atlas-auth 0.1.0

data/lib/atlas/resources/oauth_providers.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/oauth_providers+ — the social sign-in provider catalog + this
+    # instance's per-provider credentials and toggles.
+    class OAuthProviders < Base
+      # The whole catalog, configured or not.
+      def list
+        request(method: :get, path: "/v1/oauth_providers")
+      end
+
+      def get(provider)
+        request(method: :get, path: "/v1/oauth_providers/#{enc(provider)}")
+      end
+
+      # Set (or replace) this instance's own credentials for a provider.
+      def upsert(provider, body, idempotency_key: nil)
+        request(method: :put, path: "/v1/oauth_providers/#{enc(provider)}", body: body, idempotency_key: idempotency_key)
+      end
+
+      def delete(provider)
+        request(method: :delete, path: "/v1/oauth_providers/#{enc(provider)}")
+      end
+
+      # Turn a configured provider on or off.
+      def set_enabled(provider, enabled)
+        request(method: :post, path: "/v1/oauth_providers/#{enc(provider)}/enabled", body: { enabled: enabled })
+      end
+
+      # §6.5 which screens this provider serves. At least one must be true.
+      def set_scope(provider, body)
+        request(method: :post, path: "/v1/oauth_providers/#{enc(provider)}/scope", body: body)
+      end
+
+      # Verify the stored credentials against the provider's token endpoint.
+      def test(provider)
+        request(method: :post, path: "/v1/oauth_providers/#{enc(provider)}/test")
+      end
+    end
+  end
+end

data/lib/atlas/resources/organizations.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/organizations+ — orgs plus their memberships, invitations, domains,
+    # hierarchy, policy, entitlements, and directory-group role grants.
+    class Organizations < Base
+      def list(params = {})
+        request(method: :get, path: "/v1/organizations", query: params)
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/organizations/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/organizations", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/organizations/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/organizations/#{enc(id)}")
+      end
+
+      # +PUT /v1/organizations/:id/metadata+ — replaces the named bags wholesale.
+      def update_metadata(id, body)
+        request(method: :put, path: "/v1/organizations/#{enc(id)}/metadata", body: body)
+      end
+
+      # +PATCH /v1/organizations/:id/policy+.
+      def update_policy(id, body)
+        request(method: :patch, path: "/v1/organizations/#{enc(id)}/policy", body: body)
+      end
+
+      # +PUT /v1/organizations/:id/parent+ — set (or clear, with nil) the parent.
+      def set_parent(id, body)
+        request(method: :put, path: "/v1/organizations/#{enc(id)}/parent", body: body)
+      end
+
+      # +GET /v1/organizations/:id/hierarchy+ — ancestor chain + direct children.
+      def hierarchy(id)
+        request(method: :get, path: "/v1/organizations/#{enc(id)}/hierarchy")
+      end
+
+      # +GET /v1/organizations/:id/entitlements+ — the org's active feature set.
+      def entitlements(id)
+        request(method: :get, path: "/v1/organizations/#{enc(id)}/entitlements")
+      end
+
+      # +organizations.memberships+ — members of an org.
+      def memberships
+        @memberships ||= Memberships.new(@transport)
+      end
+
+      # +organizations.invitations+ — pending org invitations.
+      def invitations
+        @invitations ||= Invitations.new(@transport)
+      end
+
+      # +organizations.domains+ — verified email domains for an org.
+      def domains
+        @domains ||= Domains.new(@transport)
+      end
+
+      # +organizations.group_roles+ — directory-group → role grants.
+      def group_roles
+        @group_roles ||= GroupRoles.new(@transport)
+      end
+
+      # Nested: memberships.
+      class Memberships < Base
+        def list(org_id)
+          request(method: :get, path: "/v1/organizations/#{enc(org_id)}/memberships")
+        end
+
+        def add(org_id, body, idempotency_key: nil)
+          request(method: :post, path: "/v1/organizations/#{enc(org_id)}/memberships", body: body, idempotency_key: idempotency_key)
+        end
+
+        def update(org_id, user_id, body)
+          request(method: :patch, path: "/v1/organizations/#{enc(org_id)}/memberships/#{enc(user_id)}", body: body)
+        end
+
+        def remove(org_id, user_id)
+          request(method: :delete, path: "/v1/organizations/#{enc(org_id)}/memberships/#{enc(user_id)}")
+        end
+      end
+
+      # Nested: invitations.
+      class Invitations < Base
+        def list(org_id)
+          request(method: :get, path: "/v1/organizations/#{enc(org_id)}/invitations")
+        end
+
+        def create(org_id, body, idempotency_key: nil)
+          request(method: :post, path: "/v1/organizations/#{enc(org_id)}/invitations", body: body, idempotency_key: idempotency_key)
+        end
+
+        def revoke(org_id, invitation_id)
+          request(method: :post, path: "/v1/organizations/#{enc(org_id)}/invitations/#{enc(invitation_id)}/revoke")
+        end
+      end
+
+      # Nested: domains.
+      class Domains < Base
+        def list(org_id)
+          request(method: :get, path: "/v1/organizations/#{enc(org_id)}/domains")
+        end
+
+        def create(org_id, body, idempotency_key: nil)
+          request(method: :post, path: "/v1/organizations/#{enc(org_id)}/domains", body: body, idempotency_key: idempotency_key)
+        end
+
+        def verify(org_id, domain_id)
+          request(method: :post, path: "/v1/organizations/#{enc(org_id)}/domains/#{enc(domain_id)}/verify")
+        end
+
+        def delete(org_id, domain_id)
+          request(method: :delete, path: "/v1/organizations/#{enc(org_id)}/domains/#{enc(domain_id)}")
+        end
+      end
+
+      # Nested: directory-group role grants.
+      class GroupRoles < Base
+        def grant(org_id, group_id, role_id)
+          request(method: :put, path: "/v1/organizations/#{enc(org_id)}/groups/#{enc(group_id)}/roles/#{enc(role_id)}")
+        end
+
+        def revoke(org_id, group_id, role_id)
+          request(method: :delete, path: "/v1/organizations/#{enc(org_id)}/groups/#{enc(group_id)}/roles/#{enc(role_id)}")
+        end
+      end
+    end
+  end
+end

