@greensecurity/javascript-sdk 0.45.0-beta.9 → 0.46.0-beta.1

package/src/models/components/loginrequirementsfromemail.ts

@@ -17,12 +17,46 @@ export type LoginRequirementsFromEmail = {
    * A proper URI where the user should be sent after completing a SAML login. This is encoded into the response you will get if the user requires a SAML login.
    */
   returnUrl: string;
+  /**
+   * Opaque, signed state that Green Security issues when a third-party service
+   *
+   * @remarks
+   * provider starts a "Login with Green Security" SAML flow at
+   * `/saml/idp/sso`. The login screen receives it as the `sso_state` query
+   * string parameter and must pass it back, byte for byte, on every call to
+   * this endpoint for the remainder of the login journey — including the
+   * second call that carries an `mfa_code`.
+   *
+   * The blob is signed, not encrypted, and it expires five minutes after the
+   * service provider's request arrives. Do not parse it, shorten it, decode
+   * it, or re-encode it.
+   *
+   * **An invalid blob does not fail the login.** This is the opposite of what
+   * most integrators assume, so it is worth stating plainly: a forged, edited
+   * or expired `sso_state` is silently discarded, and the request then
+   * proceeds as an ordinary login. Valid credentials still authenticate and
+   * still return `200` — just with no `sso` object, leaving the user signed in
+   * to Green Security with no way back to the service provider that sent them.
+   * Never treat a `200` as proof that the SSO hand-off survived; check for
+   * `sso` explicitly.
+   *
+   * Every `202` response echoes the *verified* blob back in its own
+   * `sso_state` field. Always send back the value from the response you just
+   * received rather than the one you started with, so that a blob the server
+   * has already rejected is never resent, and so a client does not have to
+   * hold state of its own across the login journey.
+   *
+   * Omit this field entirely for an ordinary login that did not originate
+   * from a service provider.
+   */
+  ssoState?: string | undefined;
 };
 
 /** @internal */
 export type LoginRequirementsFromEmail$Outbound = {
   email: string;
   return_url: string;
+  sso_state?: string | undefined;
 };
 
 /** @internal */
@@ -33,9 +67,11 @@ export const LoginRequirementsFromEmail$outboundSchema: z.ZodType<
 > = z.object({
   email: z.string(),
   returnUrl: z.string(),
+  ssoState: z.string().optional(),
 }).transform((v) => {
   return remap$(v, {
     returnUrl: "return_url",
+    ssoState: "sso_state",
   });
 });
 

package/src/models/components/mfarequiredresponse.ts

@@ -36,6 +36,39 @@ export type MfaRequiredResponse = {
    */
   mobilePhone?: string | undefined;
   mfaMethod?: MfaMethod | undefined;
+  /**
+   * Opaque, signed state that Green Security issues when a third-party service
+   *
+   * @remarks
+   * provider starts a "Login with Green Security" SAML flow at
+   * `/saml/idp/sso`. The login screen receives it as the `sso_state` query
+   * string parameter and must pass it back, byte for byte, on every call to
+   * this endpoint for the remainder of the login journey — including the
+   * second call that carries an `mfa_code`.
+   *
+   * The blob is signed, not encrypted, and it expires five minutes after the
+   * service provider's request arrives. Do not parse it, shorten it, decode
+   * it, or re-encode it.
+   *
+   * **An invalid blob does not fail the login.** This is the opposite of what
+   * most integrators assume, so it is worth stating plainly: a forged, edited
+   * or expired `sso_state` is silently discarded, and the request then
+   * proceeds as an ordinary login. Valid credentials still authenticate and
+   * still return `200` — just with no `sso` object, leaving the user signed in
+   * to Green Security with no way back to the service provider that sent them.
+   * Never treat a `200` as proof that the SSO hand-off survived; check for
+   * `sso` explicitly.
+   *
+   * Every `202` response echoes the *verified* blob back in its own
+   * `sso_state` field. Always send back the value from the response you just
+   * received rather than the one you started with, so that a blob the server
+   * has already rejected is never resent, and so a client does not have to
+   * hold state of its own across the login journey.
+   *
+   * Omit this field entirely for an ordinary login that did not originate
+   * from a service provider.
+   */
+  ssoState?: string | undefined;
 };
 
