@atlasauth/backend 0.25.0 → 0.27.0

package/dist/client/app-catalog.d.ts

@@ -10,6 +10,8 @@ export interface AppPreset {
     verified: boolean;
     /** The vendor SSO documentation the values come from. */
     source_url: string | null;
+    /** A private preset of this instance. */
+    custom?: boolean;
     params: Array<{
         key: string;
         label: string;
@@ -38,6 +40,20 @@ export interface InstalledApp {
     allowed_email_domains: string[];
     assignment: Required<AppAssignment>;
 }
+export type AppRequestStatus = 'open' | 'building' | 'available' | 'declined';
+export interface AppRequest {
+    object: 'app_request';
+    id: string;
+    name: string;
+    protocol: 'saml' | 'oidc';
+    docs_url: string | null;
+    note: string | null;
+    status: AppRequestStatus;
+    requested_by: string | null;
+    votes: number;
+    created_at: number;
+    updated_at: number;
+}
 export interface InstallAppBody {
     params?: Record<string, string>;
     installed_id?: string;
@@ -48,9 +64,52 @@ export interface InstallAppBody {
 /** The app catalog: SAML and OpenID Connect presets, installs, and who may open each app. */
 export declare function appCatalogResource(request: RequestFn): {
     /** `GET /v1/app_catalog` — every preset with its protocol and parameters. */
-    presets(): Promise<{
+    presets(query?: {
+        q?: string;
+        category?: string;
+        protocol?: "saml" | "oidc";
+        verified?: boolean;
+        limit?: number;
+        offset?: number;
+    }): Promise<{
         object: "list";
         data: AppPreset[];
+        total: number;
+        has_more: boolean;
+    }>;
+    /** `GET /v1/app_catalog/custom_presets` — this instance's private presets in portable form. */
+    customPresets(): Promise<{
+        object: "list";
+        data: Array<Record<string, unknown>>;
+    }>;
+    /** `POST /v1/app_catalog/custom_presets` — save (or replace) a private SAML preset. */
+    saveCustomPreset(preset: Record<string, unknown>): Promise<Record<string, unknown>>;
+    deleteCustomPreset(id: string): Promise<{
+        object: "app_custom_preset";
+        id: string;
+        deleted: true;
+    }>;
+    /** `GET /v1/app_catalog/requests` — apps people asked for, most wanted first. */
+    requests(status?: AppRequestStatus): Promise<{
+        object: "list";
+        data: AppRequest[];
+    }>;
+    /** `POST /v1/app_catalog/requests` — ask for an app; asking again for an open one adds a vote. */
+    requestApp(body: {
+        name: string;
+        protocol?: "saml" | "oidc";
+        docs_url?: string;
+        note?: string;
+        requested_by?: string;
+    }): Promise<AppRequest>;
+    updateRequest(id: string, body: {
+        status?: AppRequestStatus;
+        note?: string;
+    }): Promise<AppRequest>;
+    deleteRequest(id: string): Promise<{
+        object: "app_request";
+        id: string;
+        deleted: true;
     }>;
     /** `GET /v1/app_catalog/installed` */
     installed(): Promise<{

package/dist/client/app-catalog.js

@@ -6,8 +6,38 @@ const request_1 = require("./request");
 function appCatalogResource(request) {
     return {
         /** `GET /v1/app_catalog` — every preset with its protocol and parameters. */
-        presets() {
-            return request({ method: 'GET', path: '/v1/app_catalog' });
+        presets(query = {}) {
+            const p = new URLSearchParams();
+            for (const [k, v] of Object.entries(query))
+                if (v !== undefined)
+                    p.set(k, String(v));
+            const qs = p.toString();
+            return request({ method: 'GET', path: `/v1/app_catalog${qs ? `?${qs}` : ''}` });
+        },
+        /** `GET /v1/app_catalog/custom_presets` — this instance's private presets in portable form. */
+        customPresets() {
+            return request({ method: 'GET', path: '/v1/app_catalog/custom_presets' });
+        },
+        /** `POST /v1/app_catalog/custom_presets` — save (or replace) a private SAML preset. */
+        saveCustomPreset(preset) {
+            return request({ method: 'POST', path: '/v1/app_catalog/custom_presets', body: { preset } });
+        },
+        deleteCustomPreset(id) {
+            return request({ method: 'DELETE', path: `/v1/app_catalog/custom_presets/${(0, request_1.enc)(id)}` });
+        },
+        /** `GET /v1/app_catalog/requests` — apps people asked for, most wanted first. */
+        requests(status) {
+            return request({ method: 'GET', path: `/v1/app_catalog/requests${status ? `?status=${status}` : ''}` });
+        },
+        /** `POST /v1/app_catalog/requests` — ask for an app; asking again for an open one adds a vote. */
+        requestApp(body) {
+            return request({ method: 'POST', path: '/v1/app_catalog/requests', body });
+        },
+        updateRequest(id, body) {
+            return request({ method: 'PATCH', path: `/v1/app_catalog/requests/${(0, request_1.enc)(id)}`, body });
+        },
+        deleteRequest(id) {
+            return request({ method: 'DELETE', path: `/v1/app_catalog/requests/${(0, request_1.enc)(id)}` });
         },
         /** `GET /v1/app_catalog/installed` */
         installed() {

