hcloud-sdk 22.9.2 → 22.10.0

package/changelog.md

@@ -1,5 +1,11 @@
-## [22.9.2](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/compare/v22.9.1...v22.9.2) (2026-07-30)
+## [22.10.0](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/compare/v22.9.3...v22.10.0) (2026-08-04)
+
+### Features
+
+* add PASSKEY_NAME validation entity ([763896f](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/763896f99dd36dd2ad654d8acb1041411d09bb47))
+* **idp:** add passkey login and registration support ([7c36e07](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/7c36e0734896e0631dbe580523e75ad8cc5c29cd))
 
 ### Bug Fixes
 
-* return pat token from agent creation from authorization header ([f1e31ea](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/f1e31eab0d53eb45e71c72aa7e88106d09319675))
+* lint error ([721acec](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/721acecd56110e7a0ab434840cb2d0ff61e5016e))
+* use storageId over storage in share items ([86a61da](https://github.com/moovit-sp-gmbh/hcloud-sdk-js/commit/86a61da52ce0ff896a8939c0aa42e771bd964187))

package/lib/helper/ValidationHelper.d.ts

@@ -50,7 +50,8 @@ declare enum Entity {
     TAG_NAME = "TAG_NAME",
     TAG_COLOR = "TAG_COLOR",
     MODULE_NAME = "MODULE_NAME",
-    LOG_COLLECTOR_NAME = "LOG_COLLECTOR_NAME"
+    LOG_COLLECTOR_NAME = "LOG_COLLECTOR_NAME",
+    PASSKEY_NAME = "PASSKEY_NAME"
 }
 declare class EntityDetails {
     private entity;

package/lib/helper/ValidationHelper.js

@@ -56,6 +56,7 @@ var Entity;
     Entity["TAG_COLOR"] = "TAG_COLOR";
     Entity["MODULE_NAME"] = "MODULE_NAME";
     Entity["LOG_COLLECTOR_NAME"] = "LOG_COLLECTOR_NAME";
+    Entity["PASSKEY_NAME"] = "PASSKEY_NAME";
 })(Entity || (exports.Entity = Entity = {}));
 class EntityDetails {
     constructor(name) {
@@ -386,4 +387,9 @@ const entityCollection = {
         minLength: 1,
         maxLength: 64,
     },
+    [Entity.PASSKEY_NAME]: {
+        pattern: /^[\w-. ]{3,128}$/i,
+        minLength: 3,
+        maxLength: 128,
+    },
 };

package/lib/interfaces/cosmo/share/index.d.ts

@@ -1,4 +1,3 @@
-import { StorageConfiguration } from "../../global/Storage";
 import { ReducedUser, ShareReducedUnlinkedUser, User } from "../../idp";
 import { ItemType } from "../asset";
 /**
@@ -42,7 +41,13 @@ export interface Share {
         name: string;
         type: ItemType.MEDIA_ASSET;
         thumbnailUrl: string;
-        storage: StorageConfiguration;
+        storageId: string;
+    } | {
+        _id: string;
+        name: string;
+        type: ItemType.STACK;
+        thumbnailUrl: string;
+        storageId: string;
     })[];
     permissions?: string[];
     permissionGroups?: ShareAssetPermissionGroup[];

package/lib/interfaces/idp/index.d.ts

@@ -9,6 +9,7 @@ export * from "./organization/settings/oauthApp";
 export * from "./organization/team";
 export * from "./user";
 export * from "./user/GeneralSettings";
+export * from "./user/Passkey";
 export * from "./user/Pat";
 export * from "./user/Scopes";
 export * from "./user/SuccessfulAuth";

package/lib/interfaces/idp/index.js

@@ -26,6 +26,7 @@ __exportStar(require("./organization/settings/oauthApp"), exports);
 __exportStar(require("./organization/team"), exports);
 __exportStar(require("./user"), exports);
 __exportStar(require("./user/GeneralSettings"), exports);
+__exportStar(require("./user/Passkey"), exports);
 __exportStar(require("./user/Pat"), exports);
 __exportStar(require("./user/Scopes"), exports);
 __exportStar(require("./user/SuccessfulAuth"), exports);

