@backblaze-labs/b2-sdk 0.3.0 → 0.4.0

package/dist/simulator/partner-capabilities.cjs

@@ -0,0 +1,77 @@
+const require_partner = require("../types/partner.cjs");
+//#region src/simulator/partner-capabilities.ts
+/**
+* Partner and Computer Backup endpoint capability requirements.
+*
+* Partner tokens carry suite-specific grants that are independent from
+* storage application-key capabilities. The simulator uses this table only
+* for strict Partner/Backup auth checks.
+*
+* Source: https://www.backblaze.com/apidocs (Partner endpoint pages list
+* valid-token authorization failures as `401 unauthorized`).
+*
+* @packageDocumentation
+*/
+var PartnerEndpoint = Object.freeze({
+	CreateGroupMember: "b2_create_group_member",
+	EjectGroupMember: "b2_eject_group_member",
+	ListGroups: "b2_list_groups",
+	ListGroupMembers: "b2_list_group_members",
+	ReserveTrialCreateAccount: "b2_reserve_trial_create_account",
+	ListComputers: "bz_list_computers",
+	DeleteComputer: "bz_delete_computer"
+});
+var PARTNER_ENDPOINT_NAMES = Object.freeze([
+	PartnerEndpoint.CreateGroupMember,
+	PartnerEndpoint.EjectGroupMember,
+	PartnerEndpoint.ListGroups,
+	PartnerEndpoint.ListGroupMembers,
+	PartnerEndpoint.ReserveTrialCreateAccount,
+	PartnerEndpoint.ListComputers,
+	PartnerEndpoint.DeleteComputer
+]);
+function endpointRequirement(suite, capabilities) {
+	return Object.freeze({
+		suite,
+		capabilities: Object.freeze([...capabilities])
+	});
+}
+var PARTNER_ENDPOINT_CAPABILITIES = Object.freeze({
+	[PartnerEndpoint.CreateGroupMember]: endpointRequirement("groups", [require_partner.PartnerCapability.All]),
+	[PartnerEndpoint.EjectGroupMember]: endpointRequirement("groups", [require_partner.PartnerCapability.All]),
+	[PartnerEndpoint.ListGroups]: endpointRequirement("groups", [require_partner.PartnerCapability.All]),
+	[PartnerEndpoint.ListGroupMembers]: endpointRequirement("groups", [require_partner.PartnerCapability.All]),
+	[PartnerEndpoint.ReserveTrialCreateAccount]: endpointRequirement("groups", [require_partner.PartnerCapability.All]),
+	[PartnerEndpoint.ListComputers]: endpointRequirement("backup", [require_partner.PartnerCapability.All]),
+	[PartnerEndpoint.DeleteComputer]: endpointRequirement("backup", [require_partner.PartnerCapability.All])
+});
+/**
+* Resolve the frozen capability requirement for a Partner or Backup endpoint.
+*
+* @param endpoint - Partner or Computer Backup endpoint name.
+*
+* @returns The endpoint's requirement, or null when no policy is available.
+*/
+function partnerEndpointCapabilityRequirementFor(endpoint) {
+	return PARTNER_ENDPOINT_CAPABILITIES[endpoint] ?? null;
+}
+/**
+* Find missing Partner capabilities against an already-resolved requirement.
+*
+* @param required - Partner capabilities required by the endpoint.
+* @param granted - Partner capabilities granted by the token suite.
+*
+* @returns The subset of required Partner capabilities absent from `granted`.
