@rivium/chat 0.1.1 → 0.1.2

package/README.md

@@ -79,6 +79,28 @@ const summary = await riviumChat.rooms.getUnreadSummary('user-1');
 
 ## API Reference
 
+### Users — verified identity (recommended)
+
+Your API key ships inside every app, so it cannot prove who a user is. Mint a
+short-lived token here and hand it to the client SDK's `tokenProvider`:
+
+```typescript
+// Express example — your own login protects the route
+app.get('/chat-token', requireLogin, async (req, res) => {
+  const { token } = await riviumChat.users.createToken({ userId: req.user.id });
+  res.json({ token });
+});
+```
+
+```typescript
+riviumChat.users.createToken({ userId, info?, ttl? })  // 1 h default, 24 h max
+riviumChat.users.revokeTokens(userId)                  // on logout, password change, ban
+```
+
+`revokeTokens` invalidates every token issued to that user so far; it takes
+effect within about 15 seconds across servers. Client SDKs then ask your
+endpoint for a new token, so a signed-out user gets nothing.
+
 ### Rooms
 
 ```typescript

package/dist/index.d.ts

@@ -4,6 +4,7 @@ import { Reactions } from './modules/reactions';
 import { Pins } from './modules/pins';
 import { Webhooks } from './modules/webhooks';
 import { Tokens } from './modules/tokens';
+import { Users } from './modules/users';
 import { RiviumChatConfig } from './types';
 export declare class RiviumChat {
     private client;
@@ -19,6 +20,8 @@ export declare class RiviumChat {
     webhooks: Webhooks;
     /** Centrifugo connection tokens */
     tokens: Tokens;
+    /** User tokens — verified identity for your client apps */
+    users: Users;
     constructor(config: RiviumChatConfig);
 }
 export { RiviumChatError } from './client';

package/dist/index.js

@@ -22,6 +22,7 @@ const reactions_1 = require("./modules/reactions");
 const pins_1 = require("./modules/pins");
 const webhooks_1 = require("./modules/webhooks");
 const tokens_1 = require("./modules/tokens");
+const users_1 = require("./modules/users");
 class RiviumChat {
     constructor(config) {
         this.client = new client_1.HttpClient(config);
@@ -31,6 +32,7 @@ class RiviumChat {
         this.pins = new pins_1.Pins(this.client);
         this.webhooks = new webhooks_1.Webhooks(this.client);
         this.tokens = new tokens_1.Tokens(this.client);
+        this.users = new users_1.Users(this.client);
     }
 }
 exports.RiviumChat = RiviumChat;

package/dist/modules/users.d.ts

@@ -0,0 +1,31 @@
+import { HttpClient } from '../client';
+import { CreateUserTokenOptions, UserToken, RevokeTokensResult } from '../types';
+/**
+ * User tokens — how your app proves **who** the user is.
+ *
+ * Your API key ships inside every app, so it cannot identify a user. Mint a
+ * short-lived token here (server-side, with your server secret) and hand it to
+ * the client SDK's `tokenProvider`. The client SDKs refresh it automatically.
+ */
+export declare class Users {
+    private client;
+    constructor(client: HttpClient);
+    /**
+     * Creates a token for one of your users. Expires in 1 hour by default
+     * (`ttl` seconds, max 24 hours).
+     *
+     * ```ts
+     * app.get('/chat-token', requireLogin, async (req, res) => {
+     *   const { token } = await chat.users.createToken({ userId: req.user.id });
+     *   res.json({ token });
+     * });
+     * ```
+     */
+    createToken(options: CreateUserTokenOptions): Promise<UserToken>;
+    /**
+     * Invalidates every token issued to this user so far — call it on logout,
+     * password change or ban. Tokens already in the user's hands stop working
+     * within seconds, for REST and realtime alike.
+     */
+    revokeTokens(userId: string): Promise<RevokeTokensResult>;
+}

package/dist/modules/users.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Users = void 0;
+/**
+ * User tokens — how your app proves **who** the user is.
+ *
+ * Your API key ships inside every app, so it cannot identify a user. Mint a
+ * short-lived token here (server-side, with your server secret) and hand it to
+ * the client SDK's `tokenProvider`. The client SDKs refresh it automatically.
+ */
+class Users {
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Creates a token for one of your users. Expires in 1 hour by default
+     * (`ttl` seconds, max 24 hours).
+     *
+     * ```ts
+     * app.get('/chat-token', requireLogin, async (req, res) => {
+     *   const { token } = await chat.users.createToken({ userId: req.user.id });
+     *   res.json({ token });
+     * });
+     * ```
+     */
+    async createToken(options) {
+        return this.client.post('/api/v1/users/token', options);
+    }
+    /**
+     * Invalidates every token issued to this user so far — call it on logout,
+     * password change or ban. Tokens already in the user's hands stop working
+     * within seconds, for REST and realtime alike.
+     */
+    async revokeTokens(userId) {
+        return this.client.post(`/api/v1/users/${encodeURIComponent(userId)}/revoke-tokens`);
+    }
+}
+exports.Users = Users;

package/dist/types.d.ts

@@ -160,3 +160,22 @@ export interface GetTokenOptions {
     userId: string;
     info?: Record<string, any>;
 }
+export interface CreateUserTokenOptions {
+    /** Your own id for the user the token is for. */
+    userId: string;
+    /** Public connection info (e.g. displayName) visible to the realtime layer. */
+    info?: Record<string, any>;
+    /** Lifetime in seconds. Default 3600 (1 h), max 86400 (24 h). */
+    ttl?: number;
+}
+export interface UserToken {
+    /** Hand this to the client SDK's tokenProvider. */
+    token: string;
+    /** ISO timestamp; the client SDKs refresh shortly before it. */
+    expiresAt: string;
+    userId: string;
+}
+export interface RevokeTokensResult {
+    /** Tokens issued at or before this moment are no longer accepted. */
+    revokedBefore: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rivium/chat",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "RiviumChat Node.js SDK — server-side chat rooms, messages, reactions, pins, and webhooks",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",