@productcraft/auth 0.8.0 → 0.8.2

package/dist/index.d.cts

@@ -156,7 +156,7 @@ declare class AuthHttpError<TData = unknown> extends Error {
  */
 type AuditLogEntryDto = {
     /**
-     * @description Canonical action string (e.g. `app.member.removed`, `role.created`).
+     * @description Canonical action string (e.g. `app.member.removed`, `role.created`). Account deletions: `auth.account.deleted` (one row per account, written in the deleting transaction; `resource` is `account`, `resource_id` the deleted account id, `metadata` `{ via, username, email_domain, created_at, verified }` where `via` is `platform`, `platform_bulk`, `consumer_admin` or `self`, plus `selection` (`{ mode, filter? }`) on bulk rows) and `auth.account.expired_unverified` (the unverified-account expiry job).
      * @type string
      */
     action: string;
@@ -981,6 +981,48 @@ type EndUserInviteListResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const botProtectionResponseDtoProviderEnum: {
+    readonly turnstile: "turnstile";
+    readonly hcaptcha: "hcaptcha";
+};
+type BotProtectionResponseDtoProviderEnumKey = (typeof botProtectionResponseDtoProviderEnum)[keyof typeof botProtectionResponseDtoProviderEnum];
+type BotProtectionResponseDto = {
+    /**
+     * @description Whether sign-up requires a verified token.
+     * @type boolean
+     */
+    enabled: boolean;
+    /**
+     * @description Hostnames a solved challenge must come from. Empty = any.
+     * @type array
+     */
+    expected_hostnames: string[];
+    /**
+     * @type string
+     */
+    provider: BotProtectionResponseDtoProviderEnumKey;
+    /**
+     * @description Last four characters of the stored secret, so you can tell which one it is. null when none is stored.
+     * @type string
+     */
+    secret_last4: string | null;
+    /**
+     * @description Whether a provider secret is stored. The secret itself is never returned.
+     * @type boolean
+     */
+    secret_set: boolean;
+    /**
+     * @description Public widget site key.
+     * @type string
+     */
+    site_key: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 declare const authConfigResponseDtoMfaEnum: {
     readonly optional: "optional";
     readonly required: "required";
@@ -1007,6 +1049,10 @@ type AuthConfigResponseDto = {
      * @type array
      */
     allowed_redirect_origins: string[];
+    /**
+     * @description Sign-up bot protection; null when not configured.
+     */
+    bot_protection: BotProtectionResponseDto | null;
     /**
      * @type boolean
      */
@@ -1071,6 +1117,18 @@ type AuthConfigResponseDto = {
      * @type boolean
      */
     signup_enabled: boolean;
+    /**
+     * @description When true, sign-up requires a Platform API Key from this app\'s workspace (anonymous sign-ups get 401).
+     * @type boolean
+     */
+    signup_requires_pak: boolean;
+    /**
+     * @description Days an account may keep an unverified primary email before it is deleted. null = never.
+     * @minLength 1
+     * @maxLength 90
+     * @type number
+     */
+    unverified_account_ttl_days: number | null;
 };
 
