@~lyre/auth 0.6.0 → 0.8.0

package/dist/admin.d.ts

@@ -96,6 +96,14 @@ interface InviteEmailCheck {
     /** When the pending invite lapses — only for `invited`. */
     expiresAt?: string;
 }
+/** A workspace (user_group) with its app-scoped profile values. */
+interface WorkspaceProfile {
+    id: string;
+    slug: string;
+    displayName: string;
+    /** App-scoped values keyed by field name — e.g. `support_email`. Empty when no app was scoped. */
+    profileData: Record<string, string>;
+}
 /** A pending (not yet accepted, not yet expired) app invitation. */
 interface PendingInvite {
     id: string;
@@ -167,16 +175,38 @@ declare class AccountsAdmin {
         profileData?: Record<string, string> | null;
     }): Promise<InviteResult>;
     /**
-     * The profile fields this app collects about a user — the spec to render an invite form from.
-     * Session-authed. Never includes email: that is the invite's identity, not a profile value.
+     * The profile fields this app collects about a SUBJECT — the spec to render a form from.
+     * `ownerType: 'user'` (default) is what an invite form collects about a person; `'user_group'` is
+     * what a workspace's edit form collects about itself. Session-authed. A user's email is never
+     * included: that is identity, not a profile value.
      */
-    listAppProfileFields(appSlug: string): Promise<ProfileFieldSpec[]>;
+    listAppProfileFields(appSlug: string, ownerType?: 'user' | 'user_group'): Promise<ProfileFieldSpec[]>;
     /**
      * Whether an email can be invited — for a live check on an invite form, so the inviter learns
      * BEFORE submitting that someone is already a member or already invited. Email only, exact match.
      * Session-authed.
      */
     checkInviteEmail(appSlug: string, email: string): Promise<InviteEmailCheck>;
+    /**
+     * A workspace's own details — name plus its app-scoped profile values (support email, …).
+     * Service-key authed (`stats:read`). Pass `appId` to scope the profile values.
+     *
+     * Workspace details live in Accounts, which owns the group. Consumers previously had no way to
+     * read them and fell back to a retiring legacy system's copy.
+     */
+    getUserGroup(groupId: string, opts?: {
+        appId?: string;
+    }): Promise<WorkspaceProfile>;
+    /**
+     * Update a workspace's name and/or its app-scoped profile values. Service-key authed
+     * (`users:write`). An empty profile value CLEARS that field rather than storing an empty string.
+     * Accounts drops any key the app does not declare for `user_group`.
+     */
+    updateUserGroup(groupId: string, input: {
+        displayName?: string;
+        profileData?: Record<string, string>;
+        appId?: string;
+    }): Promise<WorkspaceProfile>;
     /**
      * Add a user to a workspace group. Service-key authed (`users:write`).
      *
@@ -193,6 +223,23 @@ declare class AccountsAdmin {
      * reads membership — so without this a "deleted" user keeps reappearing in the workspace.
      */
     removeGroupMember(groupId: string, userId: string): Promise<void>;
+    /**
+     * Deactivate or reactivate a user account GLOBALLY. Service-key authed (`users:write`).
+     *
+     * `disabled: true` sets `users.disabled_at`; `false` clears it. A disabled user cannot
+     * authenticate by ANY route (password, OAuth exchange, token) across EVERY app — this is an
+     * account-level gate, not a per-workspace one. Their rows are retained, so anything they own
+     * (audit history, assigned tickets, migrated connections) keeps a valid owner.
+     *
+     * Accounts also revokes their live sessions across every tenant and emits `session.revoked`, so
+     * deactivation takes effect immediately rather than whenever the last session happens to expire.
+     *
+     * This is the counterpart to `removeGroupMember`, NOT a synonym for it. Removing a membership
+     * deletes the row the members list is built from, so the person disappears and can never be
+     * reactivated from the UI; disabling keeps them listed with `disabledAt` set, which is what the
+     * Active/Deactivated badge reads.
+     */
+    setUserDisabled(userId: string, disabled: boolean): Promise<void>;
     /** Revoke a pending invite (withdraw one sent in error). Session-authed. */
     revokeAppInvite(appSlug: string, inviteId: string): Promise<void>;
     /** Everyone with access to an app. Session-authed. */
@@ -270,4 +317,4 @@ declare class AccountsAdmin {
 /** Convenience factory mirroring the SDK's other `create*` helpers. */
 declare function createAccountsAdmin(opts: AccountsAdminOptions): AccountsAdmin;
 
