@alchemy.run/daytona 0.0.0-stage → 2.0.0-beta.86

package/src/OrganizationInvitation.ts

@@ -0,0 +1,174 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import { declarable } from "./internal/Declared.ts";
+import {
+  currentOrganizationId,
+  movesOrganization,
+  organizationIdFor,
+  type OrganizationRef,
+} from "./internal/Organization.ts";
+import { resolved, type Ref } from "./internal/Ref.ts";
+import type { Providers } from "./Providers.ts";
+
+/** A role, by id. Accepts a `Daytona.OrganizationRole` or `{ roleId }`. */
+export type RoleRef = { readonly roleId: string };
+
+/** `owner` manages the organization; `member` gets only the assigned roles. */
+export type MemberRole = "owner" | "member";
+
+export interface OrganizationInvitationProps {
+  /**
+   * Organization to act on, e.g. a `Daytona.Organization`. Defaults to the
+   * credentials' organization. Changing it replaces the resource.
+   */
+  organization?: Ref<OrganizationRef>;
+  /** Email to invite. Changing it replaces the invitation. */
+  email: string;
+  /** Base role. @default "member" */
+  role?: MemberRole;
+  /** Custom roles to assign. Updated in place. */
+  roles?: Ref<RoleRef>[];
+  /** When the invitation expires, as an ISO 8601 timestamp. */
+  expiresAt?: string;
+}
+
+export interface OrganizationInvitationAttributes {
+  /** Invitation ID. */
+  invitationId: string;
+  /** Organization ID. */
+  organizationId: string;
+  /** Invited email. */
+  email: string;
+  /** `pending`, `accepted`, `declined`, `cancelled`. */
+  status: string;
+  /** When it expires. */
+  expiresAt: string;
+}
+
+export type OrganizationInvitation = Resource<
+  "Daytona.OrganizationInvitation",
+  OrganizationInvitationProps,
+  OrganizationInvitationAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * Invite someone to the Daytona organization by email, with a base role
+ * and custom {@link OrganizationRole}s. Destroying it cancels the
+ * invitation if it hasn't been accepted; an accepted invitation leaves the
+ * member in place.
+ *
+ * ### Inviting a Developer
+ * **Example:** A member with a custom role
+ * ```typescript
+ * export const Alice = Daytona.OrganizationInvitation("Alice", {
+ *   email: "alice@example.com",
+ *   roles: [Developer],
+ * });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const OrganizationInvitation = declarable<OrganizationInvitation>()(
+  Resource<OrganizationInvitation>("Daytona.OrganizationInvitation"),
+);
+
+const resolveRoles = (roles: OrganizationInvitationProps["roles"]) =>
+  Effect.succeed((roles ?? []).map((r) => resolved(r).roleId));
+
+const toAttributes = (
+  i: organizations.OrganizationInvitation,
+): OrganizationInvitationAttributes => ({
+  invitationId: i.id,
+  organizationId: i.organizationId,
+  email: i.email,
+  status: i.status,
+  expiresAt: i.expiresAt,
+});
+
+export const OrganizationInvitationProvider = () =>
+  Provider.effect(
+    OrganizationInvitation,
+    Effect.succeed({
+      stables: ["invitationId", "organizationId"],
+      list: Effect.fn(function* () {
+        const organizationId = yield* currentOrganizationId;
+        return (yield* organizations.listOrganizationInvitations({ organizationId })).map(
+          toAttributes,
+        );
+      }),
+      diff: Effect.fn(function* ({ news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        if (yield* movesOrganization(news.organization, output))
+          return { action: "replace" } as const;
+        if (news.email !== output.email) return { action: "replace" } as const;
+      }),
+      read: Effect.fn(function* ({ output }) {
+        if (output === undefined) return undefined;
+        const all = yield* organizations.listOrganizationInvitations({
+          organizationId: output.organizationId,
+        });
+        const found = all.find((i) => i.id === output.invitationId);
+        return found ? toAttributes(found) : undefined;
+      }),
+      reconcile: Effect.fn(function* ({ news, output }) {
+        const organizationId = yield* organizationIdFor(news.organization);
+        const assignedRoleIds = yield* resolveRoles(news.roles);
+        const role = news.role ?? "member";
+        // Observe the pending invitation for this email.
+        const all = yield* organizations.listOrganizationInvitations({ organizationId });
+        const current =
+          all.find((i) => i.id === output?.invitationId) ??
