@nexys/user-management-client 0.1.0 → 0.2.0

package/src/types.ts

@@ -0,0 +1,285 @@
+/**
+ * Wire types matching the `user-management-rs` axum server.
+ * Field names are camelCase because the Rust wire.rs renames them
+ * with serde — keep this file byte-for-byte aligned with the server.
+ */
+
+export type UserRole = "superadmin" | "useradmin" | "user" | (string & {});
+export type TenantRole = "owner" | "admin" | "member" | (string & {});
+export type UserStatus = "active" | "inactive" | "pending" | (string & {});
+export type UserType = "human" | "service" | (string & {});
+export type AuthSource = "cookie" | "jwt" | (string & {});
+
+export interface SessionUser {
+  id: string;
+  email: string;
+  name: string;
+  image: string | null;
+  emailVerified: boolean;
+  role: UserRole;
+  banned: boolean;
+  banReason: string | null;
+  banExpires: string | null;
+  twoFactorEnabled: boolean;
+  status: UserStatus;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface SessionRow {
+  id: string;
+  userId: string;
+  token: string;
+  expiresAt: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  impersonatedBy: string | null;
+  activeOrganizationId: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface AuthSuccess {
+  user: SessionUser;
+  session?: SessionRow;
+}
+
+/**
+ * Password sign-in for a 2FA-enrolled user returns this instead of
+ * {@link AuthSuccess}; complete the flow with `verifyTotp` or
+ * `verifyBackupCode`, echoing the token back.
+ */
+export interface TwoFactorChallenge {
+  twoFactorRequired: true;
+  twoFactorToken: string;
+}
+
+export type SignInResult = AuthSuccess | TwoFactorChallenge;
+
+export const isTwoFactorChallenge = (
+  r: SignInResult
+): r is TwoFactorChallenge =>
+  (r as TwoFactorChallenge).twoFactorRequired === true;
+
+export interface TwoFactorEnableResponse {
+  /** Base32 TOTP secret, for manual authenticator entry. */
+  secret: string;
+  /** `otpauth://totp/...` URI — render as a QR code. */
+  uri: string;
+  /** 10 single-use backup codes, shown exactly once. */
+  backupCodes: string[];
+}
+
+export interface ApiTokenRow {
+  id: string;
+  name: string | null;
+  /** Display prefix of the plaintext ("um_a1b2c"). */
+  start: string | null;
+  status: "active" | "revoked" | "expired" | (string & {});
+  createdAt: string;
+  expiresAt: string | null;
+  revokedAt: string | null;
+  lastUsedAt: string | null;
+}
+
+export interface ApiTokenCreated {
+  id: string;
+  /** The full plaintext token — shown exactly once, never stored. */
+  token: string;
+  name: string;
+  start: string;
+  expiresAt: string | null;
+}
+
+export interface PasskeyItem {
+  id: string;
+  name: string | null;
+  createdAt: string | null;
+  deviceType: string;
+  backedUp: boolean;
+  transports: string | null;
+}
+
+/**
+ * WebAuthn ceremony start: `options` is the standard
+ * `PublicKeyCredential{Creation,Request}Options` JSON (base64url
+ * fields) for the browser; `challenge` is the opaque server handle to
+ * echo back on finish.
+ */
+export interface WebAuthnCeremonyStart {
+  challenge: string;
+  options: Record<string, unknown>;
+}
+
+export interface MeResponse {
+  user: { id: string; email: string; name: string | null; role: UserRole };
+  session: { activeOrganizationId: string | null; tenantRoles: TenantRole[] };
+  authSource: AuthSource;
+}
+
+export interface TokenMintResponse {
+  accessToken: string;
+  accessTokenExpiresAt: string;
+  refreshToken: string;
+  refreshTokenExpiresAt: string;
+  kid: string;
+  token: string;
+  expiresAt: string;
+}
+
+export interface TokenRefreshResponse {
+  accessToken: string;
+  accessTokenExpiresAt: string;
+  refreshToken: string;
+  refreshTokenExpiresAt: string;
+  kid: string;
+}
+
+export interface RefreshToken {
+  id: string;
+  userId: string;
+  expiresAt: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: string;
+  revokedAt: string | null;
+  current?: boolean;
+}
+
+export interface AdminUserRow {
+  id: string;
+  /** Display name — kept in sync with first/last when those are set. */
+  name: string;
+  firstName: string | null;
+  lastName: string | null;
+  email: string;
+  role: UserRole;
+  status: UserStatus;
+  type: UserType;
+  /** Linked auth providers — "credential" plus any social ids. */
+  providers: string[];
+  deletedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface AuthAccount {
+  id: string;
+  providerId: string;
+  createdAt: string;
+}
+
+export interface AuthPasskey {
+  id: string;
+  name: string | null;
+  deviceType: string;
+  createdAt: string | null;
+}
+
+export interface AuthMethodsResponse {
+  accounts: AuthAccount[];
+  passkeys: AuthPasskey[];
+  twoFactorEnabled: boolean;
+}
+
+export interface UserMembership {
+  memberId: string;
+  organizationId: string;
+  organizationName: string;
+  organizationSlug: string;
+  role: TenantRole;
+  createdAt: string;
+}
+
+export interface AdminUserListResponse {
+  total: number;
+  rows: AdminUserRow[];
+}
+
+export interface TenantRow {
+  id: string;
+  name: string;
+  slug: string;
+  /** Project the tenant lives in; null for legacy tenants. */
+  projectId?: string | null;
+  createdAt: string;
+  memberCount: number;
+}
+
+export type TenancyMode = "multi" | "single";
+
+export interface ProjectRow {
+  id: string;
+  name: string;
+  slug: string;
+  ownerUserId: string;
+  tenancyMode: TenancyMode;
+  allowTenantCreation: boolean;
+  allowSignup: boolean;
+  metadata: Record<string, unknown> | null;
+  tenantCount?: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface Member {
+  id: string;
+  organizationId: string;
+  userId: string;
+  role: TenantRole;
+  /** Custom tenant roles assigned to this member. */
+  roles?: MemberRoleRef[];
+  createdAt: string;
+  user: { name: string; email: string; image: string | null };
+}
+
+export interface MemberRoleRef {
+  id: string;
+  name: string;
+}
+
+export interface FullOrganization {
+  id: string;
+  name: string;
+  slug: string;
+  logo?: string | null;
+  /** Per-tenant settings blob; null when unset. */
+  metadata?: Record<string, unknown> | null;
+  members: Member[];
+  invitations: Invitation[];
+}
+
+export interface Invitation {
+  id: string;
+  email: string;
+  role: TenantRole;
+  status: "pending" | "accepted" | "rejected" | "expired" | (string & {});
+  organizationId: string;
+  expiresAt?: string;
+  createdAt?: string;
+}
+
+export interface RoleRow {
+  id: string;
+  name: string;
+  description: string | null;
+  /** Permission strings granted by this role (e.g. `invoices:read`). */
+  permissions: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface MyTenantPermissions {
+  /** Built-in membership role; null for a non-member superadmin. */
+  role: TenantRole | null;
+  /** Names of assigned custom roles. */
+  roles: string[];
+  /** Union of permissions granted by those roles, sorted. */
+  permissions: string[];
+}
+
+export interface ApiErrorBody {
+  code?: string;
+  error?: string;
+  message?: string;
+}