@poly-x/core 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/index.cjs

@@ -709,7 +709,13 @@ const ENDPOINTS = {
 	token: "/v1/idp/token",
 	refresh: "/v1/auth/refresh-token",
 	logout: "/v1/idp/logout",
-	orgResolve: "/v1/idp/org-resolve"
+	orgResolve: "/v1/idp/org-resolve",
+	/**
+	* Completes the admin temp-password flow: the user signed in with a temporary
+	* password, poly-auth answered `403 {userPasswordSet, userId}`, and this sets
+	* the real one. Only succeeds while the account is flagged `mustChangePassword`.
+	*/
+	setPassword: "/v1/auth/set-password"
 };
 //#endregion
 //#region src/auth/outcomes.ts
@@ -908,6 +914,24 @@ var AuthClient = class {
 		if (response.status >= 500) throw this.toError(response);
 		return parsePasswordOutcome(response.status, response.body);
 	}
+	/**
+	* Set the real password for a user the platform has flagged `mustChangePassword`
+	* (the admin temp-password flow). Call this only after `authorizeWithPassword`
+	* has returned `password_change_required` for that same user — that response IS
+	* the proof the caller knows the temporary password.
+	*/
+	async setPassword(params) {
+		const response = await this.transport.request({
+			method: "PATCH",
+			url: this.config.baseUrl + ENDPOINTS.setPassword,
+			body: {
+				userId: params.userId,
+				newPassword: params.newPassword,
+				confirmPassword: params.confirmPassword
+			}
+		});
+		if (response.status !== 200) throw this.toError(response);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",

package/dist/index.d.cts

@@ -392,6 +392,12 @@ declare const ENDPOINTS: {
   readonly refresh: "/v1/auth/refresh-token";
   readonly logout: "/v1/idp/logout";
   readonly orgResolve: "/v1/idp/org-resolve";
+  /**
+   * Completes the admin temp-password flow: the user signed in with a temporary
+   * password, poly-auth answered `403 {userPasswordSet, userId}`, and this sets
+   * the real one. Only succeeds while the account is flagged `mustChangePassword`.
+   */
+  readonly setPassword: "/v1/auth/set-password";
 };
 //#endregion
 //#region src/auth/outcomes.d.ts
@@ -496,6 +502,11 @@ interface ExchangeCodeParams {
   codeVerifier: string;
   redirectUri: string;
 }
+interface SetPasswordParams {
+  userId: string;
+  newPassword: string;
+  confirmPassword: string;
+}
 interface AuthorizeWithPasswordParams {
   email: string;
   password: string;
@@ -532,6 +543,13 @@ declare class AuthClient {
    * outcome the UI branches on.
    */
   authorizeWithPassword(params: AuthorizeWithPasswordParams): Promise<PasswordAuthOutcome>;
+  /**
+   * Set the real password for a user the platform has flagged `mustChangePassword`
+   * (the admin temp-password flow). Call this only after `authorizeWithPassword`
+   * has returned `password_change_required` for that same user — that response IS
+   * the proof the caller knows the temporary password.
+   */
+  setPassword(params: SetPasswordParams): Promise<void>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -550,4 +568,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.d.mts

