@zyphr-dev/node-sdk 0.1.37 → 0.1.39

package/src/src/apis/AuthRegistrationApi.ts

@@ -20,6 +20,8 @@ import type {
   ConvertAnonymousUserRequest,
   RegisterRequest,
   SignInAnonymouslyRequest,
+  SignInWithGameCenterRequest,
+  SignInWithGooglePlayGamesRequest,
 } from '../models/index';
 import {
     ApiErrorFromJSON,
@@ -32,6 +34,10 @@ import {
     RegisterRequestToJSON,
     SignInAnonymouslyRequestFromJSON,
     SignInAnonymouslyRequestToJSON,
+    SignInWithGameCenterRequestFromJSON,
+    SignInWithGameCenterRequestToJSON,
+    SignInWithGooglePlayGamesRequestFromJSON,
+    SignInWithGooglePlayGamesRequestToJSON,
 } from '../models/index';
 
 export interface AuthRegistrationApiConvertAnonymousUserOperationRequest {
@@ -46,6 +52,14 @@ export interface AuthRegistrationApiSignInAnonymouslyOperationRequest {
     signInAnonymouslyRequest: SignInAnonymouslyRequest;
 }
 
+export interface AuthRegistrationApiSignInWithGameCenterOperationRequest {
+    signInWithGameCenterRequest: SignInWithGameCenterRequest;
+}
+
+export interface AuthRegistrationApiSignInWithGooglePlayGamesOperationRequest {
+    signInWithGooglePlayGamesRequest: SignInWithGooglePlayGamesRequest;
+}
+
 /**
  * AuthRegistrationApi - interface
  * 
@@ -86,7 +100,7 @@ export interface AuthRegistrationApiInterface {
     registerEndUser(registerRequest: RegisterRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse>;
 
     /**
-     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert. 
+     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert.  Pass an optional `organization_id` to create the anonymous user directly in an organization; the returned access token then carries `org_id` (and `orgs`), matching the org-scoped register/login flow. 
      * @summary Sign in anonymously
      * @param {SignInAnonymouslyRequest} signInAnonymouslyRequest 
      * @param {*} [options] Override http request option.
@@ -96,11 +110,43 @@ export interface AuthRegistrationApiInterface {
     signInAnonymouslyRaw(requestParameters: AuthRegistrationApiSignInAnonymouslyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthResultResponse>>;
 
     /**
-     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert. 
+     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert.  Pass an optional `organization_id` to create the anonymous user directly in an organization; the returned access token then carries `org_id` (and `orgs`), matching the org-scoped register/login flow. 
      * Sign in anonymously
      */
     signInAnonymously(signInAnonymouslyRequest: SignInAnonymouslyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse>;
 
