@1password/sdk 0.4.0 → 0.5.0-beta.1

package/README.md

@@ -135,9 +135,16 @@ Field types:
 ### Authentication
 
 - [x] [1Password Service Accounts](https://developer.1password.com/docs/service-accounts/get-started/)
+- [x] [Workload identity](#workload-identity-beta) (beta)
 - [ ] User authentication
 - [ ] 1Password Connect. For now, use [1Password/connect-sdk-js](https://github.com/1Password/connect-sdk-js).
 
+### Workload identity (beta)
+
+> **Private beta.** Currently available for GitHub Actions via 1Password Credential Broker.
+
+Instead of a service account token, you can authenticate a workload by providing an OIDC token fetcher and your workload details. The SDK calls your `oidcFetcher` to obtain a token when it needs one.
+
 ## 📖 Learn more
 
 - [Load secrets with 1Password SDKs](https://developer.1password.com/docs/sdks/load-secrets)

package/dist/client.d.ts

@@ -2,11 +2,13 @@ import { InnerClient } from "./core.js";
 import { SecretsApi } from "./secrets.js";
 import { ItemsApi } from "./items.js";
 import { VaultsApi } from "./vaults.js";
+import { EnvironmentsApi } from "./environments.js";
 import { GroupsApi } from "./groups.js";
 export declare class Client {
     secrets: SecretsApi;
     items: ItemsApi;
     vaults: VaultsApi;
+    environments: EnvironmentsApi;
     groups: GroupsApi;
     constructor(innerClient: InnerClient);
 }

package/dist/client.js

@@ -5,12 +5,14 @@ exports.Client = void 0;
 const secrets_js_1 = require("./secrets.js");
 const items_js_1 = require("./items.js");
 const vaults_js_1 = require("./vaults.js");
+const environments_js_1 = require("./environments.js");
 const groups_js_1 = require("./groups.js");
 class Client {
     constructor(innerClient) {
         this.secrets = new secrets_js_1.Secrets(innerClient);
         this.items = new items_js_1.Items(innerClient);
         this.vaults = new vaults_js_1.Vaults(innerClient);
+        this.environments = new environments_js_1.Environments(innerClient);
         this.groups = new groups_js_1.Groups(innerClient);
     }
 }

package/dist/client_builder.js

@@ -22,11 +22,19 @@ const finalizationRegistry = new FinalizationRegistry((heldClient) => {
  * @returns The authenticated 1Password SDK client.
  */
 const createClientWithCore = (config, core) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!config.auth && !config.oidcFetcher) {
+        throw new Error("createClient requires either `auth` (service account token) or `oidcFetcher` (workload identity).");
+    }
+    if (config.oidcFetcher && !config.workloadDetails) {
+        throw new Error("`oidcFetcher` (workload identity) requires `workloadDetails` to be set.");
+    }
     const authConfig = (0, configuration_js_1.clientAuthConfig)(config);
     if (authConfig.accountName) {
         core.setInner(new shared_lib_core_js_1.SharedLibCore(authConfig.accountName));
     }
-    const clientId = yield core.initClient(authConfig);
+    const clientId = config.oidcFetcher
+        ? yield core.initClientOidc(authConfig, config.oidcFetcher)
+        : yield core.initClient(authConfig);
     const inner = new core_js_1.InnerClient(parseInt(clientId, 10), core, authConfig);
     const client = new client_js_1.Client(inner);
     // Cleans up associated memory from core when client instance goes out of scope.

package/dist/configuration.d.ts

@@ -1,10 +1,12 @@
-import { ClientAuthConfig } from "./core.js";
+import { ClientAuthConfig, WorkloadDetails } from "./core.js";
 export declare const LANGUAGE = "JS";
-export declare const VERSION = "0040003";
+export declare const VERSION = "0050001";
 export interface ClientConfiguration {
-    auth: Auth;
+    auth?: Auth;
     integrationName: string;
     integrationVersion: string;
+    oidcFetcher?: (audience: string) => Promise<string>;
+    workloadDetails?: WorkloadDetails;
 }
 type Auth = string | DesktopAuth;
 /**

package/dist/configuration.js

@@ -44,6 +44,7 @@ const clientAuthConfig = (userConfig) => {
         os: (0, exports.getOsName)(),
         osVersion: defaultOsVersion,
         architecture: os_1.default.arch(),
+        workloadDetails: userConfig.workloadDetails,
     };
 };
 exports.clientAuthConfig = clientAuthConfig;

