@thunderid/javascript 1.0.7 → 1.1.0

package/dist/utils/evaluatePasswordPolicy.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Client-side password rule used to drive both the requirement checklist and the
+ * submit gate of a change-password form.
+ *
+ * The server does not enforce the user type schema's `password` regex on the credential
+ * write path, and the default schema ships without a regex at all, so this rule is
+ * advisory: it exists to give the user actionable feedback before the request is sent.
+ * The schema's `regex` is the sole source of truth; the SDK does not layer its own
+ * character-class or length rules on top, since doing so could reject a password the
+ * organization's policy accepts.
+ */
+export interface PasswordPolicy {
+    /**
+     * A regular expression the whole value must match. Typically sourced from the
+     * `password` attribute's `regex` in `GET /users/me/meta`.
+     */
+    regex?: string;
+}
+/**
+ * The outcome of the password rule.
+ */
+export interface PasswordRuleResult {
+    /**
+     * Stable identifier for the rule, usable as a React key or test selector.
+     */
+    key: string;
+    /**
+     * i18n key describing the requirement. Resolved by the consuming component rather
+     * than here, so this module stays free of translation concerns.
+     */
+    messageKey: string;
+    /**
+     * Substitution params for `messageKey`, in the `{token}` form the i18n layer expects.
+     */
+    params?: Record<string, string | number>;
+    /**
+     * Whether the value satisfies this rule.
+     */
+    passed: boolean;
+}
+/**
+ * Evaluates a password against a policy, returning one result when the policy configures
+ * a `regex` and none otherwise.
+ *
+ * An uncompilable `regex` is treated as passing, matching `evaluateValidationRule`:
+ * the SDK stays lenient so a misconfigured schema cannot lock a user out of their own
+ * password change.
+ *
+ * @param value - The candidate password.
+ * @param policy - The rule to apply.
+ * @returns A single-item list when `policy.regex` is set, otherwise an empty list.
+ * @example
+ * ```typescript
+ * const results = evaluatePasswordPolicy('sh0rt', {regex: '^.{8,}$'});
+ * const isValid = results.every(result => result.passed);
+ * ```
+ */
+declare const evaluatePasswordPolicy: (value: string, policy: PasswordPolicy) => PasswordRuleResult[];
+export default evaluatePasswordPolicy;
+//# sourceMappingURL=evaluatePasswordPolicy.d.ts.map

package/dist/utils/evaluatePasswordPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluatePasswordPolicy.d.ts","sourceRoot":"","sources":["../../src/utils/evaluatePasswordPolicy.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACzC;;OAEG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,sBAAsB,GAAI,OAAO,MAAM,EAAE,QAAQ,cAAc,KAAG,kBAAkB,EAqBzF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/utils/mapCredentialUpdateError.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The form field a credential-update failure belongs to, or `null` when the failure has
+ * no single field to blame and belongs at form level.
+ */
+export type CredentialUpdateErrorField = 'newPassword' | null;
+/**
+ * Where a credential-update failure should be shown, and what it should say.
+ *
+ * `messageKey` is always set, so the caller can resolve text with a plain
+ * `message ?? t(messageKey)` and never needs a non-null assertion. `message` is present
+ * only when the server supplied something human-readable, and takes precedence when it
+ * is. Translation is left to the caller, which keeps this module free of i18n concerns
+ * in the same way {@link evaluatePasswordPolicy} is.
+ */
+export interface CredentialUpdateErrorResult {
+    /**
+     * The field to attach the error to, or `null` for a form-level error.
+     */
+    field: CredentialUpdateErrorField;
+    /**
+     * A server-supplied message, already human-readable. Shown as-is when present.
+     */
+    message?: string;
+    /**
+     * The i18n key to fall back to when `message` is absent. Always set.
+     */
+    messageKey: string;
+}
+declare const mapCredentialUpdateError: (error: unknown) => CredentialUpdateErrorResult;
+export default mapCredentialUpdateError;
+//# sourceMappingURL=mapCredentialUpdateError.d.ts.map

package/dist/utils/mapCredentialUpdateError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapCredentialUpdateError.d.ts","sourceRoot":"","sources":["../../src/utils/mapCredentialUpdateError.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,IAAI,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,KAAK,EAAE,0BAA0B,CAAC;IAClC;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAyBD,QAAA,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,2BAYlD,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/utils/requestManagementResource.d.ts

