@truenas/api-client 9.0.6 → 11.0.0

package/README.md

@@ -84,6 +84,22 @@ errors with an `AuthError` carrying an `AuthErrorCode`, plus the refusing
 `response` when middleware answered with one (`response.response_type` tells
 `EXPIRED`, `DENIED` and `REDIRECT` apart from `AUTH_ERR`).
 
+A wrong one-time code errors from `loginWithOtp(code)`; it never emits
+`OTP_REQUIRED`. Releases differ on whether the login survives a wrong code
+(25.10 keeps it for up to three tries, 27 and later drop it), and the API
+version does not tell them apart, so read `loginPending` off the error instead:
+
+```typescript
+client.authenticator.loginWithOtp(code).subscribe({
+  next: () => { /* signed in */ },
+  error: (err: unknown) => {
+    if (!(err instanceof AuthError)) throw err;
+    if (err.loginPending) askForAnotherCode();  // OtpAuthFailed, login still open
+    else startOverWithPassword();               // OtpAuthFailed or OtpLoginNotPending
+  },
+});
+```
+
 ## Calls
 
 ```typescript

package/dist/{chunk-UOTSHE2J.cjs → chunk-MQAS7GKB.cjs}

@@ -1733,6 +1733,7 @@ __export(v27_0_0_exports, {
   IscsiTargetCreateModeInput: () => IscsiTargetCreateModeInput,
   KeychainCredentialEntryType: () => KeychainCredentialEntryType,
   KeychainCredentialEntryTypeInput: () => KeychainCredentialEntryTypeInput,
+  Layout: () => Layout,
   Level: () => Level,
   NFS4ACEType: () => NFS4ACEType,
   NFS4ACETypeInput: () => NFS4ACETypeInput,
@@ -1847,6 +1848,10 @@ var Interval = {
   "30": 30,
   "60": 60
 };
+var Layout = {
+  Bucket: "BUCKET",
+  Dataset: "DATASET"
+};
 var Name2 = {
   Cpu: "cpu",
   Cputemp: "cputemp",
@@ -1990,6 +1995,7 @@ __export(v28_0_0_exports, {
   IscsiTargetCreateModeInput: () => IscsiTargetCreateModeInput,
   KeychainCredentialEntryType: () => KeychainCredentialEntryType,
   KeychainCredentialEntryTypeInput: () => KeychainCredentialEntryTypeInput,
+  Layout: () => Layout,
   Level: () => Level,
   NFS4ACEType: () => NFS4ACEType,
   NFS4ACETypeInput: () => NFS4ACETypeInput,
@@ -2065,6 +2071,8 @@ __export(v28_0_0_exports, {
   Versioning: () => Versioning,
   Volblocksize: () => Volblocksize,
   When: () => When,
+  ZFSResourceUserspaceEntryType: () => ZFSResourceUserspaceEntryType,
+  ZFSResourceUserspaceEntryTypeInput: () => ZFSResourceUserspaceEntryTypeInput,
   ZfsTierRewriteJobEntryStatus: () => ZfsTierRewriteJobEntryStatus,
   ZfsTierRewriteJobEntryStatusInput: () => ZfsTierRewriteJobEntryStatusInput,
   ZpoolScrubRunAction: () => ZpoolScrubRunAction
@@ -2150,6 +2158,14 @@ var VMWareMatchDatastoresWithDatasetsResultFilesystemTypeInput = {
   Filesystem: "FILESYSTEM",
   Volume: "VOLUME"
 };
+var ZFSResourceUserspaceEntryType = {
+  User: "user",
+  Group: "group"
+};
+var ZFSResourceUserspaceEntryTypeInput = {
+  User: "user",
+  Group: "group"
+};
 
 // src/generated/index.ts
 var SUPPORTED_API_VERSIONS = [
@@ -2186,6 +2202,7 @@ var TrueNasAuthMechanism = /* @__PURE__ */ ((TrueNasAuthMechanism2) => {
 var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
   AuthErrorCode2["PasswordAuthFailed"] = "PASSWORD_AUTH_FAILED";
   AuthErrorCode2["OtpAuthFailed"] = "OTP_AUTH_FAILED";
+  AuthErrorCode2["OtpLoginNotPending"] = "OTP_LOGIN_NOT_PENDING";
   AuthErrorCode2["ApiKeyAuthFailed"] = "API_KEY_AUTH_FAILED";
   AuthErrorCode2["TokenAuthFailed"] = "TOKEN_AUTH_FAILED";
   AuthErrorCode2["LoginSuperseded"] = "LOGIN_SUPERSEDED";
@@ -2199,11 +2216,12 @@ var AuthError = class _AuthError extends Error {
    * `AUTH_ERR`; the code alone says only which mechanism failed. Absent when the login
    * never got an answer of that kind (an error frame, or a superseded login).
    */
-  constructor(code, message, response) {
+  constructor(code, message, response, options = {}) {
     super(message);
     this.code = code;
     this.response = response;
     this.name = "AuthError";
+    this.loginPending = options.loginPending ?? false;
     Object.setPrototypeOf(this, _AuthError.prototype);
   }
 };
@@ -2744,6 +2762,7 @@ var throwOnAuthenticationFailure = (code, message) => rxjs.switchMap((response)
   }
   return rxjs.of(response);
 });
+var isOtpLoginNotPending = (error) => error.data?.errname === "EINVAL" && typeof error.data.reason === "string" && error.data.reason.includes("OTP_TOKEN: no authentication in progress");