package/lib/interfaces/idp/user/Passkey.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Whether a passkey credential can be backed up and synced across multiple devices (e.g. via iCloud Keychain or
+ * Google Password Manager), or is bound to a single physical authenticator and cannot be synced
+ */
+export declare enum DeviceType {
+    SINGLE_DEVICE = "SINGLE_DEVICE",
+    MULTI_DEVICE = "MULTI_DEVICE"
+}
+/**
+ * How an authenticator is connected to the client device during a WebAuthn ceremony
+ */
+export declare enum AuthenticatorAttachment {
+    PLATFORM = "platform",// The authenticator is built into the client device (e.g. Touch ID, Windows Hello)
+    CROSS_PLATFORM = "cross-platform"
+}
+/**
+ * A transport an authenticator supports for communicating with the client device
+ */
+export declare enum AuthenticatorTransport {
+    BLE = "ble",// Bluetooth Low Energy
+    CABLE = "cable",// Cloud-assisted Bluetooth Low Energy (caBLE)
+    HYBRID = "hybrid",// A client device (e.g. a phone) reachable via QR code and BLE pairing
+    INTERNAL = "internal",// The authenticator is part of the client device itself (platform authenticator)
+    NFC = "nfc",// Near Field Communication
+    SMART_CARD = "smart-card",// Smart Card
+    USB = "usb"
+}
+/**
+ * Public representation of a passkey registered by a user. Never includes the credential's public key or signature counter
+ */
+export interface Passkey {
+    credentialId: string;
+    name: string;
+    deviceType?: DeviceType;
+    createDate: number;
+    lastUsedDate?: number;
+}
+/**
+ * The relying party a new passkey is being registered for
+ */
+export interface PasskeyRelyingParty {
+    id: string;
+    name: string;
+}
+/**
+ * The user a new passkey is being registered for
+ */
+export interface PasskeyUser {
+    id: string;
+    name: string;
+    displayName: string;
+}
+/**
+ * References an existing credential, used to either exclude it from a new registration or allow it for authentication
+ */
+export interface PasskeyCredentialDescriptor {
+    id: string;
+    transports?: AuthenticatorTransport[];
+}
+/**
+ * A public key algorithm accepted for a new credential
+ */
+export interface PasskeyPubKeyCredParam {
+    alg: number;
+    type: "public-key";
+}
+/**
+ * Constraints the relying party places on which authenticators may be used and how they must behave during registration
+ */
+export interface PasskeyAuthenticatorSelection {
+    authenticatorAttachment?: AuthenticatorAttachment;
+    residentKey?: string;
+    requireResidentKey?: boolean;
+    userVerification?: string;
+}
+/**
+ * Options returned by the server to create a new passkey with an authenticator
+ */
+export interface PasskeyRegistrationOptions {
+    rp: PasskeyRelyingParty;
+    user: PasskeyUser;
+    challenge: string;
+    pubKeyCredParams: PasskeyPubKeyCredParam[];
+    timeout?: number;
+    excludeCredentials?: PasskeyCredentialDescriptor[];
+    authenticatorSelection?: PasskeyAuthenticatorSelection;
+    attestation?: string;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * Options returned by the server to authenticate with an existing passkey
+ */
+export interface PasskeyAuthenticationOptions {
+    challenge: string;
+    timeout?: number;
+    rpId?: string;
+    allowCredentials?: PasskeyCredentialDescriptor[];
+    userVerification?: string;
+    extensions?: Record<string, unknown>;
+}
+/**
+ * The authenticator's response produced during passkey registration
+ */
+export interface PasskeyAttestationResponse {
+    clientDataJSON: string;
+    attestationObject: string;
+    authenticatorData?: string;
+    transports?: AuthenticatorTransport[];
+    publicKeyAlgorithm?: number;
+    publicKey?: string;
+}
+/**
+ * The credential produced by the browser during passkey registration (the value returned by `navigator.credentials.create()`),
+ * together with a label for the new passkey.
+ */
+export interface PasskeyRegistrationCredential {
+    id: string;
+    rawId: string;
+    response: PasskeyAttestationResponse;
+    authenticatorAttachment?: AuthenticatorAttachment;
+    clientExtensionResults: Record<string, unknown>;
+    type: "public-key";
+    name: string;
+}
+/**
+ * The authenticator's response produced during passkey authentication
+ * (part of the value returned by `navigator.credentials.get()`)
+ */
+export interface PasskeyAssertionResponse {
+    clientDataJSON: string;
+    authenticatorData: string;
+    signature: string;
+    userHandle?: string;
+}
+/**
+ * The credential produced by the browser during passkey authentication (the value returned by `navigator.credentials.get()`)
+ */
+export interface PasskeyAuthenticationCredential {
+    id: string;
+    rawId: string;
+    response: PasskeyAssertionResponse;
+    authenticatorAttachment?: AuthenticatorAttachment;
+    clientExtensionResults: Record<string, unknown>;
+    type: "public-key";
+}

