@truenas/api-client 3.0.5 → 3.0.6

package/dist/index.d.cts

@@ -12851,6 +12851,20 @@ interface ApiKeyCreate {
 declare enum UserRole {
     FullAdmin = "FULL_ADMIN"
 }
+/**
+ * A role as middleware reports it.
+ *
+ * `UserRole` names only the role this client itself had a use for. Middleware
+ * defines many more — `SHARING_ADMIN`, `READONLY_ADMIN` and so on — and this
+ * client does not enumerate them, because it no longer makes any decision from
+ * a role and would only be maintaining a second copy of someone else's list.
+ *
+ * Widened to `string` so a consumer can compare against the roles it cares
+ * about without a cast, while `UserRole` still autocompletes. Consumers are
+ * where role policy lives now, so the type they are handed has to admit the
+ * roles they will actually test for.
+ */
+type UserRoleName = UserRole | (string & {});
 
 interface UserPreferences {
     language: string;
@@ -12896,7 +12910,7 @@ interface AuthResponse {
         groups: number[];
         privilege: {
             roles: {
-                $set: UserRole[];
+                $set: UserRoleName[];
             };
         };
         two_factor_auth_configured: boolean;
@@ -12935,6 +12949,13 @@ interface AuthResponse {
  * TrueNAS authenticator using the JSON-RPC 2.0 protocol.
  *
  * It handles authentication using the JSON-RPC 2.0 message format.
+ *
+ * Authentication only: any credential middleware accepts logs in here, whatever
+ * roles it carries. No path checks privilege, and that is the design — the
+ * appliance authorizes every privileged call on its own, and which roles a given
+ * product requires is that product's policy, not this client's. Consumers who
+ * need one read `user_info.privilege.roles` off the response and enforce it
+ * themselves; embedding a rule here would impose it on every consumer at once.
  */
 declare class TrueNasAuthenticator {
     private connection;
@@ -12958,6 +12979,38 @@ declare class TrueNasAuthenticator {
         key: string;
     };
     sessionLifetime: number;
+    /**
+     * Claimed by each login when it sends and checked when its answer lands: a
+     * difference means another login or a logout was issued in between, so this
+     * answer is stale and must not write session state. Responses on one socket
+     * are not ordered, which is why arrival is not enough to make an answer
+     * current.
+     *
+     * `logout()` bumps it without claiming one. It has no answer to guard —
+     * it settles its own state at the call — and bumping is what invalidates the
+     * logins already on the wire that a logout is meant to override.
+     */
+    private authEpoch;
+    /**
+     * Caller-issued logins still awaiting an answer, keyed by the epoch each
+     * claimed. The value is whether its frame has been written to a socket yet.
+     *
+     * The auto-relogin below defers while any entry exists. It is this class
+     * retrying a cached credential, not a request anyone made, so it must never
+     * outrank an explicit login — and it would: `TrueNasConnection.send` holds a
+     * frame through an outage rather than dropping it, so a login submitted while
+     * the socket is down is still pending when `opened` fires, and a relogin
+     * claiming the newer epoch has that login answered `LoginSuperseded` while the
+     * client authenticates as the previously cached account.
+     *
+     * Keyed rather than counted, because a count cannot say *which* login a
+     * removal belongs to: a login torn down by its caller would retire a slot
+     * belonging to a different login that is still waiting, and the retry would
+     * overtake it again. Identity also makes a double-subscribed login harmless.
+     */
+    private liveCallerLogins;
+    /** True only while the constructor's relogin is being constructed. */
+    private reloginInProgress;
     constructor(connection: TrueNasConnection, version?: ApiVersion | undefined);
     /**
      * `login_options` asking for a reconnect token, when the server understands it.
@@ -12979,6 +13032,14 @@ declare class TrueNasAuthenticator {
      * reconnect case the feature is named for.
      */
     private reconnectTokenOption;
+    /**
+     * Throws when another login or a logout was issued after this one was sent,
+     * so a stale answer cannot be reported to its caller as a successful login.
+     */
+    private assertNotSuperseded;
+    /** Claim the next epoch for a login, and record it if a caller asked for it. */
+    private beginLogin;
+    private endLogin;
     loginWithUserPass(username: string, password: string): rxjs.Observable<AuthResponse>;
     loginWithOtp(code: string): rxjs.Observable<AuthResponse>;
     /**
@@ -28108,6 +28169,18 @@ declare enum AuthErrorCode {
     OtpAuthFailed = "OTP_AUTH_FAILED",
     ApiKeyAuthFailed = "API_KEY_AUTH_FAILED",
     TokenAuthFailed = "TOKEN_AUTH_FAILED",
+    /**
+     * A login was overtaken by a logout, or by a later login, while its response
+     * was in flight. The server may well have accepted it; this client discarded
+     * the result rather than authenticate a session the caller had moved on from.
+     */
+    LoginSuperseded = "LOGIN_SUPERSEDED",
+    /**
+     * @deprecated Nothing throws this. The authenticator no longer refuses a
+     * login for want of a role — see `TrueNasAuthenticator`. Kept so consumers
+     * still narrowing on the code keep compiling; removing it would be a breaking
+     * change for a member that can no longer occur.
+     */
     FullAdminRequired = "FULL_ADMIN_REQUIRED"
 }
 declare class AuthError extends Error {
@@ -28168,4 +28241,4 @@ type ApiError = JsonRpcError | TrueNasError;
  */
 declare function getApiErrorMessage(error: unknown, fallback?: string): string;
 
