@vibexp/api-client 0.34.0 → 0.35.0

package/dist/axios/sdk.gen.d.ts

@@ -569,15 +569,18 @@ export declare const getGitHubStatus: <ThrowOnError extends boolean = false>(opt
 /**
  * Get GitHub App installation URL
  *
- * Returns a signed GitHub App installation URL with CSRF protection. Requires an active subscription.
+ * Returns a signed GitHub App installation URL with CSRF protection. Requires team owner/admin — the same permission as completing the callback, so a caller cannot start an install they would be refused at the end of. Requires an active subscription.
  */
 export declare const getGitHubInstallUrl: <ThrowOnError extends boolean = false>(options: Options<GetGitHubInstallUrlData, ThrowOnError>) => RequestResult<GetGitHubInstallUrlResponses, GetGitHubInstallUrlErrors, ThrowOnError>;
 /**
  * Handle GitHub App installation callback
  *
  * Completes the GitHub App installation flow after the user authorizes the app on GitHub.
- * The request must include the `installation_id` returned by GitHub and the signed `state`
- * parameter from the install URL to prevent CSRF attacks. Requires an active subscription.
+ * The request must include the `installation_id` returned by GitHub, the signed `state`
+ * parameter from the install URL (CSRF protection), and the `code` GitHub appends to the
+ * post-install redirect. The `code` is exchanged for a user access token and the
+ * installation is only bound to the team when that user has access to it on GitHub — a valid
+ * `state` alone is not sufficient. Requires team owner/admin and an active subscription.
  *
  */
 export declare const handleGitHubCallback: <ThrowOnError extends boolean = false>(options: Options<HandleGitHubCallbackData, ThrowOnError>) => RequestResult<HandleGitHubCallbackResponses, HandleGitHubCallbackErrors, ThrowOnError>;

package/dist/axios/sdk.gen.js

@@ -1308,7 +1308,7 @@ export const getGitHubStatus = (options) => (options.client ?? client).get({
 /**
  * Get GitHub App installation URL
  *
- * Returns a signed GitHub App installation URL with CSRF protection. Requires an active subscription.
+ * Returns a signed GitHub App installation URL with CSRF protection. Requires team owner/admin — the same permission as completing the callback, so a caller cannot start an install they would be refused at the end of. Requires an active subscription.
  */
 export const getGitHubInstallUrl = (options) => (options.client ?? client).get({
     responseType: 'json',
@@ -1324,8 +1324,11 @@ export const getGitHubInstallUrl = (options) => (options.client ?? client).get({
  * Handle GitHub App installation callback
  *
  * Completes the GitHub App installation flow after the user authorizes the app on GitHub.
- * The request must include the `installation_id` returned by GitHub and the signed `state`
- * parameter from the install URL to prevent CSRF attacks. Requires an active subscription.
+ * The request must include the `installation_id` returned by GitHub, the signed `state`
+ * parameter from the install URL (CSRF protection), and the `code` GitHub appends to the
+ * post-install redirect. The `code` is exchanged for a user access token and the
+ * installation is only bound to the team when that user has access to it on GitHub — a valid
+ * `state` alone is not sufficient. Requires team owner/admin and an active subscription.
  *
  */
 export const handleGitHubCallback = (options) => (options.client ?? client).post({

package/dist/axios/types.gen.d.ts

@@ -7860,7 +7860,7 @@ export type GetGitHubInstallUrlErrors = {
      */
     401: ErrorResponse;
     /**
-     * Forbidden - user does not have access to this team
+     * Forbidden - user does not have access to this team, or is not a team owner/admin
      */
     403: ErrorResponse;
     /**
@@ -7890,6 +7890,10 @@ export type HandleGitHubCallbackData = {
          * HMAC-signed state parameter from the install URL (CSRF protection)
          */
         state: string;
+        /**
+         * OAuth authorization code from GitHub's post-install redirect. Exchanged server-side for a user access token to verify the caller has access to the installation on GitHub.
+         */
+        code: string;
     };
     path: {
         /**
@@ -7910,7 +7914,7 @@ export type HandleGitHubCallbackErrors = {
      */
     401: ErrorResponse;
     /**
-     * Forbidden - state does not match team or user lacks access
+     * Forbidden - state does not match team, the caller is not a team owner/admin, or the caller has no access to the submitted GitHub App installation on GitHub
      */
     403: ErrorResponse;
     /**
@@ -7921,6 +7925,10 @@ export type HandleGitHubCallbackErrors = {
      * Internal server error
      */
     500: ErrorResponse;
+    /**
+     * GitHub App user authorization is not configured on this instance, so caller authority cannot be verified and the installation is not connected
+     */
+    503: ErrorResponse;
 };
 export type HandleGitHubCallbackError = HandleGitHubCallbackErrors[keyof HandleGitHubCallbackErrors];
 export type HandleGitHubCallbackResponses = {

package/dist/schema.d.ts

@@ -1351,7 +1351,7 @@ export interface paths {
         };
         /**
          * Get GitHub App installation URL
-         * @description Returns a signed GitHub App installation URL with CSRF protection. Requires an active subscription.
+         * @description Returns a signed GitHub App installation URL with CSRF protection. Requires team owner/admin — the same permission as completing the callback, so a caller cannot start an install they would be refused at the end of. Requires an active subscription.
          */
         get: operations["getGitHubInstallURL"];
         put?: never;
@@ -1374,8 +1374,11 @@ export interface paths {
         /**
          * Handle GitHub App installation callback
          * @description Completes the GitHub App installation flow after the user authorizes the app on GitHub.
-         *     The request must include the `installation_id` returned by GitHub and the signed `state`
-         *     parameter from the install URL to prevent CSRF attacks. Requires an active subscription.
+         *     The request must include the `installation_id` returned by GitHub, the signed `state`
+         *     parameter from the install URL (CSRF protection), and the `code` GitHub appends to the
+         *     post-install redirect. The `code` is exchanged for a user access token and the
+         *     installation is only bound to the team when that user has access to it on GitHub — a valid
+         *     `state` alone is not sufficient. Requires team owner/admin and an active subscription.
          */
         post: operations["handleGitHubCallback"];
         delete?: never;
@@ -14080,7 +14083,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
-            /** @description Forbidden - user does not have access to this team */
+            /** @description Forbidden - user does not have access to this team, or is not a team owner/admin */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -14126,9 +14129,14 @@ export interface operations {
                     setup_action?: string;
                     /**
                      * @description HMAC-signed state parameter from the install URL (CSRF protection)
-                     * @example team-id:1234567890:signature
+                     * @example team-id:0:1234567890:signature
                      */
                     state: string;
+                    /**
+                     * @description OAuth authorization code from GitHub's post-install redirect. Exchanged server-side for a user access token to verify the caller has access to the installation on GitHub.
+                     * @example abc123def456
+                     */
+                    code: string;
                 };
             };
         };
@@ -14160,7 +14168,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
-            /** @description Forbidden - state does not match team or user lacks access */
+            /** @description Forbidden - state does not match team, the caller is not a team owner/admin, or the caller has no access to the submitted GitHub App installation on GitHub */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -14187,6 +14195,15 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
+            /** @description GitHub App user authorization is not configured on this instance, so caller authority cannot be verified and the installation is not connected */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
         };
     };
     listGitHubRepositories: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibexp/api-client",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Typed VibeXP API client generated from the OpenAPI spec (openapi-fetch main entrypoint, axios SDK at ./axios)",
   "license": "MIT",
   "repository": {