@fonoster/identity-client 0.20.1 → 0.22.0

package/dist/index.d.ts

@@ -55,6 +55,26 @@ export interface InviteMemberRequest {
     role: string;
     name?: string;
 }
+/** A workspace API key as returned by list (never carries the secret). */
+export interface ApiKey {
+    ref: string;
+    accessKeyId: string;
+    role: string;
+    expiresAt?: number;
+    createdAt?: number;
+    updatedAt?: number;
+}
+export interface CreateApiKeyRequest {
+    role: string;
+    /** Optional expiry as epoch milliseconds; omit for a non-expiring key. */
+    expiresAt?: number;
+}
+/** Create/regenerate response — the only time the secret is returned. */
+export interface ApiKeyCredentials {
+    ref: string;
+    accessKeyId: string;
+    accessKeySecret: string;
+}
 /** Channel a verification code is sent over. */
 export type ContactType = "EMAIL" | "PHONE";
 /** OAuth2 providers Identity can exchange an authorization code for. */
@@ -99,6 +119,12 @@ export declare class IdentityClient {
     }>;
     exchangeCredentials(request: ExchangeCredentialsRequest): Promise<ExchangeResponse>;
     exchangeRefreshToken(refreshToken: string): Promise<ExchangeResponse>;
+    /**
+     * Exchange a workspace API key (accessKeyId + accessKeySecret) for tokens.
+     * Intended for unattended, server-to-server integrations that cannot perform
+     * an interactive credentials login.
+     */
+    exchangeApiKey(accessKeyId: string, accessKeySecret: string): Promise<ExchangeResponse>;
     /** Exchange an OAuth2 authorization code for tokens (sign in). */
     exchangeOauth2Code(provider: Oauth2Provider, code: string): Promise<ExchangeResponse>;
     /** Create an account from an OAuth2 authorization code, returning tokens (sign up). */
@@ -130,6 +156,19 @@ export declare class IdentityClient {
     resendWorkspaceMembershipInvitation(userRef: string, accessKeyId: string, token: string): Promise<{
         userRef: string;
     }>;
+    /** List the active workspace's API keys (secrets are never returned). */
+    listApiKeys(accessKeyId: string, token: string): Promise<{
+        items: ApiKey[];
+        nextPageToken?: string;
+    }>;
+    /** Create an API key; the response carries the secret (shown once). */
+    createApiKey(request: CreateApiKeyRequest, accessKeyId: string, token: string): Promise<ApiKeyCredentials>;
+    /** Rotate a key's secret in place; the new secret is returned (shown once). */
+    regenerateApiKey(ref: string, accessKeyId: string, token: string): Promise<ApiKeyCredentials>;
+    /** Permanently delete a key (this is the revocation mechanism). */
+    deleteApiKey(ref: string, accessKeyId: string, token: string): Promise<{
+        ref: string;
+    }>;
     getUser(ref: string, token: string): Promise<User>;
     updateUser(request: UpdateUserRequest, token: string): Promise<{
         ref: string;

package/dist/index.js

@@ -136,6 +136,14 @@ class IdentityClient {
     exchangeRefreshToken(refreshToken) {
         return this.unary("exchangeRefreshToken", { refreshToken });
     }
+    /**
+     * Exchange a workspace API key (accessKeyId + accessKeySecret) for tokens.
+     * Intended for unattended, server-to-server integrations that cannot perform
+     * an interactive credentials login.
+     */
+    exchangeApiKey(accessKeyId, accessKeySecret) {
+        return this.unary("exchangeApiKey", { accessKeyId, accessKeySecret });
+    }
     /** Exchange an OAuth2 authorization code for tokens (sign in). */
     exchangeOauth2Code(provider, code) {
         return this.unary("exchangeOauth2Code", { provider, code });
@@ -171,6 +179,25 @@ class IdentityClient {
     resendWorkspaceMembershipInvitation(userRef, accessKeyId, token) {
         return this.unary("resendWorkspaceMembershipInvitation", { userRef }, { token, accessKeyId });
     }
+    // --- Workspace API keys ---
+    // Workspace-scoped credentials for unattended, server-to-server integrations.
+    // The active workspace is taken from the accessKeyId metadata, as with members.
+    /** List the active workspace's API keys (secrets are never returned). */
+    listApiKeys(accessKeyId, token) {
+        return this.unary("listApiKeys", {}, { token, accessKeyId });
+    }
+    /** Create an API key; the response carries the secret (shown once). */
+    createApiKey(request, accessKeyId, token) {
+        return this.unary("createApiKey", request, { token, accessKeyId });
+    }
+    /** Rotate a key's secret in place; the new secret is returned (shown once). */
+    regenerateApiKey(ref, accessKeyId, token) {
+        return this.unary("regenerateApiKey", { ref }, { token, accessKeyId });
+    }
+    /** Permanently delete a key (this is the revocation mechanism). */
+    deleteApiKey(ref, accessKeyId, token) {
+        return this.unary("deleteApiKey", { ref }, { token, accessKeyId });
+    }
     getUser(ref, token) {
         return this.unary("getUser", { ref }, { token });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fonoster/identity-client",
-  "version": "0.20.1",
+  "version": "0.22.0",
   "description": "Lightweight client for the Fonoster Identity gRPC service",
   "license": "MIT",
   "main": "dist/index",
@@ -28,5 +28,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "eb410d1401ac015226cd72b6da920e1fb7b5f0cd"
+  "gitHead": "6095b02e5744b17ddc65f48ff1eb6cb54b8de48f"
 }