-export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };
+export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, UserRole, type UserRoleName, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };

package/dist/index.d.ts

@@ -12851,6 +12851,20 @@ interface ApiKeyCreate {
 declare enum UserRole {
     FullAdmin = "FULL_ADMIN"
 }
+/**
+ * A role as middleware reports it.
+ *
+ * `UserRole` names only the role this client itself had a use for. Middleware
+ * defines many more — `SHARING_ADMIN`, `READONLY_ADMIN` and so on — and this
+ * client does not enumerate them, because it no longer makes any decision from
+ * a role and would only be maintaining a second copy of someone else's list.
+ *
+ * Widened to `string` so a consumer can compare against the roles it cares
+ * about without a cast, while `UserRole` still autocompletes. Consumers are
+ * where role policy lives now, so the type they are handed has to admit the
+ * roles they will actually test for.
+ */
+type UserRoleName = UserRole | (string & {});
 
 interface UserPreferences {
     language: string;
@@ -12896,7 +12910,7 @@ interface AuthResponse {
         groups: number[];
         privilege: {
             roles: {
-                $set: UserRole[];
+                $set: UserRoleName[];
             };
         };
         two_factor_auth_configured: boolean;
@@ -12935,6 +12949,13 @@ interface AuthResponse {
  * TrueNAS authenticator using the JSON-RPC 2.0 protocol.
  *
  * It handles authentication using the JSON-RPC 2.0 message format.
+ *
+ * Authentication only: any credential middleware accepts logs in here, whatever
+ * roles it carries. No path checks privilege, and that is the design — the
+ * appliance authorizes every privileged call on its own, and which roles a given
+ * product requires is that product's policy, not this client's. Consumers who
+ * need one read `user_info.privilege.roles` off the response and enforce it
+ * themselves; embedding a rule here would impose it on every consumer at once.
  */
 declare class TrueNasAuthenticator {
     private connection;
@@ -12958,6 +12979,38 @@ declare class TrueNasAuthenticator {
         key: string;
     };
     sessionLifetime: number;
+    /**
+     * Claimed by each login when it sends and checked when its answer lands: a
+     * difference means another login or a logout was issued in between, so this
+     * answer is stale and must not write session state. Responses on one socket
+     * are not ordered, which is why arrival is not enough to make an answer
+     * current.
+     *
+     * `logout()` bumps it without claiming one. It has no answer to guard —
+     * it settles its own state at the call — and bumping is what invalidates the
+     * logins already on the wire that a logout is meant to override.
+     */
+    private authEpoch;
+    /**
+     * Caller-issued logins still awaiting an answer, keyed by the epoch each
+     * claimed. The value is whether its frame has been written to a socket yet.
+     *
+     * The auto-relogin below defers while any entry exists. It is this class
+     * retrying a cached credential, not a request anyone made, so it must never
+     * outrank an explicit login — and it would: `TrueNasConnection.send` holds a
+     * frame through an outage rather than dropping it, so a login submitted while
+     * the socket is down is still pending when `opened` fires, and a relogin
+     * claiming the newer epoch has that login answered `LoginSuperseded` while the
+     * client authenticates as the previously cached account.
+     *
+     * Keyed rather than counted, because a count cannot say *which* login a
+     * removal belongs to: a login torn down by its caller would retire a slot
+     * belonging to a different login that is still waiting, and the retry would
+     * overtake it again. Identity also makes a double-subscribed login harmless.
+     */
+    private liveCallerLogins;
+    /** True only while the constructor's relogin is being constructed. */
+    private reloginInProgress;
     constructor(connection: TrueNasConnection, version?: ApiVersion | undefined);
     /**
      * `login_options` asking for a reconnect token, when the server understands it.
@@ -12979,6 +13032,14 @@ declare class TrueNasAuthenticator {
      * reconnect case the feature is named for.
      */
     private reconnectTokenOption;
+    /**
+     * Throws when another login or a logout was issued after this one was sent,
+     * so a stale answer cannot be reported to its caller as a successful login.
+     */
+    private assertNotSuperseded;
+    /** Claim the next epoch for a login, and record it if a caller asked for it. */
+    private beginLogin;
+    private endLogin;
     loginWithUserPass(username: string, password: string): rxjs.Observable<AuthResponse>;
     loginWithOtp(code: string): rxjs.Observable<AuthResponse>;
     /**
@@ -28108,6 +28169,18 @@ declare enum AuthErrorCode {
     OtpAuthFailed = "OTP_AUTH_FAILED",
     ApiKeyAuthFailed = "API_KEY_AUTH_FAILED",
     TokenAuthFailed = "TOKEN_AUTH_FAILED",
+    /**
+     * A login was overtaken by a logout, or by a later login, while its response
+     * was in flight. The server may well have accepted it; this client discarded
+     * the result rather than authenticate a session the caller had moved on from.
+     */
+    LoginSuperseded = "LOGIN_SUPERSEDED",
+    /**
+     * @deprecated Nothing throws this. The authenticator no longer refuses a
+     * login for want of a role — see `TrueNasAuthenticator`. Kept so consumers
+     * still narrowing on the code keep compiling; removing it would be a breaking
+     * change for a member that can no longer occur.
+     */
     FullAdminRequired = "FULL_ADMIN_REQUIRED"
 }
 declare class AuthError extends Error {
@@ -28168,4 +28241,4 @@ type ApiError = JsonRpcError | TrueNasError;
  */
 declare function getApiErrorMessage(error: unknown, fallback?: string): string;
 
