Class AuthClient

constructor

• new AuthClient(opts: AuthClientOptions): AuthClient

  Parameters

  • opts: AuthClientOptions

  Returns AuthClient

Readonlyapi

acceptInvitation

• acceptInvitation(token: string): Promise<Member>

  Parameters

  • token: string

  Returns Promise<Member>

activateKey

• activateKey(vault: string, version: number): Promise<void>

  Parameters

  • vault: string
  • version: number

  Returns Promise<void>

audit

• audit(
      org: string,
      opts?: { before?: string; limit?: number },
  ): Promise<{ events: AuditEvent[]; next: string | null }>

  Parameters

  • org: string
  • opts: { before?: string; limit?: number } = {}

  Returns Promise<{ events: AuditEvent[]; next: string | null }>

cancelInvitation

• cancelInvitation(org: string, id: string): Promise<void>

  Parameters

  • org: string
  • id: string

  Returns Promise<void>

confirmMember

• confirmMember(
      org: string,
      user: string,
      body: { grants?: VaultGrant[]; sa_master_keys?: SaMasterGrant[] },
  ): Promise<Member>

  Parameters

  • org: string
  • user: string
  • body: { grants?: VaultGrant[]; sa_master_keys?: SaMasterGrant[] }

  Returns Promise<Member>

createOrg

• createOrg(name: string): Promise<Org>

  Parameters

  • name: string

  Returns Promise<Org>

createServiceAccount

• createServiceAccount(
      org: string,
      body: {
          expires_at?: string | null;
          id: string;
          keyset: WrappedKeysetJson;
          master_keys: SaMasterGrant[];
          name: string;
          secret: NewSaSecret;
      },
  ): Promise<ServiceAccount>

  Parameters

  • org: string
  • body: {
        expires_at?: string | null;
        id: string;
        keyset: WrappedKeysetJson;
        master_keys: SaMasterGrant[];
        name: string;
        secret: NewSaSecret;
    }

  Returns Promise<ServiceAccount>

createVault

• createVault(
      body: {
          encrypted_name: string;
          grants: Grant[];
          id: string;
          org_id?: string | null;
      },
  ): Promise<Vault>

  Parameters

  • body: { encrypted_name: string; grants: Grant[]; id: string; org_id?: string | null }

  Returns Promise<Vault>

createWebSession

• createWebSession(): Promise<{ code: string; expires_in: number }>

  A one-time code that signs the browser in to the auth website (SPEC.md §16)

  Returns Promise<{ code: string; expires_in: number }>

deleteOrg

• deleteOrg(org: string): Promise<void>

  Parameters

  • org: string

  Returns Promise<void>

deleteServiceAccount

• deleteServiceAccount(sa: string): Promise<void>

  Parameters

  • sa: string

  Returns Promise<void>

deleteVault

• deleteVault(vault: string): Promise<void>

  Parameters

  • vault: string

  Returns Promise<void>

emailFinish

• emailFinish(body: { record: string; session_id: string }): Promise<void>

  Parameters

  • body: { record: string; session_id: string }

  Returns Promise<void>

emailRequest

• emailRequest(email: string): Promise<{ expires_in: number }>

  Parameters

  • email: string

  Returns Promise<{ expires_in: number }>

emailStart

• emailStart(
      body: { code: string; email: string; request: string },
  ): Promise<{ response: string; session_id: string }>

  Parameters

  • body: { code: string; email: string; request: string }

  Returns Promise<{ response: string; session_id: string }>

getOrg

• getOrg(org: string): Promise<Org>

  Parameters

  • org: string

  Returns Promise<Org>

getServiceAccount

• getServiceAccount(sa: string): Promise<ServiceAccount>

  Parameters

  • sa: string

  Returns Promise<ServiceAccount>

getVault

• getVault(vault: string): Promise<Vault>

  Parameters

  • vault: string

  Returns Promise<Vault>

grantAccess

• grantAccess(vault: string, grants: Grant[]): Promise<void>

  Parameters

  • vault: string
  • grants: Grant[]

  Returns Promise<void>

invite

• invite(org: string, body: { email: string; role: OrgRole }): Promise<Invitation>