package/dist/core.d.ts

@@ -6,6 +6,10 @@ export interface Core {
      *  Allocates a new authenticated client and returns its id.
      */
     initClient(config: string): Promise<string>;
+    /**
+     *  Allocates a new authenticated client using an OIDC token fetcher and returns its id.
+     */
+    initClientOidc(config: string, fetcher: (audience: string) => Promise<string>): Promise<string>;
     /**
      *  Calls async business logic from a given client and returns the result.
      */
@@ -30,6 +34,14 @@ export interface ClientAuthConfig {
     architecture: string;
     serviceAccountToken?: string;
     accountName?: string;
+    workloadDetails?: WorkloadDetails;
+}
+/**
+ *  Contains workload authentication details for OIDC-based workload identity.
+ */
+export interface WorkloadDetails {
+    customerManagedSecret: string;
+    workloadUuid: string;
 }
 /**
  *  Contains the information sent to the SDK core when you call (invoke) a function.
@@ -64,6 +76,7 @@ export interface Parameters {
 }
 export declare class WasmCore implements Core {
     initClient(config: string): Promise<string>;
+    initClientOidc(config: string, fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(config: string): Promise<string>;
     releaseClient(clientId: string): void;
 }
@@ -75,6 +88,7 @@ export declare class SharedCore {
     constructor();
     setInner(core: Core): void;
     initClient(config: ClientAuthConfig): Promise<string>;
+    initClientOidc(config: ClientAuthConfig, fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(config: InvokeConfig): Promise<string>;
     invoke_sync(config: InvokeConfig): string;
     releaseClient(clientId: number): void;

package/dist/core.js

@@ -28,6 +28,16 @@ class WasmCore {
             }
         });
     }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield (0, sdk_core_1.init_client_oidc)(config, fetcher);
+            }
+            catch (e) {
+                (0, errors_1.throwError)(e);
+            }
+        });
+    }
     invoke(config) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -64,6 +74,12 @@ class SharedCore {
             return this.inner.initClient(serializedConfig);
         });
     }
+    initClientOidc(config, fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serializedConfig = JSON.stringify(config);
+            return this.inner.initClientOidc(serializedConfig, fetcher);
+        });
+    }
     invoke(config) {
         return __awaiter(this, void 0, void 0, function* () {
             const serializedConfig = JSON.stringify(config, types_1.ReplacerFunc);

package/dist/environments.d.ts

@@ -0,0 +1,19 @@
+import { InnerClient } from "./core.js";
+import { GetVariablesResponse } from "./types.js";
+/**
+ * The Environments API holds all the operations the SDK client can perform on 1Password Environments.
+ */
+export interface EnvironmentsApi {
+    /**
+     * Get environment variables belonging to an Environment.
+     */
+    getVariables(environmentId: string): Promise<GetVariablesResponse>;
+}
+export declare class Environments implements EnvironmentsApi {
+    #private;
+    constructor(inner: InnerClient);
+    /**
+     * Get environment variables belonging to an Environment.
+     */
+    getVariables(environmentId: string): Promise<GetVariablesResponse>;
+}

package/dist/environments.js

@@ -0,0 +1,53 @@
+"use strict";
+// Code generated by op-codegen - DO NOT EDIT MANUALLY
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _Environments_inner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Environments = void 0;
+const types_js_1 = require("./types.js");
+class Environments {
+    constructor(inner) {
+        _Environments_inner.set(this, void 0);
+        __classPrivateFieldSet(this, _Environments_inner, inner, "f");
+    }
+    /**
+     * Get environment variables belonging to an Environment.
+     */
+    getVariables(environmentId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const invocationConfig = {
+                invocation: {
+                    clientId: __classPrivateFieldGet(this, _Environments_inner, "f").id,
+                    parameters: {
+                        name: "EnvironmentsGetVariables",
+                        parameters: {
+                            environment_id: environmentId,
+                        },
+                    },
+                },
+            };
+            return JSON.parse(yield __classPrivateFieldGet(this, _Environments_inner, "f").invoke(invocationConfig), types_js_1.ReviverFunc);
+        });
+    }
+}
+exports.Environments = Environments;
+_Environments_inner = new WeakMap();

package/dist/shared_lib_core.d.ts

@@ -11,6 +11,7 @@ export declare class SharedLibCore implements Core {
      */
     private callSharedLibrary;
     initClient(config: string): Promise<string>;
+    initClientOidc(config: string, _fetcher: (audience: string) => Promise<string>): Promise<string>;
     invoke(invokeConfigBytes: string): Promise<string>;
     releaseClient(clientId: string): void;
 }

