@protobase/client 0.21.12 → 0.22.1

package/dist/auth.d.ts

@@ -1,9 +1,10 @@
 import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
 import { AccountSignIn, AuthenticatorSetup, Passkey } from "./account-security.js";
-import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole } from "./organizations.js";
+import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsFound } from "./organizations.js";
 import { ActiveRole } from "./roles.js";
+import { AuthUser, RoleLabel, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
+import { AppUser, UserInvitation, UserInvitationSent, UsersFound } from "./users.js";
 import { StaffSignIn } from "./staff-sign-in.js";
-import { AuthUser, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
 //#region src/auth.d.ts
 export type AuthSessionOptions = {
@@ -22,8 +23,8 @@ export declare const tokenExpiry: (token: string) => number;
 /**
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
  * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
- * sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
- * (`organizations`), the role the session acts with (`roles`), and a short-lived
+ * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
+ * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
  */
 export declare const createAuthSession: (options?: AuthSessionOptions) => {
@@ -67,7 +68,7 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
     switchTo: (organizationId: string | null) => Promise<{
       organizationId: string | null;
     }>;
-    search: (query: string) => Promise<Organization[]>;
+    search: (query: string, offset?: number) => Promise<OrganizationsFound>;
     create: (input: {
       name: string;
       slug: string;
@@ -107,6 +108,25 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
     read: () => Promise<SignInPolicyState>;
     save: (policy: SignInPolicy) => Promise<SignInPolicyState>;
   };
+  users: {
+    search: (query: string, offset?: number) => Promise<UsersFound>;
+    create: (input: {
+      email: string;
+      name: string;
+      password?: string;
+      roles: string[];
+    }) => Promise<AppUser>;
+    setRoles: (userId: string, roles: string[]) => Promise<unknown>;
+    block: (userId: string) => Promise<unknown>;
+    unblock: (userId: string) => Promise<unknown>;
+    invite: (input: {
+      email: string;
+      roles: string[];
+    }) => Promise<UserInvitationSent>;
+    invitations: () => Promise<UserInvitation[]>;
+    revoke: (invitationId: string) => Promise<unknown>;
+    roles: () => Promise<RoleLabel[]>;
+  };
   staff: {
     stop: () => Promise<void>;
     start: (input: {

package/dist/auth.js

@@ -3,6 +3,7 @@ import { accountSecurity } from "./account-security.js";
 import { betterAuthClient } from "./better-auth-client.js";
 import { organizationsClient } from "./organizations.js";
 import { rolesClient } from "./roles.js";
+import { usersClient } from "./users.js";
 import { signInFlows } from "./sign-in-flows.js";
 import { signInPolicyClient } from "./sign-in-policy.js";
 import { staffSignInClient } from "./staff-sign-in.js";
@@ -18,8 +19,8 @@ const tokenExpiry = (token) => {
 /**
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
 * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
-* sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
-* (`organizations`), the role the session acts with (`roles`), and a short-lived
+* sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
+* signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
 */
 const createAuthSession = (options = {}) => {
@@ -149,6 +150,7 @@ const createAuthSession = (options = {}) => {
 		organizations: organizationsClient(client, () => token({ refresh: true })),
 		roles: rolesClient(client, () => token({ refresh: true })),
 		signInPolicy: signInPolicyClient(client),
+		users: usersClient(client),
 		staff: {
 			...staff,
 			stop: async () => {

package/dist/index.d.ts

@@ -9,13 +9,14 @@ import { routedClient } from "./routed-client.js";
 import { SourceMeta, sourceMeta } from "./source-meta.js";
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
-import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient } from "./organizations.js";
+import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient, OrganizationsFound } from "./organizations.js";
 import { ActiveRole, RoleOption, RolesClient } from "./roles.js";
-import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
 import { AuthUser, PlatformSignIn, RoleLabel, SamlSignIn, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
+import { AppUser, UserInvitation, UserInvitationSent, UsersClient, UsersFound } from "./users.js";
+import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
 import { AuthError } from "./auth-error.js";
 import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from "./auth.js";
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimeLastUpdate, RuntimePolicy, RuntimeStatus, RuntimeUpdateStage, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type CurrentOrganization, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type CurrentOrganization, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/organizations.d.ts

