@vibexp/api-client 0.94.0 → 0.96.0

package/dist/axios/sdk.gen.d.ts

@@ -34,8 +34,8 @@ export declare const health: <ThrowOnError extends boolean = false>(options?: Op
  * URL to begin the authentication flow.
  *
  * The provider is chosen with the `provider` query parameter, whose value is
- * one of the deployment's enabled providers (e.g. `google`, `github`,
- * `oidc`). When exactly one provider is enabled the parameter may be omitted
+ * the slug of one of the deployment's enabled providers (e.g. `google`,
+ * `github`, `oidc`, or an admin-chosen slug such as `corp-sso`). When exactly one provider is enabled the parameter may be omitted
  * and that provider is used. When several are enabled the parameter is
  * required; an unknown or disabled value is rejected (no silent default).
  *
@@ -44,12 +44,13 @@ export declare const login: <ThrowOnError extends boolean = false>(options?: Opt
 /**
  * List enabled login providers
  *
- * Returns the login providers enabled in this deployment's configuration,
- * each with a canonical `name` (the value to pass as `?provider=` to
- * `GET /api/v1/auth/login`) and a human-readable `display_name` for the
- * login UI. The login screen uses this to render a provider picker instead
- * of hardcoding the provider list. The list is stable-sorted and may be
- * empty when no provider is configured.
+ * Returns the login providers enabled on this instance, each with its slug
+ * as `name` (the value to pass as `?provider=` to
+ * `GET /api/v1/auth/login`), a human-readable `display_name` for the login
+ * UI and its `type`. The login screen uses this to render a provider picker
+ * instead of hardcoding the provider list. The list is in the
+ * admin-defined sort order, reflects provider changes with no restart, and
+ * may be empty when no provider is enabled.
  *
  */
 export declare const listAuthProviders: <ThrowOnError extends boolean = false>(options?: Options<ListAuthProvidersData, ThrowOnError>) => RequestResult<ListAuthProvidersResponses, ListAuthProvidersErrors, ThrowOnError>;

package/dist/axios/sdk.gen.js

@@ -30,8 +30,8 @@ export const health = (options) => (options?.client ?? client).get({
  * URL to begin the authentication flow.
  *
  * The provider is chosen with the `provider` query parameter, whose value is
- * one of the deployment's enabled providers (e.g. `google`, `github`,
- * `oidc`). When exactly one provider is enabled the parameter may be omitted
+ * the slug of one of the deployment's enabled providers (e.g. `google`,
+ * `github`, `oidc`, or an admin-chosen slug such as `corp-sso`). When exactly one provider is enabled the parameter may be omitted
  * and that provider is used. When several are enabled the parameter is
  * required; an unknown or disabled value is rejected (no silent default).
  *
@@ -44,12 +44,13 @@ export const login = (options) => (options?.client ?? client).get({
 /**
  * List enabled login providers
  *
- * Returns the login providers enabled in this deployment's configuration,
- * each with a canonical `name` (the value to pass as `?provider=` to
- * `GET /api/v1/auth/login`) and a human-readable `display_name` for the
- * login UI. The login screen uses this to render a provider picker instead
- * of hardcoding the provider list. The list is stable-sorted and may be
- * empty when no provider is configured.
+ * Returns the login providers enabled on this instance, each with its slug
+ * as `name` (the value to pass as `?provider=` to
+ * `GET /api/v1/auth/login`), a human-readable `display_name` for the login
+ * UI and its `type`. The login screen uses this to render a provider picker
+ * instead of hardcoding the provider list. The list is in the
+ * admin-defined sort order, reflects provider changes with no restart, and
+ * may be empty when no provider is enabled.
  *
  */
 export const listAuthProviders = (options) => (options?.client ?? client).get({

