@~lyre/auth 0.7.0 → 0.9.0

package/dist/admin.d.ts

@@ -123,7 +123,34 @@ interface GroupMember {
     name?: string | null;
     firstName?: string | null;
     lastName?: string | null;
+    /**
+     * The group MEMBERSHIP role (`owner` / `admin` / `member`) — how this person relates to the
+     * workspace itself. NOT the app's account type; see `appRoles`.
+     */
     role?: string | null;
+    /**
+     * The app's own RBAC roles for this member, scoped to this group (e.g. `engage:admin`,
+     * `engage:agent`). This is what "account type" means to a consumer, and what an account-type
+     * change writes. Empty when the member holds no group-scoped app role.
+     */
+    appRoles?: string[];
+    /** Set when the account is deactivated in Accounts; null for an active account. */
+    disabledAt?: string | null;
+    /** When the user account was created (ISO). */
+    createdAt?: string | null;
+    /**
+     * Last sign-in (ISO), or null for someone who has never signed in.
+     *
+     * Derived from `MAX(sessions.last_seen_at)` — the definition Accounts uses everywhere else for
+     * this question. There is no separate `last_login_at` column.
+     */
+    lastSeenAt?: string | null;
+    /**
+     * App-scoped profile values (`phone_number`, `assignable`, `availability`, …). Present only when
+     * the request passed an `appId`; profile data is app-scoped by definition. Values are strings —
+     * the store is an EAV of text — so a boolean reads as `'true'` / `'false'`.
+     */
+    profileData?: Record<string, string>;
 }
 /** Thrown on a non-2xx Accounts response so callers can surface the upstream message + status. */
 declare class AccountsAdminError extends Error {
@@ -173,6 +200,33 @@ declare class AccountsAdmin {
          *  Accounts drops any key the app does not collect, so authorization-shaped values
          *  (role, assignability) can never be set from here. */
         profileData?: Record<string, string> | null;
+        /**
+         * The inviting app's OAuth callback — where accepting the invite should land the invitee.
+         *
+         * Acceptance hands off to `/auth/authorize`, which requires a redirect_uri it can validate
+         * against the app's authorized list; without one the invitee reaches the gateway app
+         * chooser instead of the app that invited them. Must already be in that allowlist — an
+         * unauthorized value is rejected at invite time (400) rather than stored.
+         */
+        redirectUri?: string | null;
+        /**
+         * The roles to grant when this invite is accepted, overriding the app's configured default
+         * invite roles. Role IDS resolved by the caller from its own vocabulary — Accounts has no
+         * notion of "admin" or "agent".
+         *
+         * A LIST because one account type commonly means several roles. Each id is validated as
+         * grantable by the inviting app at invite time (400 if not), so a bad invite fails the
+         * person creating it rather than the person accepting it.
+         */
+        invitedRoleIds?: string[] | null;
+        /**
+         * App-scoped `assignable` default, written to the invitee's profile on acceptance.
+         *
+         * A COLUMN on the invite, not a `profileData` key: it is authorization (whether work can be
+         * routed to this person) and the profile bag is invitee-editable, so Accounts drops it from
+         * there by design. Omit to leave unset — readers treat missing as assignable.
+         */
+        assignable?: boolean | null;
     }): Promise<InviteResult>;
     /**
      * The profile fields this app collects about a SUBJECT — the spec to render a form from.
@@ -223,6 +277,23 @@ declare class AccountsAdmin {
      * reads membership — so without this a "deleted" user keeps reappearing in the workspace.
      */
     removeGroupMember(groupId: string, userId: string): Promise<void>;
+    /**
+     * Deactivate or reactivate a user account GLOBALLY. Service-key authed (`users:write`).
+     *
+     * `disabled: true` sets `users.disabled_at`; `false` clears it. A disabled user cannot
+     * authenticate by ANY route (password, OAuth exchange, token) across EVERY app — this is an
+     * account-level gate, not a per-workspace one. Their rows are retained, so anything they own
+     * (audit history, assigned tickets, migrated connections) keeps a valid owner.
+     *
+     * Accounts also revokes their live sessions across every tenant and emits `session.revoked`, so
+     * deactivation takes effect immediately rather than whenever the last session happens to expire.
+     *
+     * This is the counterpart to `removeGroupMember`, NOT a synonym for it. Removing a membership
+     * deletes the row the members list is built from, so the person disappears and can never be
+     * reactivated from the UI; disabling keeps them listed with `disabledAt` set, which is what the
+     * Active/Deactivated badge reads.
+     */
+    setUserDisabled(userId: string, disabled: boolean): Promise<void>;
     /** Revoke a pending invite (withdraw one sent in error). Session-authed. */
     revokeAppInvite(appSlug: string, inviteId: string): Promise<void>;
     /** Everyone with access to an app. Session-authed. */