 /**
@@ -1133,6 +1191,46 @@ type UpdateAppStatusDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const updateBotProtectionDtoProviderEnum: {
+    readonly turnstile: "turnstile";
+    readonly hcaptcha: "hcaptcha";
+};
+type UpdateBotProtectionDtoProviderEnumKey = (typeof updateBotProtectionDtoProviderEnum)[keyof typeof updateBotProtectionDtoProviderEnum];
+type UpdateBotProtectionDto = {
+    /**
+     * @description When true, every sign-up on this app must carry a `bot_protection_token` the provider accepts. Needs a stored secret. Takes effect within seconds.
+     * @type boolean | undefined
+     */
+    enabled?: boolean;
+    /**
+     * @description Hostnames the solved challenge must come from, as the provider reports them (exact match, no scheme, port or path). Empty (default) accepts any hostname the site key allows. Send null or [] to clear.
+     * @type array
+     */
+    expected_hostnames?: string[] | null;
+    /**
+     * @description Which CAPTCHA the app\'s sign-up form renders: Cloudflare Turnstile or hCaptcha. Required the first time the block is configured. Changing it without sending a new `secret` clears the stored secret, which belonged to the other provider.
+     * @type string | undefined
+     */
+    provider?: UpdateBotProtectionDtoProviderEnumKey;
+    /**
+     * @description The provider secret Auth verifies tokens with. WRITE-ONLY: no response ever returns it (GET shows `secret_set` and the last four characters). Send a string to store or replace it, null to clear it, or leave it out to keep the stored one. Stored encrypted.
+     * @maxLength 512
+     * @type string
+     */
+    secret?: string | null;
+    /**
+     * @description The public site key your sign-up page renders the widget with. Not a secret. Required the first time the block is configured.
+     * @maxLength 256
+     * @type string | undefined
+     */
+    site_key?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 declare const updateAuthConfigDtoMfaEnum: {
     readonly optional: "optional";
     readonly required: "required";
@@ -1163,6 +1261,10 @@ type UpdateAuthConfigDto = {
      * @type array | undefined
      */
     allowed_redirect_origins?: string[];
+    /**
+     * @description Sign-up bot protection (Cloudflare Turnstile or hCaptcha). Fields you send are merged onto the stored block; send null to remove the block and its secret. While `enabled`, sign-up requires a `bot_protection_token` the provider accepts, checked before anything else, and fails closed (503) when the provider cannot be reached.
+     */
+    bot_protection?: UpdateBotProtectionDto | null;
     /**
      * @description When true, Consumer-API routes annotated with `@RequireAppPermission(perm)` enforce the requested perm against the EndUser\'s role-resolved permission set. When false (default), permission checks are bypassed — any valid token can call any annotated route. Flip on once you\'ve authored roles + permissions for this app and want them to actually mean something.
      * @type boolean | undefined
@@ -1253,6 +1355,18 @@ type UpdateAuthConfigDto = {
      * @type boolean | undefined
      */
     signup_enabled?: boolean;
+    /**
+     * @description When true, sign-up only works from your backend: every `POST /{app_slug}/v1/auth/signup` must carry a Platform API Key (`Authorization: Bearer pcft_live_…`) from this app\'s workspace whose policy allows `auth.signup.create` on this app. Anonymous sign-ups get 401. Use it when your own backend gates sign-ups (CAPTCHA, invite or payment checks). Independent of `bot_protection`; an app can use both. Turning it on for an app that has no workspace is refused with 409.
+     * @type boolean | undefined
+     */
+    signup_requires_pak?: boolean;
+    /**
+     * @description Delete accounts whose primary email is still unverified this many days after sign-up. Only self-sign-ups that never signed in after sign-up, hold no two-step factor, no verified contact and no social login qualify. Deletion is permanent, frees the email address and username, is audited as `auth.account.expired_unverified` and fires `user.deleted` with `reason: \"unverified_expired\"`. Send null to never delete. New apps start at 7; apps created before this setting existed start at null.
+     * @minLength 1
+     * @maxLength 90
+     * @type number
+     */
+    unverified_account_ttl_days?: number | null;
 };
 
 /**
@@ -1306,6 +1420,13 @@ type UpdateEndUserDto = {
      * @type string | undefined
      */
     email?: string;
+    /**
+     * @description Keys to merge into the end-user\'s metadata (shallow; a key set to null is removed; at most 8 KB stored). Set `app_active: true` to mark someone who uses your app: the unverified-account expiry never deletes an account carrying it.
+     * @type object | undefined
+     */
+    metadata?: {
+        [key: string]: any;
+    };
 };
 
 /**
@@ -2142,6 +2263,12 @@ type ConsumerAuthControllerSignin200 = ConsumerTokenResponseDto | ConsumerMfaCha
  * Do not edit manually.
  */
 type ConsumerSignupDto = {
+    /**
+     * @description The response token from the app\'s bot-protection widget (Cloudflare Turnstile or hCaptcha). Required when the app has bot protection switched on (`auth_config.bot_protection.enabled`); ignored otherwise. Auth verifies it with the provider before anything else about the sign-up is looked at. Tokens are single-use and expire after a few minutes, so render a fresh widget for every attempt. A backend that signs users up with a Platform API Key forwards the token its browser received.
+     * @maxLength 2048
+     * @type string | undefined
+     */
+    bot_protection_token?: string;
     /**
      * @description Optional display name shown back to the user.
      * @type string | undefined

