@meistrari/auth-core 3.1.0 → 3.3.0

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "3.1.0";
+const version = "3.3.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -548,7 +548,7 @@ class AdminService {
   async requestApplicationRoute(path, request = {}) {
     const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
     const hasBody = request.body !== void 0;
-    const { data, error } = await this.client.$fetch(`${base}${path}`, {
+    const response = await this.client.$fetch(`${base}${path}`, {
       method: request.method ?? "GET",
       params: request.params,
       query: request.query,
@@ -561,10 +561,19 @@ class AdminService {
       jsonParser: (text) => JSON.parse(text),
       throw: false
     });
+    const { data, error } = response;
     if (error)
       throw new ApplicationRouteError(error);
     return data;
   }
+  /**
+   * Calls an admin endpoint and returns its JSON body. The client is configured
+   * to throw on error responses, but better-auth types `$fetch` as returning
+   * `{ data, error }`; this narrows the result to the body it actually resolves to.
+   */
+  async fetchAdminRoute(path, options) {
+    return await this.client.$fetch(path, options);
+  }
   /**
    * Lists applications, optionally filtered by organization.
    *
@@ -610,6 +619,35 @@ class AdminService {
       body: options
     });
   }
+  /**
+   * Disables an application. Sign-ins, token exchanges, refreshes and
+   * client-credentials exchanges through it fail with `application_disabled`,
+   * which carries the deprecation notice. Disabling an already disabled
+   * application replaces its notice.
+   *
+   * @param applicationId - ID of the application to disable
+   * @param options - Optional deprecation notice
+   * @returns The updated application
+   */
+  async disableApplication(applicationId, options = {}) {
+    return await this.requestApplicationRoute("applications/:applicationId/disable", {
+      params: { applicationId },
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Enables a disabled application and clears its deprecation notice.
+   *
+   * @param applicationId - ID of the application to enable
+   * @returns The updated application
+   */
+  async enableApplication(applicationId) {
+    return await this.requestApplicationRoute("applications/:applicationId/enable", {
+      params: { applicationId },
+      method: "POST"
+    });
+  }
   /** Lists the role catalog for an application. */
   async listApplicationRoles(applicationId) {
     return await this.requestApplicationRoute(
@@ -708,7 +746,7 @@ class AdminService {
    * @returns The paginated organization listing
    */
   async listOrganizations(options = {}) {
-    return await this.client.$fetch("/admin/organizations", {
+    return await this.fetchAdminRoute("/admin/organizations", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -731,7 +769,7 @@ class AdminService {
    * @returns The paginated user listing
    */
   async listUsers(options = {}) {
-    return await this.client.$fetch("/admin/users", {
+    return await this.fetchAdminRoute("/admin/users", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -773,7 +811,7 @@ class AdminService {
    * @returns The organization
    */
   async getOrganization(options) {
-    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}`, {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}`, {
       method: "GET",
       query: {
         ...options.sortBy ? { sortBy: options.sortBy } : {},
@@ -795,7 +833,7 @@ class AdminService {
    * @returns The organization summaries for the IDs that exist
    */
   async getOrganizationsSummary(options) {
-    const { organizations } = await this.client.$fetch("/admin/organizations/summary", {
+    const { organizations } = await this.fetchAdminRoute("/admin/organizations/summary", {
       method: "GET",
       query: {
         ids: options.ids
@@ -812,7 +850,7 @@ class AdminService {
    * @returns The user access report
    */
   async getUserAccess(userId) {
-    const { data } = await this.client.$fetch(`/admin/users/${encodeURIComponent(userId)}/access`, {
+    const { data } = await this.fetchAdminRoute(`/admin/users/${encodeURIComponent(userId)}/access`, {
       method: "GET"
     });
     return data;
@@ -826,7 +864,7 @@ class AdminService {
    * @returns The application listing with entitlement details
    */
   async listAdminApplications(options = {}) {
-    return await this.client.$fetch("/admin/applications", {
+    return await this.fetchAdminRoute("/admin/applications", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -848,7 +886,7 @@ class AdminService {
    * @returns The paginated application member listing
    */
   async listApplicationMembers(options) {
-    return await this.client.$fetch(`/admin/applications/${encodeURIComponent(options.applicationId)}/members`, {
+    return await this.fetchAdminRoute(`/admin/applications/${encodeURIComponent(options.applicationId)}/members`, {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -865,7 +903,7 @@ class AdminService {
    * @returns The paginated organization member listing
    */
   async listOrganizationMembers(options) {
-    return await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/members`, {
+    return await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/members`, {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -881,6 +919,67 @@ class AdminService {
       }
     });
   }
+  /**
+   * Lists the applications available to one organization with the entitlement
+   * that decides their access and its rules. Global admins may list any
+   * organization; an organization admin only their own.