  Parameters

  • org: string
  • body: { email: string; role: OrgRole }

  Returns Promise<Invitation>

issueSaSecret

• issueSaSecret(sa: string, body: NewSaSecret): Promise<unknown>

  Parameters

  • sa: string
  • body: NewSaSecret

  Returns Promise<unknown>

listAccess

• listAccess(vault: string): Promise<{ access: VaultAccess[] }>

  Parameters

  • vault: string

  Returns Promise<{ access: VaultAccess[] }>

listDevices

• listDevices(): Promise<{ devices: Device[] }>

  Returns Promise<{ devices: Device[] }>

listInvitations

• listInvitations(org: string): Promise<{ invitations: Invitation[] }>

  Parameters

  • org: string

  Returns Promise<{ invitations: Invitation[] }>

listMembers

• listMembers(org: string): Promise<{ members: Member[] }>

  Parameters

  • org: string

  Returns Promise<{ members: Member[] }>

listSaSecrets

• listSaSecrets(sa: string): Promise<{ secrets: SaSecretInfo[] }>

  Parameters

  • sa: string

  Returns Promise<{ secrets: SaSecretInfo[] }>

listServiceAccounts

• listServiceAccounts(
      org: string,
  ): Promise<{ service_accounts: ServiceAccount[] }>

  Parameters

  • org: string

  Returns Promise<{ service_accounts: ServiceAccount[] }>

listVaults

• listVaults(): Promise<{ vaults: Vault[] }>

  Returns Promise<{ vaults: Vault[] }>

loginFinish

• loginFinish(
      body: { auth_u: string; device: DeviceInfo; session_id: string },
  ): Promise<Session | MfaChallenge>

  Parameters

  • body: { auth_u: string; device: DeviceInfo; session_id: string }

  Returns Promise<Session | MfaChallenge>

loginMfa

• loginMfa(body: { mfa_token: string; totp: string }): Promise<Session>

  Parameters

  • body: { mfa_token: string; totp: string }

  Returns Promise<Session>

loginStart

• loginStart(
      body: { email: string; ke1: string },
  ): Promise<{ ke2: string; session_id: string }>

  Parameters

  • body: { email: string; ke1: string }

  Returns Promise<{ ke2: string; session_id: string }>

logout

• logout(): Promise<void>

  Returns Promise<void>

lookupUser

• lookupUser(email: string): Promise<PublicPrincipal>

  Parameters

  • email: string

  Returns Promise<PublicPrincipal>

me

• me(): Promise<Me>

  Returns Promise<Me>

passwordFinish

• passwordFinish(
      body: {
          kdf: KdfParams;
          keyset: WrappedKeysetJson;
          record: string;
          session_id: string;
      },
  ): Promise<void>

  Parameters

  • body: {
        kdf: KdfParams;
        keyset: WrappedKeysetJson;
        record: string;
        session_id: string;
    }

  Returns Promise<void>

passwordStart

• passwordStart(
      body: { request: string },
  ): Promise<{ response: string; session_id: string }>

  Parameters

  • body: { request: string }

  Returns Promise<{ response: string; session_id: string }>

publicKey

• publicKey(principal: string): Promise<PublicPrincipal>

  Parameters

  • principal: string

  Returns Promise<PublicPrincipal>

recoverFinish

• recoverFinish(
      body: {
          device: DeviceInfo;
          kdf: KdfParams;
          keyset: WrappedKeysetJson;
          record: string;
          session_id: string;
      },
  ): Promise<Session>

  Reset, step 2: stores the new record, kdf and keyset, archives the old ones and signs this device in.

  Parameters

  • body: {
        device: DeviceInfo;
        kdf: KdfParams;
        keyset: WrappedKeysetJson;
        record: string;
        session_id: string;
    }

  Returns Promise<Session>

recoverInfo

• recoverInfo(token: string): Promise<RecoveryResetJson>

  What an approved reset will do. 409 recovery_not_ready (details.notBefore), 410 recovery_cancelled / session_expired.

  Parameters

  • token: string

  Returns Promise<RecoveryResetJson>

recoverStart

• recoverStart(
      body: { request: string; token: string },
  ): Promise<{ response: string; session_id: string }>

  Reset, step 1: an OPAQUE registration request under the account email.

  Parameters

  • body: { request: string; token: string }

  Returns Promise<{ response: string; session_id: string }>

recoveryStatus

• recoveryStatus(): Promise<RecoveryArchiveJson>

  Whether a recovery archive from a reset exists (SPEC.md §18)

  Returns Promise<RecoveryArchiveJson>

refresh

• refresh(refreshToken: string): Promise<TokenPair>

  Parameters

  • refreshToken: string

  Returns Promise<TokenPair>

registerFinish

• registerFinish(
      body: {
          device: DeviceInfo;
          kdf: KdfParams;
          keyset: WrappedKeysetJson;
          record: string;
          session_id: string;
      },
  ): Promise<Session>

  Parameters

  • body: {
        device: DeviceInfo;
        kdf: KdfParams;
        keyset: WrappedKeysetJson;
        record: string;
        session_id: string;
    }