+          all.find((i) => i.email === news.email && i.status === "pending");
+        // Ensure
+        if (current === undefined || current.status !== "pending") {
+          if (current?.status === "accepted") return toAttributes(current);
+          return toAttributes(
+            yield* organizations.createOrganizationInvitation({
+              organizationId,
+              email: news.email,
+              role,
+              assignedRoleIds,
+              expiresAt: news.expiresAt,
+            }),
+          );
+        }
+        // Sync
+        const observedRoles = current.assignedRoles.map((r) => r.id).sort();
+        if (
+          current.role === role &&
+          deepEqual(observedRoles, [...assignedRoleIds].sort()) &&
+          (news.expiresAt === undefined || news.expiresAt === current.expiresAt)
+        ) {
+          return toAttributes(current);
+        }
+        return toAttributes(
+          yield* organizations.updateOrganizationInvitation({
+            organizationId,
+            invitationId: current.id,
+            role,
+            assignedRoleIds,
+            expiresAt: news.expiresAt,
+          }),
+        );
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        const all = yield* organizations.listOrganizationInvitations({
+          organizationId: output.organizationId,
+        });
+        const found = all.find((i) => i.id === output.invitationId);
+        if (found?.status !== "pending") return;
+        yield* organizations
+          .cancelOrganizationInvitation({
+            organizationId: output.organizationId,
+            invitationId: output.invitationId,
+          })
+          .pipe(Effect.catchTag("OrganizationInvitationNotFound", () => Effect.void));
+      }),
+    }),
+  );

package/src/OrganizationMember.ts

@@ -0,0 +1,174 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { declarable } from "./internal/Declared.ts";
+import {
+  movesOrganization,
+  organizationIdFor,
+  type OrganizationRef,
+} from "./internal/Organization.ts";
+import { resolved, type Ref } from "./internal/Ref.ts";
+import type { MemberRole, RoleRef } from "./OrganizationInvitation.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface OrganizationMemberProps {
+  /**
+   * Organization to act on, e.g. a `Daytona.Organization`. Defaults to the
+   * credentials' organization. Changing it replaces the resource.
+   */
+  organization?: Ref<OrganizationRef>;
+  /** The member, by user ID or email. Changing it replaces the resource. */
+  user: string;
+  /** Base role. */
+  role: MemberRole;
+  /** Custom roles. Updated in place. */
+  roles?: Ref<RoleRef>[];
+  /**
+   * Remove the member from the organization on destroy. By default destroy
+   * only puts back the access the member had before alchemy changed it.
+   * @default false
+   */
+  removeOnDestroy?: boolean;
+}
+
+export interface OrganizationMemberAttributes {
+  /** Organization ID. */
+  organizationId: string;
+  /** User ID. */
+  userId: string;
+  /** Email. */
+  email: string;
+  /** Base role. */
+  role: string;
+  /** Assigned custom role IDs. */
+  roleIds: string[];
+  /** Access before alchemy first changed it; restored on destroy. */
+  original: { role: string; roleIds: string[] };
+  /** Whether destroy removes the member. */
+  removeOnDestroy: boolean;
+}
+
+export type OrganizationMember = Resource<
+  "Daytona.OrganizationMember",
+  OrganizationMemberProps,
+  OrganizationMemberAttributes,
+  never,
+  Providers
+>;
+
+/** No member of the organization has that user ID or email. */
+export class MemberNotInOrganization extends Data.TaggedError("Daytona.MemberNotInOrganization")<{
+  readonly user: string;
+}> {
+  override get message() {
+    return `${this.user} is not a member of the Daytona organization; invite them with Daytona.OrganizationInvitation`;
+  }
+}
+
+/**
+ * The access of an existing member of the Daytona organization: their
+ * base role and custom {@link OrganizationRole}s. Use it to manage who can
+ * do what as code. To add someone, use {@link OrganizationInvitation}.