package/dist/shared_lib_core.js

@@ -163,6 +163,12 @@ class SharedLibCore {
             return this.callSharedLibrary(config, "init_client");
         });
     }
+    // eslint-disable-next-line @typescript-eslint/require-await
+    initClientOidc(config, _fetcher) {
+        return __awaiter(this, void 0, void 0, function* () {
+            throw new Error("OIDC authentication is not supported with desktop auth");
+        });
+    }
     invoke(invokeConfigBytes) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.callSharedLibrary(invokeConfigBytes, "invoke");

package/dist/types.d.ts

@@ -18,6 +18,15 @@ export interface DocumentCreateParams {
     /** The content of the file */
     content: Uint8Array;
 }
+/** Represents an environment variable (name:value pair) and its masked state */
+export interface EnvironmentVariable {
+    /** An environment variable's name */
+    name: string;
+    /** An environment variable's value */
+    value: string;
+    /** An environment variable's masked state */
+    masked: boolean;
+}
 export interface FileAttributes {
     /** The name of the file */
     name: string;
@@ -44,6 +53,11 @@ export interface GeneratePasswordResponse {
     /** The generated password. */
     password: string;
 }
+/** Response containing the full set of environment variables from an Environment. */
+export interface GetVariablesResponse {
+    /** List of environment variables. */
+    variables: EnvironmentVariable[];
+}
 export declare enum GroupType {
     /**
      * The owners group, which gives the following permissions:
@@ -93,7 +107,8 @@ export declare enum GroupState {
 }
 export declare enum VaultAccessorType {
     User = "user",
-    Group = "group"
+    Group = "group",
+    Broker = "broker"
 }
 /** Represents the vault access information. */
 export interface VaultAccess {
@@ -605,7 +620,7 @@ export interface Vault {
     activeItemCount: number;
     /** The content version number of the vault. It gets incremented whenever the state of the vault's contents changes (e.g. items from within the vault get created or updated). */
     contentVersion: number;
-    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its title or icon. */
+    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its name or icon. */
     attributeVersion: number;
     /** The access information associated with the vault. */
     access?: VaultAccess[];
@@ -637,7 +652,7 @@ export interface VaultOverview {
     activeItemCount: number;
     /** The content version number of the vault. It gets incremented whenever the state of the vault's contents changes (e.g. items from within the vault get created or updated). */
     contentVersion: number;
-    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its title or icon. */
+    /** The attribute version number of the vault. It gets incremented whenever vault presentation information changes, such as its name or icon. */
     attributeVersion: number;
     /** The time the vault was created at */
     createdAt: Date;

package/dist/types.js

@@ -57,6 +57,7 @@ var VaultAccessorType;
 (function (VaultAccessorType) {
     VaultAccessorType["User"] = "user";
     VaultAccessorType["Group"] = "group";
+    VaultAccessorType["Broker"] = "broker";
 })(VaultAccessorType || (exports.VaultAccessorType = VaultAccessorType = {}));
 var ItemCategory;
 (function (ItemCategory) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const SDK_VERSION = "0.4.0";
-export declare const SDK_BUILD_NUMBER = "0040003";
+export declare const SDK_VERSION = "0.5.0-beta.1";
+export declare const SDK_BUILD_NUMBER = "0050001";

package/dist/version.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_BUILD_NUMBER = exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = "0.4.0";
-exports.SDK_BUILD_NUMBER = "0040003";
-const SDK_CORE_VERSION = "0.4.0";
+exports.SDK_VERSION = "0.5.0-beta.1";
+exports.SDK_BUILD_NUMBER = "0050001";
+const SDK_CORE_VERSION = "0.5.0-beta.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1password/sdk",
-  "version": "0.4.0",
+  "version": "0.5.0-beta.1",
   "description": "The 1Password JavaScript SDK offers programmatic read access to your secrets in 1Password in an interface native to JavaScript. The SDK currently supports `Node.JS`",
   "scripts": {
     "build": "tsc",
@@ -26,7 +26,7 @@
   "main": "./dist/sdk.js",
   "types": "./dist/sdk.d.ts",
   "dependencies": {
-    "@1password/sdk-core": "0.4.0"
+    "@1password/sdk-core": "0.5.0-beta.1"
   },
   "devDependencies": {
     "@1password/eslint-config": "^4.0.0",