@insurance-broker/api-client 5.19.0 → 5.21.0

package/README.md

@@ -27,6 +27,26 @@ package only describes the shapes it carries.
 Nothing here is written by hand except the entry point. The types come from the backend's committed
 `docs/api/openapi.json`, and the backend's own CI fails if the two drift apart.
 
+## Responses the per-route types do not list
+
+**Any customer-realm route can answer `401` with problem type
+`urn:brokerplatform:problem:session-revoked`**, not only the routes whose description mentions it.
+The platform's tenant resolution produces this answer before a route runs, so the generated types do
+not list it on each operation. It means the customer signed out every session
+(`POST /api/v1/customer-account/sessions/revocation`) after this session was authenticated.
+
+- Do **not** answer it by refreshing. The identity provider will issue a new token, and the API will
+  refuse it in the same way.
+- Do **not** answer it with a `prompt=login` sign-in on its own. On a device that still holds the
+  identity provider's session cookie, that re-authenticates the *same* session and re-admits every
+  refresh token copied from it.
+- Do this instead:
+  1. End the identity provider's session with RP-initiated logout and `id_token_hint`.
+  2. Discard the stored tokens.
+  3. Sign in again.
+
+The backend's ADR-0049 has the reasoning, including the 2026-10-11 amendment.
+
 ## Versioning
 
 Semantic versioning against the **contract**, not against this file:

