openvibers/openvibe.sdk Commits

Add identity SDK account email helpers (#144)

OP OpenVibers committed 4 days ago · 1cdcf59529 · 13 files, +140 −14

* Add identity SDK account email helpers

* Refresh SDK release metadata

* Add verified email identity helper

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex b72fec6..45c37e0 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.104.0 (2026-11-08)
++
++- Add `createAccountEmailsClient` to `openvibe-sdk/identity` for managing the signed-in person's verified Network email addresses.
++
  ## 0.103.0 (2026-11-08)
  
  - Add `openvibe-sdk/credentials`: `createCredentialsClient` for a person's own provider credentials on OpenVibe.AI:
ddiff --git a/README.md b/README.md
iindex ebf8aa8..2aa839a 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.103.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.104.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -11,7 +11,7 @@
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.103.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.104.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -166,7 +166,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/core` | both | `createClient()`, `OpenVibeError`, `paginate()`, `offsetPager()`, trace and id helpers, `CONTRACTS_RANGE` |
  | `openvibe-sdk/auth` | server (browser build: PKCE only) | `createServiceTokenClient()` (+ `getTokenInfo()`), `createNetworkKeys()`, `verifyUserToken()`, `verifyAppToken()`, `verifyServiceToken()`, `exchangeCode()`, `refreshUserToken()`; `startAuthorization()`, `buildAuthorizeUrl()`, `createPkcePair()`, `readCallback()`, `decodeUnverified()`, `unverifiedClaims()` |
  | `openvibe-sdk/registry` | both | `createRegistryClient(client)`: `services({status})`, `service(id)`, `capabilities({owner})`, `capability(id)`, `namespaces()`, `contracts()`, `topics()`, `domain(host)`, `descriptor()` |
--| `openvibe-sdk/identity` | server | `createIdentityClient(client)`: `resolve({subjectId} \| {system,type,id})`, `resolveBatch({subjectIds} \| {system,type,ids})` |
++| `openvibe-sdk/identity` | server | `createIdentityClient(client)`: `resolve({subjectId} \| {system,type,id})`, `resolveBatch({subjectIds} \| {system,type,ids})`; `createAccountEmailsClient({getToken})` manages the signed-in person's verified addresses ([guide](docs/identity-emails.md)) |
  | `openvibe-sdk/trust` | both | `createTrustClient({networkUrl, getToken})`: `me()` reads the caller's own account or guest signals; `of(subject)` reads an account or guest with `identity.trust.read`; `isNew(signals, {hours})`, `atLeast(signals, band)`, `AGE_BANDS` |
  | `openvibe-sdk/notifications` | server | `createNotificationsClient(client)`: `push({subjectId \| userId, type, title, message, url, category, priority, …})` through Network (`network.notifications.push`); `{ sent, skipped }` or `{ sent: false, reason: 'unknown_subject' }`; attempted once, the caller retries |
  | `openvibe-sdk/modules` | both | `createModulesClient(client)`: `get`, `put(ns, data, {revision})`, `delete`, `list`, `update(ns, fn)`, `publicGet`; `forSubject.get/put/update` for services |
ddiff --git a/STATUS.json b/STATUS.json
iindex 8b538f7..36972ac 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.103.0",
++  "version": "0.104.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex c4f9202..0e6bc01 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.103.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.104.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, modules, realtime, media, community, bot, search, bench, meme, vision, themes, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -50,7 +50,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.103.0';
++const SDK_VERSION = '0.104.0';
  