+*/
+function missingPartnerCapabilities(required, granted) {
+	const grantedSet = new Set(granted);
+	return required.filter((capability) => !grantedSet.has(capability));
+}
+//#endregion
+exports.PARTNER_ENDPOINT_CAPABILITIES = PARTNER_ENDPOINT_CAPABILITIES;
+exports.PARTNER_ENDPOINT_NAMES = PARTNER_ENDPOINT_NAMES;
+exports.PartnerEndpoint = PartnerEndpoint;
+exports.missingPartnerCapabilities = missingPartnerCapabilities;
+exports.partnerEndpointCapabilityRequirementFor = partnerEndpointCapabilityRequirementFor;
+
+//# sourceMappingURL=partner-capabilities.cjs.map

package/dist/simulator/partner-capabilities.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"partner-capabilities.cjs","names":[],"sources":["../../src/simulator/partner-capabilities.ts"],"sourcesContent":["/**\n * Partner and Computer Backup endpoint capability requirements.\n *\n * Partner tokens carry suite-specific grants that are independent from\n * storage application-key capabilities. The simulator uses this table only\n * for strict Partner/Backup auth checks.\n *\n * Source: https://www.backblaze.com/apidocs (Partner endpoint pages list\n * valid-token authorization failures as `401 unauthorized`).\n *\n * @packageDocumentation\n */\n\nimport { PartnerCapability } from '../types/partner.ts'\n\nexport const PartnerEndpoint = Object.freeze({\n  CreateGroupMember: 'b2_create_group_member',\n  EjectGroupMember: 'b2_eject_group_member',\n  ListGroups: 'b2_list_groups',\n  ListGroupMembers: 'b2_list_group_members',\n  ReserveTrialCreateAccount: 'b2_reserve_trial_create_account',\n  ListComputers: 'bz_list_computers',\n  DeleteComputer: 'bz_delete_computer',\n} as const)\n\nexport type PartnerEndpoint = (typeof PartnerEndpoint)[keyof typeof PartnerEndpoint]\n\nexport const PARTNER_ENDPOINT_NAMES = Object.freeze([\n  PartnerEndpoint.CreateGroupMember,\n  PartnerEndpoint.EjectGroupMember,\n  PartnerEndpoint.ListGroups,\n  PartnerEndpoint.ListGroupMembers,\n  PartnerEndpoint.ReserveTrialCreateAccount,\n  PartnerEndpoint.ListComputers,\n  PartnerEndpoint.DeleteComputer,\n] as const)\n\nexport type PartnerCapabilitySuite = 'groups' | 'backup'\n\nexport interface PartnerEndpointCapabilityRequirement {\n  readonly suite: PartnerCapabilitySuite\n  readonly capabilities: readonly PartnerCapability[]\n}\n\nfunction endpointRequirement(\n  suite: PartnerCapabilitySuite,\n  capabilities: readonly PartnerCapability[],\n): PartnerEndpointCapabilityRequirement {\n  return Object.freeze({\n    suite,\n    capabilities: Object.freeze([...capabilities]),\n  })\n}\n\nexport const PARTNER_ENDPOINT_CAPABILITIES = Object.freeze({\n  [PartnerEndpoint.CreateGroupMember]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.EjectGroupMember]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.ListGroups]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.ListGroupMembers]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.ReserveTrialCreateAccount]: endpointRequirement('groups', [\n    PartnerCapability.All,\n  ]),\n  [PartnerEndpoint.ListComputers]: endpointRequirement('backup', [PartnerCapability.All]),\n  [PartnerEndpoint.DeleteComputer]: endpointRequirement('backup', [PartnerCapability.All]),\n} satisfies Record<PartnerEndpoint, PartnerEndpointCapabilityRequirement>)\n\n/**\n * Resolve the frozen capability requirement for a Partner or Backup endpoint.\n *\n * @param endpoint - Partner or Computer Backup endpoint name.\n *\n * @returns The endpoint's requirement, or null when no policy is available.