@~lyre/auth 0.5.0 → 0.6.0

package/dist/admin.d.ts

@@ -177,10 +177,33 @@ declare class AccountsAdmin {
      * Session-authed.
      */
     checkInviteEmail(appSlug: string, email: string): Promise<InviteEmailCheck>;
+    /**
+     * Add a user to a workspace group. Service-key authed (`users:write`).
+     *
+     * Membership was read-only over the API, which is why "reactivate user" had to fall back to
+     * re-INVITING an existing colleague. Use this to restore membership instead.
+     */
+    addGroupMember(groupId: string, userId: string, opts?: {
+        role?: string;
+    }): Promise<void>;
+    /**
+     * Remove a user from a workspace group. Service-key authed (`users:write`). Idempotent.
+     *
+     * Removing a user's APP access does NOT remove their group membership, and the members list
+     * reads membership — so without this a "deleted" user keeps reappearing in the workspace.
+     */
+    removeGroupMember(groupId: string, userId: string): Promise<void>;
     /** Revoke a pending invite (withdraw one sent in error). Session-authed. */
     revokeAppInvite(appSlug: string, inviteId: string): Promise<void>;
     /** Everyone with access to an app. Session-authed. */
     listAppUsers(appSlug: string): Promise<AppMember[]>;
+    /**
+     * Restore an existing user's access to an app. Session-authed. Idempotent.
+     *
+     * The counterpart to `removeAppUser`. Distinct from `inviteToApp`: this is for an account that
+     * already exists and already consented, so it must NOT put the person through registration again.
+     */
+    addAppUser(appSlug: string, userId: string): Promise<void>;
     /** Revoke a user's access to an app. Session-authed. */
     removeAppUser(appSlug: string, userId: string): Promise<void>;
     /** Members of a user_group (the workspace's agents). Service-key authed (`stats:read`). */

package/dist/admin.js

@@ -103,6 +103,32 @@ var AccountsAdmin = class {
       { auth: "session" }
     );
   }
+  /**
+   * Add a user to a workspace group. Service-key authed (`users:write`).
+   *
+   * Membership was read-only over the API, which is why "reactivate user" had to fall back to
+   * re-INVITING an existing colleague. Use this to restore membership instead.
+   */
+  async addGroupMember(groupId, userId, opts = {}) {
+    await this.request(
+      "POST",
+      `/api/auth/user-groups/${encodeURIComponent(groupId)}/members`,
+      { auth: "key", body: { userId, ...opts.role ? { role: opts.role } : {} } }
+    );
+  }
+  /**
+   * Remove a user from a workspace group. Service-key authed (`users:write`). Idempotent.
+   *
+   * Removing a user's APP access does NOT remove their group membership, and the members list
+   * reads membership — so without this a "deleted" user keeps reappearing in the workspace.
+   */
+  async removeGroupMember(groupId, userId) {
+    await this.request(
+      "DELETE",
+      `/api/auth/user-groups/${encodeURIComponent(groupId)}/members?userId=${encodeURIComponent(userId)}`,
+      { auth: "key" }
+    );
+  }
   /** Revoke a pending invite (withdraw one sent in error). Session-authed. */
   async revokeAppInvite(appSlug, inviteId) {
     await this.request(
@@ -120,6 +146,19 @@ var AccountsAdmin = class {
     );
     return data.users ?? [];
   }
+  /**
+   * Restore an existing user's access to an app. Session-authed. Idempotent.
+   *
+   * The counterpart to `removeAppUser`. Distinct from `inviteToApp`: this is for an account that
+   * already exists and already consented, so it must NOT put the person through registration again.
+   */
+  async addAppUser(appSlug, userId) {
+    await this.request(
+      "POST",
+      `/api/auth/apps/${encodeURIComponent(appSlug)}/users`,
+      { auth: "session", body: { userId } }
+    );
+  }
   /** Revoke a user's access to an app. Session-authed. */
   async removeAppUser(appSlug, userId) {
     await this.request(

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@~lyre/auth",
-	"version": "0.5.0",
+	"version": "0.6.0",
 	"description": "Shared Axis Accounts auth SDK \u2014 framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
 	"type": "module",
 	"sideEffects": false,