@faable/auth-sdk 2.7.94 → 2.7.95

package/dist/FaableAuthApi.d.ts

@@ -840,6 +840,16 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             } | undefined;
             login_flow?: string | null | undefined;
             default_audience?: string | null | undefined;
+            saml_sp?: {
+                enabled: boolean;
+                entity_id: string;
+                acs_url: string;
+                nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+                attribute_mapping?: {
+                    [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+                } | undefined;
+                sign_response?: boolean | undefined;
+            } | null | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -907,6 +917,16 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             } | undefined;
             login_flow?: string | null | undefined;
             default_audience?: string | null | undefined;
+            saml_sp?: {
+                enabled: boolean;
+                entity_id: string;
+                acs_url: string;
+                nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+                attribute_mapping?: {
+                    [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+                } | undefined;
+                sign_response?: boolean | undefined;
+            } | null | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -977,6 +997,16 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             } | undefined;
             login_flow?: string | null | undefined;
             default_audience?: string | null | undefined;
+            saml_sp?: {
+                enabled: boolean;
+                entity_id: string;
+                acs_url: string;
+                nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+                attribute_mapping?: {
+                    [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+                } | undefined;
+                sign_response?: boolean | undefined;
+            } | null | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -1046,6 +1076,16 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         } | undefined;
         login_flow?: string | null | undefined;
         default_audience?: string | null | undefined;
+        saml_sp?: {
+            enabled: boolean;
+            entity_id: string;
+            acs_url: string;
+            nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+            attribute_mapping?: {
+                [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+            } | undefined;
+            sign_response?: boolean | undefined;
+        } | null | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;

