@witnium-tech/witniumchain 0.10.0 → 0.12.0

package/dist/index.js

@@ -177,9 +177,10 @@ var WitniumchainClient = class {
    * the contract with the caller's client-generated `ownerPublicKey` +
    * `initialSigningPublicKey`. Witnium never sees the private bytes.
    *
-   * Returns `{ orgId, userId, contractAddress, contractVersion,
-   * emailVerifyToken }`. The verify token is also emailed; it's echoed here
-   * for UIs that prefer to render the verify link themselves.
+   * Returns `{ orgId, userId, contractAddress, contractVersion }`. The
+   * email-verify link is mailed to `adminEmail` and never returned, so there
+   * is nothing to render. If the mail cannot be sent, nothing is created and
+   * the call fails with a 502; retry it.
    */
   createOrg(body) {
     return this.req("POST", "/v1/orgs", { auth: "Public", body });
@@ -237,11 +238,36 @@ var WitniumchainClient = class {
       query: { token }
     });
   }
+  /**
+   * Password login. Check `status`: `'authenticated'` means the session
+   * cookie is set. `'mfa_required'` means NO session exists yet: the server
+   * set a short-lived challenge cookie, and {@link loginMfa} must follow with
+   * the user's TOTP or recovery code.
+   */
   login(body) {
     return this.req("POST", "/v1/auth/login", { auth: "Public", body });
   }
-  logout() {
-    return this.req("POST", "/v1/auth/logout", { auth: "Public" });
+  /**
+   * Second step of an MFA login, after `login()` returned `'mfa_required'`.
+   * Relies on the challenge cookie from that call (`credentials: 'include'`).
+   * 401 `mfa_code_invalid`: wrong or reused code, the user may retry.
+   * 401 `mfa_challenge_invalid`: expired or used up, start again at `login()`.
+   * 429 `mfa_rate_limited`: the body carries `retryAfterSeconds`.
+   */
+  loginMfa(body) {
+    return this.req("POST", "/v1/auth/login/mfa", { auth: "Public", body });
+  }
+  /**
+   * End the first-party session. The cached bearer token is dropped even when
+   * the request fails, so a logged-out tab never keeps the previous user's
+   * token.
+   */
+  async logout() {
+    try {
+      return await this.req("POST", "/v1/auth/logout", { auth: "Public" });
+    } finally {
+      this.signOut();
+    }
   }
   forgotPassword(body) {
     return this.req("POST", "/v1/auth/forgot-password", { auth: "Public", body });
@@ -275,43 +301,6 @@ var WitniumchainClient = class {
     return this.req("GET", "/v1/orgs/me/users", { auth: "OrgApiKey" });
   }
   // ────────────────────────────────────────────────────────────────────────
-  // Admin (/v1/admin/organizations/*)
-  // ────────────────────────────────────────────────────────────────────────
-  createOrganization(body) {
-    return this.req("POST", "/v1/admin/organizations", {
-      auth: "AdminToken",
-      body
-    });
-  }
-  setOrgAccountType(id, body) {
-    return this.req(
-      "PATCH",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/account-type`,
-      { auth: "AdminToken", body }
-    );
-  }
-  verifyOrganization(id) {
-    return this.req(
-      "PATCH",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/verify`,
-      { auth: "AdminToken" }
-    );
-  }
-  rotateOrgApiKey(id) {
-    return this.req(
-      "POST",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/rotate-key`,
-      { auth: "AdminToken" }
-    );
-  }
-  adjustOrgCredits(id, body) {
-    return this.req(
-      "POST",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/adjust-credits`,
-      { auth: "AdminToken", body }
-    );
-  }
-  // ────────────────────────────────────────────────────────────────────────
   // Delegated keys (/v1/users/me/delegated-keys/*)
   // ────────────────────────────────────────────────────────────────────────
   listDelegatedKeys(query) {
@@ -511,20 +500,34 @@ var WitniumchainClient = class {
       auth: "SessionCookie"
     });
   }
-  confirmTotp(body) {
-    return this.req("POST", "/v1/account/mfa/totp/confirm", {
+  /**
+   * Confirming bumps the user's security epoch server-side, which ends every
+   * session-minted access token. A cached one is dropped so the next bearer
+   * call mints a fresh token.
+   */
+  async confirmTotp(body) {
+    const res = await this.req("POST", "/v1/account/mfa/totp/confirm", {
       auth: "SessionCookie",
       body
     });
+    if (this.accessTokenFromSession) {
+      this.accessToken = void 0;
+      this.accessTokenFromSession = false;
+    }
+    return res;
   }
-  disableTotp() {
+  /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
+  disableTotp(body) {
     return this.req("DELETE", "/v1/account/mfa/totp", {
-      auth: "SessionCookie"
+      auth: "SessionCookie",
+      body
     });
   }
-  regenerateRecoveryCodes() {
+  /** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
+  regenerateRecoveryCodes(body) {
     return this.req("POST", "/v1/account/mfa/recovery-codes/regenerate", {
-      auth: "SessionCookie"
+      auth: "SessionCookie",
+      body
     });
   }
   // ────────────────────────────────────────────────────────────────────────
@@ -1201,15 +1204,6 @@ var WitniumchainClient = class {
         headers["authorization"] = `Bearer ${this.cfg.orgApiKey}`;
         return;
       }
-      case "AdminToken": {
-        if (!this.cfg.adminToken) {
-          throw new Error(
-            `WitniumchainClient: ${method} ${path} requires an admin token. Pass \`adminToken\` to the constructor.`
-          );
-        }
-        headers["authorization"] = `Bearer ${this.cfg.adminToken}`;
-        return;
-      }
       case "SignedRequest": {
         if (!this.cfg.signedRequest) {
           throw new Error(
@@ -1398,7 +1392,12 @@ var OrgMembers = class {
   list() {
     return this.client.listMembers();
   }
-  /** Invite a member by email (default role `member`). */
+  /**
+   * Invite a member by email (default role `member`). `inviteEmailSent` says
+   * whether the invitation (with the verify link) was mailed; the token is
+   * never returned. A 502 means the membership was recorded but the mail
+   * failed; retry.
+   */
   invite(body) {
     return this.client.inviteMember(body);
   }
@@ -1418,7 +1417,10 @@ var OrgMembers = class {
   remove(userId) {
     return this.client.removeMember(userId);
   }
-  /** Re-mint an email-verify token for a pending member. */
+  /**
+   * Re-send the invitation email to a pending member. Returns `{ email }`;
+   * the fresh verify token is mailed, never returned.
+   */
   resendInvite(userId) {
     return this.client.resendMemberInvite(userId);
   }
@@ -1442,14 +1444,18 @@ var MfaTotp = class {
    * Confirm enrolment with the first user-supplied code. Returns the 10
    * single-use recovery codes — show them to the user ONCE; the server never
    * returns them again. Throws `WitniumchainApiError` with status 400 when
-   * the code is invalid or the enrolment is already confirmed.
+   * the code is invalid or the enrolment is already confirmed. Signs the
+   * user out of every other device and connected app.
    */
   confirm(code) {
     return this.client.confirmTotp({ code });
   }
-  /** Disable TOTP, wiping both the secret and all recovery codes. */
-  disable() {
-    return this.client.disableTotp();
+  /**
+   * Disable TOTP, wiping both the secret and all recovery codes. Requires the
+   * user's current code or a recovery code.
+   */
+  disable(proof) {
+    return this.client.disableTotp(proof);
   }
 };
 var MfaRecoveryCodes = class {
@@ -1460,9 +1466,10 @@ var MfaRecoveryCodes = class {
   /**
    * Issue a fresh set of 10 recovery codes, invalidating the prior ones.
    * Same as `confirm` — codes are returned ONCE and never readable again.
+   * Requires the user's current code or a recovery code.
    */
-  regenerate() {
-    return this.client.regenerateRecoveryCodes();
+  regenerate(proof) {
+    return this.client.regenerateRecoveryCodes(proof);
   }
 };
 function sleep(ms) {
@@ -1496,60 +1503,6 @@ async function sha256Hex(input) {
   return out;
 }
 
