@atensec/pulumi-thoth 0.1.11 → 0.1.13

package/governance/policyException.ts

@@ -0,0 +1,302 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyException extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyException resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyExceptionState, opts?: pulumi.CustomResourceOptions): PolicyException {
+        return new PolicyException(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyException:PolicyException';
+
+    /**
+     * Returns true if the given object is an instance of PolicyException.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyException {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyException.__pulumiType;
+    }
+
+    /**
+     * Agent ID associated with the request.
+     */
+    declare public readonly agentId: pulumi.Output<string | undefined>;
+    /**
+     * Optional alternatives reviewed before requesting an exception.
+     */
+    declare public readonly alternativesConsidered: pulumi.Output<string | undefined>;
+    /**
+     * Business reason for requesting the exception.
+     */
+    declare public readonly businessJustification: pulumi.Output<string>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Data sensitivity level touched by this exception.
+     */
+    declare public readonly dataSensitivity: pulumi.Output<string>;
+    /**
+     * How often this exception is expected to occur.
+     */
+    declare public readonly frequencyEstimate: pulumi.Output<string>;
+    /**
+     * Optional hold token when exception is tied to STEP_UP workflow.
+     */
+    declare public readonly holdToken: pulumi.Output<string | undefined>;
+    /**
+     * Policy change metadata returned by the review flow.
+     */
+    declare public /*out*/ readonly policyChangeJson: pulumi.Output<string>;
+    /**
+     * Optional request ID. If omitted, enforcer generates one.
+     */
+    declare public readonly requestId: pulumi.Output<string>;
+    /**
+     * Requester identity.
+     */
+    declare public readonly requestedBy: pulumi.Output<string>;
+    /**
+     * Review decision when present.
+     */
+    declare public /*out*/ readonly reviewDecision: pulumi.Output<string>;
+    /**
+     * Review notes when present.
+     */
+    declare public /*out*/ readonly reviewNotes: pulumi.Output<string>;
+    /**
+     * Reviewer identity when present.
+     */
+    declare public /*out*/ readonly reviewedBy: pulumi.Output<string>;
+    /**
+     * Current policy exception status.
+     */
+    declare public /*out*/ readonly status: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Tool/action name associated with the request.
+     */
+    declare public readonly toolName: pulumi.Output<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+    /**
+     * Violation ID associated with this exception request.
+     */
+    declare public readonly violationId: pulumi.Output<string>;
+
+    /**
+     * Create a PolicyException resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyExceptionArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyExceptionArgs | PolicyExceptionState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyExceptionState | undefined;
+            resourceInputs["agentId"] = state?.agentId;
+            resourceInputs["alternativesConsidered"] = state?.alternativesConsidered;
+            resourceInputs["businessJustification"] = state?.businessJustification;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["dataSensitivity"] = state?.dataSensitivity;
+            resourceInputs["frequencyEstimate"] = state?.frequencyEstimate;
+            resourceInputs["holdToken"] = state?.holdToken;
+            resourceInputs["policyChangeJson"] = state?.policyChangeJson;
+            resourceInputs["requestId"] = state?.requestId;
+            resourceInputs["requestedBy"] = state?.requestedBy;
+            resourceInputs["reviewDecision"] = state?.reviewDecision;
+            resourceInputs["reviewNotes"] = state?.reviewNotes;
+            resourceInputs["reviewedBy"] = state?.reviewedBy;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["toolName"] = state?.toolName;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+            resourceInputs["violationId"] = state?.violationId;
+        } else {
+            const args = argsOrState as PolicyExceptionArgs | undefined;
+            if (args?.businessJustification === undefined && !opts.urn) {
+                throw new Error("Missing required property 'businessJustification'");
+            }
+            if (args?.dataSensitivity === undefined && !opts.urn) {
+                throw new Error("Missing required property 'dataSensitivity'");
+            }
+            if (args?.frequencyEstimate === undefined && !opts.urn) {
+                throw new Error("Missing required property 'frequencyEstimate'");
+            }
+            if (args?.requestedBy === undefined && !opts.urn) {
+                throw new Error("Missing required property 'requestedBy'");
+            }
+            if (args?.violationId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'violationId'");
+            }
+            resourceInputs["agentId"] = args?.agentId;
+            resourceInputs["alternativesConsidered"] = args?.alternativesConsidered;
+            resourceInputs["businessJustification"] = args?.businessJustification;
+            resourceInputs["dataSensitivity"] = args?.dataSensitivity;
+            resourceInputs["frequencyEstimate"] = args?.frequencyEstimate;
+            resourceInputs["holdToken"] = args?.holdToken;
+            resourceInputs["requestId"] = args?.requestId;
+            resourceInputs["requestedBy"] = args?.requestedBy;
+            resourceInputs["toolName"] = args?.toolName;
+            resourceInputs["violationId"] = args?.violationId;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["policyChangeJson"] = undefined /*out*/;
+            resourceInputs["reviewDecision"] = undefined /*out*/;
+            resourceInputs["reviewNotes"] = undefined /*out*/;
+            resourceInputs["reviewedBy"] = undefined /*out*/;
+            resourceInputs["status"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(PolicyException.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyException resources.
+ */
+export interface PolicyExceptionState {
+    /**
+     * Agent ID associated with the request.
+     */
+    agentId?: pulumi.Input<string | undefined>;
+    /**
+     * Optional alternatives reviewed before requesting an exception.
+     */
+    alternativesConsidered?: pulumi.Input<string | undefined>;
+    /**
+     * Business reason for requesting the exception.
+     */
+    businessJustification?: pulumi.Input<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Data sensitivity level touched by this exception.
+     */
+    dataSensitivity?: pulumi.Input<string | undefined>;
+    /**
+     * How often this exception is expected to occur.
+     */
+    frequencyEstimate?: pulumi.Input<string | undefined>;
+    /**
+     * Optional hold token when exception is tied to STEP_UP workflow.
+     */
+    holdToken?: pulumi.Input<string | undefined>;
+    /**
+     * Policy change metadata returned by the review flow.
+     */
+    policyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Optional request ID. If omitted, enforcer generates one.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Requester identity.
+     */
+    requestedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Review decision when present.
+     */
+    reviewDecision?: pulumi.Input<string | undefined>;
+    /**
+     * Review notes when present.
+     */
+    reviewNotes?: pulumi.Input<string | undefined>;
+    /**
+     * Reviewer identity when present.
+     */
+    reviewedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Current policy exception status.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Tool/action name associated with the request.
+     */
+    toolName?: pulumi.Input<string | undefined>;
+    /**
+     * Last update timestamp.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Violation ID associated with this exception request.
+     */
+    violationId?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyException resource.
+ */
+export interface PolicyExceptionArgs {
+    /**
+     * Agent ID associated with the request.
+     */
+    agentId?: pulumi.Input<string | undefined>;
+    /**
+     * Optional alternatives reviewed before requesting an exception.
+     */
+    alternativesConsidered?: pulumi.Input<string | undefined>;
+    /**
+     * Business reason for requesting the exception.
+     */
+    businessJustification: pulumi.Input<string>;
+    /**
+     * Data sensitivity level touched by this exception.
+     */
+    dataSensitivity: pulumi.Input<string>;
+    /**
+     * How often this exception is expected to occur.
+     */
+    frequencyEstimate: pulumi.Input<string>;
+    /**
+     * Optional hold token when exception is tied to STEP_UP workflow.
+     */
+    holdToken?: pulumi.Input<string | undefined>;
+    /**
+     * Optional request ID. If omitted, enforcer generates one.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Requester identity.
+     */
+    requestedBy: pulumi.Input<string>;
+    /**
+     * Tool/action name associated with the request.
+     */
+    toolName?: pulumi.Input<string | undefined>;
+    /**
+     * Violation ID associated with this exception request.
+     */
+    violationId: pulumi.Input<string>;
+}