+    /**
+     * Exchange an Apple Game Center identity-verification assertion for a Zyphr end-user session. Zyphr independently re-verifies the assertion server-side (Apple certificate chain, RSA-SHA256 signature, timestamp freshness, single-use replay guard, and bundle-id binding) before provisioning-or-looking-up the user and minting tokens. The user is keyed on the modern scoped `playerId` (gamePlayerID).  ## Producing the assertion (Integration)  The assertion is produced **on-device by the iOS app** — there is no server-side way to mint it. The app calls GameKit\'s `GKLocalPlayer.fetchItems(forIdentityVerificationSignature:)`, which returns `publicKeyURL`, `signature`, `salt`, and `timestamp`; combine those with the local player\'s `gamePlayerID` and the app\'s bundle identifier and submit them here.  Two integration shapes are supported:   - **client-direct** — the iOS app holds the Zyphr application public     key and calls this endpoint itself.   - **backend-relayed** — the app forwards the fetched assertion fields     to the customer\'s own backend, which relays them to this endpoint;     the app never holds Zyphr keys. (This is the common shape for games.)  On any verification failure the response is a single opaque `401` `invalid_assertion` — the specific control that failed is never disclosed. 
+     * @summary Sign in with Apple Game Center
+     * @param {SignInWithGameCenterRequest} signInWithGameCenterRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthRegistrationApiInterface
+     */
+    signInWithGameCenterRaw(requestParameters: AuthRegistrationApiSignInWithGameCenterOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthResultResponse>>;
+
+    /**
+     * Exchange an Apple Game Center identity-verification assertion for a Zyphr end-user session. Zyphr independently re-verifies the assertion server-side (Apple certificate chain, RSA-SHA256 signature, timestamp freshness, single-use replay guard, and bundle-id binding) before provisioning-or-looking-up the user and minting tokens. The user is keyed on the modern scoped `playerId` (gamePlayerID).  ## Producing the assertion (Integration)  The assertion is produced **on-device by the iOS app** — there is no server-side way to mint it. The app calls GameKit\'s `GKLocalPlayer.fetchItems(forIdentityVerificationSignature:)`, which returns `publicKeyURL`, `signature`, `salt`, and `timestamp`; combine those with the local player\'s `gamePlayerID` and the app\'s bundle identifier and submit them here.  Two integration shapes are supported:   - **client-direct** — the iOS app holds the Zyphr application public     key and calls this endpoint itself.   - **backend-relayed** — the app forwards the fetched assertion fields     to the customer\'s own backend, which relays them to this endpoint;     the app never holds Zyphr keys. (This is the common shape for games.)  On any verification failure the response is a single opaque `401` `invalid_assertion` — the specific control that failed is never disclosed. 
+     * Sign in with Apple Game Center
+     */
+    signInWithGameCenter(signInWithGameCenterRequest: SignInWithGameCenterRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse>;
+
+    /**
+     * Exchange a Google Play Games Services (GPGS) **server auth code** for a Zyphr end-user session. Unlike Game Center (which submits an Apple-signed assertion), GPGS is verified by Google: Zyphr exchanges the single-use server auth code at Google\'s OAuth2 token endpoint, then calls the Play Games REST API (`players/me`) server-side to obtain the trusted, tamper-proof `playerId`. The user is provisioned-or-looked-up on that server-fetched `playerId` and tokens are minted.  ## Producing the server auth code (Integration)  The server auth code is obtained **on-device by the Android app** — there is no server-side way to mint it. The app calls `GamesSignInClient.requestServerSideAccess(serverClientId, …)` using the Google Cloud **web (server) client id** configured for the game, which returns a single-use auth code string. Submit that string here as `serverAuthCode`.  The **backend-relayed** shape is the common one: the app forwards the auth code to the customer\'s own backend, which relays it to this endpoint; the app never holds Zyphr keys.  ## Security  The `playerId` is derived **only** from Zyphr\'s own server-side call to Google after the token exchange — a client-supplied player id is never accepted or trusted. On any verification failure the response is a single opaque `401` `invalid_auth_code`; the specific control that failed is never disclosed. 
+     * @summary Sign in with Google Play Games Services
+     * @param {SignInWithGooglePlayGamesRequest} signInWithGooglePlayGamesRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthRegistrationApiInterface
+     */
+    signInWithGooglePlayGamesRaw(requestParameters: AuthRegistrationApiSignInWithGooglePlayGamesOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthResultResponse>>;
+
+    /**
+     * Exchange a Google Play Games Services (GPGS) **server auth code** for a Zyphr end-user session. Unlike Game Center (which submits an Apple-signed assertion), GPGS is verified by Google: Zyphr exchanges the single-use server auth code at Google\'s OAuth2 token endpoint, then calls the Play Games REST API (`players/me`) server-side to obtain the trusted, tamper-proof `playerId`. The user is provisioned-or-looked-up on that server-fetched `playerId` and tokens are minted.  ## Producing the server auth code (Integration)  The server auth code is obtained **on-device by the Android app** — there is no server-side way to mint it. The app calls `GamesSignInClient.requestServerSideAccess(serverClientId, …)` using the Google Cloud **web (server) client id** configured for the game, which returns a single-use auth code string. Submit that string here as `serverAuthCode`.  The **backend-relayed** shape is the common one: the app forwards the auth code to the customer\'s own backend, which relays it to this endpoint; the app never holds Zyphr keys.  ## Security  The `playerId` is derived **only** from Zyphr\'s own server-side call to Google after the token exchange — a client-supplied player id is never accepted or trusted. On any verification failure the response is a single opaque `401` `invalid_auth_code`; the specific control that failed is never disclosed. 
+     * Sign in with Google Play Games Services
+     */
+    signInWithGooglePlayGames(signInWithGooglePlayGamesRequest: SignInWithGooglePlayGamesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse>;
+
 }
 
