@keboola/api-client 27.0.0 → 31.0.0

package/dist/authClient-Bc_bDisO.d.ts

@@ -0,0 +1,367 @@
+import { t as createOpenapiFetchClient } from "./index-Ds8e0l7-.js";
+import { n as ClientInitOptions } from "./types-SX78XZZ0.js";
+import { D as RevokePatPath, F as ApproveDeviceAuthorizationBody, H as paths, L as CreateDeviceAuthorizationBody, O as DisableTotpPath, S as CreatePatBody, V as components, a as RemoveWebauthnInput, b as GetPkceTokenBody, d as SudoBody, g as AssertSamlBody, h as RevokeSessionPath, n as RegisterWebauthnInput, r as RegisterWebauthnOptionsResult, u as RevokeTokenBody, v as InitiateSamlBody, w as ExchangePatBody, z as GetDeviceAuthorizationTokenBody } from "./types-RmbvQimP.js";
+import * as z$1 from "zod";
+//#region src/clients/auth/login/schemas.d.ts
+declare const loginInputSchema: z$1.ZodObject<{
+  email: z$1.ZodEmail;
+  password: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const oidcInputSchema: z$1.ZodObject<{
+  grantType: z$1.ZodEnum<{
+    google: "google";
+    microsoft: "microsoft";
+  }>;
+  idToken: z$1.ZodString;
+}, z$1.core.$strip>;
+type LoginInput = z$1.infer<typeof loginInputSchema>;
+type OidcInput = z$1.infer<typeof oidcInputSchema>;
+declare const userSchema: z$1.ZodObject<{
+  id: z$1.ZodNumber;
+  email: z$1.ZodString;
+  name: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const loginSuccessSchema: z$1.ZodObject<{
+  mfaRequired: z$1.ZodDefault<z$1.ZodLiteral<false>>;
+  accessToken: z$1.ZodString;
+  refreshToken: z$1.ZodString;
+  tokenType: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  sessionId: z$1.ZodString;
+  user: z$1.ZodObject<{
+    id: z$1.ZodNumber;
+    email: z$1.ZodString;
+    name: z$1.ZodString;
+  }, z$1.core.$strip>;
+}, z$1.core.$strip>;
+/**
+ * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.
+ *
+ * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy
+ *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch
+ *   and handle the unknown case themselves.
+ * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey
+ *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it
+ *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate
+ *   present, `null` and absent alike.
+ * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody
+ *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely
+ *   out of the passkey path. Whoever runs the ceremony validates it properly instead.
+ */
+declare const mfaChallengeSchema: z$1.ZodObject<{
+  mfaRequired: z$1.ZodLiteral<true>;
+  mfaType: z$1.ZodString;
+  mfaToken: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  allowedMethods: z$1.ZodArray<z$1.ZodString>;
+  webauthn: z$1.ZodOptional<z$1.ZodUnknown>;
+}, z$1.core.$strip>;
+declare const loginResultSchema: z$1.ZodUnion<readonly [z$1.ZodObject<{
+  mfaRequired: z$1.ZodDefault<z$1.ZodLiteral<false>>;
+  accessToken: z$1.ZodString;
+  refreshToken: z$1.ZodString;
+  tokenType: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  sessionId: z$1.ZodString;
+  user: z$1.ZodObject<{
+    id: z$1.ZodNumber;
+    email: z$1.ZodString;
+    name: z$1.ZodString;
+  }, z$1.core.$strip>;
+}, z$1.core.$strip>, z$1.ZodObject<{
+  mfaRequired: z$1.ZodLiteral<true>;
+  mfaType: z$1.ZodString;
+  mfaToken: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  allowedMethods: z$1.ZodArray<z$1.ZodString>;
+  webauthn: z$1.ZodOptional<z$1.ZodUnknown>;
+}, z$1.core.$strip>]>;
+type LoginUser = z$1.infer<typeof userSchema>;
+type LoginSuccess = z$1.infer<typeof loginSuccessSchema>;
+type MfaChallenge = z$1.infer<typeof mfaChallengeSchema>;
+type LoginResult = z$1.infer<typeof loginResultSchema>;
+//#endregion
+//#region src/clients/auth/mfa/schemas.d.ts
+/**
+ * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in
+ * `mfaType` / `allowedMethods`.
+ *
+ * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.
+ * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or
+ *   drops a method fails the build here rather than at runtime mid-sign-in.
+ * - A challenge may still name a method absent from here, so the wire fields stay `string`.
