@faable/auth-sdk 2.7.74 → 2.7.76

package/dist/api/generated-client.d.ts

@@ -2081,7 +2081,23 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         all: () => Promise<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email"; /**
+             * `GET /user/{user_id}` — operationId: `user/get`
+             *
+             * Get User
+             *
+             * @throws {FaableApiError} `invalid_id` (400) — The id in the path is not a valid id for this resource.
+             * @throws {FaableApiError} `invalid_expand` (400) — An `?expand=` path is not allowed on this resource.
+             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+             * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+             */
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -2121,7 +2137,23 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         first: () => Promise<import("@faable/sdk-base/dist/helpers/paginator.js").Page<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email"; /**
+             * `GET /user/{user_id}` — operationId: `user/get`
+             *
+             * Get User
+             *
+             * @throws {FaableApiError} `invalid_id` (400) — The id in the path is not a valid id for this resource.
+             * @throws {FaableApiError} `invalid_expand` (400) — An `?expand=` path is not allowed on this resource.
+             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+             * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+             */
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -2164,7 +2196,23 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined) => Promise<import("@faable/sdk-base/dist/helpers/paginator.js").Page<{
             id: string;
             connection_name: string;
-            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email";
+            connection_type: "custom" | "database" | "github" | "figma" | "google_oauth2" | "microsoft" | "oidc" | "passwordless_email"; /**
+             * `GET /user/{user_id}` — operationId: `user/get`
+             *
+             * Get User
+             *
+             * @throws {FaableApiError} `invalid_id` (400) — The id in the path is not a valid id for this resource.
+             * @throws {FaableApiError} `invalid_expand` (400) — An `?expand=` path is not allowed on this resource.
+             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+             * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+             */
             authorize_url: string;
             token_url: string;
             userinfo_url: string;
@@ -4969,7 +5017,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      *
      * Accept a team invite for a signed-in user
      *
-     * Accepts the invite whose secret is `token` on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use it from the page you gave as the invite's `accept_url`.
+     * Accepts the invite — by the `token` of its link, or by `invite_id` — on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use `token` from the page you gave as the invite's `accept_url`, and `invite_id` from a pending-invitation notice in your app.
      *
      * @throws {FaableApiError} `invalid_ticket` (400) — The ticket does not exist or is not the kind this endpoint accepts.
      * @throws {FaableApiError} `ticket_used` (400) — The ticket was already consumed.
@@ -5080,6 +5128,31 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
+    /**
+     * `POST /team/invite/decline` — operationId: `team/declineInvite`
+     *
+     * Decline a team invite for a signed-in user
+     *
+     * The invited user says no: the invite is spent (its link stops working) and `team.invite.revoked` is emitted with reason `declined`. Same checks as accepting.
+     *
+     * @throws {FaableApiError} `invalid_ticket` (400) — The ticket does not exist or is not the kind this endpoint accepts.
+     * @throws {FaableApiError} `ticket_used` (400) — The ticket was already consumed.
+     * @throws {FaableApiError} `ticket_expired` (400) — The ticket is past its expiry.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `invite_email_mismatch` (403) — The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.
+     * @throws {FaableApiError} `invite_email_unverified` (403) — The accepting user's email matches the invite but is not verified yet.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    teamDeclineInvite(data: OpBody<"team/declineInvite">): Promise<{
+        status: "declined";
+    }>;
     /**
      * `DELETE /team/{team_id}` — operationId: `team/delete`
      *
@@ -5270,6 +5343,42 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }[];
     }>;
+    /**
+     * `GET /user/{user_id}/team-invites` — operationId: `team/listInvitesForUser`
+     *
+     * List a user's pending team invites
+     *
+     * Pending (not accepted, revoked, declined or expired) invites to any team of this tenant addressed to the user's email. Only when that email is verified; otherwise `email_verified: false` and an empty list.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    teamListInvitesForUser(user_id: string): Promise<{
+        email_verified: boolean;
+        data: {
+            id: string;
+            email: string;
+            team: string;
+            inviter?: string | undefined;
+            roles: string[];
+            mode: "auto" | "invite";
+            redirect_uri?: string | undefined;
+            expires_at: string;
+            consume_date?: string | undefined;
+            account: string;
+            metadata: {
+                [key: string]: unknown;
+            };
+            createdAt: string;
+            updatedAt?: string | undefined;
+        }[];
+    }>;
     /**
      * `GET /team/{team_id}/member` — operationId: `team/listMembers`
      *
@@ -5345,7 +5454,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
      */
-    teamRemoveMember(team_id: string, user_id: string): Promise<{
+    teamRemoveMember(team_id: string, user_id: string, params?: OpQuery<"team/removeMember">): Promise<{
         id: string;
         deleted: true;
     }>;