\n */\nexport function partnerEndpointCapabilityRequirementFor(\n  endpoint: PartnerEndpoint,\n): PartnerEndpointCapabilityRequirement | null {\n  return PARTNER_ENDPOINT_CAPABILITIES[endpoint] ?? null\n}\n\n/**\n * Find missing Partner capabilities against an already-resolved requirement.\n *\n * @param required - Partner capabilities required by the endpoint.\n * @param granted - Partner capabilities granted by the token suite.\n *\n * @returns The subset of required Partner capabilities absent from `granted`.\n */\nexport function missingPartnerCapabilities(\n  required: readonly PartnerCapability[],\n  granted: readonly PartnerCapability[],\n): readonly PartnerCapability[] {\n  const grantedSet = new Set(granted)\n  return required.filter((capability) => !grantedSet.has(capability))\n}\n\n/**\n * Find which Partner capabilities are missing from the caller's grant set.\n *\n * @param endpoint - Partner or Computer Backup endpoint name.\n * @param granted - Suite capabilities carried by the Partner token.\n *\n * @returns The required Partner capabilities not present in `granted`.\n */\nexport function missingPartnerCapabilitiesFor(\n  endpoint: PartnerEndpoint,\n  granted: readonly PartnerCapability[],\n): readonly PartnerCapability[] {\n  return missingPartnerCapabilities(\n    partnerEndpointCapabilityRequirementFor(endpoint)?.capabilities ?? [],\n    granted,\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,IAAa,kBAAkB,OAAO,OAAO;CAC3C,mBAAmB;CACnB,kBAAkB;CAClB,YAAY;CACZ,kBAAkB;CAClB,2BAA2B;CAC3B,eAAe;CACf,gBAAgB;AAClB,CAAU;AAIV,IAAa,yBAAyB,OAAO,OAAO;CAClD,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;AAClB,CAAU;AASV,SAAS,oBACP,OACA,cACsC;CACtC,OAAO,OAAO,OAAO;EACnB;EACA,cAAc,OAAO,OAAO,CAAC,GAAG,YAAY,CAAC;CAC/C,CAAC;AACH;AAEA,IAAa,gCAAgC,OAAO,OAAO;EACxD,gBAAgB,oBAAoB,oBAAoB,UAAU,CAAC,gBAAA,kBAAkB,GAAG,CAAC;EACzF,gBAAgB,mBAAmB,oBAAoB,UAAU,CAAC,gBAAA,kBAAkB,GAAG,CAAC;EACxF,gBAAgB,aAAa,oBAAoB,UAAU,CAAC,gBAAA,kBAAkB,GAAG,CAAC;EAClF,gBAAgB,mBAAmB,oBAAoB,UAAU,CAAC,gBAAA,kBAAkB,GAAG,CAAC;EACxF,gBAAgB,4BAA4B,oBAAoB,UAAU,CACzE,gBAAA,kBAAkB,GACpB,CAAC;EACA,gBAAgB,gBAAgB,oBAAoB,UAAU,CAAC,gBAAA,kBAAkB,GAAG,CAAC;EACrF,gBAAgB,iBAAiB,oBAAoB,UAAU,CAAC,gBAAA,kBAAkB,GAAG,CAAC;AACzF,CAAyE;;;;;;;;AASzE,SAAgB,wCACd,UAC6C;CAC7C,OAAO,8BAA8B,aAAa;AACpD;;;;;;;;;AAUA,SAAgB,2BACd,UACA,SAC8B;CAC9B,MAAM,aAAa,IAAI,IAAI,OAAO;CAClC,OAAO,SAAS,QAAQ,eAAe,CAAC,WAAW,IAAI,UAAU,CAAC;AACpE"}

package/dist/simulator/partner-capabilities.d.cts

@@ -0,0 +1,53 @@
+import { PartnerCapability } from '../types/partner.js';
+export declare const PartnerEndpoint: Readonly<{
+    readonly CreateGroupMember: "b2_create_group_member";
+    readonly EjectGroupMember: "b2_eject_group_member";
+    readonly ListGroups: "b2_list_groups";
+    readonly ListGroupMembers: "b2_list_group_members";
+    readonly ReserveTrialCreateAccount: "b2_reserve_trial_create_account";
+    readonly ListComputers: "bz_list_computers";
+    readonly DeleteComputer: "bz_delete_computer";
+}>;
+export type PartnerEndpoint = (typeof PartnerEndpoint)[keyof typeof PartnerEndpoint];
+export declare const PARTNER_ENDPOINT_NAMES: readonly ["b2_create_group_member", "b2_eject_group_member", "b2_list_groups", "b2_list_group_members", "b2_reserve_trial_create_account", "bz_list_computers", "bz_delete_computer"];
+export type PartnerCapabilitySuite = 'groups' | 'backup';
+export interface PartnerEndpointCapabilityRequirement {
+    readonly suite: PartnerCapabilitySuite;
+    readonly capabilities: readonly PartnerCapability[];
