@tailor-platform/sdk 1.25.4 → 1.27.0

package/docs/services/auth.md

@@ -341,6 +341,39 @@ idProvider: idp.provider("my-provider", "my-client"),
 
 See [IdP](./idp.md) for configuring identity providers.
 
+## Before Login Hook
+
+Run custom logic before a user logs in. This is useful for JIT (Just-In-Time) user provisioning — automatically creating or updating user records when a user authenticates for the first time.
+
+```typescript
+import { defineAuth } from "@tailor-platform/sdk";
+import { user } from "./tailordb/user";
+
+export const auth = defineAuth("my-auth", {
+  userProfile: {
+    type: user,
+    usernameField: "email",
+  },
+  machineUsers: {
+    "hook-invoker": {
+      attributes: { role: "ADMIN" },
+    },
+  },
+  hooks: {
+    beforeLogin: {
+      handler: async ({ claims, idpConfigName }) => {
+        // Provision or update user based on IdP claims
+      },
+      invoker: "hook-invoker",
+    },
+  },
+});
+```
+
+**handler**: An async function that receives `{ claims, idpConfigName }` and is called before each login. `claims` contains the token claims from the identity provider, and `idpConfigName` is the name of the IdP configuration used for authentication.
+
+**invoker**: The machine user whose permissions are used to execute the hook. Must reference a machine user defined in the same auth configuration.
+
 ## CLI Commands
 
 Manage Auth resources using the CLI:

package/docs/services/resolver.md

@@ -275,3 +275,35 @@ createResolver({
      // ...
    });
    ```
+
+## Authentication
+
+Specify an `authInvoker` to execute the resolver with machine user credentials:
+
+```typescript
+import { defineAuth, createResolver, t } from "@tailor-platform/sdk";
+
+const auth = defineAuth("my-auth", {
+  // ... auth configuration
+  machineUsers: {
+    "batch-processor": {
+      attributes: { role: "ADMIN" },
+    },
+  },
+});
+
+export default createResolver({
+  name: "adminQuery",
+  operation: "query",
+  output: t.object({ result: t.string() }),
+  body: async () => {
+    // Executes as "batch-processor" machine user
+    return { result: "ok" };
+  },
+  authInvoker: auth.invoker("batch-processor"),
+});
+```
+
+The `authInvoker` option accepts the return value of `auth.invoker()`, which specifies the auth namespace and machine user name.
+
+**Note:** `authInvoker` controls the permissions for database operations and other platform actions, but the `user` object passed to the `body` function still reflects the original caller who invoked the resolver.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk",
-  "version": "1.25.4",
+  "version": "1.27.0",
   "description": "Tailor Platform SDK - The SDK to work with Tailor Platform",
   "license": "MIT",
   "repository": {
@@ -132,9 +132,9 @@
     "@types/mime-types": "3.0.1",
     "@types/node": "24.12.0",
     "@typescript/native-preview": "7.0.0-dev.20260308.1",
-    "@vitest/coverage-v8": "4.0.18",
+    "@vitest/coverage-v8": "4.1.0",
     "eslint": "9.39.4",
-    "eslint-plugin-jsdoc": "62.7.1",
+    "eslint-plugin-jsdoc": "62.8.0",
     "eslint-plugin-oxlint": "1.39.0",
     "oxlint": "1.39.0",
     "oxlint-tsgolint": "0.16.0",
@@ -142,7 +142,7 @@
     "tsdown": "0.21.2",
     "typescript": "5.9.3",
     "typescript-eslint": "8.57.0",
-    "vitest": "4.0.18",
+    "vitest": "4.1.0",
     "zinfer": "0.1.7"
   },
   "scripts": {