@thunderid/node 1.11.0 → 1.12.0

package/dist/cjs/index.cjs

@@ -40,6 +40,149 @@ secure_random_bytes = __toESM(secure_random_bytes);
 let uuid = require("uuid");
 uuid = __toESM(uuid);
 
+//#region src/api/access/requestAccessApi.ts
+const METADATA_FIELDS = {
+	evaluation: "access_evaluation_endpoint",
+	evaluations: "access_evaluations_endpoint",
+	searchAction: "search_action_endpoint"
+};
+const trimSlash = (value) => value.replace(/\/+$/, "");
+/**
+* Reads the AuthZEN metadata of the server at `baseUrl` and checks that its `policy_decision_point`
+* names that server exactly (apart from a trailing slash).
+*/
+const getAuthZENConfiguration = async (operation, { baseUrl, fetcher, signal }) => {
+	const fetchFn = fetcher ?? fetch;
+	let response;
+	try {
+		response = await fetchFn(`${trimSlash(baseUrl)}/.well-known/authzen-configuration`, {
+			headers: { Accept: "application/json" },
+			method: "GET",
+			signal
+		});
+	} catch (error) {
+		throw new __thunderid_javascript.ThunderIDAPIError(`Network or parsing error: ${error instanceof Error ? error.message : "Unknown error"}`, `${operation}-NetworkError-001`, "node", 0, "Network Error");
+	}
+	if (!response.ok) throw new __thunderid_javascript.ThunderIDAPIError(await response.text().catch(() => ""), `${operation}-MetadataError-001`, "node", response.status, response.statusText, "Reading the AuthZEN metadata failed");
+	const metadata = await response.json();
+	if (typeof metadata?.policy_decision_point !== "string" || trimSlash(metadata.policy_decision_point) !== trimSlash(baseUrl)) throw new __thunderid_javascript.ThunderIDAPIError("The policy_decision_point in the AuthZEN metadata does not match the configured server.", `${operation}-MetadataError-002`, "node");
+	return metadata;
+};
+/**
+* Resolves an access endpoint: an explicit override, held to the origin of `baseUrl`, else the
+* server's AuthZEN metadata.
+*/
+const resolveEndpoint = async (operation, key, config) => {
+	const override = config.endpoints?.[key];
+	if (override) {
+		if (new URL(override).origin !== new URL(config.baseUrl).origin) throw new __thunderid_javascript.ThunderIDAPIError(`The ${key} endpoint override is not on the origin of baseUrl.`, `${operation}-ValidationError-002`, "node", 400);
+		return override;
+	}
+	const endpoint = (await getAuthZENConfiguration(operation, config))[METADATA_FIELDS[key]];
+	if (typeof endpoint !== "string" || endpoint === "") throw new __thunderid_javascript.ThunderIDAPIError(`The AuthZEN metadata names no ${METADATA_FIELDS[key]}.`, `${operation}-MetadataError-003`, "node");
+	return endpoint;
+};
+/**
+* Posts an AuthZEN request with the `Direct-Auth-Secret` header. A `4xx` or `5xx` answer is an error
+* with the server's `error` as the message; 401, 403 and 404 keep distinct codes.