package/dist/api/generated-client.js

@@ -1802,7 +1802,7 @@ export class GeneratedFaableAuthApi extends FaableApi {
      *
      * Accept a team invite for a signed-in user
      *
-     * Accepts the invite whose secret is `token` on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use it from the page you gave as the invite's `accept_url`.
+     * Accepts the invite — by the `token` of its link, or by `invite_id` — on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use `token` from the page you gave as the invite's `accept_url`, and `invite_id` from a pending-invitation notice in your app.
      *
      * @throws {FaableApiError} `invalid_ticket` (400) — The ticket does not exist or is not the kind this endpoint accepts.
      * @throws {FaableApiError} `ticket_used` (400) — The ticket was already consumed.
@@ -1885,6 +1885,31 @@ export class GeneratedFaableAuthApi extends FaableApi {
     teamCreate(data) {
         return this.fetcher.post(`/team`, data);
     }
+    /**
+     * `POST /team/invite/decline` — operationId: `team/declineInvite`
+     *
+     * Decline a team invite for a signed-in user
+     *
+     * The invited user says no: the invite is spent (its link stops working) and `team.invite.revoked` is emitted with reason `declined`. Same checks as accepting.
+     *
+     * @throws {FaableApiError} `invalid_ticket` (400) — The ticket does not exist or is not the kind this endpoint accepts.
+     * @throws {FaableApiError} `ticket_used` (400) — The ticket was already consumed.
+     * @throws {FaableApiError} `ticket_expired` (400) — The ticket is past its expiry.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `invite_email_mismatch` (403) — The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.
+     * @throws {FaableApiError} `invite_email_unverified` (403) — The accepting user's email matches the invite but is not verified yet.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    teamDeclineInvite(data) {
+        return this.fetcher.post(`/team/invite/decline`, data);
+    }
     /**
      * `DELETE /team/{team_id}` — operationId: `team/delete`
      *
@@ -1989,6 +2014,26 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("team_id", team_id);
         return this.fetcher.request({ method: "GET", url: `/team/${team_id}/invite`, params });
     }
+    /**
+     * `GET /user/{user_id}/team-invites` — operationId: `team/listInvitesForUser`
+     *
+     * List a user's pending team invites
+     *
+     * Pending (not accepted, revoked, declined or expired) invites to any team of this tenant addressed to the user's email. Only when that email is verified; otherwise `email_verified: false` and an empty list.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    teamListInvitesForUser(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/team-invites`);
+    }
     /**
      * `GET /team/{team_id}/member` — operationId: `team/listMembers`
      *
@@ -2027,10 +2072,10 @@ export class GeneratedFaableAuthApi extends FaableApi {
      * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
      */
-    teamRemoveMember(team_id, user_id) {
+    teamRemoveMember(team_id, user_id, params) {
         requireId("team_id", team_id);
         requireId("user_id", user_id);
-        return this.fetcher.delete(`/team/${team_id}/member/${user_id}`);
+        return this.fetcher.request({ method: "DELETE", url: `/team/${team_id}/member/${user_id}`, params });
     }
     /**
      * `DELETE /team/{team_id}/invite/{ticket_id}` — operationId: `team/revokeInvite`

