@managemint-solutions/sdk 0.69.0 → 0.70.0

package/README.md

@@ -401,8 +401,13 @@ await service.staffPermissions.updateForStaff(staffId, patch, byStaffId); // Upd
 ### User api credentials and emulation
 
 A credential is a client id and secret staff issue for one tenant user. Exchanging it mints that
-user's own token, which the custom access token hook marks `emulated: true` and gives a one-hour
-`exp`; `verifyAccessToken` returns it as `emulated: true` (`false` for a user's own session).
+user's own token, which the custom access token hook marks `api_credential` (the credential) with a
+15-minute `exp`; `verifyAccessToken` returns it as `api_credential`, and it reads and writes as the
+user. A staff member's Emulate User token is marked `emulated: true` with a one-hour `exp`
+(`verifyAccessToken`'s `emulated`, read-only on the main api). A token Supabase's OAuth server
+issued to an app carries `client_id`, returned as `oauth_client_id`. The caller's side of that
+OAuth server is `supabase.oauth` (`getAuthorization`, `answerAuthorization`, `listGrants`,
+`revokeGrant`), plain calls to GoTrue's endpoints with the caller's bearer.
 
 The mint itself lives in the admin api. The SDK calls it is made of:
 

package/dist/auth.d.ts

@@ -40,8 +40,18 @@ export type VerifiedAuth = AuthContext & {
     name: string | null;
     surname: string | null;
     organization: VerifiedOrganization;
-    /** True when the token was minted through an emulation handshake; false for the user's own session. */
+    /** True for a staff member's Emulate User token (read-only); false for every other token. */
     emulated: boolean;
+    /**
+     * The user api credential that minted this token, or null. Such a token acts as the user,
+     * reads and writes alike, but is not the user at the keyboard.
+     */
+    api_credential: string | null;
+    /**
+     * The OAuth app (an MCP client such as Claude) this token was issued to, or null. Like
+     * `api_credential`: the user's own access, through an app rather than the user's own login.
+     */
+    oauth_client_id: string | null;
 };
 export type VerifyAccessTokenConfig = {
     url: string;

package/dist/auth.js

@@ -72,9 +72,12 @@ const verifyAccessToken = async ({ url, key, accessToken, client = (0, exports.c
             access_expires_at: organization.access_expires_at ?? null,
             modules: organization.modules ?? [],
         },
-        // Stamped by the custom access token hook, inside the signature - a user cannot add it to
-        // their own session.
+        // All three are inside the signature - a user cannot add them to their own session.
+        // `emulated` and `api_credential` are stamped by the custom access token hook, `client_id`
+        // by GoTrue's OAuth server.
         emulated: claims.emulated === true,
+        api_credential: typeof claims.api_credential === 'string' ? claims.api_credential : null,
+        oauth_client_id: typeof claims.client_id === 'string' ? claims.client_id : null,
     };
 };
 exports.verifyAccessToken = verifyAccessToken;

package/dist/client.d.ts

@@ -7,6 +7,7 @@ import { ConfigsResource } from './configs';
 import { DocumentsResource, DocumentTemplatesResource } from './documents';
 import { NotesResource } from './notes';
 import { NotificationsResource } from './notifications';
+import { OAuthResource } from './oauth';
 import { BillingReadsResource } from './billing';
 import { InvoicesReadsResource } from './billing/invoices';
 import { InventoryItemsResource, InventoryLevelsResource, InventoryLocationsResource, InventoryMovementsResource, InventoryStocktakesResource, InventoryTransfersResource } from './inventory';
@@ -83,6 +84,8 @@ export declare class SupabaseClient {
     readonly inventoryMovements: InventoryMovementsResource;
     readonly inventoryTransfers: InventoryTransfersResource;
     readonly inventoryStocktakes: InventoryStocktakesResource;
+    /** The caller's answers to OAuth connection requests and the apps they have connected. */
+    readonly oauth: OAuthResource;
     constructor(config: SupabaseClientConfig);
 }
 export declare const createSupabaseClient: (config: SupabaseClientConfig) => SupabaseClient;

