@atensec/pulumi-thoth 0.1.12 → 0.1.13

package/governance/policyExceptionReview.ts

@@ -0,0 +1,228 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PolicyExceptionReview extends pulumi.CustomResource {
+    /**
+     * Get an existing PolicyExceptionReview resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyExceptionReviewState, opts?: pulumi.CustomResourceOptions): PolicyExceptionReview {
+        return new PolicyExceptionReview(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/policyExceptionReview:PolicyExceptionReview';
+
+    /**
+     * Returns true if the given object is an instance of PolicyExceptionReview.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PolicyExceptionReview {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PolicyExceptionReview.__pulumiType;
+    }
+
+    /**
+     * Policy change metadata present on the reviewed exception.
+     */
+    declare public /*out*/ readonly appliedPolicyChangeJson: pulumi.Output<string>;
+    /**
+     * Optional runtime override expiration timestamp (RFC3339).
+     */
+    declare public readonly overrideExpiresAt: pulumi.Output<string | undefined>;
+    /**
+     * Optional owner metadata used when synthesizing policy artifacts.
+     */
+    declare public readonly owner: pulumi.Output<string | undefined>;
+    /**
+     * Optional policy change override JSON payload.
+     */
+    declare public readonly policyChangeJson: pulumi.Output<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    declare public readonly requestId: pulumi.Output<string>;
+    /**
+     * Review outcome: approve, deny, request_changes, approve_with_modification.
+     */
+    declare public readonly reviewDecision: pulumi.Output<string>;
+    /**
+     * Optional review notes.
+     */
+    declare public readonly reviewNotes: pulumi.Output<string | undefined>;
+    /**
+     * Reviewer identity.
+     */
+    declare public readonly reviewedBy: pulumi.Output<string>;
+    /**
+     * Resulting policy exception status.
+     */
+    declare public /*out*/ readonly status: pulumi.Output<string>;
+    /**
+     * Optional target environment (for example prod or staging).
+     */
+    declare public readonly targetEnvironment: pulumi.Output<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Updated timestamp after review.
+     */
+    declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
+
+    /**
+     * Create a PolicyExceptionReview resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PolicyExceptionReviewArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PolicyExceptionReviewArgs | PolicyExceptionReviewState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PolicyExceptionReviewState | undefined;
+            resourceInputs["appliedPolicyChangeJson"] = state?.appliedPolicyChangeJson;
+            resourceInputs["overrideExpiresAt"] = state?.overrideExpiresAt;
+            resourceInputs["owner"] = state?.owner;
+            resourceInputs["policyChangeJson"] = state?.policyChangeJson;
+            resourceInputs["requestId"] = state?.requestId;
+            resourceInputs["reviewDecision"] = state?.reviewDecision;
+            resourceInputs["reviewNotes"] = state?.reviewNotes;
+            resourceInputs["reviewedBy"] = state?.reviewedBy;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["targetEnvironment"] = state?.targetEnvironment;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["updatedAt"] = state?.updatedAt;
+        } else {
+            const args = argsOrState as PolicyExceptionReviewArgs | undefined;
+            if (args?.requestId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'requestId'");
+            }
+            if (args?.reviewDecision === undefined && !opts.urn) {
+                throw new Error("Missing required property 'reviewDecision'");
+            }
+            if (args?.reviewedBy === undefined && !opts.urn) {
+                throw new Error("Missing required property 'reviewedBy'");
+            }
+            resourceInputs["overrideExpiresAt"] = args?.overrideExpiresAt;
+            resourceInputs["owner"] = args?.owner;
+            resourceInputs["policyChangeJson"] = args?.policyChangeJson;
+            resourceInputs["requestId"] = args?.requestId;
+            resourceInputs["reviewDecision"] = args?.reviewDecision;
+            resourceInputs["reviewNotes"] = args?.reviewNotes;
+            resourceInputs["reviewedBy"] = args?.reviewedBy;
+            resourceInputs["targetEnvironment"] = args?.targetEnvironment;
+            resourceInputs["appliedPolicyChangeJson"] = undefined /*out*/;
+            resourceInputs["status"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updatedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(PolicyExceptionReview.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PolicyExceptionReview resources.
+ */
+export interface PolicyExceptionReviewState {
+    /**
+     * Policy change metadata present on the reviewed exception.
+     */
+    appliedPolicyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Optional runtime override expiration timestamp (RFC3339).
+     */
+    overrideExpiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Optional owner metadata used when synthesizing policy artifacts.
+     */
+    owner?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy change override JSON payload.
+     */
+    policyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    requestId?: pulumi.Input<string | undefined>;
+    /**
+     * Review outcome: approve, deny, request_changes, approve_with_modification.
+     */
+    reviewDecision?: pulumi.Input<string | undefined>;
+    /**
+     * Optional review notes.
+     */
+    reviewNotes?: pulumi.Input<string | undefined>;
+    /**
+     * Reviewer identity.
+     */
+    reviewedBy?: pulumi.Input<string | undefined>;
+    /**
+     * Resulting policy exception status.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * Optional target environment (for example prod or staging).
+     */
+    targetEnvironment?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Updated timestamp after review.
+     */
+    updatedAt?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PolicyExceptionReview resource.
+ */
+export interface PolicyExceptionReviewArgs {
+    /**
+     * Optional runtime override expiration timestamp (RFC3339).
+     */
+    overrideExpiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Optional owner metadata used when synthesizing policy artifacts.
+     */
+    owner?: pulumi.Input<string | undefined>;
+    /**
+     * Optional policy change override JSON payload.
+     */
+    policyChangeJson?: pulumi.Input<string | undefined>;
+    /**
+     * Policy exception request ID.
+     */
+    requestId: pulumi.Input<string>;
+    /**
+     * Review outcome: approve, deny, request_changes, approve_with_modification.
+     */
+    reviewDecision: pulumi.Input<string>;
+    /**
+     * Optional review notes.
+     */
+    reviewNotes?: pulumi.Input<string | undefined>;
+    /**
+     * Reviewer identity.
+     */
+    reviewedBy: pulumi.Input<string>;
+    /**
+     * Optional target environment (for example prod or staging).
+     */
+    targetEnvironment?: pulumi.Input<string | undefined>;
+}

