@~lyre/auth 0.8.0 → 0.10.0

package/dist/admin.d.ts

@@ -123,7 +123,34 @@ interface GroupMember {
     name?: string | null;
     firstName?: string | null;
     lastName?: string | null;
+    /**
+     * The group MEMBERSHIP role (`owner` / `admin` / `member`) — how this person relates to the
+     * workspace itself. NOT the app's account type; see `appRoles`.
+     */
     role?: string | null;
+    /**
+     * The app's own RBAC roles for this member, scoped to this group (e.g. `engage:admin`,
+     * `engage:agent`). This is what "account type" means to a consumer, and what an account-type
+     * change writes. Empty when the member holds no group-scoped app role.
+     */
+    appRoles?: string[];
+    /** Set when the account is deactivated in Accounts; null for an active account. */
+    disabledAt?: string | null;
+    /** When the user account was created (ISO). */
+    createdAt?: string | null;
+    /**
+     * Last sign-in (ISO), or null for someone who has never signed in.
+     *
+     * Derived from `MAX(sessions.last_seen_at)` — the definition Accounts uses everywhere else for
+     * this question. There is no separate `last_login_at` column.
+     */
+    lastSeenAt?: string | null;
+    /**
+     * App-scoped profile values (`phone_number`, `assignable`, `availability`, …). Present only when
+     * the request passed an `appId`; profile data is app-scoped by definition. Values are strings —
+     * the store is an EAV of text — so a boolean reads as `'true'` / `'false'`.
+     */
+    profileData?: Record<string, string>;
 }
 /** Thrown on a non-2xx Accounts response so callers can surface the upstream message + status. */
 declare class AccountsAdminError extends Error {
@@ -148,11 +175,23 @@ declare class AccountsAdmin {
         appId?: string;
         profileData?: Record<string, string>;
     }): Promise<AccountsUser>;
-    /** Change the signed-in user's password. Session-authed; Accounts verifies `currentPassword` and,
-     *  with `revokeOtherSessions`, logs the user out everywhere else. The target is the session's own
-     *  user — no id is passed. */
+    /** Set or change the signed-in user's password. Session-authed; the target is the session's own
+     *  user — no id is passed.
+     *
+     *  ONE call serves both cases. Accounts reads the credential and decides: with none it SETS the
+     *  password (no `currentPassword` required); with one it verifies `currentPassword` and CHANGES
+     *  it. The result's `mode` says which happened. With `revokeOtherSessions`, the user is logged
+     *  out everywhere else. */
     changePassword(input: {
-        currentPassword: string;
+        /**
+         * OPTIONAL, and omitted when the account has no password yet — someone who signed up with
+         * Google has none to verify. Accounts decides which case applies by reading the credential
+         * itself (`setOrChangePassword`), so omitting this cannot bypass verification: when a
+         * password DOES exist and this is absent, the request is rejected.
+         *
+         * Read `hasPassword` from the `/me` payload to decide whether to collect it.
+         */
+        currentPassword?: string;
         newPassword: string;
         confirmPassword?: string;
         revokeOtherSessions?: boolean;
@@ -173,6 +212,33 @@ declare class AccountsAdmin {
          *  Accounts drops any key the app does not collect, so authorization-shaped values
          *  (role, assignability) can never be set from here. */
         profileData?: Record<string, string> | null;
+        /**
+         * The inviting app's OAuth callback — where accepting the invite should land the invitee.
+         *
+         * Acceptance hands off to `/auth/authorize`, which requires a redirect_uri it can validate
+         * against the app's authorized list; without one the invitee reaches the gateway app
+         * chooser instead of the app that invited them. Must already be in that allowlist — an
+         * unauthorized value is rejected at invite time (400) rather than stored.
+         */
+        redirectUri?: string | null;
+        /**
+         * The roles to grant when this invite is accepted, overriding the app's configured default
+         * invite roles. Role IDS resolved by the caller from its own vocabulary — Accounts has no
+         * notion of "admin" or "agent".
+         *
+         * A LIST because one account type commonly means several roles. Each id is validated as
+         * grantable by the inviting app at invite time (400 if not), so a bad invite fails the
+         * person creating it rather than the person accepting it.
+         */
+        invitedRoleIds?: string[] | null;
+        /**
+         * App-scoped `assignable` default, written to the invitee's profile on acceptance.
+         *
+         * A COLUMN on the invite, not a `profileData` key: it is authorization (whether work can be
+         * routed to this person) and the profile bag is invitee-editable, so Accounts drops it from
+         * there by design. Omit to leave unset — readers treat missing as assignable.
+         */
+        assignable?: boolean | null;
     }): Promise<InviteResult>;
     /**
      * The profile fields this app collects about a SUBJECT — the spec to render a form from.

package/dist/admin.js

@@ -49,9 +49,13 @@ var AccountsAdmin = class {
       body: input
     });
   }
-  /** Change the signed-in user's password. Session-authed; Accounts verifies `currentPassword` and,
-   *  with `revokeOtherSessions`, logs the user out everywhere else. The target is the session's own
-   *  user — no id is passed. */
+  /** Set or change the signed-in user's password. Session-authed; the target is the session's own
+   *  user — no id is passed.
+   *
+   *  ONE call serves both cases. Accounts reads the credential and decides: with none it SETS the
+   *  password (no `currentPassword` required); with one it verifies `currentPassword` and CHANGES
+   *  it. The result's `mode` says which happened. With `revokeOtherSessions`, the user is logged
+   *  out everywhere else. */
   async changePassword(input) {
     return this.request("POST", "/api/auth/change-password", {
       auth: "session",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,