@backblaze-labs/b2-sdk 0.2.0 → 0.4.0

package/dist/simulator/partner.cjs

@@ -0,0 +1,713 @@
+const require_ids = require("../types/ids.cjs");
+const require_auth = require("../types/auth.cjs");
+const require_partner = require("../types/partner.cjs");
+const require_partner_capabilities = require("./partner-capabilities.cjs");
+//#region src/simulator/partner.ts
+var DAY_MS = 864e5;
+var PARTNER_REGIONS = new Set(Object.values(require_partner.Region));
+var PARTNER_API_ENDPOINTS = new Set(require_partner_capabilities.PARTNER_ENDPOINT_NAMES);
+var DEFAULT_GROUP_COUNT = 3;
+var MAX_GROUPS_PER_ADMIN = 500;
+var DEFAULT_MAX_GROUP_COUNT = 100;
+var MAX_GROUP_COUNT = 100;
+var MAX_AUTO_PROVISIONED_ADMINS = 100;
+var MAX_GROUP_MEMBERS = 5e3;
+var DEFAULT_MAX_MEMBER_COUNT = 100;
+var MAX_MEMBER_COUNT = 1e3;
+var DEFAULT_MAX_COMPUTER_COUNT = 100;
+var MIN_COMPUTER_COUNT = 1;
+var MAX_COMPUTER_COUNT = 500;
+var DEFAULT_COMPUTER_COUNT = 3;
+var MAX_AUTO_PROVISIONED_BACKUP_ACCOUNTS = 100;
+var PARTNER_CREATED_STORAGE_KEY_CAPABILITIES = Object.freeze([
+	require_auth.Capability.ListBuckets,
+	require_auth.Capability.ReadBuckets,
+	require_auth.Capability.WriteBuckets,
+	require_auth.Capability.ListFiles,
+	require_auth.Capability.ReadFiles,
+	require_auth.Capability.WriteFiles,
+	require_auth.Capability.DeleteFiles
+]);
+function isPartnerApiEndpoint(endpoint) {
+	return PARTNER_API_ENDPOINTS.has(endpoint);
+}
+require_partner_capabilities.PartnerEndpoint.ListGroups, require_partner_capabilities.PartnerEndpoint.ListGroupMembers, require_partner_capabilities.PartnerEndpoint.ListComputers;
+function utcDateString(ms) {
+	return new Date(ms).toISOString().slice(0, 10);
+}
+function b2FriendlyTimestamp(ms) {
+	const date = new Date(ms);
+	const pad = (n, width = 2) => String(n).padStart(width, "0");
+	return `d${`${pad(date.getUTCFullYear(), 4)}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}`}_m${`${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}`}`;
+}
+function utcDayStartMs(ms) {
+	const date = new Date(ms);
+	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+}
+function requestObject(body) {
+	return typeof body === "object" && body !== null ? body : {};
+}
+function normalizeEmail(email) {
+	return email.trim().toLowerCase();
+}
+function isValidEmailAddress(email) {
+	const trimmed = email.trim();
+	if (trimmed !== email || trimmed.length < 3 || trimmed.length > 254) return false;
+	const at = trimmed.indexOf("@");
+	if (at <= 0 || at !== trimmed.lastIndexOf("@") || at === trimmed.length - 1) return false;
+	const domain = trimmed.slice(at + 1);
+	if (!domain.includes(".") || domain.startsWith(".") || domain.endsWith(".")) return false;
+	return !/\s/.test(trimmed);
+}
+function compareStrings(left, right) {
+	if (left < right) return -1;
+	if (left > right) return 1;
+	return 0;
+}
+function clonePartnerCapabilities(capabilities) {
+	return Object.freeze([...capabilities]);
+}
+/**
+* Handles Partner and Computer Backup simulator state and endpoint logic.
+*
+* B2Simulator owns dispatch and shared storage primitives. This collaborator
+* intentionally keeps both Partner and Backup surfaces together because one
+* Partner token authorizes both products. Product-specific state remains split
+* by map: groups/trials/members for Partner, computers for Backup.
+*
+* Auth has two modes:
+*
+* - default `new B2Simulator()` endpoint tests are permissive and accept any
+*   non-empty Partner token without binding request account IDs;
+* - `partnerAuthorize: true` or `strictAuth: true` turns on issued-token
+*   validation so client auth-error tests can still exercise 401 responses.
+*/
+var PartnerSimulator = class {
+	host;
+	issuedTokens = /* @__PURE__ */ new Map();
+	knownEmails = /* @__PURE__ */ new Set();
+	groups = /* @__PURE__ */ new Map();
+	groupsByAdmin = /* @__PURE__ */ new Map();
+	groupMembers = /* @__PURE__ */ new Map();
+	groupMembersByAccountId = /* @__PURE__ */ new Map();
+	computersByAccount = /* @__PURE__ */ new Map();
+	authorizeEnabled;
+	validateIssuedTokens;
+	apiEnabled;
+	accountHasValidPhone;
+	accountInGoodStanding;
+	groupsCapabilities;
+	backupCapabilities;
+	/**
+	* Creates the Partner/Backup simulator facade.
+	*
+	* @param host - Narrow callbacks into the parent B2 simulator.
+	* @param options - Parent simulator options relevant to Partner behavior.
+	*/
+	constructor(host, options) {
+		this.host = host;
+		this.authorizeEnabled = options.partnerAuthorize ?? false;
+		this.validateIssuedTokens = this.authorizeEnabled || (options.strictAuth ?? false);
+		this.apiEnabled = options.partnerApiEnabled ?? true;
+		this.accountHasValidPhone = options.partnerAccountHasValidPhone ?? true;
+		this.accountInGoodStanding = options.partnerAccountInGoodStanding ?? true;
+		this.groupsCapabilities = clonePartnerCapabilities(options.partnerGroupsCapabilities ?? [require_partner.PartnerCapability.All]);
+		this.backupCapabilities = clonePartnerCapabilities(options.partnerBackupCapabilities ?? [require_partner.PartnerCapability.All]);
+	}
+	/**
+	* Reports whether v3 authorize should return Partner/Backup suites.
+	*
+	* @returns `true` when Partner authorization is enabled.
+	*/
+	isAuthorizeEnabled() {
+		return this.authorizeEnabled;
+	}
+	/**
+	* Checks whether an endpoint name belongs to Partner or Backup APIs.
+	*
+	* @param endpoint - Endpoint name parsed from the request path.
+	*
+	* @returns `true` when this simulator should handle the endpoint.
+	*/
+	isEndpoint(endpoint) {
+		return isPartnerApiEndpoint(endpoint);
+	}
+	/**
+	* Authorizes a Partner administrator and mints a Partner token.
+	*
+	* @param authzHeader - Basic authorization header from b2_authorize_account.
+	* @param origin - Request origin used to build simulator endpoint URLs.
+	*
+	* @returns JSON response with Partner, Backup, and storage API information.
+	*/
+	authorize(authzHeader, origin = "http://localhost:0") {
+		if (!this.host.canAuthorize(authzHeader)) return this.host.error(401, "bad_auth_token", "missing or invalid Partner authorize credentials");
+		const tokenStr = this.host.genId("sim_partner_auth_token");
+		this.issuedTokens.set(tokenStr, {
+			accountId: this.host.accountId,
+			backupCapabilities: this.backupCapabilities,
+			expiresAt: this.host.now() + this.host.authTokenTtlMs,
+			groupsCapabilities: this.groupsCapabilities
+		});
+		return {
+			status: 200,
+			body: {
+				accountId: require_ids.accountId(this.host.accountId),
+				authorizationToken: tokenStr,
+				apiInfo: {
+					storageApi: {
+						absoluteMinimumPartSize: this.host.minimumPartSize,
+						apiUrl: origin,
+						bucketId: null,
+						bucketName: null,
+						capabilities: [
+							require_auth.Capability.ListBuckets,
+							require_auth.Capability.ReadBuckets,
+							require_auth.Capability.WriteBuckets,
+							require_auth.Capability.DeleteBuckets,
+							require_auth.Capability.ListFiles,
+							require_auth.Capability.ReadFiles,
+							require_auth.Capability.WriteFiles,
+							require_auth.Capability.DeleteFiles
+						],
+						downloadUrl: origin,
+						infoType: "storageApi",
+						namePrefix: null,
+						recommendedPartSize: this.host.recommendedPartSize,
+						s3ApiUrl: origin
+					},
+					groupsApi: {
+						capabilities: this.groupsCapabilities,
+						groupsApiUrl: `${origin}/partner`,
+						infoType: "groupsApi"
+					},
+					backupApi: {
+						backupApiUrl: `${origin}/backup`,
+						capabilities: this.backupCapabilities,
+						infoType: "backupApi"
+					}
+				},
+				applicationKeyExpirationTimestamp: null
+			}
+		};
+	}
+	/**
+	* Handles b2_reserve_trial_create_account.