 /**
@@ -193,7 +239,7 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
     }
 
     /**
-     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert. 
+     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert.  Pass an optional `organization_id` to create the anonymous user directly in an organization; the returned access token then carries `org_id` (and `orgs`), matching the org-scoped register/login flow. 
      * Sign in anonymously
      */
     async signInAnonymouslyRaw(requestParameters: AuthRegistrationApiSignInAnonymouslyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthResultResponse>> {
@@ -226,7 +272,7 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
     }
 
     /**
-     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert. 
+     * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert.  Pass an optional `organization_id` to create the anonymous user directly in an organization; the returned access token then carries `org_id` (and `orgs`), matching the org-scoped register/login flow. 
      * Sign in anonymously
      */
     async signInAnonymously(signInAnonymouslyRequest: SignInAnonymouslyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse> {
@@ -234,4 +280,88 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
         return await response.value();
     }
 
+    /**
+     * Exchange an Apple Game Center identity-verification assertion for a Zyphr end-user session. Zyphr independently re-verifies the assertion server-side (Apple certificate chain, RSA-SHA256 signature, timestamp freshness, single-use replay guard, and bundle-id binding) before provisioning-or-looking-up the user and minting tokens. The user is keyed on the modern scoped `playerId` (gamePlayerID).  ## Producing the assertion (Integration)  The assertion is produced **on-device by the iOS app** — there is no server-side way to mint it. The app calls GameKit\'s `GKLocalPlayer.fetchItems(forIdentityVerificationSignature:)`, which returns `publicKeyURL`, `signature`, `salt`, and `timestamp`; combine those with the local player\'s `gamePlayerID` and the app\'s bundle identifier and submit them here.  Two integration shapes are supported:   - **client-direct** — the iOS app holds the Zyphr application public     key and calls this endpoint itself.   - **backend-relayed** — the app forwards the fetched assertion fields     to the customer\'s own backend, which relays them to this endpoint;     the app never holds Zyphr keys. (This is the common shape for games.)  On any verification failure the response is a single opaque `401` `invalid_assertion` — the specific control that failed is never disclosed. 
+     * Sign in with Apple Game Center
+     */
+    async signInWithGameCenterRaw(requestParameters: AuthRegistrationApiSignInWithGameCenterOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthResultResponse>> {
+        if (requestParameters['signInWithGameCenterRequest'] == null) {
+            throw new runtime.RequiredError(
+                'signInWithGameCenterRequest',
+                'Required parameter "signInWithGameCenterRequest" was null or undefined when calling signInWithGameCenter().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/game-center`,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: SignInWithGameCenterRequestToJSON(requestParameters['signInWithGameCenterRequest']),
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => AuthResultResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Exchange an Apple Game Center identity-verification assertion for a Zyphr end-user session. Zyphr independently re-verifies the assertion server-side (Apple certificate chain, RSA-SHA256 signature, timestamp freshness, single-use replay guard, and bundle-id binding) before provisioning-or-looking-up the user and minting tokens. The user is keyed on the modern scoped `playerId` (gamePlayerID).  ## Producing the assertion (Integration)  The assertion is produced **on-device by the iOS app** — there is no server-side way to mint it. The app calls GameKit\'s `GKLocalPlayer.fetchItems(forIdentityVerificationSignature:)`, which returns `publicKeyURL`, `signature`, `salt`, and `timestamp`; combine those with the local player\'s `gamePlayerID` and the app\'s bundle identifier and submit them here.  Two integration shapes are supported:   - **client-direct** — the iOS app holds the Zyphr application public     key and calls this endpoint itself.   - **backend-relayed** — the app forwards the fetched assertion fields     to the customer\'s own backend, which relays them to this endpoint;     the app never holds Zyphr keys. (This is the common shape for games.)  On any verification failure the response is a single opaque `401` `invalid_assertion` — the specific control that failed is never disclosed. 