+*/
+const requestAccessApi = async (operation, key, config, body) => {
+	try {
+		new URL(config.baseUrl);
+	} catch (error) {
+		throw new __thunderid_javascript.ThunderIDAPIError(`Invalid URL provided. ${error instanceof Error ? error.message : String(error)}`, `${operation}-ValidationError-001`, "node", 400, "The provided `baseUrl` does not adhere to the URL schema.");
+	}
+	if (typeof config.secret !== "string" || config.secret === "") throw new __thunderid_javascript.ThunderIDAPIError("The Direct-Auth-Secret is required for access evaluation.", `${operation}-ValidationError-003`, "node", 400);
+	const endpoint = await resolveEndpoint(operation, key, config);
+	const fetchFn = config.fetcher ?? fetch;
+	let response;
+	try {
+		response = await fetchFn(endpoint, {
+			body: JSON.stringify(body),
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				"Direct-Auth-Secret": config.secret
+			},
+			method: "POST",
+			signal: config.signal
+		});
+	} catch (error) {
+		throw new __thunderid_javascript.ThunderIDAPIError(`Network or parsing error: ${error instanceof Error ? error.message : "Unknown error"}`, `${operation}-NetworkError-001`, "node", 0, "Network Error");
+	}
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		let message = text;
+		try {
+			const parsed = JSON.parse(text);
+			if (typeof parsed?.error === "string" && parsed.code === void 0) message = JSON.stringify({
+				code: parsed.error,
+				message: { defaultValue: parsed.error }
+			});
+		} catch {}
+		let reason = "ResponseError";
+		if (response.status === 401) reason = "UnauthorizedError";
+		if (response.status === 403) reason = "ForbiddenError";
+		if (response.status === 404) reason = "NotFoundError";
+		throw new __thunderid_javascript.ThunderIDAPIError(message, `${operation}-${reason}-001`, "node", response.status, response.statusText, "Access evaluation failed");
+	}
+	return await response.json();
+};
+var requestAccessApi_default = requestAccessApi;
+
+//#endregion
+//#region src/api/access/evaluateAccess.ts
+/**
+* Asks the server's AuthZEN policy decision point whether a subject may perform an action on a resource,
+* at the `access_evaluation_endpoint` from `/.well-known/authzen-configuration`.
+*
+* Server-side only: it is authorized by the server-level secret in the `Direct-Auth-Secret` header,
+* which a browser or mobile app cannot hold.
+*
+* A denial is a result: `{decision: false}`, with the reason in `context`. Only a transport failure or a
+* 4xx/5xx answer throws.
+*
+* @example
+* ```typescript
+* const {decision} = await evaluateAccess(
+*   {subject: {type: 'user', id: userId}, resource: {type: 'https://api.example.com/booking'}, action: {name: 'booking:read'}},
+*   {baseUrl: 'https://localhost:8090', secret: process.env.THUNDERID_DIRECT_AUTH_SECRET!},
+* );
+* ```
+*/
+const evaluateAccess = (request, config) => requestAccessApi_default("evaluateAccess", "evaluation", config, request);
+var evaluateAccess_default = evaluateAccess;
+
+//#endregion
+//#region src/api/access/evaluateAccesses.ts
+/**
+* Evaluates a batch of access requests at the `access_evaluations_endpoint`, and returns one decision
+* per evaluation, in order. `defaults` apply to every evaluation that does not set that member itself.
+*
+* Server-side only, like {@link evaluateAccess}. A denial is a result, not an error.
+*/
+const evaluateAccesses = async ({ defaults, evaluations }, config) => {
+	return (await requestAccessApi_default("evaluateAccesses", "evaluations", config, { evaluations: (evaluations ?? []).map((evaluation) => ({
+		...defaults,
+		...evaluation
+	})) }))?.evaluations ?? [];
+};
+var evaluateAccesses_default = evaluateAccesses;
+
+//#endregion
+//#region src/api/access/searchActions.ts
+/**
+* Asks which actions a subject may perform on a resource, at the `search_action_endpoint`
+* (`/access/v1/search/action`). Server-side only, like {@link evaluateAccess}.
+*
+* @returns The actions the subject may perform.
+*/
+const searchActions = async (request, config) => {
+	return (await requestAccessApi_default("searchActions", "searchAction", config, request))?.results ?? [];
+};
+var searchActions_default = searchActions;
+
+//#endregion
 //#region src/stores/MemoryCacheStore.ts
 /**
 * In-memory key-value store backed by `memory-cache`.