+}
+export declare const PARTNER_ENDPOINT_CAPABILITIES: Readonly<{
+    b2_create_group_member: PartnerEndpointCapabilityRequirement;
+    b2_eject_group_member: PartnerEndpointCapabilityRequirement;
+    b2_list_groups: PartnerEndpointCapabilityRequirement;
+    b2_list_group_members: PartnerEndpointCapabilityRequirement;
+    b2_reserve_trial_create_account: PartnerEndpointCapabilityRequirement;
+    bz_list_computers: PartnerEndpointCapabilityRequirement;
+    bz_delete_computer: PartnerEndpointCapabilityRequirement;
+}>;
+/**
+ * Resolve the frozen capability requirement for a Partner or Backup endpoint.
+ *
+ * @param endpoint - Partner or Computer Backup endpoint name.
+ *
+ * @returns The endpoint's requirement, or null when no policy is available.
+ */
+export declare function partnerEndpointCapabilityRequirementFor(endpoint: PartnerEndpoint): PartnerEndpointCapabilityRequirement | null;
+/**
+ * Find missing Partner capabilities against an already-resolved requirement.
+ *
+ * @param required - Partner capabilities required by the endpoint.
+ * @param granted - Partner capabilities granted by the token suite.
+ *
+ * @returns The subset of required Partner capabilities absent from `granted`.
+ */
+export declare function missingPartnerCapabilities(required: readonly PartnerCapability[], granted: readonly PartnerCapability[]): readonly PartnerCapability[];
+/**
+ * Find which Partner capabilities are missing from the caller's grant set.
+ *
+ * @param endpoint - Partner or Computer Backup endpoint name.
+ * @param granted - Suite capabilities carried by the Partner token.
+ *
+ * @returns The required Partner capabilities not present in `granted`.
+ */
+export declare function missingPartnerCapabilitiesFor(endpoint: PartnerEndpoint, granted: readonly PartnerCapability[]): readonly PartnerCapability[];
+//# sourceMappingURL=partner-capabilities.d.ts.map

package/dist/simulator/partner-capabilities.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"partner-capabilities.d.ts","sourceRoot":"","sources":["../../src/simulator/partner-capabilities.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEvD,eAAO,MAAM,eAAe;;;;;;;;EAQjB,CAAA;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA;AAEpF,eAAO,MAAM,sBAAsB,uLAQxB,CAAA;AAEX,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAExD,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAYD,eAAO,MAAM,6BAA6B;;;;;;;;EAUgC,CAAA;AAE1E;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,eAAe,GACxB,oCAAoC,GAAG,IAAI,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,SAAS,iBAAiB,EAAE,CAG9B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,SAAS,iBAAiB,EAAE,CAK9B"}

package/dist/simulator/partner-capabilities.d.ts

@@ -0,0 +1,53 @@
+import { PartnerCapability } from '../types/partner.js';
+export declare const PartnerEndpoint: Readonly<{
+    readonly CreateGroupMember: "b2_create_group_member";
+    readonly EjectGroupMember: "b2_eject_group_member";
+    readonly ListGroups: "b2_list_groups";
+    readonly ListGroupMembers: "b2_list_group_members";
+    readonly ReserveTrialCreateAccount: "b2_reserve_trial_create_account";
+    readonly ListComputers: "bz_list_computers";
+    readonly DeleteComputer: "bz_delete_computer";
+}>;
+export type PartnerEndpoint = (typeof PartnerEndpoint)[keyof typeof PartnerEndpoint];
+export declare const PARTNER_ENDPOINT_NAMES: readonly ["b2_create_group_member", "b2_eject_group_member", "b2_list_groups", "b2_list_group_members", "b2_reserve_trial_create_account", "bz_list_computers", "bz_delete_computer"];