+   *
+   * @param options - Organization ID and search options
+   * @returns The organization's applications
+   */
+  async listOrganizationApplications(options) {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications`, {
+      method: "GET",
+      query: {
+        ...options.search ? { search: options.search } : {}
+      }
+    });
+    return data;
+  }
+  /**
+   * Fetches one application of an organization with its rules and the roles
+   * those rules can grant.
+   *
+   * @param options - Organization and application IDs
+   * @returns The application access
+   */
+  async getOrganizationApplication(options) {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications/${encodeURIComponent(options.applicationId)}`, {
+      method: "GET"
+    });
+    return data;
+  }
+  /**
+   * Replaces the rules of an organization's own entitlement to an application,
+   * in the order given, as a global admin. Global access is edited on the application.
+   *
+   * @param options - Organization and application IDs, and the rules in evaluation order
+   * @returns The updated application access
+   */
+  async setOrganizationApplicationRules(options) {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications/${encodeURIComponent(options.applicationId)}/rules`, {
+      method: "POST",
+      body: { rules: options.rules }
+    });
+    return data;
+  }
+  /**
+   * Lists every active member of an organization with the rule that decides
+   * their access to an application and the role it grants.
+   *
+   * @param options - Organization and application IDs, pagination, and search options
+   * @returns The paginated member listing
+   */
+  async listOrganizationApplicationMembers(options) {
+    return await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications/${encodeURIComponent(options.applicationId)}/members`, {
+      method: "GET",
+      query: {
+        ...options.limit !== void 0 ? { limit: options.limit } : {},
+        ...options.offset !== void 0 ? { offset: options.offset } : {},
+        ...options.query ? { query: options.query } : {}
+      }
+    });
+  }
   /**
    * Lists teams for one organization. Global admins may list any organization;
    * an organization admin only their own.
@@ -889,7 +988,7 @@ class AdminService {
    * @returns The paginated organization team listing
    */
   async listOrganizationTeams(options) {
-    return await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
+    return await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -907,7 +1006,7 @@ class AdminService {
    * @returns The created team
    */
   async createOrganizationTeam(options) {
-    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
       method: "POST",
       body: {
         name: options.name,
@@ -924,7 +1023,7 @@ class AdminService {
    * @returns The updated team
    */
   async updateOrganizationTeam(options) {
-    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams/update`, {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams/update`, {
       method: "POST",
       body: {
         teamId: options.teamId,
@@ -1003,7 +1102,7 @@ class AdminService {
    * @returns The created organization
    */
   async createOrganization(options) {
-    const { data } = await this.client.$fetch("/admin/organizations", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations", {
       method: "POST",
       body: options
     });
@@ -1019,7 +1118,7 @@ class AdminService {
    * @returns The updated organization
    */
   async updateOrganization(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/update", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/update", {
       method: "POST",
       body: options
     });
@@ -1032,7 +1131,7 @@ class AdminService {
    * @returns The updated membership
    */
   async updateMemberRole(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/members/update-role", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/members/update-role", {
       method: "POST",
       body: options
     });
@@ -1045,7 +1144,7 @@ class AdminService {
    * @returns The removed membership
    */
   async removeMember(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/members/remove", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/members/remove", {
       method: "POST",
       body: options
     });
@@ -1144,7 +1243,7 @@ class AdminService {
    * @returns Per-email invite outcomes
    */
   async inviteOrganizationUsers(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/users", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/users", {
       method: "POST",
       body: { ...options, sendInvite: options.sendInvite ?? true }
     });
@@ -1202,6 +1301,41 @@ class ApplicationSessionAssuranceError extends ApplicationError {
     this.validStepUps = payload?.validStepUps ?? [];
   }
 }
+function parseApplicationDisabledPayload(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current)) {
+    seen.add(current);
+    const candidate = current;
+    for (const details of [candidate.details, candidate.error?.details]) {
+      if (!details || typeof details !== "object") {
+        continue;
+      }
+      const payload = details;
+      if (payload.code === "application_disabled" && typeof payload.applicationId === "string") {
+        return {
+          applicationId: payload.applicationId,
+          applicationName: typeof payload.applicationName === "string" ? payload.applicationName : "",
+          deprecationNotice: typeof payload.deprecationNotice === "string" ? payload.deprecationNotice : null
