@thunderid/node 1.11.0 → 1.12.1

package/dist/index.js

@@ -1,5 +1,5 @@
-import fetch, { Headers, Request, Response } from "cross-fetch";
-import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAPIError, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, addGroupMembers, addRoleAssignments, applyGatewayConfiguration, createAction, createAgent, createAgentType, createApplication, createApplicationSharingPolicy, createConfigurationVersion, createConnection, createDesignTheme, createFlow, createGateway, createGatewaySecret, createGatewayVariable, createGroup, createLayout, createNotificationTemplate, createOrganizationUnit, createResource, createResourceServer, createRole, createSecret, createUser, createUserByPath, createUserSharingPolicy, createVariable, deleteAction, deleteAgent, deleteAgentType, deleteApplication, deleteApplicationSharingPolicy, deleteConnection, deleteDesignTheme, deleteFlow, deleteGateway, deleteGatewaySecret, deleteGatewayVariable, deleteGroup, deleteImportedConfiguration, deleteLayout, deleteNotificationTemplate, deleteOrganizationUnit, deleteOrganizationUnitByPath, deleteResource, deleteResourceServer, deleteRole, deleteSecret, deleteTranslation, deleteTranslations, deleteUser, deleteUserSharingPolicy, deleteVariable, executeEmbeddedSelfFlow, exportConfiguration, getAction, getActions, getAgent, getAgentGroups, getAgentRoles, getAgentType, getAgentTypes, getAgents, getApplication, getApplicationOverlayRules, getApplicationSharingPolicies, getApplicationSharingPolicy, getApplications, getConfigurationVersion, getConfigurationVersions, getConnection, getConnectionUsages, getConnections, getConnectionsMeta, getDesignTheme, getDesignThemeUsages, getDesignThemes, getFlow, getFlowUsages, getFlowVersion, getFlowVersions, getFlows, getGateway, getGatewayAppliedConfiguration, getGatewayAppliedVersion, getGatewayConfigurationDiff, getGatewaySecret, getGatewaySecrets, getGatewayVariable, getGatewayVariables, getGateways, getGroup, getGroupMembers, getGroups, getLanguages, getLayout, getLayoutUsages, getLayouts, getNotificationTemplate, getNotificationTemplates, getOrganizationUnit, getOrganizationUnitByPath, getOrganizationUnitChildren, getOrganizationUnitGroups, getOrganizationUnitRoles, getOrganizationUnitUsers, getOrganizationUnits, getResource, getResourceServer, getResourceServers, getResources, getRole, getRoleAssignments, getRoles, getSecret, getSecrets, getServerConfig, getServerConfigs, getUser, getUserGroups, getUserOverlayRules, getUserSharingPolicies, getUserSharingPolicy, getUserTypes, getUsers, getUsersByPath, getVariable, getVariables, getVendorPrefix, importConfiguration, logger, previewCimdDocument, regenerateClientSecret, regenerateFlowSecret, removeGroupMembers, removeRoleAssignments, resolveDesign, resolveResourceEndpoint, resolveTranslation, resolveTranslations, restoreFlowVersion, revertGatewayConfiguration, setTranslation, setTranslations, suspendAgent, suspendApplication, suspendUser, unlockAgent, unlockUser, unsuspendAgent, unsuspendApplication, unsuspendUser, updateAction, updateAgent, updateAgentType, updateApplication, updateApplicationSharingPolicy, updateConnection, updateDesignTheme, updateFlow, updateGateway, updateGatewaySecret, updateGatewayVariable, updateGroup, updateLayout, updateMeCredentials, updateNotificationTemplate, updateOrganizationUnit, updateOrganizationUnitByPath, updateResource, updateResourceServer, updateRole, updateSecret, updateServerConfig, updateUser, updateUserSharingPolicy, updateVariable } from "@thunderid/javascript";
+import fetch$1, { Headers, Request, Response } from "cross-fetch";
+import { BackchannelLogoutConstants, InvalidLogoutTokenError, OrganizationUnitSwitchErrorCodes, ThunderIDAPIError, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, addGroupMembers, addRoleAssignments, applyGatewayConfiguration, createAction, createAgent, createAgentType, createApplication, createApplicationSharingPolicy, createAuthorizationDetailType, createConfigurationVersion, createConnection, createCredentialConfiguration, createDesignTheme, createFlow, createFlowSharingPolicy, createGateway, createGatewaySecret, createGatewayVariable, createGroup, createGroupByPath, createLayout, createNotificationTemplate, createOrganizationUnit, createPresentationDefinition, createProject, createResource, createResourceServer, createRole, createRoleSharingPolicy, createSecret, createUser, createUserByPath, createUserSharingPolicy, createVariable, deleteAction, deleteAgent, deleteAgentType, deleteApplication, deleteApplicationSharingPolicy, deleteAuthorizationDetailType, deleteClientRegistration, deleteConnection, deleteCredentialConfiguration, deleteDesignTheme, deleteFlow, deleteFlowSharingPolicy, deleteGateway, deleteGatewaySecret, deleteGatewayVariable, deleteGroup, deleteImportedConfiguration, deleteLayout, deleteNotificationTemplate, deleteOrganizationUnit, deleteOrganizationUnitByPath, deletePresentationDefinition, deleteProject, deleteResource, deleteResourceServer, deleteRole, deleteRoleSharingPolicy, deleteSecret, deleteTranslation, deleteTranslations, deleteUser, deleteUserSharingPolicy, deleteVariable, executeEmbeddedSelfFlow, exportConfiguration, getAction, getActions, getAgent, getAgentGroups, getAgentRoles, getAgentType, getAgentTypes, getAgents, getApplication, getApplicationOverlayRules, getApplicationSharingPolicies, getApplicationSharingPolicy, getApplications, getAuthorizationDetailType, getAuthorizationDetailTypes, getClientRegistration, getConfigurationVersion, getConfigurationVersions, getConnection, getConnectionUsages, getConnections, getConnectionsMeta, getCredentialConfiguration, getCredentialConfigurations, getDesignTheme, getDesignThemeUsages, getDesignThemes, getFlow, getFlowOverlayRules, getFlowSharingPolicies, getFlowSharingPolicy, getFlowUsages, getFlowVariables, getFlowVersion, getFlowVersions, getFlows, getGateway, getGatewayAppliedConfiguration, getGatewayAppliedVersion, getGatewayConfigurationDiff, getGatewayMaster, getGatewayMasterHistory, getGatewayMasterResource, getGatewaySecret, getGatewaySecrets, getGatewayVariable, getGatewayVariables, getGateways, getGroup, getGroupMembers, getGroups, getGroupsByPath, getLanguages, getLayout, getLayoutUsages, getLayouts, getNotificationTemplate, getNotificationTemplates, getOrganizationUnit, getOrganizationUnitByPath, getOrganizationUnitChildren, getOrganizationUnitGroups, getOrganizationUnitRoles, getOrganizationUnitUsers, getOrganizationUnits, getPresentationDefinition, getPresentationDefinitions, getProject, getProjects, getResource, getResourceServer, getResourceServers, getResources, getRole, getRoleAssignments, getRoleOverlayRules, getRoleSharingPolicies, getRoleSharingPolicy, getRoles, getSecret, getSecrets, getServerConfig, getServerConfigs, getUser, getUserGroups, getUserOverlayRules, getUserSharingPolicies, getUserSharingPolicy, getUserTypes, getUsers, getUsersByPath, getVariable, getVariables, getVendorPrefix, importConfiguration, logger, previewCimdDocument, regenerateClientSecret, regenerateFlowSecret, registerClient, removeGroupMembers, removeRoleAssignments, resolveDesign, resolveResourceEndpoint, resolveTranslation, resolveTranslations, restoreFlowVersion, revertGatewayConfiguration, setTranslation, setTranslations, suspendAgent, suspendApplication, suspendUser, unlockAgent, unlockUser, unsuspendAgent, unsuspendApplication, unsuspendUser, updateAction, updateAgent, updateAgentType, updateApplication, updateApplicationSharingPolicy, updateAuthorizationDetailType, updateClientRegistration, updateConnection, updateCredentialConfiguration, updateDesignTheme, updateFlow, updateFlowSharingPolicy, updateFlowVariables, updateGateway, updateGatewaySecret, updateGatewayVariable, updateGroup, updateLayout, updateMeCredentials, updateNotificationTemplate, updateOrganizationUnit, updateOrganizationUnitByPath, updatePresentationDefinition, updateProject, updateResource, updateResourceServer, updateRole, updateRoleSharingPolicy, updateSecret, updateServerConfig, updateUser, updateUserSharingPolicy, updateVariable } from "@thunderid/javascript";
 import cache from "memory-cache";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
@@ -10,6 +10,149 @@ import { v4, validate, version } from "uuid";
 
 export * from "@thunderid/javascript"
 
+//#region src/api/access/requestAccessApi.ts
+const METADATA_FIELDS = {
+	evaluation: "access_evaluation_endpoint",
+	evaluations: "access_evaluations_endpoint",
+	searchAction: "search_action_endpoint"
+};
+const trimSlash = (value) => value.replace(/\/+$/, "");
+/**
+* Reads the AuthZEN metadata of the server at `baseUrl` and checks that its `policy_decision_point`
+* names that server exactly (apart from a trailing slash).