+export type PartnerCapabilitySuite = 'groups' | 'backup';
+export interface PartnerEndpointCapabilityRequirement {
+    readonly suite: PartnerCapabilitySuite;
+    readonly capabilities: readonly PartnerCapability[];
+}
+export declare const PARTNER_ENDPOINT_CAPABILITIES: Readonly<{
+    b2_create_group_member: PartnerEndpointCapabilityRequirement;
+    b2_eject_group_member: PartnerEndpointCapabilityRequirement;
+    b2_list_groups: PartnerEndpointCapabilityRequirement;
+    b2_list_group_members: PartnerEndpointCapabilityRequirement;
+    b2_reserve_trial_create_account: PartnerEndpointCapabilityRequirement;
+    bz_list_computers: PartnerEndpointCapabilityRequirement;
+    bz_delete_computer: PartnerEndpointCapabilityRequirement;
+}>;
+/**
+ * Resolve the frozen capability requirement for a Partner or Backup endpoint.
+ *
+ * @param endpoint - Partner or Computer Backup endpoint name.
+ *
+ * @returns The endpoint's requirement, or null when no policy is available.
+ */
+export declare function partnerEndpointCapabilityRequirementFor(endpoint: PartnerEndpoint): PartnerEndpointCapabilityRequirement | null;
+/**
+ * Find missing Partner capabilities against an already-resolved requirement.
+ *
+ * @param required - Partner capabilities required by the endpoint.
+ * @param granted - Partner capabilities granted by the token suite.
+ *
+ * @returns The subset of required Partner capabilities absent from `granted`.
+ */
+export declare function missingPartnerCapabilities(required: readonly PartnerCapability[], granted: readonly PartnerCapability[]): readonly PartnerCapability[];
+/**
+ * Find which Partner capabilities are missing from the caller's grant set.
+ *
+ * @param endpoint - Partner or Computer Backup endpoint name.
+ * @param granted - Suite capabilities carried by the Partner token.
+ *
+ * @returns The required Partner capabilities not present in `granted`.
+ */
+export declare function missingPartnerCapabilitiesFor(endpoint: PartnerEndpoint, granted: readonly PartnerCapability[]): readonly PartnerCapability[];
+//# sourceMappingURL=partner-capabilities.d.ts.map

package/dist/simulator/partner-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"partner-capabilities.d.ts","sourceRoot":"","sources":["../../src/simulator/partner-capabilities.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEvD,eAAO,MAAM,eAAe;;;;;;;;EAQjB,CAAA;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA;AAEpF,eAAO,MAAM,sBAAsB,uLAQxB,CAAA;AAEX,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAExD,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAYD,eAAO,MAAM,6BAA6B;;;;;;;;EAUgC,CAAA;AAE1E;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,eAAe,GACxB,oCAAoC,GAAG,IAAI,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,SAAS,iBAAiB,EAAE,CAG9B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,SAAS,iBAAiB,EAAE,CAK9B"}

package/dist/simulator/partner-capabilities.js

@@ -0,0 +1,73 @@
+import { PartnerCapability } from "../types/partner.js";
+//#region src/simulator/partner-capabilities.ts
+/**
+* Partner and Computer Backup endpoint capability requirements.
+*
+* Partner tokens carry suite-specific grants that are independent from
+* storage application-key capabilities. The simulator uses this table only
+* for strict Partner/Backup auth checks.
+*
+* Source: https://www.backblaze.com/apidocs (Partner endpoint pages list
+* valid-token authorization failures as `401 unauthorized`).
