Reference

Class: AuthSession

Class: AuthSession in @ticketlayer/backstage.

Tokens plus the client that spends them. Every operation that consumes the refresh token (a refresh, an organisation switch) runs one at a time, so two requests that 401 together share one refresh instead of presenting the same rotated token twice.

Accessors#

hasEnded#

Get Signature#

get hasEnded(): boolean;

Defined in: auth/index.ts:780

Whether the issuer has refused the refresh token: sign in again.

Returns

boolean

organisation#

Get Signature#

get organisation(): OrganisationRef | null;

Defined in: auth/index.ts:775

The organisation the current access token is pinned to.

Returns

OrganisationRef | null

tokens#

Get Signature#

get tokens(): StoredTokens;

Defined in: auth/index.ts:770

The current tokens (a copy).

Returns

StoredTokens

Constructors#

Constructor#

new AuthSession(auth: BackstageAuth, options: SessionOptions): AuthSession;

Defined in: auth/index.ts:738

Parameters#

Parameter	Type
`auth`	`BackstageAuth`
`options`	`SessionOptions`

Returns#

AuthSession

Methods#

acceptInvitation()#

acceptInvitation(invitation: string): Promise<{
  redeemed: {
     created: boolean;
     organisation: {
        id: string;
        name: string;
        slug: string;
     };
     userId: string;
  };
  tokens: TokenSet;
}>;

Defined in: auth/index.ts:852

Accept an invitation as the person signed in (POST /me/invitations/redeem), then pin the session to its organisation. The invitation must have been sent to this person's address (403 INVITATION_EMAIL_MISMATCH otherwise, and it is left for that address). Without a session, use auth.invitation.

Parameters#

Parameter	Type
`invitation`	`string`

Returns#

Promise<{ redeemed: { created: boolean; organisation: { id: string; name: string; slug: string; }; userId: string; }; tokens: TokenSet; }>

createOrganisation()#

createOrganisation(input: {
  organisationName: string;
  templateName?: "venue" | "platform" | "developer";
}): Promise<{
  signUp: {
     account: {
        id: string;
        name: string;
     };
     organisation: {
        apiVersion: string;
        id: string;
        name: string;
        plan: string;
        slug: string;
        template: string | null;
     };
     owner: {
        email: string;
        id: string;
     };
     sandbox: {
        channelId: string;
        channelSlug: string;
        eventId: string;
        eventOccurrenceId: string;
        feeProfileId: string;
        listingId: string;
        paymentProviderId: string;
        publishableKey: string;
     };
  };
  tokens: TokenSet;
}>;

Defined in: auth/index.ts:839

A registrant's first organisation: POST /signup with this session's token (one that names no organisation, from signup.verify), then the session is pinned to the new organisation (selectOrganisation), so the client works in it straight away. templateName is the person's answer to what kind of organisation this is (SIGNUP_TEMPLATE_NAMES); ask them rather than choosing. A DPoP-bound session cannot sign up.

Parameters#

Parameter	Type	Description
`input`	{ `organisationName`: `string`; `templateName?`: `"venue"` \| `"platform"` \| `"developer"`; }	-
`input.organisationName`	`string`	Description What to call the organisation. Its slug is derived from this. Example `Acme Events`
`input.templateName?`	`"venue"` \| `"platform"` \| `"developer"`	Description What shape of organisation this is, as the person signing up answered it. ASK THEM; do not pick one for them. `venue`: one seller, whose resident promoters may become accounts; one customer list. `platform`: a platform selling on behalf of unrelated clients, an account per client, and each account owns its own customers. `developer`: building against the API first; one customer list. It decides whether customer records are shared across the organisation's accounts or kept per account, which cannot be changed later without migrating customer data, so it is asked rather than inferred. Omitted, nothing is recorded as chosen: the organisation shares one customer list, as every organisation created before this question existed does. An unknown name is rejected. Example `venue @enum {string}`

Returns#

Promise<{ signUp: { account: { id: string; name: string; }; organisation: { apiVersion: string; id: string; name: string; plan: string; slug: string; template: string | null; }; owner: { email: string; id: string; }; sandbox: { channelId: string; channelSlug: string; eventId: string; eventOccurrenceId: string; feeProfileId: string; listingId: string; paymentProviderId: string; publishableKey: string; }; }; tokens: TokenSet; }>

listOrganisations()#

listOrganisations(): Promise<{
  id: string;
  logoUrl?: string;
  name: string;
  primaryColor?: string;
  secondaryColor?: string;
  slug: string;
  testMode: boolean;
  userId: string;
}[]>;

Defined in: auth/index.ts:827

The signed-in person's organisations: GET /me/organisations, which takes the session's token whether or not it is pinned to an organisation. What an organisation picker shows before selectOrganisation, and all a session pinned to none can call.

Returns#

Promise<{ id: string; logoUrl?: string; name: string; primaryColor?: string; secondaryColor?: string; slug: string; testMode: boolean; userId: string; }[]>

refresh()#

refresh(): Promise<boolean>;

Defined in: auth/index.ts:785

Refresh now (or join the refresh already running). Resolves false when there is no session to refresh.

Returns#

Promise<boolean>

selectOrganisation()#

selectOrganisation(slug: string): Promise<TokenSet>;

Defined in: auth/index.ts:796

Pin the session to another organisation (token exchange). The client follows.

Parameters#

Parameter	Type
`slug`	`string`

Returns#

Promise<TokenSet>

signOut()#

signOut(): Promise<void>;

Defined in: auth/index.ts:872

Sign out: revoke the refresh token at the issuer (RFC 7009), which ends its whole family, so neither it nor any token rotated from it refreshes again; forget the tokens; and call onSessionEnded (with SIGNED_OUT), unless the session had already ended. The access token already issued is a JWT and lives out its (at most fifteen) minutes, but this session no longer sends it. Remove the refresh token from wherever onTokens kept it.

The session ends here whatever the issuer answers, so a till that is offline still signs out. If the revocation could not be made, the error is thrown after that: the refresh token is then still live at the issuer until it expires, and the caller holding a copy may revoke it with auth.revoke later.

Returns#

Promise<void>

Properties#

client#

readonly client: BackstageClient;

Defined in: auth/index.ts:732