 /** @internal */
@@ -56,10 +89,12 @@ export const MfaRequiredResponse$inboundSchema: z.ZodType<
   error: types.string(),
   mobile_phone: types.optional(types.string()),
   mfa_method: types.optional(MfaMethod$inboundSchema),
+  sso_state: types.optional(types.string()),
 }).transform((v) => {
   return remap$(v, {
     "mobile_phone": "mobilePhone",
     "mfa_method": "mfaMethod",
+    "sso_state": "ssoState",
   });
 });
 

package/src/models/components/passwordnotsetresponse.ts

@@ -20,9 +20,42 @@ export type PasswordNotSetResponse = {
    */
   error: string;
   /**
-   * URL to redirect the user to set their password (forgot password flow). Includes return_url query param when provided in the request.
+   * URL to redirect the user to set their password (forgot password flow). Carries the `return_url` and `sso_state` query params when those were provided on the request, because the browser follows this redirect and leaves the JSON body behind.
    */
   redirectUrl: string;
+  /**
+   * Opaque, signed state that Green Security issues when a third-party service
+   *
+   * @remarks
+   * provider starts a "Login with Green Security" SAML flow at
+   * `/saml/idp/sso`. The login screen receives it as the `sso_state` query
+   * string parameter and must pass it back, byte for byte, on every call to
+   * this endpoint for the remainder of the login journey — including the
+   * second call that carries an `mfa_code`.
+   *
+   * The blob is signed, not encrypted, and it expires five minutes after the
+   * service provider's request arrives. Do not parse it, shorten it, decode
+   * it, or re-encode it.
+   *
+   * **An invalid blob does not fail the login.** This is the opposite of what
+   * most integrators assume, so it is worth stating plainly: a forged, edited
+   * or expired `sso_state` is silently discarded, and the request then
+   * proceeds as an ordinary login. Valid credentials still authenticate and
+   * still return `200` — just with no `sso` object, leaving the user signed in
+   * to Green Security with no way back to the service provider that sent them.
+   * Never treat a `200` as proof that the SSO hand-off survived; check for
+   * `sso` explicitly.
+   *
+   * Every `202` response echoes the *verified* blob back in its own
+   * `sso_state` field. Always send back the value from the response you just
+   * received rather than the one you started with, so that a blob the server
+   * has already rejected is never resent, and so a client does not have to
+   * hold state of its own across the login journey.
+   *
+   * Omit this field entirely for an ordinary login that did not originate
+   * from a service provider.
+   */
+  ssoState?: string | undefined;
 };
 
 /** @internal */
@@ -35,9 +68,11 @@ export const PasswordNotSetResponse$inboundSchema: z.ZodType<
   success: types.boolean(),
   error: types.string(),
   redirect_url: types.string(),
+  sso_state: types.optional(types.string()),
 }).transform((v) => {
   return remap$(v, {
     "redirect_url": "redirectUrl",
+    "sso_state": "ssoState",
   });
 });
 

