@finueva/auth 0.8.0 → 0.9.0

package/dist/device.js

@@ -444,6 +444,7 @@ const messages = {
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
@@ -563,6 +564,209 @@ function normalizeDriveCredential(value, now) {
 		expiresAt: new Date(now + value.expiresIn * 1e3)
 	};
 }
+function normalizeOrganizationPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	const input = value;
+	const query = new URLSearchParams();
+	if (input.limit !== void 0) {
+		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
+		query.set("limit", String(input.limit));
+	}
+	if (input.cursor !== void 0) {
+		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
+		query.set("cursor", input.cursor);
+	}
+	return query;
+}
+function normalizeIdInput(value) {
+	if (!isId(value)) throw new AuthError("invalid_request", 400);
+	return value;
+}
+function normalizeOrganization(value) {
+	exact(value, [
+		"capabilities",
+		"id",
+		"lifecycle",
+		"logo",
+		"name",
+		"role",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
+	exact(value.capabilities, [
+		"readInvitations",
+		"readMembers",
+		"readTeams"
+	]);
+	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug,
+		logo: nullableHttpsUrl(value.logo),
+		lifecycle: value.lifecycle,
+		role: value.role,
+		capabilities: {
+			readMembers: true,
+			readTeams: true,
+			readInvitations: value.capabilities.readInvitations
+		}
+	};
+}
+function normalizeOrganizations(value) {
+	exact(value, ["nextCursor", "organizations"]);
+	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
+	return {
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationMembers(value) {
+	exact(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
+	return {
+		members: unique(value.members.map((member) => {
+			exact(member, [
+				"email",
+				"id",
+				"image",
+				"joinedAt",
+				"name",
+				"owner",
+				"role",
+				"teamIds",
+				"userId"
+			]);
+			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
+			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			return {
+				id: member.id,
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				role: member.role,
+				owner: member.owner,
+				joinedAt: responseDate(member.joinedAt),
+				teamIds
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeams(value) {
+	exact(value, ["nextCursor", "teams"]);
+	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
+	return {
+		teams: unique(value.teams.map((team) => {
+			exact(team, [
+				"category",
+				"createdAt",
+				"id",
+				"name"
+			]);
+			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name,
+				category: team.category,
+				createdAt: responseDate(team.createdAt)
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeamMembers(value) {
+	exact(value, ["memberIds", "nextCursor"]);
+	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
+	return {
+		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationInvitation(value) {
+	exact(value, [
+		"createdAt",
+		"email",
+		"expiresAt",
+		"id",
+		"inviter",
+		"role",
+		"status",
+		"teamIds"
+	]);
+	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
+	exact(value.inviter, ["membershipId", "name"]);
+	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		email: value.email,
+		role: value.role,
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		inviter: {
+			membershipId: value.inviter.membershipId,
+			name: value.inviter.name
+		},
+		createdAt: responseDate(value.createdAt),
+		expiresAt: responseDate(value.expiresAt),
+		status: "pending"
+	};
+}
+function normalizeOrganizationInvitations(value) {
+	exact(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeReceivedInvitation(value) {
+	exact(value, [
+		"expiresAt",
+		"id",
+		"inviterName",
+		"organization",
+		"role",
+		"teams"
+	]);
+	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
+	exact(value.organization, [
+		"id",
+		"logo",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		organization: {
+			id: value.organization.id,
+			name: value.organization.name,
+			slug: value.organization.slug,
+			logo: nullableHttpsUrl(value.organization.logo)
+		},
+		role: value.role,
+		teams: unique(value.teams.map((team) => {
+			exact(team, ["id", "name"]);
+			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name
+			};
+		}), (item) => item.id),
+		inviterName: value.inviterName,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
+function normalizeReceivedInvitations(value) {
+	exact(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
 function normalizeWorkspaceSelection(value) {
 	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
 	const keys = Object.keys(value);
@@ -600,6 +804,12 @@ function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 function authorityUnavailable() {
 	return new AuthError("identity_authority_unavailable", 503);
 }
+function fromOrganizationReadAuthorityError(value, status) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	return authorityUnavailable();
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -674,6 +884,46 @@ function normalizeProfileImage(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
+function exact(value, keys) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
+}