@@ -8,6 +8,11 @@ export type Organization = {
   slug: string;
   logo?: string | null;
 };
+/** A page of organizations and how many there are in all. */
+export type OrganizationsFound = {
+  organizations: Organization[];
+  total: number;
+};
 /**
  * The organization the session works in: for a member with their organization role, app roles there and membership
  * id; for someone with a global role who entered it without being a member, without them. `globalRoles` are the
@@ -39,9 +44,15 @@ export type OrganizationInvitation = {
   expiresAt: string;
   organizationName?: string;
 };
-/** An invitation as its link shows it, before it is accepted. */
+/**
+ * An invitation as its link shows it, before it is accepted. One to the app itself, rather than to an organization, has
+ * `app` in place of `organization` and `role`, and `appRoles` are the roles its account gets.
+ */
 export type InvitationPreview = {
-  organization: {
+  app?: {
+    name: string;
+  };
+  organization?: {
     id: string;
     name: string;
   };
@@ -49,7 +60,7 @@ export type InvitationPreview = {
     name: string;
   };
   email: string;
-  role: OrganizationRole;
+  role?: OrganizationRole;
   appRoles: string[];
   expiresAt: string;
   hasAccount: boolean;
@@ -72,8 +83,8 @@ export declare const organizationsClient: (client: BetterAuthClient, refreshToke
   switchTo: (organizationId: string | null) => Promise<{
     organizationId: string | null;
   }>;
-  /** Every organization whose name or slug contains `query`, for people with a global role. */
-  search: (query: string) => Promise<Organization[]>;
+  /** For people with a global role, 20 organizations by slug from `offset` whose name or slug contains `query`, and the total. */
+  search: (query: string, offset?: number) => Promise<OrganizationsFound>;
   /** Creates an organization, owned by the person with every app role, and works in it. */
   create: (input: {
     name: string;
@@ -105,11 +116,11 @@ export declare const organizationsClient: (client: BetterAuthClient, refreshToke
   revoke: (invitationId: string) => Promise<unknown>;
   /** The pending invitations for the person's own address. */
   myInvitations: () => Promise<OrganizationInvitation[]>;
-  /** What an invitation link is for; works signed out. */
+  /** What an invitation link is for, to an organization or to the app; works signed out. */
   invitation: (token: string) => Promise<InvitationPreview>;
   /** Accepts an invitation signed in as its address, and works in its organization. */
   accept: (token: string) => Promise<unknown>;
-  /** Creates an account for an invited address without one, accepts the invitation and signs in. */
+  /** Creates an account for an invited address without one, accepts the invitation and signs in; for either kind of invitation. */
   signUpFromInvitation: (token: string, input: {
     name: string;
     password?: string;

package/dist/organizations.js

@@ -48,8 +48,11 @@ const organizationsClient = (client, refreshToken) => {
 		current: () => call("/organization/current", "Could not read the current organization"),
 		/** Works in another organization from now on; `null` for none. */
 		switchTo: async (organizationId) => thenRefresh(await call("/organization/switch", "Could not switch the organization", { body: { organizationId } })),
-		/** Every organization whose name or slug contains `query`, for people with a global role. */
-		search: async (query) => (await call("/organization/search", "Could not search the organizations", { query: { query } })).organizations,
+		/** For people with a global role, 20 organizations by slug from `offset` whose name or slug contains `query`, and the total. */
+		search: (query, offset = 0) => call("/organization/search", "Could not search the organizations", { query: {
+			query,
+			...offset > 0 && { offset: String(offset) }
+		} }),
 		/** Creates an organization, owned by the person with every app role, and works in it. */
 		create: async (input) => thenRefresh(await call("/organization/create", "Could not create the organization", { body: input })),
 		rename: (organizationId, data) => call("/organization/update", "Could not change the organization", { body: {
@@ -110,11 +113,11 @@ const organizationsClient = (client, refreshToken) => {
 		revoke: (invitationId) => call("/organization/cancel-invitation", "Could not revoke the invitation", { body: { invitationId } }),
 		/** The pending invitations for the person's own address. */
 		myInvitations: async () => (await call("/organization/list-user-invitations", "Could not read your invitations") ?? []).map(invitation),
-		/** What an invitation link is for; works signed out. */
+		/** What an invitation link is for, to an organization or to the app; works signed out. */
 		invitation: (token) => call("/invitation", "This invitation link is not valid", { query: { token } }),
 		/** Accepts an invitation signed in as its address, and works in its organization. */
 		accept: async (token) => thenRefresh(await call("/invitation/accept", "Could not accept the invitation", { body: { token } })),
-		/** Creates an account for an invited address without one, accepts the invitation and signs in. */
+		/** Creates an account for an invited address without one, accepts the invitation and signs in; for either kind of invitation. */
 		signUpFromInvitation: async (token, input) => thenRefresh(await call("/invitation/sign-up", "Could not create your account", { body: {
 			token,
 			...input

package/dist/static-session.js

@@ -91,6 +91,20 @@ const createStaticSession = (token, user = {
 		}),
 		switchTo: unsupported("switch roles")
 	},
+	users: {
+		search: async () => ({
+			users: [],
+			total: 0
+		}),
+		create: unsupported("create an account"),
+		setRoles: unsupported("change roles"),
+		block: unsupported("block an account"),
+		unblock: unsupported("unblock an account"),
+		invite: unsupported("invite people"),
+		invitations: async () => [],
+		revoke: unsupported("revoke an invitation"),
+		roles: async () => []
+	},
 	organizations: {
 		list: async () => [],
 		current: async () => ({
@@ -98,7 +112,10 @@ const createStaticSession = (token, user = {
 			globalRoles: []
 		}),
 		switchTo: unsupported("switch organizations"),
-		search: async () => [],
+		search: async () => ({
+			organizations: [],
+			total: 0
+		}),
 		create: unsupported("create an organization"),
 		rename: unsupported("change an organization"),
 		remove: unsupported("delete an organization"),

package/dist/users.d.ts

@@ -0,0 +1,59 @@
+import { BetterAuthClient } from "./better-auth-client.js";
+import { RoleLabel } from "./auth-types.js";
+//#region src/users.d.ts
+/** Someone who can sign in, as an admin sees them: their roles, and whether they are blocked from signing in. */
+export type AppUser = {
+  id: string;
+  name: string;
+  email: string;
+  roles: string[];
+  blocked: boolean;
+  createdAt: string;
+};
+/** A page of users and how many there are in all. */
+export type UsersFound = {
+  users: AppUser[];
+  total: number;
+};
+/** A pending invitation to the app, to make an account with `roles`. */
+export type UserInvitation = {
+  id: string;
+  email: string;
+  roles: string[];
+  expiresAt: string;
+};
+/** What inviting gives back: the invitation, and its link when the server cannot email it. */
+export type UserInvitationSent = {
+  invitation: UserInvitation;
+  link?: string;
+};
+/**
+ * Managing the people who can sign in, for admins: Better Auth's admin endpoints to list, create, set roles and block,
+ * and Protobase's invitations to the app, which work with or without organizations. Each call rejects with `AuthError`.
+ */
+export declare const usersClient: (client: BetterAuthClient) => {
+  /** 20 users from `offset`, oldest first, whose address contains `query`, and the total. */
+  search: (query: string, offset?: number) => Promise<UsersFound>;
+  /** Creates an account; without a password, the person signs in another way the sign-in policy allows, such as an emailed code. */
+  create: (input: {
+    email: string;
+    name: string;
+    password?: string;
+    roles: string[];
+  }) => Promise<AppUser>;
+  setRoles: (userId: string, roles: string[]) => Promise<unknown>;
+  /** Blocks signing in, which ends the person's sessions. */
+  block: (userId: string) => Promise<unknown>;
+  unblock: (userId: string) => Promise<unknown>;
+  /** Invites an address without an account; the link comes back only when the server cannot email it. Inviting again sends a new link. */
+  invite: (input: {
+    email: string;
+    roles: string[];
+  }) => Promise<UserInvitationSent>;
+  invitations: () => Promise<UserInvitation[]>;
+  revoke: (invitationId: string) => Promise<unknown>;
+  /** Every role with its label, to give. */
+  roles: () => Promise<RoleLabel[]>;
+};
+export type UsersClient = ReturnType<typeof usersClient>;
+//#endregion