+ */
+declare const MFA_METHOD: {
+  readonly totp: 'totp';
+  readonly webauthn: 'webauthn';
+  readonly recoveryCode: 'recovery_code';
+};
+type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];
+declare const mfaCodeInputSchema: z$1.ZodObject<{
+  mfaToken: z$1.ZodString;
+  type: z$1.ZodEnum<{
+    recovery_code: "recovery_code";
+    totp: "totp";
+  }>;
+  code: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const mfaWebauthnInputSchema: z$1.ZodObject<{
+  mfaToken: z$1.ZodString;
+  assertion: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const totpVerifyInputSchema: z$1.ZodObject<{
+  code: z$1.ZodString;
+  revokeOtherSessions: z$1.ZodDefault<z$1.ZodBoolean>;
+}, z$1.core.$strip>;
+type MfaCodeInput = z$1.infer<typeof mfaCodeInputSchema>;
+type MfaWebauthnInput = z$1.infer<typeof mfaWebauthnInputSchema>;
+type TotpVerifyInput = z$1.input<typeof totpVerifyInputSchema>;
+//#endregion
+//#region src/clients/auth/password/schemas.d.ts
+declare const resetRequestInputSchema: z$1.ZodObject<{
+  email: z$1.ZodEmail;
+}, z$1.core.$strip>;
+declare const resetInputSchema: z$1.ZodObject<{
+  token: z$1.ZodString;
+  newPassword: z$1.ZodString;
+  revokeSessions: z$1.ZodDefault<z$1.ZodBoolean>;
+}, z$1.core.$strip>;
+declare const changeInputSchema: z$1.ZodObject<{
+  currentPassword: z$1.ZodString;
+  newPassword: z$1.ZodString;
+  revokeOtherSessions: z$1.ZodDefault<z$1.ZodBoolean>;
+}, z$1.core.$strip>;
+type ResetRequestInput = z$1.infer<typeof resetRequestInputSchema>;
+type ResetInput = z$1.input<typeof resetInputSchema>;
+type ChangePasswordInput = z$1.input<typeof changeInputSchema>;
+//#endregion
+//#region src/clients/auth/authClient.d.ts
+type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;
+type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;
+declare const createAuthClient: ({ baseUrl, middlewares }: AuthClientInitOptions) => {
+  healthCheck: (signal?: AbortSignal) => Promise<unknown>;
+  login: {
+    withPassword: (input: LoginInput, signal?: AbortSignal) => Promise<{
+      mfaRequired: false;
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: {
+        id: number;
+        email: string;
+        name: string;
+      };
+    } | {
+      mfaRequired: true;
+      mfaType: string;
+      mfaToken: string;
+      expiresIn: number;
+      allowedMethods: string[];
+      webauthn?: unknown;
+    }>;
+    withOidc: (input: OidcInput, signal?: AbortSignal) => Promise<{
+      mfaRequired: false;
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: {
+        id: number;
+        email: string;
+        name: string;
+      };
+    } | {
+      mfaRequired: true;
+      mfaType: string;
+      mfaToken: string;
+      expiresIn: number;
+      allowedMethods: string[];
+      webauthn?: unknown;
+    }>;
+    methods: (signal?: AbortSignal) => Promise<{
+      methods: components['schemas']['LoginMethod'][];
+      restriction: 'ssoEnforced' | 'stackSsoOnly' | null;
+      emailDiscoveryEnabled: boolean;
+      signUpUrl: string | null;
+    }>;
+  };
+  mfa: {
+    verifyWithCode: (input: MfaCodeInput, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+    verifyWithWebauthn: (input: MfaWebauthnInput, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+    regenerateRecoveryCodes: (signal?: AbortSignal) => Promise<{
+      codes: string[];
+    }>;
+    totp: {
+      setup: (signal?: AbortSignal) => Promise<{
+        secret: string;
+        otpauthUri: string;
+        expiresAt: string;
+      }>;
+      verify: (input: TotpVerifyInput, signal?: AbortSignal) => Promise<{
+        id: number;
+        mfaType: string;
+        recoveryCodes?: string[] | null;
+      }>;
+      disable: (id: DisableTotpPath['id'], signal?: AbortSignal) => Promise<void>;
+    };
+  };
+  password: {
+    resetRequest: (input: ResetRequestInput, signal?: AbortSignal) => Promise<void>;
+    reset: (input: ResetInput, signal?: AbortSignal) => Promise<void>;
+    change: (input: ChangePasswordInput, signal?: AbortSignal) => Promise<void>;
+  };
+  saml: {
+    assert: (body: AssertSamlBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    } | {
+      mfaRequired: boolean;
+      mfaType: string;
+      mfaToken: string;
+      expiresIn: number;
+      allowedMethods: string[];
