@rixl/sdk 0.29.1 → 0.29.3

package/dist/index.d.ts

@@ -14856,12 +14856,11 @@ export declare const publicRespondToInvitation: (token: string, state: Membershi
 /**
  * Switches the caller's active organization.
  *
- * Identified by org id, not by `Membership.id`. The API models a membership as
- * the pair (user_id, org_id): every sibling endpoint takes `user.org_id` as a
- * path param, and this call's own `MembershipMutation` response is keyed by that
- * pair. `Membership.id` is a `user_id:org_id` concatenation that no endpoint
- * accepts — passing it here is rejected with "invalid membership ID". The
- * backend takes user_id from the bearer token.
+ * Identified by org id, not by `Membership.id`, which is a `user_id:org_id`
+ * concatenation that no endpoint accepts. The target org goes in the top-level
+ * `org_id`: the backend reads `user.org_id` as the caller's current org, so a
+ * target sent there is ignored and the call fails with "org_id is required".
+ * The backend fills `user.user_id` from the bearer token.
  */
 export declare const updateActiveMembership: (orgId: string) => Promise<void>;
 export declare const updateMemberRole: (orgId: string, userId: string, role: AssignableRole) => Promise<void>;

package/dist/index.js

@@ -3499,6 +3499,16 @@ const isTokenExpired = (expireAt) => {
 	return Date.now() >= expireAt;
 };
 
+//#endregion
+//#region src/auth/utils/requires-action.ts
+/**
+* Whether a token response is limited scope: it names an action the user must
+* take before getting full tokens (e.g. `add_email`). The gateway emits every
+* field, so a full-scope response carries `requires_action: ""` too; only a
+* non-empty value counts.
+*/
+const isLimitedScopeTokenResponse = (result) => "requires_action" in result && Boolean(result.requires_action);
+
 //#endregion
 //#region src/auth/authStore.ts
 const isLogged = shared("isLogged", () => atom(initVals["isLogged"] === "true"));
@@ -3525,7 +3535,7 @@ const login = async (provider) => {
 };
 const refreshAccessToken = async (refresh) => {
 	const result = await refreshTokens("Bearer", refresh);
-	if (!("requires_action" in result)) setTokens(result.access_token, result.refresh_token, result.expires_in);
+	if (!isLimitedScopeTokenResponse(result)) setTokens(result.access_token, result.refresh_token, result.expires_in);
 };
 const ensureValidAccessToken = async (refresh) => {
 	if (accessToken.get() && !isTokenExpired(expireAt.get())) return;
@@ -3832,9 +3842,6 @@ const initConfig = async (config) => {
 		updateTelegramAuthUrl();
 	}
 };
-const isLimitedScopeTokenResponse = (result) => {
-	return "requires_action" in result;
-};
 const applyTokenExchangeResult = (result) => {
 	if (isLimitedScopeTokenResponse(result)) {
 		setLimitedAccessState(result.access_token, result.requires_action);
@@ -4225,17 +4232,16 @@ const ROLE_TO_PROTO = {
 /**
 * Switches the caller's active organization.
 *
-* Identified by org id, not by `Membership.id`. The API models a membership as
-* the pair (user_id, org_id): every sibling endpoint takes `user.org_id` as a
-* path param, and this call's own `MembershipMutation` response is keyed by that
-* pair. `Membership.id` is a `user_id:org_id` concatenation that no endpoint
-* accepts — passing it here is rejected with "invalid membership ID". The
-* backend takes user_id from the bearer token.
+* Identified by org id, not by `Membership.id`, which is a `user_id:org_id`
+* concatenation that no endpoint accepts. The target org goes in the top-level
+* `org_id`: the backend reads `user.org_id` as the caller's current org, so a
+* target sent there is ignored and the call fails with "org_id is required".
+* The backend fills `user.user_id` from the bearer token.
 */
 const updateActiveMembership = async (orgId) => {
 	return apiCall(async () => {
 		await authV1MembershipServiceUpdateActiveMembership({
-			body: { user: { org_id: orgId } },
+			body: { org_id: orgId },
 			throwOnError: true
 		});
 		accessToken.set(void 0);