package/dist/index.d.ts

@@ -156,7 +156,7 @@ declare class AuthHttpError<TData = unknown> extends Error {
  */
 type AuditLogEntryDto = {
     /**
-     * @description Canonical action string (e.g. `app.member.removed`, `role.created`).
+     * @description Canonical action string (e.g. `app.member.removed`, `role.created`). Account deletions: `auth.account.deleted` (one row per account, written in the deleting transaction; `resource` is `account`, `resource_id` the deleted account id, `metadata` `{ via, username, email_domain, created_at, verified }` where `via` is `platform`, `platform_bulk`, `consumer_admin` or `self`, plus `selection` (`{ mode, filter? }`) on bulk rows) and `auth.account.expired_unverified` (the unverified-account expiry job).
      * @type string
      */
     action: string;
@@ -981,6 +981,48 @@ type EndUserInviteListResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const botProtectionResponseDtoProviderEnum: {
+    readonly turnstile: "turnstile";
+    readonly hcaptcha: "hcaptcha";
+};
+type BotProtectionResponseDtoProviderEnumKey = (typeof botProtectionResponseDtoProviderEnum)[keyof typeof botProtectionResponseDtoProviderEnum];
+type BotProtectionResponseDto = {
+    /**
+     * @description Whether sign-up requires a verified token.
+     * @type boolean
+     */
+    enabled: boolean;
+    /**
+     * @description Hostnames a solved challenge must come from. Empty = any.
+     * @type array
+     */
+    expected_hostnames: string[];
+    /**
+     * @type string
+     */
+    provider: BotProtectionResponseDtoProviderEnumKey;
+    /**
+     * @description Last four characters of the stored secret, so you can tell which one it is. null when none is stored.
+     * @type string
+     */
+    secret_last4: string | null;
+    /**
+     * @description Whether a provider secret is stored. The secret itself is never returned.
+     * @type boolean
+     */
+    secret_set: boolean;
+    /**
+     * @description Public widget site key.
+     * @type string
+     */
+    site_key: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 declare const authConfigResponseDtoMfaEnum: {
     readonly optional: "optional";
     readonly required: "required";
@@ -1007,6 +1049,10 @@ type AuthConfigResponseDto = {
      * @type array
      */
     allowed_redirect_origins: string[];
+    /**
+     * @description Sign-up bot protection; null when not configured.
+     */
+    bot_protection: BotProtectionResponseDto | null;
     /**
      * @type boolean
      */
@@ -1071,6 +1117,18 @@ type AuthConfigResponseDto = {
      * @type boolean
      */
     signup_enabled: boolean;
+    /**
+     * @description When true, sign-up requires a Platform API Key from this app\'s workspace (anonymous sign-ups get 401).
+     * @type boolean
+     */
+    signup_requires_pak: boolean;
+    /**
+     * @description Days an account may keep an unverified primary email before it is deleted. null = never.
+     * @minLength 1
+     * @maxLength 90
+     * @type number
+     */
+    unverified_account_ttl_days: number | null;
 };
 