+ *
+ * ### Granting a Role
+ * **Example:** Make a member a developer
+ * ```typescript
+ * export const Bob = Daytona.OrganizationMember("Bob", {
+ *   user: "bob@example.com",
+ *   role: "member",
+ *   roles: [Developer],
+ * });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const OrganizationMember = declarable<OrganizationMember>()(
+  Resource<OrganizationMember>("Daytona.OrganizationMember"),
+);
+
+const findMember = Effect.fn(function* (organizationId: string, user: string) {
+  const members = yield* organizations.listOrganizationMembers({ organizationId });
+  return members.find((m) => m.userId === user || m.email === user);
+});
+
+const toAttributes = (
+  m: organizations.OrganizationUser,
+  original: OrganizationMemberAttributes["original"],
+  removeOnDestroy: boolean,
+): OrganizationMemberAttributes => ({
+  organizationId: m.organizationId,
+  userId: m.userId,
+  email: m.email,
+  role: m.role,
+  roleIds: m.assignedRoles.map((r) => r.id).sort(),
+  original,
+  removeOnDestroy,
+});
+
+export const OrganizationMemberProvider = () =>
+  Provider.effect(
+    OrganizationMember,
+    Effect.succeed({
+      stables: ["organizationId", "userId", "original"],
+      nuke: { skip: true },
+      list: () => Effect.succeed([]),
+      diff: Effect.fn(function* ({ news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        if (yield* movesOrganization(news.organization, output))
+          return { action: "replace" } as const;
+        if (news.user !== output.userId && news.user !== output.email)
+          return { action: "replace" } as const;
+      }),
+      read: Effect.fn(function* ({ output }) {
+        if (output === undefined) return undefined;
+        const found = yield* findMember(output.organizationId, output.userId);
+        return found ? toAttributes(found, output.original, output.removeOnDestroy) : undefined;
+      }),
+      reconcile: Effect.fn(function* ({ news, output }) {
+        const organizationId = yield* organizationIdFor(news.organization);
+        const member = yield* findMember(organizationId, output?.userId ?? news.user);
+        if (member === undefined) return yield* new MemberNotInOrganization({ user: news.user });
+        const original = output?.original ?? {
+          role: member.role,
+          roleIds: member.assignedRoles.map((r) => r.id).sort(),
+        };
+        const roleIds = (news.roles ?? []).map((r) => resolved(r).roleId).sort();
+        if (
+          member.role !== news.role ||
+          !deepEqual(member.assignedRoles.map((r) => r.id).sort(), roleIds)
+        ) {
+          yield* organizations.updateAccessForOrganizationMember({
+            organizationId,
+            userId: member.userId,
+            role: news.role,
+            assignedRoleIds: roleIds,
+          });
+        }
+        const updated = yield* findMember(organizationId, member.userId);
+        return toAttributes(updated ?? member, original, news.removeOnDestroy ?? false);
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        if (output.removeOnDestroy) {
+          yield* organizations
+            .deleteOrganizationMember({
+              organizationId: output.organizationId,
+              userId: output.userId,
+            })
+            .pipe(Effect.catchTag("OrganizationMemberNotFound", () => Effect.void));
+          return;
+        }
+        const member = yield* findMember(output.organizationId, output.userId);
+        if (member === undefined) return;
+        yield* organizations.updateAccessForOrganizationMember({
+          organizationId: output.organizationId,
+          userId: output.userId,
+          role: output.original.role,
+          assignedRoleIds: output.original.roleIds,
+        });
+      }),
+    }),
+  );

package/src/OrganizationOtelConfig.ts

@@ -0,0 +1,138 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { declarable } from "./internal/Declared.ts";
+import {
+  currentOrganizationId,
+  movesOrganization,
+  organizationIdFor,
+  type OrganizationRef,
+} from "./internal/Organization.ts";
+import type { Ref } from "./internal/Ref.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface OrganizationOtelConfigProps {
+  /**
+   * Organization to act on, e.g. a `Daytona.Organization`. Defaults to the
+   * credentials' organization. Changing it replaces the resource.
+   */
+  organization?: Ref<OrganizationRef>;
+  /** OTLP/HTTP endpoint sandboxes export telemetry to. */
+  endpoint: string;
+  /** Headers sent with every export, e.g. an API key. */
+  headers?: Record<string, string | Redacted.Redacted<string>>;
+}
+
+export interface OrganizationOtelConfigAttributes {
+  /** Organization ID. */
+  organizationId: string;
+  /** OTLP endpoint. */
+  endpoint: string;
+  /** Header names configured (values are not returned). */
+  headerNames: string[];
+}
+
+export type OrganizationOtelConfig = Resource<
+  "Daytona.OrganizationOtelConfig",
+  OrganizationOtelConfigProps,
+  OrganizationOtelConfigAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * Export the organization's sandbox telemetry (logs, traces, metrics) to
+ * your own OpenTelemetry backend. One per organization; destroying it
+ * stops the export.