+	*
+	* @param body - Parsed JSON request body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	reserveTrialCreateAccount(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ReserveTrialCreateAccount, authToken);
+		if ("status" in auth) return auth;
+		const parsed = this.parseReserveTrialCreateAccountRequest(body);
+		if (parsed.error !== null) return parsed.error;
+		const startDayMs = utcDayStartMs(this.host.now());
+		return {
+			status: 200,
+			body: this.createReserveTrialAccount(parsed.entry, parsed.normalizedEmail, startDayMs)
+		};
+	}
+	/**
+	* Handles b2_create_group_member.
+	*
+	* @param body - Parsed JSON request body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	createGroupMember(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.CreateGroupMember, authToken, { checkPhone: false });
+		if ("status" in auth) return auth;
+		const record = requestObject(body);
+		const request = this.parseCreateGroupMemberRequest(record);
+		if ("error" in request) return request.error;
+		const accountError = this.authorizeAccount(auth, request.adminAccountId);
+		if (accountError !== null) return accountError;
+		const group = this.activeGroup(request.groupId, request.adminAccountId);
+		if (group === null) return this.host.error(401, "invalid_group_id", "group ID is invalid or deleted");
+		if (!this.accountHasValidPhone) return this.host.error(401, "invalid_sms_phone", "account is missing a valid SMS phone");
+		const normalizedEmail = normalizeEmail(request.memberEmail);
+		if (!isValidEmailAddress(request.memberEmail) || this.knownEmails.has(normalizedEmail)) return this.host.error(401, "invalid_email", "email address is invalid or already exists");
+		const members = this.membersForGroup(group.groupId);
+		if (this.activeMembersForGroup(group.groupId).length >= MAX_GROUP_MEMBERS) return this.host.error(401, "too_many_members", "group member count limit exceeded");
+		const accountId$1 = require_ids.accountId(this.host.genId("sim_group_member_account"));
+		const applicationKeyId$1 = require_ids.applicationKeyId(this.host.genId("sim_key"));
+		const applicationKey = this.host.genId("sim_secret");
+		const region = request.region ?? require_partner.Region.UsWest;
+		const stored = {
+			accountId: accountId$1,
+			email: request.memberEmail,
+			normalizedEmail,
+			groupId: group.groupId,
+			groupName: group.groupName,
+			region,
+			s3Endpoint: `s3.${region}-001.backblazeb2.com`,
+			applicationKeyId: applicationKeyId$1,
+			applicationKey,
+			createdTimestamp: this.host.monotonicTimestamp(),
+			ejected: false
+		};
+		members.set(normalizedEmail, stored);
+		this.groupMembersByAccountId.set(accountId$1, stored);
+		this.knownEmails.add(normalizedEmail);
+		this.host.storeKey({
+			applicationKeyId: applicationKeyId$1,
+			keyName: `group-member-${accountId$1}`,
+			capabilities: PARTNER_CREATED_STORAGE_KEY_CAPABILITIES,
+			accountId: accountId$1,
+			applicationKey,
+			bucketIds: null,
+			namePrefix: null,
+			expirationTimestamp: null
+		});
+		return {
+			status: 200,
+			body: {
+				applicationKeyId: applicationKeyId$1,
+				applicationKey,
+				groupMember: this.publicGroupMember(stored)
+			}
+		};
+	}
+	/**
+	* Handles b2_eject_group_member.
+	*
+	* @param body - Parsed JSON request body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	ejectGroupMember(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.EjectGroupMember, authToken);
+		if ("status" in auth) return auth;
+		const record = requestObject(body);
+		const request = this.parseEjectGroupMemberRequest(record);
+		if ("error" in request) return request.error;
+		const accountError = this.authorizeAccount(auth, request.adminAccountId);
+		if (accountError !== null) return accountError;
+		const group = this.activeGroup(request.groupId, request.adminAccountId);
+		if (group === null) return this.host.error(401, "invalid_group_id", "group ID is invalid or deleted");
+		const member = this.groupMembersByAccountId.get(request.memberAccountId);
+		if (member === void 0 || member.ejected || member.groupId !== group.groupId) return this.host.error(401, "invalid_member_account_id", "group member account ID is invalid");
+		const previousNormalizedEmail = member.normalizedEmail;
+		if (request.email !== void 0 && request.email !== null) {
+			const normalizedEmail = normalizeEmail(request.email);
+			const keepsSameEmail = normalizedEmail === previousNormalizedEmail;
+			if (!isValidEmailAddress(request.email) || !keepsSameEmail && this.knownEmails.has(normalizedEmail)) return this.host.error(401, "invalid_email", "email address is invalid or already exists");
+			if (!keepsSameEmail) {
+				this.knownEmails.delete(previousNormalizedEmail);
+				this.knownEmails.add(normalizedEmail);
+			}
+			member.email = request.email;
+			member.normalizedEmail = normalizedEmail;
+		}
+		member.ejected = true;
+		this.groupMembers.get(group.groupId)?.delete(previousNormalizedEmail);
+		return {
+			status: 200,
+			body: this.publicGroupMember(member)
+		};
+	}
+	/**
+	* Handles b2_list_groups.