@@ -241,6 +384,49 @@ const createManagementClient = (resolve) => {
 				...await config("applications", options)
 			})
 		},
+		authorizationDetailTypes: {
+			create: async (payload, options) => (0, __thunderid_javascript.createAuthorizationDetailType)({
+				payload,
+				...await config("authorizationDetailTypes", options)
+			}),
+			delete: async (authorizationDetailTypeId, options) => (0, __thunderid_javascript.deleteAuthorizationDetailType)({
+				authorizationDetailTypeId: requireId(authorizationDetailTypeId, "deleteAuthorizationDetailType"),
+				...await config("authorizationDetailTypes", options)
+			}),
+			get: async (authorizationDetailTypeId, options) => (0, __thunderid_javascript.getAuthorizationDetailType)({
+				authorizationDetailTypeId: requireId(authorizationDetailTypeId, "getAuthorizationDetailType"),
+				...await config("authorizationDetailTypes", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getAuthorizationDetailTypes)({
+				limit,
+				offset,
+				...await config("authorizationDetailTypes", options)
+			}),
+			update: async (authorizationDetailTypeId, payload, options) => (0, __thunderid_javascript.updateAuthorizationDetailType)({
+				authorizationDetailTypeId: requireId(authorizationDetailTypeId, "updateAuthorizationDetailType"),
+				payload,
+				...await config("authorizationDetailTypes", options)
+			})
+		},
+		clientRegistrations: {
+			delete: async (clientId, options) => (0, __thunderid_javascript.deleteClientRegistration)({
+				clientId: requireId(clientId, "deleteClientRegistration"),
+				...await config("clientRegistrations", options)
+			}),
+			get: async (clientId, options) => (0, __thunderid_javascript.getClientRegistration)({
+				clientId: requireId(clientId, "getClientRegistration"),
+				...await config("clientRegistrations", options)
+			}),
+			register: async (payload, options) => (0, __thunderid_javascript.registerClient)({
+				payload,
+				...await config("clientRegistrations", options)
+			}),
+			update: async (clientId, payload, options) => (0, __thunderid_javascript.updateClientRegistration)({
+				clientId: requireId(clientId, "updateClientRegistration"),
+				payload,
+				...await config("clientRegistrations", options)
+			})
+		},
 		configuration: {
 			captureVersion: async (payload, options) => (0, __thunderid_javascript.createConfigurationVersion)({
 				payload,
@@ -306,6 +492,26 @@ const createManagementClient = (resolve) => {
 				...await config("connections", options)
 			})
 		},
+		credentialConfigurations: {
+			create: async (payload, options) => (0, __thunderid_javascript.createCredentialConfiguration)({
+				payload,
+				...await config("credentialConfigurations", options)
+			}),
+			delete: async (configurationId, options) => (0, __thunderid_javascript.deleteCredentialConfiguration)({
+				configurationId: requireId(configurationId, "deleteCredentialConfiguration"),
+				...await config("credentialConfigurations", options)
+			}),
+			get: async (configurationId, options) => (0, __thunderid_javascript.getCredentialConfiguration)({
+				configurationId: requireId(configurationId, "getCredentialConfiguration"),
+				...await config("credentialConfigurations", options)
+			}),
+			list: async (options) => (0, __thunderid_javascript.getCredentialConfigurations)(await config("credentialConfigurations", options)),
+			update: async (configurationId, payload, options) => (0, __thunderid_javascript.updateCredentialConfiguration)({
+				configurationId: requireId(configurationId, "updateCredentialConfiguration"),
+				payload,
+				...await config("credentialConfigurations", options)
+			})
+		},
 		design: {
 			createLayout: async (payload, options) => (0, __thunderid_javascript.createLayout)({
 				payload,
@@ -410,6 +616,49 @@ const createManagementClient = (resolve) => {
 				flowId: requireId(flowId, "updateFlow"),
 				payload,
 				...await config("flows", options)
+			}),
+			createSharingPolicy: async (flowId, payload, options) => (0, __thunderid_javascript.createFlowSharingPolicy)({
+				payload,
+				flowId: requireId(flowId, "createFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			deleteSharingPolicy: async (flowId, policyId, options) => (0, __thunderid_javascript.deleteFlowSharingPolicy)({
+				flowId: requireId(flowId, "deleteFlowSharingPolicy"),
+				policyId: requireId(policyId, "deleteFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			getOverlayRules: async (flowId, ouId, options) => (0, __thunderid_javascript.getFlowOverlayRules)({
+				flowId: requireId(flowId, "getFlowOverlayRules"),
