@atensec/pulumi-thoth 0.1.0

package/mdm/sync.ts

@@ -0,0 +1,230 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class Sync extends pulumi.CustomResource {
+    /**
+     * Get an existing Sync resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: SyncState, opts?: pulumi.CustomResourceOptions): Sync {
+        return new Sync(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:mdm/sync:Sync';
+
+    /**
+     * Returns true if the given object is an instance of Sync.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is Sync {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === Sync.__pulumiType;
+    }
+
+    /**
+     * Job completion timestamp.
+     */
+    declare public /*out*/ readonly completedAt: pulumi.Output<string>;
+    /**
+     * Job creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Job error string when status=failed.
+     */
+    declare public /*out*/ readonly error: pulumi.Output<string>;
+    /**
+     * Polling interval when wait_for_completion=true.
+     */
+    declare public readonly pollIntervalSeconds: pulumi.Output<number | undefined>;
+    /**
+     * MDM provider slug.
+     */
+    declare public readonly providerName: pulumi.Output<string>;
+    /**
+     * Job start timestamp.
+     */
+    declare public /*out*/ readonly startedAt: pulumi.Output<string>;
+    /**
+     * Job status: queued, running, succeeded, failed.
+     */
+    declare public /*out*/ readonly status: pulumi.Output<string>;
+    /**
+     * Number of endpoints synchronized by the job.
+     */
+    declare public /*out*/ readonly syncedEndpoints: pulumi.Output<number>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Polling timeout when wait_for_completion=true.
+     */
+    declare public readonly timeoutSeconds: pulumi.Output<number | undefined>;
+    /**
+     * Arbitrary replacement trigger value.
+     */
+    declare public readonly trigger: pulumi.Output<string | undefined>;
+    /**
+     * Count of devices that could not be mapped.
+     */
+    declare public /*out*/ readonly unassignedCount: pulumi.Output<number>;
+    /**
+     * Job update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * Wait for sync job completion before returning state.
+     */
+    declare public readonly waitForCompletion: pulumi.Output<boolean | undefined>;
+
+    /**
+     * Create a Sync resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: SyncArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: SyncArgs | SyncState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as SyncState | undefined;
+            resourceInputs["completedAt"] = state?.completedAt;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["error"] = state?.error;
+            resourceInputs["pollIntervalSeconds"] = state?.pollIntervalSeconds;
+            resourceInputs["providerName"] = state?.providerName;
+            resourceInputs["startedAt"] = state?.startedAt;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["syncedEndpoints"] = state?.syncedEndpoints;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["timeoutSeconds"] = state?.timeoutSeconds;
+            resourceInputs["trigger"] = state?.trigger;
+            resourceInputs["unassignedCount"] = state?.unassignedCount;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["waitForCompletion"] = state?.waitForCompletion;
+        } else {
+            const args = argsOrState as SyncArgs | undefined;
+            if (args?.providerName === undefined && !opts.urn) {
+                throw new Error("Missing required property 'providerName'");
+            }