data/lib/atlas/resources/radius_clients.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/radius_clients+ — RADIUS NAS clients allowed to authenticate users.
+    class RadiusClients < Base
+      def list
+        request(method: :get, path: "/v1/radius_clients")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/radius_clients", body: body, idempotency_key: idempotency_key)
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/radius_clients/#{enc(id)}")
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/radius_clients/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/radius_clients/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/rate_limit.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/rate_limit_policy+ — the two tunable budgets over the built-in limiter.
+    class RateLimitPolicy < Base
+      def get
+        request(method: :get, path: "/v1/rate_limit_policy")
+      end
+
+      def update(body)
+        request(method: :patch, path: "/v1/rate_limit_policy", body: body)
+      end
+    end
+  end
+end

data/lib/atlas/resources/resource_servers.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/resource_servers+ — API audiences and the scopes they define.
+    class ResourceServers < Base
+      def list
+        request(method: :get, path: "/v1/resource_servers")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/resource_servers/#{enc(id)}")
+      end
+
+      def create(body)
+        request(method: :post, path: "/v1/resource_servers", body: body)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/resource_servers/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/resource_servers/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/restrictions.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # Allowlist and blocklist share an identical route shape, so they share a
+    # class; only the base path differs. Exposed on the client as
+    # +client.allowlist+ and +client.blocklist+.
+    class Restriction < Base
+      def initialize(transport, path)
+        super(transport)
+        @path = path
+      end
+
+      def list
+        request(method: :get, path: @path)
+      end
+
+      def add(identifier)
+        request(method: :post, path: @path, body: { identifier: identifier })
+      end
+
+      def remove(id)
+        request(method: :delete, path: "#{@path}/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/risk_based_mfa.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/risk_based_mfa+ — the adaptive / risk-based MFA engine config.
+    class RiskBasedMfa < Base
+      def get
+        request(method: :get, path: "/v1/risk_based_mfa")
+      end
+
+      def update(body)
+        request(method: :patch, path: "/v1/risk_based_mfa", body: body)
+      end
+    end
+  end
+end

