,6 +24597,8 @@ export interface operations {
                         ip?: string;
                         /** @description Raw `User-Agent` header at the last authentication. */
                         user_agent?: string;
+                        /** @description The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one. */
+                        device_name?: string;
                         client?: components["schemas"]["Client"] | string | unknown;
                         connection?: components["schemas"]["Connection"] | string | unknown;
                         /** @description Issuer URL the session was minted on. */
@@ -26969,6 +26995,93 @@ export interface operations {
             };
         };
     };
+    "oauth/sessionFromTicket": {
+        parameters: {
+            query: {
+                /** @description A ticket from `POST /oauth/link_ticket`, single use. */
+                ticket: string;
+                /** @description Where to go once the session is open: a path of this host under `/flow/` (e.g. `/flow/account/security?client_id=…`). */
+                redirect_to: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_request" | "validation_error";
+                    };
+                };
+            };
+            /** @description `user_suspended` — The user is suspended and cannot sign in or be modified. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "oauth/tokenGet": {
         parameters: {
             query?: {

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.57";
+export const version = "2.7.59";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "faf0086";
+export const commit = "cb2f244";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.57",
+  "version": "2.7.59",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.49.3",
+    "version": "2.51.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -6103,6 +6103,10 @@
             "type": "string",
             "description": "Raw `User-Agent` header at the last authentication."
           },
+          "device_name": {
+            "type": "string",
+            "description": "The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one."
+          },
           "client": {
             "anyOf": [
               {
@@ -50979,6 +50983,10 @@
                       "type": "string",
                       "description": "Raw `User-Agent` header at the last authentication."
                     },
+                    "device_name": {
+                      "type": "string",
+                      "description": "The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one."
+                    },
                     "client": {
                       "anyOf": [
                         {
@@ -51310,6 +51318,10 @@
                       "type": "string",
                       "description": "Raw `User-Agent` header at the last authentication."
                     },
+                    "device_name": {
+                      "type": "string",
+                      "description": "The name a device gave itself when it asked for a code (device authorization grant), e.g. the hostname `faable login` runs on. Absent for browser sessions: a browser does not expose one."
+                    },
                     "client": {
                       "anyOf": [
                         {
@@ -59444,6 +59456,167 @@
         }
       }
     },
+    "/oauth/session-from-ticket": {
+      "get": {
+        "operationId": "oauth/sessionFromTicket",
+        "summary": "Open the hosted session from a ticket",
+        "tags": [
+          "oauth"
+        ],
+        "description": "Consumes a ticket from `POST /oauth/link_ticket`, establishes the cookie session for its user and redirects to `redirect_to`, a hosted screen of this host. For Relying Parties that signed the user in with a direct grant (e.g. passwordless OTP) and so hold no cookie session, when they send the user to an account screen such as `/flow/account/security`.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "ticket",
+            "required": true,
+            "description": "A ticket from `POST /oauth/link_ticket`, single use."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "redirect_to",
+            "required": true,
+            "description": "Where to go once the session is open: a path of this host under `/flow/` (e.g. `/flow/account/security?client_id=…`)."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response"
+          },
+          "400": {
+            "description": "`invalid_request` — A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_request",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/oauth/token": {
       "get": {
         "operationId": "oauth/tokenGet",