@meistrari/auth-core 1.28.1 → 1.29.0

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
 import z, { z as z$1 } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.28.1";
+const version = "1.29.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -439,25 +439,23 @@ class AdminService {
     });
   }
   /**
-   * Lists all Better Auth users from the user table.
+   * Lists users as a global admin, optionally with organization previews
+   * and totals when a preview size is requested.
    *
-   * @param options - Pagination, search, filter, and ordering options
+   * @param options - Pagination, ordering, search, and preview options
    * @returns The paginated user listing
    */
   async listUsers(options = {}) {
-    return await this.client.$fetch("/admin/list-users", {
+    return await this.client.$fetch("/admin/users", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
         ...options.offset !== void 0 ? { offset: options.offset } : {},
-        ...options.searchValue ? { searchValue: options.searchValue } : {},
-        ...options.searchField ? { searchField: options.searchField } : {},
-        ...options.searchOperator ? { searchOperator: options.searchOperator } : {},
         ...options.sortBy ? { sortBy: options.sortBy } : {},
         ...options.sortDirection ? { sortDirection: options.sortDirection } : {},
-        ...options.filterField ? { filterField: options.filterField } : {},
-        ...options.filterValue !== void 0 ? { filterValue: options.filterValue } : {},
-        ...options.filterOperator ? { filterOperator: options.filterOperator } : {}
+        ...options.query ? { query: options.query } : {},
+        ...options.organizationsPreview !== void 0 ? { organizations_preview: options.organizationsPreview } : {},
+        ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {}
       }
     });
   }
@@ -479,6 +477,20 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Fetches the per-organization access report for a single user: their
+   * organizations with role, membership ID, and teams, plus each
+   * organization's entitled applications with the user's effective role.
+   *
+   * @param userId - The ID of the user to fetch access for
+   * @returns The user access report
+   */
+  async getUserAccess(userId) {
+    const { data } = await this.client.$fetch(`/admin/users/${encodeURIComponent(userId)}/access`, {
+      method: "GET"
+    });
+    return data;
+  }
   /**
    * Lists active members for one organization as a global admin.
    *
@@ -491,7 +503,11 @@ class AdminService {
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
         ...options.offset !== void 0 ? { offset: options.offset } : {},
-        ...options.query ? { query: options.query } : {}
+        ...options.query ? { query: options.query } : {},
+        ...options.role ? { role: options.role } : {},
+        ...options.teamIds !== void 0 && options.teamIds.length > 0 ? { team_ids: options.teamIds } : {},
+        ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
+        ...options.includeAccess !== void 0 ? { include_access: options.includeAccess } : {}
       }
     });
   }
@@ -555,6 +571,63 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Updates an organization member's role.
+   *
+   * @param options - Membership ID and the new role
+   * @returns The updated membership
+   */
+  async updateMemberRole(options) {
+    const { data } = await this.client.$fetch("/admin/organizations/members/update-role", {
+      method: "POST",
+      body: options
+    });
+    return data;
+  }
+  /**
+   * Removes an organization member.
+   *
+   * @param options - Membership ID to remove
+   * @returns The removed membership
+   */
+  async removeMember(options) {
+    const { data } = await this.client.$fetch("/admin/organizations/members/remove", {
+      method: "POST",
+      body: options
+    });
+    return data;
+  }
+  /**
+   * Sets a user's effective application role within an organization. A
+   * non-null role grants access, a null role denies access (leave
+   * application), and clear removes the user-specific override.
+   *
+   * @param options - User, organization, application, and the role or clear flag
+   */
+  async setUserApplicationRole(options) {
+    await this.client.$fetch(`/admin/users/${encodeURIComponent(options.userId)}/applications/role`, {
+      method: "POST",
+      body: {
+        organizationId: options.organizationId,
+        applicationId: options.applicationId,
+        ...options.clear === true ? { clear: true } : { role: options.role }
+      }
+    });
+  }
+  /**
+   * Reconciles a user's team memberships within an organization to a given set.