+      webauthn: Record<string, never> | null;
+    }>;
+    initiate: (body?: InitiateSamlBody, signal?: AbortSignal) => Promise<{
+      ssoUrl: string;
+      requestHandle: string;
+      expiresIn: number;
+    }>;
+  };
+  pat: {
+    create: (body: CreatePatBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      tokenType: string;
+      expiresIn: number;
+      pat: components['schemas']['PatItemResponse'];
+    }>;
+    exchange: (body?: ExchangePatBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      tokenType: string;
+      expiresIn: number;
+      scope: Record<string, never>;
+      readOnly: boolean;
+      parentTokenId: string;
+      parentTokenType: 'session' | 'pat';
+      expiresAt: string;
+      pat: components['schemas']['PatItemResponse'];
+    }>;
+    revoke: (id: RevokePatPath['id'], signal?: AbortSignal) => Promise<void>;
+    getAll: (signal?: AbortSignal) => Promise<{
+      items: components['schemas']['PatItemResponse'][];
+    }>;
+  };
+  device: {
+    create: (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => Promise<{
+      deviceCode: string;
+      userCode: string;
+      verificationUri: string;
+      verificationUriComplete: string;
+      expiresIn: number;
+      interval: number;
+    }>;
+    approve: (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => Promise<{
+      status: 'approved' | 'denied';
+      idempotent: boolean;
+      decision: components['schemas']['DeviceApprovalDecision'];
+    }>;
+    getToken: (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+  };
+  sudo: {
+    verify: (body: SudoBody, signal?: AbortSignal) => Promise<{
+      sudoVerified: boolean;
+      sudoExpiresAt: string;
+      sudoTimeoutSeconds: number;
+    }>;
+    challenge: (signal?: AbortSignal) => Promise<{
+      challengeToken: string;
+      options: Record<string, never>;
+      expiresIn: number;
+    }>;
+  };
+  pkce: {
+    getToken: (body: GetPkceTokenBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+  };
+  session: {
+    getAll: (signal?: AbortSignal) => Promise<{
+      sessions?: components['schemas']['SessionItemResponse'][];
+      oauthSessions?: components['schemas']['OAuthSessionItemResponse'][];
+    }>;
+    revoke: (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => Promise<void>;
+    revokeAll: (signal?: AbortSignal) => Promise<void>;
+  };
+  token: {
+    refresh: (refreshToken: string, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+    introspect: (token?: string, signal?: AbortSignal) => Promise<{
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+      grantType: string;
+      sudoVerified: boolean;
+      createdAt: string;
+      expiresAt: string;
+      lastUsedAt?: string | null;
+      lastUsedIp?: string | null;
+      userAgent?: string | null;
+      projects: components['schemas']['ProjectAccessItem'][];
+    }>;
+    revoke: (body: RevokeTokenBody, signal?: AbortSignal) => Promise<void>;
+  };
+  webauthn: {
+    getAll: (signal?: AbortSignal) => Promise<{
+      webauthnCredentials?: components['schemas']['WebAuthnCredentialItemResponse'][];
+    }>;
+    registerOptions: (signal?: AbortSignal) => Promise<RegisterWebauthnOptionsResult>;
+    register: ({ credential, deviceName, revokeOtherSessions }: RegisterWebauthnInput, signal?: AbortSignal) => Promise<{
+      id: number;
+      deviceName: string;
+      created: string;
+      recoveryCodes?: string[] | null;
+    }>;
+    remove: ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => Promise<void>;
+  };
+};
+//#endregion
+export { OidcInput as C, mfaChallengeSchema as D, loginSuccessSchema as E, oidcInputSchema as O, MfaChallenge as S, loginResultSchema as T, totpVerifyInputSchema as _, ResetInput as a, LoginSuccess as b, resetInputSchema as c, MfaCodeInput as d, MfaMethod as f, mfaWebauthnInputSchema as g, mfaCodeInputSchema as h, ChangePasswordInput as i, resetRequestInputSchema as l, TotpVerifyInput as m, AuthOpenApiFetchClient as n, ResetRequestInput as o, MfaWebauthnInput as p, createAuthClient as r, changeInputSchema as s, AuthClientInitOptions as t, MFA_METHOD as u, LoginInput as v, loginInputSchema as w, LoginUser as x, LoginResult as y };
+//# sourceMappingURL=authClient-Bc_bDisO.d.ts.map