atlas-auth 0.1.0

data/lib/atlas/resources/branding.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/branding+ — the hosted-page / email appearance bag.
+    class Branding < Base
+      def get
+        request(method: :get, path: "/v1/branding")
+      end
+
+      # A PARTIAL merge — one field changes, the rest is preserved.
+      def update(body)
+        request(method: :patch, path: "/v1/branding", body: body)
+      end
+
+      # Render a draft through the live sign-in renderer without saving it.
+      def preview(body)
+        request(method: :post, path: "/v1/branding/preview", body: body)
+      end
+    end
+  end
+end

data/lib/atlas/resources/data_subject_requests.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/data_subject_requests+ — the GDPR/DSAR admin surface.
+    class DataSubjectRequests < Base
+      def list(params = {})
+        request(method: :get, path: "/v1/data_subject_requests", query: params)
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/data_subject_requests/#{enc(id)}")
+      end
+
+      # Fulfil a request now — build the export package, or run the erasure.
+      def fulfill(id, idempotency_key: nil)
+        request(method: :post, path: "/v1/data_subject_requests/#{enc(id)}/fulfill", idempotency_key: idempotency_key)
+      end
+
+      # Reject a request with a recorded reason. Terminal.
+      def reject(id, body = {}, idempotency_key: nil)
+        request(method: :post, path: "/v1/data_subject_requests/#{enc(id)}/reject", body: body, idempotency_key: idempotency_key)
+      end
+    end
+  end
+end

data/lib/atlas/resources/domains.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/domains+ — custom FAPI/accounts domains and their DNS verification.
+    class Domains < Base
+      def list
+        request(method: :get, path: "/v1/domains")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/domains", body: body, idempotency_key: idempotency_key)
+      end
+
+      def verify(id)
+        request(method: :post, path: "/v1/domains/#{enc(id)}/verify")
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/domains/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/email_templates.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/email_templates+ — transactional email templates, keyed by name.
+    class EmailTemplates < Base
+      def list
+        request(method: :get, path: "/v1/email_templates")
+      end
+
+      # Render an unsaved draft (if a body is given) or the stored template.
+      def preview(name, body = {})
+        request(method: :post, path: "/v1/email_templates/#{enc(name)}/preview", body: body)
+      end
+
+      # Save an override. Keyed by template name, not an id.
+      def update(name, body)
+        request(method: :put, path: "/v1/email_templates/#{enc(name)}", body: body)
+      end
+
+      # Revert to the built-in.
+      def delete(name)
+        request(method: :delete, path: "/v1/email_templates/#{enc(name)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/fga.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/fga+ — fine-grained relationship-based authorization (Zanzibar /
+    # OpenFGA). A tenant owns stores; each holds versioned models and the
+    # relationship tuples the engine resolves.
+    class Fga < Base
+      # +fga.stores+ — store CRUD.
+      def stores
+        @stores ||= Stores.new(@transport)
+      end
+
+      # +fga.models+ — authorization models within a store.
+      def models
+        @models ||= Models.new(@transport)
+      end
+
+      # Write and/or delete tuples in one atomic call.
+      def write(store_id, body, idempotency_key: nil)
+        request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/write", body: body, idempotency_key: idempotency_key)
+      end
+
+      # Query stored tuples by any of user / relation / object.
+      def read(store_id, body)
+        request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/read", body: body)
+      end
+
+      # Resolve a single access question against the model.
+      def check(store_id, body)
+        request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/check", body: body)
+      end
+
+      # Resolve MANY access questions in one round trip.
+      def batch_check(store_id, body)
+        request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/batch-check", body: body)
+      end
+
+      # List the objects of a type a user has a relation to.
+      def list_objects(store_id, body)
+        request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/list-objects", body: body)
+      end
+
+      # Expand the full userset tree for an object#relation.
+      def expand(store_id, body)
+        request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/expand", body: body)
+      end
+
+      # Bind a default store so an app that uses one store can call
+      # +fga.store(id).check(...)+ instead of threading the store id through
+      # every call. Returns the same operations with +store_id+ pre-applied.
+      def store(store_id)
+        StoreScope.new(self, store_id)
+      end
+
+      class Stores < Base
+        def list
+          request(method: :get, path: "/v1/fga/stores")
+        end
+
+        def create(body, idempotency_key: nil)
+          request(method: :post, path: "/v1/fga/stores", body: body, idempotency_key: idempotency_key)
+        end
+
+        def get(id)
+          request(method: :get, path: "/v1/fga/stores/#{enc(id)}")
+        end
+
+        def delete(id)
+          request(method: :delete, path: "/v1/fga/stores/#{enc(id)}")
+        end
+      end
+
+      class Models < Base
+        def list(store_id)
+          request(method: :get, path: "/v1/fga/stores/#{enc(store_id)}/authorization-models")
+        end
+
+        def create(store_id, body, idempotency_key: nil)
+          request(method: :post, path: "/v1/fga/stores/#{enc(store_id)}/authorization-models", body: body, idempotency_key: idempotency_key)
+        end
+
+        def get(store_id, model_id)
+          request(method: :get, path: "/v1/fga/stores/#{enc(store_id)}/authorization-models/#{enc(model_id)}")
+        end
+      end
+
+      # A store-bound view of the operations, so callers skip the store id.
+      class StoreScope
+        def initialize(fga, store_id)
+          @fga = fga
+          @store_id = store_id
+        end
+
+        def write(body, idempotency_key: nil)
+          @fga.write(@store_id, body, idempotency_key: idempotency_key)
+        end
+
+        def read(body)
+          @fga.read(@store_id, body)
+        end
+
+        def check(body)
+          @fga.check(@store_id, body)
+        end
+
+        def batch_check(body)
+          @fga.batch_check(@store_id, body)
+        end
+
+        def list_objects(body)
+          @fga.list_objects(@store_id, body)
+        end
+
+        def expand(body)
+          @fga.expand(@store_id, body)
+        end
+
+        def models
+          @models ||= BoundModels.new(@fga, @store_id)
+        end
+
+        class BoundModels
+          def initialize(fga, store_id)
+            @fga = fga
+            @store_id = store_id
+          end
+
+          def list
+            @fga.models.list(@store_id)
+          end
+
+          def create(body, idempotency_key: nil)
+            @fga.models.create(@store_id, body, idempotency_key: idempotency_key)
+          end
+
+          def get(model_id)
+            @fga.models.get(@store_id, model_id)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/atlas/resources/import_export.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/user_imports+, +/v1/user_exports+, +/v1/jobs+ — bulk user import/export
+    # jobs (the Auth0 +jobs+ parity surface).
+    class ImportExport < Base
+      # Import users through the same per-row path sign-up uses.
+      def import_users(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/user_imports", body: body, idempotency_key: idempotency_key)
+      end
+
+      # Export every non-deleted user, serialised without secrets.
+      def export_users(idempotency_key: nil)
+        request(method: :post, path: "/v1/user_exports", idempotency_key: idempotency_key)
+      end
+
+      # Poll the instance's import/export jobs, newest first.
+      def list_jobs(params = {})
+        request(method: :get, path: "/v1/jobs", query: params)
+      end
+
+      def get_job(id)
+        request(method: :get, path: "/v1/jobs/#{enc(id)}")
+      end
+
+      # The per-row failures recorded against a job.
+      def get_job_errors(id)
+        request(method: :get, path: "/v1/jobs/#{enc(id)}/errors")
+      end
+    end
+  end
+end