+*
+* @packageDocumentation
+*/
+var PartnerEndpoint = Object.freeze({
+	CreateGroupMember: "b2_create_group_member",
+	EjectGroupMember: "b2_eject_group_member",
+	ListGroups: "b2_list_groups",
+	ListGroupMembers: "b2_list_group_members",
+	ReserveTrialCreateAccount: "b2_reserve_trial_create_account",
+	ListComputers: "bz_list_computers",
+	DeleteComputer: "bz_delete_computer"
+});
+var PARTNER_ENDPOINT_NAMES = Object.freeze([
+	PartnerEndpoint.CreateGroupMember,
+	PartnerEndpoint.EjectGroupMember,
+	PartnerEndpoint.ListGroups,
+	PartnerEndpoint.ListGroupMembers,
+	PartnerEndpoint.ReserveTrialCreateAccount,
+	PartnerEndpoint.ListComputers,
+	PartnerEndpoint.DeleteComputer
+]);
+function endpointRequirement(suite, capabilities) {
+	return Object.freeze({
+		suite,
+		capabilities: Object.freeze([...capabilities])
+	});
+}
+var PARTNER_ENDPOINT_CAPABILITIES = Object.freeze({
+	[PartnerEndpoint.CreateGroupMember]: endpointRequirement("groups", [PartnerCapability.All]),
+	[PartnerEndpoint.EjectGroupMember]: endpointRequirement("groups", [PartnerCapability.All]),
+	[PartnerEndpoint.ListGroups]: endpointRequirement("groups", [PartnerCapability.All]),
+	[PartnerEndpoint.ListGroupMembers]: endpointRequirement("groups", [PartnerCapability.All]),
+	[PartnerEndpoint.ReserveTrialCreateAccount]: endpointRequirement("groups", [PartnerCapability.All]),
+	[PartnerEndpoint.ListComputers]: endpointRequirement("backup", [PartnerCapability.All]),
+	[PartnerEndpoint.DeleteComputer]: endpointRequirement("backup", [PartnerCapability.All])
+});
+/**
+* Resolve the frozen capability requirement for a Partner or Backup endpoint.
+*
+* @param endpoint - Partner or Computer Backup endpoint name.
+*
+* @returns The endpoint's requirement, or null when no policy is available.
+*/
+function partnerEndpointCapabilityRequirementFor(endpoint) {
+	return PARTNER_ENDPOINT_CAPABILITIES[endpoint] ?? null;
+}
+/**
+* Find missing Partner capabilities against an already-resolved requirement.
+*
+* @param required - Partner capabilities required by the endpoint.
+* @param granted - Partner capabilities granted by the token suite.
+*
+* @returns The subset of required Partner capabilities absent from `granted`.
+*/
+function missingPartnerCapabilities(required, granted) {
+	const grantedSet = new Set(granted);
+	return required.filter((capability) => !grantedSet.has(capability));
+}
+//#endregion
+export { PARTNER_ENDPOINT_CAPABILITIES, PARTNER_ENDPOINT_NAMES, PartnerEndpoint, missingPartnerCapabilities, partnerEndpointCapabilityRequirementFor };
+
+//# sourceMappingURL=partner-capabilities.js.map