+	*
+	* @param body - Parsed GET query parameters or JSON body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	listGroups(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ListGroups, authToken, { checkPhone: false });
+		if ("status" in auth) return auth;
+		const record = requestObject(body);
+		const adminAccountId = this.requiredString(record, "adminAccountId", 400, "bad_request");
+		if ("error" in adminAccountId) return adminAccountId.error;
+		const accountError = this.authorizeAccount(auth, adminAccountId.value);
+		if (accountError !== null) return accountError;
+		const maxGroupCount = this.optionalInteger(record, "maxGroupCount", DEFAULT_MAX_GROUP_COUNT, 1, MAX_GROUP_COUNT, 401, "out_of_range");
+		if ("error" in maxGroupCount) return maxGroupCount.error;
+		const groupSeedError = this.ensureGroupsForAdmin(adminAccountId.value);
+		if (groupSeedError !== null) return groupSeedError;
+		const groupNameValue = record["groupName"];
+		const groupName = typeof groupNameValue === "string" ? groupNameValue : void 0;
+		const startGroupIdValue = record["startGroupId"];
+		const startGroupId = typeof startGroupIdValue === "string" ? startGroupIdValue : void 0;
+		if (startGroupId !== void 0 && this.activeGroup(startGroupId, adminAccountId.value) === null) return this.host.error(401, "invalid_group_id", "group ID is invalid or deleted");
+		const allGroups = this.activeGroupsForAdmin(adminAccountId.value).filter((group) => groupName === void 0 || group.groupName === groupName).sort((left, right) => compareStrings(left.groupId, right.groupId));
+		const startIndex = startGroupId === void 0 ? 0 : allGroups.findIndex((group) => group.groupId >= startGroupId);
+		const normalizedStartIndex = startIndex === -1 ? allGroups.length : startIndex;
+		const page = allGroups.slice(normalizedStartIndex, normalizedStartIndex + maxGroupCount.value);
+		const next = allGroups[normalizedStartIndex + maxGroupCount.value];
+		return {
+			status: 200,
+			body: {
+				accountId: require_ids.accountId(adminAccountId.value),
+				groups: page.map((group) => this.publicGroup(group)),
+				nextGroupId: next === void 0 ? null : require_ids.groupId(next.groupId)
+			}
+		};
+	}
+	/**
+	* Handles b2_list_group_members.
+	*
+	* @param body - Parsed GET query parameters or JSON body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	listGroupMembers(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ListGroupMembers, authToken, { checkPhone: false });
+		if ("status" in auth) return auth;
+		const record = requestObject(body);
+		const request = this.parseListGroupMembersRequest(record);
+		if ("error" in request) return request.error;
+		const accountError = this.authorizeAccount(auth, request.adminAccountId);
+		if (accountError !== null) return accountError;
+		const group = this.activeGroup(request.groupId, request.adminAccountId);
+		if (group === null) return this.host.error(401, "invalid_group_id", "group ID is invalid or deleted");
+		const members = this.activeMembersForGroup(group.groupId).sort((left, right) => compareStrings(left.normalizedEmail, right.normalizedEmail));
+		const startEmail = request.startEmail === void 0 ? void 0 : normalizeEmail(request.startEmail);
+		const startIndex = startEmail === void 0 ? 0 : members.findIndex((member) => member.normalizedEmail >= startEmail);
+		const normalizedStartIndex = startIndex === -1 ? members.length : startIndex;
+		const page = members.slice(normalizedStartIndex, normalizedStartIndex + request.maxMemberCount);
+		const next = members[normalizedStartIndex + request.maxMemberCount];
+		return {
+			status: 200,
+			body: {
+				groupId: require_ids.groupId(group.groupId),
+				groupName: group.groupName,
+				groupMembers: page.map((member) => this.publicListedGroupMember(member)),
+				nextEmail: next === void 0 ? null : next.email
+			}
+		};
+	}
+	/**
+	* Handles bz_list_computers.