package/lib/interfaces/idp/user/Passkey.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticatorTransport = exports.AuthenticatorAttachment = exports.DeviceType = void 0;
+/**
+ * Whether a passkey credential can be backed up and synced across multiple devices (e.g. via iCloud Keychain or
+ * Google Password Manager), or is bound to a single physical authenticator and cannot be synced
+ */
+var DeviceType;
+(function (DeviceType) {
+    DeviceType["SINGLE_DEVICE"] = "SINGLE_DEVICE";
+    DeviceType["MULTI_DEVICE"] = "MULTI_DEVICE";
+})(DeviceType || (exports.DeviceType = DeviceType = {}));
+/**
+ * How an authenticator is connected to the client device during a WebAuthn ceremony
+ */
+var AuthenticatorAttachment;
+(function (AuthenticatorAttachment) {
+    AuthenticatorAttachment["PLATFORM"] = "platform";
+    AuthenticatorAttachment["CROSS_PLATFORM"] = "cross-platform";
+})(AuthenticatorAttachment || (exports.AuthenticatorAttachment = AuthenticatorAttachment = {}));
+/**
+ * A transport an authenticator supports for communicating with the client device
+ */
+var AuthenticatorTransport;
+(function (AuthenticatorTransport) {
+    AuthenticatorTransport["BLE"] = "ble";
+    AuthenticatorTransport["CABLE"] = "cable";
+    AuthenticatorTransport["HYBRID"] = "hybrid";
+    AuthenticatorTransport["INTERNAL"] = "internal";
+    AuthenticatorTransport["NFC"] = "nfc";
+    AuthenticatorTransport["SMART_CARD"] = "smart-card";
+    AuthenticatorTransport["USB"] = "usb";
+})(AuthenticatorTransport || (exports.AuthenticatorTransport = AuthenticatorTransport = {}));

package/lib/service/idp/index.d.ts

@@ -6,6 +6,7 @@ import { IdpGuest } from "./guest";
 import { IdpInternal } from "./internal";
 import { IdpOAuth } from "./oauth";
 import { IdpOrganization } from "./organization";
+import { IdpPasskey } from "./passkey";
 import { IdpRegistration } from "./registration";
 import { IdpUser } from "./user";
 export default class Idp extends Base {
@@ -19,6 +20,11 @@ export default class Idp extends Base {
      */
     get registration(): IdpRegistration;
     private _registration?;
+    /**
+     * Handles everything around passkey (WebAuthn) registration and login
+     */
+    get passkey(): IdpPasskey;
+    private _passkey?;
     /**
      * Handles everything around open authorization and openId requests
      */