@@ -392,6 +392,12 @@ declare const ENDPOINTS: {
   readonly refresh: "/v1/auth/refresh-token";
   readonly logout: "/v1/idp/logout";
   readonly orgResolve: "/v1/idp/org-resolve";
+  /**
+   * Completes the admin temp-password flow: the user signed in with a temporary
+   * password, poly-auth answered `403 {userPasswordSet, userId}`, and this sets
+   * the real one. Only succeeds while the account is flagged `mustChangePassword`.
+   */
+  readonly setPassword: "/v1/auth/set-password";
 };
 //#endregion
 //#region src/auth/outcomes.d.ts
@@ -496,6 +502,11 @@ interface ExchangeCodeParams {
   codeVerifier: string;
   redirectUri: string;
 }
+interface SetPasswordParams {
+  userId: string;
+  newPassword: string;
+  confirmPassword: string;
+}
 interface AuthorizeWithPasswordParams {
   email: string;
   password: string;
@@ -532,6 +543,13 @@ declare class AuthClient {
    * outcome the UI branches on.
    */
   authorizeWithPassword(params: AuthorizeWithPasswordParams): Promise<PasswordAuthOutcome>;
+  /**
+   * Set the real password for a user the platform has flagged `mustChangePassword`
+   * (the admin temp-password flow). Call this only after `authorizeWithPassword`
+   * has returned `password_change_required` for that same user — that response IS
+   * the proof the caller knows the temporary password.
+   */
+  setPassword(params: SetPasswordParams): Promise<void>;
   exchangeCode(params: ExchangeCodeParams): Promise<StoredSession>;
   /** The `RefreshTokens` function the SessionEngine (F003) injects. */
   createRefresher(): RefreshTokens;
@@ -550,4 +568,4 @@ declare class AuthClient {
 declare const PACKAGE_NAME = "@poly-x/core";
 declare const version = "0.0.0";
 //#endregion
-export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };
+export { AuthClient, type AuthClientOptions, type AuthorizeOutcome, type AuthorizeWithPasswordParams, type BuildAuthorizeUrlParams, type Clock, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, ENDPOINTS, type ExchangeCodeParams, FetchTransport, type FieldError, ForbiddenError, type HttpMethod, INITIAL_STATE as INITIAL_SESSION_STATE, InMemoryLock, InMemoryPkceStore, InMemorySessionChannel, InMemorySessionStore, type KeyEnv, type KeyKind, type Lock, type MockRoute, MockTransport, PACKAGE_NAME, type ParsedKey, type PasswordAuthOutcome, type PkceEntry, type PkcePair, type PkceStore, type PlatformResponseLike, PolyXConfigError, PolyXError, type PolyXErrorOptions, RateLimitedError, type RefreshTokens, type ResolveConfigInput, type ResolvedConfig, type RetryPolicy, type RuntimeContext, type Session, type SessionChannel, type SessionChannelEvent, type SessionClaims, SessionEngine, type SessionEngineOptions, type SessionEvent, SessionExpiredError, SessionRevokedError, type SessionState, type SessionStore, type SetPasswordParams, type SignedOutReason, type StoredSession, SystemClock, type TenantOption, type TimerHandle, type TokenSet, type Transport, type TransportRequest, type TransportResponse, UnauthenticatedError, UpstreamError, ValidationError, computeChallenge, createSessionEngine, decodeJwtExp, generatePkce, isTransientStatus, mapPlatformError, normalizeExchange, normalizeRefresh, parseAuthorizeOutcome, parsePasswordOutcome, parsePolyXKey, randomState, redactSensitive, reduce as reduceSessionState, resolveConfig, version };

package/dist/index.mjs

@@ -708,7 +708,13 @@ const ENDPOINTS = {
 	token: "/v1/idp/token",
 	refresh: "/v1/auth/refresh-token",
 	logout: "/v1/idp/logout",
-	orgResolve: "/v1/idp/org-resolve"
+	orgResolve: "/v1/idp/org-resolve",
+	/**
+	* Completes the admin temp-password flow: the user signed in with a temporary
+	* password, poly-auth answered `403 {userPasswordSet, userId}`, and this sets
+	* the real one. Only succeeds while the account is flagged `mustChangePassword`.
+	*/
+	setPassword: "/v1/auth/set-password"
 };
 //#endregion
 //#region src/auth/outcomes.ts
@@ -907,6 +913,24 @@ var AuthClient = class {
 		if (response.status >= 500) throw this.toError(response);
 		return parsePasswordOutcome(response.status, response.body);
 	}
+	/**
+	* Set the real password for a user the platform has flagged `mustChangePassword`
+	* (the admin temp-password flow). Call this only after `authorizeWithPassword`
+	* has returned `password_change_required` for that same user — that response IS
+	* the proof the caller knows the temporary password.
+	*/
+	async setPassword(params) {
+		const response = await this.transport.request({
+			method: "PATCH",
+			url: this.config.baseUrl + ENDPOINTS.setPassword,
+			body: {
+				userId: params.userId,
+				newPassword: params.newPassword,
+				confirmPassword: params.confirmPassword
+			}
+		});
+		if (response.status !== 200) throw this.toError(response);
+	}
 	async exchangeCode(params) {
 		const response = await this.transport.request({
 			method: "POST",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poly-x/core",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.4",
   "description": "Framework-agnostic core of the PolyX SDK",
   "license": "MIT",
   "type": "module",