+	*
+	* @param body - Parsed GET query parameters or JSON body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	listComputers(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ListComputers, authToken, { checkPhone: false });
+		if ("status" in auth) return auth;
+		const record = requestObject(body);
+		const accountId = this.requiredString(record, "accountId", 400, "invalid_account_id");
+		if ("error" in accountId) return accountId.error;
+		const accountError = this.authorizeAccount(auth, accountId.value);
+		if (accountError !== null) return accountError;
+		const maxComputerCount = this.optionalInteger(record, "maxComputerCount", DEFAULT_MAX_COMPUTER_COUNT, MIN_COMPUTER_COUNT, MAX_COMPUTER_COUNT, 400, "out_of_range");
+		if ("error" in maxComputerCount) return maxComputerCount.error;
+		const computers = this.ensureComputersForAccount(accountId.value);
+		if ("status" in computers) return computers;
+		const startComputerIdValue = record["startComputerId"];
+		const startComputerId = typeof startComputerIdValue === "string" ? startComputerIdValue : void 0;
+		if (startComputerId !== void 0) {
+			const start = computers.get(startComputerId);
+			if (start === void 0 || start.deleted) return this.host.error(400, "invalid_computer_id", "computer ID is invalid or deleted");
+		}
+		const activeComputers = [...computers.values()].filter((computer) => !computer.deleted).sort((left, right) => compareStrings(left.computerId, right.computerId));
+		const startIndex = startComputerId === void 0 ? 0 : activeComputers.findIndex((computer) => computer.computerId >= startComputerId);
+		const normalizedStartIndex = startIndex === -1 ? activeComputers.length : startIndex;
+		const page = activeComputers.slice(normalizedStartIndex, normalizedStartIndex + maxComputerCount.value);
+		const next = activeComputers[normalizedStartIndex + maxComputerCount.value];
+		return {
+			status: 200,
+			body: {
+				nextComputerId: next === void 0 ? null : next.computerId,
+				computers: page.map((computer) => this.publicComputer(computer))
+			}
+		};
+	}
+	/**
+	* Handles bz_delete_computer.
+	*
+	* @param body - Parsed JSON request body.
+	* @param authToken - Partner authorization token.
+	*
+	* @returns Simulator JSON response.
+	*/
+	deleteComputer(body, authToken) {
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.DeleteComputer, authToken, { checkPhone: false });
+		if ("status" in auth) return auth;
+		const record = requestObject(body);
+		const accountId = this.requiredString(record, "accountId", 400, "invalid_account_id");
+		if ("error" in accountId) return accountId.error;
+		const computerId = this.requiredString(record, "computerId", 400, "invalid_computer_id");
+		if ("error" in computerId) return computerId.error;
+		const accountError = this.authorizeAccount(auth, accountId.value);
+		if (accountError !== null) return accountError;
+		const computer = this.computersByAccount.get(accountId.value)?.get(computerId.value);
+		if (computer === void 0 || computer.deleted) return this.host.error(400, "invalid_computer_id", "computer ID is invalid or deleted");
+		computer.deleted = true;
+		return {
+			status: 200,
+			body: [this.publicComputer(computer)]
+		};
+	}
+	authorizeRequest(endpoint, authToken, options = {}) {
+		if (authToken === void 0 || authToken.trim() === "" || /\s/.test(authToken)) return this.host.error(403, "access_denied", "missing or malformed Partner API Authorization header");
+		if (!this.validateIssuedTokens) {
+			if (!this.apiEnabled) return this.host.error(403, "access_denied", "account is not enabled for Partner API");
+			if (options.checkPhone !== false && !this.accountHasValidPhone) return this.host.error(403, "access_denied", "account does not have a valid phone number");
+			if (!this.accountInGoodStanding) return this.host.error(403, "access_denied", "account is not in good standing");
+			return { accountId: null };
+		}
+		const token = this.issuedTokens.get(authToken);
+		if (token === void 0 || this.host.now() > token.expiresAt) return this.host.error(401, "unauthorized", "invalid Partner API authorization token");