+     * Sign in with Apple Game Center
+     */
+    async signInWithGameCenter(signInWithGameCenterRequest: SignInWithGameCenterRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse> {
+        const response = await this.signInWithGameCenterRaw({ signInWithGameCenterRequest: signInWithGameCenterRequest }, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Exchange a Google Play Games Services (GPGS) **server auth code** for a Zyphr end-user session. Unlike Game Center (which submits an Apple-signed assertion), GPGS is verified by Google: Zyphr exchanges the single-use server auth code at Google\'s OAuth2 token endpoint, then calls the Play Games REST API (`players/me`) server-side to obtain the trusted, tamper-proof `playerId`. The user is provisioned-or-looked-up on that server-fetched `playerId` and tokens are minted.  ## Producing the server auth code (Integration)  The server auth code is obtained **on-device by the Android app** — there is no server-side way to mint it. The app calls `GamesSignInClient.requestServerSideAccess(serverClientId, …)` using the Google Cloud **web (server) client id** configured for the game, which returns a single-use auth code string. Submit that string here as `serverAuthCode`.  The **backend-relayed** shape is the common one: the app forwards the auth code to the customer\'s own backend, which relays it to this endpoint; the app never holds Zyphr keys.  ## Security  The `playerId` is derived **only** from Zyphr\'s own server-side call to Google after the token exchange — a client-supplied player id is never accepted or trusted. On any verification failure the response is a single opaque `401` `invalid_auth_code`; the specific control that failed is never disclosed. 
+     * Sign in with Google Play Games Services
+     */
+    async signInWithGooglePlayGamesRaw(requestParameters: AuthRegistrationApiSignInWithGooglePlayGamesOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthResultResponse>> {
+        if (requestParameters['signInWithGooglePlayGamesRequest'] == null) {
+            throw new runtime.RequiredError(
+                'signInWithGooglePlayGamesRequest',
+                'Required parameter "signInWithGooglePlayGamesRequest" was null or undefined when calling signInWithGooglePlayGames().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/google-play-games`,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: SignInWithGooglePlayGamesRequestToJSON(requestParameters['signInWithGooglePlayGamesRequest']),
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => AuthResultResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Exchange a Google Play Games Services (GPGS) **server auth code** for a Zyphr end-user session. Unlike Game Center (which submits an Apple-signed assertion), GPGS is verified by Google: Zyphr exchanges the single-use server auth code at Google\'s OAuth2 token endpoint, then calls the Play Games REST API (`players/me`) server-side to obtain the trusted, tamper-proof `playerId`. The user is provisioned-or-looked-up on that server-fetched `playerId` and tokens are minted.  ## Producing the server auth code (Integration)  The server auth code is obtained **on-device by the Android app** — there is no server-side way to mint it. The app calls `GamesSignInClient.requestServerSideAccess(serverClientId, …)` using the Google Cloud **web (server) client id** configured for the game, which returns a single-use auth code string. Submit that string here as `serverAuthCode`.  The **backend-relayed** shape is the common one: the app forwards the auth code to the customer\'s own backend, which relays it to this endpoint; the app never holds Zyphr keys.  ## Security  The `playerId` is derived **only** from Zyphr\'s own server-side call to Google after the token exchange — a client-supplied player id is never accepted or trusted. On any verification failure the response is a single opaque `401` `invalid_auth_code`; the specific control that failed is never disclosed. 
+     * Sign in with Google Play Games Services
+     */
+    async signInWithGooglePlayGames(signInWithGooglePlayGamesRequest: SignInWithGooglePlayGamesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthResultResponse> {
+        const response = await this.signInWithGooglePlayGamesRaw({ signInWithGooglePlayGamesRequest: signInWithGooglePlayGamesRequest }, initOverrides);
+        return await response.value();
+    }
+
 }