@meistrari/auth-core 2.3.0 → 2.5.0

package/dist/index.d.mts

@@ -884,7 +884,9 @@ declare class ApplicationService {
      * Lists candidate organizations for a specific application.
      *
      * Returns organizations where the authenticated user is a member and
-     * the application has been enabled with appropriate entitlement rules.
+     * the effective entitlement grants access through its rules. An enabled global
+     * entitlement is selected first; organization entitlements are considered only
+     * when no global entitlement is enabled.
      *
      * @param applicationId - The application ID to get candidate organizations for
      * @returns The list of candidate organizations
@@ -993,8 +995,10 @@ declare class ApplicationService {
      * Switches the active organization for the authenticated user.
      *
      * Issues new access and refresh tokens scoped to the specified organization.
-     * The target organization must be entitled to the application and the entitlement's
-     * access rules must allow the current user.
+     * Requires active membership in the target organization and an enabled entitlement
+     * whose rules allow the user. The global entitlement is selected first, and its
+     * denial never falls back to an organization entitlement. Organization entitlements
+     * are considered only when no global entitlement is enabled.
      *
      * @param organizationId - The ID of the organization to switch to
      * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
@@ -1414,7 +1418,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
         getActions: ($fetch: better_auth_client.BetterFetch) => {
             customEndpoints: {
                 organizations: {
-                    apiKeys: () => Promise<ApiKeyWithoutSecret[]>;
+                    apiKeys: (organizationId?: string) => Promise<ApiKeyWithoutSecret[]>;
                 };
                 teams: {
                     members: (teamId: string) => Promise<TeamMembersResponse>;
@@ -4434,15 +4438,15 @@ type CreateAdminApplicationOptions = {
     homeUrl?: string | null;
     /** Custom application authentication settings. */
     config?: ApplicationConfig | null;
-    /** Organizations to enable for this application during creation. */
+    /** Organization or global entitlements to create for this application. */
     entitlements?: CreateAdminApplicationEntitlementOptions[];
 };
 /**
- * Options accepted when enabling an organization for an application.
+ * Options accepted when creating an organization or global entitlement for an application.
  */
 type CreateAdminApplicationEntitlementOptions = {
-    /** Organization that should be entitled to the application. */
-    organizationId: string;
+    /** Organization ID for type `organization`; passing null creates an entitlement with type `global`. */
+    organizationId: string | null;
 };
 /**
  * Options accepted when creating a client secret for an application.
@@ -4856,8 +4860,11 @@ type AdminApplicationOrganization = {
  */
 type AdminApplicationEntitlement = {
     id: string;
+    /** Access scope. Defaults to `organization` when omitted; the API returns the resolved type. Type `global` applies across organizations. */
+    entitlementType?: 'organization' | 'global';
     applicationId: string;
-    organizationId: string;
+    /** Required for type `organization` and constrained to null for type `global`. */
+    organizationId: string | null;
     enabled: boolean;
     createdAt: string;
     updatedAt: string;
@@ -4881,10 +4888,10 @@ type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'application
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
-type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals' | 'global';
 /**
  * A single access rule on an entitlement. Rules are evaluated in `position`
- * order, first match wins. A non-null `role` grants access with that role; a
+ * order with the global catch-all always last, first match wins. A non-null `role` grants access with that role; a
  * null `role` denies access.
  */
 type AdminEntitlementRule = {
@@ -6116,11 +6123,12 @@ declare class ApiKeyService {
         offset: number | undefined;
     }>;
     /**
-     * Lists all API keys belonging to the active organization.
+     * Lists all API keys belonging to an organization.
      *
+     * @param organizationId - Defaults to the active organization. Only global admins may select another organization.
      * @returns An array of API keys (without secret key values)
      */
-    listOrganizationApiKeys(): Promise<ApiKeyWithoutSecret[]>;
+    listOrganizationApiKeys(organizationId?: string): Promise<ApiKeyWithoutSecret[]>;
     /**
      * Updates an existing API key.
      *

