@pryv/delegation 3.14.2 → 3.16.0

package/README.md

@@ -103,6 +103,8 @@ const created = await delegation.createAccount({
 
 ## Detach requires a genuine login on B
 
+When the delegate accepted cross-account consents for the account, the owner may keep some of them: `detachDelegate('parent-b', { keepAccessIds: ['<grant id>'] })` (core 2.0.0-rc.31 or later; each id must be a consent grant given through this relationship, else `delegation-invalid-keep-list` and nothing changes). The others are withdrawn and their requesters told.
+
 `detachDelegate` and `cancelInvite` remove a delegation relationship, so they require the account owner to be **genuinely logged in** to the controlled account — a delegate PAT or a control token is rejected. A delegated session therefore cannot walk away with, or tear down, the relationship on its own.
 
 The rejection surfaces as a typed [`DelegationError`](#typed-errors) with `id === delegationErrorIds.GENUINE_LOGIN_REQUIRED`. Surface it distinctly in your UI:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pryv/delegation",
-  "version": "3.14.2",
+  "version": "3.16.0",
   "description": "Account-delegation client helpers for Pryv.io",
   "keywords": [
     "Pryv",

package/src/index.d.ts

@@ -137,7 +137,8 @@ declare module '@pryv/delegation' {
     requestAttach(delegateUsername: string): Promise<DelegationRecord>;
     cancelInvite(delegateUsername: string): Promise<void>;
     listDelegates(): Promise<DelegateRecord[]>;
-    detachDelegate(delegateUsername: string): Promise<void>;
+    /** `opts.keepAccessIds`: consent grants the delegate gave that the owner keeps (core 2.0.0-rc.31+). */
+    detachDelegate(delegateUsername: string, opts?: { keepAccessIds?: string[] }): Promise<void>;
 
     // A side (the delegate)
     acceptAttach(controlledUsername: string): Promise<DelegationRecord>;

package/src/index.js

@@ -243,11 +243,23 @@ class Delegation {
    * — surface it distinctly so the UI can explain the account owner must log
    * in directly (not through a delegated session) to remove a delegate.
    *
+   * The account owner may keep consent grants the delegate gave (core
+   * 2.0.0-rc.31 or later): `opts.keepAccessIds` lists them; every other
+   * consent grant of the relationship is withdrawn. Each id must be such a
+   * grant, else `delegation-invalid-keep-list` and nothing is changed. An
+   * older core ignores the list and withdraws them all.
+   *
    * @param {string} delegateUsername  the delegate to detach.
+   * @param {Object} [opts]
+   * @param {string[]} [opts.keepAccessIds]  consent grants the owner keeps.
    * @returns {Promise<void>}
    */
-  async detachDelegate (delegateUsername) {
-    await this._apiOne('delegations.detachDelegate', { username: delegateUsername });
+  async detachDelegate (delegateUsername, opts) {
+    const params = { username: delegateUsername };
+    if (opts != null && Array.isArray(opts.keepAccessIds) && opts.keepAccessIds.length > 0) {
+      params.keepAccessIds = opts.keepAccessIds.slice();
+    }
+    await this._apiOne('delegations.detachDelegate', params);
   }
 
   // ---- A side (the delegate) --------------------------------------------

package/test/delegation.test.js

@@ -168,6 +168,15 @@ describe('[DELM] @pryv/delegation method → endpoint mapping', function () {
       expect(conn.calls[0].method).to.equal('delegations.detachDelegate');
       expect(conn.calls[0].params).to.deep.equal({ username: 'bob' });
     });
+
+    it('[LCI2] detachDelegate passes keepAccessIds through, and sends none for an empty list', async function () {
+      const conn = makeStubConnection({ handlers: { 'delegations.detachDelegate': function () { return {}; } } });
+      const d = Delegation.fromConnection(conn);
+      await d.detachDelegate('bob', { keepAccessIds: ['g1', 'g2'] });
+      expect(conn.calls[0].params).to.deep.equal({ username: 'bob', keepAccessIds: ['g1', 'g2'] });
+      await d.detachDelegate('bob', { keepAccessIds: [] });
+      expect(conn.calls[1].params).to.deep.equal({ username: 'bob' });
+    });
   });
 
   describe('[DELMA] A-side (delegate)', function () {