data/lib/atlas/resources/instance.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/instance+ — instance configuration (origins, auth config).
+    class Instance < Base
+      def get
+        request(method: :get, path: "/v1/instance")
+      end
+
+      def update(body)
+        request(method: :patch, path: "/v1/instance", body: body)
+      end
+    end
+  end
+end

data/lib/atlas/resources/instance_security.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/instance/security+ — kill switches, IP allowlist, and the write-only
+    # provider secrets (captcha, Kerberos, LDAP bind password).
+    class InstanceSecurity < Base
+      def get
+        request(method: :get, path: "/v1/instance/security")
+      end
+
+      def update(body)
+        request(method: :patch, path: "/v1/instance/security", body: body)
+      end
+
+      # Store the captcha provider secret. Refused while the provider is +none+.
+      def set_captcha_secret(body)
+        request(method: :put, path: "/v1/instance/captcha_secret", body: body)
+      end
+
+      def delete_captcha_secret
+        request(method: :delete, path: "/v1/instance/captcha_secret")
+      end
+
+      # Store the Kerberos/IWA trusted-proxy secret.
+      def set_kerberos_secret(body)
+        request(method: :put, path: "/v1/instance/kerberos_secret", body: body)
+      end
+
+      def delete_kerberos_secret
+        request(method: :delete, path: "/v1/instance/kerberos_secret")
+      end
+
+      # Store an LDAP connection's service-account bind password.
+      def set_ldap_bind_password(connection_id, body)
+        request(method: :put, path: "/v1/instance/ldap_connections/#{enc(connection_id)}/bind_password", body: body)
+      end
+
+      def delete_ldap_bind_password(connection_id)
+        request(method: :delete, path: "/v1/instance/ldap_connections/#{enc(connection_id)}/bind_password")
+      end
+    end
+  end
+end

data/lib/atlas/resources/invitations.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/invitations+ — instance-level sign-up invitations.
+    class Invitations < Base
+      def list(params = {})
+        request(method: :get, path: "/v1/invitations", query: params)
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/invitations", body: body, idempotency_key: idempotency_key)
+      end
+
+      def revoke(id)
+        request(method: :post, path: "/v1/invitations/#{enc(id)}/revoke")
+      end
+    end
+  end
+end

