@treeseed/agent 0.8.5

package/dist/api/auth/d1-store.d.ts

@@ -0,0 +1,114 @@
+import type { D1DatabaseLike } from '@treeseed/sdk/types/cloudflare';
+import type { ApiConfig, ApiCredential, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.ts';
+type PrincipalRecord = {
+    principal: ApiPrincipal;
+    userId: string;
+};
+export interface PersonalAccessTokenResult {
+    id: string;
+    token: string;
+    prefix: string;
+    name: string;
+    expiresAt: string | null;
+}
+export interface ServiceCredentialResult {
+    id: string;
+    serviceId: string;
+    secret: string;
+}
+export declare class D1AuthStore {
+    private readonly config;
+    private readonly db;
+    private initializationPromise;
+    constructor(config: ApiConfig, db: D1DatabaseLike);
+    private run;
+    private first;
+    private all;
+    private ensureInitialized;
+    private ensureAuthSchema;
+    private seedCatalog;
+    private seedConfiguredServices;
+    private loadUser;
+    private loadIdentityByProvider;
+    private loadUserByVerifiedEmail;
+    private rolesForUser;
+    private permissionsForUser;
+    private permissionsForRoles;
+    private scopesForPrincipal;
+    private principalForUser;
+    private assignRole;
+    private replaceRoles;
+    private bootstrapRolesForUser;
+    private writeAuditEvent;
+    private userMetadata;
+    syncUser(identity: UserIdentityProfileInput): Promise<{
+        identityId: string | null;
+        principal: ApiPrincipal;
+        userId: string;
+    }>;
+    createUser(input: {
+        email?: string | null;
+        username?: string | null;
+        displayName?: string | null;
+        metadata?: Record<string, unknown>;
+    }): Promise<PrincipalRecord>;
+    setUserRoles(userId: string, roles: string[]): Promise<PrincipalRecord>;
+    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
+    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
+        ok: true;
+    }>;
+    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
+    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
+    createPersonalAccessToken(userId: string, input: {
+        name: string;
+        scopes?: string[];
+        expiresAt?: string | null;
+    }): Promise<{
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        token: string;
+        prefix: string;
+        name: string;
+        expiresAt: string | null;
+    }>;
+    listPersonalAccessTokens(userId: string): Promise<{
+        id: string;
+        name: string;
+        token_prefix: string;
+        expires_at: string | null;
+        last_used_at: string | null;
+        revoked_at: string | null;
+        created_at: string;
+    }[]>;
+    revokePersonalAccessToken(userId: string, tokenId: string): Promise<void>;
+    upsertServiceCredential(input: {
+        serviceId: string;
+        name: string;
+        secret: string;
+        roles?: string[];
+        permissions?: string[];
+    }): Promise<string>;
+    createServiceCredential(input: {
+        serviceId: string;
+        name: string;
+        roles?: string[];
+        permissions?: string[];
+    }): Promise<ServiceCredentialResult>;
+    rotateServiceCredential(serviceId: string): Promise<ServiceCredentialResult>;
+    authenticateBearerToken(token: string): Promise<{
+        principal: ApiPrincipal;
+        credential: ApiCredential;
+    } | null>;
+    authenticateService(serviceId: string, secret: string): Promise<{
+        principal: ApiPrincipal;
+        credential: ApiCredential;
+    } | null>;
+    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): Promise<{
+        ok: true;
+        accessToken: string;
+        tokenType: "Bearer";
+        expiresAt: string;
+        expiresInSeconds: number;
+        principal: ApiPrincipal;
+    }>;
+}
+export {};