@insignia-education/api-sdk-js 0.16.1 → 0.16.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insignia-education/api-sdk-js",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "JavaScript SDK for the Insignia Education API",
   "main": "index.js",
   "type": "module",

package/src/api/v1/Search.js

@@ -9,6 +9,11 @@ export default class Search {
      * Sales-and-above global search: users (name/email/dni) and courses (cod/title).
      * `offset` pages through the user results only (courses are always the first page) —
      * response includes `users_has_more` to know whether another page exists.
+     * `includeTrashed` opts into soft-deleted accounts (flagged via `deleted_at` on the
+     * returned row) — off by default, since this same endpoint also backs pickers (coupon
+     * grant, referrer) that must never offer a deleted account as a valid target.
      */
-    query(q, offset = 0) { return this.#client.get('/search', { q, offset }); }
+    query(q, offset = 0, includeTrashed = false) {
+        return this.#client.get('/search', { q, offset, include_trashed: includeTrashed ? 1 : undefined });
+    }
 }

package/src/api/v1/Users.js

@@ -247,8 +247,20 @@ export default class Users {
     /** Admin-only: lifts a hard block. */
     unblock(userId) { return this.#client.post(`/users/${userId}/unblock`); }
 
-    /** GDPR erasure request — self-service or sales-and-above, always confirmed with the ACTOR's own current password. Soft-deletes now; the API permanently purges it after a 1-year retention window. */
-    delete(userId, password) { return this.#client.del(`/users/${userId}`, { password }); }
+    /**
+     * GDPR erasure request — self-service or sales-and-above. `data` is either
+     * `{ password, captcha_token }` or `{ webauthn_credential }`, same step-up
+     * shape as payments().verify()/reject(). Soft-deletes now; the API
+     * permanently purges it after a 1-year retention window, and immediately
+     * emails a one-time undo link to the account's own address.
+     */
+    delete(userId, data) { return this.#client.del(`/users/${userId}`, data); }
+
+    /** Sellers+: reverses a soft-deletion found via the global search (which includes trashed accounts). */
+    restore(userId) { return this.#client.post(`/users/${userId}/restore`); }
+
+    /** Public — the account is soft-deleted so its own session is already dead; this is the only way it gets back in. No auth. */
+    undoDeletionConfirm(hash) { return this.#client.post(`/accounts/undo-deletion/${hash}`); }
 
     /** GDPR access/portability request (Art. 15/20) — self-service or sales-and-above. Runs synchronously and returns the DataRequest with `pdf_url`/`json_url` already populated. */
     exportData(userId) { return this.#client.post(`/users/${userId}/data-export`); }