@snokam/platform-client 3.0.0 → 3.1.1

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.1.1](https://github.com/GIT_USER_ID/GIT_REPO_ID/compare/@snokam/platform-client@3.1.0...@snokam/platform-client@3.1.1) (2026-10-02)
+
+
+### Bug Fixes
+
+* **auth:** harden app sign-in after a security review, and give sign-in one home ([#2543](https://github.com/GIT_USER_ID/GIT_REPO_ID/issues/2543)) ([7100eb7](https://github.com/GIT_USER_ID/GIT_REPO_ID/commit/7100eb79ce278875eafe75228ab496dedc0ae151))
+
+
+
+
+
+# [3.1.0](https://github.com/GIT_USER_ID/GIT_REPO_ID/compare/@snokam/platform-client@3.0.0...@snokam/platform-client@3.1.0) (2026-10-02)
+
+
+### Features
+
+* **auth:** let MCP clients sign in through the Snøsky login ([#2542](https://github.com/GIT_USER_ID/GIT_REPO_ID/issues/2542)) ([5ea6750](https://github.com/GIT_USER_ID/GIT_REPO_ID/commit/5ea67501bde43d999d518e41f98611af2536ff23))
+
+
+
+
+
 # [3.0.0](https://github.com/GIT_USER_ID/GIT_REPO_ID/compare/@snokam/platform-client@2.0.0...@snokam/platform-client@3.0.0) (2026-10-01)
 
 

package/README.md

@@ -1,4 +1,4 @@
-# @snokam/platform-client@1.0.0
+# @snokam/platform-client@3.1.0
 
 A TypeScript SDK client for the snokam.snosky.no API.
 
@@ -58,6 +58,7 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 | ----- | ------ | ------------ | -------------
 *PlatformClient* | [**addCustomDomain**](docs/PlatformClient.md#addcustomdomainoperation) | **POST** /v1.0/protected/businesses/{id}/custom-domains | Add a custom domain
 *PlatformClient* | [**approveDevice**](docs/PlatformClient.md#approvedeviceoperation) | **POST** /v1.0/protected/businesses/{id}/devices | Approve a screen into this business
+*PlatformClient* | [**approveOAuthAuthorization**](docs/PlatformClient.md#approveoauthauthorization) | **POST** /v1.0/protected/oauth/authorization | Record the user\'s approval of an app\'s sign-in request
 *PlatformClient* | [**assignBusinessEmployeeSystem**](docs/PlatformClient.md#assignbusinessemployeesystem) | **POST** /v1.0/protected/businesses/{id}/employees/{upn}/systems/{systemKey} | Grant an employee a seat in a third-party system
 *PlatformClient* | [**backfillBridgeWebhook**](docs/PlatformClient.md#backfillbridgewebhook) | **POST** /v1.0/protected/businesses/{id}/bridge-webhook | Re-create a business\'s Sanity bridge webhook with a managed API key
 *PlatformClient* | [**checkIntegration**](docs/PlatformClient.md#checkintegration) | **POST** /v1.0/protected/businesses/{id}/integrations/{key}/check | Run a live integration connectivity check
@@ -148,6 +149,7 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 *PlatformClient* | [**powerOfficeOnboardingReturn**](docs/PlatformClient.md#powerofficeonboardingreturn) | **GET** /v1.0/connect/poweroffice/return/{reference} | PowerOffice onboarding return
 *PlatformClient* | [**previewBillingInvoice**](docs/PlatformClient.md#previewbillinginvoice) | **POST** /v1.0/protected/businesses/{id}/billing/invoice-preview | Preview a month\'s invoice basis
 *PlatformClient* | [**previewDevice**](docs/PlatformClient.md#previewdevice) | **GET** /v1.0/protected/businesses/{id}/devices/preview | Look up a pairing code before approving
+*PlatformClient* | [**previewOAuthAuthorization**](docs/PlatformClient.md#previewoauthauthorization) | **POST** /v1.0/protected/oauth/authorization/preview | Describe an app\'s sign-in request before the user approves it
 *PlatformClient* | [**provisionBusiness**](docs/PlatformClient.md#provisionbusiness) | **POST** /v1.0/protected/businesses/{id}/provision | Provision a business
 *PlatformClient* | [**publicCapabilities**](docs/PlatformClient.md#publiccapabilities) | **GET** /v1.0/public/capabilities | Get capabilities
 *PlatformClient* | [**publicModules**](docs/PlatformClient.md#publicmodules) | **GET** /v1.0/public/modules | Get available modules
@@ -200,6 +202,8 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 - [AppCatalogEntry](docs/AppCatalogEntry.md)
 - [AppModule](docs/AppModule.md)
 - [ApproveDeviceRequest](docs/ApproveDeviceRequest.md)
+- [AuthorizationPreview](docs/AuthorizationPreview.md)
+- [AuthorizationRequest](docs/AuthorizationRequest.md)
 - [BillingPaymentMethod](docs/BillingPaymentMethod.md)
 - [BillingSessionRequest](docs/BillingSessionRequest.md)
 - [BillingSessionResponse](docs/BillingSessionResponse.md)
@@ -254,6 +258,7 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 - [InviteCredentialRequest](docs/InviteCredentialRequest.md)
 - [InvoiceBasis](docs/InvoiceBasis.md)
 - [InvoiceBasisLine](docs/InvoiceBasisLine.md)
+- [IssuedAuthorizationCode](docs/IssuedAuthorizationCode.md)
 - [LoginConfig](docs/LoginConfig.md)
 - [MeApp](docs/MeApp.md)
 - [MeterEnforcementDecision](docs/MeterEnforcementDecision.md)
@@ -384,7 +389,7 @@ and is automatically generated by the
 [OpenAPI Generator](https://openapi-generator.tech) project:
 
