@nexys/user-management-client 0.1.0 → 0.2.0

package/src/endpoints/tenants.ts

@@ -0,0 +1,313 @@
+import type { Endpoint } from "../endpoint.js";
+import type { ApiError } from "../result.js";
+import { parseApiError } from "../result.js";
+import type {
+  FullOrganization,
+  Invitation,
+  Member,
+  MyTenantPermissions,
+  RoleRow,
+  TenantRole,
+  TenantRow,
+} from "../types.js";
+
+export const adminListTenants: Endpoint<void, { tenants: TenantRow[] }, ApiError> = {
+  method: "GET",
+  path: () => "/api/admin/tenants",
+  parseOutput: (data) => data as { tenants: TenantRow[] },
+  parseError: parseApiError,
+};
+
+export const createTenant: Endpoint<
+  {
+    name: string;
+    slug?: string;
+    /**
+     * Attach the tenant to a project, gated by the project's settings
+     * (`allowTenantCreation`, `tenancyMode`).
+     */
+    projectId?: string;
+  },
+  TenantRow,
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/create",
+  body: (input) => input,
+  parseOutput: (data) => data as TenantRow,
+  parseError: parseApiError,
+};
+
+/**
+ * Update tenant name/slug/logo and the per-tenant `metadata` settings
+ * blob. Omitted fields keep their current value; `metadata: null`
+ * clears the blob. Requires org owner/admin (or a superadmin).
+ */
+export const updateTenant: Endpoint<
+  {
+    organizationId: string;
+    data: {
+      name?: string;
+      slug?: string;
+      logo?: string | null;
+      metadata?: Record<string, unknown> | null;
+    };
+  },
+  {
+    id: string;
+    name: string;
+    slug: string;
+    logo: string | null;
+    metadata: Record<string, unknown> | null;
+  },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/update",
+  body: (input) => input,
+  parseOutput: (data) =>
+    data as {
+      id: string;
+      name: string;
+      slug: string;
+      logo: string | null;
+      metadata: Record<string, unknown> | null;
+    },
+  parseError: parseApiError,
+};
+
+/**
+ * Owner self-service tenant delete. Cascades members, invitations, and
+ * roles. Requires the caller to be the org owner (or a superadmin). For
+ * the superadmin system-wide path see {@link adminDeleteTenant}.
+ */
+export const deleteTenant: Endpoint<
+  { organizationId: string },
+  { ok: true; id: string },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/delete",
+  body: (input) => input,
+  parseOutput: (data) => data as { ok: true; id: string },
+  parseError: parseApiError,
+};
+
+export const setActiveTenant: Endpoint<
+  { organizationId: string | null },
+  { session: { activeOrganizationId: string | null } },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/set-active",
+  body: (input) => input,
+  parseOutput: (data) =>
+    data as { session: { activeOrganizationId: string | null } },
+  parseError: parseApiError,
+};
+
+export const getFullTenant: Endpoint<
+  { organizationId?: string },
+  FullOrganization,
+  ApiError
+> = {
+  method: "GET",
+  path: () => "/api/auth/organization/get-full-organization",
+  query: (input) => ({ organizationId: input.organizationId }),
+  parseOutput: (data) => data as FullOrganization,
+  parseError: parseApiError,
+};
+
+export const inviteMember: Endpoint<
+  { email: string; role: TenantRole; organizationId: string },
+  Invitation,
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/invite-member",
+  body: (input) => input,
+  parseOutput: (data) => data as Invitation,
+  parseError: parseApiError,
+};
+
+export const acceptInvitation: Endpoint<
+  { invitationId: string },
+  { memberId: string; organizationId: string; role: TenantRole },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/accept-invitation",
+  body: (input) => input,
+  parseOutput: (data) =>
+    data as { memberId: string; organizationId: string; role: TenantRole },
+  parseError: parseApiError,
+};
+
+export const updateMemberRole: Endpoint<
+  { memberId: string; role: TenantRole; organizationId: string },
+  { ok: true },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/update-member-role",
+  body: (input) => input,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+/**