package/dist/index.d.ts

@@ -884,7 +884,9 @@ declare class ApplicationService {
      * Lists candidate organizations for a specific application.
      *
      * Returns organizations where the authenticated user is a member and
-     * the application has been enabled with appropriate entitlement rules.
+     * the effective entitlement grants access through its rules. An enabled global
+     * entitlement is selected first; organization entitlements are considered only
+     * when no global entitlement is enabled.
      *
      * @param applicationId - The application ID to get candidate organizations for
      * @returns The list of candidate organizations
@@ -993,8 +995,10 @@ declare class ApplicationService {
      * Switches the active organization for the authenticated user.
      *
      * Issues new access and refresh tokens scoped to the specified organization.
-     * The target organization must be entitled to the application and the entitlement's
-     * access rules must allow the current user.
+     * Requires active membership in the target organization and an enabled entitlement
+     * whose rules allow the user. The global entitlement is selected first, and its
+     * denial never falls back to an organization entitlement. Organization entitlements
+     * are considered only when no global entitlement is enabled.
      *
      * @param organizationId - The ID of the organization to switch to
      * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
@@ -1414,7 +1418,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
         getActions: ($fetch: better_auth_client.BetterFetch) => {
             customEndpoints: {
                 organizations: {
-                    apiKeys: () => Promise<ApiKeyWithoutSecret[]>;
+                    apiKeys: (organizationId?: string) => Promise<ApiKeyWithoutSecret[]>;
                 };
                 teams: {
                     members: (teamId: string) => Promise<TeamMembersResponse>;
@@ -4434,15 +4438,15 @@ type CreateAdminApplicationOptions = {
     homeUrl?: string | null;
     /** Custom application authentication settings. */
     config?: ApplicationConfig | null;
-    /** Organizations to enable for this application during creation. */
+    /** Organization or global entitlements to create for this application. */
     entitlements?: CreateAdminApplicationEntitlementOptions[];
 };
 /**
- * Options accepted when enabling an organization for an application.
+ * Options accepted when creating an organization or global entitlement for an application.
  */
 type CreateAdminApplicationEntitlementOptions = {
-    /** Organization that should be entitled to the application. */
-    organizationId: string;
+    /** Organization ID for type `organization`; passing null creates an entitlement with type `global`. */
+    organizationId: string | null;
 };
 /**
  * Options accepted when creating a client secret for an application.
@@ -4856,8 +4860,11 @@ type AdminApplicationOrganization = {
  */
 type AdminApplicationEntitlement = {
     id: string;
+    /** Access scope. Defaults to `organization` when omitted; the API returns the resolved type. Type `global` applies across organizations. */
+    entitlementType?: 'organization' | 'global';
     applicationId: string;
-    organizationId: string;
+    /** Required for type `organization` and constrained to null for type `global`. */
+    organizationId: string | null;
     enabled: boolean;
     createdAt: string;
     updatedAt: string;
@@ -4881,10 +4888,10 @@ type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'application
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
-type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals' | 'global';
 /**
  * A single access rule on an entitlement. Rules are evaluated in `position`
- * order, first match wins. A non-null `role` grants access with that role; a
+ * order with the global catch-all always last, first match wins. A non-null `role` grants access with that role; a
  * null `role` denies access.
  */
 type AdminEntitlementRule = {
@@ -6116,11 +6123,12 @@ declare class ApiKeyService {
         offset: number | undefined;
     }>;
     /**
-     * Lists all API keys belonging to the active organization.
+     * Lists all API keys belonging to an organization.
      *
+     * @param organizationId - Defaults to the active organization. Only global admins may select another organization.
      * @returns An array of API keys (without secret key values)
      */
-    listOrganizationApiKeys(): Promise<ApiKeyWithoutSecret[]>;
+    listOrganizationApiKeys(organizationId?: string): Promise<ApiKeyWithoutSecret[]>;
     /**
      * Updates an existing API key.
      *

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "2.3.0";
+const version = "2.5.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -373,8 +373,8 @@ function customEndpointsPluginClient() {
     getActions: ($fetch) => ({
       customEndpoints: {
         organizations: {
-          apiKeys: async () => {
-            return await $fetch("/custom-endpoints/organizations/api-keys");
+          apiKeys: async (organizationId) => {
+            return await $fetch("/custom-endpoints/organizations/api-keys", organizationId === void 0 ? void 0 : { query: { organizationId } });
           }
         },
         teams: {
@@ -1471,7 +1471,9 @@ class ApplicationService {
    * Lists candidate organizations for a specific application.
    *
    * Returns organizations where the authenticated user is a member and
-   * the application has been enabled with appropriate entitlement rules.
+   * the effective entitlement grants access through its rules. An enabled global
+   * entitlement is selected first; organization entitlements are considered only
+   * when no global entitlement is enabled.
    *
    * @param applicationId - The application ID to get candidate organizations for
    * @returns The list of candidate organizations
@@ -1681,8 +1683,10 @@ class ApplicationService {
    * Switches the active organization for the authenticated user.
    *
    * Issues new access and refresh tokens scoped to the specified organization.
-   * The target organization must be entitled to the application and the entitlement's
-   * access rules must allow the current user.
+   * Requires active membership in the target organization and an enabled entitlement
+   * whose rules allow the user. The global entitlement is selected first, and its
+   * denial never falls back to an organization entitlement. Organization entitlements
+   * are considered only when no global entitlement is enabled.
    *
    * @param organizationId - The ID of the organization to switch to
    * @param accessToken - Access token for authentication, sent as the `x-tela-access-token` header
@@ -2219,12 +2223,13 @@ class ApiKeyService {
     return await this.client.apiKey.list();
   }
   /**
-   * Lists all API keys belonging to the active organization.
+   * Lists all API keys belonging to an organization.
    *
+   * @param organizationId - Defaults to the active organization. Only global admins may select another organization.
    * @returns An array of API keys (without secret key values)
    */
-  async listOrganizationApiKeys() {
-    return await this.client.customEndpoints.organizations.apiKeys();
+  async listOrganizationApiKeys(organizationId) {
+    return await this.client.customEndpoints.organizations.apiKeys(organizationId);
   }
   /**
    * Updates an existing API key.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "2.3.0",
+    "version": "2.5.0",
     "type": "module",
     "exports": {
         ".": {