+		if (!this.apiEnabled) return this.host.error(403, "access_denied", "account is not enabled for Partner API");
+		if (options.checkPhone !== false && !this.accountHasValidPhone) return this.host.error(403, "access_denied", "account does not have a valid phone number");
+		if (!this.accountInGoodStanding) return this.host.error(403, "access_denied", "account is not in good standing");
+		const capabilityError = this.authorizeEndpointCapabilities(endpoint, token);
+		if (capabilityError !== null) return capabilityError;
+		return { accountId: token.accountId };
+	}
+	authorizeEndpointCapabilities(endpoint, token) {
+		const requirement = require_partner_capabilities.partnerEndpointCapabilityRequirementFor(endpoint);
+		if (requirement === null) return this.host.error(401, "unauthorized", `no Partner capability policy for ${endpoint}`);
+		const granted = requirement.suite === "groups" ? token.groupsCapabilities : token.backupCapabilities;
+		const missing = require_partner_capabilities.missingPartnerCapabilities(requirement.capabilities, granted);
+		if (missing.length === 0) return null;
+		return this.host.error(401, "unauthorized", `Partner token lacks required capabilities: ${missing.join(", ")}`);
+	}
+	authorizeAccount(auth, requestedAccountId) {
+		if (auth.accountId === null) return null;
+		if (auth.accountId === requestedAccountId) return null;
+		return this.host.error(403, "unauthorized", "Partner token is not authorized for requested account");
+	}
+	parseReserveTrialCreateAccountRequest(value) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return { error: this.host.error(400, "bad_request", "trial account request must be an object") };
+		const record = value;
+		const email = record["email"];
+		if (typeof email !== "string") return { error: this.host.error(400, "bad_request", "email is required") };
+		if (!isValidEmailAddress(email)) return { error: this.host.error(400, "bad_request", "email address is invalid") };
+		const normalizedEmail = normalizeEmail(email);
+		if (this.knownEmails.has(normalizedEmail)) return { error: this.host.error(400, "bad_request", "email must not already exist as a Backblaze account") };
+		const term = record["term"];
+		if (typeof term !== "number" || !Number.isInteger(term) || term < 7 || term > 30) return { error: this.host.error(400, "bad_request", "term must be between 7 and 30 days") };
+		const storage = record["storage"];
+		if (typeof storage !== "number" || !Number.isInteger(storage) || storage < 1 || storage > 50) return { error: this.host.error(400, "bad_request", "storage must be between 1 and 50 TB") };
+		const region = record["region"];
+		if (region !== void 0 && region !== null && (typeof region !== "string" || !PARTNER_REGIONS.has(region))) return { error: this.host.error(400, "bad_request", "region is not supported") };
+		return {
+			entry: {
+				email,
+				term,
+				storage,
+				...region !== void 0 ? { region } : {}
+			},
+			normalizedEmail,
+			error: null
+		};
+	}
+	createReserveTrialAccount(request, normalizedEmail, startDayMs) {
+		const accountId$2 = require_ids.accountId(this.host.genId("sim_trial_account"));
+		const bucketName = `trial-${this.host.genId("bucket").slice(-8)}`;
+		const bucketResponse = this.host.createBucket({
+			accountId: accountId$2,
+			bucketName,
+			bucketType: "allPrivate"
+		});
+		if (bucketResponse.status !== 200) throw new Error("failed to create simulator reserve trial bucket");
+		const bucket = bucketResponse.body;
+		const keyId = require_ids.applicationKeyId(this.host.genId("sim_key"));
+		const applicationKey = this.host.genId("sim_secret");
+		this.host.storeKey({
+			applicationKeyId: keyId,
+			keyName: `reserve-trial-${bucketName}`,
+			capabilities: PARTNER_CREATED_STORAGE_KEY_CAPABILITIES,
+			accountId: accountId$2,
+			applicationKey,
+			bucketIds: [bucket.bucketId],
+			namePrefix: null,
+			expirationTimestamp: null
+		});
+		this.knownEmails.add(normalizedEmail);
+		return {
+			accountId: accountId$2,