  module.exports = {
      createClient,
ddiff --git a/docs/api-surface.json b/docs/api-surface.json
iindex 6a277bd..e336632 100644
---- a/docs/api-surface.json
++++ b/docs/api-surface.json
@@@ -162,6 +162,7 @@
      },
      "identity": {
        "object": [
++        "createAccountEmailsClient",
          "createIdentityClient"
        ]
      },
@@@ -720,6 +721,7 @@
      "createHostClient": "function"
    },
    "openvibe-sdk/identity": {
++    "createAccountEmailsClient": "function",
      "createIdentityClient": "function"
    },
    "openvibe-sdk/inventory": {
ddiff --git a/docs/identity-emails.md b/docs/identity-emails.md
nnew file mode 100644
iindex 0000000..ac5be8c
---- /dev/null
++++ b/docs/identity-emails.md
@@@ -0,0 +1,28 @@
++# Account email addresses
++
++Use `createAccountEmailsClient` with the signed-in person's Network access token. It only reads and changes that person's own list; email addresses are private until the person shares one.
++
++```js
++const { createAccountEmailsClient } = require('openvibe-sdk/identity');
++
++const emails = createAccountEmailsClient({
++  getToken: () => session.accessToken,
++});
++
++const { emails: addresses } = await emails.list();
++await emails.add('[email protected]'); // Network sends a single-use verification link
++await emails.makePrimary(addresses[1].id); // verified addresses only
++await emails.remove(addresses[0].id); // choose a new primary first
++```
++
++`verify(id)` asks Network to send the verification link again. Verification links expire after one hour and can be used once. Keep the access token on the person's trusted client or server and do not log it.
++
++Services holding `identity.emails.read` can check one subject and address without receiving an address list:
++
++```js
++const { createIdentityClient } = require('openvibe-sdk/identity');
++const identity = createIdentityClient(serviceClient);
++const verified = await identity.isEmailVerified({ subject: 'usr_…', email: '[email protected]' });
++```
++
++Unknown subjects and addresses both return `false`. Making an address primary or removing one requires a sign-in from the last ten minutes.
ddiff --git a/esm/identity.mjs b/esm/identity.mjs
iindex cb61486..e769670 100644
---- a/esm/identity.mjs
++++ b/esm/identity.mjs
@@@ -2,6 +2,6 @@
  import cjs from '../src/identity.js';
  
  export const {
--    createIdentityClient,
++    createIdentityClient, createAccountEmailsClient,
  } = cjs;
  export default cjs;
ddiff --git a/package-lock.json b/package-lock.json
iindex e0a2537..9fcfe2f 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.103.0",
++  "version": "0.104.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.103.0",
++      "version": "0.104.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 9916e6f..a679653 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.103.0",
++  "version": "0.104.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 29c6ed2..30e1c12 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.103.0';
++const SDK_VERSION = '0.104.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/identity.js b/src/identity.js
iindex 91f2e06..7d32ebf 100644
---- a/src/identity.js
++++ b/src/identity.js
@@@ -10,6 +10,38 @@
   */
  const { isOpenVibeError } = require('./core/errors');
  
++/** Manage the authenticated person's private, verified email addresses on Network. */
++function createAccountEmailsClient({ networkUrl = 'https://openvibe.network', getToken, fetchImpl = globalThis.fetch } = {}) {
++    if (typeof getToken !== 'function') throw new TypeError('createAccountEmailsClient: getToken must be a function');
++    if (typeof fetchImpl !== 'function') throw new TypeError('createAccountEmailsClient: fetch is not available');
++    const base = String(networkUrl || '').replace(/\/+$/, '');
++    if (!base) throw new TypeError('createAccountEmailsClient: networkUrl is required');
++    async function request(path, { method = 'GET', body } = {}) {
++        const token = await getToken();
++        if (!token) throw new TypeError('createAccountEmailsClient: getToken returned no token');
++        const response = await fetchImpl(`${base}/api/v1/me/emails${path}`, {
++            method,
++            headers: { Accept: 'application/json', Authorization: `Bearer ${token}`, ...(body ? { 'Content-Type': 'application/json' } : {}) },
++            ...(body ? { body: JSON.stringify(body) } : {}),
++        });
++        const data = await response.json().catch(() => null);
++        if (!response.ok) {
++            const error = new Error(data && (data.detail || data.error) || `Network email request failed (${response.status})`);
++            error.status = response.status;
++            error.code = data && (data.code || data.error);
++            throw error;
++        }
++        return data;
++    }
++    return {
++        list: () => request(''),
++        add: (email) => request('', { method: 'POST', body: { email } }),
++        verify: (id) => request(`/${encodeURIComponent(String(id))}/verify`, { method: 'POST' }),
++        remove: (id) => request(`/${encodeURIComponent(String(id))}`, { method: 'DELETE' }),
++        makePrimary: (id) => request(`/${encodeURIComponent(String(id))}/primary`, { method: 'POST' }),
++    };
++}
++
  const BATCH = 500;
  
  function createIdentityClient(client, { baseUrl } = {}) {
@@@ -50,7 +82,14 @@ function createIdentityClient(client, { baseUrl } = {}) {
          return results;
      }
  
--    return { resolve, resolveBatch };
++    /** True only when the supplied email is verified for the supplied Network user subject. */
++    async function isEmailVerified({ subject, email } = {}) {
++        if (typeof subject !== 'string' || !subject || typeof email !== 'string' || !email) throw new TypeError('isEmailVerified: subject and email are required');
++        const result = await call({ method: 'POST', path: '/api/v1/identity/emails/verified-check', json: { subject, email }, idempotent: true });
++        return result?.verified === true;
++    }
++
++    return { resolve, resolveBatch, isEmailVerified };
  }
  