package/governance/policyExceptionReview.ts

@@ -0,0 +1,228 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyExceptionReview extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyExceptionReview resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyExceptionReviewState, opts?: pulumi.CustomResourceOptions): PolicyExceptionReview {
+        return new PolicyExceptionReview(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyExceptionReview:PolicyExceptionReview';
+
+    /**
+     * Returns true if the given object is an instance of PolicyExceptionReview.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyExceptionReview {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyExceptionReview.__pulumiType;
+    }
+
+    /**
+     * Policy change metadata present on the reviewed exception.
+     */
+    declare public /*out*/ readonly appliedPolicyChangeJson: pulumi.Output<string>;
+    /**
+     * Optional runtime override expiration timestamp (RFC3339).
+     */
+    declare public readonly overrideExpiresAt: pulumi.Output<string | undefined>;
+    /**
+     * Optional owner metadata used when synthesizing policy artifacts.
+     */
+    declare public readonly owner: pulumi.Output<string | undefined>;
+    /**
+     * Optional policy change override JSON payload.
+     */
+    declare public readonly policyChangeJson: pulumi.Output<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    declare public readonly requestId: pulumi.Output<string>;
+    /**
+     * Review outcome: approve, deny, request_changes, approve_with_modification.
+     */
+    declare public readonly reviewDecision: pulumi.Output<string>;
+    /**
+     * Optional review notes.
+     */
+    declare public readonly reviewNotes: pulumi.Output<string | undefined>;
+    /**
+     * Reviewer identity.
+     */
+    declare public readonly reviewedBy: pulumi.Output<string>;
+    /**
+     * Resulting policy exception status.
+     */
+    declare public /*out*/ readonly status: pulumi.Output<string>;
+    /**
+     * Optional target environment (for example prod or staging).
+     */
+    declare public readonly targetEnvironment: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Updated timestamp after review.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+
+    /**
+     * Create a PolicyExceptionReview resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyExceptionReviewArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyExceptionReviewArgs | PolicyExceptionReviewState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyExceptionReviewState | undefined;
+            resourceInputs["appliedPolicyChangeJson"] = state?.appliedPolicyChangeJson;
+            resourceInputs["overrideExpiresAt"] = state?.overrideExpiresAt;
+            resourceInputs["owner"] = state?.owner;
+            resourceInputs["policyChangeJson"] = state?.policyChangeJson;
+            resourceInputs["requestId"] = state?.requestId;
+            resourceInputs["reviewDecision"] = state?.reviewDecision;
+            resourceInputs["reviewNotes"] = state?.reviewNotes;
+            resourceInputs["reviewedBy"] = state?.reviewedBy;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["targetEnvironment"] = state?.targetEnvironment;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+        } else {
+            const args = argsOrState as PolicyExceptionReviewArgs | undefined;
+            if (args?.requestId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'requestId'");
+            }
+            if (args?.reviewDecision === undefined && !opts.urn) {
+                throw new Error("Missing required property 'reviewDecision'");
+            }
+            if (args?.reviewedBy === undefined && !opts.urn) {
+                throw new Error("Missing required property 'reviewedBy'");
+            }
+            resourceInputs["overrideExpiresAt"] = args?.overrideExpiresAt;
+            resourceInputs["owner"] = args?.owner;
+            resourceInputs["policyChangeJson"] = args?.policyChangeJson;
+            resourceInputs["requestId"] = args?.requestId;
+            resourceInputs["reviewDecision"] = args?.reviewDecision;
+            resourceInputs["reviewNotes"] = args?.reviewNotes;
+            resourceInputs["reviewedBy"] = args?.reviewedBy;
+            resourceInputs["targetEnvironment"] = args?.targetEnvironment;
+            resourceInputs["appliedPolicyChangeJson"] = undefined /*out*/;
+            resourceInputs["status"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(PolicyExceptionReview.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyExceptionReview resources.
+ */
+export interface PolicyExceptionReviewState {
+    /**
+     * Policy change metadata present on the reviewed exception.
+     */
+    appliedPolicyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Optional runtime override expiration timestamp (RFC3339).
+     */
+    overrideExpiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Optional owner metadata used when synthesizing policy artifacts.
+     */
+    owner?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy change override JSON payload.
+     */
+    policyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Review outcome: approve, deny, request_changes, approve_with_modification.
+     */
+    reviewDecision?: pulumi.Input<string | undefined>;
+    /**
+     * Optional review notes.
+     */
+    reviewNotes?: pulumi.Input<string | undefined>;
+    /**
+     * Reviewer identity.
+     */
+    reviewedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Resulting policy exception status.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Optional target environment (for example prod or staging).
+     */
+    targetEnvironment?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Updated timestamp after review.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyExceptionReview resource.
+ */
+export interface PolicyExceptionReviewArgs {
+    /**
+     * Optional runtime override expiration timestamp (RFC3339).
+     */
+    overrideExpiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Optional owner metadata used when synthesizing policy artifacts.
+     */
+    owner?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy change override JSON payload.
+     */
+    policyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    requestId: pulumi.Input<string>;
+    /**
+     * Review outcome: approve, deny, request_changes, approve_with_modification.
+     */
+    reviewDecision: pulumi.Input<string>;
+    /**
+     * Optional review notes.
+     */
+    reviewNotes?: pulumi.Input<string | undefined>;
+    /**
+     * Reviewer identity.
+     */
+    reviewedBy: pulumi.Input<string>;
+    /**
+     * Optional target environment (for example prod or staging).
+     */
+    targetEnvironment?: pulumi.Input<string | undefined>;
+}

package/index.ts

@@ -16,6 +16,7 @@ import * as browser from "./browser";
 import * as config from "./config";
 import * as fleet from "./fleet";
 import * as governance from "./governance";
+import * as mcp from "./mcp";
 import * as mdm from "./mdm";
 
 export {
@@ -25,6 +26,7 @@ export {
     config,
     fleet,
     governance,
+    mcp,
     mdm,
 };
 pulumi.runtime.registerResourcePackage("thoth", {