@atlasauth/backend 0.25.0 → 0.27.0

package/dist/client/risk-containment.d.ts

@@ -0,0 +1,244 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type RiskyUserState = 'none' | 'at_risk' | 'confirmed_compromised' | 'dismissed' | 'remediated';
+export interface RiskyUser {
+    object: 'risky_user';
+    user_id: string;
+    state: RiskyUserState;
+    level: 'low' | 'medium' | 'high';
+    /** Cumulative score; halves every 72 hours. */
+    score: number;
+    reasons: string[];
+    last_event_at: number | null;
+    resolved_by: string | null;
+    resolved_at: number | null;
+    updated_at: number;
+}
+export interface UserContainment {
+    object: 'user_containment';
+    id: string;
+    user_id: string;
+    state: 'contained' | 'released';
+    reason: string | null;
+    source: string;
+    /** What containment revoked: sessions, api_tokens, api_keys, agent_grants, device_keys, desktop_devices, remembered_devices, temporary_passes. */
+    revoked: Record<string, number>;
+    contained_by: string | null;
+    released_by: string | null;
+    created_at: number;
+    released_at: number | null;
+    already_contained?: boolean;
+}
+export interface MfaFactorQuarantine {
+    object: 'mfa_factor_quarantine';
+    id: string;
+    user_id: string;
+    factor_type: string;
+    factor_id: string;
+    reason: string | null;
+    until: number;
+    released_at: number | null;
+    created_at: number;
+}
+export interface TemporaryAccessPass {
+    object: 'temporary_access_pass';
+    id: string;
+    user_id: string;
+    expires_at: number;
+    uses_left: number;
+    require_enrolment: boolean;
+    bound_ip: string | null;
+    issued_by: string | null;
+    reason: string | null;
+    last_used_at: number | null;
+    created_at: number;
+}
+export interface CreateTemporaryAccessBody {
+    /** 60 to 604800; default 3600. */
+    lifetime_seconds?: number;
+    /** Default true (one use). */
+    one_time?: boolean;
+    /** 1 to 100 uses when `one_time` is false; default 5. */
+    uses?: number;
+    /** Make the user register a passkey or second factor after signing in; default true. */
+    require_enrolment?: boolean;
+    bound_ip?: string;
+    reason?: string;
+}
+/** Risky-user lifecycle, one-action account containment and risky-factor quarantine. */
+export declare function riskResource(request: RequestFn): {
+    riskyUsers: {
+        list(query?: {
+            state?: Exclude<RiskyUserState, "none">;
+            limit?: number;
+        }): Promise<ListPage<RiskyUser>>;
+        get(userId: string): Promise<RiskyUser>;
+        dismiss(userId: string): Promise<RiskyUser>;
+        confirm(userId: string): Promise<RiskyUser>;
+        remediate(userId: string): Promise<RiskyUser>;
+        forcePasswordChange(userId: string): Promise<{
+            object: "risk_remediation";
+            user_id: string;
+            action: string;
+            sessions_revoked: number;
+        }>;
+        forceReauth(userId: string): Promise<{
+            object: "risk_remediation";
+            user_id: string;
+            action: string;
+            sessions_revoked: number;
+        }>;
+    };
+    containment: {
+        /** Contain an account: sign-in disabled, password invalidated, sessions, tokens, keys and devices revoked. */
+        contain(userId: string, body?: {
+            reason?: string;
+        }): Promise<UserContainment>;
+        release(userId: string): Promise<UserContainment>;
+        list(query?: {
+            user_id?: string;
+        }): Promise<ListPage<UserContainment>>;
+    };
+    factorQuarantines: {
+        list(query?: {
+            user_id?: string;
+            active?: boolean;
+        }): Promise<ListPage<MfaFactorQuarantine>>;
+        release(id: string): Promise<MfaFactorQuarantine>;
+    };
+};
+/** Temporary access passes (`users.createTemporaryAccess`). */
+export declare function temporaryAccessResource(request: RequestFn): {
+    /** Issue a pass. The `code` is in this response only. */
+    create(userId: string, body?: CreateTemporaryAccessBody): Promise<TemporaryAccessPass & {
+        code: string;
+    }>;
+    list(userId: string): Promise<ListPage<TemporaryAccessPass>>;
+    revoke(userId: string, passId: string): Promise<{
+        object: "temporary_access_pass";
+        id: string;