+ * Direct member assignment — no invitation round-trip. The target
+ * user must already exist (lookup by userId or email); requires
+ * tenant owner/admin or a superadmin.
+ */
+export const addMember: Endpoint<
+  {
+    organizationId: string;
+    role: TenantRole;
+    userId?: string;
+    email?: string;
+  },
+  Member,
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/add-member",
+  body: (input) => input,
+  parseOutput: (data) => data as Member,
+  parseError: parseApiError,
+};
+
+export const removeMember: Endpoint<
+  { memberId: string; organizationId: string },
+  { ok: true },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/organization/remove-member",
+  body: (input) => input,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+export const adminDeleteTenant: Endpoint<
+  { id: string },
+  { ok: true },
+  ApiError
+> = {
+  method: "DELETE",
+  path: (input) => `/api/admin/tenants/${input.id}`,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+export const listTenantRoles: Endpoint<
+  { orgId: string },
+  { roles: RoleRow[] },
+  ApiError
+> = {
+  method: "GET",
+  path: (input) => `/api/tenants/${input.orgId}/roles`,
+  parseOutput: (data) => data as { roles: RoleRow[] },
+  parseError: parseApiError,
+};
+
+export const createTenantRole: Endpoint<
+  { orgId: string; name: string; description?: string; permissions?: string[] },
+  RoleRow,
+  ApiError
+> = {
+  method: "POST",
+  path: (input) => `/api/tenants/${input.orgId}/roles`,
+  body: (input) => ({
+    name: input.name,
+    description: input.description,
+    permissions: input.permissions,
+  }),
+  parseOutput: (data) => data as RoleRow,
+  parseError: parseApiError,
+};
+
+/**
+ * Update a role's name/description and, when `permissions` is present,
+ * replace its permission set wholesale.
+ */
+export const updateTenantRole: Endpoint<
+  {
+    orgId: string;
+    roleId: string;
+    name?: string;
+    description?: string;
+    permissions?: string[];
+  },
+  RoleRow,
+  ApiError
+> = {
+  method: "PATCH",
+  path: (input) => `/api/tenants/${input.orgId}/roles/${input.roleId}`,
+  body: (input) => ({
+    name: input.name,
+    description: input.description,
+    permissions: input.permissions,
+  }),
+  parseOutput: (data) => data as RoleRow,
+  parseError: parseApiError,
+};
+
+export const deleteTenantRole: Endpoint<
+  { orgId: string; roleId: string },
+  { ok: true },
+  ApiError
+> = {
+  method: "DELETE",
+  path: (input) => `/api/tenants/${input.orgId}/roles/${input.roleId}`,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+/** Custom roles assigned to one member (with their permissions). */
+export const listMemberRoles: Endpoint<
+  { orgId: string; memberId: string },
+  { roles: RoleRow[] },
+  ApiError
+> = {
+  method: "GET",
+  path: (input) => `/api/tenants/${input.orgId}/members/${input.memberId}/roles`,
+  parseOutput: (data) => data as { roles: RoleRow[] },
+  parseError: parseApiError,
+};
+
+export const assignMemberRole: Endpoint<
+  { orgId: string; memberId: string; roleId: string },
+  { ok: true; roleId: string; memberId: string },
+  ApiError
+> = {
+  method: "POST",
+  path: (input) => `/api/tenants/${input.orgId}/members/${input.memberId}/roles`,
+  body: (input) => ({ roleId: input.roleId }),
+  parseOutput: (data) => data as { ok: true; roleId: string; memberId: string },
+  parseError: parseApiError,
+};
+
+export const removeMemberRole: Endpoint<
+  { orgId: string; memberId: string; roleId: string },
+  { ok: true },
+  ApiError
+> = {
+  method: "DELETE",
+  path: (input) =>
+    `/api/tenants/${input.orgId}/members/${input.memberId}/roles/${input.roleId}`,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+/** The caller's own effective role/permissions inside a tenant. */
+export const myTenantPermissions: Endpoint<
+  { orgId: string },
+  MyTenantPermissions,
+  ApiError
+> = {
+  method: "GET",
+  path: (input) => `/api/tenants/${input.orgId}/permissions/me`,
+  parseOutput: (data) => data as MyTenantPermissions,
+  parseError: parseApiError,
+};