package/lib/service/idp/index.js

@@ -17,6 +17,7 @@ const guest_1 = require("./guest");
 const internal_1 = require("./internal");
 const oauth_1 = require("./oauth");
 const organization_1 = require("./organization");
+const passkey_1 = require("./passkey");
 const registration_1 = require("./registration");
 const user_1 = require("./user");
 class Idp extends Base_1.default {
@@ -38,6 +39,15 @@ class Idp extends Base_1.default {
         }
         return this._registration;
     }
+    /**
+     * Handles everything around passkey (WebAuthn) registration and login
+     */
+    get passkey() {
+        if (this._passkey === undefined) {
+            this._passkey = new passkey_1.IdpPasskey(this.options, this.axios);
+        }
+        return this._passkey;
+    }
     /**
      * Handles everything around open authorization and openId requests
      */

package/lib/service/idp/passkey.d.ts

@@ -0,0 +1,56 @@
+import Base, { MaybeRaw } from "../../Base";
+import { Passkey, PasskeyAuthenticationCredential, PasskeyAuthenticationOptions, PasskeyRegistrationCredential, PasskeyRegistrationOptions } from "../../interfaces/idp/user/Passkey";
+import { SuccessfulAuth } from "../../interfaces/idp/user/SuccessfulAuth";
+export declare class IdpPasskey extends Base {
+    /**
+     * Requests options for registering a new passkey for the currently authenticated user. Pass the returned object
+     * into `navigator.credentials.create()` to have the browser/authenticator create a new credential, then submit
+     * the result to {@link verifyRegistration}.
+     * @returns PasskeyRegistrationOptions object to be passed into `navigator.credentials.create()`
+     */
+    createRegistrationOptions<R extends boolean = false>(raw?: {
+        raw: R;
+    }): Promise<MaybeRaw<R, PasskeyRegistrationOptions>>;
+    /**
+     * Verifies a newly created passkey credential and, if valid, stores it for the currently authenticated user.
+     * @param credential The credential returned by `navigator.credentials.create()`, together with a user-friendly name for the passkey
+     * @returns The newly stored Passkey
+     */
+    verifyRegistration<R extends boolean = false>(credential: PasskeyRegistrationCredential, raw?: {
+        raw: R;
+    }): Promise<MaybeRaw<R, Passkey>>;
+    /**
+     * Requests all passkeys registered for the currently authenticated user.
+     * @returns Array of Passkey objects
+     */
+    getPasskeys<R extends boolean = false>(raw?: {
+        raw: R;
+    }): Promise<MaybeRaw<R, Passkey[]>>;
+    /**
+     * Deletes a passkey registered for the currently authenticated user.
+     * @param credentialId Base64url-encoded credential ID of the passkey to delete
+     */
+    deletePasskey<R extends boolean = false>(credentialId: string, raw?: {
+        raw: R;
+    }): Promise<MaybeRaw<R, void>>;
+    /**
+     * Requests options for logging in with a passkey. This endpoint requires no authentication and does not identify
+     * the user upfront - any passkey registered for this relying party may be used. Pass the returned object into
+     * `navigator.credentials.get()` to have the browser/authenticator produce an assertion, then submit the result
+     * to {@link verifyAuthentication}.
+     * @returns PasskeyAuthenticationOptions object to be passed into `navigator.credentials.get()`
+     */
+    createAuthenticationOptions<R extends boolean = false>(raw?: {
+        raw: R;
+    }): Promise<MaybeRaw<R, PasskeyAuthenticationOptions>>;
+    /**
+     * Verifies a passkey authentication assertion. This endpoint requires no authentication. On success, the user is
+     * logged in and the response carries the Authorization header and auth_token cookie of the new session.
+     * @param credential The credential returned by `navigator.credentials.get()`
+     * @returns SuccessfulAuth object holding the token and the authenticated user
+     */
+    verifyAuthentication<R extends boolean = false>(credential: PasskeyAuthenticationCredential, raw?: {
+        raw: R;
+    }): Promise<MaybeRaw<R, SuccessfulAuth>>;
+    protected getEndpoint(endpoint: string): string;
+}