-export { AccountsAdmin, AccountsAdminError, type AccountsAdminOptions, type AccountsUser, type AppMember, type ChangePasswordResult, type GroupMember, type InviteEmailCheck, type InviteResult, type ListUsersQuery, type ListUsersResult, type PendingInvite, type ProfileFieldSpec, createAccountsAdmin };
+export { AccountsAdmin, AccountsAdminError, type AccountsAdminOptions, type AccountsUser, type AppMember, type ChangePasswordResult, type GroupMember, type InviteEmailCheck, type InviteResult, type ListUsersQuery, type ListUsersResult, type PendingInvite, type ProfileFieldSpec, type WorkspaceProfile, createAccountsAdmin };

package/dist/admin.js

@@ -80,13 +80,16 @@ var AccountsAdmin = class {
     });
   }
   /**
-   * The profile fields this app collects about a user — the spec to render an invite form from.
-   * Session-authed. Never includes email: that is the invite's identity, not a profile value.
+   * The profile fields this app collects about a SUBJECT — the spec to render a form from.
+   * `ownerType: 'user'` (default) is what an invite form collects about a person; `'user_group'` is
+   * what a workspace's edit form collects about itself. Session-authed. A user's email is never
+   * included: that is identity, not a profile value.
    */
-  async listAppProfileFields(appSlug) {
+  async listAppProfileFields(appSlug, ownerType = "user") {
+    const suffix = ownerType === "user_group" ? "?ownerType=user_group" : "";
     const data = await this.request(
       "GET",
-      `/api/auth/apps/${encodeURIComponent(appSlug)}/profile-fields`,
+      `/api/auth/apps/${encodeURIComponent(appSlug)}/profile-fields${suffix}`,
       { auth: "session" }
     );
     return data.fields ?? [];
@@ -103,6 +106,33 @@ var AccountsAdmin = class {
       { auth: "session" }
     );
   }
+  /**
+   * A workspace's own details — name plus its app-scoped profile values (support email, …).
+   * Service-key authed (`stats:read`). Pass `appId` to scope the profile values.
+   *
+   * Workspace details live in Accounts, which owns the group. Consumers previously had no way to
+   * read them and fell back to a retiring legacy system's copy.
+   */
+  async getUserGroup(groupId, opts = {}) {
+    const suffix = opts.appId ? `?appId=${encodeURIComponent(opts.appId)}` : "";
+    return this.request(
+      "GET",
+      `/api/auth/user-groups/${encodeURIComponent(groupId)}${suffix}`,
+      { auth: "key" }
+    );
+  }
+  /**
+   * Update a workspace's name and/or its app-scoped profile values. Service-key authed
+   * (`users:write`). An empty profile value CLEARS that field rather than storing an empty string.
+   * Accounts drops any key the app does not declare for `user_group`.
+   */
+  async updateUserGroup(groupId, input) {
+    return this.request(
+      "PATCH",
+      `/api/auth/user-groups/${encodeURIComponent(groupId)}`,
+      { auth: "key", body: input }
+    );
+  }
   /**
    * Add a user to a workspace group. Service-key authed (`users:write`).
    *
@@ -129,6 +159,32 @@ var AccountsAdmin = class {
       { auth: "key" }
     );
   }
+  /**
+   * Deactivate or reactivate a user account GLOBALLY. Service-key authed (`users:write`).
+   *
+   * `disabled: true` sets `users.disabled_at`; `false` clears it. A disabled user cannot
+   * authenticate by ANY route (password, OAuth exchange, token) across EVERY app — this is an
+   * account-level gate, not a per-workspace one. Their rows are retained, so anything they own
+   * (audit history, assigned tickets, migrated connections) keeps a valid owner.
+   *
+   * Accounts also revokes their live sessions across every tenant and emits `session.revoked`, so
+   * deactivation takes effect immediately rather than whenever the last session happens to expire.
+   *
+   * This is the counterpart to `removeGroupMember`, NOT a synonym for it. Removing a membership
+   * deletes the row the members list is built from, so the person disappears and can never be
+   * reactivated from the UI; disabling keeps them listed with `disabledAt` set, which is what the
+   * Active/Deactivated badge reads.
+   */
+  async setUserDisabled(userId, disabled) {
+    await this.request(
+      "PATCH",
+      `/api/auth/admin/users/${encodeURIComponent(userId)}`,
+      {
+        auth: "key",
+        body: { disabledAt: disabled ? (/* @__PURE__ */ new Date()).toISOString() : null }
+      }
+    );
+  }
   /** Revoke a pending invite (withdraw one sent in error). Session-authed. */
   async revokeAppInvite(appSlug, inviteId) {
     await this.request(

