@faable/auth-sdk 2.8.16 → 2.8.17

package/dist/api/generated-client.d.ts

@@ -463,7 +463,22 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             slug: string;
             logo_src?: string | null | undefined;
             icon_src?: string | null | undefined;
-            callback_hostnames: string[];
+            callback_hostnames: string[]; /**
+             * `POST /user/import` — operationId: `user/import`
+             *
+             * Import users, with their password hashes
+             *
+             * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
+             *
+             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+             */
             token_signature: string;
             token_signing_alg: "RS256";
             default_connection?: unknown;
@@ -533,7 +548,22 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             slug: string;
             logo_src?: string | null | undefined;
             icon_src?: string | null | undefined;
-            callback_hostnames: string[];
+            callback_hostnames: string[]; /**
+             * `POST /user/import` — operationId: `user/import`
+             *
+             * Import users, with their password hashes
+             *
+             * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
+             *
+             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+             */
             token_signature: string;
             token_signing_alg: "RS256";
             default_connection?: unknown;
@@ -606,7 +636,22 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             slug: string;
             logo_src?: string | null | undefined;
             icon_src?: string | null | undefined;
-            callback_hostnames: string[];
+            callback_hostnames: string[]; /**
+             * `POST /user/import` — operationId: `user/import`
+             *
+             * Import users, with their password hashes
+             *
+             * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
+             *
+             * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+             * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+             * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+             * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+             * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+             * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+             * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+             */
             token_signature: string;
             token_signing_alg: "RS256";
             default_connection?: unknown;

package/dist/api/types.d.ts

@@ -2809,7 +2809,7 @@ export interface paths {
         put?: never;
         /**
          * Start enrolling an authenticator app
-         * @description Creates an UNCONFIRMED TOTP factor and returns its `otpauth://` URI and secret — the only time either is ever readable. The factor does not satisfy any policy until `POST /me/factors/:id/verify` proves the user can produce a code from it.
+         * @description Creates an UNCONFIRMED TOTP factor and returns its `otpauth://` URI and secret. When the user already has one that was started and never confirmed, that one is returned instead of a new one, so an interrupted setup continues with the seed already scanned. Once confirmed, the secret is never readable again. The factor does not satisfy any policy until `POST /me/factors/:id/verify` proves the user can produce a code from it.
          */
         post: {
             parameters: {

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.8.16";
+export const version = "2.8.17";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "0b2f364";
+export const commit = "6e10ae8";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.8.16",
+  "version": "2.8.17",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.86.0",
+    "version": "2.86.1",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -66314,7 +66314,7 @@
         "tags": [
           "mfa"
         ],
-        "description": "Creates an UNCONFIRMED TOTP factor and returns its `otpauth://` URI and secret — the only time either is ever readable. The factor does not satisfy any policy until `POST /me/factors/:id/verify` proves the user can produce a code from it.",
+        "description": "Creates an UNCONFIRMED TOTP factor and returns its `otpauth://` URI and secret. When the user already has one that was started and never confirmed, that one is returned instead of a new one, so an interrupted setup continues with the seed already scanned. Once confirmed, the secret is never readable again. The factor does not satisfy any policy until `POST /me/factors/:id/verify` proves the user can produce a code from it.",
         "requestBody": {
           "required": true,
           "content": {