@finueva/auth 0.8.1 → 0.9.0

package/dist/index.js

@@ -1884,6 +1884,7 @@ const messages = {
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
@@ -2282,18 +2283,208 @@ function normalizeDriveCredential(value, now) {
 		expiresAt: new Date(now + value.expiresIn * 1e3)
 	};
 }
+function normalizeOrganizationPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject(value) || Object.keys(value).some((key) => key !== "limit" && key !== "cursor")) throw new AuthError("invalid_request", 400);
+	const input = value;
+	const query = new URLSearchParams();
+	if (input.limit !== void 0) {
+		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) throw new AuthError("invalid_request", 400);
+		query.set("limit", String(input.limit));
+	}
+	if (input.cursor !== void 0) {
+		if (typeof input.cursor !== "string" || input.cursor.length < 1 || input.cursor.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.cursor)) throw new AuthError("invalid_request", 400);
+		query.set("cursor", input.cursor);
+	}
+	return query;
+}
+function normalizeIdInput(value) {
+	if (!isId(value)) throw new AuthError("invalid_request", 400);
+	return value;
+}
+function normalizeOrganization(value) {
+	exact(value, [
+		"capabilities",
+		"id",
+		"lifecycle",
+		"logo",
+		"name",
+		"role",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
+	exact(value.capabilities, [
+		"readInvitations",
+		"readMembers",
+		"readTeams"
+	]);
+	if (value.capabilities.readMembers !== true || value.capabilities.readTeams !== true || typeof value.capabilities.readInvitations !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug,
+		logo: nullableHttpsUrl(value.logo),
+		lifecycle: value.lifecycle,
+		role: value.role,
+		capabilities: {
+			readMembers: true,
+			readTeams: true,
+			readInvitations: value.capabilities.readInvitations
+		}
+	};
+}
 function normalizeOrganizations(value) {
-	if (!Array.isArray(value) || value.length >= 100) throw authorityUnavailable();
-	const seen = new Set();
-	return value.map((organization) => {
-		if (!isObject(organization) || !isId(organization.id) || seen.has(organization.id) || typeof organization.name !== "string" || organization.name.length < 1 || typeof organization.slug !== "string" || organization.slug.length < 1) throw authorityUnavailable();
-		seen.add(organization.id);
-		return {
-			id: organization.id,
-			name: organization.name,
-			slug: organization.slug
-		};
-	});
+	exact(value, ["nextCursor", "organizations"]);
+	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
+	return {
+		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationMembers(value) {
+	exact(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
+	return {
+		members: unique(value.members.map((member) => {
+			exact(member, [
+				"email",
+				"id",
+				"image",
+				"joinedAt",
+				"name",
+				"owner",
+				"role",
+				"teamIds",
+				"userId"
+			]);
+			if (!isId(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || !role(member.role) || typeof member.owner !== "boolean" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
+			const teamIds = unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item);
+			return {
+				id: member.id,
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				role: member.role,
+				owner: member.owner,
+				joinedAt: responseDate(member.joinedAt),
+				teamIds
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeams(value) {
+	exact(value, ["nextCursor", "teams"]);
+	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
+	return {
+		teams: unique(value.teams.map((team) => {
+			exact(team, [
+				"category",
+				"createdAt",
+				"id",
+				"name"
+			]);
+			if (!isId(team.id) || !boundedString(team.name, 255) || team.category !== "manual" && team.category !== "managed") throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name,
+				category: team.category,
+				createdAt: responseDate(team.createdAt)
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationTeamMembers(value) {
+	exact(value, ["memberIds", "nextCursor"]);
+	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
+	return {
+		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeOrganizationInvitation(value) {
+	exact(value, [
+		"createdAt",
+		"email",
+		"expiresAt",
+		"id",
+		"inviter",
+		"role",
+		"status",
+		"teamIds"
+	]);
+	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
+	exact(value.inviter, ["membershipId", "name"]);
+	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		email: value.email,
+		role: value.role,
+		teamIds: unique(value.teamIds.map(normalizeResponseId), (item) => item),
+		inviter: {
+			membershipId: value.inviter.membershipId,
+			name: value.inviter.name
+		},
+		createdAt: responseDate(value.createdAt),
+		expiresAt: responseDate(value.expiresAt),
+		status: "pending"
+	};
+}
+function normalizeOrganizationInvitations(value) {
+	exact(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeReceivedInvitation(value) {
+	exact(value, [
+		"expiresAt",
+		"id",
+		"inviterName",
+		"organization",
+		"role",
+		"teams"
+	]);
+	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
+	exact(value.organization, [
+		"id",
+		"logo",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.organization.id) || !boundedString(value.organization.name, 255) || !boundedString(value.organization.slug, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		organization: {
+			id: value.organization.id,
+			name: value.organization.name,
+			slug: value.organization.slug,
+			logo: nullableHttpsUrl(value.organization.logo)
+		},
+		role: value.role,
+		teams: unique(value.teams.map((team) => {
+			exact(team, ["id", "name"]);
+			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
+			return {
+				id: team.id,
+				name: team.name
+			};
+		}), (item) => item.id),
+		inviterName: value.inviterName,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
+function normalizeReceivedInvitations(value) {
+	exact(value, ["invitations", "nextCursor"]);
+	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
+	return {
+		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
 }
 function normalizeInvitationInput(value) {
 	if (!isObject(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
@@ -2359,6 +2550,12 @@ function fromOrganizationListError(error) {
 	if (error instanceof AuthError) return error;
 	return authorityUnavailable();
 }
+function fromOrganizationReadAuthorityError(value, status) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	return authorityUnavailable();
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -2445,6 +2642,46 @@ function normalizeProfileImage(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
+function exact(value, keys) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
+}
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+}
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
+}
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
+}
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
+}
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2474,18 +2711,18 @@ async function requestJsonResponse(url, options) {
 	}
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response) : void 0;
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
 		await response.body?.cancel();
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
-		value: await readJson(response),
+		value: await readJson(response, options.maxResponseBytes),
 		headers: response.headers
 	};
 }
-async function readJson(response) {
+async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
 	const length = response.headers.get("content-length");
-	if (length && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
 		await response.body?.cancel();
 		throw authorityUnavailable();
 	}
@@ -2498,7 +2735,7 @@ async function readJson(response) {
 			const { done, value } = await reader.read();
 			if (done) break;
 			size += value.byteLength;
-			if (size > MAX_RESPONSE_BYTES) throw authorityUnavailable();
+			if (size > maximum) throw authorityUnavailable();
 			chunks.push(value);
 		}
 	} catch (error) {
@@ -3534,6 +3771,25 @@ function createAuthClient(options) {
 			mapError
 		})).value;
 	}
+	async function organizationRead(path, input, normalize) {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const query = normalizeOrganizationPageInput(input);
+		const value = await requestJson(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "GET",
+			mapError: fromOrganizationReadAuthorityError,
+			maxResponseBytes: 256 * 1024
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		try {
+			return normalize(value);
+		} catch (error) {
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			throw error;
+		}
+	}
 	return {
 		_type: "browser",
 		acceptInvitation(input) {
@@ -3544,7 +3800,7 @@ function createAuthClient(options) {
 				return Promise.reject(error);
 			}
 			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) return Promise.reject(new AuthError("state_conflict", 409));
-			const generation = authorityGeneration;
+			const generation = ++authorityGeneration;
 			const controller = new AbortController();
 			clearCredential();
 			const request = (async () => {
@@ -3575,22 +3831,37 @@ function createAuthClient(options) {
 			return request;
 		},
 		getSession,
-		async listOrganizations() {
-			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
-			const generation = authorityGeneration;
+		async listOrganizations(input) {
 			try {
-				const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organization/list"), {
-					fetch: fetchImpl,
-					timeoutMs,
-					method: "GET"
-				});
-				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-				return normalizeOrganizations(value);
+				return await organizationRead("", input, normalizeOrganizations);
 			} catch (error) {
-				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 				throw fromOrganizationListError(error);
 			}
 		},
+		async getOrganization(organizationId) {
+			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
+		},
+		async listOrganizationMembers(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
+		},
+		async listOrganizationTeams(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams);
+		},
+		async listOrganizationTeamMembers(organizationId, teamId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/teams/${normalizeIdInput(teamId)}/members`, input, normalizeOrganizationTeamMembers);
+		},
+		async listOrganizationInvitations(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/invitations`, input, normalizeOrganizationInvitations);
+		},
+		async getOrganizationInvitation(organizationId, invitationId) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeOrganizationInvitation);
+		},
+		async listReceivedInvitations(input) {
+			return organizationRead("received-invitations", input, normalizeReceivedInvitations);
+		},
+		async getReceivedInvitation(invitationId) {
+			return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
+		},
 		async signIn(input) {
 			const body = {
 				email: normalizeEmail(input?.email),

