@remit/api-openapi-spec 0.0.81 → 0.0.82

package/openapi.json

@@ -6058,6 +6058,378 @@
         }
       }
     },
+    "/people": {
+      "get": {
+        "operationId": "PeopleOperations_listPeople",
+        "description": "List everyone who signs in to this instance, ordered by email. Self-host only, and absent (404) while self sign-up is open.",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.PeopleListResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The request carried no usable credential. `code` is `unauthorized`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The People operation is refused for the caller. `code` is one of\n`sign_in_disabled` (the kill switch is on), `caller_disabled` (the caller's\naccount is disabled or gone), `foreign_origin` (an unsafe request from an\norigin this instance does not serve), `step_up_required` (the step-up token\nis missing, spent, expired, or bound to another caller, action or person) and\n`wrong_password` (the step-up password is wrong).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Nothing answers to this address, or the caller may not learn that something does. `code` is `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/people/step-up": {
+      "post": {
+        "operationId": "PeopleOperations_createStepUp",
+        "description": "Trade the caller's current password for a single-use token that allows one action on one person for five minutes. Five wrong passwords in 15 minutes refuse further step-ups with 429. Absent (404) while self sign-up is open, or when the person does not exist.",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.StepUpResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The request carried no usable credential. `code` is `unauthorized`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The People operation is refused for the caller. `code` is one of\n`sign_in_disabled` (the kill switch is on), `caller_disabled` (the caller's\naccount is disabled or gone), `foreign_origin` (an unsafe request from an\norigin this instance does not serve), `step_up_required` (the step-up token\nis missing, spent, expired, or bound to another caller, action or person) and\n`wrong_password` (the step-up password is wrong).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Nothing answers to this address, or the caller may not learn that something does. `code` is `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Five wrong step-up passwords in 15 minutes. `code` is `step_up_locked`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.StepUpInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/people/{userId}": {
+      "patch": {
+        "operationId": "PeopleOperations_updatePerson",
+        "description": "Disable or enable the person. Needs a `Disable` or `Enable` step-up for this person. Refused with 409 `cannot_disable_self` when the caller disables themselves.",
+        "parameters": [
+          {
+            "name": "userId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.Person"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The request carried no usable credential. `code` is `unauthorized`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The People operation is refused for the caller. `code` is one of\n`sign_in_disabled` (the kill switch is on), `caller_disabled` (the caller's\naccount is disabled or gone), `foreign_origin` (an unsafe request from an\norigin this instance does not serve), `step_up_required` (the step-up token\nis missing, spent, expired, or bound to another caller, action or person) and\n`wrong_password` (the step-up password is wrong).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Nothing answers to this address, or the caller may not learn that something does. `code` is `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "A person cannot disable themselves. `code` is `cannot_disable_self`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.UpdatePersonInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/people/{userId}/password-reset": {
+      "post": {
+        "operationId": "PeopleOperations_createPasswordReset",
+        "description": "Issue a single-use password reset link for the person, valid 24 hours. Needs a `ResetPassword` step-up for this person. The person's old password stops working and their sessions are revoked.",
+        "parameters": [
+          {
+            "name": "userId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.PasswordResetResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The request carried no usable credential. `code` is `unauthorized`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The People operation is refused for the caller. `code` is one of\n`sign_in_disabled` (the kill switch is on), `caller_disabled` (the caller's\naccount is disabled or gone), `foreign_origin` (an unsafe request from an\norigin this instance does not serve), `step_up_required` (the step-up token\nis missing, spent, expired, or bound to another caller, action or person) and\n`wrong_password` (the step-up password is wrong).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Nothing answers to this address, or the caller may not learn that something does. `code` is `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.CreatePasswordResetInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