package/dist/client.js

@@ -9,6 +9,7 @@ const configs_1 = require("./configs");
 const documents_1 = require("./documents");
 const notes_1 = require("./notes");
 const notifications_1 = require("./notifications");
+const oauth_1 = require("./oauth");
 const billing_1 = require("./billing");
 const invoices_1 = require("./billing/invoices");
 const inventory_1 = require("./inventory");
@@ -69,6 +70,8 @@ class SupabaseClient {
     inventoryMovements;
     inventoryTransfers;
     inventoryStocktakes;
+    /** The caller's answers to OAuth connection requests and the apps they have connected. */
+    oauth;
     constructor(config) {
         this.auth = config.auth;
         this.supabase =
@@ -109,6 +112,7 @@ class SupabaseClient {
         this.inventoryMovements = new inventory_1.InventoryMovementsResource(this.supabase, this.auth, this.audit);
         this.inventoryTransfers = new inventory_1.InventoryTransfersResource(this.supabase, this.auth, this.audit);
         this.inventoryStocktakes = new inventory_1.InventoryStocktakesResource(this.supabase, this.auth, this.audit);
+        this.oauth = new oauth_1.OAuthResource(config.url, config.key, config.accessToken);
     }
 }
 exports.SupabaseClient = SupabaseClient;

package/dist/index.d.ts

@@ -34,6 +34,7 @@ export { CreateOrganizationDto, GetOrganizationsDto, OrganizationIdDto, UpdateOr
 export { PermissionsResource } from './permissions';
 export type { PermissionFlags } from './permissions';
 export { UpdatePermissionsDto } from './permissions';
+export { OAuthAuthorizationIdDto, OAuthClientIdDto } from './oauth';
 export { CreateStaffDto, StaffIdDto, UpdateStaffPermissionsDto } from './staff';
 export type { CreateUserApiCredentialRow, UserApiCredentialRow } from './user-api-credentials';
 export { CreateUserApiCredentialDto, MintEmulationTokenDto, UserApiCredentialIdDto, } from './user-api-credentials';

