run402-mcp
Version:
MCP server for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.
203 lines • 8.06 kB
TypeScript
/**
* `auth` namespace — project-scoped user authentication: magic links, password
* set/change, auth settings, and admin role promotion/demotion.
*
* Magic link + password ops use the project's anon key (they represent
* end-user flows). Settings + promote/demote use the service key.
*/
import type { Client } from "../kernel.js";
export type EmailAuthDelivery = "link" | "code" | "both";
interface MagicLinkOptionsBase {
email: string;
intent?: "signin" | "invite" | "claim" | "recovery";
clientState?: unknown;
}
export type MagicLinkOptions = (MagicLinkOptionsBase & {
delivery?: "link";
redirectUrl: string;
}) | (MagicLinkOptionsBase & {
delivery: "both";
redirectUrl: string;
}) | (MagicLinkOptionsBase & {
delivery: "code";
redirectUrl?: string;
});
export interface MagicLinkRequestWarning {
code: string;
message: string;
[key: string]: unknown;
}
export interface MagicLinkRequestResult {
message: string;
warnings?: MagicLinkRequestWarning[];
challengeId?: string;
}
export interface EmailCodeVerifyOptions {
challengeId: string;
code: string;
}
export interface MagicLinkUser {
id: string;
email: string;
}
export interface MagicLinkVerifyResult {
access_token: string;
refresh_token: string;
token_type: string;
expires_in: number;
user: MagicLinkUser;
magic_link?: {
intent: "signin" | "invite" | "claim" | "recovery";
client_state: string | null;
state_source: "anonymous" | "service_key";
state_trusted: boolean;
delivery?: EmailAuthDelivery;
verified_with?: "link" | "email_code";
};
}
export interface AuthProvidersResult {
magic_link: {
enabled: boolean;
/** Capability-gated email modes. Absent means link-only compatibility. */
deliveryModes: EmailAuthDelivery[];
};
[key: string]: unknown;
}
export interface SetPasswordOptions {
accessToken: string;
newPassword: string;
/** Required for password change; omit for reset (via magic link) or initial set. */
currentPassword?: string;
}
export interface AuthSettings {
allow_password_set?: boolean;
preferred_sign_in_method?: "password" | "magic_link" | "oauth_google" | "passkey" | null;
public_signup?: "open" | "known_email" | "invite_only";
require_passkey_for_project_admin?: boolean;
/**
* Restrict hosted Google sign-in to these email domains, enforced at token
* issuance. `[]` or omitted = unrestricted. Entries are normalized
* (lowercased, leading `@` stripped, trimmed, deduped) and domain-validated
* server-side; pass an explicit `[]` to clear an existing restriction.
*/
allowed_email_domains?: string[];
}
export interface AuthSettingsResult {
allow_password_set: boolean;
preferred_sign_in_method: "password" | "magic_link" | "oauth_google" | "passkey" | null;
public_signup: "open" | "known_email" | "invite_only";
require_passkey_for_project_admin: boolean;
/** Normalized email-domain allowlist for hosted Google sign-in; `[]` = unrestricted. */
allowed_email_domains: string[];
}
export interface CreateAuthUserOptions {
email: string;
isAdmin?: boolean;
sendInvite?: boolean;
redirectUrl?: string;
clientState?: unknown;
}
export interface AuthUserAdminResult {
id: string;
email: string;
is_admin: boolean;
email_verified_at: string | null;
created: boolean;
invite_sent: boolean;
}
export interface AuthSessionResult extends MagicLinkVerifyResult {
elevation_required?: boolean;
required_method?: "passkey";
effective_role?: "authenticated";
intended_role?: "project_admin";
}
export interface PasskeyOptionsResult {
challenge_id: string;
options: unknown;
}
export interface PasskeyRecord {
id: string;
rp_id: string;
created_origin: string;
last_used_origin?: string | null;
transports: string[];
label: string | null;
credential_device_type: string | null;