package/dist/admin.js

@@ -159,6 +159,32 @@ var AccountsAdmin = class {
       { auth: "key" }
     );
   }
+  /**
+   * Deactivate or reactivate a user account GLOBALLY. Service-key authed (`users:write`).
+   *
+   * `disabled: true` sets `users.disabled_at`; `false` clears it. A disabled user cannot
+   * authenticate by ANY route (password, OAuth exchange, token) across EVERY app — this is an
+   * account-level gate, not a per-workspace one. Their rows are retained, so anything they own
+   * (audit history, assigned tickets, migrated connections) keeps a valid owner.
+   *
+   * Accounts also revokes their live sessions across every tenant and emits `session.revoked`, so
+   * deactivation takes effect immediately rather than whenever the last session happens to expire.
+   *
+   * This is the counterpart to `removeGroupMember`, NOT a synonym for it. Removing a membership
+   * deletes the row the members list is built from, so the person disappears and can never be
+   * reactivated from the UI; disabling keeps them listed with `disabledAt` set, which is what the
+   * Active/Deactivated badge reads.
+   */
+  async setUserDisabled(userId, disabled) {
+    await this.request(
+      "PATCH",
+      `/api/auth/admin/users/${encodeURIComponent(userId)}`,
+      {
+        auth: "key",
+        body: { disabledAt: disabled ? (/* @__PURE__ */ new Date()).toISOString() : null }
+      }
+    );
+  }
   /** Revoke a pending invite (withdraw one sent in error). Session-authed. */
   async revokeAppInvite(appSlug, inviteId) {
     await this.request(

package/package.json

@@ -1,73 +1,73 @@
 {
-	"name": "@~lyre/auth",
-	"version": "0.7.0",
-	"description": "Shared Axis Accounts auth SDK \u2014 framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
-	"type": "module",
-	"sideEffects": false,
-	"license": "MIT",
-	"author": "Britam Trust Services / Lyre",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/kigathi-chege/lyre-auth-sdk.git"
-	},
-	"homepage": "https://github.com/kigathi-chege/lyre-auth-sdk#readme",
-	"bugs": {
-		"url": "https://github.com/kigathi-chege/lyre-auth-sdk/issues"
-	},
-	"keywords": [
-		"auth",
-		"sso",
-		"accounts",
-		"session",
-		"sveltekit",
-		"hmac",
-		"lyre"
-	],
-	"main": "./dist/index.js",
-	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"import": "./dist/index.js"
-		},
-		"./sveltekit": {
-			"types": "./dist/sveltekit.d.ts",
-			"import": "./dist/sveltekit.js"
-		},
-		"./nest": {
-			"types": "./dist/nest.d.ts",
-			"import": "./dist/nest.js"
-		},
-		"./admin": {
-			"types": "./dist/admin.d.ts",
-			"import": "./dist/admin.js"
-		},
-		"./package.json": "./package.json"
-	},
-	"files": [
-		"dist",
-		"README.md",
-		"LICENSE"
-	],
-	"scripts": {
-		"build": "tsup src/index.ts src/sveltekit.ts src/nest.ts src/admin.ts --format esm --dts --clean",
-		"check": "tsc --noEmit"
-	},
-	"peerDependencies": {
-		"@sveltejs/kit": "^2.0.0"
-	},
-	"peerDependenciesMeta": {
-		"@sveltejs/kit": {
-			"optional": true
-		}
-	},
-	"devDependencies": {
-		"@sveltejs/kit": "^2.0.0",
-		"@types/node": "^22",
-		"tsup": "^8.3.5",
-		"typescript": "^6.0.2"
-	},
-	"publishConfig": {
-		"access": "public"
-	}
+  "name": "@~lyre/auth",
+  "version": "0.9.0",
+  "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
+  "type": "module",
+  "sideEffects": false,
+  "license": "MIT",
+  "author": "Britam Trust Services / Lyre",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kigathi-chege/lyre-auth-sdk.git"
+  },
+  "homepage": "https://github.com/kigathi-chege/lyre-auth-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/kigathi-chege/lyre-auth-sdk/issues"
+  },
+  "keywords": [
+    "auth",
+    "sso",
+    "accounts",
+    "session",
+    "sveltekit",
+    "hmac",
+    "lyre"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit.d.ts",
+      "import": "./dist/sveltekit.js"
+    },
+    "./nest": {
+      "types": "./dist/nest.d.ts",
+      "import": "./dist/nest.js"
+    },
+    "./admin": {
+      "types": "./dist/admin.d.ts",
+      "import": "./dist/admin.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/sveltekit.ts src/nest.ts src/admin.ts --format esm --dts --clean",
+    "check": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@sveltejs/kit": "^2.0.0",
+    "@types/node": "^22",
+    "tsup": "^8.3.5",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }