@keboola/api-client 52.0.0 → 54.0.0

package/dist/{types-DjWubjvP.d.cts → types-CaBcgsT2.d.cts}

@@ -210,14 +210,15 @@ type paths = {
      *     registration is usable):
      *
      *     * Repository permissions: Contents → Read-only; Organization permissions: Members →
-     *       Read-only (the install callback needs it to confirm the installer owns the GitHub
+     *       Read-only (the callback needs it to confirm the user connecting owns the GitHub
      *       organization).
-     *     * "Where can this GitHub App be installed?" → Any account.
-     *     * **"Request user authorization (OAuth) during installation" must be enabled**, and the
-     *       App's Callback URL set to this service's
-     *       `/platform-consumers/github-app/callback`. Without it GitHub sends no `code` with the
-     *       install redirect, the callback cannot prove the installer owns the installation they
-     *       returned with, and every connection attempt fails there.
+     *     * "Where can this GitHub App be installed?" → Any account, for an App that third parties
+     *       install.
+     *     * The App's Callback URL list must include this service's
+     *       `/platform-consumers/github-app/callback`: connecting goes through the App's OAuth web
+     *       flow with that URL as `redirect_uri`. "Request user authorization (OAuth) during
+     *       installation" is not needed; when it is on, the redirect GitHub sends right after an
+     *       install has no `state` and is answered with directions to connect from Keboola.
      *     * `clientId` / `clientSecret` come from the same App's page ("Client ID", "Generate a new
      *       client secret") — they are not the App ID and private key.
      *
@@ -265,10 +266,11 @@ type paths = {
       cookie?: never;
     };
     /**
-     * GitHub App install callback
-     * @description Invoked by GitHub, not by API consumers. This is the App's Callback URL, configured once on
-     *     the GitHub side and identical for every install, which is why it carries no organization
-     *     segment — the organization is recovered from the install session that `state` resolves to.
+     * GitHub App OAuth callback
+     * @description Invoked by GitHub, not by API consumers. This is one of the App's Callback URLs, configured
+     *     once on the GitHub side and identical for every connection, which is why it carries no
+     *     organization segment — the organization is recovered from the install session that `state`
+     *     resolves to.
      *
      *     It is the only endpoint that records an installation, and it requires no Keboola credential.
      *     Three things authorise it, all of them necessary:
@@ -276,22 +278,29 @@ type paths = {
      *     1. `state` must match the `__Host-orgInstallSession` cookie set when the flow started (the
      *        legacy `oauthSessionId` cookie is ignored here);
      *     2. `state` must resolve to an unexpired install session;
-     *     3. the installing user must own the account the installation belongs to. GitHub, asked as
-     *        the App, says which account that is (`GET /app/installations/{id}`); asked with the
-     *        user-to-server token obtained from `code`, it says whether the installer is an active
-     *        owner of that organization (`GET /user/memberships/orgs/{login}` → `role: admin`,
-     *        `state: active`) or, for a personal account, that very user (`GET /user`). Being a
-     *        collaborator or an ordinary member is not enough.
+     *     3. the user who authorized (`code`, exchanged for a user-to-server token) must own the
+     *        account the bound installation belongs to: an active owner of that organization
+     *        (`GET /user/memberships/orgs/{login}` → `role: admin`, `state: active`) or, for a
+     *        personal account, that very user (`GET /user`). Being a collaborator or an ordinary
+     *        member is not enough. This is why the App needs "Organization members: read".
      *
-     *     Point 3 is why the App needs "Request user authorization (OAuth) during installation" and
-     *     the "Organization members: read" permission. Installation ids are small sequential
-     *     integers, so without that confirmation anyone able to start an install for an organization
-     *     they do administer could bind a stranger's installation and mint read tokens on that
-     *     stranger's private repositories.
+     *     Which installation is bound:
      *
-     *     When the installer is not a GitHub organization owner, GitHub returns
-     *     `setup_action=request` with no installation id: the installation is pending an owner's
-     *     approval and nothing is recorded.
+     *     * **OAuth web flow** (started by `POST /authorize/organizations/{organizationId}`; only
+     *       `code` and `state` come back): the App's installations the user can reach
+     *       (`GET /user/installations`, all pages), narrowed to the `account` given at the start if
+     *       any, each run through check 3. Exactly one owned installation is connected. None
+     *       installed is a `400` and none owned a `403`, both naming the App's install page
+     *       `{webBaseUrl}/apps/{slug}/installations/new`; several owned without `account` is a `400`
+     *       naming them — start again with `account`.
+     *     * **No `state`** — GitHub's redirect after an install started on GitHub, for an App that
+     *       requests user authorization during installation: a `400` saying the connection has to
+     *       be started from Keboola. Nothing is asked of GitHub or recorded.