+    "/people/{userId}/sign-out": {
+      "post": {
+        "operationId": "PeopleOperations_signOutPerson",
+        "description": "Sign the person out of every browser session and MCP connection. Needs a `SignOut` step-up for this person. A JWT already minted works until it expires, at most 15 minutes.",
+        "parameters": [
+          {
+            "name": "userId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The request has succeeded.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RemitImap.Person"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The request carried no usable credential. `code` is `unauthorized`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The People operation is refused for the caller. `code` is one of\n`sign_in_disabled` (the kill switch is on), `caller_disabled` (the caller's\naccount is disabled or gone), `foreign_origin` (an unsafe request from an\norigin this instance does not serve), `step_up_required` (the step-up token\nis missing, spent, expired, or bound to another caller, action or person) and\n`wrong_password` (the step-up password is wrong).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Nothing answers to this address, or the caller may not learn that something does. `code` is `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RemitImap.SignOutPersonInput"
+              }
+            }
+          }
+        },
+        "x-amazon-apigateway-integration": {
+          "type": "aws_proxy",
+          "httpMethod": "POST",
+          "passthroughBehavior": "when_no_match",
+          "uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:{{HandlerFunctionName}}/invocations"
+          }
+        }
+      }
+    },
     "/settings": {
       "get": {
         "operationId": "UserSettingsOperations_getUserSettings",
@@ -9825,6 +10197,18 @@
         },
         "description": "Input for creating an outbox message"
       },
+      "RemitImap.CreatePasswordResetInput": {
+        "type": "object",
+        "required": [
+          "stepUpToken"
+        ],
+        "properties": {
+          "stepUpToken": {
+            "type": "string"
+          }
+        },
+        "description": "Issue a password reset link for the person. Their old password stops working and their sessions are revoked."
+      },
       "RemitImap.DeleteAccountConfigResponse": {
         "type": "object",
         "required": [
@@ -11867,6 +12251,29 @@
         ],
         "description": "Status of an outbox message in the send queue"
       },
+      "RemitImap.PasswordResetResponse": {
+        "type": "object",
+        "required": [
+          "person",
+          "resetUrl",
+          "expiresAt"
+        ],
+        "properties": {
+          "person": {
+            "$ref": "#/components/schemas/RemitImap.Person"
+          },
+          "resetUrl": {
+            "type": "string",
+            "description": "The single-use reset link. It exists only in this response."
+          },
+          "expiresAt": {
+            "type": "integer",
+            "format": "int64",
+            "description": "When the link stops working, epoch milliseconds: issue time plus 24 hours."
+          }
+        },
+        "description": "The person, and the reset link to hand them. The link is shown once and works once."
+      },
       "RemitImap.PendingConfigImport": {
         "type": "object",
         "required": [
@@ -11892,6 +12299,79 @@
         },
         "description": "An import that is still waiting for IMAP discovery to produce the folders its\nfile named. The folder appointed to a role, a folder's own display name or\nmute, and a filter's move destination are all bound by path; a path this\naccount does not hold yet is kept, not guessed, and bound the moment discovery\nfinds it."
       },
+      "RemitImap.PeopleListResponse": {
+        "type": "object",
+        "required": [
+          "people"
+        ],
+        "properties": {
+          "people": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RemitImap.Person"
+            }
+          }
+        },
+        "description": "Everyone who signs in to this instance, ordered by email."
+      },
+      "RemitImap.Person": {
+        "type": "object",
+        "required": [
+          "userId",
+          "email",
+          "createdAt",
+          "lastSignInAt",
+          "sessionCount",
+          "status",
+          "isCaller"
+        ],
+        "properties": {
+          "userId": {
+            "type": "string",
+            "description": "The person's user id."
+          },
+          "email": {
+            "type": "string",
+            "description": "The address the person signs in with."
+          },
+          "createdAt": {
+            "type": "integer",
+            "format": "int64",
+            "description": "When the account was created, epoch milliseconds."
+          },
+          "lastSignInAt": {
+            "type": "integer",
+            "format": "int64",
+            "description": "When the person last signed in, epoch milliseconds."
