@meistrari/auth-core 2.2.0 → 2.4.0

package/dist/index.d.mts

@@ -884,7 +884,9 @@ declare class ApplicationService {
      * Lists candidate organizations for a specific application.
      *
      * Returns organizations where the authenticated user is a member and
-     * the application has been enabled with appropriate entitlement rules.
+     * the effective entitlement grants access through its rules. An enabled global
+     * entitlement is selected first; organization entitlements are considered only
+     * when no global entitlement is enabled.
      *
      * @param applicationId - The application ID to get candidate organizations for
      * @returns The list of candidate organizations
@@ -993,8 +995,10 @@ declare class ApplicationService {
      * Switches the active organization for the authenticated user.
      *
      * Issues new access and refresh tokens scoped to the specified organization.
-     * The target organization must be entitled to the application and the entitlement's
-     * access rules must allow the current user.
+     * Requires active membership in the target organization and an enabled entitlement
+     * whose rules allow the user. The global entitlement is selected first, and its
+     * denial never falls back to an organization entitlement. Organization entitlements
+     * are considered only when no global entitlement is enabled.
      *
      * @param organizationId - The ID of the organization to switch to
      * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
@@ -4434,15 +4438,15 @@ type CreateAdminApplicationOptions = {
     homeUrl?: string | null;
     /** Custom application authentication settings. */
     config?: ApplicationConfig | null;
-    /** Organizations to enable for this application during creation. */
+    /** Organization or global entitlements to create for this application. */
     entitlements?: CreateAdminApplicationEntitlementOptions[];
 };
 /**
- * Options accepted when enabling an organization for an application.
+ * Options accepted when creating an organization or global entitlement for an application.
  */
 type CreateAdminApplicationEntitlementOptions = {
-    /** Organization that should be entitled to the application. */
-    organizationId: string;
+    /** Organization ID for type `organization`; passing null creates an entitlement with type `global`. */
+    organizationId: string | null;
 };
 /**
  * Options accepted when creating a client secret for an application.
@@ -4856,8 +4860,11 @@ type AdminApplicationOrganization = {
  */
 type AdminApplicationEntitlement = {
     id: string;
+    /** Access scope. Defaults to `organization` when omitted; the API returns the resolved type. Type `global` applies across organizations. */
+    entitlementType?: 'organization' | 'global';
     applicationId: string;
-    organizationId: string;
+    /** Required for type `organization` and constrained to null for type `global`. */
+    organizationId: string | null;
     enabled: boolean;
     createdAt: string;
     updatedAt: string;
@@ -4881,10 +4888,10 @@ type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'application
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
-type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals' | 'global';
 /**
  * A single access rule on an entitlement. Rules are evaluated in `position`
- * order, first match wins. A non-null `role` grants access with that role; a
+ * order with the global catch-all always last, first match wins. A non-null `role` grants access with that role; a
  * null `role` denies access.
  */
 type AdminEntitlementRule = {
@@ -5264,6 +5271,25 @@ declare class AdminService {
     getUserAccess(userId: string): Promise<{
         data: AdminUserAccess;
     } | null>;
+    /**
+     * Lists applications with their entitlements as a global admin. Unlike
+     * {@link listApplications}, which goes through the session-only application
+     * routes, this uses the admin endpoint and so also works with a bearer token.
+     *
+     * @param options - Pagination, ordering, organization filter, search, and member preview options
+     * @returns The application listing with entitlement details
+     */
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminApplicationsResult;
+        error: null;
+    }>;
     /**
      * Lists the users with access to an application as a global admin, one row
      * per user with every organization that grants them access and the role it

