@oxyhq/core 3.18.1 → 4.0.1

package/src/mixins/index.ts

@@ -18,8 +18,8 @@ import { OxyServicesLanguageMixin } from './OxyServices.language';
 import { OxyServicesPaymentMixin } from './OxyServices.payment';
 import { OxyServicesReputationMixin } from './OxyServices.reputation';
 import { OxyServicesAssetsMixin } from './OxyServices.assets';
-import { OxyServicesApplicationsMixin } from './OxyServices.applications';
-import { OxyServicesWorkspacesMixin } from './OxyServices.workspaces';
+import { OxyServicesAccountsMixin } from './OxyServices.accounts';
+import { OxyServicesConnectedAppsMixin } from './OxyServices.connectedApps';
 import { OxyServicesLocationMixin } from './OxyServices.location';
 import { OxyServicesAnalyticsMixin } from './OxyServices.analytics';
 import { OxyServicesDevicesMixin } from './OxyServices.devices';
@@ -27,7 +27,6 @@ import { OxyServicesSecurityMixin } from './OxyServices.security';
 import { OxyServicesUtilityMixin } from './OxyServices.utility';
 import { OxyServicesFeaturesMixin } from './OxyServices.features';
 import { OxyServicesTopicsMixin } from './OxyServices.topics';
-import { OxyServicesManagedAccountsMixin } from './OxyServices.managedAccounts';
 import { OxyServicesContactsMixin } from './OxyServices.contacts';
 import { OxyServicesAppDataMixin } from './OxyServices.appData';
 import { OxyServicesCivicMixin } from './OxyServices.civic';
@@ -56,15 +55,14 @@ type AllMixinInstances =
   & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>>
-  & InstanceType<ReturnType<typeof OxyServicesApplicationsMixin<typeof OxyServicesBase>>>
-  & InstanceType<ReturnType<typeof OxyServicesWorkspacesMixin<typeof OxyServicesBase>>>
+  & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>>
+  & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>>
-  & InstanceType<ReturnType<typeof OxyServicesManagedAccountsMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>>
@@ -125,15 +123,19 @@ const MIXIN_PIPELINE: MixinFunction[] = [
     OxyServicesPaymentMixin,
     OxyServicesReputationMixin,
     OxyServicesAssetsMixin,
-    OxyServicesApplicationsMixin,
-    OxyServicesWorkspacesMixin,
+    // Unified account graph + the applications owned within it. The clean-cut
+    // replacement for the former managedAccounts + workspaces + applications
+    // (account-management) mixins.
+    OxyServicesAccountsMixin,
+    // OAuth-consent surface (public app identity + connected-app grants). Kept
+    // separate from account ownership.
+    OxyServicesConnectedAppsMixin,
     OxyServicesLocationMixin,
     OxyServicesAnalyticsMixin,
     OxyServicesDevicesMixin,
     OxyServicesSecurityMixin,
     OxyServicesFeaturesMixin,
     OxyServicesTopicsMixin,
-    OxyServicesManagedAccountsMixin,
     OxyServicesContactsMixin,
     OxyServicesAppDataMixin,
     // Civic / Commons "Oxy ID" (public signed cards, Oxy ID QR payload)

package/dist/cjs/mixins/OxyServices.applications.js

@@ -1,350 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OxyServicesApplicationsMixin = OxyServicesApplicationsMixin;
-const mixinHelpers_1 = require("./mixinHelpers");
-function OxyServicesApplicationsMixin(Base) {
-    return class extends Base {
-        constructor(...args) {
-            super(...args);
-        }
-        /**
-         * Resolve an OAuth client identifier to the owning application's PUBLIC
-         * identity. No authentication required — the API returns only sanitized,
-         * display-safe metadata ({@link PublicApplication}). Use this to render the
-         * requesting application's name/icon in consent, authorize, and device-flow
-         * approval UIs before any session exists.
-         *
-         * @param clientId - The OAuth `client_id` (an active credential's public
-         *   key). URL-encoded before being placed in the path.
-         */
-        async getPublicApplication(clientId) {
-            try {
-                const res = await this.makeRequest('GET', `/auth/oauth/client/${encodeURIComponent(clientId)}`, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM });
-                return res.application;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * List the OAuth-authorized applications the current user has connected —
-         * the third-party apps the user granted access to via the consent flow.
-         * Each entry is a {@link ConnectedApp} carrying the application's display
-         * identity, the granted scopes, and when the grant was first made and last
-         * exercised. Requires an authenticated session.