data/lib/atlas/resources/jwt_templates.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/jwt_templates+ — custom JWT claim templates, keyed by name.
+    class JwtTemplates < Base
+      def list
+        request(method: :get, path: "/v1/jwt_templates")
+      end
+
+      # Fetched by template name.
+      def get(name)
+        request(method: :get, path: "/v1/jwt_templates/#{enc(name)}")
+      end
+
+      def create(body)
+        request(method: :post, path: "/v1/jwt_templates", body: body)
+      end
+
+      # Only the claims are updatable; the name is the key.
+      def update(name, body)
+        request(method: :patch, path: "/v1/jwt_templates/#{enc(name)}", body: body)
+      end
+
+      def delete(name)
+        request(method: :delete, path: "/v1/jwt_templates/#{enc(name)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/localizations.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/localizations+ — per-locale overrides for emails, SMS, and prompt copy.
+    class Localizations < Base
+      def list(params = {})
+        request(method: :get, path: "/v1/localizations", query: params)
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/localizations", body: body, idempotency_key: idempotency_key)
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/localizations/#{enc(id)}")
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/localizations/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/localizations/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/log_streams.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/log_streams+ — the instance event feed forwarded to external sinks.
+    class LogStreams < Base
+      def list
+        request(method: :get, path: "/v1/log_streams")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/log_streams/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/log_streams", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/log_streams/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/log_streams/#{enc(id)}")
+      end
+
+      # Send ONE synthetic event with the real credentials.
+      def test(id)
+        request(method: :post, path: "/v1/log_streams/#{enc(id)}/test")
+      end
+    end
+  end
+end

data/lib/atlas/resources/lti_platforms.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/lti_platforms+ — LTI 1.3 platform (LMS) registrations.
+    class LtiPlatforms < Base
+      def list
+        request(method: :get, path: "/v1/lti_platforms")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/lti_platforms/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/lti_platforms", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/lti_platforms/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/lti_platforms/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/managed_waf.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/managed_waf+ — the managed AWS WAF captcha gate control plane.
+    class ManagedWaf < Base
+      # Read config + provisioning state, with secrets reduced to +has_*+ markers.
+      def get
+        request(method: :get, path: "/v1/managed_waf")
+      end
+
+      # Read just the provisioning state.
+      def status
+        request(method: :get, path: "/v1/managed_waf/status")
+      end
+
+      # Set config and write-only credentials; omitted fields are left unchanged.
+      def update(body)
+        request(method: :put, path: "/v1/managed_waf", body: body)
+      end
+
+      # Apply now — idempotent create/update + associate the WebACL.
+      def provision
+        request(method: :post, path: "/v1/managed_waf/provision")
+      end
+
+      # Disassociate and delete the WebACL.
+      def deprovision
+        request(method: :post, path: "/v1/managed_waf/deprovision")
+      end
+    end
+  end
+end

data/lib/atlas/resources/messaging.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/messaging_providers+ — BYOK email/SMS provider config.
+    class Messaging < Base
+      # The instance's configured email and SMS providers, secrets omitted.
+      def get
+        request(method: :get, path: "/v1/messaging_providers")
+      end
+
+      def set_email(body)
+        request(method: :put, path: "/v1/messaging_providers/email", body: body)
+      end
+
+      def set_sms(body)
+        request(method: :put, path: "/v1/messaging_providers/sms", body: body)
+      end
+
+      def delete_channel(channel)
+        request(method: :delete, path: "/v1/messaging_providers/#{enc(channel)}")
+      end
+
+      # Send a fixed, clearly-marked test message through the channel's provider.
+      def test(channel, body)
+        request(method: :post, path: "/v1/messaging_providers/#{enc(channel)}/test", body: body)
+      end
+    end
+  end
+end

data/lib/atlas/resources/network_acls.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/network_acls+ — per-instance IP allow/deny rules, priority-ordered.
+    class NetworkAcls < Base
+      def list
+        request(method: :get, path: "/v1/network_acls")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/network_acls/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/network_acls", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/network_acls/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/network_acls/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/oauth_clients.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/oauth_clients+ — first- and third-party OAuth/OIDC clients, plus their
+    # resource-server grants.
+    class OAuthClients < Base
+      def list
+        request(method: :get, path: "/v1/oauth_clients")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/oauth_clients/#{enc(id)}")
+      end
+
+      # Create reveals the client secret exactly once.
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/oauth_clients", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/oauth_clients/#{enc(id)}", body: body)
+      end
+
+      def rotate_secret(id)
+        request(method: :post, path: "/v1/oauth_clients/#{enc(id)}/rotate_secret")
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/oauth_clients/#{enc(id)}")
+      end
+
+      # +oauth_clients.grants+ — resource-server grants for a client.
+      def grants
+        @grants ||= Grants.new(@transport)
+      end
+
+      class Grants < Base
+        def list(client_id)
+          request(method: :get, path: "/v1/oauth_clients/#{enc(client_id)}/grants")
+        end
+
+        def create(client_id, body)
+          request(method: :post, path: "/v1/oauth_clients/#{enc(client_id)}/grants", body: body)
+        end
+
+        def delete(client_id, grant_id)
+          request(method: :delete, path: "/v1/oauth_clients/#{enc(client_id)}/grants/#{enc(grant_id)}")
+        end
+      end
+    end
+  end
+end