-export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };
+export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, UserRole, type UserRoleName, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };

package/dist/index.js

@@ -2399,6 +2399,7 @@ var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
   AuthErrorCode2["OtpAuthFailed"] = "OTP_AUTH_FAILED";
   AuthErrorCode2["ApiKeyAuthFailed"] = "API_KEY_AUTH_FAILED";
   AuthErrorCode2["TokenAuthFailed"] = "TOKEN_AUTH_FAILED";
+  AuthErrorCode2["LoginSuperseded"] = "LOGIN_SUPERSEDED";
   AuthErrorCode2["FullAdminRequired"] = "FULL_ADMIN_REQUIRED";
   return AuthErrorCode2;
 })(AuthErrorCode || {});
@@ -2437,24 +2438,70 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     this.authenticating$ = new BehaviorSubject(false);
     this.credentials = { username: "", password: "", key: "" };
     this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
+    /**
+     * Claimed by each login when it sends and checked when its answer lands: a
+     * difference means another login or a logout was issued in between, so this
+     * answer is stale and must not write session state. Responses on one socket
+     * are not ordered, which is why arrival is not enough to make an answer
+     * current.
+     *
+     * `logout()` bumps it without claiming one. It has no answer to guard —
+     * it settles its own state at the call — and bumping is what invalidates the
+     * logins already on the wire that a logout is meant to override.
+     */
+    this.authEpoch = 0;
+    /**
+     * Caller-issued logins still awaiting an answer, keyed by the epoch each
+     * claimed. The value is whether its frame has been written to a socket yet.
+     *
+     * The auto-relogin below defers while any entry exists. It is this class
+     * retrying a cached credential, not a request anyone made, so it must never
+     * outrank an explicit login — and it would: `TrueNasConnection.send` holds a
+     * frame through an outage rather than dropping it, so a login submitted while
+     * the socket is down is still pending when `opened` fires, and a relogin
+     * claiming the newer epoch has that login answered `LoginSuperseded` while the
+     * client authenticates as the previously cached account.
+     *
+     * Keyed rather than counted, because a count cannot say *which* login a
+     * removal belongs to: a login torn down by its caller would retire a slot
+     * belonging to a different login that is still waiting, and the retry would
+     * overtake it again. Identity also makes a double-subscribed login harmless.
+     */
+    this.liveCallerLogins = /* @__PURE__ */ new Map();
+    /** True only while the constructor's relogin is being constructed. */
+    this.reloginInProgress = false;
+    this.connection.opened.subscribe((isOpen) => {
+      if (!isOpen) return;
+      for (const epoch of this.liveCallerLogins.keys()) {
+        this.liveCallerLogins.set(epoch, true);
+      }
+    });
     this.connection.opened.pipe(
       filter(
-        (isOpen) => !!(isOpen && this.credentials?.username && (this.credentials.password || this.credentials.key))
+        (isOpen) => !!(isOpen && this.credentials?.username && (this.credentials.password || this.credentials.key) && // An explicit login already on the wire outranks this retry.
+        this.liveCallerLogins.size === 0)
       ),
       switchMap(() => {
-        if (this.credentials.password) {
-          return this.loginWithUserPass(
+        this.reloginInProgress = true;
+        let relogin;
+        try {
+          relogin = this.credentials.password ? this.loginWithUserPass(
             this.credentials.username,
             this.credentials.password
-          );
+          ) : this.loginWithApiKey({
+            username: this.credentials.username,
+            key: this.credentials.key
+          });
+        } finally {
+          this.reloginInProgress = false;
         }
-        return this.loginWithApiKey({
-          username: this.credentials.username,
-          key: this.credentials.key
-        });
+        return relogin.pipe(catchError$1(() => EMPTY));
       })
     ).subscribe();
     connection.closed.subscribe(() => {
+      for (const [epoch, flushed] of this.liveCallerLogins) {
+        if (flushed) this.liveCallerLogins.delete(epoch);
+      }
       this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
       this.authenticated$.next(false);
     });
@@ -2485,7 +2532,36 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     if (!this.version || this.version.year <= legacyCutoffYear) return void 0;
     return { login_options: { reconnect_token: true } };
   }
+  /**
+   * Throws when another login or a logout was issued after this one was sent,
+   * so a stale answer cannot be reported to its caller as a successful login.
+   */
+  assertNotSuperseded(sentDuring) {
+    if (this.authEpoch === sentDuring) return;
+    throw new AuthError(
+      "LOGIN_SUPERSEDED" /* LoginSuperseded */,
+      "Login was superseded by a later logout or login and was discarded."
+    );
+  }
+  /** Claim the next epoch for a login, and record it if a caller asked for it. */
+  beginLogin() {
+    const callerInitiated = !this.reloginInProgress;
+    const sentDuring = ++this.authEpoch;
+    if (callerInitiated) {
+      this.liveCallerLogins.set(sentDuring, this.connection.opened.value);
+    }
+    return { sentDuring, callerInitiated };
+  }
+  endLogin(sentDuring, callerInitiated, answered) {
+    const flushed = this.liveCallerLogins.get(sentDuring);
+    if (callerInitiated && (answered || flushed)) {
+      this.liveCallerLogins.delete(sentDuring);
+    }
+    this.authenticating$.next(false);
+  }
   loginWithUserPass(username, password) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
         mechanism: "PASSWORD_PLAIN" /* Password */,