package/dist/simulator/partner-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"partner-capabilities.js","names":[],"sources":["../../src/simulator/partner-capabilities.ts"],"sourcesContent":["/**\n * Partner and Computer Backup endpoint capability requirements.\n *\n * Partner tokens carry suite-specific grants that are independent from\n * storage application-key capabilities. The simulator uses this table only\n * for strict Partner/Backup auth checks.\n *\n * Source: https://www.backblaze.com/apidocs (Partner endpoint pages list\n * valid-token authorization failures as `401 unauthorized`).\n *\n * @packageDocumentation\n */\n\nimport { PartnerCapability } from '../types/partner.ts'\n\nexport const PartnerEndpoint = Object.freeze({\n  CreateGroupMember: 'b2_create_group_member',\n  EjectGroupMember: 'b2_eject_group_member',\n  ListGroups: 'b2_list_groups',\n  ListGroupMembers: 'b2_list_group_members',\n  ReserveTrialCreateAccount: 'b2_reserve_trial_create_account',\n  ListComputers: 'bz_list_computers',\n  DeleteComputer: 'bz_delete_computer',\n} as const)\n\nexport type PartnerEndpoint = (typeof PartnerEndpoint)[keyof typeof PartnerEndpoint]\n\nexport const PARTNER_ENDPOINT_NAMES = Object.freeze([\n  PartnerEndpoint.CreateGroupMember,\n  PartnerEndpoint.EjectGroupMember,\n  PartnerEndpoint.ListGroups,\n  PartnerEndpoint.ListGroupMembers,\n  PartnerEndpoint.ReserveTrialCreateAccount,\n  PartnerEndpoint.ListComputers,\n  PartnerEndpoint.DeleteComputer,\n] as const)\n\nexport type PartnerCapabilitySuite = 'groups' | 'backup'\n\nexport interface PartnerEndpointCapabilityRequirement {\n  readonly suite: PartnerCapabilitySuite\n  readonly capabilities: readonly PartnerCapability[]\n}\n\nfunction endpointRequirement(\n  suite: PartnerCapabilitySuite,\n  capabilities: readonly PartnerCapability[],\n): PartnerEndpointCapabilityRequirement {\n  return Object.freeze({\n    suite,\n    capabilities: Object.freeze([...capabilities]),\n  })\n}\n\nexport const PARTNER_ENDPOINT_CAPABILITIES = Object.freeze({\n  [PartnerEndpoint.CreateGroupMember]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.EjectGroupMember]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.ListGroups]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.ListGroupMembers]: endpointRequirement('groups', [PartnerCapability.All]),\n  [PartnerEndpoint.ReserveTrialCreateAccount]: endpointRequirement('groups', [\n    PartnerCapability.All,\n  ]),\n  [PartnerEndpoint.ListComputers]: endpointRequirement('backup', [PartnerCapability.All]),\n  [PartnerEndpoint.DeleteComputer]: endpointRequirement('backup', [PartnerCapability.All]),\n} satisfies Record<PartnerEndpoint, PartnerEndpointCapabilityRequirement>)\n\n/**\n * Resolve the frozen capability requirement for a Partner or Backup endpoint.\n *\n * @param endpoint - Partner or Computer Backup endpoint name.\n *\n * @returns The endpoint's requirement, or null when no policy is available.\n */\nexport function partnerEndpointCapabilityRequirementFor(\n  endpoint: PartnerEndpoint,\n): PartnerEndpointCapabilityRequirement | null {\n  return PARTNER_ENDPOINT_CAPABILITIES[endpoint] ?? null\n}\n\n/**\n * Find missing Partner capabilities against an already-resolved requirement.\n *\n * @param required - Partner capabilities required by the endpoint.\n * @param granted - Partner capabilities granted by the token suite.\n *\n * @returns The subset of required Partner capabilities absent from `granted`.