package/package.json

@@ -1,73 +1,73 @@
 {
-	"name": "@~lyre/auth",
-	"version": "0.6.0",
-	"description": "Shared Axis Accounts auth SDK \u2014 framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
-	"type": "module",
-	"sideEffects": false,
-	"license": "MIT",
-	"author": "Britam Trust Services / Lyre",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/kigathi-chege/lyre-auth-sdk.git"
-	},
-	"homepage": "https://github.com/kigathi-chege/lyre-auth-sdk#readme",
-	"bugs": {
-		"url": "https://github.com/kigathi-chege/lyre-auth-sdk/issues"
-	},
-	"keywords": [
-		"auth",
-		"sso",
-		"accounts",
-		"session",
-		"sveltekit",
-		"hmac",
-		"lyre"
-	],
-	"main": "./dist/index.js",
-	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"import": "./dist/index.js"
-		},
-		"./sveltekit": {
-			"types": "./dist/sveltekit.d.ts",
-			"import": "./dist/sveltekit.js"
-		},
-		"./nest": {
-			"types": "./dist/nest.d.ts",
-			"import": "./dist/nest.js"
-		},
-		"./admin": {
-			"types": "./dist/admin.d.ts",
-			"import": "./dist/admin.js"
-		},
-		"./package.json": "./package.json"
-	},
-	"files": [
-		"dist",
-		"README.md",
-		"LICENSE"
-	],
-	"scripts": {
-		"build": "tsup src/index.ts src/sveltekit.ts src/nest.ts src/admin.ts --format esm --dts --clean",
-		"check": "tsc --noEmit"
-	},
-	"peerDependencies": {
-		"@sveltejs/kit": "^2.0.0"
-	},
-	"peerDependenciesMeta": {
-		"@sveltejs/kit": {
-			"optional": true
-		}
-	},
-	"devDependencies": {
-		"@sveltejs/kit": "^2.0.0",
-		"@types/node": "^22",
-		"tsup": "^8.3.5",
-		"typescript": "^6.0.2"
-	},
-	"publishConfig": {
-		"access": "public"
-	}
+  "name": "@~lyre/auth",
+  "version": "0.8.0",
+  "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
+  "type": "module",
+  "sideEffects": false,
+  "license": "MIT",
+  "author": "Britam Trust Services / Lyre",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kigathi-chege/lyre-auth-sdk.git"
+  },
+  "homepage": "https://github.com/kigathi-chege/lyre-auth-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/kigathi-chege/lyre-auth-sdk/issues"
+  },
+  "keywords": [
+    "auth",
+    "sso",
+    "accounts",
+    "session",
+    "sveltekit",
+    "hmac",
+    "lyre"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit.d.ts",
+      "import": "./dist/sveltekit.js"
+    },
+    "./nest": {
+      "types": "./dist/nest.d.ts",
+      "import": "./dist/nest.js"
+    },
+    "./admin": {
+      "types": "./dist/admin.d.ts",
+      "import": "./dist/admin.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/sveltekit.ts src/nest.ts src/admin.ts --format esm --dts --clean",
+    "check": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@sveltejs/kit": "^2.0.0",
+    "@types/node": "^22",
+    "tsup": "^8.3.5",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }