@keboola/api-client 21.0.0 → 24.0.0

package/dist/{types-CbEJaobw.d.ts → types-Cgh3jqrV.d.cts}

@@ -1,4 +1,4 @@
-import { b as OpenapiBodyType, a as OpenapiReturnType, d as OpenapiPathType } from './types-jKnx7Tm_.js';
+import { O as OpenapiBodyType, b as OpenapiReturnType, d as OpenapiPathType } from './types-gcShAmmi.cjs';
 
 /**
  * This file was auto-generated by openapi-typescript.
@@ -106,6 +106,66 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/v1/auth/password/change': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Change the current admin's password
+     * @description Verifies the current password and applies the new one. Optionally (revokeOtherSessions=true) revokes every other session of the admin and the tokens derived from them; the calling session always stays valid.
+     */
+    post: operations['post_auth_password_change'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/password/reset': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Reset a password with a reset token
+     * @description Validates the single-use reset token, applies the new password, and (by default) revokes every session of the admin and the tokens derived from them; pass revokeSessions=false to keep sessions alive. User-created Personal Access Tokens are never affected.
+     */
+    post: operations['post_auth_password_reset'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/password/reset-request': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Request a password reset token
+     * @description Sends a single-use, short-lived password-reset token to the given email if it belongs to a password-eligible account. The response is always 202 Accepted and reveals nothing about whether the account exists.
+     */
+    post: operations['post_auth_password_reset_request'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/v1/auth/pat': {
     parameters: {
       query?: never;
@@ -305,7 +365,7 @@ type paths = {
     put?: never;
     /**
      * Step-up authentication (sudo)
-     * @description Verifies a TOTP or recovery code and activates a sudo window on the current session. Required for sensitive operations annotated with #[RequiresSudo].
+     * @description Verifies a TOTP code, recovery code, WebAuthn assertion, or — for accounts without MFA only — the account password, and activates a sudo window on the current session. Required for sensitive operations annotated with #[RequiresSudo].
      */
     post: operations['post_/v1/auth/sudo'];
     delete?: never;
@@ -394,6 +454,82 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/v1/auth/mfa/totp/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Remove the TOTP factor
+     * @description Removes the authenticated admin's TOTP factor. Since TOTP is always the admin's only factor of its type, this disables MFA entirely and wipes recovery codes.
+     */
+    delete: operations['delete_auth_mfa_totp_delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/mfa/totp': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Start a TOTP enrollment
+     * @description Generates a new TOTP secret and otpauth:// URI for the authenticated admin. The secret is held server-side until confirmed via POST /v1/auth/mfa/totp/verify.
+     */
+    post: operations['post_auth_mfa_totp_enroll'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/mfa/totp/verify': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Confirm a TOTP enrollment
+     * @description Confirms a pending TOTP enrollment with a 6-digit code. Activates (or reconfigures) the admin's TOTP factor. Recovery codes are returned only when this enabled the first MFA factor.
+     */
+    post: operations['post_auth_mfa_totp_enroll_verify'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/admin/auth/pkce/authorize': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get: operations['get_auth_pkce_authorize'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
 };
 type components = {
   schemas: {
@@ -440,6 +576,44 @@ type components = {
       /** @description WebAuthn assertion response as JSON string. Required when type is webauthn. */
       assertion: string;
     };
+    PasswordChangeRequest: {
+      /**
+       * Format: password
+       * @description The admin's current password.
+       */
+      currentPassword: string;
+      /**
+       * Format: password
+       * @description The new password. Must be 12–512 characters and include at least one uppercase letter, one lowercase letter, one number and one special character.
+       */
+      newPassword: string;
+      /**
+       * @description When true, revokes every other session of the admin and the tokens derived from them (the calling session stays valid). Use after a suspected credential leak; defaults to false.
+       * @default false
+       */
+      revokeOtherSessions: boolean;
+    };
+    PasswordResetRequest: {
+      /** @description The single-use reset token delivered by e-mail (kbc_pr_...). */
+      token: string;
+      /**
+       * Format: password
+       * @description The new password. Must be 12–512 characters and include at least one uppercase letter, one lowercase letter, one number and one special character.
+       */
+      newPassword: string;
+      /**
+       * @description When true (default), revokes every session of the admin and the session-derived tokens after the password is set. User-created Personal Access Tokens are not affected. Set to false to keep existing sessions alive.
+       * @default true
+       */
+      revokeSessions: boolean;
+    };