package/lib/service/idp/passkey.js

@@ -0,0 +1,95 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdpPasskey = void 0;
+const Base_1 = __importDefault(require("../../Base"));
+class IdpPasskey extends Base_1.default {
+    /**
+     * Requests options for registering a new passkey for the currently authenticated user. Pass the returned object
+     * into `navigator.credentials.create()` to have the browser/authenticator create a new credential, then submit
+     * the result to {@link verifyRegistration}.
+     * @returns PasskeyRegistrationOptions object to be passed into `navigator.credentials.create()`
+     */
+    createRegistrationOptions(raw) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resp = yield this.axios.post(this.getEndpoint("/v1/user/passkey/options"));
+            return ((raw === null || raw === void 0 ? void 0 : raw.raw) ? resp : resp.data);
+        });
+    }
+    /**
+     * Verifies a newly created passkey credential and, if valid, stores it for the currently authenticated user.
+     * @param credential The credential returned by `navigator.credentials.create()`, together with a user-friendly name for the passkey
+     * @returns The newly stored Passkey
+     */
+    verifyRegistration(credential, raw) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resp = yield this.axios.post(this.getEndpoint("/v1/user/passkey/verify"), credential);
+            return ((raw === null || raw === void 0 ? void 0 : raw.raw) ? resp : resp.data);
+        });
+    }
+    /**
+     * Requests all passkeys registered for the currently authenticated user.
+     * @returns Array of Passkey objects
+     */
+    getPasskeys(raw) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resp = yield this.axios.get(this.getEndpoint("/v1/user/passkey"));
+            return ((raw === null || raw === void 0 ? void 0 : raw.raw) ? resp : resp.data);
+        });
+    }
+    /**
+     * Deletes a passkey registered for the currently authenticated user.
+     * @param credentialId Base64url-encoded credential ID of the passkey to delete
+     */
+    deletePasskey(credentialId, raw) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resp = yield this.axios.delete(this.getEndpoint(`/v1/user/passkey/${encodeURIComponent(credentialId)}`));
+            return ((raw === null || raw === void 0 ? void 0 : raw.raw) ? resp : undefined);
+        });
+    }
+    /**
+     * Requests options for logging in with a passkey. This endpoint requires no authentication and does not identify
+     * the user upfront - any passkey registered for this relying party may be used. Pass the returned object into
+     * `navigator.credentials.get()` to have the browser/authenticator produce an assertion, then submit the result
+     * to {@link verifyAuthentication}.
+     * @returns PasskeyAuthenticationOptions object to be passed into `navigator.credentials.get()`
+     */
+    createAuthenticationOptions(raw) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const resp = yield this.axios.post(this.getEndpoint("/v1/auth/passkey/options"));
+            return ((raw === null || raw === void 0 ? void 0 : raw.raw) ? resp : resp.data);
+        });
+    }
+    /**
+     * Verifies a passkey authentication assertion. This endpoint requires no authentication. On success, the user is
+     * logged in and the response carries the Authorization header and auth_token cookie of the new session.
+     * @param credential The credential returned by `navigator.credentials.get()`
+     * @returns SuccessfulAuth object holding the token and the authenticated user
+     */
+    verifyAuthentication(credential, raw) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const resp = yield this.axios.post(this.getEndpoint("/v1/auth/passkey/verify"), credential);
+            const authed = {
+                token: ((_a = resp.headers["authorization"]) === null || _a === void 0 ? void 0 : _a.toString()) || "",
+                user: resp.data,
+            };
+            return ((raw === null || raw === void 0 ? void 0 : raw.raw) ? Object.assign(Object.assign({}, resp), { data: authed }) : authed);
+        });
+    }
+    getEndpoint(endpoint) {
+        return `${this.options.server}/api/account${endpoint}`;
+    }
+}
+exports.IdpPasskey = IdpPasskey;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hcloud-sdk",
-  "version": "22.9.2",
+  "version": "22.10.0",
   "description": "hcloud platform sdk",
   "main": "index.js",
   "types": "index.d.ts",