@atensec/pulumi-thoth 0.1.0

package/.gitattributes

@@ -0,0 +1 @@
+* linguist-generated

package/Pulumi.yaml

@@ -0,0 +1,3 @@
+name: thoth
+description: A Pulumi resource provider for thoth.
+language: nodejs

package/README.md

@@ -0,0 +1,4 @@
+> This provider is a derived work of the [Terraform Provider](https://github.com/atensecurity/terraform-provider-thoth)
+> distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,
+> first check the [`pulumi-thoth` repo](https://github.com/atensecurity/pulumi-thoth/issues); however, if that doesn't turn up anything,
+> please consult the source [`terraform-provider-thoth` repo](https://github.com/atensecurity/terraform-provider-thoth/issues).

package/access/apiKey.ts

@@ -0,0 +1,239 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class ApiKey extends pulumi.CustomResource {
+    /**
+     * Get an existing ApiKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ApiKeyState, opts?: pulumi.CustomResourceOptions): ApiKey {
+        return new ApiKey(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:access/apiKey:ApiKey';
+
+    /**
+     * Returns true if the given object is an instance of ApiKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is ApiKey {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === ApiKey.__pulumiType;
+    }
+
+    /**
+     * Whether key is currently active and not expired/revoked.
+     */
+    declare public /*out*/ readonly active: pulumi.Output<boolean>;
+    /**
+     * One-time plaintext API key (returned only on create).
+     */
+    declare public /*out*/ readonly apiKey: pulumi.Output<string>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Expiry timestamp.
+     */
+    declare public /*out*/ readonly expiresAt: pulumi.Output<string>;
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    declare public readonly jitReason: pulumi.Output<string | undefined>;
+    /**
+     * GovAPI key identifier.
+     */
+    declare public /*out*/ readonly keyId: pulumi.Output<string>;
+    /**
+     * Last authorization timestamp.
+     */
+    declare public /*out*/ readonly lastUsedAt: pulumi.Output<string>;
+    /**
+     * Display name for the API key.
+     */
+    declare public readonly name: pulumi.Output<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    declare public readonly permissions: pulumi.Output<string[]>;
+    /**
+     * Key prefix for operator identification.
+     */
+    declare public /*out*/ readonly prefix: pulumi.Output<string>;
+    /**
+     * Scope level: organization, fleet, endpoint, agent.
+     */
+    declare public readonly scopeLevel: pulumi.Output<string>;
+    /**
+     * Target ID for scope level (not required for organization).
+     */
+    declare public readonly scopeTargetId: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    declare public readonly ttlSeconds: pulumi.Output<number | undefined>;
+
+    /**
+     * Create a ApiKey resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: ApiKeyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: ApiKeyArgs | ApiKeyState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as ApiKeyState | undefined;
+            resourceInputs["active"] = state?.active;
+            resourceInputs["apiKey"] = state?.apiKey;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["expiresAt"] = state?.expiresAt;
+            resourceInputs["jitReason"] = state?.jitReason;
+            resourceInputs["keyId"] = state?.keyId;
+            resourceInputs["lastUsedAt"] = state?.lastUsedAt;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["permissions"] = state?.permissions;
+            resourceInputs["prefix"] = state?.prefix;
+            resourceInputs["scopeLevel"] = state?.scopeLevel;
+            resourceInputs["scopeTargetId"] = state?.scopeTargetId;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["ttlSeconds"] = state?.ttlSeconds;
+        } else {
+            const args = argsOrState as ApiKeyArgs | undefined;
+            if (args?.permissions === undefined && !opts.urn) {
+                throw new Error("Missing required property 'permissions'");
+            }
+            if (args?.scopeLevel === undefined && !opts.urn) {
+                throw new Error("Missing required property 'scopeLevel'");
+            }
+            resourceInputs["jitReason"] = args?.jitReason;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["permissions"] = args?.permissions;
+            resourceInputs["scopeLevel"] = args?.scopeLevel;
+            resourceInputs["scopeTargetId"] = args?.scopeTargetId;
+            resourceInputs["ttlSeconds"] = args?.ttlSeconds;
+            resourceInputs["active"] = undefined /*out*/;
+            resourceInputs["apiKey"] = undefined /*out*/;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["expiresAt"] = undefined /*out*/;
+            resourceInputs["keyId"] = undefined /*out*/;
+            resourceInputs["lastUsedAt"] = undefined /*out*/;
+            resourceInputs["prefix"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["apiKey"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(ApiKey.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering ApiKey resources.
+ */
+export interface ApiKeyState {
+    /**
+     * Whether key is currently active and not expired/revoked.
+     */
+    active?: pulumi.Input<boolean | undefined>;
+    /**
+     * One-time plaintext API key (returned only on create).
+     */
+    apiKey?: pulumi.Input<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Expiry timestamp.
+     */
+    expiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    jitReason?: pulumi.Input<string | undefined>;
+    /**
+     * GovAPI key identifier.
+     */
+    keyId?: pulumi.Input<string | undefined>;
+    /**
+     * Last authorization timestamp.
+     */
+    lastUsedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Display name for the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    permissions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Key prefix for operator identification.
+     */
+    prefix?: pulumi.Input<string | undefined>;
+    /**
+     * Scope level: organization, fleet, endpoint, agent.
+     */
+    scopeLevel?: pulumi.Input<string | undefined>;
+    /**
+     * Target ID for scope level (not required for organization).
+     */
+    scopeTargetId?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    ttlSeconds?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a ApiKey resource.
+ */
+export interface ApiKeyArgs {
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    jitReason?: pulumi.Input<string | undefined>;
+    /**
+     * Display name for the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    permissions: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Scope level: organization, fleet, endpoint, agent.
+     */
+    scopeLevel: pulumi.Input<string>;
+    /**
+     * Target ID for scope level (not required for organization).
+     */
+    scopeTargetId?: pulumi.Input<string | undefined>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    ttlSeconds?: pulumi.Input<number | undefined>;
+}