package/src/models/components/passwordrequiredresponse.ts

@@ -3,6 +3,7 @@
  */
 
 import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
 import { safeParse } from "../../lib/schemas.js";
 import { Result as SafeParseResult } from "../../types/fp.js";
 import * as types from "../../types/primitives.js";
@@ -18,6 +19,39 @@ export type PasswordRequiredResponse = {
    * Error describing the exact condition of what further steps are needed to finish the login process.
    */
   error: string;
+  /**
+   * Opaque, signed state that Green Security issues when a third-party service
+   *
+   * @remarks
+   * provider starts a "Login with Green Security" SAML flow at
+   * `/saml/idp/sso`. The login screen receives it as the `sso_state` query
+   * string parameter and must pass it back, byte for byte, on every call to
+   * this endpoint for the remainder of the login journey — including the
+   * second call that carries an `mfa_code`.
+   *
+   * The blob is signed, not encrypted, and it expires five minutes after the
+   * service provider's request arrives. Do not parse it, shorten it, decode
+   * it, or re-encode it.
+   *
+   * **An invalid blob does not fail the login.** This is the opposite of what
+   * most integrators assume, so it is worth stating plainly: a forged, edited
+   * or expired `sso_state` is silently discarded, and the request then
+   * proceeds as an ordinary login. Valid credentials still authenticate and
+   * still return `200` — just with no `sso` object, leaving the user signed in
+   * to Green Security with no way back to the service provider that sent them.
+   * Never treat a `200` as proof that the SSO hand-off survived; check for
+   * `sso` explicitly.
+   *
+   * Every `202` response echoes the *verified* blob back in its own
+   * `sso_state` field. Always send back the value from the response you just
+   * received rather than the one you started with, so that a blob the server
+   * has already rejected is never resent, and so a client does not have to
+   * hold state of its own across the login journey.
+   *
+   * Omit this field entirely for an ordinary login that did not originate
+   * from a service provider.
+   */
+  ssoState?: string | undefined;
 };
 
 /** @internal */
@@ -29,6 +63,11 @@ export const PasswordRequiredResponse$inboundSchema: z.ZodType<
   requires: types.literal("password"),
   success: types.boolean(),
   error: types.string(),
+  sso_state: types.optional(types.string()),
+}).transform((v) => {
+  return remap$(v, {
+    "sso_state": "ssoState",
+  });
 });
 
 export function passwordRequiredResponseFromJSON(

package/src/models/components/samlloginrequiredresponse.ts

@@ -28,6 +28,39 @@ export type SamlLoginRequiredResponse = {
    * This is the URL that should be opened to initiate the SAML login flow
    */
   ssoUrl: string;
+  /**
+   * Opaque, signed state that Green Security issues when a third-party service
+   *
+   * @remarks
+   * provider starts a "Login with Green Security" SAML flow at
+   * `/saml/idp/sso`. The login screen receives it as the `sso_state` query
+   * string parameter and must pass it back, byte for byte, on every call to
+   * this endpoint for the remainder of the login journey — including the
+   * second call that carries an `mfa_code`.
+   *
+   * The blob is signed, not encrypted, and it expires five minutes after the
+   * service provider's request arrives. Do not parse it, shorten it, decode
+   * it, or re-encode it.
+   *
+   * **An invalid blob does not fail the login.** This is the opposite of what
+   * most integrators assume, so it is worth stating plainly: a forged, edited
+   * or expired `sso_state` is silently discarded, and the request then
+   * proceeds as an ordinary login. Valid credentials still authenticate and
+   * still return `200` — just with no `sso` object, leaving the user signed in
+   * to Green Security with no way back to the service provider that sent them.
+   * Never treat a `200` as proof that the SSO hand-off survived; check for
+   * `sso` explicitly.
+   *
+   * Every `202` response echoes the *verified* blob back in its own
+   * `sso_state` field. Always send back the value from the response you just
+   * received rather than the one you started with, so that a blob the server
+   * has already rejected is never resent, and so a client does not have to
+   * hold state of its own across the login journey.
+   *
+   * Omit this field entirely for an ordinary login that did not originate
+   * from a service provider.
+   */
+  ssoState?: string | undefined;
 };
 
 /** @internal */
@@ -41,10 +74,12 @@ export const SamlLoginRequiredResponse$inboundSchema: z.ZodType<
   error: types.string(),
   sso_instructions: types.optional(types.string()),
   sso_url: types.string(),
+  sso_state: types.optional(types.string()),
 }).transform((v) => {
   return remap$(v, {
     "sso_instructions": "ssoInstructions",
     "sso_url": "ssoUrl",
+    "sso_state": "ssoState",
   });
 });
 

package/src/models/components/ssocontinuation.ts

@@ -0,0 +1,71 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+
+/**
+ * Where to send the browser to finish a "Login with Green Security" flow.
+ *
+ * @remarks
+ *
+ * Present on a `200` from `POST /users/authenticate` only when the request
+ * carried a valid, unexpired `sso_state`. Its absence means the login
+ * succeeded but the SAML flow did not resume — treat the login as an
+ * ordinary one rather than retrying.
+ *
+ * This object is additive. The login itself is unaffected by it: the
+ * caller's own permanent token is in `user_token` exactly as it would be on
+ * any other successful authentication, and it is not the token embedded in
+ * `continue_url`.
+ */
+export type SsoContinuation = {
+  /**
+   * An absolute, single-use URL on Green Security's domain. Navigate the
+   *
+   * @remarks
+   * browser to it (a full page navigation, not `fetch`); it answers with a
+   * self-submitting form that POSTs the signed `SAMLResponse` and the
+   * original `RelayState` to the service provider's assertion consumer
+   * service URL.
+   *
+   * The `token` in this URL is a separate **one-time** token that is
+   * consumed the first time the URL is followed, so the URL is good for
+   * exactly one navigation. It is not the caller's permanent token, which
+   * is returned unchanged in `user_token`. Treat the URL as a secret:
+   * whoever follows it first receives that user's assertion.
+   *
+   * Never fetch this URL from your own back end: the response is meant for
+   * the user's browser, and posting the assertion from anywhere else
+   * breaks the flow.
+   */
+  continueUrl: string;
+};
+
+/** @internal */
+export const SsoContinuation$inboundSchema: z.ZodType<
+  SsoContinuation,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  continue_url: types.string(),
+}).transform((v) => {
+  return remap$(v, {
+    "continue_url": "continueUrl",
+  });
+});
+
+export function ssoContinuationFromJSON(
+  jsonString: string,
+): SafeParseResult<SsoContinuation, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => SsoContinuation$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'SsoContinuation' from JSON`,
+  );
+}

package/src/models/components/system.ts

@@ -0,0 +1,39 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+
+/**
+ * A simplified representation of a System, typically used in list views.
+ */
+export type System = {
+  id: number;
+  name: string;
+  /**
+   * URL of the system's logo (thumbnail size), or null if none has been uploaded.
+   */
+  image?: string | null | undefined;
+};
+
+/** @internal */
+export const System$inboundSchema: z.ZodType<System, z.ZodTypeDef, unknown> = z
+  .object({
+    id: types.number(),
+    name: types.string(),
+    image: z.nullable(types.string()).optional(),
+  });
+
+export function systemFromJSON(
+  jsonString: string,
+): SafeParseResult<System, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => System$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'System' from JSON`,
+  );
+}

package/src/models/components/vendorcredentialsummary.ts

@@ -14,9 +14,9 @@ import {
   BackgroundCheckResult$inboundSchema,
 } from "./backgroundcheckresult.js";
 import { Company, Company$inboundSchema } from "./company.js";
-import { CompanyLookup, CompanyLookup$inboundSchema } from "./companylookup.js";
 import { Credential, Credential$inboundSchema } from "./credential.js";
 import { Invoice, Invoice$inboundSchema } from "./invoice.js";
+import { System, System$inboundSchema } from "./system.js";
 import { Vendor, Vendor$inboundSchema } from "./vendor.js";
 import {
   VendorCredentialDataRequest,
@@ -88,6 +88,10 @@ export type VendorCredentialSummary = {
   appliesToCompany?: boolean | null | undefined;
   credential?: Credential | number | null | undefined;
   vendor?: Vendor | number | null | undefined;
+  /**
+   * The systems, among the company's active target facilities, that require this credential. Only present when the `vendor_credential.systems` expand scope is requested.
+   */
+  systems?: Array<System> | null | undefined;
   invoice?: Invoice | number | null | undefined;
   quote?: Invoice | number | null | undefined;
   vendorCredentialFiles?: Array<VendorCredentialFile | null> | undefined;
@@ -113,7 +117,6 @@ export type VendorCredentialSummary = {
   totalPendingCredentials?: number | null | undefined;
   backgroundCheckProviderId?: number | null | undefined;
   requiresAdminReview?: boolean | null | undefined;
-  systems?: Array<CompanyLookup> | null | undefined;
 };
 