-         *
-         * Backed by `GET /auth/grants`. The response is briefly cached
-         * (identity-scoped); {@link revokeAppGrant} busts that cache so a revoke is
-         * reflected on the next read.
-         */
-        async listConnectedApps() {
-            try {
-                return await this.makeRequest('GET', '/auth/grants', undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.SHORT });
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Revoke the current user's grant for a connected application, identified by
-         * its application `_id` (a {@link ConnectedApp.applicationId}, NOT a
-         * credential/client id — keyed by application so the revocation survives
-         * credential rotation). After this the application can no longer act on the
-         * user's behalf until it is re-authorized.
-         *
-         * Backed by `DELETE /auth/grants/:applicationId`. On success the cached
-         * connected-apps list (`GET:/auth/grants`) is invalidated so the next
-         * {@link listConnectedApps} read reflects the removal.
-         *
-         * @param applicationId - The connected application's Mongo `_id`.
-         */
-        async revokeAppGrant(applicationId) {
-            try {
-                await this.makeRequest('DELETE', `/auth/grants/${applicationId}`, undefined, { cache: false });
-                // A revoke removes an entry from the user's connected-apps list; bust
-                // the cached `GET /auth/grants` so the next read re-fetches.
-                this.clearCacheEntry('GET:/auth/grants');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * List applications the current user is an active member of.
-         *
-         * @param workspaceId - Optional workspace `_id` to scope the listing to
-         *   applications belonging to that workspace. When provided it is appended
-         *   as a `workspaceId` query parameter (URL-encoded). The query string is
-         *   part of the request path, so the response cache keys on it
-         *   automatically — scoped and unscoped lists never collide.
-         */
-        async getApplications(workspaceId) {
-            try {
-                const path = workspaceId
-                    ? `/applications?workspaceId=${encodeURIComponent(workspaceId)}`
-                    : '/applications';
-                const res = await this.makeRequest('GET', path, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM });
-                return res.applications ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Create a new application. The caller becomes its `owner`.
-         * @param data - Application configuration. Staff-only fields are ignored.
-         */
-        async createApplication(data) {
-            try {
-                const res = await this.makeRequest('POST', '/applications', data, { cache: false });
-                // Bust every cached application list (unscoped + per-workspace) so the
-                // new application appears on the next `getApplications()` read.
-                this._invalidateApplicationLists();
-                return res.application;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Fetch a single application by id.
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        async getApplication(applicationId) {
-            try {
-                const res = await this.makeRequest('GET', `/applications/${applicationId}`, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.LONG });
-                return res.application;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Update an application's mutable fields.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Subset of updatable fields. Staff-only fields are ignored.
-         */
-        async updateApplication(applicationId, data) {
-            try {
-                const res = await this.makeRequest('PATCH', `/applications/${applicationId}`, data, { cache: false });
-                // Bust the cached detail and every list (which embeds application
-                // fields) so neither serves the pre-update snapshot.
-                this.clearCacheEntry(`GET:/applications/${applicationId}`);
-                this._invalidateApplicationLists();
-                return res.application;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Soft-delete an application (owner only).
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        async deleteApplication(applicationId) {
-            try {
-                const result = await this.makeRequest('DELETE', `/applications/${applicationId}`, undefined, { cache: false });
-                // Bust every cached representation of the deleted application.
-                this.clearCacheEntry(`GET:/applications/${applicationId}`);
-                this.clearCacheEntry(`GET:/applications/${applicationId}/members`);
-                this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-                this._invalidateApplicationLists();
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * List members of an application.
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        async getApplicationMembers(applicationId) {
-            try {
-                const res = await this.makeRequest('GET', `/applications/${applicationId}/members`, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM });
-                return res.members ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Add a member to an application.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Target user's username or email and role (never `owner`).
-         *   The server resolves `usernameOrEmail` to a user; an unknown value yields
-         *   a 404 "User not found".
-         */
-        async inviteApplicationMember(applicationId, data) {
-            try {
-                const res = await this.makeRequest('POST', `/applications/${applicationId}/members`, data, { cache: false });
-                this._invalidateApplicationMembership(applicationId);
-                return res.member;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Change a member's role.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param memberId - The member's Mongo `_id`.
-         * @param data - New role.
