@faable/auth-sdk 2.7.59 → 2.7.61

package/dist/api/generated-client.d.ts

@@ -4891,7 +4891,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      *
      * Add Users to a Team
      *
-     * Adds one or more Users as members of the given Team. Returns the resulting TeamMember record.
+     * Adds one or more Users of this tenant as members of the given Team, with the same roles. Users already in the team are skipped; `already_member` only when all of them are. A user or team that is not in this tenant is a 404. Returns the TeamMember record of the first user in `users`.
      *
      * @throws {FaableApiError} `already_member` (400) — The user is already a member of the team.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
@@ -4899,6 +4899,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
      * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
      * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
      * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
      * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.

package/dist/api/generated-client.js

@@ -1751,7 +1751,7 @@ export class GeneratedFaableAuthApi extends FaableApi {
      *
      * Add Users to a Team
      *
-     * Adds one or more Users as members of the given Team. Returns the resulting TeamMember record.
+     * Adds one or more Users of this tenant as members of the given Team, with the same roles. Users already in the team are skipped; `already_member` only when all of them are. A user or team that is not in this tenant is a 404. Returns the TeamMember record of the first user in `users`.
      *
      * @throws {FaableApiError} `already_member` (400) — The user is already a member of the team.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
@@ -1759,6 +1759,7 @@ export class GeneratedFaableAuthApi extends FaableApi {
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
      * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
      * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
      * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
      * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.

package/dist/api/types.d.ts

@@ -1259,7 +1259,7 @@ export interface paths {
         put?: never;
         /**
          * Add Users to a Team
-         * @description Adds one or more Users as members of the given Team. Returns the resulting TeamMember record.
+         * @description Adds one or more Users of this tenant as members of the given Team, with the same roles. Users already in the team are skipped; `already_member` only when all of them are. A user or team that is not in this tenant is a 404. Returns the TeamMember record of the first user in `users`.
          */
         post: operations["team/addMembers"];
         delete?: never;
@@ -1341,7 +1341,7 @@ export interface paths {
         };
         /**
          * Verify a team-invite ticket and add the user to the team
-         * @description Entry point for the link sent to the invitee. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.
+         * @description Entry point for the link sent to the invitee, which carries `token` — the invite's own secret. `ticket` (the invite id) is accepted only for invites issued before invites had a secret. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.
          */
         get: operations["team_invite_verify"];
         put?: never;
@@ -18818,7 +18818,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -18826,7 +18830,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "account_not_found";
+                        error_code?: "not_found" | "account_not_found";
                     };
                 };
             };
@@ -19390,8 +19394,9 @@ export interface operations {
     };
     team_invite_verify: {
         parameters: {
-            query: {
-                ticket: string;
+            query?: {
+                token?: string;
+                ticket?: string;
             };
             header?: never;
             path?: never;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.59";
+export const version = "2.7.61";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "cb2f244";
+export const commit = "279c85b";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.59",
+  "version": "2.7.61",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.51.0",
+    "version": "2.51.2",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -35810,7 +35810,7 @@
         "tags": [
           "team"
         ],
-        "description": "Adds one or more Users as members of the given Team. Returns the resulting TeamMember record.",
+        "description": "Adds one or more Users of this tenant as members of the given Team, with the same roles. Users already in the team are skipped; `already_member` only when all of them are. A user or team that is not in this tenant is a 404. Returns the TeamMember record of the first user in `users`.",
         "requestBody": {
           "required": true,
           "content": {
@@ -36028,7 +36028,7 @@
             }
           },
           "404": {
-            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -36042,6 +36042,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
+                            "not_found",
                             "account_not_found"
                           ]
                         }
@@ -37271,15 +37272,25 @@
         "tags": [
           "team"
         ],
-        "description": "Entry point for the link sent to the invitee. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.",
+        "description": "Entry point for the link sent to the invitee, which carries `token` — the invite's own secret. `ticket` (the invite id) is accepted only for invites issued before invites had a secret. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.",
         "parameters": [
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "minLength": 1
+            },
+            "in": "query",
+            "name": "token",
+            "required": false
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1
             },
             "in": "query",
             "name": "ticket",
-            "required": true
+            "required": false
           }
         ],
         "responses": {