+*/
+const getAuthZENConfiguration = async (operation, { baseUrl, fetcher, signal }) => {
+	const fetchFn = fetcher ?? fetch;
+	let response;
+	try {
+		response = await fetchFn(`${trimSlash(baseUrl)}/.well-known/authzen-configuration`, {
+			headers: { Accept: "application/json" },
+			method: "GET",
+			signal
+		});
+	} catch (error) {
+		throw new ThunderIDAPIError(`Network or parsing error: ${error instanceof Error ? error.message : "Unknown error"}`, `${operation}-NetworkError-001`, "node", 0, "Network Error");
+	}
+	if (!response.ok) throw new ThunderIDAPIError(await response.text().catch(() => ""), `${operation}-MetadataError-001`, "node", response.status, response.statusText, "Reading the AuthZEN metadata failed");
+	const metadata = await response.json();
+	if (typeof metadata?.policy_decision_point !== "string" || trimSlash(metadata.policy_decision_point) !== trimSlash(baseUrl)) throw new ThunderIDAPIError("The policy_decision_point in the AuthZEN metadata does not match the configured server.", `${operation}-MetadataError-002`, "node");
+	return metadata;
+};
+/**
+* Resolves an access endpoint: an explicit override, held to the origin of `baseUrl`, else the
+* server's AuthZEN metadata.
+*/
+const resolveEndpoint = async (operation, key, config) => {
+	const override = config.endpoints?.[key];
+	if (override) {
+		if (new URL(override).origin !== new URL(config.baseUrl).origin) throw new ThunderIDAPIError(`The ${key} endpoint override is not on the origin of baseUrl.`, `${operation}-ValidationError-002`, "node", 400);
+		return override;
+	}
+	const endpoint = (await getAuthZENConfiguration(operation, config))[METADATA_FIELDS[key]];
+	if (typeof endpoint !== "string" || endpoint === "") throw new ThunderIDAPIError(`The AuthZEN metadata names no ${METADATA_FIELDS[key]}.`, `${operation}-MetadataError-003`, "node");
+	return endpoint;
+};
+/**
+* Posts an AuthZEN request with the `Direct-Auth-Secret` header. A `4xx` or `5xx` answer is an error
+* with the server's `error` as the message; 401, 403 and 404 keep distinct codes.
+*/
+const requestAccessApi = async (operation, key, config, body) => {
+	try {
+		new URL(config.baseUrl);
+	} catch (error) {
+		throw new ThunderIDAPIError(`Invalid URL provided. ${error instanceof Error ? error.message : String(error)}`, `${operation}-ValidationError-001`, "node", 400, "The provided `baseUrl` does not adhere to the URL schema.");
+	}
+	if (typeof config.secret !== "string" || config.secret === "") throw new ThunderIDAPIError("The Direct-Auth-Secret is required for access evaluation.", `${operation}-ValidationError-003`, "node", 400);
+	const endpoint = await resolveEndpoint(operation, key, config);
+	const fetchFn = config.fetcher ?? fetch;
+	let response;
+	try {
+		response = await fetchFn(endpoint, {
+			body: JSON.stringify(body),
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				"Direct-Auth-Secret": config.secret
+			},
+			method: "POST",
+			signal: config.signal
+		});
+	} catch (error) {
+		throw new ThunderIDAPIError(`Network or parsing error: ${error instanceof Error ? error.message : "Unknown error"}`, `${operation}-NetworkError-001`, "node", 0, "Network Error");
+	}
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		let message = text;
+		try {
+			const parsed = JSON.parse(text);
+			if (typeof parsed?.error === "string" && parsed.code === void 0) message = JSON.stringify({
+				code: parsed.error,
+				message: { defaultValue: parsed.error }
+			});
+		} catch {}
+		let reason = "ResponseError";
+		if (response.status === 401) reason = "UnauthorizedError";
+		if (response.status === 403) reason = "ForbiddenError";
+		if (response.status === 404) reason = "NotFoundError";
+		throw new ThunderIDAPIError(message, `${operation}-${reason}-001`, "node", response.status, response.statusText, "Access evaluation failed");
+	}
+	return await response.json();
+};
+var requestAccessApi_default = requestAccessApi;
+
+//#endregion
+//#region src/api/access/evaluateAccess.ts
+/**
+* Asks the server's AuthZEN policy decision point whether a subject may perform an action on a resource,
+* at the `access_evaluation_endpoint` from `/.well-known/authzen-configuration`.
+*
+* Server-side only: it is authorized by the server-level secret in the `Direct-Auth-Secret` header,
+* which a browser or mobile app cannot hold.
+*
+* A denial is a result: `{decision: false}`, with the reason in `context`. Only a transport failure or a
+* 4xx/5xx answer throws.