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+}
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
+}
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
+}
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
+}
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -700,18 +950,18 @@ async function requestJsonResponse(url, options) {
 	}
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response) : void 0;
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
 		await response.body?.cancel();
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
-		value: await readJson(response),
+		value: await readJson(response, options.maxResponseBytes),
 		headers: response.headers
 	};
 }
-async function readJson(response) {
+async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
 	const length = response.headers.get("content-length");
-	if (length && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
 		await response.body?.cancel();
 		throw authorityUnavailable();
 	}
@@ -724,7 +974,7 @@ async function readJson(response) {
 			const { done, value } = await reader.read();
 			if (done) break;
 			size += value.byteLength;
-			if (size > MAX_RESPONSE_BYTES) throw authorityUnavailable();
+			if (size > maximum) throw authorityUnavailable();
 			chunks.push(value);
 		}
 	} catch (error) {
@@ -1092,6 +1342,20 @@ function createDeviceAuth(options) {
 		}
 		return session;
 	}
+	async function organizationRead(path, input, normalize) {
+		const query = normalizeOrganizationPageInput(input);
+		const current = await readToken();
+		if (!current) throw new AuthError("authentication_required", 401);
+		return normalize((await requestJsonResponse(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
+			fetch: requestFetch,
+			timeoutMs,
+			method: "GET",
+			credentials: "omit",
+			headers: { authorization: `Bearer ${current.accessToken}` },
+			mapError: fromOrganizationReadAuthorityError,
+			maxResponseBytes: 256 * 1024
+		})).value);
+	}
 	async function removePersisted() {
 		if (!options.persistence) return;
 		try {
@@ -1117,6 +1381,57 @@ function createDeviceAuth(options) {
 		},
 		getToken: () => serializeAuthority(async () => copyTokenOrNull(await readToken())),
 		getSession: () => serializeAuthority(getSession, true),
+		listOrganizations: (input) => serializeAuthority(() => organizationRead("", input, normalizeOrganizations)),
+		getOrganization(organizationId) {
+			try {
+				return serializeAuthority(() => organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
+		listOrganizationMembers(organizationId, input) {
+			try {
+				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
+		listOrganizationTeams(organizationId, input) {
+			try {
+				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
+		listOrganizationTeamMembers(organizationId, teamId, input) {
+			try {
+				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/teams/${normalizeIdInput(teamId)}/members`, input, normalizeOrganizationTeamMembers));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
+		listOrganizationInvitations(organizationId, input) {
+			try {
+				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/invitations`, input, normalizeOrganizationInvitations));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
+		getOrganizationInvitation(organizationId, invitationId) {
+			try {
+				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeOrganizationInvitation));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
+		listReceivedInvitations: (input) => serializeAuthority(() => organizationRead("received-invitations", input, normalizeReceivedInvitations)),
+		getReceivedInvitation(invitationId) {
+			try {
+				return serializeAuthority(() => organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation));
+			} catch (error) {
+				return Promise.reject(error);
+			}
+		},
 		signUpWithEmail(email, password, name) {
 			let body;
 			try {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, a as AuthPersistenceDriver, b as WorkspaceSelection, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as SignInInput, h as SendVerificationEmailInput, i as AuthPersistence, l as DriveCredential, m as PersonalWorkspaceSelection, n as AuthClientOptions, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-DDopQNZR.js";
+import { A as UpdateProfileInput, C as PersonalWorkspaceSelection, D as SignInInput, E as SendVerificationEmailInput, M as AuthError, N as AuthErrorCode, O as SocialIdTokenInput, P as AuthErrorStatus, S as OrganizationWorkspaceSelection, T as ReceivedOrganizationInvitationPage, _ as OrganizationPage, a as AuthPersistenceDriver, b as OrganizationTeamMemberPage, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as OrganizationMemberPage, h as OrganizationMember, i as AuthPersistence, j as WorkspaceSelection, k as SocialIdTokenProvider, l as DriveCredential, m as OrganizationInvitationPage, n as AuthClientOptions, o as AuthSession, p as OrganizationInvitation, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput, v as OrganizationPageInput, w as ReceivedOrganizationInvitation, x as OrganizationTeamPage, y as OrganizationTeam } from "./types-B67VIvTQ.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };