@limecloud/cli 0.12.0 → 0.13.0

package/dist/identity.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Lime Identity API",
-    "version": "0.12.0",
+    "version": "0.13.0",
     "description": "Implemented public OAuth 2.0 and OpenID Connect endpoints. Plain protocol responses; separate from authenticated management BFF APIs."
   },
   "servers": [
@@ -47,8 +47,17 @@
         "operationId": "identity_authorize",
         "summary": "Authorize a user",
         "x-lime-summary-zh-CN": "用户授权",
-        "description": "Navigate the user's browser here. Register the client and exact redirect URI first. Production clients must be activated against a published version; installation authorization requires both installation_id and space_id. User consent remains separate from installation approval. The callback contains code+state or error+state; never accept it without checking the bound state.",
-        "x-lime-zh-CN": "将用户浏览器导航至此。先登记客户端和精确回调。生产客户端须基于已发布版本启用；安装授权须同时提供 installation_id 和 space_id。个人同意与安装批准分别判定。回调包含 code+state 或 error+state，必须校验绑定的 state 后再处理。",
+        "description": "Navigate the user's browser here using the environment's App ID or a separately registered user-client ID and an exact registered callback. Production credentials require a published version. For identity-only Web OIDC sign-in with the production App ID, installation_id and space_id may be omitted: after sign-in, one eligible existing partner or official installation is bound and shown on consent. When there is no eligible installation and a trusted Console is configured, an approved listed application may continue the original request through explicit installation in the user's personal space, including the existing strong-authentication requirement. Installation approval does not replace consent or extend the original ten-minute deadline. Multiple eligible installations require explicit selectors. Independent clients, device requests, organization installation and business audiences do not use this first-installation continuation. Business-audience requests require both selectors at authorization start. The frozen context cannot be replaced during token exchange. Validate the original bound state on both successful and error callbacks.",
+        "x-lime-zh-CN": "将用户浏览器导航至此，使用对应环境 App ID 或独立登记的用户客户端 ID，以及精确登记的回调。正式凭据要求应用已发布。正式 App ID 接入仅身份 Scope 的 Web OIDC 登录时，可省略 installation_id 与 space_id：用户登录后，仅有一个符合条件的合作或官方应用已有安装时，平台绑定该安装并在同意页明示。没有符合条件的安装且平台已配置受控 Console 时，已审核上架应用可经本人个人空间显式安装后接续原请求，仍须满足现行强认证要求。安装批准不代替本人同意，不延长原十分钟期限。多个符合条件的安装须显式选择。独立 Client、设备请求、组织安装与业务 Audience 不适用此首次接入路径。业务 Audience 请求须在发起时提供两个安装选择字段。换码不能替换已固定上下文，成功及错误回调均须校验原事务绑定的 state。",
+        "x-lime-action-revision": "app-id-installation-onboarding-v1",
+        "x-lime-localizations": {
+          "en": {
+            "description": "Navigate the user's browser here using the environment's App ID or a separately registered user-client ID and an exact registered callback. Production credentials require a published version. For identity-only Web OIDC sign-in with the production App ID, installation_id and space_id may be omitted: after sign-in, one eligible existing partner or official installation is bound and shown on consent. When there is no eligible installation and a trusted Console is configured, an approved listed application may continue the original request through explicit installation in the user's personal space, including the existing strong-authentication requirement. Installation approval does not replace consent or extend the original ten-minute deadline. Multiple eligible installations require explicit selectors. Independent clients, device requests, organization installation and business audiences do not use this first-installation continuation. Business-audience requests require both selectors at authorization start. The frozen context cannot be replaced during token exchange. Validate the original bound state on both successful and error callbacks."
+          },
+          "zh-CN": {
+            "description": "将用户浏览器导航至此，使用对应环境 App ID 或独立登记的用户客户端 ID，以及精确登记的回调。正式凭据要求应用已发布。正式 App ID 接入仅身份 Scope 的 Web OIDC 登录时，可省略 installation_id 与 space_id：用户登录后，仅有一个符合条件的合作或官方应用已有安装时，平台绑定该安装并在同意页明示。没有符合条件的安装且平台已配置受控 Console 时，已审核上架应用可经本人个人空间显式安装后接续原请求，仍须满足现行强认证要求。安装批准不代替本人同意，不延长原十分钟期限。多个符合条件的安装须显式选择。独立 Client、设备请求、组织安装与业务 Audience 不适用此首次接入路径。业务 Audience 请求须在发起时提供两个安装选择字段。换码不能替换已固定上下文，成功及错误回调均须校验原事务绑定的 state。"
+          }
+        },
         "tags": [
           "Identity"
         ],
@@ -67,8 +76,16 @@
             "name": "client_id",
             "in": "query",
             "required": true,
-            "description": "Public or confidential user-client ID. Always send it in this query; never send a client secret to the authorization endpoint.",
-            "x-lime-zh-CN": "公共或机密用户客户端 ID。所有用户客户端均在此查询参数中提供 ID，不得向授权端点发送 Secret。",
+            "description": "The selected environment's application App ID, or a separately registered public or confidential user-client ID. The production App ID equals the Application ID; sandbox uses a separate App ID. Always send the ID in this query and keep the secret off the authorization endpoint.",
+            "x-lime-zh-CN": "所选环境的应用 App ID，或独立登记的公共、机密用户客户端 ID。正式 App ID 与 Application ID 相同，沙箱使用独立 App ID。始终在此查询参数中提交 ID，不向授权端点发送 Secret。",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The selected environment's application App ID, or a separately registered public or confidential user-client ID. The production App ID equals the Application ID; sandbox uses a separate App ID. Always send the ID in this query and keep the secret off the authorization endpoint."
+              },
+              "zh-CN": {
+                "description": "所选环境的应用 App ID，或独立登记的公共、机密用户客户端 ID。正式 App ID 与 Application ID 相同，沙箱使用独立 App ID。始终在此查询参数中提交 ID，不向授权端点发送 Secret。"
+              }
+            },
             "schema": {
               "type": "string"
             }
@@ -95,8 +112,33 @@
             "name": "scope",
             "in": "query",
             "required": false,
-            "description": "Space-separated scopes registered on this client. openid is required for sign-in; profile, email and offline_access are optional.",
-            "x-lime-zh-CN": "客户端已登记的权限，以空格分隔。登录须含 openid，可选 profile、email、offline_access。",
+            "description": "Space-separated scopes. Sign-in requires openid; profile, email and offline_access are optional. User business authorization requires openid and the approved business scopes frozen in the selected installation for the single API audience.",
+            "x-lime-zh-CN": "以空格分隔的权限。登录须含 openid，可选 profile、email、offline_access。本人业务授权须含 openid 及所选安装对单一 API Audience 已批准冻结的业务权限。",
+            "schema": {
+              "type": "string"
+            },
+            "x-lime-localizations": {
+              "en": {
+                "description": "Space-separated scopes. Sign-in requires openid; profile, email and offline_access are optional. User business authorization requires openid and the approved business scopes frozen in the selected installation for the single API audience."
+              },
+              "zh-CN": {
+                "description": "以空格分隔的权限。登录须含 openid，可选 profile、email、offline_access。本人业务授权须含 openid 及所选安装对单一 API Audience 已批准冻结的业务权限。"
+              }
+            }
+          },
+          {
+            "name": "audience",
+            "in": "query",
+            "required": false,
+            "description": "For user business authorization, send exactly one approved API audience in the form urn:lime:api:{providerApplicationID}:production:{apiServiceID}, together with installation_id and space_id. Request openid and the installed business scopes. An ordinary OpenID token does not authorize business APIs. A resource parameter or multiple business audiences are rejected.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "For user business authorization, send exactly one approved API audience in the form urn:lime:api:{providerApplicationID}:production:{apiServiceID}, together with installation_id and space_id. Request openid and the installed business scopes. An ordinary OpenID token does not authorize business APIs. A resource parameter or multiple business audiences are rejected."
+              },
+              "zh-CN": {
+                "description": "申请本人业务授权时，提交一个已批准 API 的 Audience，格式为 urn:lime:api:{providerApplicationID}:production:{apiServiceID}，并同时提供 installation_id 与 space_id。Scope 须含 openid 及已安装的业务权限。普通 OpenID 令牌不能调用业务 API；不接受 resource 参数或多个业务 Audience。"
+              }
+            },
             "schema": {
               "type": "string"
             }
@@ -196,8 +238,16 @@
             "name": "installation_id",
             "in": "query",
             "required": false,
-            "description": "Production installation ID. Supply together with space_id when authorizing an enterprise installation.",
-            "x-lime-zh-CN": "生产安装 ID。授权企业安装时须与 space_id 同时传入。",
+            "description": "Production installation ID, supplied together with space_id when selecting explicitly. Both may be omitted only for identity-only production App ID Web OIDC sign-in that resolves exactly one existing eligible partner or official installation. Other installation-bound client and business-audience requests retain explicit selection.",
+            "x-lime-zh-CN": "正式安装 ID，显式选择时须与 space_id 同时传入。仅请求身份权限的正式 App ID Web OIDC 登录，且可确定唯一已有可用合作或官方应用安装时，可同时省略这两个字段。其他安装绑定客户端及业务 Audience 请求仍须显式选择。",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Production installation ID, supplied together with space_id when selecting explicitly. Both may be omitted only for identity-only production App ID Web OIDC sign-in that resolves exactly one existing eligible partner or official installation. Other installation-bound client and business-audience requests retain explicit selection."
+              },
+              "zh-CN": {
+                "description": "正式安装 ID，显式选择时须与 space_id 同时传入。仅请求身份权限的正式 App ID Web OIDC 登录，且可确定唯一已有可用合作或官方应用安装时，可同时省略这两个字段。其他安装绑定客户端及业务 Audience 请求仍须显式选择。"
+              }
+            },
             "schema": {
               "type": "string",
               "maxLength": 40
@@ -207,8 +257,16 @@
             "name": "space_id",
             "in": "query",
             "required": false,
-            "description": "Workspace containing the installation. This does not select a global current workspace.",
-            "x-lime-zh-CN": "安装所属的工作空间，不用于选择全局当前空间。",
+            "description": "Workspace containing the explicitly selected installation; provide together with installation_id. Both may be omitted under the production App ID identity-only Web sign-in rule. This field does not select a global current workspace.",
+            "x-lime-zh-CN": "显式选择的安装所属空间，须与 installation_id 同时传入。符合正式 App ID 纯身份 Web 登录条件时，可同时省略两个字段；此字段不用于选择全局当前空间。",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Workspace containing the explicitly selected installation; provide together with installation_id. Both may be omitted under the production App ID identity-only Web sign-in rule. This field does not select a global current workspace."
+              },
+              "zh-CN": {
+                "description": "显式选择的安装所属空间，须与 installation_id 同时传入。符合正式 App ID 纯身份 Web 登录条件时，可同时省略两个字段；此字段不用于选择全局当前空间。"
+              }
+            },
             "schema": {
               "type": "string",
               "maxLength": 40