+            resourceInputs["pollIntervalSeconds"] = args?.pollIntervalSeconds;
+            resourceInputs["providerName"] = args?.providerName;
+            resourceInputs["timeoutSeconds"] = args?.timeoutSeconds;
+            resourceInputs["trigger"] = args?.trigger;
+            resourceInputs["waitForCompletion"] = args?.waitForCompletion;
+            resourceInputs["completedAt"] = undefined /*out*/;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["error"] = undefined /*out*/;
+            resourceInputs["startedAt"] = undefined /*out*/;
+            resourceInputs["status"] = undefined /*out*/;
+            resourceInputs["syncedEndpoints"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["unassignedCount"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(Sync.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering Sync resources.
+ */
+export interface SyncState {
+    /**
+     * Job completion timestamp.
+     */
+    completedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Job creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Job error string when status=failed.
+     */
+    error?: pulumi.Input<string | undefined>;
+    /**
+     * Polling interval when wait_for_completion=true.
+     */
+    pollIntervalSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * MDM provider slug.
+     */
+    providerName?: pulumi.Input<string | undefined>;
+    /**
+     * Job start timestamp.
+     */
+    startedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Job status: queued, running, succeeded, failed.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Number of endpoints synchronized by the job.
+     */
+    syncedEndpoints?: pulumi.Input<number | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Polling timeout when wait_for_completion=true.
+     */
+    timeoutSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * Arbitrary replacement trigger value.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Count of devices that could not be mapped.
+     */
+    unassignedCount?: pulumi.Input<number | undefined>;
+    /**
+     * Job update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Wait for sync job completion before returning state.
+     */
+    waitForCompletion?: pulumi.Input<boolean | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a Sync resource.
+ */
+export interface SyncArgs {
+    /**
+     * Polling interval when wait_for_completion=true.
+     */
+    pollIntervalSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * MDM provider slug.
+     */
+    providerName: pulumi.Input<string>;
+    /**
+     * Polling timeout when wait_for_completion=true.
+     */
+    timeoutSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * Arbitrary replacement trigger value.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Wait for sync job completion before returning state.
+     */
+    waitForCompletion?: pulumi.Input<boolean | undefined>;
+}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@atensec/pulumi-thoth",
+  "version": "0.1.0",
+  "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
+  "keywords": [
+    "pulumi",
+    "thoth",
+    "atensecurity",
+    "governance",
+    "ai"
+  ],
+  "homepage": "https://atensecurity.com",
+  "repository": "https://github.com/atensecurity/pulumi-thoth",
+  "license": "Apache-2.0",
+  "scripts": {
+    "build": "tsc"
+  },
+  "dependencies": {
+    "@pulumi/pulumi": "^3.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "typescript": "^4.7.0"
+  },
+  "pulumi": {
+    "resource": true,
+    "name": "thoth"
+  }
+}

package/provider.ts

@@ -0,0 +1,144 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "./utilities";
+
+/**
+ * The provider type for the thoth package. By default, resources use package-wide configuration
+ * settings, however an explicit `Provider` instance may be created and passed during resource
+ * construction to achieve fine-grained programmatic control over provider settings. See the
+ * [documentation](https://www.pulumi.com/docs/reference/programming-model/#providers) for more information.
+ */
+export class Provider extends pulumi.ProviderResource {
+    /** @internal */
+    public static readonly __pulumiType = 'thoth';
+
+    /**
+     * Returns true if the given object is an instance of Provider.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is Provider {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === "pulumi:providers:" + Provider.__pulumiType;
+    }
+
+    /**
+     * Admin bearer token used for authenticated GovAPI requests.
+     */
+    declare public readonly adminBearerToken: pulumi.Output<string | undefined>;
+    /**
+     * Path to a file containing the admin bearer token.
+     */
+    declare public readonly adminBearerTokenFile: pulumi.Output<string | undefined>;
+    /**
+     * Apex domain used to derive GovAPI host when apiBaseUrl is omitted. Defaults to atensecurity.com.
+     */
+    declare public readonly apexDomain: pulumi.Output<string | undefined>;
+    /**
+     * GovAPI base URL override. When omitted, provider derives https://grid.<tenant_id>.<apex_domain>.
+     */
+    declare public readonly apiBaseUrl: pulumi.Output<string | undefined>;
+    /**
+     * Tenant slug used in GovAPI route scoping.
+     */
+    declare public readonly tenantId: pulumi.Output<string>;
+
+    /**
+     * Create a Provider resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: ProviderArgs, opts?: pulumi.ResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        {
+            if (args?.tenantId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'tenantId'");
+            }
+            resourceInputs["adminBearerToken"] = args?.adminBearerToken ? pulumi.secret(args.adminBearerToken) : undefined;
+            resourceInputs["adminBearerTokenFile"] = args?.adminBearerTokenFile;
+            resourceInputs["apexDomain"] = args?.apexDomain;
+            resourceInputs["apiBaseUrl"] = args?.apiBaseUrl;
+            resourceInputs["insecureSkipTlsVerify"] = pulumi.output(args?.insecureSkipTlsVerify).apply(JSON.stringify);
+            resourceInputs["requestTimeoutSeconds"] = pulumi.output(args?.requestTimeoutSeconds).apply(JSON.stringify);
+            resourceInputs["retryBaseDelayMs"] = pulumi.output(args?.retryBaseDelayMs).apply(JSON.stringify);
+            resourceInputs["retryMaxAttempts"] = pulumi.output(args?.retryMaxAttempts).apply(JSON.stringify);
+            resourceInputs["retryMaxDelayMs"] = pulumi.output(args?.retryMaxDelayMs).apply(JSON.stringify);
+            resourceInputs["tenantId"] = args?.tenantId;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["adminBearerToken"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(Provider.__pulumiType, name, resourceInputs, opts);
+    }
+
+    /**
+     * This function returns a Terraform config object with terraform-namecased keys,to be used with the Terraform Module Provider.
+     */
+    terraformConfig(): pulumi.Output<Provider.TerraformConfigResult> {
+        return pulumi.runtime.call("pulumi:providers:thoth/terraformConfig", {
+            "__self__": this,
+        }, this);
+    }
+}
+
+/**
+ * The set of arguments for constructing a Provider resource.
+ */
+export interface ProviderArgs {
+    /**
+     * Admin bearer token used for authenticated GovAPI requests.
+     */
+    adminBearerToken?: pulumi.Input<string | undefined>;
+    /**
+     * Path to a file containing the admin bearer token.
+     */
+    adminBearerTokenFile?: pulumi.Input<string | undefined>;
+    /**
+     * Apex domain used to derive GovAPI host when apiBaseUrl is omitted. Defaults to atensecurity.com.
+     */
+    apexDomain?: pulumi.Input<string | undefined>;
+    /**
+     * GovAPI base URL override. When omitted, provider derives https://grid.<tenant_id>.<apex_domain>.
+     */
+    apiBaseUrl?: pulumi.Input<string | undefined>;
+    /**
+     * Skip TLS certificate verification (development/testing only).
+     */
+    insecureSkipTlsVerify?: pulumi.Input<boolean | undefined>;
+    /**
+     * Per-request timeout in seconds.
+     */
+    requestTimeoutSeconds?: pulumi.Input<number | undefined>;
+    /**
+     * Base delay in milliseconds for exponential retry backoff.
+     */
+    retryBaseDelayMs?: pulumi.Input<number | undefined>;
+    /**
+     * Maximum retry attempts for transient API/network failures.
+     */
+    retryMaxAttempts?: pulumi.Input<number | undefined>;
+    /**
+     * Maximum delay in milliseconds for retry backoff.
+     */
+    retryMaxDelayMs?: pulumi.Input<number | undefined>;
+    /**
+     * Tenant slug used in GovAPI route scoping.
+     */
+    tenantId: pulumi.Input<string>;
+}
+
+export namespace Provider {
+    /**
+     * The results of the Provider.terraformConfig method.
+     */
+    export interface TerraformConfigResult {
+        readonly result: {[key: string]: any};
+    }
+
+}