+    PasswordResetEmailRequest: {
+      /**
+       * Format: email
+       * @description Email address of the account to send a password-reset token to.
+       */
+      email: string;
+    };
     ScopeRequestPayload: {
       /**
        * @description Explicit allow-list of project ids. Omit the field (do not send `null`) to inherit the parent scope verbatim (exchange) or default to all projects (user-create).
@@ -493,6 +667,8 @@ type components = {
       webauthnAssertion?: string | null;
       /** @description Sudo challenge token (kbc_mfa_*) from POST /v1/auth/sudo/challenge. Required when webauthnAssertion is provided. */
       challengeToken?: string | null;
+      /** @description Account password. Only accepted when the account has no MFA configured (first-factor enrollment bootstrap). */
+      password?: string | null;
     };
     TokenRefreshRequest: {
       /** @description Refresh token to exchange for new token pair. */
@@ -507,6 +683,41 @@ type components = {
        */
       tokenTypeHint?: 'accessToken' | 'refreshToken' | null;
     };
+    TotpEnrollVerifyRequest: {
+      /** @description 6-digit TOTP code generated from the pending secret. */
+      code: string;
+    };
+    PkceAuthorizeQueryRequest: {
+      /**
+       * @description OAuth response type. Not enforced at the constraint level, but required to be "code" for the authorize flow to succeed.
+       * @enum {string|null}
+       */
+      responseType?: 'code' | null;
+      /** @description Public PKCE client identifier. Required for the authorize flow to succeed. */
+      clientId?: string | null;
+      /**
+       * Format: uri
+       * @description URI to redirect to with the authorization code. Required for the authorize flow to succeed.
+       */
+      redirectUri?: string | null;
+      /** @description PKCE code challenge derived from the client code verifier. Required for the authorize flow to succeed. */
+      codeChallenge?: string | null;
+      /**
+       * @description PKCE code challenge method. Not enforced at the constraint level, but required to be "S256" for the authorize flow to succeed.
+       * @enum {string|null}
+       */
+      codeChallengeMethod?: 'S256' | null;
+      /** @description Opaque value used to maintain state between the request and callback. Required for the authorize flow to succeed. */
+      state?: string | null;
+    };
+    PkceAuthorizeHeaderRequest: {
+      /** @description Value of the Origin request header, if present. */
+      origin?: string | null;
+      /** @description Value of the Referer request header, if present. */
+      referer?: string | null;
+      /** @description Value of the User-Agent request header, if present. */
+      'user-agent'?: string | null;
+    };
     LoginRequest2: {
       /**
        * @description Authentication grant type.
@@ -803,6 +1014,11 @@ type components = {
        * @default null
        */
       challengeToken: string | null;
+      /**
+       * @description Account password. Only accepted when the account has no MFA configured (first-factor enrollment bootstrap).
+       * @default null
+       */
+      password: string | null;
       type: string;
     };
     SudoResponse: {
@@ -864,6 +1080,33 @@ type components = {
        */
       tokenTypeHint: 'accessToken' | 'refreshToken' | null;
     };
+    /** @description Pending TOTP enrollment material. Confirm with POST /v1/auth/mfa/totp/verify before expiresAt. */
+    TotpEnrollResponse: {
+      /** @description Base32-encoded TOTP shared secret, for manual entry. */
+      secret: string;
+      /** @description otpauth:// URI to render as a QR code for the authenticator app. */
+      otpauthUri: string;
+      /**
+       * Format: date-time
+       * @description When this pending enrollment expires; verify before this time.
+       */
+      expiresAt: string;
+    };
+    /** @description TOTP enrollment confirmed. recoveryCodes is present only when this enabled the first MFA factor. */
+    TotpEnrollVerifyResponse: {
+      /**
+       * @description Id of the persisted TOTP credential (use with DELETE /v1/auth/mfa/totp/{id}).
+       * @example 42
+       */
+      id: number;
+      /**
+       * @description The admin's active MFA type after this call.
+       * @example TOTP
+       */
+      mfaType: string;
+      /** @description Plaintext recovery codes, present only when this enrollment enabled the first MFA factor. */
+      recoveryCodes?: string[] | null;
+    };
   };
   responses: never;
   parameters: never;
@@ -926,8 +1169,15 @@ type operations = {
       path?: never;
       cookie?: never;
     };
+    /** @description Bearer mode (session bearer in the `Authorization` header): JSON body with `userCode` and `decision`. Browser/cookie mode: form-encoded body with `decision` and the CSRF `_token` — the device user code is read from the browser session, not the body. */
     requestBody: {
       content: {
+        'application/x-www-form-urlencoded': {
+          /** @enum {string} */
+          decision: 'approve' | 'deny';
+          /** @description CSRF token bound to the browser session. */
+          _token: string;
+        };
         'application/json': components['schemas']['DeviceAuthorizationApprovalRequest'];
       };
     };
@@ -1105,6 +1355,149 @@ type operations = {
       };
     };
   };
+  post_auth_password_change: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PasswordChangeRequest'];
+      };
+    };
+    responses: {