+*
+* @example
+* ```typescript
+* const {decision} = await evaluateAccess(
+*   {subject: {type: 'user', id: userId}, resource: {type: 'https://api.example.com/booking'}, action: {name: 'booking:read'}},
+*   {baseUrl: 'https://localhost:8090', secret: process.env.THUNDERID_DIRECT_AUTH_SECRET!},
+* );
+* ```
+*/
+const evaluateAccess = (request, config) => requestAccessApi_default("evaluateAccess", "evaluation", config, request);
+var evaluateAccess_default = evaluateAccess;
+
+//#endregion
+//#region src/api/access/evaluateAccesses.ts
+/**
+* Evaluates a batch of access requests at the `access_evaluations_endpoint`, and returns one decision
+* per evaluation, in order. `defaults` apply to every evaluation that does not set that member itself.
+*
+* Server-side only, like {@link evaluateAccess}. A denial is a result, not an error.
+*/
+const evaluateAccesses = async ({ defaults, evaluations }, config) => {
+	return (await requestAccessApi_default("evaluateAccesses", "evaluations", config, { evaluations: (evaluations ?? []).map((evaluation) => ({
+		...defaults,
+		...evaluation
+	})) }))?.evaluations ?? [];
+};
+var evaluateAccesses_default = evaluateAccesses;
+
+//#endregion
+//#region src/api/access/searchActions.ts
+/**
+* Asks which actions a subject may perform on a resource, at the `search_action_endpoint`
+* (`/access/v1/search/action`). Server-side only, like {@link evaluateAccess}.
+*
+* @returns The actions the subject may perform.
+*/
+const searchActions = async (request, config) => {
+	return (await requestAccessApi_default("searchActions", "searchAction", config, request))?.results ?? [];
+};
+var searchActions_default = searchActions;
+
+//#endregion
 //#region src/stores/MemoryCacheStore.ts
 /**
 * In-memory key-value store backed by `memory-cache`.
@@ -211,6 +354,49 @@ const createManagementClient = (resolve) => {
 				...await config("applications", options)
 			})
 		},
+		authorizationDetailTypes: {
+			create: async (payload, options) => createAuthorizationDetailType({
+				payload,
+				...await config("authorizationDetailTypes", options)
+			}),
+			delete: async (authorizationDetailTypeId, options) => deleteAuthorizationDetailType({
+				authorizationDetailTypeId: requireId(authorizationDetailTypeId, "deleteAuthorizationDetailType"),
+				...await config("authorizationDetailTypes", options)
+			}),
+			get: async (authorizationDetailTypeId, options) => getAuthorizationDetailType({
+				authorizationDetailTypeId: requireId(authorizationDetailTypeId, "getAuthorizationDetailType"),
+				...await config("authorizationDetailTypes", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getAuthorizationDetailTypes({
+				limit,
+				offset,
+				...await config("authorizationDetailTypes", options)
+			}),
+			update: async (authorizationDetailTypeId, payload, options) => updateAuthorizationDetailType({
+				authorizationDetailTypeId: requireId(authorizationDetailTypeId, "updateAuthorizationDetailType"),
+				payload,
+				...await config("authorizationDetailTypes", options)
+			})
+		},
+		clientRegistrations: {
+			delete: async (clientId, options) => deleteClientRegistration({
+				clientId: requireId(clientId, "deleteClientRegistration"),
+				...await config("clientRegistrations", options)
+			}),
+			get: async (clientId, options) => getClientRegistration({
+				clientId: requireId(clientId, "getClientRegistration"),
+				...await config("clientRegistrations", options)
+			}),
+			register: async (payload, options) => registerClient({
+				payload,
+				...await config("clientRegistrations", options)
+			}),
+			update: async (clientId, payload, options) => updateClientRegistration({
+				clientId: requireId(clientId, "updateClientRegistration"),
+				payload,
+				...await config("clientRegistrations", options)
+			})
+		},
 		configuration: {
 			captureVersion: async (payload, options) => createConfigurationVersion({
 				payload,
@@ -276,6 +462,26 @@ const createManagementClient = (resolve) => {
 				...await config("connections", options)
 			})
 		},
+		credentialConfigurations: {
+			create: async (payload, options) => createCredentialConfiguration({
+				payload,
+				...await config("credentialConfigurations", options)
+			}),
+			delete: async (configurationId, options) => deleteCredentialConfiguration({
+				configurationId: requireId(configurationId, "deleteCredentialConfiguration"),
+				...await config("credentialConfigurations", options)
+			}),
+			get: async (configurationId, options) => getCredentialConfiguration({
+				configurationId: requireId(configurationId, "getCredentialConfiguration"),
+				...await config("credentialConfigurations", options)
+			}),
+			list: async (options) => getCredentialConfigurations(await config("credentialConfigurations", options)),