+     *
+     *     Any `installation_id` GitHub adds to the query is ignored. Installation ids are small
+     *     sequential integers: believing one would let anyone able to start a connection for an
+     *     organization they do administer bind a stranger's installation and mint read tokens on
+     *     that stranger's private repositories.
      *
      *     An organization holds at most one connection per GitHub account and registration. When the
      *     account is already connected under a *different* installation id — the App was
@@ -318,23 +327,30 @@ type paths = {
     put?: never;
     /**
      * Connect a GitHub organization
-     * @description Starts the GitHub App install flow and redirects to GitHub.
+     * @description Starts connecting a GitHub organization and redirects to the GitHub App's OAuth web flow,
+     *     `{webBaseUrl}/login/oauth/authorize?client_id=…&redirect_uri=…&state=…`, where
+     *     `redirect_uri` is this service's `/platform-consumers/github-app/callback`. GitHub signs
+     *     the user in, asks them to authorize the App the first time, and returns to the callback,
+     *     which connects the installation the user owns (or the one on `account`). The App must
+     *     already be installed on the GitHub organization — by anyone, from anywhere; the callback
+     *     links the install page if it is not.
      *
-     *     Submitted by the browser as a form — a top-level navigation — exactly like
-     *     `POST /authorize/{componentId}`, with the caller's Storage API token in the `token` form
-     *     field, verified with Storage API by this service. The token may belong to any project the
-     *     caller can reach: it establishes only *who* the caller is. A token without an admin
-     *     (component or legacy token) is refused with `403`.
+     *     Submitted by the browser as a form — a top-level navigation from the organization's page
+     *     in the Control Panel — with the caller's Manage API token in the `manageToken` form field,
+     *     verified by this service with `GET /manage/tokens/verify`. The token must have a user
+     *     behind it: the Control Panel's session token or a personal Manage token. An application
+     *     token is refused with `403`; a token Manage API does not know, or reports as expired or
+     *     disabled, with `401`. Storage API tokens and programmatic `kbc_pat_*` tokens are not
+     *     accepted. The token establishes only *who* the
+     *     caller is, and it is never stored.
      *
      *     The organization is taken from the URL and the caller must be an administrator of it — `GET /manage/organizations/{id}/users` is
      *     Connection's organization administrators listing, so appearing in it is the admin check.
-     *     Deriving the organization from the token instead would be unsafe — users belong to projects
-     *     across several organizations and the project-to-organization link is invisible in the UI.
+     *     Super admins who are not listed are refused.
      *
      *     The credentials row is created incomplete and only becomes usable once the install
      *     callback records the installation. Starting again under the name of an incomplete row (an
-     *     abandoned tab, or an install that became an owner-approval request) replaces that row and
-     *     its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
+     *     abandoned tab or a refused callback) replaces that row and its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
      *     already taken by a completed connection is a `409`.
      *
      *     The response sets the session cookie `__Host-orgInstallSession` (Secure, HttpOnly,
@@ -366,7 +382,8 @@ type paths = {
     /**
      * List connected GitHub organizations
      * @description Lists the GitHub accounts this Keboola organization has connected. Connections whose
-     *     install never completed are omitted.
+     *     install never completed are omitted. The caller must be an administrator of the
+     *     organization; see `ManageApiUserToken` for the accepted tokens.
      */
     get: operations['organizationCredentialsList'];
     put?: never;
@@ -423,7 +440,8 @@ type paths = {
     /**
      * Disconnect a GitHub organization
      * @description Removes the connection on the Keboola side. The App stays installed on GitHub until an
-     *     owner removes it there.
+     *     owner removes it there. The caller must be an administrator of the organization; see
+     *     `ManageApiUserToken` for the accepted tokens.
      */
     delete: operations['organizationCredentialsDelete'];
     options?: never;
@@ -555,8 +573,8 @@ type components = {
       webHost?: string;
     };
     OrganizationCredentialsInitRequest: {
-      /** @description Storage API token of the caller; identifies who they are */
-      token: string;
+      /** @description Manage API token of the caller with a user behind it (the Control Panel's session token or a personal Manage token); identifies who they are */
+      manageToken: string;
       /**
        * @description Unique within the organization.
        * @example acme-github
@@ -564,7 +582,7 @@ type components = {
       name: string;
       /**
        * Format: url
-       * @description Where GitHub returns the user after the install completes. Must be https.
+       * @description Where the browser returns after the connection completes. Must be https.
        */
       returnUrl: string;
       description?: string | null;
@@ -573,6 +591,11 @@ type components = {
        * @example acme.ghe.com
        */
       host?: string | null;
+      /**
+       * @description The GitHub account (organization or user login, case-insensitive) to connect. Needed only when the caller owns several accounts the GitHub App is installed on; omitted, the callback connects the only one.
+       * @example acme
+       */
+      account?: string | null;
     };
     OrganizationCredentials: {
       /** Format: uuid */
@@ -590,8 +613,22 @@ type components = {
        */
       host?: string;
       creator?: {
+        /** @description ID of the token the connection was started with. */
         id?: string;
+        /** @description Description of that token; for the Control Panel's session token, the user's email. */
         description?: string | null;
+        /**
+         * @description Which API the token belongs to. Connections are started with a Manage API token; `storage` marks connections started with a Storage API token before that.
+         * @enum {string}
+         */
+        type?: 'manage' | 'storage';
+        /** @description The user behind the Manage API token. A session token expires after about an hour, so this is what still says who connected the organization. Null for `storage`. */
+        user?: {
+          /** @example 76 */
+          id?: string;
+          /** @example admin@keboola.com */
+          email?: string | null;
+        } | null;
       };
       /** Format: date-time */
       created?: string;
@@ -1247,15 +1284,11 @@ interface operations {
   };
   platformConsumerInstallCallback: {
     parameters: {
-      query: {
-        /** @description GitHub installation ID. */
-        installation_id?: string;
-        /** @description Temporary user authorization code. Present only when the App has "Request user authorization (OAuth) during installation" enabled; the callback exchanges it for a user-to-server token and verifies installation ownership with it. */
+      query?: {
+        /** @description Temporary user authorization code; exchanged for a user-to-server token that identifies the user and verifies installation ownership. Missing when the user did not authorize the App (`error=access_denied`). */
         code?: string;
-        /** @description What GitHub did. `request` means an owner still has to approve. */
-        setup_action?: 'install' | 'request' | 'update';
-        /** @description Opaque install-session ID issued when the flow started. */
-        state: string;
+        /** @description Opaque install-session ID issued when the flow started. Required; GitHub omits it on the redirect after an install started on GitHub, which is answered with a `400`. */
+        state?: string;
       };
       header?: never;
       path?: never;
@@ -1270,8 +1303,16 @@ interface operations {
         };
         content?: never;
       };
-      400: components['responses']['400_BadRequest'];
-      /** @description The installer is not an active owner of the GitHub organization (or not the personal account) the installation belongs to, or the App lacks "Organization members: read" */
+      /** @description No `state` (the connection has to be started from Keboola); no matching session cookie or an expired session; no `code`, or GitHub rejected it; the App is not installed on any account the user can reach (or on the requested `account`) — the message links the install page; or the user owns several accounts with the App installed and no `account` was given — the message names them */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description The user owns none of the accounts the App is installed on that they can reach (or not the requested `account`): neither an active owner of the organization nor the personal account itself. The message links the install page, or names an organization enforcing SAML SSO the user's GitHub session is not authorized for. Also when the App lacks "Organization members: read" */
       403: {
         headers: {
           [name: string]: unknown;
@@ -1289,6 +1330,24 @@ interface operations {
           'application/json': components['schemas']['Error'];
         };
       };
+      /** @description GitHub is rate limiting requests; see `Retry-After` */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description GitHub failed or returned a malformed answer */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
     };
   };
   organizationCredentialsInit: {
@@ -1307,7 +1366,7 @@ interface operations {
       };
     };
     responses: {
-      /** @description Redirect to GitHub to install the App */
+      /** @description Redirect to the GitHub App's OAuth web flow (`/login/oauth/authorize`) */
       302: {
         headers: {
           [name: string]: unknown;
@@ -1315,6 +1374,7 @@ interface operations {
         content?: never;
       };
       400: components['responses']['400_BadRequest'];
+      401: components['responses']['401_Unauthorized'];
       403: components['responses']['403_Forbidden'];
       /** @description A completed connection with this name already exists in the organization */
       409: {
@@ -1526,5 +1586,13 @@ type CredentialInput = ComponentPath & {
 type CreateCredentialInput = ComponentPath & Omit<CreateCredentialBody, '#data'> & {
   data: Record<string, unknown>;
 };
-export { CredentialInput as a, GetCredentialsInput as c, Credential as i, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, OrganizationConnection as s, ComponentPath as t };
-//# sourceMappingURL=types-DjWubjvP.d.cts.map
+type OrganizationCredentials = OpenapiReturnType<paths['/organizations/{organizationId}/credentials']['get']>[number];
+type ManageTokenInput = {
+  /** A Manage API token with a user behind it, e.g. the Control Panel's session token. */
+  manageToken: string;
+};
+type GetOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials']['get']> & ManageTokenInput;
+type DeleteOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials/{id}']['delete']> & ManageTokenInput;
+type GetOrganizationConnectFormInput = OpenapiPathType<paths['/authorize/organizations/{organizationId}']['post']> & OpenapiBodyType<paths['/authorize/organizations/{organizationId}']['post']>;
+export { CredentialInput as a, GetOrganizationConnectFormInput as c, OrganizationCredentials as d, GetCredentialsInput as f, Credential as i, GetOrganizationCredentialsInput as l, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, DeleteOrganizationCredentialsInput as s, ComponentPath as t, OrganizationConnection as u };
+//# sourceMappingURL=types-CaBcgsT2.d.cts.map

package/dist/{types-BljDxuWG.d.cts → types-DCARsJWs.d.cts}

@@ -1,5 +1,6 @@
 import { i as CreateMetaObjectInput } from "./types-CIlBSV99.cjs";
 import { n as createMetastoreClient } from "./index-CNJBmCHM.cjs";
+import { n as MetastoreObjectMeta, t as MetastoreObject } from "./metaObject-D7oudegV.cjs";
 /**
  * The closed value sets the metastore accepts on a semantic object.