package/tsconfig.json

@@ -0,0 +1,48 @@
+{
+    "compilerOptions": {
+        // Output
+        "outDir": "bin",
+        "declaration": true,
+        "declarationMap": true,
+        "sourceMap": true,
+        "stripInternal": true,
+        // Environment
+        "target": "ES2022",
+        "module": "nodenext",
+        "moduleResolution": "nodenext",
+        "moduleDetection": "force",
+        "types": ["node"],
+        // Type Checking
+        "strict": true,
+        "noFallthroughCasesInSwitch": true,
+        "noImplicitReturns": true,
+        "skipLibCheck": true
+    },
+    "files": [
+        "access/apiKey.ts",
+        "access/getApiKeyMetrics.ts",
+        "access/index.ts",
+        "browser/enrollment.ts",
+        "browser/index.ts",
+        "browser/policy.ts",
+        "browser/provider.ts",
+        "config/index.ts",
+        "config/vars.ts",
+        "governance/approvalDecision.ts",
+        "governance/getFeed.ts",
+        "governance/getTenantSettings.ts",
+        "governance/getTools.ts",
+        "governance/index.ts",
+        "governance/packAssignment.ts",
+        "governance/policySync.ts",
+        "governance/tenantSettings.ts",
+        "governance/webhookTest.ts",
+        "index.ts",
+        "mdm/getSyncJob.ts",
+        "mdm/index.ts",
+        "mdm/provider.ts",
+        "mdm/sync.ts",
+        "provider.ts",
+        "utilities.ts"
+    ]
+}

package/utilities.ts

@@ -0,0 +1,96 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+
+import * as runtime from "@pulumi/pulumi/runtime";
+import * as pulumi from "@pulumi/pulumi";
+
+export function getEnv(...vars: string[]): string | undefined {
+    for (const v of vars) {
+        const value = process.env[v];
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+
+export function getEnvBoolean(...vars: string[]): boolean | undefined {
+    const s = getEnv(...vars);
+    if (s !== undefined) {
+        // NOTE: these values are taken from https://golang.org/src/strconv/atob.go?s=351:391#L1, which is what
+        // Terraform uses internally when parsing boolean values.
+        if (["1", "t", "T", "true", "TRUE", "True"].find(v => v === s) !== undefined) {
+            return true;
+        }
+        if (["0", "f", "F", "false", "FALSE", "False"].find(v => v === s) !== undefined) {
+            return false;
+        }
+    }
+    return undefined;
+}
+
+export function getEnvNumber(...vars: string[]): number | undefined {
+    const s = getEnv(...vars);
+    if (s !== undefined) {
+        const f = parseFloat(s);
+        if (!isNaN(f)) {
+            return f;
+        }
+    }
+    return undefined;
+}
+
+export function getVersion(): string {
+    let version = require('./package.json').version;
+    // Node allows for the version to be prefixed by a "v", while semver doesn't.
+    // If there is a v, strip it off.
+    if (version.indexOf('v') === 0) {
+        version = version.slice(1);
+    }
+    return version;
+}
+
+/** @internal */
+export function resourceOptsDefaults(): any {
+    return { version: getVersion() };
+}
+
+/** @internal */
+export function lazyLoad(exports: any, props: string[], loadModule: any) {
+    for (let property of props) {
+        Object.defineProperty(exports, property, {
+            enumerable: true,
+            get: function() {
+                return loadModule()[property];
+            },
+        });
+    }
+}
+
+/** @internal */
+export async function callAsync<T>(
+    tok: string,
+    props: pulumi.Inputs,
+    res?: pulumi.Resource,
+    opts?: {property?: string},
+): Promise<T> {
+    const o: any = runtime.call<T>(tok, props, res);
+    const value = await o.promise(true /*withUnknowns*/);
+    const isKnown = await o.isKnown;
+    const isSecret = await o.isSecret;
+    const problem: string|undefined =
+        !isKnown ? "an unknown value"
+        : isSecret ? "a secret value"
+        : undefined;
+    // Ingoring o.resources silently. They are typically non-empty, r.f() calls include r as a dependency.
+    if (problem) {
+        throw new Error(`Plain resource method "${tok}" incorrectly returned ${problem}. ` +
+            "This is an error in the provider, please report this to the provider developer.");
+    }
+    // Extract a single property if requested.
+    if (opts && opts.property) {
+        return value[opts.property];
+    }
+    return value;
+}