package/dist/index.js

@@ -8,9 +8,9 @@
 // to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IsAdditionalDetailsValueByType = exports.GetAllAdditionalDetailsDto = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.GetAllStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.GetCronRunsDto = exports.CronIdDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.ConfigIdDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.ModuleSetDto = exports.ChangeModulesDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.withAuditBatch = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseStaffClient = exports.SupabaseStaffClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.GetInventoryItemsDto = exports.GeocodeAddressDto = exports.CreateInventoryTransferLineDto = exports.CreateInventoryTransferDto = exports.CreateInventoryMovementDto = exports.CreateInventoryLocationDto = exports.CreateInventoryItemDto = exports.CountInventoryLineDto = exports.CountInventoryDto = exports.UpdateLeadDto = exports.StaffGetLeadsDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.StaffGetClientsDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.GetAllSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.StaffGetUsersDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserApiCredentialIdDto = exports.MintEmulationTokenDto = exports.CreateUserApiCredentialDto = exports.UpdateStaffPermissionsDto = exports.StaffIdDto = exports.CreateStaffDto = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.OrganizationIdDto = exports.GetOrganizationsDto = exports.CreateOrganizationDto = exports.UpdateOrganizationPayoutsDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.GetAllNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = void 0;
-exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.StaffGetProjectsDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateVisibilityDto = exports.ReassignPrivateDocumentsDto = exports.ConvertDocumentDto = exports.VoidDocumentDto = exports.UpdateDocumentTemplateDto = exports.UpdateDocumentDto = exports.SendDocumentDto = exports.RecordDocumentPaymentDto = exports.PayDocumentDto = exports.GetDocumentTemplatesDto = exports.GetDocumentsDto = exports.GetCatalogueTemplatesDto = exports.documentProblem = exports.DocumentTemplateIdDto = exports.DocumentPaymentIdDto = exports.DocumentPayTokenDto = exports.DocumentPayQueryDto = exports.DocumentImageUrlsDto = exports.DocumentImageNameDto = exports.DocumentIdDto = exports.CreateDocumentTemplateDto = exports.CreateDocumentDto = exports.CopyCatalogueTemplateDto = exports.CatalogueTemplateSlugDto = exports.UpdateInventoryTransferDto = exports.UpdateInventoryLocationDto = exports.UpdateInventoryLevelDto = exports.UpdateInventoryItemDto = exports.SuggestAddressesDto = exports.StaffGetInventoryItemsDto = exports.ReceiveInventoryTransferDto = exports.InventoryTransferIdDto = exports.InventoryStocktakeIdDto = exports.InventoryLocationIdDto = exports.InventoryLevelKeyDto = exports.InventoryItemIdDto = exports.ImportInventoryItemsDto = exports.ImportInventoryItemDto = exports.GetInventoryTransfersDto = exports.GetInventoryStocktakesDto = exports.GetInventoryMovementsDto = exports.GetInventoryLocationsDto = void 0;
-exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.StaffGetTasksDto = void 0;
+exports.CreateInventoryTransferLineDto = exports.CreateInventoryTransferDto = exports.CreateInventoryMovementDto = exports.CreateInventoryLocationDto = exports.CreateInventoryItemDto = exports.CountInventoryLineDto = exports.CountInventoryDto = exports.UpdateLeadDto = exports.StaffGetLeadsDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.StaffGetClientsDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.GetAllSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.StaffGetUsersDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserApiCredentialIdDto = exports.MintEmulationTokenDto = exports.CreateUserApiCredentialDto = exports.UpdateStaffPermissionsDto = exports.StaffIdDto = exports.CreateStaffDto = exports.OAuthClientIdDto = exports.OAuthAuthorizationIdDto = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.OrganizationIdDto = exports.GetOrganizationsDto = exports.CreateOrganizationDto = exports.UpdateOrganizationPayoutsDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.GetAllNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = void 0;
+exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.StaffGetProjectsDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateVisibilityDto = exports.ReassignPrivateDocumentsDto = exports.ConvertDocumentDto = exports.VoidDocumentDto = exports.UpdateDocumentTemplateDto = exports.UpdateDocumentDto = exports.SendDocumentDto = exports.RecordDocumentPaymentDto = exports.PayDocumentDto = exports.GetDocumentTemplatesDto = exports.GetDocumentsDto = exports.GetCatalogueTemplatesDto = exports.documentProblem = exports.DocumentTemplateIdDto = exports.DocumentPaymentIdDto = exports.DocumentPayTokenDto = exports.DocumentPayQueryDto = exports.DocumentImageUrlsDto = exports.DocumentImageNameDto = exports.DocumentIdDto = exports.CreateDocumentTemplateDto = exports.CreateDocumentDto = exports.CopyCatalogueTemplateDto = exports.CatalogueTemplateSlugDto = exports.UpdateInventoryTransferDto = exports.UpdateInventoryLocationDto = exports.UpdateInventoryLevelDto = exports.UpdateInventoryItemDto = exports.SuggestAddressesDto = exports.StaffGetInventoryItemsDto = exports.ReceiveInventoryTransferDto = exports.InventoryTransferIdDto = exports.InventoryStocktakeIdDto = exports.InventoryLocationIdDto = exports.InventoryLevelKeyDto = exports.InventoryItemIdDto = exports.ImportInventoryItemsDto = exports.ImportInventoryItemDto = exports.GetInventoryTransfersDto = exports.GetInventoryStocktakesDto = exports.GetInventoryMovementsDto = exports.GetInventoryLocationsDto = exports.GetInventoryItemsDto = exports.GeocodeAddressDto = void 0;
+exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.StaffGetTasksDto = exports.GetTasksDto = exports.CreateTaskDto = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
@@ -100,6 +100,9 @@ var permissions_1 = require("./permissions");
 Object.defineProperty(exports, "PermissionsResource", { enumerable: true, get: function () { return permissions_1.PermissionsResource; } });
 var permissions_2 = require("./permissions");
 Object.defineProperty(exports, "UpdatePermissionsDto", { enumerable: true, get: function () { return permissions_2.UpdatePermissionsDto; } });
+var oauth_1 = require("./oauth");
+Object.defineProperty(exports, "OAuthAuthorizationIdDto", { enumerable: true, get: function () { return oauth_1.OAuthAuthorizationIdDto; } });
+Object.defineProperty(exports, "OAuthClientIdDto", { enumerable: true, get: function () { return oauth_1.OAuthClientIdDto; } });
 var staff_1 = require("./staff");
 Object.defineProperty(exports, "CreateStaffDto", { enumerable: true, get: function () { return staff_1.CreateStaffDto; } });
 Object.defineProperty(exports, "StaffIdDto", { enumerable: true, get: function () { return staff_1.StaffIdDto; } });

package/dist/oauth/dto.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthAuthorizationIdDto as OAuthAuthorizationIdDtoType, OAuthClientIdDto as OAuthClientIdDtoType } from '@managemint-solutions/entities/oauth/dto';
+export declare class OAuthAuthorizationIdDto implements OAuthAuthorizationIdDtoType {
+    readonly authorizationId: string;
+}
+export declare class OAuthClientIdDto implements OAuthClientIdDtoType {
+    readonly clientId: string;
+}

package/dist/oauth/dto.js

@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthClientIdDto = exports.OAuthAuthorizationIdDto = void 0;
+const class_validator_1 = require("class-validator");
+class OAuthAuthorizationIdDto {
+    // GoTrue's own id format, not one of ours, so only its length is checked.
+    authorizationId;
+}
+exports.OAuthAuthorizationIdDto = OAuthAuthorizationIdDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Invalid authorization ID' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Invalid authorization ID' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Invalid authorization ID' }),
+    __metadata("design:type", String)
+], OAuthAuthorizationIdDto.prototype, "authorizationId", void 0);
+class OAuthClientIdDto {
+    clientId;
+}
+exports.OAuthClientIdDto = OAuthClientIdDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('all', { message: 'Invalid app ID format' }),
+    __metadata("design:type", String)
+], OAuthClientIdDto.prototype, "clientId", void 0);

