@greensecurity/javascript-sdk 0.45.0-beta.22 → 0.45.0-beta.23

package/src/sdk/users.ts

@@ -29,6 +29,8 @@ export class Users extends ClientSDK {
    * By default the response returns a compact profile (id, name, email,
    * phone, timezone, user type, and a handful of confirmation flags).
    *
+   * **Permissions.** Requires a valid token only - a caller may always read their own record.
+   *
    * Supported `expand` values:
    * - `user` — return the full user record, including all profile fields stored against the user (sensitive columns such as passwords, MFA codes, and payment-provider IDs are always omitted)
    * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)
@@ -59,6 +61,8 @@ export class Users extends ClientSDK {
    * By default the response returns a compact profile (id, name, email,
    * phone, timezone, user type, and a handful of confirmation flags).
    *
+   * **Permissions.** Requires any of `users.view`, `vendors.view`, `contacts.view`, `inventory_managers.view` or `company_managers.view`. Which one applies depends on the target user's type; callers may always read their own record.
+   *
    * Supported `expand` values:
    * - `user` — return the full user record (sensitive columns such as passwords and payment-provider IDs are always omitted)
    * - `user.email_preferences` — include the user's `email_preferences` block (notification recipients, weekly email flags, and — for company managers — `receive_vendor_emails`)
@@ -101,6 +105,8 @@ export class Users extends ClientSDK {
    * `GET ?expand=user.email_preferences` call.
    *
    * To rotate an API token use `POST /users/api_key_rotator` instead.
+   *
+   * **Permissions.** Requires the `users.edit` permission.
    */
   async updateUser(
     request: operations.UpdateUserRequest,
@@ -185,6 +191,8 @@ export class Users extends ClientSDK {
    * same blob; the user has to start again from the service provider. See the
    * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
    * guide for the service provider half of this flow.
+   *
+   * **Permissions.** No authentication required.
    */
   async postAuthenticate(
     request: operations.PostAuthenticateRequestBody,
@@ -202,6 +210,8 @@ export class Users extends ClientSDK {
    *
    * @remarks
    * Allows an API user to rotate their own API key. Note, the key rotation happens immediately so the user should be prepared to update their API key in their application for all subsequent requests.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async rotateApiKey(
     options?: RequestOptions,
@@ -224,6 +234,8 @@ export class Users extends ClientSDK {
    * API users may additionally pass a numeric `user_id` to fetch another user's
    * linked users, provided they have an active app activation for that user.
    * Non-API users may only pass `me`.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async getLinkedUsers(
     request: operations.GetLinkedUsersRequest,
@@ -241,6 +253,8 @@ export class Users extends ClientSDK {
    *
    * @remarks
    * If a user has two different types of accounts (i.e. Company Manager and Vendor) this endpoint allows the integration to swap the token from the existing user to the linked account user. For API integrations, the `source_user_id` field is required and must be the ID of the user whose session will be switched into the target user's token.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async switchAccount(
     request: operations.SwitchAccountRequestBody,
@@ -258,6 +272,8 @@ export class Users extends ClientSDK {
    *
    * @remarks
    * It sends an email with a magic link to allow the user to log in.
+   *
+   * **Permissions.** No authentication required.
    */
   async magiclink(
     request: operations.MagiclinkRequestBody,
@@ -275,6 +291,8 @@ export class Users extends ClientSDK {
    *
    * @remarks
    * It sends an email with a link for resetting a user's password.
+   *
+   * **Permissions.** No authentication required.
    */
   async passwordResetRequest(
     request: operations.PasswordResetRequestRequestBody,
@@ -293,6 +311,8 @@ export class Users extends ClientSDK {
    * @remarks
    * Resets the a user's password using a password_reset_id that was sent to them via email.
    * See /users/passwordresetrequest to initiate a password reset flow.
+   *
+   * **Permissions.** No authentication required.
    */
   async password(
     request: operations.PasswordRequestBody,
@@ -310,6 +330,8 @@ export class Users extends ClientSDK {
    *
    * @remarks
    * Change the user's password to the new passed as parameter
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async changePassword(
     request: operations.ChangePasswordRequest,
@@ -326,7 +348,9 @@ export class Users extends ClientSDK {
    * Register profile picture metadata for S3 direct upload
    *
    * @remarks
-   * Register profile picture metadata for a user and obtain a presigned S3 upload URL. The flow is two-step: (1) call this endpoint with the image's file name, content type, and size; (2) PUT the file bytes to the returned upload_url with the matching Content-Type header. The file is stored at user_profile_image/{id}{ext} in the uploads bucket, where {ext} is derived from image_file_name and may be empty, and is processed asynchronously (resize to tiny/thumb/large variants). Use 'me' as the id for the authenticated user. Requires authentication and either self-ownership or 'users:edit' permission. API users must be authorized via MarketplaceAppActivation for the target user.
+   * 'Register profile picture metadata for a user and obtain a presigned S3 upload URL. The flow is two-step: (1) call this endpoint with the image''s file name, content type, and size; (2) PUT the file bytes to the returned upload_url with the matching Content-Type header. The file is stored at user_profile_image/{id}{ext} in the uploads bucket, where {ext} is derived from image_file_name and may be empty, and is processed asynchronously (resize to tiny/thumb/large variants). Use ''me'' as the id for the authenticated user. Requires authentication and either self-ownership or ''users:edit'' permission. API users must be authorized via MarketplaceAppActivation for the target user.'
+   *
+   * **Permissions.** For a regular user, requires self-ownership or the `users.edit` permission. For an API user, `users.edit` is not checked at all — authorization instead runs through the caller's update access scope on the target user, which a `MarketplaceAppActivation` grants at the user or site level.
    */
   async updateUserProfilePicture(
     request: operations.UpdateUserProfilePictureRequest,

package/src/sdk/vendorfields.ts

@@ -20,6 +20,8 @@ export class VendorFields extends ClientSDK {
    *
    * For API users: source_user_id is required. The API user acts on behalf of that user
    * (e.g. a company manager). The app must be activated for that user via MarketplaceAppActivation.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async createVendorField(
     request: operations.CreateVendorFieldRequestBody,
@@ -40,6 +42,8 @@ export class VendorFields extends ClientSDK {
    * the name cannot be modified after creation.
    *
    * For API users: source_user_id is required. The API user acts on behalf of that user.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async updateVendorField(
     request: operations.UpdateVendorFieldRequest,