wyrd/tools
esc

    ↑↓ Move ↵ Open t3c results first Search by Pagefind
    Releases

    Authentication API

    Authentication API

    Classes

    AuthClient

    Auth control plane and the sole owner of credential-store access.

    Constants

    AuthEnvironmentScope

    Strict: validates the scopes a caller asks for.

    AuthLegacyScopes

    The scopes clients released before granular permissions knew. Servers report scopes filtered to these and the full grant as permissions.

    AuthWebSocketTicketUse

    A ticket minted for one use is refused on the other route.

    AuthBrowserSessionResult

    The session token itself is only in the response's HttpOnly cookie.

    AuthReviewWriteScope

    Retained for decoding existing credentials; grants no current RPC access.

    Functions

    generateDpopKey()

    Generate a P-256 key. The caller owns it until a token exchange stores it.

    export function generateDpopKey(): DpopPrivateJwk;
    createDpopProof()

    Sign a proof for one request. A socket URL is named as the HTTP request the server sees.

    export function createDpopProof(input: DpopProofInput): string;
    currentDesktopBootstrapToken()

    The token of the current window. The server also accepts the windows on each side.

    export function currentDesktopBootstrapToken(secret: string, nowMs: number = Date.now()): string;
    watchAccess()

    Watch changes to access grants and authenticated clients.

    export function watchAccess(
  rpc: RpcClient<RpcMethods>,
  options?: { readonly signal?: AbortSignal },
): AsyncIterable<DecodedStreamItem<AuthAccessStreamEvent>>;
    grantedScopes()

    Read granular permissions when present, otherwise the legacy scopes.

    export function grantedScopes(response: {
  readonly scopes?: readonly AuthGrantedScope[] | undefined;
  readonly permissions?: readonly AuthGrantedScope[] | undefined;
}): AuthGrantedScope[];
    hasScope()

    granted is what the server reported and may hold scopes this client does not know.

    export function hasScope(
  granted: readonly AuthGrantedScope[] | undefined,
  required: AuthEnvironmentScope,
): boolean;
    ensureScopes()

    Require every named scope; throw T3AuthError for the first missing scope.

    export function ensureScopes(
  granted: readonly AuthGrantedScope[] | undefined,
  required: readonly AuthEnvironmentScope[],
  context = "operation",
): void;

    AuthClient

    Auth control plane and the sole owner of credential-store access.

    Kind: global class

    authClient.credentialsVersion

    Increments every time this client saves or clears a different credential.

    get credentialsVersion(): number;

    Kind: instance property of AuthClient

    authClient.onCredentialsChange()

    Called after every change to the stored credential made through this client.

    onCredentialsChange(handler: () => void): () => void;

    Kind: instance method of AuthClient

    authClient.scopesSync()

    Scopes of the last credential loaded or saved; undefined until one is known.

    scopesSync(): AuthGrantedScopeType[] | undefined;

    Kind: instance method of AuthClient

    authClient.descriptor()

    Read the public environment descriptor without authentication.

    descriptor(signal?: AbortSignal): Promise<ExecutionEnvironmentDescriptorType>;

    Kind: instance method of AuthClient

    authClient.sessionState()

    Read the session state using the stored token when present.

    sessionState(signal?: AbortSignal): Promise<AuthSessionStateType>;

    Kind: instance method of AuthClient

    authClient.exchangePairingToken()

    Exchange a bootstrap credential and save the resulting session. A pairing token is single use; a desktop bootstrap token can be exchanged again.

    async exchangePairingToken(
    pairingToken: string,
    options: ExchangePairingTokenOptions = {},
  ): Promise<AuthAccessTokenResultType>;

    Kind: instance method of AuthClient

    authClient.setAccessToken()

    Validate an issued token before saving its session metadata.

    async setAccessToken(
    token: string,
    options: SetAccessTokenOptions = {},
  ): Promise<AuthSessionStateType>;

    Kind: instance method of AuthClient

    authClient.clearCredentials()

    Forgets the stored credential.

    async clearCredentials(): Promise<void>;

    Kind: instance method of AuthClient

    authClient.websocketTicket()

    Issue a short-lived WebSocket ticket for the stored credential.