--module.exports = { createIdentityClient };
++module.exports = { createIdentityClient, createAccountEmailsClient };
ddiff --git a/test/identity.test.js b/test/identity.test.js
iindex 3810afb..b0d66ec 100644
---- a/test/identity.test.js
++++ b/test/identity.test.js
@@@ -4,7 +4,7 @@ const assert = require('node:assert/strict');
  const { stubServer, send, run } = require('./helpers');
  const { createClient } = require('../src/core');
  const { createServiceTokenClient } = require('../src/auth');
--const { createIdentityClient } = require('../src/identity');
++const { createIdentityClient, createAccountEmailsClient } = require('../src/identity');
  const { createMockPlatform } = require('../src/testing');
  
  run([
@@@ -42,4 +42,34 @@ run([
          await assert.rejects(identity.resolveBatch({ ids: [1] }), TypeError);
          await srv.close();
      }],
++
++    ['verified email check asks Network for one subject and address only', async () => {
++        const srv = await stubServer((req, res, body) => {
++            assert.equal(req.method, 'POST');
++            assert.equal(req.url, '/api/v1/identity/emails/verified-check');
++            assert.deepEqual(JSON.parse(body.toString()), { subject: 'usr_01JAB2C3D4E5F6G7H8J9K0MNPQ', email: '[email protected]' });
++            send(res, 200, { verified: true });
++        });
++        const identity = createIdentityClient(createClient({ baseUrls: { network: srv.url }, token: 'svc' }));
++        assert.equal(await identity.isEmailVerified({ subject: 'usr_01JAB2C3D4E5F6G7H8J9K0MNPQ', email: '[email protected]' }), true);
++        await assert.rejects(identity.isEmailVerified({ email: '[email protected]' }), TypeError);
++        await srv.close();
++    }],
++
++    ["account email helpers use the signed-in person's Network API", async () => {
++        const srv = await stubServer((req, res) => send(res, 200, { ok: true, emails: [] }));
++        const emails = createAccountEmailsClient({ networkUrl: srv.url, getToken: () => 'person-token' });
++        await emails.list();
++        await emails.add('[email protected]');
++        await emails.verify('email-id');
++        await emails.makePrimary('email-id');
++        await emails.remove('email-id');
++        assert.deepEqual(srv.requests.map((r) => [r.method, r.url]), [
++            ['GET', '/api/v1/me/emails'], ['POST', '/api/v1/me/emails'], ['POST', '/api/v1/me/emails/email-id/verify'],
++            ['POST', '/api/v1/me/emails/email-id/primary'], ['DELETE', '/api/v1/me/emails/email-id'],
++        ]);
++        assert.ok(srv.requests.every((r) => r.headers.authorization === 'Bearer person-token'));
++        assert.deepEqual(JSON.parse(srv.requests[1].body.toString()), { email: '[email protected]' });
++        await srv.close();
++    }],
  ]);
ddiff --git a/types/identity.d.ts b/types/identity.d.ts
iindex 028f25c..255bb6c 100644
---- a/types/identity.d.ts
++++ b/types/identity.d.ts
@@@ -16,5 +16,28 @@ export type ResolveBatchInput = { subjectIds: string[] } | { system: string; typ
  export interface IdentityClient {
      resolve(input: ResolveInput): Promise<SubjectProjection | null>;
      resolveBatch(input: ResolveBatchInput): Promise<Record<string, SubjectProjection | null>>;
++    isEmailVerified(input: { subject: string; email: string }): Promise<boolean>;
  }
  export declare function createIdentityClient(client: OpenVibeClient, opts?: { baseUrl?: string }): IdentityClient;
++
++export interface AccountEmail {
++    id: string;
++    email: string;
++    verified: boolean;
++    verified_at: string | null;
++    primary: boolean;
++    created_at: string;
++}
++export interface AccountEmailsClient {
++    list(): Promise<{ emails: AccountEmail[] }>;
++    add(email: string): Promise<{ ok: boolean; message: string }>;
++    verify(id: string): Promise<{ ok: boolean; message: string }>;
++    remove(id: string): Promise<{ ok: boolean; emails: AccountEmail[] }>;
++    makePrimary(id: string): Promise<{ ok: boolean; emails: AccountEmail[] }>;
++}
++/** Manage the current person's own addresses with an OpenVibe.Network user access token. */
++export declare function createAccountEmailsClient(opts: {
++    networkUrl?: string;
++    getToken: () => string | Promise<string>;
++    fetchImpl?: typeof fetch;
++}): AccountEmailsClient;