package/mcp/getInventoryDigest.ts

@@ -0,0 +1,51 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getInventoryDigest(args?: GetInventoryDigestArgs, opts?: pulumi.InvokeOptions): Promise<GetInventoryDigestResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:mcp/getInventoryDigest:getInventoryDigest", {
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInventoryDigest.
+ */
+export interface GetInventoryDigestArgs {
+    windowHours?: number;
+}
+
+/**
+ * A collection of values returned by getInventoryDigest.
+ */
+export interface GetInventoryDigestResult {
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly recommendedActions: string[];
+    readonly responseJson: string;
+    readonly topUnapprovedEndpointsJson: string;
+    readonly totalEndpoints: number;
+    readonly unapprovedCalls: number;
+    readonly unapprovedEndpoints: number;
+    readonly windowHours: number;
+}
+export function getInventoryDigestOutput(args?: GetInventoryDigestOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetInventoryDigestResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:mcp/getInventoryDigest:getInventoryDigest", {
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getInventoryDigest.
+ */
+export interface GetInventoryDigestOutputArgs {
+    windowHours?: pulumi.Input<number | undefined>;
+}

package/mcp/index.ts

@@ -10,6 +10,11 @@ export type CatalogVerify = import("./catalogVerify").CatalogVerify;
 export const CatalogVerify: typeof import("./catalogVerify").CatalogVerify = null as any;
 utilities.lazyLoad(exports, ["CatalogVerify"], () => require("./catalogVerify"));
 
+export { GetInventoryDigestArgs, GetInventoryDigestResult, GetInventoryDigestOutputArgs } from "./getInventoryDigest";
+export const getInventoryDigest: typeof import("./getInventoryDigest").getInventoryDigest = null as any;
+export const getInventoryDigestOutput: typeof import("./getInventoryDigest").getInventoryDigestOutput = null as any;
+utilities.lazyLoad(exports, ["getInventoryDigest","getInventoryDigestOutput"], () => require("./getInventoryDigest"));
+
 export { GetInventoryReportArgs, GetInventoryReportResult, GetInventoryReportOutputArgs } from "./getInventoryReport";
 export const getInventoryReport: typeof import("./getInventoryReport").getInventoryReport = null as any;
 export const getInventoryReportOutput: typeof import("./getInventoryReport").getInventoryReportOutput = null as any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atensec/pulumi-thoth",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
   "keywords": [
     "pulumi",
@@ -24,6 +24,7 @@
   },
   "pulumi": {
     "resource": true,
-    "name": "thoth"
+    "name": "thoth",
+    "server": "github://api.github.com/atensecurity/pulumi-thoth"
   }
 }

package/tsconfig.json

@@ -58,6 +58,7 @@
         "governance/evidenceBackfill.ts",
         "governance/getAgentLatestForensics.ts",
         "governance/getApprovals.ts",
+        "governance/getBoardIncidentSummary.ts",
         "governance/getCostReport.ts",
         "governance/getDay7Report.ts",
         "governance/getEffectivePolicyBundles.ts",
@@ -65,12 +66,17 @@
         "governance/getEvidenceChain.ts",
         "governance/getEvidenceSlos.ts",
         "governance/getEvidenceVerify.ts",
+        "governance/getExecutiveSummary.ts",
         "governance/getFeed.ts",
         "governance/getIncidentForensics.ts",
         "governance/getPackRuleVersions.ts",
         "governance/getPackRules.ts",
         "governance/getPacks.ts",
         "governance/getPolicyBundles.ts",
+        "governance/getPolicyChangeArtifact.ts",
+        "governance/getPolicyChangeArtifacts.ts",
+        "governance/getPolicyException.ts",
+        "governance/getPolicyExceptions.ts",
         "governance/getReportData.ts",
         "governance/getReportsOverview.ts",
         "governance/getRuntimeStatus.ts",
@@ -83,12 +89,16 @@
         "governance/packAssignmentBulk.ts",
         "governance/pamSettings.ts",
         "governance/policyBundle.ts",
+        "governance/policyChangeArtifactApply.ts",
+        "governance/policyException.ts",
+        "governance/policyExceptionReview.ts",
         "governance/policySync.ts",
         "governance/siemSettings.ts",
         "governance/webhookSettings.ts",
         "governance/webhookTest.ts",
         "index.ts",
         "mcp/catalogVerify.ts",
+        "mcp/getInventoryDigest.ts",
         "mcp/getInventoryReport.ts",
         "mcp/getVendor.ts",
         "mcp/getVendors.ts",

package/utilities.ts

@@ -53,7 +53,7 @@ export function getVersion(): string {
 
 /** @internal */
 export function resourceOptsDefaults(): any {
-    return { version: getVersion() };
+    return { version: getVersion(), pluginDownloadURL: "github://api.github.com/atensecurity/pulumi-thoth" };
 }
 
 /** @internal */