 var TrueNasAuthenticator = class _TrueNasAuthenticator {
   constructor(connection, version) {
     this.connection = connection;
@@ -2927,6 +2946,19 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       rxjs.take(1)
     );
   }
+  /**
+   * The second step of a two-factor login, after `loginWithUserPass` answered
+   * `OTP_REQUIRED`.
+   *
+   * Emits the answer when the code is accepted (`SUCCESS`), or when middleware
+   * refuses the account outright (`EXPIRED`, `DENIED`, `REDIRECT`); never
+   * `OTP_REQUIRED`. A refused code errors with `AuthError`, the same way on
+   * every release:
+   *
+   * - `OtpAuthFailed` with `loginPending: true`: ask for another code.
+   * - `OtpAuthFailed` with `loginPending: false`: start over with the password.
+   * - `OtpLoginNotPending`: no login was waiting for a code; start over.
+   */
   loginWithOtp(code) {
     const { sentDuring, callerInitiated } = this.beginLogin();
     let answered = false;
@@ -2946,6 +2978,12 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       rxjs.map((msg) => {
         if (msg.error) {
+          if (isOtpLoginNotPending(msg.error)) {
+            throw new AuthError(
+              "OTP_LOGIN_NOT_PENDING" /* OtpLoginNotPending */,
+              "TrueNAS is no longer waiting for a one-time passcode for this login. Please sign in with your password again."
+            );
+          }
           const errorMessage = getApiErrorMessage(
             msg.error,
             "Authentication failed"
@@ -2954,6 +2992,23 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         }
         return msg.result;
       }),
+      // A wrong code is answered differently by release, and the API version
+      // does not say which: 25.10 answers `OTP_REQUIRED` and keeps the login
+      // for another code, 27+ answers `AUTH_ERR` and drops it. Both are the
+      // same failure to the caller, told apart only by `loginPending`, so no
+      // caller has to read `OTP_REQUIRED` as "wrong code".
+      rxjs.map((res) => {
+        const loginPending = res?.response_type === "OTP_REQUIRED" /* OtpRequired */;
+        if (loginPending || res?.response_type === "AUTH_ERR" /* AuthErr */) {
+          throw new AuthError(
+            "OTP_AUTH_FAILED" /* OtpAuthFailed */,
+            loginPending ? "TrueNAS rejected the one-time passcode. Please verify it and try again." : "TrueNAS rejected the one-time passcode. Please sign in with your password again.",
+            res,
+            { loginPending }
+          );
+        }
+        return res;
+      }),
       rxjs.tap((res) => {
         if (res?.response_type === "SUCCESS" /* Success */) {
           this.assertNotSuperseded(sentDuring);
@@ -2961,10 +3016,6 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
           this.authenticated$.next(true);
         }
       }),
-      throwOnAuthenticationFailure(
-        "OTP_AUTH_FAILED" /* OtpAuthFailed */,
-        "TrueNAS authentication failed. Please verify your one-time passcode and try again."
-      ),
       rxjs.finalize(() => {
         this.endLogin(sentDuring, callerInitiated, answered);
       }),
@@ -4207,7 +4258,12 @@ function toContainer3(container) {
   return {
     id: container.id.toString(),
     name: container.name,
-    status: toAppState(container.status.state),
+    // `status` is nullable from v28. Middleware's own word on when: "`null` if
+    // `query-options.extra.retrieve_status` is `false`" — so a null is status
+    // that was not fetched, not a container in an unreportable state. That is
+    // what `Unknown` is for ("no usable state"), and it keeps `Container.status`
+    // non-optional for every caller.
+    status: container.status ? toAppState(container.status.state) : "UNKNOWN" /* Unknown */,
     // Optional in the generated entry, required by `Container`.
     autostart: container.autostart ?? false,
     description
@@ -4823,5 +4879,5 @@ exports.v25_10_4_exports = v25_10_4_exports;
 exports.v25_10_5_exports = v25_10_5_exports;
 exports.v27_0_0_exports = v27_0_0_exports;
 exports.v28_0_0_exports = v28_0_0_exports;
-//# sourceMappingURL=chunk-UOTSHE2J.cjs.map
-//# sourceMappingURL=chunk-UOTSHE2J.cjs.map
+//# sourceMappingURL=chunk-MQAS7GKB.cjs.map
+//# sourceMappingURL=chunk-MQAS7GKB.cjs.map