credential_backed_up: boolean | null;
created_at: string;
last_used_at: string | null;
}
export interface PasskeyRegistrationOptions {
accessToken: string;
appOrigin: string;
}
export interface PasskeyRegistrationVerifyOptions {
accessToken: string;
challengeId: string;
response: unknown;
label?: string;
}
export interface PasskeyLoginOptions {
appOrigin: string;
email?: string;
}
export interface PasskeyLoginVerifyOptions {
challengeId: string;
response: unknown;
}
export interface PasskeyListOptions {
accessToken: string;
}
export interface PasskeyDeleteOptions {
accessToken: string;
passkeyId: string;
}
export declare class Auth {
private readonly client;
readonly magicLink: (projectId: string, opts: MagicLinkOptions) => Promise<MagicLinkRequestResult>;
readonly verify: (projectId: string, token: string) => Promise<MagicLinkVerifyResult>;
readonly setPassword: (projectId: string, opts: SetPasswordOptions) => Promise<void>;
readonly promoteUser: (projectId: string, email: string) => Promise<void>;
readonly demoteUser: (projectId: string, email: string) => Promise<void>;
constructor(client: Client);
/** Request a passwordless email credential. Link remains the wire default. */
requestMagicLink(projectId: string, opts: MagicLinkOptions): Promise<MagicLinkRequestResult>;
/** Exchange a magic-link token for access + refresh tokens. */
verifyMagicLink(projectId: string, token: string): Promise<MagicLinkVerifyResult>;
/** Exchange an opaque challenge handle plus a six-digit code. Never auto-retried. */
verifyEmailCode(projectId: string, opts: EmailCodeVerifyOptions): Promise<MagicLinkVerifyResult>;
/**
* Set / change / reset the authenticated user's password. The caller's
* `accessToken` (from `verifyMagicLink` or a prior login) is used as the
* Bearer credential.
*/
setUserPassword(projectId: string, opts: SetPasswordOptions): Promise<void>;
/** Update project-level auth settings. Requires service key. */
settings(projectId: string, settings: AuthSettings): Promise<AuthSettingsResult>;
/** Create or update an auth user. Requires service key. */
createUser(projectId: string, opts: CreateAuthUserOptions): Promise<AuthUserAdminResult>;
/** Create/update an auth user and send a trusted invite. Requires service key. */
inviteUser(projectId: string, opts: Omit<CreateAuthUserOptions, "sendInvite">): Promise<AuthUserAdminResult>;
/** Create WebAuthn registration options for the authenticated user. */
createPasskeyRegistrationOptions(projectId: string, opts: PasskeyRegistrationOptions): Promise<PasskeyOptionsResult>;
/** Verify and store a WebAuthn passkey registration. */
verifyPasskeyRegistration(projectId: string, opts: PasskeyRegistrationVerifyOptions): Promise<PasskeyRecord>;
/** Create WebAuthn login options. */
createPasskeyLoginOptions(projectId: string, opts: PasskeyLoginOptions): Promise<PasskeyOptionsResult>;
/** Verify a WebAuthn login assertion and return a normal auth session. */
verifyPasskeyLogin(projectId: string, opts: PasskeyLoginVerifyOptions): Promise<AuthSessionResult>;
/** List the authenticated user's active passkeys. */
listPasskeys(projectId: string, opts: PasskeyListOptions): Promise<{
passkeys: PasskeyRecord[];
}>;
/** Delete one authenticated-user passkey by id. */
deletePasskey(projectId: string, opts: PasskeyDeleteOptions): Promise<void>;
/** List configured auth providers for a project. Uses the project's anon key. */
providers(projectId: string): Promise<AuthProvidersResult>;
/** Promote a user (by email) to `project_admin`. Requires service key. */
promote(projectId: string, email: string): Promise<void>;
/** Demote a user (by email) from `project_admin` back to the default role. */
demote(projectId: string, email: string): Promise<void>;
}
export {};
//# sourceMappingURL=auth.d.ts.map