@protobase/client 0.22.0 → 0.22.2

package/dist/auth.d.ts

@@ -2,8 +2,9 @@ import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
 import { AccountSignIn, AuthenticatorSetup, Passkey } from "./account-security.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsFound } from "./organizations.js";
 import { ActiveRole } from "./roles.js";
+import { AuthUser, RoleLabel, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
+import { AppUser, UserInvitation, UserInvitationSent, UsersFound } from "./users.js";
 import { StaffSignIn } from "./staff-sign-in.js";
-import { AuthUser, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
 //#region src/auth.d.ts
 export type AuthSessionOptions = {
@@ -22,8 +23,8 @@ export declare const tokenExpiry: (token: string) => number;
 /**
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
  * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
- * sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
- * (`organizations`), the role the session acts with (`roles`), and a short-lived
+ * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
+ * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
  */
 export declare const createAuthSession: (options?: AuthSessionOptions) => {
@@ -107,6 +108,25 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
     read: () => Promise<SignInPolicyState>;
     save: (policy: SignInPolicy) => Promise<SignInPolicyState>;
   };
+  users: {
+    search: (query: string, offset?: number) => Promise<UsersFound>;
+    create: (input: {
+      email: string;
+      name: string;
+      password?: string;
+      roles: string[];
+    }) => Promise<AppUser>;
+    setRoles: (userId: string, roles: string[]) => Promise<unknown>;
+    block: (userId: string) => Promise<unknown>;
+    unblock: (userId: string) => Promise<unknown>;
+    invite: (input: {
+      email: string;
+      roles: string[];
+    }) => Promise<UserInvitationSent>;
+    invitations: () => Promise<UserInvitation[]>;
+    revoke: (invitationId: string) => Promise<unknown>;
+    roles: () => Promise<RoleLabel[]>;
+  };
   staff: {
     stop: () => Promise<void>;
     start: (input: {

package/dist/auth.js

@@ -3,6 +3,7 @@ import { accountSecurity } from "./account-security.js";
 import { betterAuthClient } from "./better-auth-client.js";
 import { organizationsClient } from "./organizations.js";
 import { rolesClient } from "./roles.js";
+import { usersClient } from "./users.js";
 import { signInFlows } from "./sign-in-flows.js";
 import { signInPolicyClient } from "./sign-in-policy.js";
 import { staffSignInClient } from "./staff-sign-in.js";
@@ -18,8 +19,8 @@ const tokenExpiry = (token) => {
 /**
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
 * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
-* sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
-* (`organizations`), the role the session acts with (`roles`), and a short-lived
+* sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
+* signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
 */
 const createAuthSession = (options = {}) => {
@@ -149,6 +150,7 @@ const createAuthSession = (options = {}) => {
 		organizations: organizationsClient(client, () => token({ refresh: true })),
 		roles: rolesClient(client, () => token({ refresh: true })),
 		signInPolicy: signInPolicyClient(client),
+		users: usersClient(client),
 		staff: {
 			...staff,
 			stop: async () => {

package/dist/index.d.ts

@@ -11,11 +11,12 @@ import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffA
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient, OrganizationsFound } from "./organizations.js";
 import { ActiveRole, RoleOption, RolesClient } from "./roles.js";
-import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
 import { AuthUser, PlatformSignIn, RoleLabel, SamlSignIn, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
+import { AppUser, UserInvitation, UserInvitationSent, UsersClient, UsersFound } from "./users.js";
+import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
 import { AuthError } from "./auth-error.js";
 import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from "./auth.js";
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimeLastUpdate, RuntimePolicy, RuntimeStatus, RuntimeUpdateStage, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type CurrentOrganization, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type CurrentOrganization, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/organizations.d.ts

@@ -44,9 +44,15 @@ export type OrganizationInvitation = {
   expiresAt: string;
   organizationName?: string;
 };
-/** An invitation as its link shows it, before it is accepted. */
+/**
+ * An invitation as its link shows it, before it is accepted. One to the app itself, rather than to an organization, has
+ * `app` in place of `organization` and `role`, and `appRoles` are the roles its account gets.
+ */
 export type InvitationPreview = {
-  organization: {
+  app?: {
+    name: string;
+  };
+  organization?: {
     id: string;
     name: string;
   };
@@ -54,7 +60,7 @@ export type InvitationPreview = {
     name: string;
   };
   email: string;
-  role: OrganizationRole;
+  role?: OrganizationRole;
   appRoles: string[];
   expiresAt: string;
   hasAccount: boolean;
@@ -110,11 +116,11 @@ export declare const organizationsClient: (client: BetterAuthClient, refreshToke
   revoke: (invitationId: string) => Promise<unknown>;
   /** The pending invitations for the person's own address. */
   myInvitations: () => Promise<OrganizationInvitation[]>;
-  /** What an invitation link is for; works signed out. */
+  /** What an invitation link is for, to an organization or to the app; works signed out. */
   invitation: (token: string) => Promise<InvitationPreview>;
   /** Accepts an invitation signed in as its address, and works in its organization. */
   accept: (token: string) => Promise<unknown>;
-  /** Creates an account for an invited address without one, accepts the invitation and signs in. */
+  /** Creates an account for an invited address without one, accepts the invitation and signs in; for either kind of invitation. */
   signUpFromInvitation: (token: string, input: {
     name: string;
     password?: string;

package/dist/organizations.js

@@ -113,11 +113,11 @@ const organizationsClient = (client, refreshToken) => {
 		revoke: (invitationId) => call("/organization/cancel-invitation", "Could not revoke the invitation", { body: { invitationId } }),
 		/** The pending invitations for the person's own address. */
 		myInvitations: async () => (await call("/organization/list-user-invitations", "Could not read your invitations") ?? []).map(invitation),
-		/** What an invitation link is for; works signed out. */
+		/** What an invitation link is for, to an organization or to the app; works signed out. */
 		invitation: (token) => call("/invitation", "This invitation link is not valid", { query: { token } }),
 		/** Accepts an invitation signed in as its address, and works in its organization. */
 		accept: async (token) => thenRefresh(await call("/invitation/accept", "Could not accept the invitation", { body: { token } })),
-		/** Creates an account for an invited address without one, accepts the invitation and signs in. */
+		/** Creates an account for an invited address without one, accepts the invitation and signs in; for either kind of invitation. */
 		signUpFromInvitation: async (token, input) => thenRefresh(await call("/invitation/sign-up", "Could not create your account", { body: {
 			token,
 			...input

package/dist/static-session.js

@@ -91,6 +91,20 @@ const createStaticSession = (token, user = {
 		}),
 		switchTo: unsupported("switch roles")
 	},
+	users: {
+		search: async () => ({
+			users: [],
+			total: 0
+		}),
+		create: unsupported("create an account"),
+		setRoles: unsupported("change roles"),
+		block: unsupported("block an account"),
+		unblock: unsupported("unblock an account"),
+		invite: unsupported("invite people"),
+		invitations: async () => [],
+		revoke: unsupported("revoke an invitation"),
+		roles: async () => []
+	},
 	organizations: {
 		list: async () => [],
 		current: async () => ({

package/dist/users.d.ts

@@ -0,0 +1,59 @@
+import { BetterAuthClient } from "./better-auth-client.js";
+import { RoleLabel } from "./auth-types.js";
+//#region src/users.d.ts
+/** Someone who can sign in, as an admin sees them: their roles, and whether they are blocked from signing in. */
+export type AppUser = {
+  id: string;
+  name: string;
+  email: string;
+  roles: string[];
+  blocked: boolean;
+  createdAt: string;
+};
+/** A page of users and how many there are in all. */
+export type UsersFound = {
+  users: AppUser[];
+  total: number;
+};
+/** A pending invitation to the app, to make an account with `roles`. */
+export type UserInvitation = {
+  id: string;
+  email: string;
+  roles: string[];
+  expiresAt: string;
+};
+/** What inviting gives back: the invitation, and its link when the server cannot email it. */
+export type UserInvitationSent = {
+  invitation: UserInvitation;
+  link?: string;
+};
+/**
+ * Managing the people who can sign in, for admins: Better Auth's admin endpoints to list, create, set roles and block,
+ * and Protobase's invitations to the app, which work with or without organizations. Each call rejects with `AuthError`.
+ */
+export declare const usersClient: (client: BetterAuthClient) => {
+  /** 20 users from `offset`, oldest first, whose address contains `query`, and the total. */
+  search: (query: string, offset?: number) => Promise<UsersFound>;
+  /** Creates an account; without a password, the person signs in another way the sign-in policy allows, such as an emailed code. */
+  create: (input: {
+    email: string;
+    name: string;
+    password?: string;
+    roles: string[];
+  }) => Promise<AppUser>;
+  setRoles: (userId: string, roles: string[]) => Promise<unknown>;
+  /** Blocks signing in, which ends the person's sessions. */
+  block: (userId: string) => Promise<unknown>;
+  unblock: (userId: string) => Promise<unknown>;
+  /** Invites an address without an account; the link comes back only when the server cannot email it. Inviting again sends a new link. */
+  invite: (input: {
+    email: string;
+    roles: string[];
+  }) => Promise<UserInvitationSent>;
+  invitations: () => Promise<UserInvitation[]>;
+  revoke: (invitationId: string) => Promise<unknown>;
+  /** Every role with its label, to give. */
+  roles: () => Promise<RoleLabel[]>;
+};
+export type UsersClient = ReturnType<typeof usersClient>;
+//#endregion