+        deleted: true;
+    }>;
+};
+export interface EmailRiskResult {
+    object: 'email_risk';
+    verdict: 'allow' | 'review' | 'block';
+    score: number;
+    reasons: string[];
+    email_domain: string;
+    mode: string;
+    checks: {
+        syntax: boolean;
+        disposable: boolean;
+        role_account: boolean;
+        mx: boolean | null;
+        suppressed: boolean;
+        mailbox: Record<string, unknown> | null;
+    };
+}
+export interface EmailRiskSettings {
+    object: 'email_risk_settings';
+    mode: 'off' | 'mx' | 'provider';
+    provider: 'zerobounce' | 'kickbox' | null;
+    has_credentials: boolean;
+    block_disposable: boolean;
+    block_suppressed: boolean;
+    block_undeliverable: boolean;
+    block_role: boolean;
+    gate_sign_up: boolean;
+    updated_at: number | null;
+}
+export interface EmailSuppression {
+    object: 'email_suppression';
+    id: string;
+    email: string;
+    reason: string;
+    source: string;
+    detail: string | null;
+    created_at: number;
+}
+/** Email risk (`POST /v1/fraud/email_risk`) and the suppression list. */
+export declare function emailRiskResource(request: RequestFn): {
+    check(body: {
+        email: string;
+        ip?: string;
+        verify_mailbox?: boolean;
+    }): Promise<EmailRiskResult>;
+    settings(): Promise<EmailRiskSettings>;
+    updateSettings(body: {
+        mode?: "off" | "mx" | "provider";
+        provider?: "zerobounce" | "kickbox" | null;
+        /** Write-only: `{ apiKey, region? }` for your own account, or null to clear. */
+        credentials?: {
+            apiKey: string;
+            region?: "us" | "eu";
+        } | null;
+        block_disposable?: boolean;
+        block_suppressed?: boolean;
+        block_undeliverable?: boolean;
+        block_role?: boolean;
+        gate_sign_up?: boolean;
+    }): Promise<EmailRiskSettings>;
+    suppressions: {
+        list(query?: {
+            email?: string;
+            limit?: number;
+            after?: string;
+        }): Promise<ListPage<EmailSuppression>>;
+        add(body: {
+            email?: string;
+            emails?: string[];
+            reason?: "hard_bounce" | "complaint" | "unsubscribe" | "manual" | "invalid";
+            source?: string;
+            detail?: string;
+        }): Promise<ListPage<EmailSuppression>>;
+        remove(email: string): Promise<{
+            object: "email_suppression";
+            email: string;
+            deleted: true;
+        }>;
+    };
+};
+export interface AuthenticatorPolicy {
+    object: 'authenticator_policy';
+    id: string;
+    name: string;
+    group: string;
+    enabled: boolean;
+    required_factors: Array<'totp' | 'sms' | 'passkey' | 'push'>;
+    grace_until: number | null;
+    passkey: {
+        requireUserVerification?: boolean;
+        attestation?: 'none' | 'indirect' | 'direct' | null;
+        attachment?: 'any' | 'platform' | 'cross-platform' | null;
+        allowlist?: string[];
+        blocklist?: string[];
+    };
+    created_at: number;
+    updated_at: number;
+}
+export type AuthenticatorPolicyBody = Partial<Pick<AuthenticatorPolicy, 'name' | 'group' | 'enabled' | 'required_factors' | 'grace_until' | 'passkey'>>;
+/** Group-targeted authenticator policies: required factors with an enrolment grace window and passkey profiles. */
+export declare function authenticatorPoliciesResource(request: RequestFn): {
+    list(): Promise<ListPage<AuthenticatorPolicy>>;
+    get(id: string): Promise<AuthenticatorPolicy>;
+    create(body: AuthenticatorPolicyBody & {
+        name: string;
+        group: string;
+    }): Promise<AuthenticatorPolicy>;
+    update(id: string, body: AuthenticatorPolicyBody): Promise<AuthenticatorPolicy>;
+    delete(id: string): Promise<{
+        object: "authenticator_policy";
+        id: string;
+        deleted: true;
+    }>;
+    /** The combined rules that apply to one user through their groups. */
+    effective(userId: string): Promise<{
+        object: "effective_authenticator_rules";
+        user_id: string;
+        required_factors: string[];
+        in_grace: boolean;
+        passkey: Record<string, unknown>;
+        matched_policies: string[];
+    }>;
+};

package/dist/client/risk-containment.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.riskResource = riskResource;