 - API version: `v1.0.0`
-- Package version: `1.0.0`
+- Package version: `3.1.0`
 - Generator version: `7.23.0`
 - Build package: `org.openapitools.codegen.languages.TypeScriptFetchClientCodegen`
 

package/dist/apis/PlatformClient.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
+import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, AuthorizationPreview, AuthorizationRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, IssuedAuthorizationCode, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
 export interface AddCustomDomainOperationRequest {
     id: string;
     addCustomDomainRequest: AddCustomDomainRequest;
@@ -19,6 +19,9 @@ export interface ApproveDeviceOperationRequest {
     id: string;
     approveDeviceRequest: ApproveDeviceRequest;
 }
+export interface ApproveOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface AssignBusinessEmployeeSystemRequest {
     id: string;
     upn: string;
@@ -266,6 +269,9 @@ export interface PreviewDeviceRequest {
     id: string;
     code: string;
 }
+export interface PreviewOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface ProvisionBusinessRequest {
     id: string;
 }
@@ -429,6 +435,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Approve a screen into this business
      */
     approveDevice(requestParameters: ApproveDeviceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DeviceScreen>;
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters: ApproveOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorizationRaw(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<IssuedAuthorizationCode>>;
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorization(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<IssuedAuthorizationCode>;
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -1685,6 +1705,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Look up a pairing code before approving
      */
     previewDevice(requestParameters: PreviewDeviceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PendingDevicePreview>;
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters: PreviewOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthorizationPreview>>;
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthorizationPreview>;
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -1814,12 +1848,12 @@ export declare class PlatformClient extends runtime.BaseAPI {
      */
     resolvePlatformSanityConfigRequestOpts(): Promise<runtime.RequestOpts>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PlatformSanityConfig>>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PlatformSanityConfig>;

package/dist/apis/PlatformClient.js

@@ -128,6 +128,52 @@ class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling approveOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.approveOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.approveOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -4167,6 +4213,52 @@ class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling previewOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization/preview`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.previewOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.previewOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -4575,7 +4667,7 @@ class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides) {
@@ -4586,7 +4678,7 @@ class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides) {

package/dist/esm/apis/PlatformClient.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
+import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, AuthorizationPreview, AuthorizationRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, IssuedAuthorizationCode, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
 export interface AddCustomDomainOperationRequest {
     id: string;
     addCustomDomainRequest: AddCustomDomainRequest;
@@ -19,6 +19,9 @@ export interface ApproveDeviceOperationRequest {
     id: string;
     approveDeviceRequest: ApproveDeviceRequest;
 }
+export interface ApproveOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface AssignBusinessEmployeeSystemRequest {
     id: string;
     upn: string;
@@ -266,6 +269,9 @@ export interface PreviewDeviceRequest {
     id: string;
     code: string;
 }
+export interface PreviewOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface ProvisionBusinessRequest {
     id: string;
 }
@@ -429,6 +435,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Approve a screen into this business
      */
     approveDevice(requestParameters: ApproveDeviceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DeviceScreen>;
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters: ApproveOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorizationRaw(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<IssuedAuthorizationCode>>;
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorization(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<IssuedAuthorizationCode>;
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -1685,6 +1705,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Look up a pairing code before approving
      */
     previewDevice(requestParameters: PreviewDeviceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PendingDevicePreview>;
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters: PreviewOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthorizationPreview>>;
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthorizationPreview>;
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -1814,12 +1848,12 @@ export declare class PlatformClient extends runtime.BaseAPI {
      */
     resolvePlatformSanityConfigRequestOpts(): Promise<runtime.RequestOpts>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PlatformSanityConfig>>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PlatformSanityConfig>;

package/dist/esm/apis/PlatformClient.js

@@ -125,6 +125,52 @@ export class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling approveOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.approveOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Called by the login site after the user consents. Issues a single-use authorization code the app redeems at the token endpoint.
+     * Record the user\'s approval of an app\'s sign-in request
+     */
+    approveOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.approveOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -4164,6 +4210,52 @@ export class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling previewOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization/preview`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.previewOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Called by the login site. Validates the app, redirect URI and resource for the user whose access token is in the body, and names the app.
+     * Describe an app\'s sign-in request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.previewOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -4572,7 +4664,7 @@ export class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides) {
@@ -4583,7 +4675,7 @@ export class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides) {