-// src/admin-client.ts
-var WitniumchainAdminClient = class {
-  inner;
-  constructor(config) {
-    if (!config.adminToken) {
-      throw new Error("WitniumchainAdminClient: adminToken is required");
-    }
-    this.inner = new WitniumchainClient({
-      baseUrl: config.baseUrl,
-      adminToken: config.adminToken,
-      timeout: config.timeout,
-      fetch: config.fetch
-    });
-  }
-  /**
-   * Mint a new organisation. The returned `apiKey` is shown ONCE — the server
-   * only retains its SHA-256 hash. Persist it before the response leaves
-   * scope; there is no recovery path.
-   *
-   * @param body  Organisation seed: name, email, optional accountType and
-   *              signup credit grant, optional skip-email-verification flag.
-   */
-  createOrganization(body) {
-    return this.inner.createOrganization(body);
-  }
-  /** Flip an org between `metered` (Stripe checkout + credit ledger) and `unlimited` (flat-fee). */
-  setAccountType(orgId, accountType) {
-    return this.inner.setOrgAccountType(orgId, { accountType });
-  }
-  /** Mark an org's email as verified. Prerequisite for the org to create users. */
-  verifyEmail(orgId) {
-    return this.inner.verifyOrganization(orgId);
-  }
-  /**
-   * Rotate the org's API key. The previous `wcorg_live_…` is invalidated and
-   * the new key is returned ONCE — same one-time-secret semantics as
-   * {@link createOrganization}.
-   */
-  rotateApiKey(orgId) {
-    return this.inner.rotateOrgApiKey(orgId);
-  }
-  /**
-   * Apply a signed credit delta to an org's ledger. Positive `delta` grants
-   * credits (goodwill, migration backfill); negative claws them back.
-   * Recorded as `reason: adjustment` with the supplied `note`.
-   *
-   * Use sparingly — this bypasses Stripe and should be auditable from the
-   * `note` alone.
-   */
-  adjustCredits(orgId, delta, note) {
-    return this.inner.adjustOrgCredits(orgId, { delta, note });
-  }
-};
-
 // src/chain-admin-client.ts
 var WitniumchainChainAdminClient = class {
   baseUrl;
@@ -1751,7 +1704,6 @@ exports.OrgMembers = OrgMembers;
 exports.OrgUsers = OrgUsers;
 exports.SigningKeys = SigningKeys;
 exports.Subscriptions = Subscriptions;
-exports.WitniumchainAdminClient = WitniumchainAdminClient;
 exports.WitniumchainApiError = WitniumchainApiError;
 exports.WitniumchainChainAdminClient = WitniumchainChainAdminClient;
 exports.WitniumchainClient = WitniumchainClient;