package/dist/oauth/index.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthAuthorizationResponse, OAuthGrant, OAuthRedirect } from '@managemint-solutions/entities/oauth';
+export * from './dto';
+/**
+ * The caller's side of Supabase Auth's OAuth server: answering a connection request on the
+ * consent page, and the apps they have connected.
+ *
+ * GoTrue authenticates these endpoints with the caller's own token, and supabase-js only sends
+ * one from a stored session, which a stateless server-side client never has - so these are plain
+ * calls to the same endpoints supabase-js uses (`auth.oauth.*`), carrying the caller's bearer.
+ */
+export declare class OAuthResource {
+    private readonly url;
+    private readonly key;
+    private readonly accessToken;
+    constructor(url: string, key: string, accessToken: string);
+    /** A connection request: what the consent page shows, or a redirect if already approved. */
+    getAuthorization(authorizationId: string): Promise<OAuthAuthorizationResponse>;
+    /** Approves or denies a connection request; either way the answer is a redirect to the app. */
+    answerAuthorization(authorizationId: string, action: 'approve' | 'deny'): Promise<OAuthRedirect>;
+    /** The apps the caller has connected. */
+    listGrants(): Promise<OAuthGrant[]>;
+    /** Disconnects an app: GoTrue ends its sessions and refresh tokens at once. */
+    revokeGrant(clientId: string): Promise<void>;
+    private request;
+}

package/dist/oauth/index.js

@@ -0,0 +1,88 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthResource = void 0;
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+/**
+ * The caller's side of Supabase Auth's OAuth server: answering a connection request on the
+ * consent page, and the apps they have connected.
+ *
+ * GoTrue authenticates these endpoints with the caller's own token, and supabase-js only sends
+ * one from a stored session, which a stateless server-side client never has - so these are plain
+ * calls to the same endpoints supabase-js uses (`auth.oauth.*`), carrying the caller's bearer.
+ */
+class OAuthResource {
+    url;
+    key;
+    accessToken;
+    constructor(url, key, accessToken) {
+        this.url = url;
+        this.key = key;
+        this.accessToken = accessToken;
+    }
+    /** A connection request: what the consent page shows, or a redirect if already approved. */
+    async getAuthorization(authorizationId) {
+        const data = await this.request('GET', `/oauth/authorizations/${encodeURIComponent(authorizationId)}`);
+        if ('redirect_url' in data)
+            return { redirect_url: data.redirect_url };
+        // GoTrue also sends the signed-in user; the caller already knows who they are.
+        return {
+            authorization_id: data.authorization_id,
+            redirect_uri: data.redirect_uri,
+            client: data.client,
+            scope: data.scope,
+        };
+    }
+    /** Approves or denies a connection request; either way the answer is a redirect to the app. */
+    async answerAuthorization(authorizationId, action) {
+        const data = await this.request('POST', `/oauth/authorizations/${encodeURIComponent(authorizationId)}/consent`, { action });
+        return { redirect_url: data.redirect_url };
+    }
+    /** The apps the caller has connected. */
+    async listGrants() {
+        return await this.request('GET', '/user/oauth/grants');
+    }
+    /** Disconnects an app: GoTrue ends its sessions and refresh tokens at once. */
+    async revokeGrant(clientId) {
+        await this.request('DELETE', `/user/oauth/grants?client_id=${encodeURIComponent(clientId)}`);
+    }
+    async request(method, path, body) {
+        const response = await fetch(`${this.url}/auth/v1${path}`, {
+            method,
+            headers: {
+                apikey: this.key,
+                Authorization: `Bearer ${this.accessToken}`,
+                ...(body ? { 'Content-Type': 'application/json' } : {}),
+            },
+            ...(body ? { body: JSON.stringify(body) } : {}),
+        });
+        const text = await response.text();
+        const data = text ? JSON.parse(text) : null;
+        if (!response.ok) {
+            const error = (data ?? {});
+            throw new errors_1.SupabaseClientError({
+                // GoTrue answers an unknown or expired request with 404 and a bad id with 400; anything
+                // else is its own failure, not the caller's.
+                status: response.status >= 500 ? 502 : response.status,
+                error: 'Authentication Error',
+                message: error.msg ?? error.message ?? error.error_description ?? 'The connection request failed',
+            });
+        }
+        return data;
+    }
+}
+exports.OAuthResource = OAuthResource;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",
@@ -55,7 +55,7 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "@managemint-solutions/entities": "^1.51.0"
+    "@managemint-solutions/entities": "^1.52.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",