+			applicationKey,
+			applicationKeyId: keyId,
+			s3Endpoint: `s3.${request.region ?? require_partner.Region.UsWest}-001.backblazeb2.com`,
+			startDate: utcDateString(startDayMs),
+			endDate: utcDateString(startDayMs + request.term * DAY_MS),
+			email: request.email,
+			bucketName: bucket.bucketName,
+			bucketId: bucket.bucketId
+		};
+	}
+	parseCreateGroupMemberRequest(record) {
+		const adminAccountId = this.requiredString(record, "adminAccountId", 400, "bad_request");
+		if ("error" in adminAccountId) return adminAccountId;
+		const groupId$1 = this.requiredString(record, "groupId", 401, "invalid_group_id");
+		if ("error" in groupId$1) return groupId$1;
+		const memberEmail = this.requiredString(record, "memberEmail", 401, "invalid_email");
+		if ("error" in memberEmail) return memberEmail;
+		const regionValue = record["region"];
+		if (regionValue !== void 0 && regionValue !== null && (typeof regionValue !== "string" || !PARTNER_REGIONS.has(regionValue))) return { error: this.host.error(401, "invalid_region", "region is invalid") };
+		return {
+			adminAccountId: require_ids.accountId(adminAccountId.value),
+			groupId: require_ids.groupId(groupId$1.value),
+			memberEmail: memberEmail.value,
+			...regionValue !== void 0 ? { region: regionValue } : {}
+		};
+	}
+	parseEjectGroupMemberRequest(record) {
+		const adminAccountId = this.requiredString(record, "adminAccountId", 400, "bad_request");
+		if ("error" in adminAccountId) return adminAccountId;
+		const groupId$2 = this.requiredString(record, "groupId", 401, "invalid_group_id");
+		if ("error" in groupId$2) return groupId$2;
+		const memberAccountId = this.requiredString(record, "memberAccountId", 401, "invalid_member_account_id");
+		if ("error" in memberAccountId) return memberAccountId;
+		const email = record["email"];
+		if (email !== void 0 && email !== null && typeof email !== "string") return { error: this.host.error(401, "invalid_email", "email address is invalid") };
+		return {
+			adminAccountId: require_ids.accountId(adminAccountId.value),
+			groupId: require_ids.groupId(groupId$2.value),
+			memberAccountId: require_ids.accountId(memberAccountId.value),
+			...email !== void 0 ? { email } : {}
+		};
+	}
+	parseListGroupMembersRequest(record) {
+		const adminAccountId = this.requiredString(record, "adminAccountId", 400, "bad_request");
+		if ("error" in adminAccountId) return adminAccountId;
+		const groupId$3 = this.requiredString(record, "groupId", 401, "invalid_group_id");
+		if ("error" in groupId$3) return groupId$3;
+		const maxMemberCount = this.optionalInteger(record, "maxMemberCount", DEFAULT_MAX_MEMBER_COUNT, 1, MAX_MEMBER_COUNT, 401, "out_of_range", { zeroUsesDefault: true });
+		if ("error" in maxMemberCount) return maxMemberCount;
+		const startEmail = record["startEmail"];
+		if (startEmail !== void 0 && typeof startEmail !== "string") return { error: this.host.error(400, "bad_request", "startEmail must be a string") };
+		return {
+			adminAccountId: require_ids.accountId(adminAccountId.value),
+			groupId: require_ids.groupId(groupId$3.value),
+			...startEmail !== void 0 ? { startEmail } : {},
+			maxMemberCount: maxMemberCount.value
+		};
+	}
+	requiredString(record, field, status, code) {
+		const value = record[field];
+		if (typeof value !== "string" || value === "") return { error: this.host.error(status, code, `${field} is required`) };
+		return { value };
+	}
+	optionalInteger(record, field, defaultValue, min, max, status, code, options = {}) {
+		const raw = record[field];
+		if (raw === void 0) return { value: defaultValue };
+		const value = typeof raw === "number" ? raw : typeof raw === "string" && raw !== "" ? Number(raw) : NaN;
+		if (options.zeroUsesDefault === true && value === 0) return { value: defaultValue };
+		if (!Number.isInteger(value) || value < min || value > max) return { error: this.host.error(status, code, `${field} must be between ${min} and ${max}`) };
+		return { value };
+	}
+	ensureGroupsForAdmin(adminAccountId) {
+		if (this.groupsByAdmin.has(adminAccountId)) return null;