package/dist/client/app-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-catalog.js","sourceRoot":"","sources":["../../src/client/app-catalog.ts"],"names":[],"mappings":";;AAkDA,gDAuBC;AAzED,uCAAgD;AAiDhD,6FAA6F;AAC7F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,6EAA6E;QAC7E,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,sCAAsC;QACtC,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,yGAAyG;QACzG,OAAO,CAAC,QAAgB,EAAE,OAAuB,EAAE,EAAE,cAAuB;YAC1E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,EAAU,EAAE,IAA2E;YAC5F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,6CAA6C;QAC7C,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"app-catalog.js","sourceRoot":"","sources":["../../src/client/app-catalog.ts"],"names":[],"mappings":";;AAmEA,gDAmDC;AAtHD,uCAAgD;AAkEhD,6FAA6F;AAC7F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,6EAA6E;QAC7E,OAAO,CAAC,QAA4H,EAAE;YACpI,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,SAAS;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+FAA+F;QAC/F,aAAa;YACX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA+B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,iFAAiF;QACjF,QAAQ,CAAC,MAAyB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,kGAAkG;QAClG,UAAU,CAAC,IAA2G;YACpH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,IAAkD;YAC1E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,sCAAsC;QACtC,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,yGAAyG;QACzG,OAAO,CAAC,QAAgB,EAAE,OAAuB,EAAE,EAAE,cAAuB;YAC1E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,EAAU,EAAE,IAA2E;YAC5F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,6CAA6C;QAC7C,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/authz-decisions.d.ts

@@ -0,0 +1,154 @@
+import { type RequestFn } from './request';
+/**
+ * The authorization decision log: every ABAC, AuthZEN, FGA-check and
+ * access-policy decision can be recorded with its (redacted) input, result, the
+ * policy revision in force and latency — sampled, shipped as `authz.decision`
+ * events to your log streams, and queryable here.
+ */
+export type DecisionSource = 'abac' | 'authzen' | 'fga' | 'access_policy' | 'mcp_gateway';
+export interface AuthzDecision {
+    object: 'authz_decision';
+    id: string;
+    source: DecisionSource;
+    decision: 'allow' | 'deny';
+    /** `Type::id` (ABAC / AuthZEN), the FGA user, or the user id (access policies). */
+    principal: string | null;
+    /** The action, the FGA relation, or the access-policy stage. */
+    action: string | null;
+    resource: string | null;
+    /** The request as kept by `input_mode`; null when capture keeps none. */
+    input: Record<string, unknown> | null;
+    /** Reasons (policy names), matched policies, error counts, FGA `allowed` / `cached`. */
+    result: Record<string, unknown>;
+    /** The signed-bundle revision in force (`rev_…`); access policies carry an `ap_…` digest. */
+    policy_revision: string | null;
+    /** The exact policy versions or FGA model that evaluated. */
+    policy_version: Record<string, unknown> | null;
+    latency_ms: number;
+    /** The probability this decision was kept at; divide counts by it for the true volume. */
+    sample_rate: number;
+    actor_id: string | null;
+    created_at: number;
+}
+export interface ListAuthzDecisionsParams {
+    source?: DecisionSource;
+    decision?: 'allow' | 'deny';
+    principal?: string;
+    action?: string;
+    resource?: string;
+    policy_revision?: string;
+    /** ISO 8601 or epoch milliseconds. */
+    since?: string | number;
+    until?: string | number;
+    /** 1–200; default 50. */
+    limit?: number;
+    starting_after?: string;
+}
+export interface AuthzDecisionPage {
+    object: 'list';
+    data: AuthzDecision[];
+    has_more: boolean;
+    /** Pass as `starting_after` for the next page. */
+    next_cursor: string | null;
+}
+export interface AuthzDecisionStats {
+    object: 'authz_decision_stats';
+    since: number;
+    until: number;
+    recorded: number;
+    /** Recorded decisions scaled back up by their sample rates. */
+    estimated_total: number;
+    by_source: Record<string, {
+        allow: number;
+        deny: number;
+        estimated_allow: number;
+        estimated_deny: number;
+    }>;
+    latency_ms: {
+        p50: number | null;
+        p95: number | null;
+        p99: number | null;
+        max: number | null;
+    };
+}
+export interface AuthzDecisionSettings {
+    object: 'authz_decision_settings';
+    /** Record decisions. Off by default. */
+    enabled: boolean;
+    /** Probability (0–1) an allow is recorded. */
+    sample_rate_allow: number;
+    /** Probability (0–1) a deny is recorded. */
+    sample_rate_deny: number;
+    /** `ids` keeps identifiers only; `full` keeps the request minus `redact`; `none` keeps no input. */
+    input_mode: 'ids' | 'full' | 'none';
+    /** Dotted paths blanked in `full` mode; `*` matches one segment. */
+    redact: string[];
+    /** Also emit each recorded decision as an `authz.decision` event. */
+    ship_to_events: boolean;
+    /** Days to keep decisions; null keeps them. */
+    retention_days: number | null;
+}
+export type UpdateAuthzDecisionSettingsBody = Partial<Omit<AuthzDecisionSettings, 'object'>>;
+export declare function authzDecisionsResource(request: RequestFn): {
+    /** Query the decision log, newest first. */
+    list(params?: ListAuthzDecisionsParams): Promise<AuthzDecisionPage>;
+    /** Follow `next_cursor` and yield every matching decision. */
+    iterate(params?: Omit<ListAuthzDecisionsParams, "starting_after">): AsyncGenerator<AuthzDecision>;
+    get(id: string): Promise<AuthzDecision>;
+    /** Counts per engine and outcome, sampling-corrected, with latency percentiles (the last 24 hours by default). */
+    stats(params?: {
+        since?: string | number;
+        until?: string | number;
+    }): Promise<AuthzDecisionStats>;
+    /** A local PDP ships a batch of decisions (max 500) and checks in; also its heartbeat. */
+    ingest(body: {
+        pdp: {
+            id: string;
+            name?: string;
+            version?: string;
+            bundle_revision?: string;
+        };
+        decisions?: Array<{
+            decision: "allow" | "deny";
+            principal?: string;
+            action?: string;
+            resource?: string;
+            input?: Record<string, unknown>;
+            result?: Record<string, unknown>;
+            latency_ms?: number;
+        }>;
+    }): Promise<{
+        object: "authz_decision_ingest";
+        accepted: number;
+        enabled: boolean;
+        pdp: AuthzPdp;
+    }>;
+    /** The fleet of local PDPs that have checked in. */
+    pdps: {
+        list(): Promise<{
+            object: "list";
+            data: AuthzPdp[];
+            has_more: boolean;
+        }>;
+        remove(id: string): Promise<{
+            object: "authz_pdp";
+            id: string;
+            deleted: boolean;
+        }>;
+    };
+    settings: {
+        get(): Promise<AuthzDecisionSettings>;
+        /** Fields you omit keep their value. */
+        update(body: UpdateAuthzDecisionSettingsBody): Promise<AuthzDecisionSettings>;
+    };
+};
+export interface AuthzPdp {
+    object: 'authz_pdp';
+    id: string;
+    name: string | null;
+    version: string | null;
+    bundle_revision: string | null;
+    decisions_total: number;
+    first_seen_at: number;
+    last_seen_at: number;
+}

package/dist/client/authz-decisions.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authzDecisionsResource = authzDecisionsResource;
+const request_1 = require("./request");
+function authzDecisionsResource(request) {
+    return {
+        /** Query the decision log, newest first. */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/authz_decisions', query: { ...params } });
+        },
+        /** Follow `next_cursor` and yield every matching decision. */
+        async *iterate(params = {}) {
+            let after;
+            for (;;) {
+                const page = await this.list({ ...params, starting_after: after });
+                yield* page.data;
+                if (!page.has_more || !page.next_cursor)
+                    return;
+                after = page.next_cursor;
+            }
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/authz_decisions/${(0, request_1.enc)(id)}` });
+        },
+        /** Counts per engine and outcome, sampling-corrected, with latency percentiles (the last 24 hours by default). */
+        stats(params = {}) {
+            return request({ method: 'GET', path: '/v1/authz_decisions/stats', query: { ...params } });
+        },
+        /** A local PDP ships a batch of decisions (max 500) and checks in; also its heartbeat. */
+        ingest(body) {
+            return request({ method: 'POST', path: '/v1/authz_decisions/ingest', body });
+        },
+        /** The fleet of local PDPs that have checked in. */
+        pdps: {
+            list() {
+                return request({ method: 'GET', path: '/v1/authz_pdps' });
+            },
+            remove(id) {
+                return request({ method: 'DELETE', path: `/v1/authz_pdps/${(0, request_1.enc)(id)}` });
+            },
+        },
+        settings: {
+            get() {
+                return request({ method: 'GET', path: '/v1/authz_decision_settings' });
+            },
+            /** Fields you omit keep their value. */
+            update(body) {
+                return request({ method: 'PUT', path: '/v1/authz_decision_settings', body });
+            },
+        },
+    };
+}
+//# sourceMappingURL=authz-decisions.js.map

package/dist/client/authz-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-decisions.js","sourceRoot":"","sources":["../../src/client/authz-decisions.ts"],"names":[],"mappings":";;AA0FA,wDA8CC;AAxID,uCAAgD;AA0FhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,4CAA4C;QAC5C,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,8DAA8D;QAC9D,KAAK,CAAC,CAAC,OAAO,CAAC,SAA2D,EAAE;YAC1E,IAAI,KAAyB,CAAC;YAC9B,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,OAAO;gBAChD,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,kHAAkH;QAClH,KAAK,CAAC,SAA+D,EAAE;YACrE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,0FAA0F;QAC1F,MAAM,CAAC,IAA2R;YAChS,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,oDAAoD;QACpD,IAAI,EAAE;YACJ,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF;QACD,QAAQ,EAAE;YACR,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,wCAAwC;YACxC,MAAM,CAAC,IAAqC;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}