    websocketTicket(signal?: AbortSignal): Promise<AuthWebSocketTicketResultType>;

    Kind: instance method of AuthClient

    authClient.createPairingCredential()

    Create a pairing credential with the requested scopes.

    createPairingCredential(
    input: AuthCreatePairingCredentialInputType,
  ): Promise<AuthPairingCredentialResultType>;

    Kind: instance method of AuthClient

    Revoke a pairing link; return whether it was revoked.

    async revokePairingLink(id: string): Promise<boolean>;

    Kind: instance method of AuthClient

    authClient.revokeClient()

    Revoke the selected client session.

    async revokeClient(sessionId: AuthSessionId): Promise<boolean>;

    Kind: instance method of AuthClient

    authClient.revokeOtherClients()

    Revoke other sessions; return the number revoked.

    async revokeOtherClients(): Promise<number>;

    Kind: instance method of AuthClient

    authClient.currentAccessToken()

    Load the current bearer token through the credential store.

    async currentAccessToken(): Promise<string | undefined>;

    Kind: instance method of AuthClient

    authClient.currentDpopKey()

    The key of a proof-bound session; undefined for a bearer session.

    async currentDpopKey(): Promise<DpopPrivateJwk | undefined>;

    Kind: instance method of AuthClient

    authClient.currentScopes()

    Load and return the scopes granted to the current credential.

    async currentScopes(): Promise<AuthGrantedScopeType[] | undefined>;

    Kind: instance method of AuthClient

    authClient.hasScope()

    Check whether the credential grants the requested scope.

    async hasScope(scope: AuthEnvironmentScopeType): Promise<boolean>;

    Kind: instance method of AuthClient

    authClient.ensureScopes()

    Throw T3AuthError when a required scope is missing.

    async ensureScopes(required: AuthEnvironmentScopeType[]): Promise<void>;

    Kind: instance method of AuthClient

    AuthEnvironmentScope

    Strict: validates the scopes a caller asks for.

    Kind: global constant

    AuthLegacyScopes

    The scopes clients released before granular permissions knew. Servers report scopes filtered to these and the full grant as permissions.

    Kind: global constant

    AuthWebSocketTicketUse

    A ticket minted for one use is refused on the other route.

    Kind: global constant

    AuthBrowserSessionResult

    The session token itself is only in the response’s HttpOnly cookie.

    Kind: global constant

    AuthReviewWriteScope

    Retained for decoding existing credentials; grants no current RPC access.

    Kind: global constant

    generateDpopKey()

    Generate a P-256 key. The caller owns it until a token exchange stores it.

    export function generateDpopKey(): DpopPrivateJwk;

    Kind: global function

    createDpopProof()

    Sign a proof for one request. A socket URL is named as the HTTP request the server sees.

    export function createDpopProof(input: DpopProofInput): string;

    Kind: global function

    currentDesktopBootstrapToken()

    The token of the current window. The server also accepts the windows on each side.

    export function currentDesktopBootstrapToken(secret: string, nowMs: number = Date.now()): string;

    Kind: global function

    watchAccess()

    Watch changes to access grants and authenticated clients.

    export function watchAccess(
  rpc: RpcClient<RpcMethods>,
  options?: { readonly signal?: AbortSignal },
): AsyncIterable<DecodedStreamItem<AuthAccessStreamEvent>>;

    Kind: global function

    grantedScopes()

    Read granular permissions when present, otherwise the legacy scopes.

    export function grantedScopes(response: {
  readonly scopes?: readonly AuthGrantedScope[] | undefined;
  readonly permissions?: readonly AuthGrantedScope[] | undefined;
}): AuthGrantedScope[];

    Kind: global function

    hasScope()

    granted is what the server reported and may hold scopes this client does not know.

    export function hasScope(
  granted: readonly AuthGrantedScope[] | undefined,
  required: AuthEnvironmentScope,
): boolean;

    Kind: global function

    ensureScopes()

    Require every named scope; throw T3AuthError for the first missing scope.

    export function ensureScopes(
  granted: readonly AuthGrantedScope[] | undefined,
  required: readonly AuthEnvironmentScope[],
  context = "operation",
): void;

    Kind: global function