# @dofe/sso-node

Runtime-neutral Node SDK for `sso.dofe.ai` internal service APIs.

## Install

```bash
pnpm add @dofe/sso-node
```

## Usage

```ts
import { createSsoInternalClient } from '@dofe/sso-node';

const sso = createSsoInternalClient({
  baseUrl: process.env.SSO_INTERNAL_API_URL!,
  internalSecret: process.env.INTERNAL_API_SECRET!,
  serviceName: 'agents.dofe.ai',
});

const user = await sso.users.get('00000000-0000-0000-0000-000000000000');
const permissions = await sso.permissions.getUserPermissions(user.id);
```

For migration from older local clients that expose flat methods, use `createSsoLegacyClient`:

```ts
import { createSsoLegacyClient } from '@dofe/sso-node/legacy';

const sso = createSsoLegacyClient({
  baseUrl: process.env.SSO_INTERNAL_API_URL!,
  internalSecret: process.env.INTERNAL_API_SECRET!,
  internalBasePath: '/api/internal',
  authMode: 'x-internal-secret',
  serviceName: 'agents.dofe.ai',
});

const user = await sso.getUser('00000000-0000-0000-0000-000000000000');
const hasPermission = await sso.checkPermission(user.id, 'team.read', 'team-id');
const role = await sso.getUserTeamRole('team-id', user.id);
```

## Auth Modes

| Mode                | Header                                   |
| ------------------- | ---------------------------------------- |
| `bearer`            | `Authorization: Bearer <internalSecret>` |
| `x-internal-secret` | `X-Internal-Secret: <internalSecret>`    |

The default mode is `bearer`. Use `x-internal-secret` only for legacy services while they migrate.

## Boundary

This package is a client-only SDK. It does not include NestJS modules, Redis subscribers, Prisma, migrations, seeds, or database connection logic.