+ *
+ * ### Exporting Telemetry
+ * **Example:** Send sandbox telemetry to Axiom
+ * ```typescript
+ * export const Telemetry = Daytona.OrganizationOtelConfig("Telemetry", {
+ *   endpoint: "https://api.axiom.co",
+ *   headers: {
+ *     Authorization: Config.Redacted("AXIOM_TOKEN"),
+ *     "X-Axiom-Dataset": "daytona",
+ *   },
+ * });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const OrganizationOtelConfig = declarable<OrganizationOtelConfig>()(
+  Resource<OrganizationOtelConfig>("Daytona.OrganizationOtelConfig"),
+);
+
+const plainHeaders = (headers: OrganizationOtelConfigProps["headers"]) =>
+  headers === undefined
+    ? undefined
+    : Object.fromEntries(
+        Object.entries(headers).map(([k, v]) => [
+          k,
+          Redacted.isRedacted(v) ? Redacted.value(v) : v,
+        ]),
+      );
+
+// Daytona stores the endpoint normalized (`https://host` -> `https://host/`).
+const sameEndpoint = (observed: string | undefined, desired: string) =>
+  observed !== undefined && URL.canParse(observed) && URL.canParse(desired)
+    ? new URL(observed).href === new URL(desired).href
+    : observed === desired;
+
+// getOrganizationOtelConfig is for Daytona's runners and proxy (users get
+// 401); the organization itself carries the config.
+const observeOtelConfig = (organizationId: string) =>
+  Effect.map(organizations.getOrganization({ organizationId }), (o) => o.otelConfig);
+
+export const OrganizationOtelConfigProvider = () =>
+  Provider.effect(
+    OrganizationOtelConfig,
+    Effect.succeed({
+      stables: ["organizationId"],
+      nuke: { singleton: true },
+      list: () => Effect.succeed([]),
+      diff: Effect.fn(function* ({ news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        if (yield* movesOrganization(news.organization, output))
+          return { action: "replace" } as const;
+      }),
+      read: Effect.fn(function* ({ output }) {
+        const organizationId = output?.organizationId ?? (yield* currentOrganizationId);
+        const config = yield* observeOtelConfig(organizationId);
+        if (!config?.endpoint) return undefined;
+        return {
+          organizationId,
+          endpoint: config.endpoint,
+          headerNames: Object.keys(config.headers ?? {}),
+        };
+      }),
+      reconcile: Effect.fn(function* ({ news, olds }) {
+        const organizationId = yield* organizationIdFor(news.organization);
+        // Observe — header values aren't returned, so they are written
+        // whenever they changed since the last deploy (or on first deploy).
+        const current = yield* observeOtelConfig(organizationId);
+        const headers = plainHeaders(news.headers);
+        if (
+          !sameEndpoint(current?.endpoint, news.endpoint) ||
+          olds === undefined ||
+          !deepEqual(plainHeaders(olds.headers), headers)
+        ) {
+          yield* organizations.updateOrganizationOtelConfig({
+            organizationId,
+            endpoint: news.endpoint,
+            headers,
+          });
+        }
+        return { organizationId, endpoint: news.endpoint, headerNames: Object.keys(headers ?? {}) };
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        yield* organizations
+          .deleteOrganizationOtelConfig({ organizationId: output.organizationId })
+          .pipe(Effect.catchTag("OrganizationNotFound", () => Effect.void));
+      }),
+    }),
+  );

package/src/OrganizationRole.ts

@@ -0,0 +1,167 @@
+import * as organizations from "@distilled.cloud/daytona/organizations";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import type { Permission } from "./ApiKey.ts";
+import { declarable } from "./internal/Declared.ts";
+import { isOwnedName, resolveName } from "./internal/Names.ts";
+import {
+  currentOrganizationId,
+  movesOrganization,
+  organizationIdFor,
+  type OrganizationRef,
+} from "./internal/Organization.ts";
+import type { Ref } from "./internal/Ref.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface OrganizationRoleProps {
+  /**
+   * Organization to act on, e.g. a `Daytona.Organization`. Defaults to the
+   * credentials' organization. Changing it replaces the resource.
+   */
+  organization?: Ref<OrganizationRef>;
+  /**
+   * Role name. If omitted, a unique name is generated from the stack,
+   * stage and logical ID. Renames update in place.
+   */
+  name?: string;
+  /** What the role is for. */
+  description?: string;
+  /** Permissions members with this role get. Updated in place. */
+  permissions: Permission[];
+}
+
+export interface OrganizationRoleAttributes {
+  /** Role ID; what invitations and member access take. */
+  roleId: string;
+  /** Organization the role belongs to. */
+  organizationId: string;
+  /** Role name. */
+  name: string;
+  /** Description. */
+  description: string;
+  /** Permissions the role grants. */
+  permissions: Permission[];
+}
+
+export type OrganizationRole = Resource<
+  "Daytona.OrganizationRole",
+  OrganizationRoleProps,
+  OrganizationRoleAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A custom role in the Daytona organization: a named set of permissions to
+ * give members, through {@link OrganizationInvitation} or
+ * {@link OrganizationMember}.
