@medalsocial/sdk 1.7.0 → 1.8.0

package/dist/src/index.mjs

@@ -35,17 +35,21 @@ var BaseClient = class {
     this.config = config;
   }
   /** Execute an authenticated GET request and return the parsed JSON body. */
-  async get(path, params) {
+  async get(path, params, options) {
     const url = this.buildUrl(path, params);
-    return this.request(url, { method: "GET" });
+    return this.request(url, { method: "GET", headers: options?.headers });
   }
   /** Execute an authenticated POST request with a JSON body. */
   async post(path, body, options) {
-    return this.request(this.buildUrl(path), {
-      method: "POST",
-      headers: this.writeHeaders(options),
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
+    return this.request(
+      this.buildUrl(path),
+      {
+        method: "POST",
+        headers: this.writeHeaders(options),
+        body: body !== void 0 ? JSON.stringify(body) : void 0
+      },
+      options?.retry
+    );
   }
   /**
    * Execute a POST that must never execute twice, guaranteeing an
@@ -72,21 +76,33 @@ var BaseClient = class {
   }
   /** Execute an authenticated PATCH request with a JSON body. */
   async patch(path, body, options) {
-    return this.request(this.buildUrl(path), {
-      method: "PATCH",
-      headers: this.writeHeaders(options),
-      body: JSON.stringify(body)
-    });
+    return this.request(
+      this.buildUrl(path),
+      {
+        method: "PATCH",
+        headers: this.writeHeaders(options),
+        body: JSON.stringify(body)
+      },
+      options?.retry
+    );
   }
   /** Execute an authenticated DELETE request. */
   async delete(path, options) {
-    return this.request(this.buildUrl(path), {
-      method: "DELETE",
-      headers: this.writeHeaders(options)
-    });
+    return this.request(
+      this.buildUrl(path),
+      {
+        method: "DELETE",
+        headers: this.writeHeaders(options)
+      },
+      options?.retry
+    );
   }
   writeHeaders(options) {
-    const headers = { "content-type": "application/json" };
+    const headers = {};
+    for (const [key, value] of Object.entries(options?.headers ?? {})) {
+      headers[key.toLowerCase()] = value;
+    }
+    headers["content-type"] = "application/json";
     if (options?.idempotencyKey) {
       headers["idempotency-key"] = options.idempotencyKey;
     }
@@ -106,8 +122,8 @@ var BaseClient = class {
     }
     return url.toString();
   }
-  async request(url, init) {
-    const maxAttempts = 3;
+  async request(url, init, retry = true) {
+    const maxAttempts = retry ? 3 : 1;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       const headers = new Headers(init.headers);
       headers.set("authorization", `Bearer ${this.config.token}`);
@@ -881,6 +897,111 @@ var Helpdesk = class {
   }
 };
 
+// src/resources/portal.ts
+function withSession(session) {
+  return { headers: { "x-portal-session": session } };
+}
+var ONCE = { retry: false };
+var PortalLogin = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * E-mail a one-time code to the address.
+   *
+   * Always 202 `{ status: "sent" }` — enumeration-safe: `"sent"` does not
+   * confirm that the address belongs to a contact. Rate-limited per address
+   * and per caller (`429 RATE_LIMITED`).
+   */
+  async start(input) {
+    return this.client.post("/api/v1/portal/login/start", input);
+  }
+  /**
+   * Exchange the e-mailed code for a session.
+   *
+   * `session_token` is a bearer credential for ONE contact — keep it in an
+   * HttpOnly cookie on the site's server. A wrong, burned or expired code all
+   * answer `401 PORTAL_CODE_INVALID`; the three are not distinguished, so the
+   * response is not an oracle for which codes exist.
+   */
+  async verify(input) {
+    return this.client.post("/api/v1/portal/login/verify", input, ONCE);
+  }
+};
+var Portal = class {
+  constructor(client) {
+    this.client = client;
+    this.login = new PortalLogin(client);
+  }
+  client;
+  /** E-mail one-time-code login: `start` sends the code, `verify` exchanges it. */
+  login;
+  /**
+   * Revoke the session. Resolves to `undefined` (the route answers 204).
+   *
+   * Not keyed: revoking twice reaches the same state — the second call answers
+   * `401 PORTAL_SESSION_INVALID`, which is the outcome you wanted anyway.
+   */
+  async logout(session) {
+    await this.client.post("/api/v1/portal/logout", void 0, {
+      ...withSession(session),
+      ...ONCE
+    });
+  }
+  /** The signed-in contact's own profile. */
+  async me(session) {
+    return this.client.get("/api/v1/portal/me", void 0, withSession(session));
+  }
+  /**
+   * Update the signed-in contact's profile. Only the supplied fields change;
+   * `phone: null` clears the number and `family` replaces the whole list.
+   * `marketing_consent` records a `marketing_email` consent decision with
+   * source `portal`. Returns the profile as it is after the change.
+   */
+  /**
+   * A profile patch is not idempotency-keyed on the server and a `marketing_consent`
+   * change records a dated consent event, so a retry after a committed-but-lost
+   * response would repeat that event: sent exactly once, like the other writes.
+   */
+  async updateMe(session, patch) {
+    return this.client.patch("/api/v1/portal/me", patch, { ...withSession(session), ...ONCE });
+  }
+  /**
+   * The contact's bookings split into `upcoming` and `past`. An upcoming
+   * booking that is still inside the workspace's policy windows carries
+   * `manage_token` and `can_manage: true`; use the token to open the site's
+   * manage page (`medal.bookings.manage.*`).
+   */
+  async myBookings(session) {
+    return this.client.get("/api/v1/portal/me/bookings", void 0, withSession(session));
+  }
+  /**
+   * Everything the workspace holds about the contact — profile, family,
+   * consents and bookings — as one JSON document (GDPR Art. 15). Synchronous,
+   * unlike `medal.gdpr.requestExport()`, which exports the whole workspace.
+   *
+   * Not keyed: a read-only snapshot, so a retried call costs nothing and
+   * duplicates nothing.
+   */
+  async exportMyData(session) {
+    return this.client.post("/api/v1/portal/me/export", void 0, withSession(session));
+  }
+  /**
+   * Erase the contact (GDPR Art. 17). Resolves to `undefined` (the route
+   * answers 204); the session is revoked as part of the deletion.
+   *
+   * Not keyed: deletion is terminal, so a retry meets a revoked session and
+   * answers `401 PORTAL_SESSION_INVALID` rather than deleting anything else.
+   */
+  async deleteMe(session) {
+    await this.client.post("/api/v1/portal/me/delete", void 0, {
+      ...withSession(session),
+      ...ONCE
+    });
+  }
+};
+
 // src/resources/posts.ts
 var Posts = class {
   constructor(client) {
@@ -1186,6 +1307,7 @@ var Medal = class {
   deals;
   gdpr;
   helpdesk;
+  portal;
   posts;
   scan;
   webhooks;
@@ -1215,6 +1337,7 @@ var Medal = class {
     this.deals = new Deals(client);
     this.gdpr = new Gdpr(client);
     this.helpdesk = new Helpdesk(client, confirmer);
+    this.portal = new Portal(client);
     this.posts = new Posts(client);
     this.scan = new Scan(client);
     this.webhooks = new Webhooks(client, confirmer);
@@ -1241,6 +1364,7 @@ export {
   Helpdesk,
   Medal,
   MedalApiError,
+  Portal,
   Posts,
   Scan,
   WebhookVerificationError,