package/dist/api/types.d.ts

@@ -1383,7 +1383,7 @@ export interface paths {
         put?: never;
         /**
          * Accept a team invite for a signed-in user
-         * @description Accepts the invite whose secret is `token` on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use it from the page you gave as the invite's `accept_url`.
+         * @description Accepts the invite — by the `token` of its link, or by `invite_id` — on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use `token` from the page you gave as the invite's `accept_url`, and `invite_id` from a pending-invitation notice in your app.
          */
         post: operations["team/acceptInvite"];
         delete?: never;
@@ -1392,6 +1392,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/team-invites": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a user's pending team invites
+         * @description Pending (not accepted, revoked, declined or expired) invites to any team of this tenant addressed to the user's email. Only when that email is verified; otherwise `email_verified: false` and an empty list.
+         */
+        get: operations["team/listInvitesForUser"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/team/invite/decline": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Decline a team invite for a signed-in user
+         * @description The invited user says no: the invite is spent (its link stops working) and `team.invite.revoked` is emitted with reason `declined`. Same checks as accepting.
+         */
+        post: operations["team/declineInvite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api": {
         parameters: {
             query?: never;
@@ -19178,6 +19218,8 @@ export interface operations {
                      *     ]
                      */
                     roles: string[];
+                    /** @description The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                    actor_user_id?: string;
                 };
             };
         };
@@ -19305,7 +19347,10 @@ export interface operations {
     };
     "team/removeMember": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description The person removing (or leaving), when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                actor_user_id?: string;
+            };
             header?: never;
             path: {
                 team_id: string;
@@ -19577,7 +19622,7 @@ export interface operations {
                     roles?: string[];
                     /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
                     mode?: "auto" | "invite";
-                    /** @description Where `/invite-verify` redirects the invitee after a successful accept. Must be at an origin of one of this tenant's client callbacks or `callback_hostnames`. */
+                    /** @description Where the invitee goes once in: `/invite-verify` redirects there after a successful accept, and it is the button of the "you were added" email (otherwise your auth domain). Must be at an origin of one of this tenant's client callbacks or `callback_hostnames`. */
                     redirect_uri?: string;
                     /** @description The user who is inviting, when you call on their behalf with a machine token. Shown in the invite email. Must be a user of this tenant; defaults to the token's own user. */
                     inviter_user_id?: string;
@@ -19912,8 +19957,10 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description The invite secret, as it arrived in the fragment of the `accept_url` link. */
-                    token: string;
+                    /** @description The invite secret, as it arrived in the fragment of the `accept_url` link. Give this or `invite_id`. */
+                    token?: string;
+                    /** @description The invite id, for accepting from your app without the link (a "pending invitation" notice; see `GET /user/{user_id}/team-invites`). Give this or `token`. */
+                    invite_id?: string;
                     /** @description The user accepting — the one signed in on your page. Must exist in this tenant and have the invited email, verified. */
                     user_id: string;
                 };
@@ -20031,6 +20078,267 @@ export interface operations {
             };
         };
     };
+    "team/listInvitesForUser": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description False when the user's email is not verified: nothing is listed then, since the address could be anybody's. */
+                        email_verified: boolean;
+                        data: {
+                            /** @description TeamInvite ID */
+                            id: string;
+                            /** @description Email address that was invited */
+                            email: string;
+                            /** @description Id of the team the invitee will be added to upon acceptance. */
+                            team: string;
+                            /** @description Id of the user that created the invitation, if known. */
+                            inviter?: string;
+                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
+                            roles: string[];
+                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                            mode: "auto" | "invite";
+                            /** @description URI to redirect the invitee to after a successful accept. */
+                            redirect_uri?: string;
+                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
+                            expires_at: string;
+                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
+                            consume_date?: string;
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamInviteMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamInvite creation date */
+                            createdAt: string;
+                            /** @description TeamInvite updated date */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "team/declineInvite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    invite_id: string;
+                    /** @description The user declining — must have the invited email, verified. */
+                    user_id: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "declined";
+                    };
+                };
+            };
+            /**
+             * @description `invalid_ticket` — The ticket does not exist or is not the kind this endpoint accepts.
+             *
+             *     `ticket_used` — The ticket was already consumed.
+             *
+             *     `ticket_expired` — The ticket is past its expiry.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_ticket" | "ticket_used" | "ticket_expired" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `invite_email_mismatch` — The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.
+             *
+             *     `invite_email_unverified` — The accepting user's email matches the invite but is not verified yet.
+             *
+             *     `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invite_email_mismatch" | "invite_email_unverified" | "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "api/list": {
         parameters: {
             query?: {