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, b as WorkspaceSelection, c as AuthUser, f as InvitationAcceptance, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError } from "./types-DDopQNZR.js";
+import { C as PersonalWorkspaceSelection, M as AuthError, N as AuthErrorCode, O as SocialIdTokenInput, P as AuthErrorStatus, S as OrganizationWorkspaceSelection, T as ReceivedOrganizationInvitationPage, _ as OrganizationPage, b as OrganizationTeamMemberPage, c as AuthUser, f as InvitationAcceptance, g as OrganizationMemberPage, h as OrganizationMember, j as WorkspaceSelection, k as SocialIdTokenProvider, l as DriveCredential, m as OrganizationInvitationPage, o as AuthSession, p as OrganizationInvitation, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput, v as OrganizationPageInput, w as ReceivedOrganizationInvitation, x as OrganizationTeamPage, y as OrganizationTeam } from "./types-B67VIvTQ.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -20,11 +20,19 @@ interface ServerSocialIdTokenSession extends AuthSession {
 interface FinuevaServerAuth {
   acceptInvitation(input: AcceptInvitationInput): Promise<ServerInvitationAcceptance>;
   getSession(): Promise<AuthSession | null>;
-  listOrganizations(): Promise<AuthOrganization[]>;
+  listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
+  getOrganization(organizationId: string): Promise<AuthOrganization>;
+  listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
+  listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
+  listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
+  listOrganizationInvitations(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationInvitationPage>;
+  getOrganizationInvitation(organizationId: string, invitationId: string): Promise<OrganizationInvitation>;
+  listReceivedInvitations(input?: OrganizationPageInput): Promise<ReceivedOrganizationInvitationPage>;
+  getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type WorkspaceSelection, createServerAuth };