+          },
+          "sessionCount": {
+            "type": "integer",
+            "format": "int32",
+            "description": "Unexpired browser sessions the person holds."
+          },
+          "status": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RemitImap.PersonStatus"
+              }
+            ],
+            "description": "Whether the person may sign in."
+          },
+          "isCaller": {
+            "type": "boolean",
+            "description": "Whether this row is the caller."
+          }
+        },
+        "description": "One person who signs in to this self-hosted instance."
+      },
+      "RemitImap.PersonStatus": {
+        "type": "string",
+        "enum": [
+          "Active",
+          "Disabled"
+        ],
+        "description": "Whether a person may sign in. A disabled person's sessions, MCP grants and calendar feeds are revoked, and every sign-in is refused."
+      },
       "RemitImap.PlacementAction": {
         "type": "string",
         "enum": [
@@ -12245,6 +12725,18 @@
         ],
         "description": "Trust level for the From address, derived at read time from AddressFlags + counters."
       },
+      "RemitImap.SignOutPersonInput": {
+        "type": "object",
+        "required": [
+          "stepUpToken"
+        ],
+        "properties": {
+          "stepUpToken": {
+            "type": "string"
+          }
+        },
+        "description": "Sign the person out of every browser session and MCP connection."
+      },
       "RemitImap.SortOrder": {
         "type": "string",
         "enum": [
@@ -12324,6 +12816,56 @@
         ],
         "description": "Gmail-style star colors for message/thread marking"
       },
+      "RemitImap.StepUpAction": {
+        "type": "string",
+        "enum": [
+          "SignOut",
+          "Disable",
+          "Enable",
+          "ResetPassword"
+        ],
+        "description": "The operation a step-up token is spent on. `updatePerson` maps `Disabled` to `Disable` and `Active` to `Enable`."
+      },
+      "RemitImap.StepUpInput": {
+        "type": "object",
+        "required": [
+          "password",
+          "action",
+          "userId"
+        ],
+        "properties": {
+          "password": {
+            "type": "string",
+            "description": "The caller's own current password."
+          },
+          "action": {
+            "$ref": "#/components/schemas/RemitImap.StepUpAction"
+          },
+          "userId": {
+            "type": "string",
+            "description": "The person the token will act on."
+          }
+        },
+        "description": "The caller's current password, and the one action on one person the token will allow."
+      },
+      "RemitImap.StepUpResponse": {
+        "type": "object",
+        "required": [
+          "stepUpToken",
+          "expiresAt"
+        ],
+        "properties": {
+          "stepUpToken": {
+            "type": "string"
+          },
+          "expiresAt": {
+            "type": "integer",
+            "format": "int64",
+            "description": "When the token stops working, epoch milliseconds."
+          }
+        },
+        "description": "A single-use token for one action on one person. Spend it at once; it is never stored by the client."
+      },
       "RemitImap.SyncPhase": {
         "type": "string",
         "enum": [
@@ -13619,6 +14161,22 @@
         },
         "description": "Input for updating a draft outbox message"
       },
+      "RemitImap.UpdatePersonInput": {
+        "type": "object",
+        "required": [
+          "status",
+          "stepUpToken"
+        ],
+        "properties": {
+          "status": {
+            "$ref": "#/components/schemas/RemitImap.PersonStatus"
+          },
+          "stepUpToken": {
+            "type": "string"
+          }
+        },
+        "description": "Disable or enable the person. Disabling also revokes their sessions, MCP grants and calendar feeds."
+      },
       "RemitImap.UpdateUserSettingsInput": {
         "type": "object",
         "properties": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/api-openapi-spec",
-  "version": "0.0.81",
+  "version": "0.0.82",
   "description": "Remit API OpenAPI 3 document, generated from TypeSpec, and its precompiled request validators.",
   "exports": {
     ".": "./openapi.json",