@samyx/preview-stacks-client 0.29.0 → 0.31.0

package/dist/index.d.ts

@@ -173,21 +173,29 @@ export declare function createClient(opts: ClientOptions): {
      * to call — this is the configuration around it.
      */
     sso: {
-        /** `clientSecret` comes back as a mask. There is no route that returns the real one. */
+        /** Every stored provider (secrets never come back — `secretSet` is all a read learns). */
         config: () => Promise<SsoConfigResponse>;
         /**
-         * Save. Omit `clientSecret` (or send the mask back) to keep the stored one. For `mode: 'oidc'`
-         * the issuer is fetched here, so a bad one is a 400 now rather than a failed login later.
+         * Save one provider under `key`, a lowercase slug. `key` may be omitted on a host with at
+         * most one provider — an empty host derives it from the config, a one-provider host replaces
+         * that one — which is what PUT meant before keys existed; with several it is a 400. Omit
+         * `clientSecret` to keep that key's stored one. For `mode: 'oidc'` the issuer is fetched
+         * here, so a bad one is a 400 now rather than a failed login later.
          */
         save: (config: Partial<SsoConfig> & {
+            key?: string;
             clientSecret?: string;
         }) => Promise<{
             ok: true;
+            key: string;
             config: SsoConfig;
             callbackUrl: string;
         }>;
-        /** Forget the provider. Nobody is deleted — accounts it created keep working. */
-        remove: () => Promise<{
+        /**
+         * Forget one provider — or the only one, when `key` is omitted (a 400 names the keys when
+         * there are several). Nobody is deleted — accounts it created keep working.
+         */
+        remove: (key?: string) => Promise<{
             ok: true;
         }>;
     };

package/dist/index.js

@@ -93,7 +93,7 @@ function createClient(opts) {
     sso: {
       config: () => get("/api/sso/config"),
       save: (config) => put("/api/sso/config", config),
-      remove: () => del("/api/sso/config")
+      remove: (key) => del(key ? `/api/sso/config/${enc(key)}` : "/api/sso/config")
     },
     jobs: {
       list: () => get("/api/jobs").then((r) => r.jobs),

package/dist/types.d.ts

@@ -34,10 +34,17 @@ export type Health = {
     /** False only in loopback dev mode, where the server refuses to bind off-localhost. */
     authEnforced: boolean;
     hasUsers?: boolean;
-    /** The configured identity provider, or null. Readable BEFORE authenticating — a login page needs it. */
+    /**
+     * The ENABLED sign-in providers, or null when there are none. Readable BEFORE authenticating —
+     * a login page needs one button per entry. `key` is what `/api/auth/sso/start?provider=` takes;
+     * `preset` is the preset the config came from (`''` for a bare OIDC issuer), for an icon.
+     */
     sso?: {
-        enabled: boolean;
-        label: string;
+        providers: Array<{
+            key: string;
+            label: string;
+            preset: string;
+        }>;
     } | null;
     dataDir: string;
     version: string;
@@ -183,6 +190,8 @@ export type RuntimeContainer = {
     node?: string | null;
     /** A swarm task on ANOTHER node: listed, but out of reach of exec/stop from the manager. */
     remote?: boolean;
+    /** A one-shot swarm service's synthetic row (0.31.0+): container verbs have nothing to act on. */
+    job?: boolean;
 };
 export type RuntimeRoute = {
     router: string;
@@ -293,28 +302,63 @@ export type SsoConfig = {
     userInfoUrl: string;
     /** Consulted only when the profile carries no address (GitHub's default). */
     emailsUrl: string;
+    /** Where the provider lists this user's groups/orgs. Preset-filled; only read when `requiredGroups` is set. */
+    groupsUrl: string;
     scopes: string;
     claimMap: SsoClaimMap;
-    /** Non-empty ⇒ a login outside these domains is refused, INCLUDING one with no address at all. */
+    /**
+     * The three sign-in rules. Each list is ANY-OF, and the three are ANDed with each other. An empty
+     * list is no constraint; a non-empty one FAILS CLOSED — a login the rule cannot be evaluated
+     * against is refused, not waved through.
+     */
     allowedEmailDomains: string[];
+    /**
+     * Glob patterns (`path.Match` semantics, so `*`, `?` and `[a-z]` all work), matched case-folded
+     * against the provider's username. Inert on a provider that supplies no username claim, which
+     * many bare OIDC providers do not — and inert here means every login is refused, not admitted.
+     */
+    allowedUsernames: string[];
+    /**
+     * Group/org names, matched exactly and case-folded. Setting this requires a provider whose preset
+     * knows a groups endpoint, and scopes that can read it — the server refuses the save otherwise
+     * rather than letting every later login fail.
+     */
+    requiredGroups: string[];
     defaultRole: string;
 };
 export type SsoPreset = {
     key: string;
     label: string;
+    /** How the provider is talked to; the config's mode defaults from it. */
+    mode: 'oidc' | 'oauth2';
+    /** Login-page button text ("Continue with GitHub"). */
+    buttonLabel: string;
+    /** Where the operator registers the OAuth app, and the walkthrough to show beside the form. */
+    setupUrl: string;
+    setupHint: string;
+    /**
+     * The issuer, for an oidc preset (`''` otherwise). One containing `<` is a TEMPLATE — render it
+     * as a field for the operator to fill in; the server refuses it verbatim.
+     */
+    discoveryUrl: string;
     authorizeUrl: string;
     tokenUrl: string;
-    userInfoUrl: string | null;
+    userInfoUrl: string;
     scopes: string;
     claimMap: SsoClaimMap;
 };
+/** One stored provider, under its operator-chosen slug. */
+export type SsoProviderEntry = {
+    key: string;
+    config: SsoConfig;
+    /** All a read learns about the client secret — the value has no read path. */
+    secretSet: boolean;
+    updatedAt: number;
+};
 export type SsoConfigResponse = {
-    configured: boolean;
-    /** Register THIS with the provider, byte for byte. Built server-side; never guess it. */
+    /** Every stored provider, in key order — disabled ones included. */
+    providers: SsoProviderEntry[];
+    /** Register THIS with every provider, byte for byte. Built server-side; never guess it. */
     callbackUrl: string;
     presets: SsoPreset[];
-    config: SsoConfig | null;
-    /** A mask when one is stored. Submit it back unchanged to keep the stored secret. */
-    clientSecret: string;
-    updatedAt: number | null;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samyx/preview-stacks-client",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Typed API client for a pstack control plane: deployments, jobs, readiness, containers, logs, notifiers.",
   "repository": {
     "type": "git",