package/dist/axios/types.gen.d.ts

@@ -146,18 +146,28 @@ export type User = {
 /**
  * The authenticated user as returned by GET /api/v1/auth/me — the full User
  * object plus session-relative flags. `is_instance_admin` lets the SPA gate the
- * Admin Portal menu and /admin routes; it is UI convenience only, as every
- * /api/v1/admin* call is authorized server-side regardless.
+ * Admin Portal menu and /admin routes, and `is_root_instance_admin` lets it
+ * hide the grant/revoke admin controls; both are UI convenience only, as every
+ * /api/v1/admin* call (and every grant or revoke) is authorized server-side
+ * regardless.
  *
  */
 export type CurrentUser = User & {
     /**
-     * Whether the authenticated user's email is in the configured
-     * auth.instance_admins list (matched case-insensitively). False when the
-     * list is empty (feature dormant).
+     * Whether the authenticated user is an instance admin: either a root
+     * admin (see `is_root_instance_admin`) or a non-suspended user granted
+     * instance admin in the database by a root admin.
      *
      */
     is_instance_admin: boolean;
+    /**
+     * Whether the authenticated user's email is in the configured
+     * auth.instance_admins list (matched case-insensitively). Only root
+     * admins may grant or revoke other instance admins. UI convenience
+     * only; grant/revoke is authorized server-side.
+     *
+     */
+    is_root_instance_admin: boolean;
 };
 /**
  * Response body returned by GET /api/v1/auth/login containing the authorization URL
@@ -182,9 +192,9 @@ export type LogoutResponse = {
  */
 export type AuthProvider = {
     /**
-     * Canonical provider name, also the value to pass as the `provider`
-     * query parameter to GET /api/v1/auth/login (e.g. `google`, `github`,
-     * `oidc`).
+     * Provider slug, also the value to pass as the `provider` query
+     * parameter to GET /api/v1/auth/login (e.g. `google`, `github`, `oidc`,
+     * or an admin-chosen slug such as `corp-sso`).
      *
      */
     name: string;
@@ -192,15 +202,21 @@ export type AuthProvider = {
      * Human-readable label for the provider button in the login UI
      */
     display_name: string;
+    /**
+     * The provider kind. Several `oidc` providers may be enabled side by
+     * side, each with its own slug.
+     *
+     */
+    type: 'google' | 'github' | 'oidc';
 };
 /**
  * Response body returned by GET /api/v1/auth/providers listing the login
- * providers enabled in this deployment's configuration.
+ * providers enabled on this instance.
  *
  */
 export type ProvidersResponse = {
     /**
-     * Enabled login providers, stable-sorted by canonical name
+     * Enabled login providers, ordered by the admin-defined sort order
      */
     providers: Array<AuthProvider>;
 };
@@ -6953,9 +6969,9 @@ export type LoginData = {
     path?: never;
     query?: {
         /**
-         * Canonical name of the identity provider to use (e.g. `google`,
-         * `github`, `oidc`). Optional when a single provider is enabled;
-         * required when more than one is enabled.
+         * Slug of the identity provider to use (the `name` returned by
+         * GET /api/v1/auth/providers). Optional when a single provider is
+         * enabled; required when more than one is enabled.
          *
          */
         provider?: string;
@@ -6974,7 +6990,9 @@ export type LoginErrors = {
      */
     500: ErrorResponse;
     /**
-     * No identity provider is configured (web login unavailable)
+     * No identity provider is enabled (web login unavailable), or the
+     * enabled providers could not be read
+     *
      */
     503: ErrorResponse;
 };
@@ -6997,6 +7015,10 @@ export type ListAuthProvidersErrors = {
      * Internal server error
      */
     500: ErrorResponse;
+    /**
+     * The enabled providers could not be read
+     */
+    503: ErrorResponse;
 };
 export type ListAuthProvidersError = ListAuthProvidersErrors[keyof ListAuthProvidersErrors];
 export type ListAuthProvidersResponses = {
@@ -7034,6 +7056,10 @@ export type AuthCallbackErrors = {
      * Identity provider authentication failed or session could not be created
      */
     500: ErrorResponse;
+    /**
+     * The enabled providers could not be read
+     */
+    503: ErrorResponse;
 };
 export type AuthCallbackError = AuthCallbackErrors[keyof AuthCallbackErrors];
 export type LogoutData = {