-         */
-        async updateApplicationMember(applicationId, memberId, data) {
-            try {
-                const res = await this.makeRequest('PATCH', `/applications/${applicationId}/members/${memberId}`, data, { cache: false });
-                this._invalidateApplicationMembership(applicationId);
-                return res.member;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Remove a member from an application.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param memberId - The member's Mongo `_id`.
-         */
-        async removeApplicationMember(applicationId, memberId) {
-            try {
-                const result = await this.makeRequest('DELETE', `/applications/${applicationId}/members/${memberId}`, undefined, { cache: false });
-                this._invalidateApplicationMembership(applicationId);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Transfer ownership of an application to another member (owner only).
-         * Demotes the current owner to `admin` and promotes the target to `owner`.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Target user id.
-         */
-        async transferApplicationOwnership(applicationId, data) {
-            try {
-                const result = await this.makeRequest('POST', `/applications/${applicationId}/transfer-ownership`, data, { cache: false });
-                // Ownership change alters roles in the member list AND the detail, and
-                // can change which applications the caller "owns" in the list view.
-                this._invalidateApplicationMembership(applicationId);
-                this._invalidateApplicationLists();
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * List an application's credentials. The response NEVER includes secrets.
-         * @param applicationId - The application's Mongo `_id`.
-         */
-        async getApplicationCredentials(applicationId) {
-            try {
-                const res = await this.makeRequest('GET', `/applications/${applicationId}/credentials`, undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.MEDIUM });
-                return res.credentials ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Create a credential. The plaintext `secret` is returned exactly ONCE;
-         * the server stores only a hash and will never return it again.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param data - Credential configuration.
-         */
-        async createApplicationCredential(applicationId, data) {
-            try {
-                const result = await this.makeRequest('POST', `/applications/${applicationId}/credentials`, data, { cache: false });
-                this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Rotate a credential's secret. The new plaintext `secret` is returned
-         * exactly ONCE, along with audit fields: `rotatedFrom` (the previous
-         * credentialId) and `graceExpiresAt` (ISO string for the grace window during
-         * which the old credential is still honoured).
-         * @param applicationId - The application's Mongo `_id`.
-         * @param credentialId - The credential's Mongo `_id`.
-         */
-        async rotateApplicationCredential(applicationId, credentialId) {
-            try {
-                const result = await this.makeRequest('POST', `/applications/${applicationId}/credentials/${credentialId}/rotate`, undefined, { cache: false });
-                // Rotation changes credential status/audit fields surfaced by the
-                // credentials list (`rotatedFrom`, grace window, new active credential).
-                this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Revoke a credential (`status='revoked'`). Revoked credentials can no
-         * longer authenticate.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param credentialId - The credential's Mongo `_id`.
-         */
-        async revokeApplicationCredential(applicationId, credentialId) {
-            try {
-                const result = await this.makeRequest('DELETE', `/applications/${applicationId}/credentials/${credentialId}`, undefined, { cache: false });
-                // Revocation flips the credential's status in the cached list.
-                this.clearCacheEntry(`GET:/applications/${applicationId}/credentials`);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Fetch usage statistics for an application.
-         * @param applicationId - The application's Mongo `_id`.
-         * @param period - Time window (defaults to the server default).
-         */
-        async getApplicationUsage(applicationId, period) {
-            try {
-                return await this.makeRequest('GET', `/applications/${applicationId}/usage`, period ? { period } : undefined, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.SHORT });
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Bust every cached application list. `getApplications(workspaceId?)` keys
-         * the unscoped list as `GET:/applications` and each workspace-scoped list as
-         * `GET:/applications?workspaceId=<id>` (the query string is part of the URL
-         * path). A change to list membership (create/delete/ownership transfer)
-         * invalidates all of them, so we clear the unscoped entry plus every
-         * `?workspaceId=` variant via a prefix sweep. The prefix `GET:/applications?`
-         * matches only the query-string list variants, never the `GET:/applications/<id>…`
-         * detail/sub-resource keys.
-         *
-         * Internal helper (leading underscore); not part of the supported public
-         * surface. Public rather than `private` because mixins compose into an
-         * exported anonymous class, where TypeScript cannot represent a private
-         * member in the emitted declaration file (TS4094).
-         */
-        _invalidateApplicationLists() {
-            this.clearCacheEntry('GET:/applications');
-            this.clearCacheByPrefix('GET:/applications?');
-        }
-        /**
-         * Bust the cached member list and detail for an application after a
-         * membership mutation. The member list (`getApplicationMembers`) and the
-         * detail (`getApplication`, which can embed member counts) both go stale
-         * when the member set or a member's role changes.