+			update: async (configurationId, payload, options) => updateCredentialConfiguration({
+				configurationId: requireId(configurationId, "updateCredentialConfiguration"),
+				payload,
+				...await config("credentialConfigurations", options)
+			})
+		},
 		design: {
 			createLayout: async (payload, options) => createLayout({
 				payload,
@@ -380,6 +586,49 @@ const createManagementClient = (resolve) => {
 				flowId: requireId(flowId, "updateFlow"),
 				payload,
 				...await config("flows", options)
+			}),
+			createSharingPolicy: async (flowId, payload, options) => createFlowSharingPolicy({
+				payload,
+				flowId: requireId(flowId, "createFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			deleteSharingPolicy: async (flowId, policyId, options) => deleteFlowSharingPolicy({
+				flowId: requireId(flowId, "deleteFlowSharingPolicy"),
+				policyId: requireId(policyId, "deleteFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			getOverlayRules: async (flowId, ouId, options) => getFlowOverlayRules({
+				flowId: requireId(flowId, "getFlowOverlayRules"),
+				ouId: requireId(ouId, "getFlowOverlayRules"),
+				...await config("flows", options)
+			}),
+			getSharingPolicy: async (flowId, policyId, options) => getFlowSharingPolicy({
+				flowId: requireId(flowId, "getFlowSharingPolicy"),
+				policyId: requireId(policyId, "getFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			listSharingPolicies: async (flowId, { limit, offset,...options } = {}) => getFlowSharingPolicies({
+				flowId: requireId(flowId, "getFlowSharingPolicies"),
+				limit,
+				offset,
+				...await config("flows", options)
+			}),
+			updateSharingPolicy: async (flowId, policyId, payload, options) => updateFlowSharingPolicy({
+				payload,
+				policyId: requireId(policyId, "updateFlowSharingPolicy"),
+				flowId: requireId(flowId, "updateFlowSharingPolicy"),
+				...await config("flows", options)
+			}),
+			getVariables: async (flowId, ouId, options) => getFlowVariables({
+				flowId: requireId(flowId, "getFlowVariables"),
+				ouId: requireId(ouId, "getFlowVariables"),
+				...await config("flows", options)
+			}),
+			updateVariables: async (flowId, ouId, variables, options) => updateFlowVariables({
+				flowId: requireId(flowId, "updateFlowVariables"),
+				ouId: requireId(ouId, "updateFlowVariables"),
+				variables,
+				...await config("flows", options)
 			})
 		},
 		gateways: {
@@ -433,6 +682,20 @@ const createManagementClient = (resolve) => {
 				version: version$1,
 				...await config("gateways", options)
 			}),
+			getMaster: async (gatewayId, options) => getGatewayMaster({
+				gatewayId: requireId(gatewayId, "getGatewayMaster"),
+				...await config("gateways", options)
+			}),
+			getMasterHistory: async (gatewayId, options) => getGatewayMasterHistory({
+				gatewayId: requireId(gatewayId, "getGatewayMasterHistory"),
+				...await config("gateways", options)
+			}),
+			getMasterResource: async (gatewayId, resourceType, resourceId, options) => getGatewayMasterResource({
+				gatewayId: requireId(gatewayId, "getGatewayMasterResource"),
+				resourceId: requireId(resourceId, "getGatewayMasterResource"),
+				resourceType: requireId(resourceType, "getGatewayMasterResource"),
+				...await config("gateways", options)
+			}),
 			getSecret: async (gatewayId, name, options) => getGatewaySecret({
 				gatewayId: requireId(gatewayId, "getGatewaySecret"),
 				name: requireId(name, "getGatewaySecret"),
@@ -493,6 +756,11 @@ const createManagementClient = (resolve) => {
 				payload,
 				...await config("groups", options)
 			}),
+			createByPath: async (path, payload, options) => createGroupByPath({
+				path,
+				payload,
+				...await config("groups", options)
+			}),
 			delete: async (groupId, options) => deleteGroup({
 				groupId: requireId(groupId, "deleteGroup"),
 				...await config("groups", options)
@@ -506,6 +774,12 @@ const createManagementClient = (resolve) => {
 				offset,
 				...await config("groups", options)
 			}),
+			listByPath: async (path, { limit, offset,...options } = {}) => getGroupsByPath({
+				limit,
+				offset,
+				path,
+				...await config("groups", options)
+			}),
 			listMembers: async (groupId, { limit, offset,...options } = {}) => getGroupMembers({
 				groupId: requireId(groupId, "getGroupMembers"),
 				limit,
@@ -652,6 +926,50 @@ const createManagementClient = (resolve) => {
 				...await config("organizationUnits", options)
 			})
 		},
+		presentationDefinitions: {
+			create: async (payload, options) => createPresentationDefinition({
+				payload,
+				...await config("presentationDefinitions", options)
+			}),
+			delete: async (definitionId, options) => deletePresentationDefinition({