package/src/endpoints/two-factor.ts

@@ -0,0 +1,84 @@
+import type { Endpoint } from "../endpoint.js";
+import type { ApiError } from "../result.js";
+import { parseApiError } from "../result.js";
+import type { AuthSuccess, TwoFactorEnableResponse } from "../types.js";
+
+/**
+ * Start TOTP enrolment (cookie-auth). Returns the secret, the
+ * `otpauth://` URI to render as a QR, and 10 single-use backup codes
+ * that are shown exactly once. Enrolment isn't active until
+ * {@link twoFactorConfirm} verifies the first code.
+ */
+export const twoFactorEnable: Endpoint<void, TwoFactorEnableResponse, ApiError> = {
+  method: "POST",
+  path: () => "/api/auth/two-factor/enable",
+  parseOutput: (data) => data as TwoFactorEnableResponse,
+  parseError: parseApiError,
+};
+
+export const twoFactorConfirm: Endpoint<{ code: string }, { ok: true }, ApiError> = {
+  method: "POST",
+  path: () => "/api/auth/two-factor/confirm",
+  body: (input) => input,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+/** Requires a current TOTP code; wipes the secret + backup codes. */
+export const twoFactorDisable: Endpoint<{ code: string }, { ok: true }, ApiError> = {
+  method: "POST",
+  path: () => "/api/auth/two-factor/disable",
+  body: (input) => input,
+  parseOutput: () => ({ ok: true }),
+  parseError: parseApiError,
+};
+
+/**
+ * Complete a password sign-in that returned a
+ * {@link TwoFactorChallenge}: `token` is the challenge token, `code`
+ * the current TOTP code. Sets the session cookie on success.
+ */
+export const verifyTotp: Endpoint<
+  { token: string; code: string },
+  AuthSuccess,
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/two-factor/verify-totp",
+  body: (input) => input,
+  parseOutput: (data) => data as AuthSuccess,
+  parseError: parseApiError,
+};
+
+/**
+ * Step-up re-verification for an already authenticated caller (cookie
+ * or bearer). Answers whether `code` is a current TOTP code for the
+ * caller without touching sessions or tokens — resource servers use it
+ * to gate sensitive actions (payments, key exports) on a fresh second
+ * factor. `enabled: false` means the caller has no verified TOTP
+ * enrolment (and `valid` is then always false).
+ */
+export const twoFactorStepUp: Endpoint<
+  { code: string },
+  { enabled: boolean; valid: boolean },
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/me/two-factor/step-up",
+  body: (input) => input,
+  parseOutput: (data) => data as { enabled: boolean; valid: boolean },
+  parseError: parseApiError,
+};
+
+/** Like {@link verifyTotp} but consumes a single-use backup code. */
+export const verifyBackupCode: Endpoint<
+  { token: string; code: string },
+  AuthSuccess,
+  ApiError
+> = {
+  method: "POST",
+  path: () => "/api/auth/two-factor/verify-backup-code",
+  body: (input) => input,
+  parseOutput: (data) => data as AuthSuccess,
+  parseError: parseApiError,
+};

package/src/index.ts

@@ -0,0 +1,26 @@
+// Core types & runtime
+export {
+  createClient,
+  type ClientConfig,
+  type Endpoint,
+  type EndpointError,
+  type EndpointInput,
+  type EndpointOutput,
+  type Method,
+  type UmClient,
+} from "./endpoint.js";
+export {
+  err,
+  ok,
+  parseApiError,
+  type ApiError,
+  type NetworkError,
+  type Result,
+} from "./result.js";
+
+// Endpoints — all named exports, grouped by domain
+export * from "./endpoints/index.js";
+
+// Wire types
+export type * from "./types.js";
+export { isTwoFactorChallenge } from "./types.js";

package/src/result.ts

@@ -0,0 +1,39 @@
+/**
+ * Result + error types. Endpoints never throw — `call` collapses
+ * thrown exceptions into `{ kind: "network" }` and HTTP errors into
+ * whatever shape `endpoint.parseError` produces.
+ */
+
+export type Result<T, E> = { ok: true; data: T } | { ok: false; error: E };
+
+export type NetworkError = { kind: "network"; message: string };
+
+/**
+ * Default HTTP error envelope mirroring the rust server's
+ * `{ code, message }` shape. Individual endpoints can narrow this
+ * with a discriminated union when they want callers to switch on
+ * specific codes (e.g. sign-in's INVALID_EMAIL_OR_PASSWORD).
+ */
+export type ApiError = {
+  kind: "http";
+  status: number;
+  code: string | undefined;
+  message: string;
+};
+
+/**
+ * Lift a JSON error body into `ApiError`. Tolerates non-JSON
+ * (data === null) and missing fields.
+ */
+export const parseApiError = (status: number, data: unknown): ApiError => {
+  const body = (data ?? {}) as { code?: string; error?: string; message?: string };
+  return {
+    kind: "http",
+    status,
+    code: body.code ?? body.error,
+    message: body.message ?? body.error ?? `Request failed (${status})`,
+  };
+};
+
+export const ok = <T>(data: T): Result<T, never> => ({ ok: true, data });
+export const err = <E>(error: E): Result<never, E> => ({ ok: false, error });