@insurance-broker/api-client 5.19.0 → 5.20.0

package/README.md

@@ -27,6 +27,26 @@ package only describes the shapes it carries.
 Nothing here is written by hand except the entry point. The types come from the backend's committed
 `docs/api/openapi.json`, and the backend's own CI fails if the two drift apart.
 
+## Responses the per-route types do not list
+
+**Any customer-realm route can answer `401` with problem type
+`urn:brokerplatform:problem:session-revoked`**, not only the routes whose description mentions it.
+The platform's tenant resolution produces this answer before a route runs, so the generated types do
+not list it on each operation. It means the customer signed out every session
+(`POST /api/v1/customer-account/sessions/revocation`) after this session was authenticated.
+
+- Do **not** answer it by refreshing. The identity provider will issue a new token, and the API will
+  refuse it in the same way.
+- Do **not** answer it with a `prompt=login` sign-in on its own. On a device that still holds the
+  identity provider's session cookie, that re-authenticates the *same* session and re-admits every
+  refresh token copied from it.
+- Do this instead:
+  1. End the identity provider's session with RP-initiated logout and `id_token_hint`.
+  2. Discard the stored tokens.
+  3. Sign in again.
+
+The backend's ADR-0049 has the reasoning, including the 2026-10-11 amendment.
+
 ## Versioning
 
 Semantic versioning against the **contract**, not against this file:

package/dist/schema.d.ts

@@ -3009,6 +3009,32 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/customer-account/sessions/revocation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Signs the customer out of every session they have established, including this one.
+         * @description **Every sign-in this customer established up to now stops working against this API on its next request — including the one making this call.** That is the stolen-device remedy (SEC-012): a phone that is lost keeps a session the customer cannot reach, and this ends what that session can do here without needing the phone.
+         *
+         *     **What a client must do afterwards.** Every request from a session established before the returned `revokedAtUtc` (plus a few seconds' clock allowance) is answered `401` with problem type `urn:brokerplatform:problem:session-revoked` — on any customer route, not only this one. **Do not refresh in answer to it**: the identity provider will issue a new token and that token will be refused the same way, because it belongs to the same sign-in. **Do not answer it with a `prompt=login` sign-in alone either**: on a device that still holds the identity provider's session cookie, that re-authenticates the *same* session and re-admits every refresh token copied from it. End the identity provider's session first (RP-initiated logout with `id_token_hint`), discard the stored tokens, then sign in.
+         *
+         *     **Tell the customer to change their password, and to secure their email account.** Signing out does not stop somebody who knows the password from signing in again, and a password can be reset through the email address.
+         *
+         *     **What it does not do yet.** It does not end the sessions at the identity provider, list them, or end one and keep the others; those need the isolated identity-management component ADR-0049 describes. A `409` means the caller is acting for an organisation: sessions belong to the person, so act personally to revoke them.
+         */
+        post: operations["RevokeOwnCustomerSessions"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/customer-account/redemption": {
         parameters: {
             query?: never;
@@ -7240,6 +7266,10 @@ export interface components {
             /** Format: double */
             distanceKm: null | number | string;
         };
+        CustomerSessionRevocationResponse: {
+            /** Format: date-time */
+            revokedAtUtc: string;
+        };
         CustomerSubmissionAttachmentResponse: {
             /** Format: uuid */
             id: string;
@@ -16668,6 +16698,42 @@ export interface operations {
             };
         };
     };
+    RevokeOwnCustomerSessions: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The organisation to act for: one of the identifiers GET /api/v1/customer/contexts lists. Omit it, or send it empty, to act for your own account; there is no mode in which it becomes mandatory. A value you hold no active membership of, or one that is not an organisation identifier, is refused with 403 naming nothing, and never quietly treated as your own account. */
+                "X-Broker-Acting-For"?: components["parameters"]["ActingFor"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
+                    "X-Broker-Acting-For"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CustomerSessionRevocationResponse"];
+                };
+            };
+            /** @description Conflict. A type of urn:brokerplatform:problem:concurrency-conflict means someone else changed the record first and nothing was written: read it again and decide again. Any other type is a conflict this operation decided itself, and retrying it unchanged will not help. */
+            409: {
+                headers: {
+                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
+                    "X-Broker-Acting-For"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ConcurrencyConflictProblem"] | components["schemas"]["ProblemDetails"];
+                };
+            };
+        };
+    };
     RedeemCustomerInvitation: {
         parameters: {
             query?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insurance-broker/api-client",
-  "version": "5.19.0",
+  "version": "5.20.0",
   "description": "Generated TypeScript client for the Insurance Broker Platform API. Do not edit by hand: regenerate with scripts/update-api-contract.",
   "license": "UNLICENSED",
   "private": false,