+				ouId: requireId(ouId, "getFlowOverlayRules"),
+				...await config("flows", options)
+			}),
+			getSharingPolicy: async (flowId, policyId, options) => (0, __thunderid_javascript.getFlowSharingPolicy)({
+				flowId: requireId(flowId, "getFlowSharingPolicy"),
+				policyId: requireId(policyId, "getFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			listSharingPolicies: async (flowId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getFlowSharingPolicies)({
+				flowId: requireId(flowId, "getFlowSharingPolicies"),
+				limit,
+				offset,
+				...await config("flows", options)
+			}),
+			updateSharingPolicy: async (flowId, policyId, payload, options) => (0, __thunderid_javascript.updateFlowSharingPolicy)({
+				payload,
+				policyId: requireId(policyId, "updateFlowSharingPolicy"),
+				flowId: requireId(flowId, "updateFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			getVariables: async (flowId, ouId, options) => (0, __thunderid_javascript.getFlowVariables)({
+				flowId: requireId(flowId, "getFlowVariables"),
+				ouId: requireId(ouId, "getFlowVariables"),
+				...await config("flows", options)
+			}),
+			updateVariables: async (flowId, ouId, variables, options) => (0, __thunderid_javascript.updateFlowVariables)({
+				flowId: requireId(flowId, "updateFlowVariables"),
+				ouId: requireId(ouId, "updateFlowVariables"),
+				variables,
+				...await config("flows", options)
 			})
 		},
 		gateways: {
@@ -463,6 +712,20 @@ const createManagementClient = (resolve) => {
 				version,
 				...await config("gateways", options)
 			}),
+			getMaster: async (gatewayId, options) => (0, __thunderid_javascript.getGatewayMaster)({
+				gatewayId: requireId(gatewayId, "getGatewayMaster"),
+				...await config("gateways", options)
+			}),
+			getMasterHistory: async (gatewayId, options) => (0, __thunderid_javascript.getGatewayMasterHistory)({
+				gatewayId: requireId(gatewayId, "getGatewayMasterHistory"),
+				...await config("gateways", options)
+			}),
+			getMasterResource: async (gatewayId, resourceType, resourceId, options) => (0, __thunderid_javascript.getGatewayMasterResource)({
+				gatewayId: requireId(gatewayId, "getGatewayMasterResource"),
+				resourceId: requireId(resourceId, "getGatewayMasterResource"),
+				resourceType: requireId(resourceType, "getGatewayMasterResource"),
+				...await config("gateways", options)
+			}),
 			getSecret: async (gatewayId, name, options) => (0, __thunderid_javascript.getGatewaySecret)({
 				gatewayId: requireId(gatewayId, "getGatewaySecret"),
 				name: requireId(name, "getGatewaySecret"),
@@ -523,6 +786,11 @@ const createManagementClient = (resolve) => {
 				payload,
 				...await config("groups", options)
 			}),
+			createByPath: async (path, payload, options) => (0, __thunderid_javascript.createGroupByPath)({
+				path,
+				payload,
+				...await config("groups", options)
+			}),
 			delete: async (groupId, options) => (0, __thunderid_javascript.deleteGroup)({
 				groupId: requireId(groupId, "deleteGroup"),
 				...await config("groups", options)
@@ -536,6 +804,12 @@ const createManagementClient = (resolve) => {
 				offset,
 				...await config("groups", options)
 			}),
+			listByPath: async (path, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getGroupsByPath)({
+				limit,
+				offset,
+				path,
+				...await config("groups", options)
+			}),
 			listMembers: async (groupId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getGroupMembers)({
 				groupId: requireId(groupId, "getGroupMembers"),
 				limit,
@@ -682,6 +956,50 @@ const createManagementClient = (resolve) => {
 				...await config("organizationUnits", options)
 			})
 		},
+		presentationDefinitions: {
+			create: async (payload, options) => (0, __thunderid_javascript.createPresentationDefinition)({
+				payload,
+				...await config("presentationDefinitions", options)
+			}),
+			delete: async (definitionId, options) => (0, __thunderid_javascript.deletePresentationDefinition)({
+				definitionId: requireId(definitionId, "deletePresentationDefinition"),
+				...await config("presentationDefinitions", options)
+			}),
+			get: async (definitionId, options) => (0, __thunderid_javascript.getPresentationDefinition)({
+				definitionId: requireId(definitionId, "getPresentationDefinition"),
+				...await config("presentationDefinitions", options)
+			}),
+			list: async (options) => (0, __thunderid_javascript.getPresentationDefinitions)(await config("presentationDefinitions", options)),
+			update: async (definitionId, payload, options) => (0, __thunderid_javascript.updatePresentationDefinition)({