-         *
-         * Internal helper (leading underscore); see `_invalidateApplicationLists`
-         * for why this is public rather than `private`.
-         */
-        _invalidateApplicationMembership(applicationId) {
-            this.clearCacheEntry(`GET:/applications/${applicationId}/members`);
-            this.clearCacheEntry(`GET:/applications/${applicationId}`);
-        }
-    };
-}

package/dist/cjs/mixins/OxyServices.managedAccounts.js

@@ -1,143 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OxyServicesManagedAccountsMixin = OxyServicesManagedAccountsMixin;
-function OxyServicesManagedAccountsMixin(Base) {
-    return class extends Base {
-        constructor(...args) {
-            super(...args);
-        }
-        /**
-         * Create a new managed account (sub-account).
-         *
-         * The server creates a User document with `isManagedAccount: true` and links
-         * it to the authenticated user as owner. Invalidates the cached
-         * `GET /managed-accounts` list (~2-minute TTL, identity-scoped) so the next
-         * read includes the newly created account.
-         */
-        async createManagedAccount(data) {
-            try {
-                const result = await this.makeRequest('POST', '/managed-accounts', data, {
-                    cache: false,
-                });
-                this.clearCacheEntry('GET:/managed-accounts');
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * List all accounts the authenticated user manages.
-         */
-        async getManagedAccounts() {
-            try {
-                return await this.makeRequest('GET', '/managed-accounts', undefined, {
-                    cache: true,
-                    cacheTTL: 2 * 60 * 1000, // 2 minutes cache
-                });
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Get details for a specific managed account.
-         */
-        async getManagedAccountDetails(accountId) {
-            try {
-                return await this.makeRequest('GET', `/managed-accounts/${accountId}`, undefined, {
-                    cache: true,
-                    cacheTTL: 2 * 60 * 1000,
-                });
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Update a managed account's profile data.
-         * Requires owner or admin role.
-         *
-         * Invalidates both the cached detail (`GET /managed-accounts/<id>`) and the
-         * cached list (`GET /managed-accounts`, which embeds account profile data)
-         * so neither serves the pre-update snapshot within their ~2-minute TTL.
-         */
-        async updateManagedAccount(accountId, data) {
-            try {
-                const result = await this.makeRequest('PUT', `/managed-accounts/${accountId}`, data, {
-                    cache: false,
-                });
-                this.clearCacheEntry(`GET:/managed-accounts/${accountId}`);
-                this.clearCacheEntry('GET:/managed-accounts');
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Delete a managed account permanently.
-         * Requires owner role.
-         *
-         * Invalidates the cached detail and list responses so the deleted account
-         * is not served from cache.
-         */
-        async deleteManagedAccount(accountId) {
-            try {
-                await this.makeRequest('DELETE', `/managed-accounts/${accountId}`, undefined, {
-                    cache: false,
-                });
-                this.clearCacheEntry(`GET:/managed-accounts/${accountId}`);
-                this.clearCacheEntry('GET:/managed-accounts');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Add a manager to a managed account.
-         * Requires owner or admin role on the account.
-         *
-         * Mutates the account's `managers[]`, which is returned by the detail and
-         * list reads — invalidate both so they re-fetch the updated manager set.
-         *
-         * @param accountId - The managed account to add the manager to
-         * @param userId - The user to grant management access
-         * @param role - The role to assign: 'admin' or 'editor'
-         */
-        async addManager(accountId, userId, role) {
-            try {
-                await this.makeRequest('POST', `/managed-accounts/${accountId}/managers`, { userId, role }, {
-                    cache: false,
-                });
-                this.clearCacheEntry(`GET:/managed-accounts/${accountId}`);
-                this.clearCacheEntry('GET:/managed-accounts');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Remove a manager from a managed account.
-         * Requires owner role.
-         *
-         * Invalidates the detail and list responses so the updated `managers[]`
-         * is observed on the next read (see `addManager`).
-         *
-         * @param accountId - The managed account
-         * @param userId - The manager to remove
-         */
-        async removeManager(accountId, userId) {
-            try {
-                await this.makeRequest('DELETE', `/managed-accounts/${accountId}/managers/${userId}`, undefined, {
-                    cache: false,
-                });
-                this.clearCacheEntry(`GET:/managed-accounts/${accountId}`);
-                this.clearCacheEntry('GET:/managed-accounts');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-    };
-}