+   *
+   * @param options - User, organization, and the desired teams (empty to clear)
+   */
+  async setUserTeam(options) {
+    await this.client.$fetch(`/admin/users/${encodeURIComponent(options.userId)}/team`, {
+      method: "POST",
+      body: {
+        organizationId: options.organizationId,
+        teamIds: options.teamIds
+      }
+    });
+  }
   /**
    * Bans a user from the auth system and invalidates all their sessions.
    * @param userId - The ID of the user to ban
@@ -562,6 +635,51 @@ class AdminService {
   async banUser(userId) {
     await this.client.$fetch("/admin/ban-user", { method: "POST", body: { userId } });
   }
+  /**
+   * Lifts a user's ban.
+   * @param userId - The ID of the user to unban
+   */
+  async unbanUser(userId) {
+    await this.client.$fetch("/admin/unban-user", { method: "POST", body: { userId } });
+  }
+  /**
+   * Permanently removes a user from the auth system.
+   * @param userId - The ID of the user to remove
+   */
+  async removeUser(userId) {
+    await this.client.$fetch("/admin/remove-user", { method: "POST", body: { userId } });
+  }
+  /**
+   * Cancels a pending invitation as a global admin.
+   * @param invitationId - The ID of the invitation to cancel
+   */
+  async cancelInvite(invitationId) {
+    await this.client.$fetch("/admin/invites/cancel", { method: "POST", body: { invitationId } });
+  }
+  /**
+   * Re-sends an organization invitation email as a global admin.
+   * @param options - Organization, email, role, and optional application and teams
+   */
+  async resendInvite(options) {
+    await this.client.$fetch("/admin/organizations/users", {
+      method: "POST",
+      body: { ...options, sendInvite: true, resend: true }
+    });
+  }
+  /**
+   * Invites several users to an organization in one call. Failures are
+   * isolated per email in the results payload.
+   *
+   * @param options - Organization, emails, role, and optional teams/application
+   * @returns Per-email invite outcomes
+   */
+  async inviteOrganizationUsers(options) {
+    const { data } = await this.client.$fetch("/admin/organizations/users", {
+      method: "POST",
+      body: { ...options, sendInvite: true }
+    });
+    return data;
+  }
 }
 
 class BaseError extends Error {
@@ -668,6 +786,7 @@ const SENSITIVE_ACTION_ASSURANCE_POLICY = {
   minAal: AALs.Aal2,
   acceptedAmr: [AMRs.Pwd, AMRs.Otp, AMRs.Oauth]
 };
+const STEP_UP_MAX_AGE_SECONDS = 15 * 60;
 function getAalRank(aal) {
   switch (aal) {
     case AALs.Aal3:
@@ -683,7 +802,7 @@ function getAalRank(aal) {
 function maxAal(left, right) {
   return getAalRank(left) >= getAalRank(right) ? left : right;
 }
-function isAssuranceSufficientForPolicy(assurance, policy) {
+function isAssuranceSufficientForPolicy(assurance, policy, now = /* @__PURE__ */ new Date()) {
   if (!assurance) {
     return false;
   }
@@ -693,7 +812,16 @@ function isAssuranceSufficientForPolicy(assurance, policy) {
   if (!assurance.amr.length) {
     return false;
   }
-  return assurance.amr.some((amr) => policy.acceptedAmr.includes(amr));
+  if (!assurance.amr.some((amr) => policy.acceptedAmr.includes(amr))) {
+    return false;
+  }
+  if (getAalRank(policy.minAal) >= getAalRank(AALs.Aal2)) {
+    const assuredAtMs = Date.parse(assurance.assuredAt);
+    if (Number.isNaN(assuredAtMs) || now.getTime() - assuredAtMs > STEP_UP_MAX_AGE_SECONDS * 1e3) {
+      return false;
+    }
+  }
+  return true;
 }
 function canStepUpWithAmr(assurance, amr) {
   return !assurance.amr.includes(amr);
@@ -1841,4 +1969,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.28.1",
+  "version": "1.29.0",
   "type": "module",
   "exports": {
     ".": {