@@ -2499,6 +2575,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      tap(() => {
+        answered = true;
+      }),
       map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2515,28 +2594,21 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       ),
       tap((res) => {
         if (res.response_type === "SUCCESS" /* Success */) {
-          if (res.user_info?.privilege.roles.$set.includes("FULL_ADMIN" /* FullAdmin */)) {
-            this.credentials.username = username;
-            this.credentials.password = password;
-            this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
-            this.authenticated$.next(true);
-          } else {
-            this.logout();
-            this.authenticated$.next(false);
-            throw new AuthError(
-              "FULL_ADMIN_REQUIRED" /* FullAdminRequired */,
-              "User account must have full admin privileges"
-            );
-          }
+          this.assertNotSuperseded(sentDuring);
+          this.credentials = { username, password, key: "" };
+          this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
+          this.authenticated$.next(true);
         }
       }),
       finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       take(1)
     );
   }
   loginWithOtp(code) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
         mechanism: "OTP_TOKEN" /* Otp */,
@@ -2548,6 +2620,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      tap(() => {
+        answered = true;
+      }),
       map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2560,6 +2635,7 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       tap((res) => {
         if (res?.response_type === "SUCCESS" /* Success */) {
+          this.assertNotSuperseded(sentDuring);
           this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
           this.authenticated$.next(true);
         }
@@ -2569,7 +2645,7 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         "TrueNAS authentication failed. Please verify your one-time passcode and try again."
       ),
       finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       take(1)
     );
@@ -2594,6 +2670,8 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
    * reason the socket dropped in the first place.
    */
   loginWithToken(token) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
         mechanism: "TOKEN_PLAIN" /* Token */,
@@ -2606,6 +2684,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      tap(() => {
+        answered = true;
+      }),
       map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2632,21 +2713,13 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       tap((res) => {
         if (res.response_type === "SUCCESS" /* Success */) {
-          if (res.user_info?.privilege.roles.$set.includes("FULL_ADMIN" /* FullAdmin */)) {
-            this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
-            this.authenticated$.next(true);
-          } else {
-            this.logout();
-            this.authenticated$.next(false);
-            throw new AuthError(
-              "FULL_ADMIN_REQUIRED" /* FullAdminRequired */,
-              "User account must have full admin privileges"
-            );
-          }
+          this.assertNotSuperseded(sentDuring);
+          this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
+          this.authenticated$.next(true);
         }
       }),
       finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       take(1)
     );
@@ -2657,6 +2730,8 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
    * and replayed. The token exists for the credential that cannot be.
    */
   loginWithApiKey(credentials) {
+    const { sentDuring, callerInitiated } = this.beginLogin();
+    let answered = false;
     const { username, key } = credentials;
     const message = createJsonRpcMessage("auth.login_ex", [
       {
@@ -2670,6 +2745,9 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     const messageId = message.id ?? "";
     return this.connection.messages().pipe(
       withId(messageId),
+      tap(() => {
+        answered = true;
+      }),
       map((msg) => {
         if (msg.error) {
           const errorMessage = getApiErrorMessage(
@@ -2685,13 +2763,13 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         "TrueNAS authentication failed. Has the TrueNAS Connect API key been removed from your TrueNAS server?"
       ),
       tap((res) => {
-        this.credentials.username = username;
-        this.credentials.key = key;
+        this.assertNotSuperseded(sentDuring);
+        this.credentials = { username, password: "", key };
         this.sessionLifetime = res.user_info?.attributes?.preferences?.lifetime ?? _TrueNasAuthenticator.DefaultSessionLifetime;
         this.authenticated$.next(true);
       }),
       finalize(() => {
-        this.authenticating$.next(false);
+        this.endLogin(sentDuring, callerInitiated, answered);
       }),
       take(1)
     );
@@ -2718,6 +2796,10 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
     );
   }
   logout() {
+    this.credentials = { username: "", password: "", key: "" };
+    this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
+    this.authEpoch += 1;
+    this.authenticated$.next(false);
     const message = createJsonRpcMessage("auth.logout");
     this.connection.send(message);
     const messageId = message.id ?? "";
@@ -2729,10 +2811,6 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         }
         return msg.result;
       }),
-      tap((success) => {
-        this.sessionLifetime = _TrueNasAuthenticator.DefaultSessionLifetime;
-        this.authenticated$.next(!success);
-      }),
       take(1)
     );
   }
@@ -3923,6 +4001,12 @@ function errorMessageOrDefault(error, fallback) {
   return fallback;
 }
 