+				definitionId: requireId(definitionId, "deletePresentationDefinition"),
+				...await config("presentationDefinitions", options)
+			}),
+			get: async (definitionId, options) => getPresentationDefinition({
+				definitionId: requireId(definitionId, "getPresentationDefinition"),
+				...await config("presentationDefinitions", options)
+			}),
+			list: async (options) => getPresentationDefinitions(await config("presentationDefinitions", options)),
+			update: async (definitionId, payload, options) => updatePresentationDefinition({
+				definitionId: requireId(definitionId, "updatePresentationDefinition"),
+				payload,
+				...await config("presentationDefinitions", options)
+			})
+		},
+		projects: {
+			create: async (payload, options) => createProject({
+				payload,
+				...await config("projects", options)
+			}),
+			delete: async (projectId, options) => deleteProject({
+				projectId: requireId(projectId, "deleteProject"),
+				...await config("projects", options)
+			}),
+			get: async (projectId, options) => getProject({
+				projectId: requireId(projectId, "getProject"),
+				...await config("projects", options)
+			}),
+			list: async ({ limit, offset,...options } = {}) => getProjects({
+				limit,
+				offset,
+				...await config("projects", options)
+			}),
+			update: async (projectId, payload, options) => updateProject({
+				projectId: requireId(projectId, "updateProject"),
+				payload,
+				...await config("projects", options)
+			})
+		},
 		resourceServers: {
 			create: async (payload, options) => createResourceServer({
 				payload,
@@ -777,6 +1095,38 @@ const createManagementClient = (resolve) => {
 				payload,
 				roleId: requireId(roleId, "updateRole"),
 				...await config("roles", options)
+			}),
+			createSharingPolicy: async (roleId, payload, options) => createRoleSharingPolicy({
+				payload,
+				roleId: requireId(roleId, "createRoleSharingPolicy"),
+				...await config("roles", options)
+			}),
+			deleteSharingPolicy: async (roleId, policyId, options) => deleteRoleSharingPolicy({
+				roleId: requireId(roleId, "deleteRoleSharingPolicy"),
+				policyId: requireId(policyId, "deleteRoleSharingPolicy"),
+				...await config("roles", options)
+			}),
+			getOverlayRules: async (roleId, ouId, options) => getRoleOverlayRules({
+				roleId: requireId(roleId, "getRoleOverlayRules"),
+				ouId: requireId(ouId, "getRoleOverlayRules"),
+				...await config("roles", options)
+			}),
+			getSharingPolicy: async (roleId, policyId, options) => getRoleSharingPolicy({
+				roleId: requireId(roleId, "getRoleSharingPolicy"),
+				policyId: requireId(policyId, "getRoleSharingPolicy"),
+				...await config("roles", options)
+			}),
+			listSharingPolicies: async (roleId, { limit, offset,...options } = {}) => getRoleSharingPolicies({
+				roleId: requireId(roleId, "getRoleSharingPolicies"),
+				limit,
+				offset,
+				...await config("roles", options)
+			}),
+			updateSharingPolicy: async (roleId, policyId, payload, options) => updateRoleSharingPolicy({
+				payload,
+				policyId: requireId(policyId, "updateRoleSharingPolicy"),
+				roleId: requireId(roleId, "updateRoleSharingPolicy"),
+				...await config("roles", options)
 			})
 		},
 		secrets: {
@@ -1072,7 +1422,7 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 	async signIn(...args) {
 		const [authURLCallback, userId, authorizationCode, state, signInConfig] = args;
 		if (!userId) return Promise.reject(new ThunderIDAuthException("NODE-AUTH_CLIENT-SI-NF01", "No user ID was provided.", "Unable to sign in the user as no user ID was provided."));
-		if (await this.isSignedIn(userId)) {
+		if (!Boolean(authorizationCode && state && await this.isOrganizationUnitBoundRequest(state, userId)) && await this.isSignedIn(userId)) {
 			const sessionData$1 = await this.getStorageManager().getSessionData(userId);
 			return Promise.resolve({
 				accessToken: sessionData$1.access_token,
@@ -1117,6 +1467,87 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		if (!url) return Promise.reject(new ThunderIDAuthException("NODE-AUTH_CLIENT-GSIU-NF01", "Getting authorization URL failed.", "No authorization URL was returned."));
 		return url;
 	}
+	/**
+	* Starts a switch of the session `userId` to the organization unit `organizationUnitId`: builds the
+	* unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) and hands it to `authURLCallback`
+	* to redirect the user to. The server reuses the SSO session when the user can sign in there, so
+	* normally no credentials are asked. Complete it with `signIn(callback, userId, code, state)` on the
+	* callback: the code is redeemed at the unit's token endpoint and replaces the session's tokens.
+	* Until then, and when the callback carries an error, the previous session stays as it was.