package/access/getApiKeyMetrics.ts

@@ -0,0 +1,31 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getApiKeyMetrics(opts?: pulumi.InvokeOptions): Promise<GetApiKeyMetricsResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:access/getApiKeyMetrics:getApiKeyMetrics", {
+    }, opts);
+}
+
+/**
+ * A collection of values returned by getApiKeyMetrics.
+ */
+export interface GetApiKeyMetricsResult {
+    readonly activeSdkKeys: number;
+    readonly avgLatencyMs: number;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly keyUsage24h: number;
+    readonly metricsJson: string;
+    readonly redTeamTests: number;
+}
+export function getApiKeyMetricsOutput(opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetApiKeyMetricsResult> {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:access/getApiKeyMetrics:getApiKeyMetrics", {
+    }, opts);
+}

package/access/index.ts

@@ -0,0 +1,30 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+// Export members:
+export { ApiKeyArgs, ApiKeyState } from "./apiKey";
+export type ApiKey = import("./apiKey").ApiKey;
+export const ApiKey: typeof import("./apiKey").ApiKey = null as any;
+utilities.lazyLoad(exports, ["ApiKey"], () => require("./apiKey"));
+
+export { GetApiKeyMetricsResult } from "./getApiKeyMetrics";
+export const getApiKeyMetrics: typeof import("./getApiKeyMetrics").getApiKeyMetrics = null as any;
+export const getApiKeyMetricsOutput: typeof import("./getApiKeyMetrics").getApiKeyMetricsOutput = null as any;
+utilities.lazyLoad(exports, ["getApiKeyMetrics","getApiKeyMetricsOutput"], () => require("./getApiKeyMetrics"));
+
+
+const _module = {
+    version: utilities.getVersion(),
+    construct: (name: string, type: string, urn: string): pulumi.Resource => {
+        switch (type) {
+            case "thoth:access/apiKey:ApiKey":
+                return new ApiKey(name, <any>undefined, { urn })
+            default:
+                throw new Error(`unknown resource type ${type}`);
+        }
+    },
+};
+pulumi.runtime.registerResourceModule("thoth", "access/apiKey", _module)