+		if (this.groupsByAdmin.size >= MAX_AUTO_PROVISIONED_ADMINS) return this.host.error(400, "too_many_accounts", "simulator Partner account auto-provisioning cap exceeded");
+		this.groupsByAdmin.set(adminAccountId, []);
+		for (let index = 1; index <= DEFAULT_GROUP_COUNT; index += 1) this.createGroup(adminAccountId, `Simulator Group ${index}`);
+		return null;
+	}
+	createGroup(adminAccountId, groupName) {
+		const existingGroupIds = this.groupsByAdmin.get(adminAccountId) ?? [];
+		if (existingGroupIds.length >= MAX_GROUPS_PER_ADMIN) throw new Error("simulator Partner group cap exceeded");
+		const group = {
+			adminAccountId,
+			groupId: this.host.genId("sim_group"),
+			groupName,
+			groupProducts: ["STORAGE", "BACKUP"],
+			createdTimestamp: this.host.monotonicTimestamp(),
+			deleted: false
+		};
+		this.groups.set(group.groupId, group);
+		existingGroupIds.push(group.groupId);
+		this.groupsByAdmin.set(adminAccountId, existingGroupIds);
+		this.groupMembers.set(group.groupId, /* @__PURE__ */ new Map());
+		return group;
+	}
+	activeGroup(groupId, adminAccountId) {
+		const group = this.groups.get(groupId);
+		if (group === void 0 || group.deleted || group.adminAccountId !== adminAccountId) return null;
+		return group;
+	}
+	activeGroupsForAdmin(adminAccountId) {
+		return (this.groupsByAdmin.get(adminAccountId) ?? []).map((groupId) => this.groups.get(groupId)).filter((group) => group !== void 0 && !group.deleted);
+	}
+	membersForGroup(groupId) {
+		const existing = this.groupMembers.get(groupId);
+		if (existing !== void 0) return existing;
+		const created = /* @__PURE__ */ new Map();
+		this.groupMembers.set(groupId, created);
+		return created;
+	}
+	activeMembersForGroup(groupId) {
+		return [...this.groupMembers.get(groupId)?.values() ?? []].filter((member) => !member.ejected);
+	}
+	ensureComputersForAccount(accountId) {
+		const existing = this.computersByAccount.get(accountId);
+		if (existing !== void 0) return existing;
+		if (this.computersByAccount.size >= MAX_AUTO_PROVISIONED_BACKUP_ACCOUNTS) return this.host.error(400, "too_many_accounts", "simulator Backup account auto-provisioning cap exceeded");
+		const computers = /* @__PURE__ */ new Map();
+		for (let index = 1; index <= DEFAULT_COMPUTER_COUNT; index += 1) {
+			const computer = {
+				accountId,
+				computerId: this.host.genId("sim_computer"),
+				computerName: `sim-computer-${index}`,
+				lastFileUploadedTimestamp: this.host.monotonicTimestamp(),
+				deleted: false
+			};
+			computers.set(computer.computerId, computer);
+		}
+		this.computersByAccount.set(accountId, computers);
+		return computers;
+	}
+	publicGroup(group) {
+		const timestamp = b2FriendlyTimestamp(group.createdTimestamp);
+		return {
+			accountStandingDetails: { state: "B2_GOOD_STANDING" },
+			b2Stats: this.emptyB2Stats(group.createdTimestamp),
+			groupId: require_ids.groupId(group.groupId),
+			groupName: group.groupName,
+			groupProducts: group.groupProducts,
+			groupStats: {
+				createdTimestamp: timestamp,
+				groupStatsAsOfTimestamp: timestamp,
+				memberCount: this.activeMembersForGroup(group.groupId).length
+			}
+		};
+	}
+	publicGroupMember(member) {
+		return {
+			accountId: require_ids.accountId(member.accountId),
+			email: member.email,
+			groupId: require_ids.groupId(member.groupId),
+			groupName: member.groupName,
+			region: member.region,
+			s3Endpoint: member.s3Endpoint
+		};
+	}
+	publicListedGroupMember(member) {
+		return {
+			...this.publicGroupMember(member),
+			b2Stats: this.emptyB2Stats(member.createdTimestamp)
+		};
+	}
+	publicComputer(computer) {
+		return {
+			computerId: require_ids.computerId(computer.computerId),
+			computerName: computer.computerName,
+			lastFileUploadedTimestamp: computer.lastFileUploadedTimestamp
+		};
+	}
+	emptyB2Stats(timestamp) {
+		return {
+			b2BytesStoredCount: 0,
+			b2FilesStoredCount: 0,
+			b2StatsAsOfTimestamp: b2FriendlyTimestamp(timestamp),
+			bucketCount: 0
+		};
+	}
+};
+//#endregion
+exports.PartnerSimulator = PartnerSimulator;
+
+//# sourceMappingURL=partner.cjs.map