data/lib/atlas/resources/roles.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/roles+ — instance roles and their permission sets.
+    class Roles < Base
+      def list
+        request(method: :get, path: "/v1/roles")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/roles", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/roles/#{enc(id)}", body: body)
+      end
+
+      # Replace a role's permission set wholesale.
+      def set_permissions(id, permissions)
+        request(method: :put, path: "/v1/roles/#{enc(id)}/permissions", body: { permissions: permissions })
+      end
+
+      # Delete a role. Pass +reassign_to:+ to move every member onto another role
+      # first (atomic, before the delete) so an in-use role can be retired.
+      def delete(id, reassign_to: nil)
+        query = reassign_to ? { reassign_to: reassign_to } : nil
+        request(method: :delete, path: "/v1/roles/#{enc(id)}", query: query)
+      end
+    end
+
+    # +/v1/permissions+ — instance permissions.
+    class Permissions < Base
+      def list
+        request(method: :get, path: "/v1/permissions")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/permissions", body: body, idempotency_key: idempotency_key)
+      end
+
+      # Relabel a custom permission (name/description only — the key is immutable).
+      def update(id, body)
+        request(method: :patch, path: "/v1/permissions/#{enc(id)}", body: body)
+      end
+
+      # Delete a custom permission. Fails with +role_in_use+ if a role grants it.
+      def delete(id)
+        request(method: :delete, path: "/v1/permissions/#{enc(id)}")
+      end
+    end
+  end
+end

data/lib/atlas/resources/scim_provisioning.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/scim_provisioning_targets+ — OUTBOUND SCIM provisioning targets Atlas
+    # pushes users/groups to.
+    class ScimProvisioning < Base
+      def list
+        request(method: :get, path: "/v1/scim_provisioning_targets")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/scim_provisioning_targets/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/scim_provisioning_targets", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/scim_provisioning_targets/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/scim_provisioning_targets/#{enc(id)}")
+      end
+
+      # Probe connectivity + auth to the downstream with the real bearer.
+      def test(id)
+        request(method: :post, path: "/v1/scim_provisioning_targets/#{enc(id)}/test")
+      end
+
+      # Force one user's sync now (backfill / re-push).
+      def sync_user(id, user_id)
+        request(method: :post, path: "/v1/scim_provisioning_targets/#{enc(id)}/sync_user", body: { user_id: user_id })
+      end
+
+      # Force one org's (group) sync now.
+      def sync_group(id, organization_id)
+        request(method: :post, path: "/v1/scim_provisioning_targets/#{enc(id)}/sync_group", body: { organization_id: organization_id })
+      end
+    end
+  end
+end

data/lib/atlas/resources/scim_tokens.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/scim_tokens+ — inbound SCIM bearer tokens for directory sync.
+    class ScimTokens < Base
+      def list
+        request(method: :get, path: "/v1/scim_tokens")
+      end
+
+      # Create reveals the usable secret exactly once.
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/scim_tokens", body: body, idempotency_key: idempotency_key)
+      end
+
+      def revoke(id)
+        request(method: :post, path: "/v1/scim_tokens/#{enc(id)}/revoke")
+      end
+    end
+  end
+end

data/lib/atlas/resources/sessions.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/sessions+ — mint, list, inspect, and revoke sessions.
+    class Sessions < Base
+      # +POST /v1/sessions+ — mint a session for a user without the sign-in flow.
+      # Returns the bearer jwt + refresh token in-body. Refused for a banned user.
+      def create(params)
+        request(method: :post, path: "/v1/sessions", body: params)
+      end
+
+      # +GET /v1/sessions?user_id=+ — requires a +user_id+.
+      def list(params)
+        request(method: :get, path: "/v1/sessions", query: params)
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/sessions/#{enc(id)}")
+      end
+
+      def revoke(id)
+        request(method: :post, path: "/v1/sessions/#{enc(id)}/revoke")
+      end
+    end
+  end
+end