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.74";
+export const version = "2.7.76";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "7e26e4b";
+export const commit = "07be5e1";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.74",
+  "version": "2.7.76",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.59.2",
+    "version": "2.61.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -36278,6 +36278,10 @@
                     "example": [
                       "role_6555fd293acc2f0fac0e3452"
                     ]
+                  },
+                  "actor_user_id": {
+                    "type": "string",
+                    "description": "The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant."
                   }
                 },
                 "additionalProperties": false,
@@ -36559,6 +36563,15 @@
         ],
         "description": "Removes the User's membership of the given Team (the User itself is not deleted). Emits `team.member.removed` and leaves an entry in the tenant's log.",
         "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "actor_user_id",
+            "required": false,
+            "description": "The person removing (or leaving), when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant."
+          },
           {
             "schema": {
               "type": "string"
@@ -36815,7 +36828,7 @@
                   },
                   "redirect_uri": {
                     "type": "string",
-                    "description": "Where `/invite-verify` redirects the invitee after a successful accept. Must be at an origin of one of this tenant's client callbacks or `callback_hostnames`."
+                    "description": "Where the invitee goes once in: `/invite-verify` redirects there after a successful accept, and it is the button of the \"you were added\" email (otherwise your auth domain). Must be at an origin of one of this tenant's client callbacks or `callback_hostnames`."
                   },
                   "inviter_user_id": {
                     "type": "string",
@@ -37766,7 +37779,7 @@
         "tags": [
           "team"
         ],
-        "description": "Accepts the invite whose secret is `token` on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use it from the page you gave as the invite's `accept_url`.",
+        "description": "Accepts the invite — by the `token` of its link, or by `invite_id` — on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use `token` from the page you gave as the invite's `accept_url`, and `invite_id` from a pending-invitation notice in your app.",
         "requestBody": {
           "required": true,
           "content": {
@@ -37774,14 +37787,18 @@
               "schema": {
                 "type": "object",
                 "required": [
-                  "token",
                   "user_id"
                 ],
                 "properties": {
                   "token": {
                     "type": "string",
                     "minLength": 1,
-                    "description": "The invite secret, as it arrived in the fragment of the `accept_url` link."
+                    "description": "The invite secret, as it arrived in the fragment of the `accept_url` link. Give this or `invite_id`."
+                  },
+                  "invite_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The invite id, for accepting from your app without the link (a \"pending invitation\" notice; see `GET /user/{user_id}/team-invites`). Give this or `token`."
                   },
                   "user_id": {
                     "type": "string",
@@ -38008,6 +38025,516 @@
         }
       }
     },
+    "/user/{user_id}/team-invites": {
+      "get": {
+        "operationId": "team/listInvitesForUser",
+        "summary": "List a user's pending team invites",
+        "tags": [
+          "team"
+        ],
+        "description": "Pending (not accepted, revoked, declined or expired) invites to any team of this tenant addressed to the user's email. Only when that email is verified; otherwise `email_verified: false` and an empty list.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "user_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "email_verified",
+                    "data"
+                  ],
+                  "properties": {
+                    "email_verified": {
+                      "type": "boolean",
+                      "description": "False when the user's email is not verified: nothing is listed then, since the address could be anybody's."
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "id",
+                          "email",
+                          "team",
+                          "roles",
+                          "mode",
+                          "expires_at",
+                          "account",
+                          "createdAt"
+                        ],
+                        "properties": {
+                          "id": {
+                            "type": "string",
+                            "description": "TeamInvite ID"
+                          },
+                          "email": {
+                            "type": "string",
+                            "description": "Email address that was invited"
+                          },
+                          "team": {
+                            "type": "string",
+                            "description": "Id of the team the invitee will be added to upon acceptance."
+                          },
+                          "inviter": {
+                            "type": "string",
+                            "description": "Id of the user that created the invitation, if known."
+                          },
+                          "roles": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "description": "Role ids that will be applied to the new TeamMember on acceptance."
+                          },
+                          "mode": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "auto"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "invite"
+                                ]
+                              }
+                            ],
+                            "description": "`auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists."
+                          },
+                          "redirect_uri": {
+                            "type": "string",
+                            "description": "URI to redirect the invitee to after a successful accept."
+                          },
+                          "expires_at": {
+                            "type": "string",
+                            "description": "ISO 8601 timestamp at which the invite stops being valid."
+                          },
+                          "consume_date": {
+                            "type": "string",
+                            "description": "ISO 8601 timestamp at which the invite was accepted. Absent for pending invites."
+                          },
+                          "account": {
+                            "type": "string",
+                            "description": "Object is related with this account"
+                          },
+                          "metadata": {
+                            "type": "object",
+                            "properties": {},
+                            "additionalProperties": true,
+                            "description": "TeamInviteMetadata",
+                            "default": {}
+                          },
+                          "createdAt": {
+                            "type": "string",
+                            "description": "TeamInvite creation date"
+                          },
+                          "updatedAt": {
+                            "type": "string",
+                            "description": "TeamInvite updated date"
+                          }
+                        },
+                        "description": "TeamInvite"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/team/invite/decline": {
+      "post": {
+        "operationId": "team/declineInvite",
+        "summary": "Decline a team invite for a signed-in user",
+        "tags": [
+          "team"
+        ],
+        "description": "The invited user says no: the invite is spent (its link stops working) and `team.invite.revoked` is emitted with reason `declined`. Same checks as accepting.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "invite_id",
+                  "user_id"
+                ],
+                "properties": {
+                  "invite_id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "user_id": {
+                    "type": "string",
+                    "description": "The user declining — must have the invited email, verified."
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "status"
+                  ],
+                  "properties": {
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "declined"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_ticket` — The ticket does not exist or is not the kind this endpoint accepts.\n\n`ticket_used` — The ticket was already consumed.\n\n`ticket_expired` — The ticket is past its expiry.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_ticket",
+                            "ticket_used",
+                            "ticket_expired",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`invite_email_mismatch` — The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n\n`invite_email_unverified` — The accepting user's email matches the invite but is not verified yet.\n\n`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invite_email_mismatch",
+                            "invite_email_unverified",
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api": {
       "get": {
         "operationId": "api/list",