 /** @internal */
@@ -311,6 +314,7 @@ export const VendorCredentialSummary$inboundSchema: z.ZodType<
     .optional(),
   vendor: z.nullable(smartUnion([Vendor$inboundSchema, types.number()]))
     .optional(),
+  systems: z.nullable(z.array(System$inboundSchema)).optional(),
   invoice: z.nullable(smartUnion([Invoice$inboundSchema, types.number()]))
     .optional(),
   quote: z.nullable(smartUnion([Invoice$inboundSchema, types.number()]))
@@ -347,7 +351,6 @@ export const VendorCredentialSummary$inboundSchema: z.ZodType<
   total_pending_credentials: z.nullable(types.number()).optional(),
   background_check_provider_id: z.nullable(types.number()).optional(),
   requires_admin_review: z.nullable(types.boolean()).optional(),
-  systems: z.nullable(z.array(CompanyLookup$inboundSchema)).optional(),
 }).transform((v) => {
   return remap$(v, {
     "date_due": "dateDue",

package/src/models/components/vendortargetfacility.ts

@@ -36,6 +36,10 @@ export type VendorTargetFacility = {
    * Whether all TIP 1 screening questions for this facility have been answered by the vendor.
    */
   questionsAnswered: boolean | null;
+  /**
+   * Whether the vendor has answered at least one target-facility screening question for this facility. Only present when `vendor_target_facility.has_screening_responses` is passed to `expand`. Combined with `questions_answered` it distinguishes "View" (answered some) from "None" (no questions answered) in the individual's subscription view.
+   */
+  hasScreeningResponses?: boolean | undefined;
   dateCreated?: Date | null | undefined;
 };
 
@@ -68,10 +72,12 @@ export const VendorTargetFacility$inboundSchema: z.ZodType<
   ),
   status: types.nullable(types.string()),
   questions_answered: types.nullable(types.boolean()),
+  has_screening_responses: types.optional(types.boolean()),
   date_created: z.nullable(types.date()).optional(),
 }).transform((v) => {
   return remap$(v, {
     "questions_answered": "questionsAnswered",
+    "has_screening_responses": "hasScreeningResponses",
     "date_created": "dateCreated",
   });
 });

package/src/models/components/vendortargetfacilityscreeningresponse.ts

@@ -0,0 +1,70 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import * as types from "../../types/primitives.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+
+/**
+ * A target-facility screening question paired with the vendor's answer, for read-only review. Included for every question that currently applies to the vendor at the facility, whether or not it has been answered.
+ */
+export type VendorTargetFacilityScreeningResponse = {
+  /**
+   * ScreeningResponse row ID, or null when the question has not been answered.
+   */
+  id?: number | null | undefined;
+  screeningQuestionId: number;
+  /**
+   * The text of the screening question.
+   */
+  question?: string | null | undefined;
+  screeningAnswerId?: number | null | undefined;
+  /**
+   * The vendor's answer: the free-text custom_answer when one was entered, otherwise the selected preset answer text (comma-joined for multi-select). Null when the question has not been answered.
+   */
+  answer?: string | null | undefined;
+  /**
+   * Free-text answer entered by the vendor, if applicable.
+   */
+  customAnswer?: string | null | undefined;
+  /**
+   * Whether the vendor has answered this question.
+   */
+  answered: boolean;
+};
+
+/** @internal */
+export const VendorTargetFacilityScreeningResponse$inboundSchema: z.ZodType<
+  VendorTargetFacilityScreeningResponse,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  id: z.nullable(types.number()).optional(),
+  screening_question_id: types.number(),
+  question: z.nullable(types.string()).optional(),
+  screening_answer_id: z.nullable(types.number()).optional(),
+  answer: z.nullable(types.string()).optional(),
+  custom_answer: z.nullable(types.string()).optional(),
+  answered: types.boolean(),
+}).transform((v) => {
+  return remap$(v, {
+    "screening_question_id": "screeningQuestionId",
+    "screening_answer_id": "screeningAnswerId",
+    "custom_answer": "customAnswer",
+  });
+});
+
+export function vendorTargetFacilityScreeningResponseFromJSON(
+  jsonString: string,
+): SafeParseResult<VendorTargetFacilityScreeningResponse, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      VendorTargetFacilityScreeningResponse$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'VendorTargetFacilityScreeningResponse' from JSON`,
+  );
+}