+				definitionId: requireId(definitionId, "updatePresentationDefinition"),
+				payload,
+				...await config("presentationDefinitions", options)
+			})
+		},
+		projects: {
+			create: async (payload, options) => (0, __thunderid_javascript.createProject)({
+				payload,
+				...await config("projects", options)
+			}),
+			delete: async (projectId, options) => (0, __thunderid_javascript.deleteProject)({
+				projectId: requireId(projectId, "deleteProject"),
+				...await config("projects", options)
+			}),
+			get: async (projectId, options) => (0, __thunderid_javascript.getProject)({
+				projectId: requireId(projectId, "getProject"),
+				...await config("projects", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => (0, __thunderid_javascript.getProjects)({
+				limit,
+				offset,
+				...await config("projects", options)
+			}),
+			update: async (projectId, payload, options) => (0, __thunderid_javascript.updateProject)({
+				projectId: requireId(projectId, "updateProject"),
+				payload,
+				...await config("projects", options)
+			})
+		},
 		resourceServers: {
 			create: async (payload, options) => (0, __thunderid_javascript.createResourceServer)({
 				payload,
@@ -807,6 +1125,38 @@ const createManagementClient = (resolve) => {
 				payload,
 				roleId: requireId(roleId, "updateRole"),
 				...await config("roles", options)
+			}),
+			createSharingPolicy: async (roleId, payload, options) => (0, __thunderid_javascript.createRoleSharingPolicy)({
+				payload,
+				roleId: requireId(roleId, "createRoleSharingPolicy"),
+				...await config("roles", options)
+			}),
+			deleteSharingPolicy: async (roleId, policyId, options) => (0, __thunderid_javascript.deleteRoleSharingPolicy)({
+				roleId: requireId(roleId, "deleteRoleSharingPolicy"),
+				policyId: requireId(policyId, "deleteRoleSharingPolicy"),
+				...await config("roles", options)
+			}),
+			getOverlayRules: async (roleId, ouId, options) => (0, __thunderid_javascript.getRoleOverlayRules)({
+				roleId: requireId(roleId, "getRoleOverlayRules"),
+				ouId: requireId(ouId, "getRoleOverlayRules"),
+				...await config("roles", options)
+			}),
+			getSharingPolicy: async (roleId, policyId, options) => (0, __thunderid_javascript.getRoleSharingPolicy)({
+				roleId: requireId(roleId, "getRoleSharingPolicy"),
+				policyId: requireId(policyId, "getRoleSharingPolicy"),
+				...await config("roles", options)
+			}),
+			listSharingPolicies: async (roleId, { limit, offset,...options } = {}) => (0, __thunderid_javascript.getRoleSharingPolicies)({
+				roleId: requireId(roleId, "getRoleSharingPolicies"),
+				limit,
+				offset,
+				...await config("roles", options)
+			}),
+			updateSharingPolicy: async (roleId, policyId, payload, options) => (0, __thunderid_javascript.updateRoleSharingPolicy)({
+				payload,
+				policyId: requireId(policyId, "updateRoleSharingPolicy"),
+				roleId: requireId(roleId, "updateRoleSharingPolicy"),
+				...await config("roles", options)
 			})
 		},
 		secrets: {
@@ -1102,7 +1452,7 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 	async signIn(...args) {
 		const [authURLCallback, userId, authorizationCode, state, signInConfig] = args;
 		if (!userId) return Promise.reject(new __thunderid_javascript.ThunderIDAuthException("NODE-AUTH_CLIENT-SI-NF01", "No user ID was provided.", "Unable to sign in the user as no user ID was provided."));
-		if (await this.isSignedIn(userId)) {
+		if (!Boolean(authorizationCode && state && await this.isOrganizationUnitBoundRequest(state, userId)) && await this.isSignedIn(userId)) {
 			const sessionData$1 = await this.getStorageManager().getSessionData(userId);
 			return Promise.resolve({
 				accessToken: sessionData$1.access_token,
@@ -1147,6 +1497,87 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		if (!url) return Promise.reject(new __thunderid_javascript.ThunderIDAuthException("NODE-AUTH_CLIENT-GSIU-NF01", "Getting authorization URL failed.", "No authorization URL was returned."));
 		return url;
 	}
+	/**
+	* Starts a switch of the session `userId` to the organization unit `organizationUnitId`: builds the
+	* unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) and hands it to `authURLCallback`
+	* to redirect the user to. The server reuses the SSO session when the user can sign in there, so
+	* normally no credentials are asked. Complete it with `signIn(callback, userId, code, state)` on the
+	* callback: the code is redeemed at the unit's token endpoint and replaces the session's tokens.
