@~lyre/auth 0.9.0 → 0.11.0

package/dist/admin.d.ts

@@ -89,7 +89,13 @@ interface ProfileFieldSpec {
 /** Whether an email can be invited to an app. See `checkInviteEmail`. */
 interface InviteEmailCheck {
     email: string;
-    /** `member` = already has app access; `invited` = a live invite exists; `available` = go ahead. */
+    /**
+     * `member` = already in scope; `invited` = a live invite exists; `available` = go ahead.
+     *
+     * SCOPE depends on whether `userGroupId` was passed: with one, each state is about that
+     * WORKSPACE; without, about the app as a whole. For a multi-workspace app the app-level answer is
+     * usually the wrong one — someone in another workspace is not a member of this one.
+     */
     state: 'member' | 'invited' | 'available';
     /** Whether an Accounts user already exists for this address (they keep their own profile). */
     hasAccount: boolean;
@@ -175,11 +181,23 @@ declare class AccountsAdmin {
         appId?: string;
         profileData?: Record<string, string>;
     }): Promise<AccountsUser>;
-    /** Change the signed-in user's password. Session-authed; Accounts verifies `currentPassword` and,
-     *  with `revokeOtherSessions`, logs the user out everywhere else. The target is the session's own
-     *  user — no id is passed. */
+    /** Set or change the signed-in user's password. Session-authed; the target is the session's own
+     *  user — no id is passed.
+     *
+     *  ONE call serves both cases. Accounts reads the credential and decides: with none it SETS the
+     *  password (no `currentPassword` required); with one it verifies `currentPassword` and CHANGES
+     *  it. The result's `mode` says which happened. With `revokeOtherSessions`, the user is logged
+     *  out everywhere else. */
     changePassword(input: {
-        currentPassword: string;
+        /**
+         * OPTIONAL, and omitted when the account has no password yet — someone who signed up with
+         * Google has none to verify. Accounts decides which case applies by reading the credential
+         * itself (`setOrChangePassword`), so omitting this cannot bypass verification: when a
+         * password DOES exist and this is absent, the request is rejected.
+         *
+         * Read `hasPassword` from the `/me` payload to decide whether to collect it.
+         */
+        currentPassword?: string;
         newPassword: string;
         confirmPassword?: string;
         revokeOtherSessions?: boolean;
@@ -240,7 +258,9 @@ declare class AccountsAdmin {
      * BEFORE submitting that someone is already a member or already invited. Email only, exact match.
      * Session-authed.
      */
-    checkInviteEmail(appSlug: string, email: string): Promise<InviteEmailCheck>;
+    checkInviteEmail(appSlug: string, email: string, opts?: {
+        userGroupId?: string | null;
+    }): Promise<InviteEmailCheck>;
     /**
      * A workspace's own details — name plus its app-scoped profile values (support email, …).
      * Service-key authed (`stats:read`). Pass `appId` to scope the profile values.

package/dist/admin.js

@@ -49,9 +49,13 @@ var AccountsAdmin = class {
       body: input
     });
   }
-  /** Change the signed-in user's password. Session-authed; Accounts verifies `currentPassword` and,
-   *  with `revokeOtherSessions`, logs the user out everywhere else. The target is the session's own
-   *  user — no id is passed. */
+  /** Set or change the signed-in user's password. Session-authed; the target is the session's own
+   *  user — no id is passed.
+   *
+   *  ONE call serves both cases. Accounts reads the credential and decides: with none it SETS the
+   *  password (no `currentPassword` required); with one it verifies `currentPassword` and CHANGES
+   *  it. The result's `mode` says which happened. With `revokeOtherSessions`, the user is logged
+   *  out everywhere else. */
   async changePassword(input) {
     return this.request("POST", "/api/auth/change-password", {
       auth: "session",
@@ -99,10 +103,12 @@ var AccountsAdmin = class {
    * BEFORE submitting that someone is already a member or already invited. Email only, exact match.
    * Session-authed.
    */
-  async checkInviteEmail(appSlug, email) {
+  async checkInviteEmail(appSlug, email, opts) {
+    const query = new URLSearchParams({ email });
+    if (opts?.userGroupId) query.set("userGroupId", opts.userGroupId);
     return this.request(
       "GET",
-      `/api/auth/apps/${encodeURIComponent(appSlug)}/invites/lookup?email=${encodeURIComponent(email)}`,
+      `/api/auth/apps/${encodeURIComponent(appSlug)}/invites/lookup?${query.toString()}`,
       { auth: "session" }
     );
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.9.0",
-  "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
+  "version": "0.11.0",
+  "description": "Shared Axis Accounts auth SDK \u2014 framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",