+exports.temporaryAccessResource = temporaryAccessResource;
+exports.emailRiskResource = emailRiskResource;
+exports.authenticatorPoliciesResource = authenticatorPoliciesResource;
+const request_1 = require("./request");
+/** Risky-user lifecycle, one-action account containment and risky-factor quarantine. */
+function riskResource(request) {
+    return {
+        riskyUsers: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/risky_users', query });
+            },
+            get(userId) {
+                return request({ method: 'GET', path: `/v1/risky_users/${(0, request_1.enc)(userId)}` });
+            },
+            dismiss(userId) {
+                return request({ method: 'POST', path: `/v1/risky_users/${(0, request_1.enc)(userId)}/dismiss`, body: {} });
+            },
+            confirm(userId) {
+                return request({ method: 'POST', path: `/v1/risky_users/${(0, request_1.enc)(userId)}/confirm`, body: {} });
+            },
+            remediate(userId) {
+                return request({ method: 'POST', path: `/v1/risky_users/${(0, request_1.enc)(userId)}/remediate`, body: {} });
+            },
+            forcePasswordChange(userId) {
+                return request({ method: 'POST', path: `/v1/risky_users/${(0, request_1.enc)(userId)}/force_password_change`, body: {} });
+            },
+            forceReauth(userId) {
+                return request({ method: 'POST', path: `/v1/risky_users/${(0, request_1.enc)(userId)}/force_reauth`, body: {} });
+            },
+        },
+        containment: {
+            /** Contain an account: sign-in disabled, password invalidated, sessions, tokens, keys and devices revoked. */
+            contain(userId, body = {}) {
+                return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/contain`, body });
+            },
+            release(userId) {
+                return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/release`, body: {} });
+            },
+            list(query = {}) {
+                return request({ method: 'GET', path: `/v1/containments${query.user_id ? `?user_id=${(0, request_1.enc)(query.user_id)}` : ''}` });
+            },
+        },
+        factorQuarantines: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/mfa_factor_quarantines', query });
+            },
+            release(id) {
+                return request({ method: 'POST', path: `/v1/mfa_factor_quarantines/${(0, request_1.enc)(id)}/release`, body: {} });
+            },
+        },
+    };
+}
+/** Temporary access passes (`users.createTemporaryAccess`). */
+function temporaryAccessResource(request) {
+    return {
+        /** Issue a pass. The `code` is in this response only. */
+        create(userId, body = {}) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/temporary_access`, body });
+        },
+        list(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/temporary_access` });
+        },
+        revoke(userId, passId) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/temporary_access/${(0, request_1.enc)(passId)}` });
+        },
+    };
+}
+/** Email risk (`POST /v1/fraud/email_risk`) and the suppression list. */
+function emailRiskResource(request) {
+    return {
+        check(body) {
+            return request({ method: 'POST', path: '/v1/fraud/email_risk', body });
+        },
+        settings() {
+            return request({ method: 'GET', path: '/v1/fraud/email_risk/settings' });
+        },
+        updateSettings(body) {
+            return request({ method: 'PUT', path: '/v1/fraud/email_risk/settings', body });
+        },
+        suppressions: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/messaging/suppressions', query });
+            },
+            add(body) {
+                return request({ method: 'POST', path: '/v1/messaging/suppressions', body });
+            },
+            remove(email) {
+                return request({ method: 'DELETE', path: `/v1/messaging/suppressions/${(0, request_1.enc)(email)}` });
+            },
+        },
+    };
+}
+/** Group-targeted authenticator policies: required factors with an enrolment grace window and passkey profiles. */
+function authenticatorPoliciesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/authenticator_policies' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/authenticator_policies/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/authenticator_policies', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/authenticator_policies/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/authenticator_policies/${(0, request_1.enc)(id)}` });
+        },
+        /** The combined rules that apply to one user through their groups. */
+        effective(userId) {
+            return request({ method: 'GET', path: `/v1/authenticator_policies/effective/${(0, request_1.enc)(userId)}` });
+        },
+    };
+}
+//# sourceMappingURL=risk-containment.js.map

package/dist/client/risk-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-containment.js","sourceRoot":"","sources":["../../src/client/risk-containment.ts"],"names":[],"mappings":";;AA2EA,oCA8CC;AAGD,0DAaC;AAoCD,8CAiCC;AAkBD,sEAsBC;AAtPD,uCAAgD;AA0EhD,wFAAwF;AACxF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,UAAU,EAAE;YACV,IAAI,CAAC,QAAqE,EAAE;gBAC1E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,MAAc;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,CAAC,MAAc;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,CAAC,MAAc;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,SAAS,CAAC,MAAc;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,mBAAmB,CAAC,MAAc;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,WAAW,CAAC,MAAc;gBACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;SACF;QACD,WAAW,EAAE;YACX,8GAA8G;YAC9G,OAAO,CAAC,MAAc,EAAE,OAA4B,EAAE;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,OAAO,CAAC,MAAc;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,IAAA,aAAG,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACtH,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,IAAI,CAAC,QAAgD,EAAE;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,yDAAyD;QACzD,MAAM,CAAC,MAAc,EAAE,OAAkC,EAAE;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,MAAc;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,MAAc,EAAE,MAAc;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;KACF,CAAC;AACJ,CAAC;AAmCD,yEAAyE;AACzE,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,KAAK,CAAC,IAA8D;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,cAAc,CAAC,IAUd;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,YAAY,EAAE;YACZ,IAAI,CAAC,QAA4D,EAAE;gBACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAA0J;gBAC5J,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,CAAC,KAAa;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAiBD,mHAAmH;AACnH,SAAgB,6BAA6B,CAAC,OAAkB;IAC9D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,IAA+D;YACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sEAAsE;QACtE,SAAS,CAAC,MAAc;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wCAAwC,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/saml-idp.d.ts

@@ -0,0 +1,183 @@
+import { type RequestFn } from './request';
+export type SamlNameIdFormat = 'emailAddress' | 'persistent' | 'transient' | 'unspecified';
+/** A SAML service provider Atlas issues assertions to, with its depth settings. */
+export interface SamlIdpServiceProvider {
+    object: 'saml_idp_service_provider';
+    id: string;
+    name: string;
+    entity_id: string;
+    acs_url: string;
+    acs_urls: string[];
+    name_id_format: SamlNameIdFormat;
+    name_id_field: 'email' | 'user_id';
+    attributes: Record<string, string>;
+    encrypt_assertions: boolean;
+    has_encryption_cert: boolean;
+    signing_cert_count: number;
+    require_signed_requests: boolean;
+    signature_algorithm: 'rsa-sha256' | 'rsa-sha384' | 'rsa-sha512';
+    digest_algorithm: 'sha256' | 'sha384' | 'sha512';
+    sign_response: boolean;
+    artifact_binding: boolean;
+    ecp: boolean;
+    attribute_query: boolean;
+    slo_url: string | null;
+    slo_binding: 'redirect' | 'post' | 'soap' | null;
+    authn_context_class_ref: string | null;
+    assertion_lifetime_seconds: number;
+}
+/** Any of these; `null` clears an optional setting. */
+export interface UpdateSamlIdpServiceProviderBody {
+    name?: string;
+    acs_urls?: string[];
+    name_id_format?: SamlNameIdFormat;
+    name_id_field?: 'email' | 'user_id';
+    attributes?: Record<string, string>;
+    encrypt_assertions?: boolean;
+    encryption_cert?: string | null;
+    signing_certs?: string[];
+    require_signed_requests?: boolean;
+    signature_algorithm?: 'rsa-sha256' | 'rsa-sha384' | 'rsa-sha512';
+    digest_algorithm?: 'sha256' | 'sha384' | 'sha512';
+    sign_response?: boolean;
+    artifact_binding?: boolean;
+    ecp?: boolean;
+    attribute_query?: boolean;
+    slo_url?: string | null;
+    slo_binding?: 'redirect' | 'post' | 'soap';
+    authn_context_class_ref?: string | null;
+    assertion_lifetime_seconds?: number | null;
+}
+export interface SamlIdpSpMetadata {
+    object: 'saml_idp_sp_metadata';
+    saved: boolean;
+    entity_id: string;
+    acs_url: string;
+    acs_urls: string[];
+    name_id_format: SamlNameIdFormat;
+    signing_certs: string[];
+    encryption_cert: string | null;
+    slo_url: string | null;
+    slo_binding: string | null;
+    authn_requests_signed: boolean;
+    want_assertions_signed: boolean;
+    requested_attributes: string[];
+    service_provider?: SamlIdpServiceProvider | null;
+}
+/** Atlas as a SAML identity provider: service-provider settings and metadata import. */
+export declare function samlIdpResource(request: RequestFn): {
+    /** `GET /v1/saml_idp/service_providers` */
+    list(): Promise<{
+        object: "list";
+        data: SamlIdpServiceProvider[];
+    }>;
+    /** `GET /v1/saml_idp/service_providers/:id` */
+    get(id: string): Promise<SamlIdpServiceProvider>;
+    /** `PATCH /v1/saml_idp/service_providers/:id` — NameID format, encryption, request signing, algorithms, logout. */
+    update(id: string, body: UpdateSamlIdpServiceProviderBody): Promise<SamlIdpServiceProvider>;
+    /** `POST /v1/saml_idp/service_providers/import_metadata` — preview, or save with `save_as`. */
+    importMetadata(body: {
+        metadata_xml?: string;
+        metadata_url?: string;
+        mdq_base_url?: string;
+        entity_id?: string;
+        federation_certificate?: string;
+        save_as?: string;
+        name?: string;
+    }): Promise<SamlIdpSpMetadata>;
+};
+export type CloudProvider = 'aws' | 'gcp' | 'azure';
+/** A cloud access target: an AWS account and role, a Google Cloud workforce pool, or an Azure trust. */
+export interface CloudAccessTarget {
+    object: 'cloud_access_target';
+    id: string;
+    provider: CloudProvider;
+    name: string;
+    config: Record<string, unknown>;
+    assignment: Record<string, unknown> | null;
+    launch_url: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CloudAccessSetup {
+    object: 'cloud_access_setup';
+    target_id: string;
+    provider: CloudProvider;
+    steps: string[];
+    snippets: Record<string, string>;
+    sources: string[];
+}
+/** Cloud access portal: account and role tiles for the launcher. */
+export declare function cloudAccessResource(request: RequestFn): {
+    list(provider?: CloudProvider): Promise<{
+        object: "list";
+        data: CloudAccessTarget[];
+    }>;
+    get(id: string): Promise<CloudAccessTarget>;
+    create(body: {
+        provider: CloudProvider;
+        name: string;
+        config: Record<string, unknown>;
+        assignment?: Record<string, unknown>;
+    }): Promise<CloudAccessTarget>;
+    update(id: string, body: {
+        name?: string;
+        config?: Record<string, unknown>;
+        assignment?: Record<string, unknown>;
+    }): Promise<CloudAccessTarget>;
+    delete(id: string): Promise<{
+        object: "cloud_access_target";
+        id: string;
+        deleted: true;
+    }>;
+    /** The commands and policy to apply on the cloud side. */
+    setup(id: string): Promise<CloudAccessSetup>;
+};
+/** A WS-Federation relying-party connection (sign people in through AD FS or another WS-Federation provider). */
+export interface WsFedConnection {
+    object: 'wsfed_connection';
+    id: string;
+    organization_id: string | null;
+    status: 'draft' | 'active' | 'disabled';
+    issuer: string | null;
+    passive_endpoint: string | null;
+    realm: string | null;
+    signing_certificate_count: number;
+    allowed_domains: string[];
+    attribute_mapping: Record<string, string>;
+    freshness_minutes: number | null;
+    auth_method: string | null;
+    /** Enter as the reply URL of the provider's relying-party trust. */
+    acs_url: string;
+    logout_start_url: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface WsFedConnectionBody {
+    organization_id?: string | null;
+    status?: 'draft' | 'active' | 'disabled';
+    metadata_url?: string;
+    metadata_xml?: string;
+    issuer?: string;
+    passive_endpoint?: string;
+    signing_certificates?: string;
+    realm?: string;
+    allowed_domains?: string[];
+    attribute_mapping?: Record<string, string> | null;
+    freshness_minutes?: number | null;
+    auth_method?: string | null;
+}
+export declare function wsfedConnectionsResource(request: RequestFn): {
+    list(): Promise<{
+        object: "list";
+        data: WsFedConnection[];
+    }>;
+    get(id: string): Promise<WsFedConnection>;
+    create(body: WsFedConnectionBody): Promise<WsFedConnection>;
+    update(id: string, body: WsFedConnectionBody): Promise<WsFedConnection>;
+    delete(id: string): Promise<{
+        object: "wsfed_connection";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/saml-idp.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.samlIdpResource = samlIdpResource;
+exports.cloudAccessResource = cloudAccessResource;
+exports.wsfedConnectionsResource = wsfedConnectionsResource;
+const request_1 = require("./request");
+/** Atlas as a SAML identity provider: service-provider settings and metadata import. */
+function samlIdpResource(request) {
+    return {
+        /** `GET /v1/saml_idp/service_providers` */
+        list() {
+            return request({ method: 'GET', path: '/v1/saml_idp/service_providers' });
+        },
+        /** `GET /v1/saml_idp/service_providers/:id` */
+        get(id) {
+            return request({ method: 'GET', path: `/v1/saml_idp/service_providers/${(0, request_1.enc)(id)}` });
+        },
+        /** `PATCH /v1/saml_idp/service_providers/:id` — NameID format, encryption, request signing, algorithms, logout. */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/saml_idp/service_providers/${(0, request_1.enc)(id)}`, body });
+        },
+        /** `POST /v1/saml_idp/service_providers/import_metadata` — preview, or save with `save_as`. */
+        importMetadata(body) {
+            return request({ method: 'POST', path: '/v1/saml_idp/service_providers/import_metadata', body });
+        },
+    };
+}
+/** Cloud access portal: account and role tiles for the launcher. */
+function cloudAccessResource(request) {
+    return {
+        list(provider) {
+            return request({ method: 'GET', path: `/v1/cloud_access/targets${provider ? `?provider=${provider}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/cloud_access/targets', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}` });
+        },
+        /** The commands and policy to apply on the cloud side. */
+        setup(id) {
+            return request({ method: 'GET', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}/setup` });
+        },
+    };
+}
+function wsfedConnectionsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/wsfed_connections' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/wsfed_connections/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/wsfed_connections', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/wsfed_connections/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/wsfed_connections/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=saml-idp.js.map

package/dist/client/saml-idp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-idp.js","sourceRoot":"","sources":["../../src/client/saml-idp.ts"],"names":[],"mappings":";;AAwEA,0CAmBC;AA2BD,kDAsBC;AAsCD,4DAkBC;AApMD,uCAAgD;AAuEhD,wFAAwF;AACxF,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,2CAA2C;QAC3C,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,+CAA+C;QAC/C,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,mHAAmH;QACnH,MAAM,CAAC,EAAU,EAAE,IAAsC;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kCAAkC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,+FAA+F;QAC/F,cAAc,CAAC,IAAmK;YAChL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gDAAgD,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC;AA0BD,oEAAoE;AACpE,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI,CAAC,QAAwB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,QAAQ,CAAC,CAAC,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA+F;YAChH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,0DAA0D;QAC1D,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AAsCD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}