+	* Until then, and when the callback carries an error, the previous session stays as it was.
+	*
+	* @throws {ThunderIDAPIError} `switchOrganizationUnit-ValidationError-001` without a unit, a session or
+	*   a callback.
+	*/
+	async switchOrganizationUnit(organizationUnitId, options = {}) {
+		const { authURLCallback, userId,...rest } = options;
+		const params = Object.fromEntries(Object.entries(rest).filter(([key]) => key !== "redirect"));
+		if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "" || !userId) throw new __thunderid_javascript.ThunderIDAPIError("An organization unit identifier and a session are required.", __thunderid_javascript.OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "node", 400);
+		if (typeof authURLCallback !== "function") throw new __thunderid_javascript.ThunderIDAPIError("An authURLCallback is required to send the user to the organization unit.", __thunderid_javascript.OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "node", 400);
+		authURLCallback(await this.getSignInUrl({
+			...params,
+			organizationUnitId
+		}, userId));
+	}
+	/**
+	* Starts a device authorization request (RFC 8628) for an input-constrained device or a CLI tool. Show
+	* the user `userCode` and `verificationUri`; keep `deviceCode`, a credential, to yourself and pass it
+	* to {@link pollDeviceAuthorization}. It is never logged.
+	*/
+	async startDeviceAuthorization(options = {}) {
+		return super.startDeviceAuthorization(options);
+	}
+	/**
+	* Polls the token endpoint with the device code until the user approves, denies, or the code expires,
+	* and stores the tokens for the session `userId` on approval.
+	*
+	* @throws {ThunderIDAPIError} `JS-AUTH_CORE-DEVICE2-HE03` when the server ends the request
+	*   (`access_denied`, `expired_token`), with the OAuth error in `serverError`.
+	*/
+	async pollDeviceAuthorization(deviceCode, interval, options, userId) {
+		const tokens = await super.pollDeviceAuthorization(deviceCode, interval, options, userId);
+		if (userId) await this.indexSession(userId, await this.getStorageManager().getSessionData(userId));
+		return tokens;
+	}
+	/**
+	* Introspects a token (RFC 7662) at the server's introspection endpoint, authenticating as this client.
+	* An inactive token is a result (`{active: false}`), not an error.
+	*/
+	async introspectToken(token, tokenTypeHint) {
+		return super.introspectToken(token, tokenTypeHint);
+	}
+	/**
+	* The request configuration for access evaluation: the configured server, secret and overrides, with
+	* a per-call secret taking precedence.
+	*/
+	async accessEvaluationConfig(secret, signal) {
+		const configData = await this.getStorageManager().getConfigData();
+		const accessEvaluation = configData.accessEvaluation;
+		return {
+			baseUrl: configData?.baseUrl ?? "",
+			endpoints: accessEvaluation?.endpoints,
+			secret: secret ?? accessEvaluation?.secret ?? "",
+			signal
+		};
+	}
+	/**
+	* Asks the server whether a subject may perform an action on a resource (AuthZEN). A denial is a result
+	* (`decision: false`), not an error. Uses `accessEvaluation.secret`, or `options.secret`.