package/dist/users.js

@@ -0,0 +1,78 @@
+import { authError } from "./auth-error.js";
+//#region src/users.ts
+const pageSize = 20;
+const rolesOf = (role) => Array.isArray(role) ? role : (role ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+const user = (raw) => ({
+	id: raw.id,
+	name: raw.name || raw.email,
+	email: raw.email,
+	roles: rolesOf(raw.role),
+	blocked: Boolean(raw.banned),
+	createdAt: new Date(raw.createdAt).toISOString()
+});
+const invitation = (raw) => ({
+	id: raw.id,
+	email: raw.email,
+	roles: raw.roles,
+	expiresAt: new Date(raw.expiresAt).toISOString()
+});
+const sent = (raw) => ({
+	invitation: invitation(raw),
+	...raw.link && { link: raw.link }
+});
+/**
+* Managing the people who can sign in, for admins: Better Auth's admin endpoints to list, create, set roles and block,
+* and Protobase's invitations to the app, which work with or without organizations. Each call rejects with `AuthError`.
+*/
+const usersClient = (client) => {
+	const call = async (path, fallback, init = {}) => {
+		const { data, error } = await client.$fetch(path, {
+			method: init.body ? "POST" : "GET",
+			...init.body && { body: init.body },
+			...init.query && { query: init.query }
+		});
+		if (error) throw authError(error, fallback);
+		return data;
+	};
+	return {
+		/** 20 users from `offset`, oldest first, whose address contains `query`, and the total. */
+		search: async (query, offset = 0) => {
+			const found = await call("/admin/list-users", "Could not read the users", { query: {
+				limit: String(pageSize),
+				sortBy: "createdAt",
+				sortDirection: "asc",
+				...offset > 0 && { offset: String(offset) },
+				...query && {
+					searchValue: query,
+					searchField: "email"
+				}
+			} });
+			return {
+				users: found.users.map(user),
+				total: found.total
+			};
+		},
+		/** Creates an account; without a password, the person signs in another way the sign-in policy allows, such as an emailed code. */
+		create: async (input) => user((await call("/admin/create-user", "Could not create the account", { body: {
+			email: input.email,
+			name: input.name,
+			role: input.roles,
+			...input.password && { password: input.password }
+		} })).user),
+		setRoles: (userId, roles) => call("/admin/set-role", "Could not change the roles", { body: {
+			userId,
+			role: roles
+		} }),
+		/** Blocks signing in, which ends the person's sessions. */
+		block: (userId) => call("/admin/ban-user", "Could not block the account", { body: { userId } }),
+		unblock: (userId) => call("/admin/unban-user", "Could not unblock the account", { body: { userId } }),
+		/** Invites an address without an account; the link comes back only when the server cannot email it. Inviting again sends a new link. */
+		invite: async (input) => sent(await call("/users/invite", "Could not send the invitation", { body: input })),
+		invitations: async () => (await call("/users/invitations", "Could not read the invitations")).invitations.map(invitation),
+		revoke: (invitationId) => call("/users/invitations/cancel", "Could not revoke the invitation", { body: { id: invitationId } }),
+		/** Every role with its label, to give. */
+		roles: () => call("/users/roles", "Could not read the roles")
+	};
+};
+//#endregion
+export { usersClient };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.22.0",
-    "@protobase/schema": "0.22.0",
+    "@protobase/layout": "0.22.2",
+    "@protobase/schema": "0.22.2",
     "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.7"
   }