@xcitedbs/client 0.3.8 → 0.3.9

package/dist/client.d.ts

@@ -541,6 +541,12 @@ export declare class XCiteDBClient {
     getGroup(id: string): Promise<AppUserGroup>;
     /** Delete a group (`DELETE /api/v1/security/user-isolation/groups/{id}`). Owner or admin only. */
     deleteGroup(id: string): Promise<void>;
+    /**
+     * Rename a group (`PATCH /api/v1/security/user-isolation/groups/{id}`). Owner or admin only.
+     * Returns the updated group record. The `group_id` is stable across renames, so existing shares
+     * targeted at this group continue to work.
+     */
+    renameGroup(id: string, name: string): Promise<AppUserGroup>;
     /**
      * Add an app user to a group (`POST /api/v1/security/user-isolation/groups/{id}/members`).
      * Owner or admin only. Returns the updated group record.

package/dist/client.js

@@ -1773,6 +1773,14 @@ class XCiteDBClient {
     async deleteGroup(id) {
         await this.request('DELETE', `/api/v1/security/user-isolation/groups/${encodeURIComponent(id)}`);
     }
+    /**
+     * Rename a group (`PATCH /api/v1/security/user-isolation/groups/{id}`). Owner or admin only.
+     * Returns the updated group record. The `group_id` is stable across renames, so existing shares
+     * targeted at this group continue to work.
+     */
+    async renameGroup(id, name) {
+        return this.request('PATCH', `/api/v1/security/user-isolation/groups/${encodeURIComponent(id)}`, { name });
+    }
     /**
      * Add an app user to a group (`POST /api/v1/security/user-isolation/groups/{id}/members`).
      * Owner or admin only. Returns the updated group record.

package/dist/types.d.ts

@@ -699,6 +699,14 @@ export interface UserIsolationShareResult {
 export interface UserIsolationShareListEntry {
     identifier: string;
     mode: UserIsolationShareMode;
+    /** App user id of the user who created this share, parsed from the alias path. */
+    granter_user_id?: string;
+    /** Display name of the granter, looked up at list time. */
+    granter_display_name?: string;
+    /** Email of the granter, looked up at list time. */
+    granter_email?: string;
+    /** Epoch seconds. Omitted for shares created before share-meta storage existed. */
+    created_at?: number;
 }
 /** Response from `GET /api/v1/security/user-isolation/shares?direction=…`. */
 export interface UserIsolationShareListResponse {

package/dist/user-isolation.test.js

@@ -310,6 +310,13 @@ wd('app-user groups + group-aware shares (wet)', () => {
                 const status = err.status;
                 return status === 403;
             }, 'non-owner deleteGroup must be rejected with 403');
+            // Rename: owner can; non-owner cannot.
+            const newName = `g-${suffix}-renamed`;
+            const renamed = await ownerClient.renameGroup(groupId, newName);
+            strict_1.default.equal(renamed.name, newName);
+            strict_1.default.equal(renamed.group_id, groupId, 'group_id must be stable across rename');
+            strict_1.default.ok(renamed.updated_at >= created.updated_at, 'updated_at should advance on rename');
+            await strict_1.default.rejects(() => memberClient.renameGroup(groupId, `g-${suffix}-hijack`), (err) => err.status === 403, 'non-owner renameGroup must be rejected with 403');
             await ownerClient.removeGroupMember(groupId, member.user_id);
             const afterRemove = await ownerClient.getGroup(groupId);
             strict_1.default.ok(!afterRemove.member_ids.includes(member.user_id), 'member_ids should not include removed user');
@@ -378,7 +385,11 @@ wd('app-user groups + group-aware shares (wet)', () => {
             });
             await memberClient.loginAppUser(memberEmail, password);
             const incoming = await memberClient.listUserIsolationShares({ direction: 'incoming' });
-            strict_1.default.ok(incoming.identifiers.some((row) => row.identifier === share.alias), `incoming list should include alias ${share.alias}; got ${JSON.stringify(incoming.identifiers)}`);
+            const matched = incoming.identifiers.find((row) => row.identifier === share.alias);
+            strict_1.default.ok(matched, `incoming list should include alias ${share.alias}; got ${JSON.stringify(incoming.identifiers)}`);
+            strict_1.default.equal(matched.granter_user_id, owner.user_id, 'granter_user_id should match the sharer');
+            strict_1.default.equal(matched.granter_email, ownerEmail, 'granter_email should be the sharer email');
+            strict_1.default.ok(typeof matched.created_at === 'number' && matched.created_at > 0, `created_at should be a positive number; got ${matched.created_at}`);
             const doc = await memberClient.readJsonDocument(share.alias);
             strict_1.default.equal(doc.who, 'owner');
             strict_1.default.equal(doc.v, 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xcitedbs/client",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "XCiteDB BaaS client SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",