package/dist/index.d.ts

@@ -884,7 +884,9 @@ declare class ApplicationService {
      * Lists candidate organizations for a specific application.
      *
      * Returns organizations where the authenticated user is a member and
-     * the application has been enabled with appropriate entitlement rules.
+     * the effective entitlement grants access through its rules. An enabled global
+     * entitlement is selected first; organization entitlements are considered only
+     * when no global entitlement is enabled.
      *
      * @param applicationId - The application ID to get candidate organizations for
      * @returns The list of candidate organizations
@@ -993,8 +995,10 @@ declare class ApplicationService {
      * Switches the active organization for the authenticated user.
      *
      * Issues new access and refresh tokens scoped to the specified organization.
-     * The target organization must be entitled to the application and the entitlement's
-     * access rules must allow the current user.
+     * Requires active membership in the target organization and an enabled entitlement
+     * whose rules allow the user. The global entitlement is selected first, and its
+     * denial never falls back to an organization entitlement. Organization entitlements
+     * are considered only when no global entitlement is enabled.
      *
      * @param organizationId - The ID of the organization to switch to
      * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
@@ -4434,15 +4438,15 @@ type CreateAdminApplicationOptions = {
     homeUrl?: string | null;
     /** Custom application authentication settings. */
     config?: ApplicationConfig | null;
-    /** Organizations to enable for this application during creation. */
+    /** Organization or global entitlements to create for this application. */
     entitlements?: CreateAdminApplicationEntitlementOptions[];
 };
 /**
- * Options accepted when enabling an organization for an application.
+ * Options accepted when creating an organization or global entitlement for an application.
  */
 type CreateAdminApplicationEntitlementOptions = {
-    /** Organization that should be entitled to the application. */
-    organizationId: string;
+    /** Organization ID for type `organization`; passing null creates an entitlement with type `global`. */
+    organizationId: string | null;
 };
 /**
  * Options accepted when creating a client secret for an application.
@@ -4856,8 +4860,11 @@ type AdminApplicationOrganization = {
  */
 type AdminApplicationEntitlement = {
     id: string;
+    /** Access scope. Defaults to `organization` when omitted; the API returns the resolved type. Type `global` applies across organizations. */
+    entitlementType?: 'organization' | 'global';
     applicationId: string;
-    organizationId: string;
+    /** Required for type `organization` and constrained to null for type `global`. */
+    organizationId: string | null;
     enabled: boolean;
     createdAt: string;
     updatedAt: string;
@@ -4881,10 +4888,10 @@ type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'application
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
-type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals' | 'global';
 /**
  * A single access rule on an entitlement. Rules are evaluated in `position`
- * order, first match wins. A non-null `role` grants access with that role; a
+ * order with the global catch-all always last, first match wins. A non-null `role` grants access with that role; a
  * null `role` denies access.
  */
 type AdminEntitlementRule = {
@@ -5264,6 +5271,25 @@ declare class AdminService {
     getUserAccess(userId: string): Promise<{
         data: AdminUserAccess;
     } | null>;
+    /**
+     * Lists applications with their entitlements as a global admin. Unlike
+     * {@link listApplications}, which goes through the session-only application
+     * routes, this uses the admin endpoint and so also works with a bearer token.
+     *
+     * @param options - Pagination, ordering, organization filter, search, and member preview options
+     * @returns The application listing with entitlement details
+     */
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminApplicationsResult;
+        error: null;
+    }>;
     /**
      * Lists the users with access to an application as a global admin, one row
      * per user with every organization that grants them access and the role it

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "2.2.0";
+const version = "2.4.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -822,6 +822,28 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Lists applications with their entitlements as a global admin. Unlike
+   * {@link listApplications}, which goes through the session-only application
+   * routes, this uses the admin endpoint and so also works with a bearer token.
+   *
+   * @param options - Pagination, ordering, organization filter, search, and member preview options
+   * @returns The application listing with entitlement details
+   */
+  async listAdminApplications(options = {}) {
+    return await this.client.$fetch("/admin/applications", {
+      method: "GET",
+      query: {
+        ...options.limit !== void 0 ? { limit: options.limit } : {},
+        ...options.offset !== void 0 ? { offset: options.offset } : {},
+        ...options.search ? { search: options.search } : {},
+        ...options.organizationId ? { organization_id: options.organizationId } : {},
+        ...options.membersPreview !== void 0 ? { members_preview: options.membersPreview } : {},
+        ...options.orderBy ? { sortBy: options.orderBy } : {},
+        ...options.orderDirection ? { sortDirection: options.orderDirection } : {}
+      }
+    });
+  }
   /**
    * Lists the users with access to an application as a global admin, one row
    * per user with every organization that grants them access and the role it
@@ -1449,7 +1471,9 @@ class ApplicationService {
    * Lists candidate organizations for a specific application.
    *
    * Returns organizations where the authenticated user is a member and
-   * the application has been enabled with appropriate entitlement rules.
+   * the effective entitlement grants access through its rules. An enabled global
+   * entitlement is selected first; organization entitlements are considered only
+   * when no global entitlement is enabled.
    *
    * @param applicationId - The application ID to get candidate organizations for
    * @returns The list of candidate organizations
@@ -1659,8 +1683,10 @@ class ApplicationService {
    * Switches the active organization for the authenticated user.
    *
    * Issues new access and refresh tokens scoped to the specified organization.
-   * The target organization must be entitled to the application and the entitlement's
-   * access rules must allow the current user.
+   * Requires active membership in the target organization and an enabled entitlement
+   * whose rules allow the user. The global entitlement is selected first, and its
+   * denial never falls back to an organization entitlement. Organization entitlements
+   * are considered only when no global entitlement is enabled.
    *
    * @param organizationId - The ID of the organization to switch to
    * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "2.2.0",
+    "version": "2.4.0",
     "type": "module",
     "exports": {
         ".": {