  Returns Promise<Session>

registerStart

• registerStart(
      body: { email: string; request: string },
  ): Promise<{ response: string; session_id: string; user_id: string }>

  Parameters

  • body: { email: string; request: string }

  Returns Promise<{ response: string; session_id: string; user_id: string }>

removeMember

• removeMember(org: string, user: string): Promise<void>

  Parameters

  • org: string
  • user: string

  Returns Promise<void>

renameOrg

• renameOrg(org: string, name: string): Promise<Org>

  Parameters

  • org: string
  • name: string

  Returns Promise<Org>

renameVault

• renameVault(vault: string, encryptedName: string): Promise<Vault>

  Parameters

  • vault: string
  • encryptedName: string

  Returns Promise<Vault>

restoreFinish

• restoreFinish(
      body: { grants: VaultGrant[]; proof: string; session_id: string },
  ): Promise<void>

  Restore, step 3: the vault keys re-sealed to the current keyset, and the proof. 400 invalid_proof.

  Parameters

  • body: { grants: VaultGrant[]; proof: string; session_id: string }

  Returns Promise<void>

restoreStart

• restoreStart(
      body: { ke1: string },
  ): Promise<{ email?: string; ke2: string; session_id: string }>

  Restore, step 1: OPAQUE login against the archived record. Needs a token issued in the last 5 minutes.

  Parameters

  • body: { ke1: string }

  Returns Promise<{ email?: string; ke2: string; session_id: string }>

restoreVerify

• restoreVerify(
      body: { auth_u: string; session_id: string },
  ): Promise<RestoreVerified>

  Restore, step 2: 401 for a wrong old password, else the archived kdf, keyset and grants. Not retried on 401 (a failed verify counts towards the lockout), so call it with a fresh access token.

  Parameters

  • body: { auth_u: string; session_id: string }

  Returns Promise<RestoreVerified>

revokeDevice

• revokeDevice(id: string): Promise<void>

  Parameters

  • id: string

  Returns Promise<void>

revokeSaSecret

• revokeSaSecret(sa: string, id: string): Promise<void>

  Parameters

  • sa: string
  • id: string

  Returns Promise<void>

serviceAccountExchange

• serviceAccountExchange(
      body: { sa_id: string; secret: string },
  ): Promise<ServiceAccountExchange>

  Parameters

  • body: { sa_id: string; secret: string }

  Returns Promise<ServiceAccountExchange>

setMemberRole

• setMemberRole(
      org: string,
      user: string,
      body: { role: OrgRole; sa_master_keys?: SaMasterGrant[] },
  ): Promise<Member>

  Parameters

  • org: string
  • user: string
  • body: { role: OrgRole; sa_master_keys?: SaMasterGrant[] }

  Returns Promise<Member>

startRotation

• startRotation(
      vault: string,
      body: { grants: Grant[]; key_version: number; remove?: string[] },
  ): Promise<void>

  Parameters

  • vault: string
  • body: { grants: Grant[]; key_version: number; remove?: string[] }

  Returns Promise<void>

totpConfirm

• totpConfirm(totp: string): Promise<void>

  Parameters

  • totp: string

  Returns Promise<void>

totpDisable

• totpDisable(totp: string): Promise<void>

  Parameters

  • totp: string

  Returns Promise<void>

totpStart

• totpStart(): Promise<{ otpauth_uri: string; secret: string }>

  Returns Promise<{ otpauth_uri: string; secret: string }>

updateSaSecret

• updateSaSecret(
      sa: string,
      id: string,
      body: { expires_at: string | null },
  ): Promise<SaSecretInfo>

  Changes when a secret expires (null: never); the token stays the same (SPEC §9).

  Parameters

  • sa: string
  • id: string
  • body: { expires_at: string | null }

  Returns Promise<SaSecretInfo>

updateServiceAccount

• updateServiceAccount(
      sa: string,
      body: { disabled?: boolean; expires_at?: string | null; name?: string },
  ): Promise<ServiceAccount>

  Parameters

  • sa: string
  • body: { disabled?: boolean; expires_at?: string | null; name?: string }

  Returns Promise<ServiceAccount>

withTokens

• withTokens(tokens: AccessTokenSource): AuthClient

  Parameters

  • tokens: AccessTokenSource

  Returns AuthClient

StaticfromIssuer

• fromIssuer(
      issuer: string,
      opts?: HttpOptions & { tokens?: AccessTokenSource },
  ): Promise<{ client: AuthClient; config: OpenVireoConfiguration }>

  Builds a client from discovery.

  Parameters

  • issuer: string
  • opts: HttpOptions & { tokens?: AccessTokenSource } = {}

  Returns Promise<{ client: AuthClient; config: OpenVireoConfiguration }>