+        };
+      }
+    }
+    current = candidate.cause;
+  }
+  return null;
+}
+class ApplicationDisabledError extends ApplicationError {
+  applicationId;
+  applicationName;
+  deprecationNotice;
+  constructor(payload = null, options) {
+    super(payload?.deprecationNotice || `${payload?.applicationName || "The application"} has been disabled`, options);
+    this.code = "APPLICATION_DISABLED";
+    this.applicationId = payload?.applicationId ?? null;
+    this.applicationName = payload?.applicationName || null;
+    this.deprecationNotice = payload?.deprecationNotice ?? null;
+  }
+}
 class UserNotLoggedInError extends ApplicationError {
   constructor(message, options) {
     super(message, options);
@@ -1433,8 +1567,17 @@ function parseErrorMessage(error) {
   const nested = typeof candidateError.error === "string" ? candidateError.error : candidateError.error?.message;
   return candidateError.message ?? nested ?? "Failed to exchange device code for tokens";
 }
+function throwIfApplicationDisabled(error) {
+  const payload = parseApplicationDisabledPayload(error);
+  if (payload) {
+    throw new ApplicationDisabledError(payload, { cause: error });
+  }
+}
 function throwDeviceGrantError(error) {
   const code = parseErrorCode(error);
+  if (code === "application_disabled") {
+    throw new ApplicationDisabledError(parseApplicationDisabledPayload(error), { cause: error });
+  }
   if (code === "authorization_pending") {
     throw new DeviceAuthorizationPendingError({ cause: error });
   }
@@ -1512,6 +1655,7 @@ class ApplicationService {
     try {
       const response = await this.client.applications.startAuthorizationFlow(applicationId, redirectUri, codeChallenge, organizationId);
       if (!response.data) {
+        throwIfApplicationDisabled(response.error);
         const payload = parseSessionAssuranceRequiredPayload(response.error);
         if (payload) {
           throw new SessionAssuranceRequiredError(payload, { cause: response.error });
@@ -1520,9 +1664,10 @@ class ApplicationService {
       }
       return response.data;
     } catch (error) {
-      if (error instanceof SessionAssuranceRequiredError) {
+      if (error instanceof SessionAssuranceRequiredError || error instanceof ApplicationDisabledError) {
         throw error;
       }
+      throwIfApplicationDisabled(error);
       const payload = parseSessionAssuranceRequiredPayload(error);
       if (payload) {
         throw new SessionAssuranceRequiredError(payload, { cause: error });
@@ -1605,6 +1750,7 @@ class ApplicationService {
    * @throws {DeviceCodeExpiredError} The device code has expired
    * @throws {DeviceTransientServerError} Transient server error — safe to retry
    * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+   * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
    */
   async exchangeDeviceCodeForTokens(deviceCode) {
     try {
@@ -1629,8 +1775,12 @@ class ApplicationService {
    * @returns A short-lived access token with service-account and organization details
    */
   async exchangeClientCredentialsForToken(credentials) {
-    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials);
+    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials).catch((error) => {
+      throwIfApplicationDisabled(error);
+      throw error;
+    });
     if (!response.data) {
+      throwIfApplicationDisabled(response.error);
       throw new Error("No data returned from the API", { cause: response.error });
     }
     return response.data;
@@ -1642,8 +1792,12 @@ class ApplicationService {
    * @param codeVerifier - The code verifier to use for the authorization flow
    */
   async completeAuthorizationFlow(code, codeVerifier) {
-    const response = await this.client.applications.completeAuthorizationFlow(code, codeVerifier);
+    const response = await this.client.applications.completeAuthorizationFlow(code, codeVerifier).catch((error) => {
+      throwIfApplicationDisabled(error);
+      throw error;
+    });
     if (!response.data) {
+      throwIfApplicationDisabled(response.error);
       throw new Error("No data returned from the API", { cause: response.error });
     }
     return response.data;
@@ -1653,11 +1807,15 @@ class ApplicationService {
    *
    * @param refreshToken - The refresh token to use for the authentication token refresh
    * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+   * @throws {ApplicationDisabledError} When the application has been disabled
    * @throws {ApplicationError} For other API errors
    */
   async refreshAccessToken(refreshToken) {
     const handleRefreshError = (error) => {
       const status = error?.status;
+      if (parseErrorCode(error) === "application_disabled") {
+        throw new ApplicationDisabledError(parseApplicationDisabledPayload(error), { cause: error, status });
+      }
       if (status === 401 || status === 404) {
         throw new RefreshTokenExpiredError({ cause: error, status });
       }
@@ -1866,6 +2024,7 @@ class OrganizationService {
       applicationName: responseWithContext.applicationName ?? null,
       homeUrl: responseWithContext.homeUrl ?? null,
       inviteAcceptedUrl: responseWithContext.inviteAcceptedUrl ?? null,
+      // better-auth types the role as a plain string; the organization plugin only stores configured roles.
       member: response.member
     };
   }
@@ -2643,4 +2802,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "3.1.0",
+    "version": "3.3.0",
     "type": "module",
     "exports": {
         ".": {