@@ -0,0 +1,41 @@
+import { ManagementRequestConfig } from '../models/api';
+/**
+ * Describes a single request against a management API resource collection.
+ */
+export interface ManagementResourceRequest {
+    /**
+     * Request payload, serialized as JSON.
+     */
+    body?: unknown;
+    /**
+     * Collection path segment appended to `baseUrl` when no `url` is given (e.g. `applications`).
+     */
+    collection: string;
+    /**
+     * Message prefix used when the server rejects the request.
+     */
+    failureMessage: string;
+    /**
+     * Identifier of a single resource. When set, the request targets `{collectionUrl}/{id}`.
+     */
+    id?: string;
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    /**
+     * Name of the calling operation, used as the prefix of every error code it raises.
+     */
+    operation: string;
+    /**
+     * Query parameters. `undefined` values are omitted.
+     */
+    query?: Record<string, string | number | undefined>;
+}
+/**
+ * Performs a request against a management API resource and maps failures onto
+ * {@link ThunderIDAPIError}. HTTP 403 and 404 get their own codes so a caller can tell a missing
+ * permission from a missing resource.
+ *
+ * @returns The parsed JSON body, or `undefined` when the server returns no content.
+ */
+declare const requestManagementResource: <T>({ baseUrl, url, fetcher, ...requestConfig }: ManagementRequestConfig, { body, collection, failureMessage, id, method, operation, query }: ManagementResourceRequest) => Promise<T>;
+export default requestManagementResource;
+//# sourceMappingURL=requestManagementResource.d.ts.map

package/dist/utils/requestManagementResource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestManagementResource.d.ts","sourceRoot":"","sources":["../../src/utils/requestManagementResource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,uBAAuB,EAAC,MAAM,eAAe,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CACrD;AAED;;;;;;GAMG;AACH,QAAA,MAAM,yBAAyB,GAAU,CAAC,EACxC,6CAA2C,uBAAuB,EAClE,oEAAkE,yBAAyB,KAC1F,OAAO,CAAC,CAAC,CA0FX,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/utils/resolveChangeCredentialPolicy.d.ts

@@ -0,0 +1,24 @@
+import { PasswordPolicy } from './evaluatePasswordPolicy';
+import { AttributeSchema } from '../api/getUsersMeMeta';
+/**
+ * Resolves the rules a change-credential form should enforce for the given credential.
+ *
+ * The organization's own policy, expressed as the credential attribute's `regex` in
+ * `GET /users/me/meta`, is the sole source of truth: the SDK does not layer its own
+ * character-class or length rules on top, since doing so could reject a value the
+ * organization's policy accepts. When the schema carries no regex for this credential,
+ * there is no policy to check client-side and the requirement checklist is simply empty.
+ *
+ * @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+ * @param attribute - The credential attribute this form manages (e.g. `password`, `pin`).
+ * @param override - An explicit policy supplied by the caller, which wins outright.
+ * @returns The policy to hand to {@link evaluatePasswordPolicy}.
+ * @example
+ * ```typescript
+ * const policy = resolveChangeCredentialPolicy(userSchema, 'pin', undefined);
+ * const results = evaluatePasswordPolicy(candidate, policy);
+ * ```
+ */
+declare const resolveChangeCredentialPolicy: (userSchema: Record<string, AttributeSchema> | null | undefined, attribute: string, override?: PasswordPolicy) => PasswordPolicy;
+export default resolveChangeCredentialPolicy;
+//# sourceMappingURL=resolveChangeCredentialPolicy.d.ts.map