+      /** @description Password changed. Other sessions were revoked only when revokeOtherSessions was true. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Current password incorrect (auth.password.invalidCurrentPassword), or invalid request payload including a new password that violates the password policy (validation.failed). */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Password is managed by the SSO identity provider. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many failed attempts. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_password_reset: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PasswordResetRequest'];
+      };
+    };
+    responses: {
+      /** @description Password reset. Unless revokeSessions=false was sent, all sessions and session-derived tokens of the admin were revoked. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid/expired/used reset token (auth.password.invalidResetToken), or a new password that violates the password policy (validation.failed). */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many reset attempts. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_password_reset_request: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PasswordResetEmailRequest'];
+      };
+    };
+    responses: {
+      /** @description Request accepted. If the account exists and is password-eligible, a reset token was e-mailed. */
+      202: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid request payload (validation.failed). */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many reset requests. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   get_auth_pat_list: {
     parameters: {
       query?: never;
@@ -1241,7 +1634,7 @@ type operations = {
         };
         content?: never;
       };
-      /** @description PAT issuance rate limit exceeded. */
+      /** @description Rate limit exceeded — either the per-admin PAT issuance limit, or the per-IP limit on repeated failed parent-token verifications. */
       429: {
         headers: {
           [name: string]: unknown;
@@ -1590,14 +1983,14 @@ type operations = {
           'application/json': components['schemas']['SudoResponse'];
         };
       };
-      /** @description Invalid or missing bearer token. */
+      /** @description Invalid or missing bearer token, or invalid password. */
       401: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
-      /** @description MFA is not configured for this account. */
+      /** @description MFA is not configured for this account (MFA factor supplied), or password step-up attempted on an MFA-configured account. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -1748,6 +2141,184 @@ type operations = {
       };
     };
   };
+  delete_auth_mfa_totp_delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Identifier of the TOTP credential to remove. */
+        id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description TOTP factor removed; MFA disabled. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description TOTP credential not found, not owned by the caller, or the programmatic auth feature is disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_mfa_totp_enroll: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Pending TOTP enrollment created. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TotpEnrollResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description A different MFA factor type (WebAuthn) is already active for this account. */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_mfa_totp_enroll_verify: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['TotpEnrollVerifyRequest'];
+      };
+    };
+    responses: {
+      /** @description TOTP enrollment confirmed. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['TotpEnrollVerifyResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token, or invalid TOTP code (auth.mfa.invalidCode). */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description No eligible pending enrollment — either the feature is disabled on this stack, or no enrollment was started, it expired, exceeded the maximum attempts, or was already used. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description A different MFA factor type (WebAuthn) became active for this account after this enrollment was started. */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  get_auth_pkce_authorize: {
+    parameters: {
+      query?: {
+        /** @description OAuth response type. Not enforced at the constraint level, but required to be "code" for the authorize flow to succeed. */
+        responseType?: 'code' | null;
+        /** @description Public PKCE client identifier. Required for the authorize flow to succeed. */
+        clientId?: string | null;
+        /** @description URI to redirect to with the authorization code. Required for the authorize flow to succeed. */
+        redirectUri?: string | null;
+        /** @description PKCE code challenge derived from the client code verifier. Required for the authorize flow to succeed. */
+        codeChallenge?: string | null;
+        /** @description PKCE code challenge method. Not enforced at the constraint level, but required to be "S256" for the authorize flow to succeed. */
+        codeChallengeMethod?: 'S256' | null;
+        /** @description Opaque value used to maintain state between the request and callback. Required for the authorize flow to succeed. */
+        state?: string | null;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      default: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
 };
 
 type IntrospectTokenResult = OpenapiReturnType<paths['/v1/auth/token/introspect']['get']>;
@@ -1783,4 +2354,12 @@ type AssertSamlResult = OpenapiReturnType<paths['/v1/auth/saml/assert']['post']>
 type InitiateSamlBody = OpenapiBodyType<paths['/v1/auth/saml/initiate']['post']>;
 type InitiateSamlResult = OpenapiReturnType<paths['/v1/auth/saml/initiate']['post']>;
 
-export type { ApproveDeviceAuthorizationBody as A, CreateDeviceAuthorizationBody as C, ExchangePatBody as E, GetDeviceAuthorizationTokenBody as G, InitiateSamlBody as I, ListPatsResult as L, RefreshTokenResult as R, SudoBody as S, ApproveDeviceAuthorizationResult as a, AssertSamlBody as b, AssertSamlResult as c, CreateDeviceAuthorizationResult as d, CreatePatBody as e, CreatePatResult as f, ExchangePatResult as g, GetDeviceAuthorizationTokenResult as h, GetPkceTokenBody as i, GetPkceTokenResult as j, InitiateSamlResult as k, IntrospectTokenResult as l, ListSessionsResult as m, RevokePatPath as n, RevokeSessionPath as o, paths as p, RevokeTokenBody as q, SudoChallengeResult as r, SudoResult as s, components as t };
+type VerifyMfaBody = OpenapiBodyType<paths['/v1/auth/mfa']['post']>;
+type VerifyMfaResult = OpenapiReturnType<paths['/v1/auth/mfa']['post']>;
+type RegenerateRecoveryCodesResult = OpenapiReturnType<paths['/v1/auth/mfa/recovery-codes']['post']>;
+type TotpSetupResult = OpenapiReturnType<paths['/v1/auth/mfa/totp']['post']>;
+type TotpVerifyBody = OpenapiBodyType<paths['/v1/auth/mfa/totp/verify']['post']>;
+type TotpVerifyResult = OpenapiReturnType<paths['/v1/auth/mfa/totp/verify']['post']>;
+type DisableTotpPath = OpenapiPathType<paths['/v1/auth/mfa/totp/{id}']['delete']>;
+
+export type { ApproveDeviceAuthorizationBody as A, CreateDeviceAuthorizationBody as C, DisableTotpPath as D, ExchangePatBody as E, GetDeviceAuthorizationTokenBody as G, InitiateSamlBody as I, ListPatsResult as L, RefreshTokenResult as R, SudoBody as S, TotpSetupResult as T, VerifyMfaBody as V, ApproveDeviceAuthorizationResult as a, AssertSamlBody as b, AssertSamlResult as c, CreateDeviceAuthorizationResult as d, CreatePatBody as e, CreatePatResult as f, ExchangePatResult as g, GetDeviceAuthorizationTokenResult as h, GetPkceTokenBody as i, GetPkceTokenResult as j, InitiateSamlResult as k, IntrospectTokenResult as l, ListSessionsResult as m, RegenerateRecoveryCodesResult as n, RevokePatPath as o, paths as p, RevokeSessionPath as q, RevokeTokenBody as r, SudoChallengeResult as s, SudoResult as t, TotpVerifyBody as u, TotpVerifyResult as v, VerifyMfaResult as w, components as x };

package/dist/{types-DFWnAftN.d.cts → types-CiJ5ULtS.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, b as OpenapiBodyType, a as OpenapiReturnType, A as ArrayElement } from './types-jKnx7Tm_.cjs';
+import { c as OpenapiQueryType, O as OpenapiBodyType, b as OpenapiReturnType, A as ArrayElement } from './types-gcShAmmi.js';
 
 /**
  * This file was auto-generated by openapi-typescript.