package/src/models/components/webhooksubscription.ts

@@ -12,6 +12,9 @@ import { ClosedEnum } from "../../types/enums.js";
  * and `destroyed` lifecycle of every entity that supports webhooks.
  */
 export const WebhookSubscription = {
+  FullReportCreated: "FullReport.created",
+  FullReportUpdated: "FullReport.updated",
+  FullReportDestroyed: "FullReport.destroyed",
   TargetFacilityStatusChangeCreated: "TargetFacilityStatusChange.created",
   TargetFacilityStatusChangeUpdated: "TargetFacilityStatusChange.updated",
   TargetFacilityStatusChangeDestroyed: "TargetFacilityStatusChange.destroyed",

package/src/models/components/webhooksubscriptiondetail.ts

@@ -14,6 +14,7 @@ import { SDKValidationError } from "../errors/sdkvalidationerror.js";
  * The entity the event is about.
  */
 export const Model = {
+  FullReport: "FullReport",
   TargetFacilityStatusChange: "TargetFacilityStatusChange",
   Vendor: "Vendor",
   VendorScan: "VendorScan",

package/src/models/operations/createevent.ts

@@ -32,6 +32,23 @@ export type CreateEventRequestBody = {
   inviteeUserIds?: Array<number> | undefined;
   inviteeDepartmentIds?: Array<number> | undefined;
   notes?: string | undefined;
+  /**
+   * The user the appointment is booked for. Defaults to the authenticated user, which
+   *
+   * @remarks
+   * is what a vendor or a facility user means. An API service account has no calendar
+   * of its own, so it names one here; the user must be a contact of the selected
+   * facility (or of its system), or a vendor targeting it.
+   */
+  organizerUserId?: number | undefined;
+  /**
+   * The time zone `begin_date`/`begin_time` and `end_date`/`end_time` are given in, as
+   *
+   * @remarks
+   * a Rails time zone name (e.g. "Central Time (US & Canada)"). Defaults to the
+   * organizer's own time zone.
+   */
+  timezone?: string | undefined;
 };
 
 /**
@@ -57,6 +74,8 @@ export type CreateEventRequestBody$Outbound = {
   invitee_user_ids?: Array<number> | undefined;
   invitee_department_ids?: Array<number> | undefined;
   notes?: string | undefined;
+  organizer_user_id?: number | undefined;
+  timezone?: string | undefined;
 };
 
 /** @internal */
@@ -78,6 +97,8 @@ export const CreateEventRequestBody$outboundSchema: z.ZodType<
   inviteeUserIds: z.array(z.number().int()).optional(),
   inviteeDepartmentIds: z.array(z.number().int()).optional(),
   notes: z.string().optional(),
+  organizerUserId: z.number().int().optional(),
+  timezone: z.string().optional(),
 }).transform((v) => {
   return remap$(v, {
     facilityId: "facility_id",
@@ -91,6 +112,7 @@ export const CreateEventRequestBody$outboundSchema: z.ZodType<
     endDate: "end_date",
     inviteeUserIds: "invitee_user_ids",
     inviteeDepartmentIds: "invitee_department_ids",
+    organizerUserId: "organizer_user_id",
   });
 });