package/dist/utils/resolveChangeCredentialPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveChangeCredentialPolicy.d.ts","sourceRoot":"","sources":["../../src/utils/resolveChangeCredentialPolicy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,QAAA,MAAM,6BAA6B,GACjC,YAAY,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9D,WAAW,MAAM,EACjB,WAAW,cAAc,KACxB,cAQF,CAAC;AAEF,eAAe,6BAA6B,CAAC"}

package/dist/utils/resolveResourceEndpoint.d.ts

@@ -8,7 +8,7 @@ import { BaseConfig } from '../models/config';
  * issuers), these overrides let the SDK send flow and user-management requests to the resource
  * server while OAuth requests continue to target the authorization server.
  */
-export type ResourceEndpointKey = 'flowExecute' | 'flowMeta' | 'usersMe' | 'usersMeMeta';
+export type ResourceEndpointKey = 'agents' | 'applications' | 'flowExecute' | 'flowMeta' | 'users' | 'usersMe' | 'usersMeCredentials' | 'usersMeMeta';
 /**
  * The `config.endpoints` keys that address resource-server endpoints rather than OIDC/OAuth
  * endpoints. Used to keep these overrides out of the resolved OIDC provider metadata.

package/dist/utils/resolveResourceEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAKhE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"resolveResourceEndpoint.d.ts","sourceRoot":"","sources":["../../src/utils/resolveResourceEndpoint.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,cAAc,GACd,aAAa,GACb,UAAU,GACV,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,aAAa,CAAC;AAElB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAShE,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,QAAA,MAAM,uBAAuB,GAC3B,KAAK,mBAAmB,EACxB,QAAQ,sBAAsB,GAAG,SAAS,EAC1C,cAAc,MAAM,KACnB,MAAM,GAAG,SAAiE,CAAC;AAE9E,eAAe,uBAAuB,CAAC"}

package/dist/utils/supportsCredential.d.ts

@@ -0,0 +1,32 @@
+import { AttributeSchema } from '../api/getUsersMeMeta';
+/**
+ * Whether the signed-in user's type allows them to set the given credential for themselves.
+ *
+ * The user type schema from `GET /users/me/meta` is the only thing a client can check before
+ * rendering. It says whether the credential is declared on this type at all, which is a property
+ * of the type rather than of the account, so it cannot say whether this particular user has one
+ * stored today. That second question is the server's to answer.
+ *
+ * Without this check the form would submit into a guaranteed failure. `POST
+ * /users/me/update-credentials` rejects a write for a name not declared on the type, since the
+ * entity layer only accepts schema-declared credential keys.
+ *
+ * An absent schema means the answer is not known yet, either because the profile is still loading
+ * or because the consuming app never supplied one. Both resolve to `true` so a change-credential
+ * affordance is never hidden on missing information alone, and so apps that do not wire up
+ * `userSchema` keep the behaviour they had before this check existed.
+ *
+ * @param userSchema - The user type schema resolved by the provider, keyed by attribute.
+ * @param attribute - The credential attribute to check (e.g. `password`, `pin`).
+ * @returns `false` only when the schema is known and either defines no attribute named
+ * `attribute` or defines one that isn't marked `credential: true`.
+ * @example
+ * ```typescript
+ * if (!supportsCredential(userSchema, 'pin')) {
+ *   return null;
+ * }
+ * ```
+ */
+declare const supportsCredential: (userSchema: Record<string, AttributeSchema> | null | undefined, attribute: string) => boolean;
+export default supportsCredential;
+//# sourceMappingURL=supportsCredential.d.ts.map

package/dist/utils/supportsCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supportsCredential.d.ts","sourceRoot":"","sources":["../../src/utils/supportsCredential.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,QAAA,MAAM,kBAAkB,GACtB,YAAY,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9D,WAAW,MAAM,KAChB,OAMF,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/javascript",
-  "version": "1.0.7",
+  "version": "1.1.0",
   "description": "JavaScript Ecosystem SDK for ThunderID",
   "keywords": [
     "thunderid",