package/dist/users.js

@@ -0,0 +1,78 @@
+import { authError } from "./auth-error.js";
+//#region src/users.ts
+const pageSize = 20;
+const rolesOf = (role) => Array.isArray(role) ? role : (role ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+const user = (raw) => ({
+	id: raw.id,
+	name: raw.name || raw.email,
+	email: raw.email,
+	roles: rolesOf(raw.role),
+	blocked: Boolean(raw.banned),
+	createdAt: new Date(raw.createdAt).toISOString()
+});
+const invitation = (raw) => ({
+	id: raw.id,
+	email: raw.email,
+	roles: raw.roles,
+	expiresAt: new Date(raw.expiresAt).toISOString()
+});
+const sent = (raw) => ({
+	invitation: invitation(raw),
+	...raw.link && { link: raw.link }
+});
+/**
+* Managing the people who can sign in, for admins: Better Auth's admin endpoints to list, create, set roles and block,
+* and Protobase's invitations to the app, which work with or without organizations. Each call rejects with `AuthError`.
+*/
+const usersClient = (client) => {
+	const call = async (path, fallback, init = {}) => {
+		const { data, error } = await client.$fetch(path, {
+			method: init.body ? "POST" : "GET",
+			...init.body && { body: init.body },
+			...init.query && { query: init.query }
+		});
+		if (error) throw authError(error, fallback);
+		return data;
+	};
+	return {
+		/** 20 users from `offset`, oldest first, whose address contains `query`, and the total. */
+		search: async (query, offset = 0) => {
+			const found = await call("/admin/list-users", "Could not read the users", { query: {
+				limit: String(pageSize),
+				sortBy: "createdAt",
+				sortDirection: "asc",
+				...offset > 0 && { offset: String(offset) },
+				...query && {
+					searchValue: query,
+					searchField: "email"
+				}
+			} });
+			return {
+				users: found.users.map(user),
+				total: found.total
+			};
+		},
+		/** Creates an account; without a password, the person signs in another way the sign-in policy allows, such as an emailed code. */
+		create: async (input) => user((await call("/admin/create-user", "Could not create the account", { body: {
+			email: input.email,
+			name: input.name,
+			role: input.roles,
+			...input.password && { password: input.password }
+		} })).user),
+		setRoles: (userId, roles) => call("/admin/set-role", "Could not change the roles", { body: {
+			userId,
+			role: roles
+		} }),
+		/** Blocks signing in, which ends the person's sessions. */
+		block: (userId) => call("/admin/ban-user", "Could not block the account", { body: { userId } }),
+		unblock: (userId) => call("/admin/unban-user", "Could not unblock the account", { body: { userId } }),
+		/** Invites an address without an account; the link comes back only when the server cannot email it. Inviting again sends a new link. */
+		invite: async (input) => sent(await call("/users/invite", "Could not send the invitation", { body: input })),
+		invitations: async () => (await call("/users/invitations", "Could not read the invitations")).invitations.map(invitation),
+		revoke: (invitationId) => call("/users/invitations/cancel", "Could not revoke the invitation", { body: { id: invitationId } }),
+		/** Every role with its label, to give. */
+		roles: () => call("/users/roles", "Could not read the roles")
+	};
+};
+//#endregion
+export { usersClient };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.21.12",
+  "version": "0.22.1",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.21.12",
-    "@protobase/schema": "0.21.12",
+    "@protobase/layout": "0.22.1",
+    "@protobase/schema": "0.22.1",
     "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.7"
   }