@finueva/auth 0.28.0 → 0.29.0

package/dist/server.d.ts

@@ -258,6 +258,69 @@ interface FinuevaDriveProvisioningAuth {
 /** Service authority only. Never pass an incoming User request or session to this client. */
 declare function createDriveProvisioningAuth(options: DriveProvisioningAuthOptions): FinuevaDriveProvisioningAuth;
 //#endregion
+//#region src/user-directory.d.ts
+interface UserDirectoryEntry {
+  applicationId: string;
+  /** Opaque application-scoped identifier. This is not the canonical Auth User ID. */
+  userId: string;
+  /** Immutable application-scoped incarnation. A replacement User cannot inherit it. */
+  userGeneration: string;
+  lifecycle: "active" | "suspended" | "deleted";
+}
+interface UserDirectoryLookupInput {
+  applicationId: string;
+  userId: string;
+  userGeneration: string;
+}
+interface UserDirectoryListInput {
+  applicationId: string;
+  limit?: number;
+  cursor?: string;
+}
+interface UserDirectoryMembersInput extends UserDirectoryListInput {
+  organizationId: string;
+  organizationGeneration: string;
+}
+interface UserDirectoryResolveInput {
+  applicationId: string;
+  authUserId: string;
+}
+interface UserDirectoryPage {
+  users: UserDirectoryEntry[];
+  /** Only null means the collection is exhausted. */ nextCursor: string | null;
+}
+interface UserDirectoryMember {
+  user: UserDirectoryEntry;
+  role: "owner" | "admin" | "member";
+  membershipStatus: "active" | "suspended";
+}
+interface UserDirectoryMembersPage {
+  applicationId: string;
+  organizationId: string;
+  organizationGeneration: string;
+  members: UserDirectoryMember[];
+  nextCursor: string | null;
+}
+/** Private service authority. Never forward this object to an operator or browser. */
+interface UserDirectoryBinding {
+  user: UserDirectoryEntry;
+  authUserId: string;
+}
+interface UserDirectoryAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface FinuevaUserDirectoryAuth {
+  listUsers(input: UserDirectoryListInput, assertion: string): Promise<UserDirectoryPage>;
+  lookupUser(input: UserDirectoryLookupInput, assertion: string): Promise<UserDirectoryEntry | null>;
+  listOrganizationMembers(input: UserDirectoryMembersInput, assertion: string): Promise<UserDirectoryMembersPage>;
+  resolveUser(input: UserDirectoryResolveInput, assertion: string): Promise<UserDirectoryEntry | null>;
+  resolveUserBinding(input: UserDirectoryLookupInput, assertion: string): Promise<UserDirectoryBinding | null>;
+}
+/** Server-only service assertions. This client has no session authority and performs no automatic retry. */
+declare function createUserDirectoryAuth(options: UserDirectoryAuthOptions): FinuevaUserDirectoryAuth;
+//#endregion
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -322,4 +385,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationDirectoryAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationDirectoryAuth, FinuevaServerAuth, type FinuevaUserDirectoryAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type UserDirectoryAuthOptions, type UserDirectoryBinding, type UserDirectoryEntry, type UserDirectoryListInput, type UserDirectoryLookupInput, type UserDirectoryMember, type UserDirectoryMembersInput, type UserDirectoryMembersPage, type UserDirectoryPage, type UserDirectoryResolveInput, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth };

package/dist/server.js

@@ -3475,6 +3475,168 @@ function createDriveProvisioningAuth(options) {
 	} };
 }
 //#endregion
+//#region src/user-directory.ts
+function user(value, applicationId) {
+	if (!exact$6(value, [
+		"applicationId",
+		"userId",
+		"userGeneration",
+		"lifecycle"
+	]) || value.applicationId !== applicationId || !directoryGeneration(value.userId) || !directoryGeneration(value.userGeneration) || ![
+		"active",
+		"suspended",
+		"deleted"
+	].includes(String(value.lifecycle))) throw authorityUnavailable();
+	return {
+		applicationId,
+		userId: value.userId,
+		userGeneration: value.userGeneration,
+		lifecycle: value.lifecycle
+	};
+}
+function exactInput(input) {
+	if (!exact$6(input, [
+		"applicationId",
+		"userId",
+		"userGeneration"
+	]) || !directoryId(input.applicationId) || !directoryGeneration(input.userId) || !directoryGeneration(input.userGeneration)) throw new AuthError("invalid_request", 400);
+}
+function pageInput(input, members = false) {
+	if (!record$1(input) || Object.keys(input).some((key) => ![
+		"applicationId",
+		"limit",
+		"cursor",
+		...members ? ["organizationId", "organizationGeneration"] : []
+	].includes(key)) || !directoryId(input.applicationId) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 2048) || members && (!directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration))) throw new AuthError("invalid_request", 400);
+}
+function nextCursor(value) {
+	if (value !== null && (typeof value !== "string" || !value.length || value.length > 2048)) throw authorityUnavailable();
+	return value;
+}
+function selectedUser(value, input) {
+	const normalized = user(value, input.applicationId);
+	if (normalized.userId !== input.userId || normalized.userGeneration !== input.userGeneration) throw authorityUnavailable();
+	return normalized;
+}
+function createUserDirectoryAuth(options) {
+	const origin = normalizeOrigin(options.authOrigin, "authOrigin");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = 0;
+	async function exchange(operation, body, assertion) {
+		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
+		inFlight += 1;
+		const controller = new AbortController();
+		let timer;
+		const deadline = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(authorityUnavailable());
+				controller.abort();
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([requestJson(joinURL(origin, "api/v1/auth/user-directory", operation), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "omit",
+				cache: "no-store",
+				headers: {
+					"x-finueva-service-assertion": assertion,
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body,
+				maxResponseBytes: 128 * 1024,
+				signal: controller.signal
+			}).finally(() => {
+				inFlight -= 1;
+			}), deadline]);
+		} catch (cause) {
+			if (cause instanceof AuthError) throw cause;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+		}
+	}
+	return {
+		async listUsers(input, assertion) {
+			pageInput(input);
+			const value = await exchange("list", input, assertion);
+			if (!exact$6(value, ["users", "nextCursor"]) || !Array.isArray(value.users) || value.users.length > (input.limit ?? 50)) throw authorityUnavailable();
+			const users = value.users.map((item) => user(item, input.applicationId));
+			if (users.some((item) => item.lifecycle === "deleted") || new Set(users.map((item) => item.userId)).size !== users.length) throw authorityUnavailable();
+			return {
+				users,
+				nextCursor: nextCursor(value.nextCursor)
+			};
+		},
+		async lookupUser(input, assertion) {
+			exactInput(input);
+			const value = await exchange("lookup", input, assertion);
+			if (!exact$6(value, ["user"])) throw authorityUnavailable();
+			return value.user === null ? null : selectedUser(value.user, input);
+		},
+		async listOrganizationMembers(input, assertion) {
+			pageInput(input, true);
+			const value = await exchange("members", input, assertion);
+			if (!exact$6(value, [
+				"applicationId",
+				"organizationId",
+				"organizationGeneration",
+				"members",
+				"nextCursor"
+			]) || value.applicationId !== input.applicationId || value.organizationId !== input.organizationId || value.organizationGeneration !== input.organizationGeneration || !Array.isArray(value.members) || value.members.length > (input.limit ?? 50)) throw authorityUnavailable();
+			const members = value.members.map((item) => {
+				if (!exact$6(item, [
+					"user",
+					"role",
+					"membershipStatus"
+				]) || item.role !== "owner" && item.role !== "admin" && item.role !== "member" || item.membershipStatus !== "active" && item.membershipStatus !== "suspended") throw authorityUnavailable();
+				const normalized = user(item.user, input.applicationId);
+				if (normalized.lifecycle === "deleted") throw authorityUnavailable();
+				return {
+					user: normalized,
+					role: item.role,
+					membershipStatus: item.membershipStatus
+				};
+			});
+			if (new Set(members.map((item) => item.user.userId)).size !== members.length) throw authorityUnavailable();
+			return {
+				applicationId: input.applicationId,
+				organizationId: input.organizationId,
+				organizationGeneration: input.organizationGeneration,
+				members,
+				nextCursor: nextCursor(value.nextCursor)
+			};
+		},
+		async resolveUser(input, assertion) {
+			if (!exact$6(input, ["applicationId", "authUserId"]) || !directoryId(input.applicationId) || !directoryId(input.authUserId)) throw new AuthError("invalid_request", 400);
+			const value = await exchange("resolve", input, assertion);
+			if (!exact$6(value, ["user"])) throw authorityUnavailable();
+			const result = value.user === null ? null : user(value.user, input.applicationId);
+			if (result?.lifecycle === "deleted") throw authorityUnavailable();
+			return result;
+		},
+		async resolveUserBinding(input, assertion) {
+			exactInput(input);
+			const value = await exchange("binding", input, assertion);
+			if (!exact$6(value, ["binding"])) throw authorityUnavailable();
+			if (value.binding === null) return null;
+			if (!exact$6(value.binding, ["user", "authUserId"]) || !directoryId(value.binding.authUserId)) throw authorityUnavailable();
+			const result = selectedUser(value.binding.user, input);
+			if (result.lifecycle === "deleted") throw authorityUnavailable();
+			return {
+				user: result,
+				authUserId: value.binding.authUserId
+			};
+		}
+	};
+}
+//#endregion
 //#region src/server.ts
 const MAX_AUTHORIZATION_BYTES = 16 * 1024;
 function createServerAuth(options) {
@@ -4035,4 +4197,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier };
+export { AuthError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,