data/lib/atlas/resources/sign_in_tokens.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/sign_in_tokens+ — one-time sign-in tokens for a user.
+    #
+    # @deprecated POST /v1/sign_in_tokens is deprecated (Sunset 2026-04-01). Use
+    #   Sessions#create (POST /v1/sessions), which mints a real redeemable session.
+    class SignInTokens < Base
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/sign_in_tokens", body: body, idempotency_key: idempotency_key)
+      end
+    end
+  end
+end

data/lib/atlas/resources/sms_templates.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/sms_templates+ — transactional SMS templates, keyed by name.
+    class SmsTemplates < Base
+      def list
+        request(method: :get, path: "/v1/sms_templates")
+      end
+
+      # Upsert an override by name.
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/sms_templates", body: body, idempotency_key: idempotency_key)
+      end
+
+      def get(name)
+        request(method: :get, path: "/v1/sms_templates/#{enc(name)}")
+      end
+
+      def update(name, body)
+        request(method: :patch, path: "/v1/sms_templates/#{enc(name)}", body: body)
+      end
+
+      # Revert to the built-in.
+      def delete(name)
+        request(method: :delete, path: "/v1/sms_templates/#{enc(name)}")
+      end
+
+      # Render an unsaved draft (if a body is given) or the stored/built-in.
+      def preview(name, body = {})
+        request(method: :post, path: "/v1/sms_templates/#{enc(name)}/preview", body: body)
+      end
+    end
+  end
+end

data/lib/atlas/resources/sso_connections.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/sso_connections+ — enterprise SSO connections (OIDC, SAML, Discourse).
+    class SsoConnections < Base
+      def list
+        request(method: :get, path: "/v1/sso_connections")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/sso_connections/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/sso_connections", body: body, idempotency_key: idempotency_key)
+      end
+
+      def update(id, body)
+        request(method: :patch, path: "/v1/sso_connections/#{enc(id)}", body: body)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/sso_connections/#{enc(id)}")
+      end
+
+      # SP SAML metadata for a connection (JSON envelope carrying the XML).
+      def saml_metadata(id)
+        request(method: :get, path: "/v1/sso_connections/#{enc(id)}/saml_metadata")
+      end
+    end
+  end
+end

data/lib/atlas/resources/sso_onboarding.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/sso_onboarding_profiles+ — self-service SSO onboarding profiles and
+    # the one-time tickets they issue.
+    class SsoOnboarding < Base
+      def list
+        request(method: :get, path: "/v1/sso_onboarding_profiles")
+      end
+
+      def get(id)
+        request(method: :get, path: "/v1/sso_onboarding_profiles/#{enc(id)}")
+      end
+
+      def create(body, idempotency_key: nil)
+        request(method: :post, path: "/v1/sso_onboarding_profiles", body: body, idempotency_key: idempotency_key)
+      end
+
+      def delete(id)
+        request(method: :delete, path: "/v1/sso_onboarding_profiles/#{enc(id)}")
+      end
+
+      # Issue a one-time ticket for a profile. The token is returned once, here.
+      def create_ticket(profile_id, body = {}, idempotency_key: nil)
+        request(method: :post, path: "/v1/sso_onboarding_profiles/#{enc(profile_id)}/tickets", body: body, idempotency_key: idempotency_key)
+      end
+
+      # Kill a still-live ticket. 404 once used, expired, or already revoked.
+      def revoke_ticket(ticket_id)
+        request(method: :post, path: "/v1/sso_onboarding_tickets/#{enc(ticket_id)}/revoke")
+      end
+    end
+  end
+end

data/lib/atlas/resources/tokens.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Atlas
+  module Resources
+    # +/v1/tokens+ — authoritative online session-token verification (checks the
+    # revocation set). The slow path; prefer local {Atlas::Backend#verify}.
+    class Tokens < Base
+      def verify(body)
+        request(method: :post, path: "/v1/tokens/verify", body: body)
+      end
+    end
+  end
+end