@meistrari/auth-core 1.34.0 → 1.35.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +39 -18
- package/dist/index.d.ts +39 -18
- package/dist/index.mjs +28 -1
- package/package.json +1 -1
package/dist/index.d.mts
CHANGED
|
@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
|
|
|
14
14
|
declare const ACRBrand: unique symbol;
|
|
15
15
|
declare const AuthMethodBrand: unique symbol;
|
|
16
16
|
declare const AMRs: {
|
|
17
|
-
readonly Pwd: ("
|
|
18
|
-
readonly Otp: ("
|
|
19
|
-
readonly Oauth: ("
|
|
20
|
-
readonly Sso: ("
|
|
21
|
-
readonly Saml: ("
|
|
17
|
+
readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
18
|
+
readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
19
|
+
readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
20
|
+
readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
21
|
+
readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
22
22
|
};
|
|
23
23
|
declare const AALs: {
|
|
24
24
|
readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
|
|
@@ -29,11 +29,11 @@ declare const ACRs: {
|
|
|
29
29
|
readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
|
|
30
30
|
};
|
|
31
31
|
declare const AuthMethods: {
|
|
32
|
-
readonly Password: ("
|
|
33
|
-
readonly EmailOTP: ("
|
|
34
|
-
readonly OAuth: ("
|
|
35
|
-
readonly SAML: ("
|
|
36
|
-
readonly Unknown: ("
|
|
32
|
+
readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
33
|
+
readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
34
|
+
readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
35
|
+
readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
36
|
+
readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
37
37
|
};
|
|
38
38
|
declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
|
|
39
39
|
readonly Pwd: "pwd";
|
|
@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
|
|
|
4402
4402
|
} & {
|
|
4403
4403
|
applications: {
|
|
4404
4404
|
getApplicationAuthContext: (applicationId: string) => Promise<{
|
|
4405
|
+
data: ApplicationAuthContextResponse;
|
|
4406
|
+
error: null;
|
|
4407
|
+
} | {
|
|
4405
4408
|
data: null;
|
|
4406
4409
|
error: {
|
|
4407
4410
|
message?: string | undefined;
|
|
4408
4411
|
status: number;
|
|
4409
4412
|
statusText: string;
|
|
4410
4413
|
};
|
|
4411
|
-
} | {
|
|
4412
|
-
data: ApplicationAuthContextResponse;
|
|
4413
|
-
error: null;
|
|
4414
4414
|
}>;
|
|
4415
4415
|
listCandidateOrganizations: (applicationId: string) => Promise<{
|
|
4416
4416
|
data: ListCandidateOrganizationsResponse;
|
|
@@ -6079,6 +6079,8 @@ type AdminUserAccessApplication = {
|
|
|
6079
6079
|
imageUrl: string | null;
|
|
6080
6080
|
/** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
|
|
6081
6081
|
role: string | null;
|
|
6082
|
+
/** User-facing name from the application role catalog. Null when no role matches. */
|
|
6083
|
+
roleDisplayName: string | null;
|
|
6082
6084
|
};
|
|
6083
6085
|
/**
|
|
6084
6086
|
* Team row in an admin user access report.
|
|
@@ -6135,6 +6137,17 @@ type AdminApplicationEntitlement = {
|
|
|
6135
6137
|
* Entitlement record returned by entitlement mutation endpoints.