package/dist/api/generated-client.d.ts

@@ -385,6 +385,33 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         next_in_queue_kid: string;
         kids_active: string[];
     }>;
+    /**
+     * `GET /account/keys/saml` — operationId: `account/getSamlKeys`
+     *
+     * Get the SAML signing certificates
+     *
+     * The X.509 certificate this Account signs SAML assertions with, and the next one when a rotation is staged. Separate from the JWKS keys: rotating tokens never touches SAML. Created on first use.
+     *
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    accountGetSamlKeys(): Promise<{
+        current: {
+            id: string;
+            certificate: string;
+            not_after: string;
+        };
+        next?: {
+            id: string;
+            certificate: string;
+            not_after: string;
+        } | undefined;
+    }>;
     /**
      * `GET /account` — operationId: `account/list`
      *
@@ -667,6 +694,26 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         next_in_queue_kid: string;
         kids_active: string[];
     }>;
+    /**
+     * `POST /account/keys/saml/rotate` — operationId: `account/rotateSamlKeys`
+     *
+     * Rotate the SAML signing certificate
+     *
+     * Two steps. The first call stages a new certificate: the IdP metadata publishes both and signing continues with the current one, so each Service Provider can be updated. The second call promotes it: assertions are signed with the new certificate and the old one is dropped.
+     *
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    accountRotateSamlKeys(): Promise<{
+        step: "staged" | "promoted";
+        current_id: string;
+        next_id?: string | undefined;
+    }>;
     /**
      * `GET /sdk-health/{account_id}` — operationId: `account/sdk-health`
      *
@@ -1459,6 +1506,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         login_flow?: string | null | undefined;
         default_audience?: string | null | undefined;
+        saml_sp?: {
+            enabled: boolean;
+            entity_id: string;
+            acs_url: string;
+            nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+            attribute_mapping?: {
+                [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+            } | undefined;
+            sign_response?: boolean | undefined;
+        } | null | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -1542,6 +1599,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         login_flow?: string | null | undefined;
         default_audience?: string | null | undefined;
+        saml_sp?: {
+            enabled: boolean;
+            entity_id: string;
+            acs_url: string;
+            nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+            attribute_mapping?: {
+                [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+            } | undefined;
+            sign_response?: boolean | undefined;
+        } | null | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -1626,6 +1693,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         login_flow?: string | null | undefined;
         default_audience?: string | null | undefined;
+        saml_sp?: {
+            enabled: boolean;
+            entity_id: string;
+            acs_url: string;
+            nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+            attribute_mapping?: {
+                [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+            } | undefined;
+            sign_response?: boolean | undefined;
+        } | null | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -1711,6 +1788,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             login_flow?: string | null | undefined;
             default_audience?: string | null | undefined;
+            saml_sp?: {
+                enabled: boolean;
+                entity_id: string;
+                acs_url: string;
+                nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+                attribute_mapping?: {
+                    [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+                } | undefined;
+                sign_response?: boolean | undefined;
+            } | null | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -1778,6 +1865,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             login_flow?: string | null | undefined;
             default_audience?: string | null | undefined;
+            saml_sp?: {
+                enabled: boolean;
+                entity_id: string;
+                acs_url: string;
+                nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+                attribute_mapping?: {
+                    [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+                } | undefined;
+                sign_response?: boolean | undefined;
+            } | null | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -1848,6 +1945,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             login_flow?: string | null | undefined;
             default_audience?: string | null | undefined;
+            saml_sp?: {
+                enabled: boolean;
+                entity_id: string;
+                acs_url: string;
+                nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+                attribute_mapping?: {
+                    [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+                } | undefined;
+                sign_response?: boolean | undefined;
+            } | null | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -1934,6 +2041,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         login_flow?: string | null | undefined;
         default_audience?: string | null | undefined;
+        saml_sp?: {
+            enabled: boolean;
+            entity_id: string;
+            acs_url: string;
+            nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+            attribute_mapping?: {
+                [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+            } | undefined;
+            sign_response?: boolean | undefined;
+        } | null | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -2018,6 +2135,16 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         login_flow?: string | null | undefined;
         default_audience?: string | null | undefined;
+        saml_sp?: {
+            enabled: boolean;
+            entity_id: string;
+            acs_url: string;
+            nameid_format?: "unspecified" | "emailAddress" | "persistent" | undefined;
+            attribute_mapping?: {
+                [key: string]: "name" | "picture" | "email" | "user_id" | "email_verified" | "given_name" | "family_name" | "nickname" | "phone_number";
+            } | undefined;
+            sign_response?: boolean | undefined;
+        } | null | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;

package/dist/api/generated-client.js

@@ -135,6 +135,24 @@ export class GeneratedFaableAuthApi extends FaableApi {
     accountGetKeys() {
         return this.fetcher.get(`/account/keys`);
     }
+    /**
+     * `GET /account/keys/saml` — operationId: `account/getSamlKeys`
+     *
+     * Get the SAML signing certificates
+     *
+     * The X.509 certificate this Account signs SAML assertions with, and the next one when a rotation is staged. Separate from the JWKS keys: rotating tokens never touches SAML. Created on first use.
+     *
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    accountGetSamlKeys() {
+        return this.fetcher.get(`/account/keys/saml`);
+    }
     /**
      * `GET /account` — operationId: `account/list`
      *
@@ -194,6 +212,24 @@ export class GeneratedFaableAuthApi extends FaableApi {
     accountRotateKeys(data) {
         return this.fetcher.post(`/account/keys/rotate`, data);
     }
+    /**
+     * `POST /account/keys/saml/rotate` — operationId: `account/rotateSamlKeys`
+     *
+     * Rotate the SAML signing certificate
+     *
+     * Two steps. The first call stages a new certificate: the IdP metadata publishes both and signing continues with the current one, so each Service Provider can be updated. The second call promotes it: assertions are signed with the new certificate and the old one is dropped.
+     *
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    accountRotateSamlKeys() {
+        return this.fetcher.post(`/account/keys/saml/rotate`, {});
+    }
     /**
      * `GET /sdk-health/{account_id}` — operationId: `account/sdk-health`
      *