+	*
+	* @throws {ThunderIDAPIError} `switchOrganizationUnit-ValidationError-001` without a unit, a session or
+	*   a callback.
+	*/
+	async switchOrganizationUnit(organizationUnitId, options = {}) {
+		const { authURLCallback, userId,...rest } = options;
+		const params = Object.fromEntries(Object.entries(rest).filter(([key]) => key !== "redirect"));
+		if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "" || !userId) throw new ThunderIDAPIError("An organization unit identifier and a session are required.", OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "node", 400);
+		if (typeof authURLCallback !== "function") throw new ThunderIDAPIError("An authURLCallback is required to send the user to the organization unit.", OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "node", 400);
+		authURLCallback(await this.getSignInUrl({
+			...params,
+			organizationUnitId
+		}, userId));
+	}
+	/**
+	* Starts a device authorization request (RFC 8628) for an input-constrained device or a CLI tool. Show
+	* the user `userCode` and `verificationUri`; keep `deviceCode`, a credential, to yourself and pass it
+	* to {@link pollDeviceAuthorization}. It is never logged.
+	*/
+	async startDeviceAuthorization(options = {}) {
+		return super.startDeviceAuthorization(options);
+	}
+	/**
+	* Polls the token endpoint with the device code until the user approves, denies, or the code expires,
+	* and stores the tokens for the session `userId` on approval.
+	*
+	* @throws {ThunderIDAPIError} `JS-AUTH_CORE-DEVICE2-HE03` when the server ends the request
+	*   (`access_denied`, `expired_token`), with the OAuth error in `serverError`.
+	*/
+	async pollDeviceAuthorization(deviceCode, interval, options, userId) {
+		const tokens = await super.pollDeviceAuthorization(deviceCode, interval, options, userId);
+		if (userId) await this.indexSession(userId, await this.getStorageManager().getSessionData(userId));
+		return tokens;
+	}
+	/**
+	* Introspects a token (RFC 7662) at the server's introspection endpoint, authenticating as this client.
+	* An inactive token is a result (`{active: false}`), not an error.
+	*/
+	async introspectToken(token, tokenTypeHint) {
+		return super.introspectToken(token, tokenTypeHint);
+	}
+	/**
+	* The request configuration for access evaluation: the configured server, secret and overrides, with
+	* a per-call secret taking precedence.
+	*/
+	async accessEvaluationConfig(secret, signal) {
+		const configData = await this.getStorageManager().getConfigData();
+		const accessEvaluation = configData.accessEvaluation;
+		return {
+			baseUrl: configData?.baseUrl ?? "",
+			endpoints: accessEvaluation?.endpoints,
+			secret: secret ?? accessEvaluation?.secret ?? "",
+			signal
+		};
+	}
+	/**
+	* Asks the server whether a subject may perform an action on a resource (AuthZEN). A denial is a result
+	* (`decision: false`), not an error. Uses `accessEvaluation.secret`, or `options.secret`.
+	*/
+	async evaluateAccess(request, options = {}) {
+		return evaluateAccess_default(request, await this.accessEvaluationConfig(options.secret, options.signal));
+	}
+	/**
+	* Evaluates a batch of access requests and returns one decision per evaluation, in order.
+	*/
+	async evaluateAccesses(request, options = {}) {
+		return evaluateAccesses_default(request, await this.accessEvaluationConfig(options.secret, options.signal));
+	}
+	/**
+	* Asks which actions a subject may perform on a resource.
+	*/
+	async searchActions(request, options = {}) {
+		return searchActions_default(request, await this.accessEvaluationConfig(options.secret, options.signal));
+	}
 	async signOut(...args) {
 		const userId = typeof args[0] === "string" ? args[0] : void 0;
 		const signOutUrl = await this.getSignOutUrl(userId);
@@ -1667,8 +2098,11 @@ const MANAGEMENT_COLLECTIONS = {
 	agentTypes: "agent-types",
 	agents: "agents",
 	applications: "applications",
+	authorizationDetailTypes: "authorization-detail-types",
+	clientRegistrations: "oauth2/dcr/register",
 	configurationVersions: "configuration-versions",
 	connections: "connections",
+	credentialConfigurations: "openid4vci/credential-configurations",
 	design: "design",
 	export: "export",
 	flows: "flows",
@@ -1678,6 +2112,8 @@ const MANAGEMENT_COLLECTIONS = {
 	import: "import",
 	notificationTemplates: "notification-templates",
 	organizationUnits: "organization-units",
+	presentationDefinitions: "openid4vp/presentation-definitions",
+	projects: "projects",
 	resourceServers: "resource-servers",
 	roles: "roles",
 	secrets: "secrets",
@@ -1742,11 +2178,11 @@ var getSessionCookieOptions_default = getSessionCookieOptions;
 //#endregion
 //#region src/index.ts
 if (!globalThis.fetch) {
-	globalThis.fetch = fetch;
+	globalThis.fetch = fetch$1;
 	globalThis.Headers = Headers;
 	globalThis.Request = Request;
 	globalThis.Response = Response;
 }
 
 //#endregion
-export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MANAGEMENT_COLLECTIONS, MANAGEMENT_COLLECTION_KEYS, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, createManagementClient_default as createManagementClient, generateSessionId_default as generateSessionId, getManagementCollectionUrls, getSessionCookieOptions_default as getSessionCookieOptions, matchManagementUrl };
+export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MANAGEMENT_COLLECTIONS, MANAGEMENT_COLLECTION_KEYS, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, createManagementClient_default as createManagementClient, evaluateAccess_default as evaluateAccess, evaluateAccesses_default as evaluateAccesses, generateSessionId_default as generateSessionId, getManagementCollectionUrls, getSessionCookieOptions_default as getSessionCookieOptions, matchManagementUrl, searchActions_default as searchActions };

package/dist/models/access-evaluation.d.ts

@@ -0,0 +1,112 @@
+/**
+ * The subject of an access evaluation (AuthZEN): who acts.