package/dist/schema.d.ts

@@ -58,8 +58,8 @@ export interface paths {
          *     URL to begin the authentication flow.
          *
          *     The provider is chosen with the `provider` query parameter, whose value is
-         *     one of the deployment's enabled providers (e.g. `google`, `github`,
-         *     `oidc`). When exactly one provider is enabled the parameter may be omitted
+         *     the slug of one of the deployment's enabled providers (e.g. `google`,
+         *     `github`, `oidc`, or an admin-chosen slug such as `corp-sso`). When exactly one provider is enabled the parameter may be omitted
          *     and that provider is used. When several are enabled the parameter is
          *     required; an unknown or disabled value is rejected (no silent default).
          */
@@ -81,12 +81,13 @@ export interface paths {
         };
         /**
          * List enabled login providers
-         * @description Returns the login providers enabled in this deployment's configuration,
-         *     each with a canonical `name` (the value to pass as `?provider=` to
-         *     `GET /api/v1/auth/login`) and a human-readable `display_name` for the
-         *     login UI. The login screen uses this to render a provider picker instead
-         *     of hardcoding the provider list. The list is stable-sorted and may be
-         *     empty when no provider is configured.
+         * @description Returns the login providers enabled on this instance, each with its slug
+         *     as `name` (the value to pass as `?provider=` to
+         *     `GET /api/v1/auth/login`), a human-readable `display_name` for the login
+         *     UI and its `type`. The login screen uses this to render a provider picker
+         *     instead of hardcoding the provider list. The list is in the
+         *     admin-defined sort order, reflects provider changes with no restart, and
+         *     may be empty when no provider is enabled.
          */
         get: operations["listAuthProviders"];
         put?: never;
@@ -5812,17 +5813,27 @@ export interface components {
         /**
          * @description The authenticated user as returned by GET /api/v1/auth/me — the full User
          *     object plus session-relative flags. `is_instance_admin` lets the SPA gate the
-         *     Admin Portal menu and /admin routes; it is UI convenience only, as every
-         *     /api/v1/admin/* call is authorized server-side regardless.
+         *     Admin Portal menu and /admin routes, and `is_root_instance_admin` lets it
+         *     hide the grant/revoke admin controls; both are UI convenience only, as every
+         *     /api/v1/admin/* call (and every grant or revoke) is authorized server-side
+         *     regardless.
          */
         CurrentUser: components["schemas"]["User"] & {
             /**
-             * @description Whether the authenticated user's email is in the configured
-             *     auth.instance_admins list (matched case-insensitively). False when the
-             *     list is empty (feature dormant).
+             * @description Whether the authenticated user is an instance admin: either a root
+             *     admin (see `is_root_instance_admin`) or a non-suspended user granted
+             *     instance admin in the database by a root admin.
              * @example false
              */
             is_instance_admin: boolean;
+            /**
+             * @description Whether the authenticated user's email is in the configured
+             *     auth.instance_admins list (matched case-insensitively). Only root
+             *     admins may grant or revoke other instance admins. UI convenience
+             *     only; grant/revoke is authorized server-side.
+             * @example false
+             */
+            is_root_instance_admin: boolean;
         };
         /** @description Response body returned by GET /api/v1/auth/login containing the authorization URL */
         LoginResponse: {
@@ -5844,9 +5855,9 @@ export interface components {
         /** @description One enabled login provider, with display metadata for the login UI */
         AuthProvider: {
             /**
-             * @description Canonical provider name, also the value to pass as the `provider`
-             *     query parameter to GET /api/v1/auth/login (e.g. `google`, `github`,
-             *     `oidc`).
+             * @description Provider slug, also the value to pass as the `provider` query
+             *     parameter to GET /api/v1/auth/login (e.g. `google`, `github`, `oidc`,
+             *     or an admin-chosen slug such as `corp-sso`).
              * @example google
              */
             name: string;
@@ -5855,13 +5866,20 @@ export interface components {
              * @example Google
              */
             display_name: string;
+            /**
+             * @description The provider kind. Several `oidc` providers may be enabled side by
+             *     side, each with its own slug.
+             * @example google
+             * @enum {string}
+             */
+            type: "google" | "github" | "oidc";
         };
         /**
          * @description Response body returned by GET /api/v1/auth/providers listing the login
-         *     providers enabled in this deployment's configuration.
+         *     providers enabled on this instance.
          */
         ProvidersResponse: {
-            /** @description Enabled login providers, stable-sorted by canonical name */
+            /** @description Enabled login providers, ordered by the admin-defined sort order */
             providers: components["schemas"]["AuthProvider"][];
         };
         /** @description Request body for POST /api/v1/auth/dev/login (development environment only) */
@@ -13783,9 +13801,9 @@ export interface operations {
         parameters: {
             query?: {
                 /**
-                 * @description Canonical name of the identity provider to use (e.g. `google`,
-                 *     `github`, `oidc`). Optional when a single provider is enabled;
-                 *     required when more than one is enabled.
+                 * @description Slug of the identity provider to use (the `name` returned by
+                 *     GET /api/v1/auth/providers). Optional when a single provider is
+                 *     enabled; required when more than one is enabled.
                  */
                 provider?: string;
             };
@@ -13825,7 +13843,10 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
-            /** @description No identity provider is configured (web login unavailable) */
+            /**
+             * @description No identity provider is enabled (web login unavailable), or the
+             *     enabled providers could not be read
+             */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -13863,6 +13884,15 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
+            /** @description The enabled providers could not be read */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
         };
     };
     authCallback: {
@@ -13883,7 +13913,9 @@ export interface operations {
              * @description Redirects the browser to the frontend. On success, to the home page
              *     (a session cookie is set). When sign-in is denied by the access
              *     allowlist, to `/auth/callback?error=access_restricted` with no session
-             *     cookie set.
+             *     cookie set. When the provider the flow started with was disabled or
+             *     removed before the callback, to
+             *     `/auth/callback?error=provider_unavailable`.
              */
             302: {
                 headers: {
@@ -13925,6 +13957,15 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
+            /** @description The enabled providers could not be read */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
         };
     };
     logout: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibexp/api-client",
-  "version": "0.94.0",
+  "version": "0.96.0",
   "description": "Typed VibeXP API client generated from the OpenAPI spec (openapi-fetch main entrypoint, axios SDK at ./axios)",
   "license": "MIT",
   "repository": {