package/browser/enrollment.ts

@@ -0,0 +1,218 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class Enrollment extends pulumi.CustomResource {
+    /**
+     * Get an existing Enrollment resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: EnrollmentState, opts?: pulumi.CustomResourceOptions): Enrollment {
+        return new Enrollment(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:browser/enrollment:Enrollment';
+
+    /**
+     * Returns true if the given object is an instance of Enrollment.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is Enrollment {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === Enrollment.__pulumiType;
+    }
+
+    /**
+     * Browser profile identifier.
+     */
+    declare public readonly browserProfile: pulumi.Output<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Device identifier for enrollment.
+     */
+    declare public readonly deviceId: pulumi.Output<string>;
+    /**
+     * Enrollment ID; generated by GovAPI if omitted.
+     */
+    declare public readonly enrollmentId: pulumi.Output<string>;
+    /**
+     * Last-seen timestamp (RFC3339).
+     */
+    declare public readonly lastSeenAt: pulumi.Output<string | undefined>;
+    /**
+     * Metadata JSON object.
+     */
+    declare public readonly metadataJson: pulumi.Output<string | undefined>;
+    /**
+     * Browser provider slug.
+     */
+    declare public readonly providerName: pulumi.Output<string>;
+    /**
+     * Enrollment status (active, pending, disabled).
+     */
+    declare public readonly status: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * User identifier for enrollment.
+     */
+    declare public readonly userId: pulumi.Output<string>;
+
+    /**
+     * Create a Enrollment resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: EnrollmentArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: EnrollmentArgs | EnrollmentState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as EnrollmentState | undefined;
+            resourceInputs["browserProfile"] = state?.browserProfile;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["deviceId"] = state?.deviceId;
+            resourceInputs["enrollmentId"] = state?.enrollmentId;
+            resourceInputs["lastSeenAt"] = state?.lastSeenAt;
+            resourceInputs["metadataJson"] = state?.metadataJson;
+            resourceInputs["providerName"] = state?.providerName;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["userId"] = state?.userId;
+        } else {
+            const args = argsOrState as EnrollmentArgs | undefined;
+            if (args?.deviceId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'deviceId'");
+            }
+            if (args?.providerName === undefined && !opts.urn) {
+                throw new Error("Missing required property 'providerName'");
+            }
+            if (args?.userId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'userId'");
+            }
+            resourceInputs["browserProfile"] = args?.browserProfile;
+            resourceInputs["deviceId"] = args?.deviceId;
+            resourceInputs["enrollmentId"] = args?.enrollmentId;
+            resourceInputs["lastSeenAt"] = args?.lastSeenAt;
+            resourceInputs["metadataJson"] = args?.metadataJson;
+            resourceInputs["providerName"] = args?.providerName;
+            resourceInputs["status"] = args?.status;
+            resourceInputs["userId"] = args?.userId;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(Enrollment.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering Enrollment resources.
+ */
+export interface EnrollmentState {
+    /**
+     * Browser profile identifier.
+     */
+    browserProfile?: pulumi.Input<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Device identifier for enrollment.
+     */
+    deviceId?: pulumi.Input<string | undefined>;
+    /**
+     * Enrollment ID; generated by GovAPI if omitted.
+     */
+    enrollmentId?: pulumi.Input<string | undefined>;
+    /**
+     * Last-seen timestamp (RFC3339).
+     */
+    lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Metadata JSON object.
+     */
+    metadataJson?: pulumi.Input<string | undefined>;
+    /**
+     * Browser provider slug.
+     */
+    providerName?: pulumi.Input<string | undefined>;
+    /**
+     * Enrollment status (active, pending, disabled).
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * User identifier for enrollment.
+     */
+    userId?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a Enrollment resource.
+ */
+export interface EnrollmentArgs {
+    /**
+     * Browser profile identifier.
+     */
+    browserProfile?: pulumi.Input<string | undefined>;
+    /**
+     * Device identifier for enrollment.
+     */
+    deviceId: pulumi.Input<string>;
+    /**
+     * Enrollment ID; generated by GovAPI if omitted.
+     */
+    enrollmentId?: pulumi.Input<string | undefined>;
+    /**
+     * Last-seen timestamp (RFC3339).
+     */
+    lastSeenAt?: pulumi.Input<string | undefined>;
+    /**
+     * Metadata JSON object.
+     */
+    metadataJson?: pulumi.Input<string | undefined>;
+    /**
+     * Browser provider slug.
+     */
+    providerName: pulumi.Input<string>;
+    /**
+     * Enrollment status (active, pending, disabled).
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * User identifier for enrollment.
+     */
+    userId: pulumi.Input<string>;
+}

package/browser/index.ts

@@ -0,0 +1,41 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+// Export members:
+export { EnrollmentArgs, EnrollmentState } from "./enrollment";
+export type Enrollment = import("./enrollment").Enrollment;
+export const Enrollment: typeof import("./enrollment").Enrollment = null as any;
+utilities.lazyLoad(exports, ["Enrollment"], () => require("./enrollment"));
+
+export { PolicyArgs, PolicyState } from "./policy";
+export type Policy = import("./policy").Policy;
+export const Policy: typeof import("./policy").Policy = null as any;
+utilities.lazyLoad(exports, ["Policy"], () => require("./policy"));
+
+export { ProviderArgs, ProviderState } from "./provider";
+export type Provider = import("./provider").Provider;
+export const Provider: typeof import("./provider").Provider = null as any;
+utilities.lazyLoad(exports, ["Provider"], () => require("./provider"));
+
+
+const _module = {
+    version: utilities.getVersion(),
+    construct: (name: string, type: string, urn: string): pulumi.Resource => {
+        switch (type) {
+            case "thoth:browser/enrollment:Enrollment":
+                return new Enrollment(name, <any>undefined, { urn })
+            case "thoth:browser/policy:Policy":
+                return new Policy(name, <any>undefined, { urn })
+            case "thoth:browser/provider:Provider":
+                return new Provider(name, <any>undefined, { urn })
+            default:
+                throw new Error(`unknown resource type ${type}`);
+        }
+    },
+};
+pulumi.runtime.registerResourceModule("thoth", "browser/enrollment", _module)
+pulumi.runtime.registerResourceModule("thoth", "browser/policy", _module)
+pulumi.runtime.registerResourceModule("thoth", "browser/provider", _module)