+ */
+export interface AccessSubject {
+    /**
+     * The subject identifier, such as a user ID.
+     */
+    id: string;
+    properties?: Record<string, unknown>;
+    /**
+     * The subject type, such as `user`. When omitted, the server skips subject type validation.
+     */
+    type?: string;
+}
+/**
+ * The resource of an access evaluation: a resource server identifier as `type`.
+ */
+export interface AccessResource {
+    id?: string;
+    properties?: Record<string, unknown>;
+    /**
+     * The ThunderID resource server identifier, such as `https://api.example.com/booking`.
+     */
+    type: string;
+}
+/**
+ * The action of an access evaluation: a permission registered under the resource server.
+ */
+export interface AccessAction {
+    /**
+     * The permission name, such as `booking:read`.
+     */
+    name: string;
+    properties?: Record<string, unknown>;
+}
+/**
+ * One access evaluation request.
+ */
+export interface AccessEvaluationRequest {
+    action: AccessAction;
+    context?: Record<string, unknown>;
+    resource: AccessResource;
+    subject: AccessSubject;
+}
+/**
+ * A decision. A denial is a result, not an error: an unknown resource or an unregistered action comes
+ * back as `decision: false` with the reason in `context`.
+ */
+export interface AccessEvaluationResponse {
+    context?: Record<string, unknown>;
+    decision: boolean;
+}
+/**
+ * A batch of evaluations. `defaults` (any of subject, action, resource and context) apply to every
+ * evaluation that does not set that member itself.
+ */
+export interface AccessEvaluationsRequest {
+    defaults?: Partial<AccessEvaluationRequest>;
+    evaluations: Partial<AccessEvaluationRequest>[];
+}
+/**
+ * Asks which actions a subject may perform on a resource.
+ */
+export interface AccessActionSearchRequest {
+    context?: Record<string, unknown>;
+    resource: AccessResource;
+    subject: AccessSubject;
+}
+/**
+ * The actions the subject may perform.
+ */
+export interface AccessActionSearchResponse {
+    results: AccessAction[];
+}
+/**
+ * The server's AuthZEN policy decision point metadata, from `/.well-known/authzen-configuration`.
+ */
+export interface AuthZENConfiguration {
+    access_evaluation_endpoint: string;
+    access_evaluations_endpoint?: string;
+    policy_decision_point: string;
+    search_action_endpoint?: string;
+}
+/**
+ * Where access evaluation requests go and how they are authorized.
+ */
+export interface AccessEvaluationRequestConfig {
+    /**
+     * The server's base URL. Its `/.well-known/authzen-configuration` supplies the endpoints, and its
+     * `policy_decision_point` must match it exactly.
+     */
+    baseUrl: string;
+    /**
+     * Explicit endpoint overrides, each on the origin of `baseUrl`. When every endpoint an operation
+     * needs is set, the metadata is not fetched.
+     */
+    endpoints?: {
+        evaluation?: string;
+        evaluations?: string;
+        searchAction?: string;
+    };
+    /**
+     * Optional custom fetcher. Defaults to the global `fetch`.
+     */
+    fetcher?: (url: string, config: RequestInit) => Promise<Response>;
+    /**
+     * The server-level secret, sent in the `Direct-Auth-Secret` header. Never logged.
+     */
+    secret: string;
+    signal?: AbortSignal;
+}
+//# sourceMappingURL=access-evaluation.d.ts.map

package/dist/models/access-evaluation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-evaluation.d.ts","sourceRoot":"","sources":["../../src/models/access-evaluation.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5C,WAAW,EAAE,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB"}