+ * @see https://www.daytona.io/docs/en/organizations/
+ *
+ * ### Creating a Role
+ * **Example:** A role that can run sandboxes but not manage images
+ * ```typescript
+ * export const Developer = Daytona.OrganizationRole("Developer", {
+ *   description: "Run sandboxes",
+ *   permissions: ["write:sandboxes", "delete:sandboxes", "read:volumes"],
+ * });
+ * ```
+ *
+ * @resource
+ * @product Organization
+ */
+export const OrganizationRole = declarable<OrganizationRole>()(
+  Resource<OrganizationRole>("Daytona.OrganizationRole"),
+);
+
+const toAttributes = (
+  organizationId: string,
+  r: organizations.OrganizationRole,
+): OrganizationRoleAttributes => ({
+  roleId: r.id,
+  organizationId,
+  name: r.name,
+  description: r.description,
+  permissions: r.permissions,
+});
+
+const listRoles = (organizationId: string) =>
+  organizations.listOrganizationRoles({ organizationId });
+
+const sorted = (permissions: readonly string[]) => [...permissions].sort();
+
+export const OrganizationRoleProvider = () =>
+  Provider.effect(
+    OrganizationRole,
+    Effect.succeed({
+      stables: ["roleId", "organizationId"],
+      list: Effect.fn(function* () {
+        const organizationId = yield* currentOrganizationId;
+        const roles = yield* listRoles(organizationId);
+        return roles.filter((r) => !r.isGlobal).map((r) => toAttributes(organizationId, r));
+      }),
+      diff: Effect.fn(function* ({ news, output }) {
+        if (!isResolved(news) || output === undefined) return undefined;
+        if (yield* movesOrganization(news.organization, output))
+          return { action: "replace" } as const;
+      }),
+      read: Effect.fn(function* ({ id, olds, output }) {
+        const organizationId = output?.organizationId ?? (yield* currentOrganizationId);
+        const name = yield* resolveName(id, olds?.name, output?.name);
+        const roles = yield* listRoles(organizationId);
+        const found =
+          roles.find((r) => r.id === output?.roleId) ?? roles.find((r) => r.name === name);
+        if (found === undefined) return undefined;
+        const attrs = toAttributes(organizationId, found);
+        return (yield* isOwnedName(id, found.name, output !== undefined)) ? attrs : Unowned(attrs);
+      }),
+      reconcile: Effect.fn(function* ({ id, news, output }) {
+        const organizationId = yield* organizationIdFor(news.organization);
+        const name = yield* resolveName(id, news.name, output?.name);
+        const description = news.description ?? "";
+        // Observe
+        const roles = yield* listRoles(organizationId);
+        const current =
+          roles.find((r) => r.id === output?.roleId) ?? roles.find((r) => r.name === name);
+        // Ensure
+        if (current === undefined) {
+          const created = yield* organizations
+            .createOrganizationRole({
+              organizationId,
+              name,
+              description,
+              permissions: news.permissions,
+            })
+            .pipe(Effect.catchTag("OrganizationRoleAlreadyExists", () => Effect.undefined));
+          if (created) return toAttributes(organizationId, created);
+        }
+        const existing = current ?? (yield* listRoles(organizationId)).find((r) => r.name === name);
+        if (existing === undefined) {
+          return yield* Effect.die(`Daytona role ${name} vanished during create`);
+        }
+        // Sync against observed state.
+        if (
+          existing.name === name &&
+          existing.description === description &&
+          deepEqual(sorted(existing.permissions), sorted(news.permissions))
+        ) {
+          return toAttributes(organizationId, existing);
+        }
+        const updated = yield* organizations.updateOrganizationRole({
+          organizationId,
+          roleId: existing.id,
+          name,
+          description,
+          permissions: news.permissions,
+        });
+        return toAttributes(organizationId, updated);
+      }),
+      delete: Effect.fn(function* ({ output }) {
+        yield* organizations
+          .deleteOrganizationRole({ organizationId: output.organizationId, roleId: output.roleId })
+          .pipe(Effect.catchTag("OrganizationRoleNotFound", () => Effect.void));
+      }),
+    }),
+  );