@vindentech/api-client 0.3.0-next.2 → 0.3.0-next.20

package/dist/permissions.d.ts

@@ -0,0 +1,46 @@
+import { OPERATION_PERMISSIONS, type ApiPermission, type OperationAccess, type OperationName } from "./generated/_permissions.js";
+export { OPERATION_PERMISSIONS };
+export type { ApiPermission, OperationAccess, OperationName };
+/**
+ * The access rule for an operation — what a caller needs to invoke it. A closed
+ * discriminated union, so every operation is classified and none reads as
+ * "open by omission":
+ *  - `{ kind: "permissions", permissions }` — caller must hold ALL of them;
+ *  - `{ kind: "guest-session", permissions }` — callable with a verified
+ *    anonymous-session token (X-Session-Token) instead of a JWT; an
+ *    authenticated caller must still hold ALL listed permissions (may be
+ *    empty);
+ *  - `{ kind: "authenticated" }` — any authenticated user;
+ *  - `{ kind: "public" }` — no authentication required.
+ *
+ * Keyed by the operation-function name as a typed string literal (e.g.
+ * `"billingAccountsControllerCreateAccountV1"`), so a renamed or removed
+ * operation is a compile error. Pass the name string, not the function — name
+ * lookup is bundler-safe where `Function.name` is not.
+ *
+ * @example
+ * import { requiredPermissions } from "@vindentech/api-client";
+ * requiredPermissions("billingAccountsControllerCreateAccountV1");
+ * // → { kind: "permissions", permissions: ["billingaccount:write"] }
+ */
+export declare function requiredPermissions(operation: OperationName): OperationAccess;
+/**
+ * Whether the given capabilities (e.g. `me.capabilities` from `GET /v1/me`)
+ * satisfy an operation's access rule. `true` for public and authenticated-only
+ * operations (they require no specific permission); for permission-gated ones —
+ * including the authenticated-caller side of a guest-session operation — the
+ * caller must hold ALL required permissions, mirroring the backend
+ * PermissionGuard exactly. Use to gate UI before calling. (For rendering a
+ * guest flow without a signed-in user, check `kind === "guest-session"`
+ * instead — this helper answers for an authenticated caller.)
+ *
+ * For logged-out rendering, read `requiredPermissions(op).kind` to distinguish
+ * `"public"` from `"authenticated"`.
+ *
+ * @example
+ * if (hasRequiredPermissions(me.capabilities, "billingAccountsControllerCreateAccountV1")) {
+ *   // show the "Create account" button
+ * }
+ */
+export declare function hasRequiredPermissions(capabilities: readonly string[], operation: OperationName): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,CAAC;AACjC,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,aAAa,GAAG,eAAe,CAE7E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,aAAa,GACvB,OAAO,CAKT"}

package/dist/permissions.js

@@ -0,0 +1,53 @@
+import { OPERATION_PERMISSIONS, } from "./generated/_permissions.js";
+export { OPERATION_PERMISSIONS };
+/**
+ * The access rule for an operation — what a caller needs to invoke it. A closed
+ * discriminated union, so every operation is classified and none reads as
+ * "open by omission":
+ *  - `{ kind: "permissions", permissions }` — caller must hold ALL of them;
+ *  - `{ kind: "guest-session", permissions }` — callable with a verified
+ *    anonymous-session token (X-Session-Token) instead of a JWT; an
+ *    authenticated caller must still hold ALL listed permissions (may be
+ *    empty);
+ *  - `{ kind: "authenticated" }` — any authenticated user;
+ *  - `{ kind: "public" }` — no authentication required.
+ *
+ * Keyed by the operation-function name as a typed string literal (e.g.
+ * `"billingAccountsControllerCreateAccountV1"`), so a renamed or removed
+ * operation is a compile error. Pass the name string, not the function — name
+ * lookup is bundler-safe where `Function.name` is not.
+ *
+ * @example
+ * import { requiredPermissions } from "@vindentech/api-client";
+ * requiredPermissions("billingAccountsControllerCreateAccountV1");
+ * // → { kind: "permissions", permissions: ["billingaccount:write"] }
+ */
+export function requiredPermissions(operation) {
+    return OPERATION_PERMISSIONS[operation];
+}
+/**
+ * Whether the given capabilities (e.g. `me.capabilities` from `GET /v1/me`)
+ * satisfy an operation's access rule. `true` for public and authenticated-only
+ * operations (they require no specific permission); for permission-gated ones —
+ * including the authenticated-caller side of a guest-session operation — the
+ * caller must hold ALL required permissions, mirroring the backend
+ * PermissionGuard exactly. Use to gate UI before calling. (For rendering a
+ * guest flow without a signed-in user, check `kind === "guest-session"`
+ * instead — this helper answers for an authenticated caller.)
+ *
+ * For logged-out rendering, read `requiredPermissions(op).kind` to distinguish
+ * `"public"` from `"authenticated"`.
+ *
+ * @example
+ * if (hasRequiredPermissions(me.capabilities, "billingAccountsControllerCreateAccountV1")) {
+ *   // show the "Create account" button
+ * }
+ */
+export function hasRequiredPermissions(capabilities, operation) {
+    const access = OPERATION_PERMISSIONS[operation];
+    if (access.kind !== "permissions" && access.kind !== "guest-session")
+        return true;
+    const held = new Set(capabilities);
+    return access.permissions.every((p) => held.has(p));
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAItB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAwB;IAC1D,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAA+B,EAC/B,SAAwB;IAExB,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vindentech/api-client",
-  "version": "0.3.0-next.2",
+  "version": "0.3.0-next.20",
   "description": "TypeScript SDK for the Vinden Core API. Generated from OpenAPI via orval.",
   "license": "UNLICENSED",
   "type": "module",