|
|
6136
6138
|
*/
|
|
6137
6139
|
type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
|
|
6140
|
+
/** Application-scoped role definition used by entitlement rules. */
|
|
6141
|
+
type AdminApplicationRole = {
|
|
6142
|
+
applicationId: string;
|
|
6143
|
+
name: string;
|
|
6144
|
+
displayName: string;
|
|
6145
|
+
description: string;
|
|
6146
|
+
};
|
|
6147
|
+
/** Options accepted when creating an application role. */
|
|
6148
|
+
type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
|
|
6149
|
+
/** Options accepted when updating an application role. */
|
|
6150
|
+
type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
|
|
6138
6151
|
/** Kind of matcher an entitlement rule applies. */
|
|
6139
6152
|
type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
|
|
6140
6153
|
/**
|
|
@@ -6145,7 +6158,7 @@ type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organi
|
|
|
6145
6158
|
type AdminEntitlementRule = {
|
|
6146
6159
|
type: AdminEntitlementRuleType;
|
|
6147
6160
|
value: string;
|
|
6148
|
-
role
|
|
6161
|
+
role: string | null;
|
|
6149
6162
|
position: number;
|
|
6150
6163
|
};
|
|
6151
6164
|
/** An entitlement together with its ordered access rules. */
|
|
@@ -6339,6 +6352,14 @@ declare class AdminService {
|
|
|
6339
6352
|
* @returns The updated application
|
|
6340
6353
|
*/
|
|
6341
6354
|
updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
|
|
6355
|
+
/** Lists the role catalog for an application. */
|
|
6356
|
+
listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
|
|
6357
|
+
/** Creates an application-scoped role definition. */
|
|
6358
|
+
createApplicationRole(applicationId: string, options: CreateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
|
|
6359
|
+
/** Updates an application-scoped role definition. */
|
|
6360
|
+
updateApplicationRole(applicationId: string, currentName: string, options: UpdateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
|
|
6361
|
+
/** Deletes an application-scoped role definition. */
|
|
6362
|
+
deleteApplicationRole(applicationId: string, name: string): Promise<AdminApplicationRole>;
|
|
6342
6363
|
/**
|
|
6343
6364
|
* Enables an organization for an application.
|
|
6344
6365
|
*
|
|
@@ -6355,15 +6376,15 @@ declare class AdminService {
|
|
|
6355
6376
|
* @returns The paginated organization listing
|
|
6356
6377
|
*/
|
|
6357
6378
|
listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
|
|
6358
|
-
data: ListAdminOrganizationsResult;
|
|
6359
|
-
error: null;
|
|
6360
|
-
} | {
|
|
6361
6379
|
data: null;
|
|
6362
6380
|
error: {
|
|
6363
6381
|
message?: string | undefined;
|
|
6364
6382
|
status: number;
|
|
6365
6383
|
statusText: string;
|
|
6366
6384
|
};
|
|
6385
|
+
} | {
|
|
6386
|
+
data: ListAdminOrganizationsResult;
|
|
6387
|
+
error: null;
|
|
6367
6388
|
}>;
|
|
6368
6389
|
/**
|
|
6369
6390
|
* Lists users as a global admin, optionally with organization previews
|
|
@@ -7522,4 +7543,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
|
|
|
7522
7543
|
declare function extractTokenPayload(token: string): DecodedJWTPayload;
|
|
7523
7544
|
|
|
7524
7545
|
export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
|
|
7525
|
-
export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
|
|
7546
|
+
export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
|
package/dist/index.d.ts
CHANGED
|
@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
|
|
|
14
14
|
declare const ACRBrand: unique symbol;
|
|
15
15
|
declare const AuthMethodBrand: unique symbol;
|
|
16
16
|
declare const AMRs: {
|
|
17
|
-
readonly Pwd: ("
|
|
18
|
-
readonly Otp: ("
|
|
19
|
-
readonly Oauth: ("
|
|
20
|
-
readonly Sso: ("
|
|
21
|
-
readonly Saml: ("
|
|
17
|
+
readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
18
|
+
readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
19
|
+
readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
20
|
+
readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
21
|
+
readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
|
|
22
22
|
};
|
|
23
23
|
declare const AALs: {
|
|
24
24
|
readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
|
|
@@ -29,11 +29,11 @@ declare const ACRs: {
|
|
|
29
29
|
readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
|
|
30
30
|
};
|
|
31
31
|
declare const AuthMethods: {
|
|
32
|
-
readonly Password: ("
|
|
33
|
-
readonly EmailOTP: ("
|
|
34
|
-
readonly OAuth: ("
|
|
35
|
-
readonly SAML: ("
|
|
36
|
-
readonly Unknown: ("
|
|
32
|
+
readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
33
|
+
readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
34
|
+
readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
35
|
+
readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
36
|
+
readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
|
|
37
37
|
};
|
|
38
38
|
declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
|
|
39
39
|
readonly Pwd: "pwd";
|
|
@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
|
|
|
4402
4402
|
} & {
|
|
4403
4403
|
applications: {
|
|
4404
4404
|
getApplicationAuthContext: (applicationId: string) => Promise<{
|
|
4405
|
+
data: ApplicationAuthContextResponse;
|
|
4406
|
+
error: null;
|
|
4407
|
+
} | {
|
|
4405
4408
|
data: null;
|
|
4406
4409
|
error: {
|
|
4407
4410
|
message?: string | undefined;
|
|
4408
4411
|
status: number;
|
|
4409
4412
|
statusText: string;
|
|
4410
4413
|
};
|
|
4411
|
-
} | {
|
|
4412
|
-
data: ApplicationAuthContextResponse;
|
|
4413
|
-
error: null;
|
|
4414
4414
|
}>;
|
|
4415
4415
|
listCandidateOrganizations: (applicationId: string) => Promise<{
|
|
4416
4416
|
data: ListCandidateOrganizationsResponse;
|
|
@@ -6079,6 +6079,8 @@ type AdminUserAccessApplication = {
|
|
|
6079
6079
|
imageUrl: string | null;
|
|
6080
6080
|
/** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
|
|
6081
6081
|
role: string | null;
|
|
6082
|
+
/** User-facing name from the application role catalog. Null when no role matches. */
|
|
6083
|
+
roleDisplayName: string | null;
|
|
6082
6084
|
};
|
|
6083
6085
|
/**
|
|
6084
6086
|
* Team row in an admin user access report.
|
|
@@ -6135,6 +6137,17 @@ type AdminApplicationEntitlement = {
|
|
|
6135
6137
|
* Entitlement record returned by entitlement mutation endpoints.
|
|
6136
6138
|
*/
|
|
6137
6139
|
type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
|
|
6140
|
+
/** Application-scoped role definition used by entitlement rules. */
|
|
6141
|
+
type AdminApplicationRole = {
|
|
6142
|
+
applicationId: string;
|
|
6143
|
+
name: string;
|
|
6144
|
+
displayName: string;
|
|
6145
|
+
description: string;
|
|
6146
|
+
};
|
|
6147
|
+
/** Options accepted when creating an application role. */
|
|
6148
|
+
type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
|
|
6149
|
+
/** Options accepted when updating an application role. */
|
|
6150
|
+
type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
|
|
6138
6151
|
/** Kind of matcher an entitlement rule applies. */
|
|
6139
6152
|
type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
|
|
6140
6153
|
/**
|
|
@@ -6145,7 +6158,7 @@ type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organi
|
|
|
6145
6158
|
type AdminEntitlementRule = {
|
|
6146
6159
|
type: AdminEntitlementRuleType;
|
|
6147
6160
|
value: string;
|
|
6148
|
-
role
|
|
6161
|
+
role: string | null;
|
|
6149
6162
|
position: number;
|
|
6150
6163
|
};
|
|
6151
6164
|
/** An entitlement together with its ordered access rules. */
|
|
@@ -6339,6 +6352,14 @@ declare class AdminService {
|
|
|
6339
6352
|
* @returns The updated application
|
|
6340
6353
|
*/
|
|
6341
6354
|
updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
|
|
6355
|
+
/** Lists the role catalog for an application. */
|
|
6356
|
+
listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
|
|
6357
|
+
/** Creates an application-scoped role definition. */
|
|
6358
|
+
createApplicationRole(applicationId: string, options: CreateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
|
|
6359
|
+
/** Updates an application-scoped role definition. */
|
|
6360
|
+
updateApplicationRole(applicationId: string, currentName: string, options: UpdateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
|
|
6361
|
+
/** Deletes an application-scoped role definition. */
|
|
6362
|
+
deleteApplicationRole(applicationId: string, name: string): Promise<AdminApplicationRole>;
|
|
6342
6363
|
/**
|
|
6343
6364
|
* Enables an organization for an application.
|
|
6344
6365
|
*
|
|
@@ -6355,15 +6376,15 @@ declare class AdminService {
|
|
|
6355
6376
|
* @returns The paginated organization listing
|
|
6356
6377
|
*/
|
|
6357
6378
|
listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
|
|
6358
|
-
data: ListAdminOrganizationsResult;
|
|
6359
|
-
error: null;
|
|
6360
|
-
} | {
|
|
6361
6379
|
data: null;
|
|
6362
6380
|
error: {
|
|
6363
6381
|
message?: string | undefined;
|
|
6364
6382
|
status: number;
|
|
6365
6383
|
statusText: string;
|
|
6366
6384
|
};
|
|
6385
|
+
} | {
|
|
6386
|
+
data: ListAdminOrganizationsResult;
|
|
6387
|
+
error: null;
|
|
6367
6388
|
}>;
|
|
6368
6389
|
/**
|
|
6369
6390
|
* Lists users as a global admin, optionally with organization previews
|
|
@@ -7522,4 +7543,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
|
|
|
7522
7543
|
declare function extractTokenPayload(token: string): DecodedJWTPayload;
|
|
7523
7544
|
|
|
7524
7545
|
export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
|
|
7525
|
-
export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
|
|
7546
|
+
export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
|
package/dist/index.mjs
CHANGED
|
@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
|
|
|
8
8
|
import z, { z as z$1 } from 'zod';
|
|
9
9
|
export { APIError } from 'better-auth';
|
|
10
10
|
|
|
11
|
-
const version = "1.
|
|
11
|
+
const version = "1.35.0";
|
|
12
12
|
|
|
13
13
|
function parsedEnumValues(schema) {
|
|
14
14
|
return Object.fromEntries(
|
|
@@ -506,6 +506,33 @@ class AdminService {
|
|
|
506
506
|
body: options
|
|
507
507
|
});
|
|
508
508
|
}
|
|
509
|
+
/** Lists the role catalog for an application. */
|
|
510
|
+
async listApplicationRoles(applicationId) {
|
|
511
|
+
return await this.requestApplicationRoute(
|
|
512
|
+
`applications/${encodeURIComponent(applicationId)}/roles`
|
|
513
|
+
);
|
|
514
|
+
}
|
|
515
|
+
/** Creates an application-scoped role definition. */
|
|
516
|
+
async createApplicationRole(applicationId, options) {
|
|
517
|
+
return await this.requestApplicationRoute(
|
|
518
|
+
`applications/${encodeURIComponent(applicationId)}/roles`,
|
|
519
|
+
{ method: "POST", body: options }
|
|
520
|
+
);
|
|
521
|
+
}
|
|
522
|
+
/** Updates an application-scoped role definition. */
|
|
523
|
+
async updateApplicationRole(applicationId, currentName, options) {
|
|
524
|
+
return await this.requestApplicationRoute(
|
|
525
|
+
`applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(currentName)}`,
|
|
526
|
+
{ method: "PUT", body: options }
|
|
527
|
+
);
|
|
528
|
+
}
|
|
529
|
+
/** Deletes an application-scoped role definition. */
|
|
530
|
+
async deleteApplicationRole(applicationId, name) {
|
|
531
|
+
return await this.requestApplicationRoute(
|
|
532
|
+
`applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(name)}`,
|
|
533
|
+
{ method: "DELETE" }
|
|
534
|
+
);
|
|
535
|
+
}
|
|
509
536
|
/**
|
|
510
537
|
* Enables an organization for an application.
|
|
511
538
|
*
|