package/dist/schema.d.ts

@@ -3009,6 +3009,32 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/customer-account/sessions/revocation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Signs the customer out of every session they have established, including this one.
+         * @description **Every sign-in this customer established up to now stops working against this API on its next request — including the one making this call.** That is the stolen-device remedy (SEC-012): a phone that is lost keeps a session the customer cannot reach, and this ends what that session can do here without needing the phone.
+         *
+         *     **What a client must do afterwards.** Every request from a session established before the returned `revokedAtUtc` (plus a few seconds' clock allowance) is answered `401` with problem type `urn:brokerplatform:problem:session-revoked` — on any customer route, not only this one. **Do not refresh in answer to it**: the identity provider will issue a new token and that token will be refused the same way, because it belongs to the same sign-in. **Do not answer it with a `prompt=login` sign-in alone either**: on a device that still holds the identity provider's session cookie, that re-authenticates the *same* session and re-admits every refresh token copied from it. End the identity provider's session first (RP-initiated logout with `id_token_hint`), discard the stored tokens, then sign in.
+         *
+         *     **Tell the customer to change their password, and to secure their email account.** Signing out does not stop somebody who knows the password from signing in again, and a password can be reset through the email address.
+         *
+         *     **What it does not do yet.** It does not end the sessions at the identity provider, list them, or end one and keep the others; those need the isolated identity-management component ADR-0049 describes. A `409` means the caller is acting for an organisation: sessions belong to the person, so act personally to revoke them.
+         */
+        post: operations["RevokeOwnCustomerSessions"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/customer-account/redemption": {
         parameters: {
             query?: never;
@@ -3026,6 +3052,69 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/customer-verification-methods": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The ways this broker's staff may verify a customer before signing them out, in the broker's order.
+         * @description The broker's closed set of verification methods (ADR-0049). A member of staff signing a customer out of every session picks one of these keys and the choice is recorded in the audit entry. The set is configuration, never empty once configured; an empty list means this broker has not configured one yet, and staff-assisted sign-out is refused until it does.
+         */
+        get: operations["ListCustomerVerificationMethods"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/customers/{id}/sessions/revocation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Signs a customer out of every session they have established, after a member of staff has verified them.
+         * @description **Every sign-in this customer established up to now stops working against this API on its next request** — the same effect as the customer's own `POST /api/v1/customer-account/sessions/revocation`, for a customer who rings in because a device was lost or stolen (SEC-012). The customer signs in again afterwards on the device they hold.
+         *
+         *     **Verify the customer first, then say how.** `verificationMethod` is a key from `GET /api/v1/customer-verification-methods`, this broker's closed set; `reason` is required, at most 500 characters, and is recorded with the method and the member of staff in the audit entry on the customer record (action `crm.customer.sessions-revoked-by-staff`). Tell the customer to change their password and secure their email account: signing out does not stop somebody who knows the password.
+         *
+         *     **Refusals.** `400` when either field is missing or the reason is too long. `404` when the customer is not this broker's. `409` with problem type `urn:brokerplatform:problem:verification-method-not-offered` when the method is not in this broker's set (or the broker has configured none) — read the set and choose from it. `409` with no type when the customer has never attached a sign-in account, so has no session to end.
+         *
+         *     **What it does not do yet.** It does not end the sessions at the identity provider or list them; those need the isolated identity-management component ADR-0049 describes.
+         */
+        post: operations["RevokeCustomerSessions"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/customer/contexts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** The parties the signed-in customer may act as: themselves, and every organisation they hold an active membership of. The identifier of each is what X-Broker-Acting-For takes. */
+        get: operations["ListActingContexts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/organisations": {
         parameters: {
             query?: never;
@@ -3164,23 +3253,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/v1/customer/contexts": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** The parties the signed-in customer may act as: themselves, and every organisation they hold an active membership of. The identifier of each is what X-Broker-Acting-For takes. */
-        get: operations["ListActingContexts"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/v1/customer/organisations/{id}/membership/acceptance": {
         parameters: {
             query?: never;
@@ -7240,6 +7312,10 @@ export interface components {
             /** Format: double */
             distanceKm: null | number | string;
         };
+        CustomerSessionRevocationResponse: {
+            /** Format: date-time */
+            revokedAtUtc: string;
+        };
         CustomerSubmissionAttachmentResponse: {
             /** Format: uuid */
             id: string;
@@ -7271,6 +7347,11 @@ export interface components {
             help: null | string;
             section: null | string;
         };
+        CustomerVerificationMethodResponse: {
+            key: string;
+            name: string;
+            description: null | string;
+        };
         DataClassificationResponse: {
             key: string;
             name: string;
@@ -9559,6 +9640,17 @@ export interface components {
             /** Format: uuid */
             conflictingPaymentId: string;
         };
+        StaffCustomerSessionRevocationRequest: {
+            verificationMethod: null | string;
+            reason: null | string;
+        };
+        StaffCustomerSessionRevocationResponse: {
+            /** Format: uuid */
+            customerId: string;
+            /** Format: date-time */
+            revokedAtUtc: string;
+            verificationMethod: string;
+        };
         StaffNameResponse: {
             subjectId: string;
             displayName: string;
@@ -16668,6 +16760,42 @@ export interface operations {
             };
         };
     };
+    RevokeOwnCustomerSessions: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The organisation to act for: one of the identifiers GET /api/v1/customer/contexts lists. Omit it, or send it empty, to act for your own account; there is no mode in which it becomes mandatory. A value you hold no active membership of, or one that is not an organisation identifier, is refused with 403 naming nothing, and never quietly treated as your own account. */
+                "X-Broker-Acting-For"?: components["parameters"]["ActingFor"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
+                    "X-Broker-Acting-For"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CustomerSessionRevocationResponse"];
+                };
+            };
+            /** @description Conflict. A type of urn:brokerplatform:problem:concurrency-conflict means someone else changed the record first and nothing was written: read it again and decide again. Any other type is a conflict this operation decided itself, and retrying it unchanged will not help. */
+            409: {
+                headers: {
+                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
+                    "X-Broker-Acting-For"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ConcurrencyConflictProblem"] | components["schemas"]["ProblemDetails"];
+                };
+            };
+        };
+    };
     RedeemCustomerInvitation: {
         parameters: {
             query?: never;
@@ -16697,6 +16825,102 @@ export interface operations {
             };
         };
     };
+    ListCustomerVerificationMethods: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CustomerVerificationMethodResponse"][];
+                };
+            };
+        };
+    };
+    RevokeCustomerSessions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StaffCustomerSessionRevocationRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StaffCustomerSessionRevocationResponse"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["HttpValidationProblemDetails"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Conflict. A type of urn:brokerplatform:problem:concurrency-conflict means someone else changed the record first and nothing was written: read it again and decide again. Any other type is a conflict this operation decided itself, and retrying it unchanged will not help. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ConcurrencyConflictProblem"] | components["schemas"]["ProblemDetails"];
+                };
+            };
+        };
+    };
+    ListActingContexts: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description The organisation to act for: one of the identifiers GET /api/v1/customer/contexts lists. Omit it, or send it empty, to act for your own account; there is no mode in which it becomes mandatory. A value you hold no active membership of, or one that is not an organisation identifier, is refused with 403 naming nothing, and never quietly treated as your own account. */
+                "X-Broker-Acting-For"?: components["parameters"]["ActingFor"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
+                    "X-Broker-Acting-For"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ActingContextResponse"][];
+                };
+            };
+        };
+    };
     ListOrganisations: {
         parameters: {
             query?: {
@@ -17076,31 +17300,6 @@ export interface operations {
             };
         };
     };
-    ListActingContexts: {
-        parameters: {
-            query?: never;
-            header?: {
-                /** @description The organisation to act for: one of the identifiers GET /api/v1/customer/contexts lists. Omit it, or send it empty, to act for your own account; there is no mode in which it becomes mandatory. A value you hold no active membership of, or one that is not an organisation identifier, is refused with 403 naming nothing, and never quietly treated as your own account. */
-                "X-Broker-Acting-For"?: components["parameters"]["ActingFor"];
-            };
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    /** @description The party this request actually acted for. Present, carrying the organisation identifier, when it acted for an organisation; absent when it acted for your own account. It mirrors the request header, so it can be sent back unchanged. Compare it with what you meant to send: it is the only way to see that a request you meant for an organisation was made personally. */
-                    "X-Broker-Acting-For"?: string;
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ActingContextResponse"][];
-                };
-            };
-        };
-    };
     AcceptOrganisationMembership: {
         parameters: {
             query?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insurance-broker/api-client",
-  "version": "5.19.0",
+  "version": "5.21.0",
   "description": "Generated TypeScript client for the Insurance Broker Platform API. Do not edit by hand: regenerate with scripts/update-api-contract.",
   "license": "UNLICENSED",
   "private": false,