  *
@@ -133,34 +134,10 @@ type SemanticChildObjectDataMap = {
 type SemanticChildObjectType = keyof SemanticChildObjectDataMap;
 type SemanticObjectType = SemanticChildObjectType | 'semantic-model';
 type SemanticObjectScope = (typeof SEMANTIC_OBJECT_SCOPES)[number];
-type SemanticObjectMeta = {
-  name?: string;
-  branch?: string;
-  projectId?: number | null;
-  organizationId?: string;
-  revision?: number;
-  schemaVersion?: string;
-  createdAt?: string;
-  lastUpdated?: string;
-  revisionCreatedAt?: string;
-  scope?: SemanticObjectScope;
-  sourceProjectId?: number;
-  /** The projects a `targeted` object is shared with, read-only. */
-  targetProjectIds?: number[];
-  /** Set while a `project`-scope object awaits an org-admin decision. Cleared by promoting
-   *  (PATCH `{scope:"organization"}`) or withdrawing the request. */
-  scopeElevationRequestedAt?: string;
-};
-/**
- * Normalized metastore object as returned by this SDK. Matches the live metastore
- * envelope ({ type, id, attributes: <data payload>, meta: {...} }), which differs
- * from the legacy wrapper types in clients/metastore/repository/types.ts.
- */
-type SemanticObject<TData> = {
-  uuid: string;
-  data: TData;
-  meta: SemanticObjectMeta;
-};
+/** The metastore envelope's `meta`; shared with every metastore object family. */
+type SemanticObjectMeta = MetastoreObjectMeta;
+/** A semantic-layer object as this SDK returns it, in the shared metastore envelope. */
+type SemanticObject<TData> = MetastoreObject<TData>;
 type CreateSemanticObjectMeta = Omit<CreateMetaObjectInput, 'data' | 'objectType'>;
 /**
  * Meta for a CONTENT update. `scope` is deliberately absent: a scope change is a separate PATCH
@@ -195,4 +172,4 @@ type SemanticUnreadableObjectRef = {
   modelUUID: string | null;
 };
 export { CONSTRAINT_TYPES as A, SemanticRuleExpression as C, UpdateSemanticObjectMeta as D, SemanticValidationQuery as E, SQL_DIALECTS as F, RELATIONSHIP_JOIN_TYPES as M, RULE_OPERATORS as N, CONSTRAINT_SCOPES as O, SEMANTIC_OBJECT_SCOPES as P, SemanticRelationshipJoinType as S, SemanticUnreadableObjectRef as T, SemanticObject as _, SemanticChildObjectType as a, SemanticObjectType as b, SemanticConstraintSeverity as c, SemanticFieldData as d, SemanticFieldRole as f, SemanticModelData as g, SemanticModelChildRef as h, SemanticChildObjectDataMap as i, FIELD_ROLES as j, CONSTRAINT_SEVERITIES as k, SemanticConstraintType as l, SemanticMetricData as m, MetastoreClient as n, SemanticConstraintData as o, SemanticGlossaryData as p, SemanticAiMetadata as r, SemanticConstraintScope as s, CreateSemanticObjectMeta as t, SemanticDatasetData as u, SemanticObjectMeta as v, SemanticRuleOperator as w, SemanticRelationshipData as x, SemanticObjectScope as y };
-//# sourceMappingURL=types-BljDxuWG.d.cts.map
+//# sourceMappingURL=types-DCARsJWs.d.cts.map