+	*/
+	async evaluateAccess(request, options = {}) {
+		return evaluateAccess_default(request, await this.accessEvaluationConfig(options.secret, options.signal));
+	}
+	/**
+	* Evaluates a batch of access requests and returns one decision per evaluation, in order.
+	*/
+	async evaluateAccesses(request, options = {}) {
+		return evaluateAccesses_default(request, await this.accessEvaluationConfig(options.secret, options.signal));
+	}
+	/**
+	* Asks which actions a subject may perform on a resource.
+	*/
+	async searchActions(request, options = {}) {
+		return searchActions_default(request, await this.accessEvaluationConfig(options.secret, options.signal));
+	}
 	async signOut(...args) {
 		const userId = typeof args[0] === "string" ? args[0] : void 0;
 		const signOutUrl = await this.getSignOutUrl(userId);
@@ -1697,8 +2128,11 @@ const MANAGEMENT_COLLECTIONS = {
 	agentTypes: "agent-types",
 	agents: "agents",
 	applications: "applications",
+	authorizationDetailTypes: "authorization-detail-types",
+	clientRegistrations: "oauth2/dcr/register",
 	configurationVersions: "configuration-versions",
 	connections: "connections",
+	credentialConfigurations: "openid4vci/credential-configurations",
 	design: "design",
 	export: "export",
 	flows: "flows",
@@ -1708,6 +2142,8 @@ const MANAGEMENT_COLLECTIONS = {
 	import: "import",
 	notificationTemplates: "notification-templates",
 	organizationUnits: "organization-units",
+	presentationDefinitions: "openid4vp/presentation-definitions",
+	projects: "projects",
 	resourceServers: "resource-servers",
 	roles: "roles",
 	secrets: "secrets",
@@ -1791,10 +2227,13 @@ exports.SessionIndex = SessionIndex_default;
 exports.SessionUtils = SessionUtils_default;
 exports.ThunderIDNodeClient = ThunderIDNodeClient_default;
 exports.createManagementClient = createManagementClient_default;
+exports.evaluateAccess = evaluateAccess_default;
+exports.evaluateAccesses = evaluateAccesses_default;
 exports.generateSessionId = generateSessionId_default;
 exports.getManagementCollectionUrls = getManagementCollectionUrls;
 exports.getSessionCookieOptions = getSessionCookieOptions_default;
 exports.matchManagementUrl = matchManagementUrl;
+exports.searchActions = searchActions_default;
 Object.keys(__thunderid_javascript).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {
     enumerable: true,

package/dist/index.d.ts

@@ -6,6 +6,10 @@ export { default as CookieConfig } from './constants/CookieConfig';
 export type { ThunderIDNodeConfig, SessionCookieConfig } from './models/config';
 export type { default as AuthURLCallback } from './models/AuthURLCallback';
 export type { ManagementCallOptions, ManagementGroupMemberInput, ManagementListOptions, ManagementRequestConfigResolver, ManagementResourceKey, ThunderIDNodeManagementClient, } from './models/management';
+export type { AccessAction, AccessActionSearchRequest, AccessActionSearchResponse, AccessEvaluationRequest, AccessEvaluationRequestConfig, AccessEvaluationResponse, AccessEvaluationsRequest, AccessResource, AccessSubject, AuthZENConfiguration, } from './models/access-evaluation';
+export { default as evaluateAccess } from './api/access/evaluateAccess';
+export { default as evaluateAccesses } from './api/access/evaluateAccesses';
+export { default as searchActions } from './api/access/searchActions';
 export { default as MemoryCacheStore } from './stores/MemoryCacheStore';
 export { default as CookieChunking } from './utils/CookieChunking';
 export { default as NodeCryptoUtils } from './utils/NodeCryptoUtils';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAC9E,YAAY,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,0BAA0B,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAE,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAClG,YAAY,EAAC,iBAAiB,EAAE,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAC,eAAe,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AAGnF,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAC9E,YAAY,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,0BAA0B,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAC,OAAO,IAAI,aAAa,EAAC,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAE,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAClG,YAAY,EAAC,iBAAiB,EAAE,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAC,eAAe,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AAGnF,cAAc,uBAAuB,CAAC"}