-export { AppState, AuthError, AuthErrorCode, InvalidVersionResponseError, JobState, NoCompatibleVersionsError, SUPPORTED_API_VERSIONS, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, v25_10_0_exports as v25_10_0, v25_10_1_exports as v25_10_1, v25_10_2_exports as v25_10_2, v25_10_3_exports as v25_10_3, v25_10_4_exports as v25_10_4, v25_10_5_exports as v25_10_5, v26_0_0_exports as v26_0_0, v27_0_0_exports as v27_0_0 };
+// src/enums/user-role.enum.ts
+var UserRole = /* @__PURE__ */ ((UserRole2) => {
+  UserRole2["FullAdmin"] = "FULL_ADMIN";
+  return UserRole2;
+})(UserRole || {});
+
+export { AppState, AuthError, AuthErrorCode, InvalidVersionResponseError, JobState, NoCompatibleVersionsError, SUPPORTED_API_VERSIONS, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, UserRole, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, v25_10_0_exports as v25_10_0, v25_10_1_exports as v25_10_1, v25_10_2_exports as v25_10_2, v25_10_3_exports as v25_10_3, v25_10_4_exports as v25_10_4, v25_10_5_exports as v25_10_5, v26_0_0_exports as v26_0_0, v27_0_0_exports as v27_0_0 };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map