 /**
@@ -1133,6 +1191,46 @@ type UpdateAppStatusDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const updateBotProtectionDtoProviderEnum: {
+    readonly turnstile: "turnstile";
+    readonly hcaptcha: "hcaptcha";
+};
+type UpdateBotProtectionDtoProviderEnumKey = (typeof updateBotProtectionDtoProviderEnum)[keyof typeof updateBotProtectionDtoProviderEnum];
+type UpdateBotProtectionDto = {
+    /**
+     * @description When true, every sign-up on this app must carry a `bot_protection_token` the provider accepts. Needs a stored secret. Takes effect within seconds.
+     * @type boolean | undefined
+     */
+    enabled?: boolean;
+    /**
+     * @description Hostnames the solved challenge must come from, as the provider reports them (exact match, no scheme, port or path). Empty (default) accepts any hostname the site key allows. Send null or [] to clear.
+     * @type array
+     */
+    expected_hostnames?: string[] | null;
+    /**
+     * @description Which CAPTCHA the app\'s sign-up form renders: Cloudflare Turnstile or hCaptcha. Required the first time the block is configured. Changing it without sending a new `secret` clears the stored secret, which belonged to the other provider.
+     * @type string | undefined
+     */
+    provider?: UpdateBotProtectionDtoProviderEnumKey;
+    /**
+     * @description The provider secret Auth verifies tokens with. WRITE-ONLY: no response ever returns it (GET shows `secret_set` and the last four characters). Send a string to store or replace it, null to clear it, or leave it out to keep the stored one. Stored encrypted.
+     * @maxLength 512
+     * @type string
+     */
+    secret?: string | null;
+    /**
+     * @description The public site key your sign-up page renders the widget with. Not a secret. Required the first time the block is configured.
+     * @maxLength 256
+     * @type string | undefined
+     */
+    site_key?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 declare const updateAuthConfigDtoMfaEnum: {
     readonly optional: "optional";
     readonly required: "required";
@@ -1163,6 +1261,10 @@ type UpdateAuthConfigDto = {
      * @type array | undefined
      */
     allowed_redirect_origins?: string[];
+    /**
+     * @description Sign-up bot protection (Cloudflare Turnstile or hCaptcha). Fields you send are merged onto the stored block; send null to remove the block and its secret. While `enabled`, sign-up requires a `bot_protection_token` the provider accepts, checked before anything else, and fails closed (503) when the provider cannot be reached.
+     */
+    bot_protection?: UpdateBotProtectionDto | null;
     /**
      * @description When true, Consumer-API routes annotated with `@RequireAppPermission(perm)` enforce the requested perm against the EndUser\'s role-resolved permission set. When false (default), permission checks are bypassed — any valid token can call any annotated route. Flip on once you\'ve authored roles + permissions for this app and want them to actually mean something.
      * @type boolean | undefined
@@ -1253,6 +1355,18 @@ type UpdateAuthConfigDto = {
      * @type boolean | undefined
      */
     signup_enabled?: boolean;
+    /**
+     * @description When true, sign-up only works from your backend: every `POST /{app_slug}/v1/auth/signup` must carry a Platform API Key (`Authorization: Bearer pcft_live_…`) from this app\'s workspace whose policy allows `auth.signup.create` on this app. Anonymous sign-ups get 401. Use it when your own backend gates sign-ups (CAPTCHA, invite or payment checks). Independent of `bot_protection`; an app can use both. Turning it on for an app that has no workspace is refused with 409.
+     * @type boolean | undefined
+     */
+    signup_requires_pak?: boolean;
+    /**
+     * @description Delete accounts whose primary email is still unverified this many days after sign-up. Only self-sign-ups that never signed in after sign-up, hold no two-step factor, no verified contact and no social login qualify. Deletion is permanent, frees the email address and username, is audited as `auth.account.expired_unverified` and fires `user.deleted` with `reason: \"unverified_expired\"`. Send null to never delete. New apps start at 7; apps created before this setting existed start at null.
+     * @minLength 1
+     * @maxLength 90
+     * @type number
+     */
+    unverified_account_ttl_days?: number | null;
 };
 
 /**
@@ -1306,6 +1420,13 @@ type UpdateEndUserDto = {
      * @type string | undefined
      */
     email?: string;
+    /**
+     * @description Keys to merge into the end-user\'s metadata (shallow; a key set to null is removed; at most 8 KB stored). Set `app_active: true` to mark someone who uses your app: the unverified-account expiry never deletes an account carrying it.
+     * @type object | undefined
+     */
+    metadata?: {
+        [key: string]: any;
+    };
 };
 
 /**
@@ -2142,6 +2263,12 @@ type ConsumerAuthControllerSignin200 = ConsumerTokenResponseDto | ConsumerMfaCha
  * Do not edit manually.
  */
 type ConsumerSignupDto = {
+    /**
+     * @description The response token from the app\'s bot-protection widget (Cloudflare Turnstile or hCaptcha). Required when the app has bot protection switched on (`auth_config.bot_protection.enabled`); ignored otherwise. Auth verifies it with the provider before anything else about the sign-up is looked at. Tokens are single-use and expire after a few minutes, so render a fresh widget for every attempt. A backend that signs users up with a Platform API Key forwards the token its browser received.
+     * @maxLength 2048
+     * @type string | undefined
+     */
+    bot_protection_token?: string;
     /**
      * @description Optional display name shown back to the user.
      * @type string | undefined