\n */\nexport function missingPartnerCapabilities(\n  required: readonly PartnerCapability[],\n  granted: readonly PartnerCapability[],\n): readonly PartnerCapability[] {\n  const grantedSet = new Set(granted)\n  return required.filter((capability) => !grantedSet.has(capability))\n}\n\n/**\n * Find which Partner capabilities are missing from the caller's grant set.\n *\n * @param endpoint - Partner or Computer Backup endpoint name.\n * @param granted - Suite capabilities carried by the Partner token.\n *\n * @returns The required Partner capabilities not present in `granted`.\n */\nexport function missingPartnerCapabilitiesFor(\n  endpoint: PartnerEndpoint,\n  granted: readonly PartnerCapability[],\n): readonly PartnerCapability[] {\n  return missingPartnerCapabilities(\n    partnerEndpointCapabilityRequirementFor(endpoint)?.capabilities ?? [],\n    granted,\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,IAAa,kBAAkB,OAAO,OAAO;CAC3C,mBAAmB;CACnB,kBAAkB;CAClB,YAAY;CACZ,kBAAkB;CAClB,2BAA2B;CAC3B,eAAe;CACf,gBAAgB;AAClB,CAAU;AAIV,IAAa,yBAAyB,OAAO,OAAO;CAClD,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;AAClB,CAAU;AASV,SAAS,oBACP,OACA,cACsC;CACtC,OAAO,OAAO,OAAO;EACnB;EACA,cAAc,OAAO,OAAO,CAAC,GAAG,YAAY,CAAC;CAC/C,CAAC;AACH;AAEA,IAAa,gCAAgC,OAAO,OAAO;EACxD,gBAAgB,oBAAoB,oBAAoB,UAAU,CAAC,kBAAkB,GAAG,CAAC;EACzF,gBAAgB,mBAAmB,oBAAoB,UAAU,CAAC,kBAAkB,GAAG,CAAC;EACxF,gBAAgB,aAAa,oBAAoB,UAAU,CAAC,kBAAkB,GAAG,CAAC;EAClF,gBAAgB,mBAAmB,oBAAoB,UAAU,CAAC,kBAAkB,GAAG,CAAC;EACxF,gBAAgB,4BAA4B,oBAAoB,UAAU,CACzE,kBAAkB,GACpB,CAAC;EACA,gBAAgB,gBAAgB,oBAAoB,UAAU,CAAC,kBAAkB,GAAG,CAAC;EACrF,gBAAgB,iBAAiB,oBAAoB,UAAU,CAAC,kBAAkB,GAAG,CAAC;AACzF,CAAyE;;;;;;;;AASzE,SAAgB,wCACd,UAC6C;CAC7C,OAAO,8BAA8B,aAAa;AACpD;;;;;;;;;AAUA,SAAgB,2BACd,UACA,SAC8B;CAC9B,MAAM,aAAa,IAAI,IAAI,OAAO;CAClC,OAAO,SAAS,QAAQ,eAAe,CAAC,WAAW,IAAI,UAAU,CAAC;AACpE"}

package/dist/simulator/partner.cjs

@@ -1,18 +1,11 @@
 const require_ids = require("../types/ids.cjs");
 const require_auth = require("../types/auth.cjs");
 const require_partner = require("../types/partner.cjs");
+const require_partner_capabilities = require("./partner-capabilities.cjs");
 //#region src/simulator/partner.ts
 var DAY_MS = 864e5;
 var PARTNER_REGIONS = new Set(Object.values(require_partner.Region));
-var PARTNER_API_ENDPOINTS = /* @__PURE__ */ new Set([
-	"b2_create_group_member",
-	"b2_eject_group_member",
-	"b2_list_groups",
-	"b2_list_group_members",
-	"b2_reserve_trial_create_account",
-	"bz_list_computers",
-	"bz_delete_computer"
-]);
+var PARTNER_API_ENDPOINTS = new Set(require_partner_capabilities.PARTNER_ENDPOINT_NAMES);
 var DEFAULT_GROUP_COUNT = 3;
 var MAX_GROUPS_PER_ADMIN = 500;
 var DEFAULT_MAX_GROUP_COUNT = 100;
@@ -38,24 +31,15 @@ var PARTNER_CREATED_STORAGE_KEY_CAPABILITIES = Object.freeze([
 function isPartnerApiEndpoint(endpoint) {
 	return PARTNER_API_ENDPOINTS.has(endpoint);
 }
-var PARTNER_QUERY_ENDPOINTS = /* @__PURE__ */ new Set([
-	"b2_list_groups",
-	"b2_list_group_members",
-	"bz_list_computers"
-]);
-/**
-* Checks whether a JSON API endpoint can safely receive GET query parameters.
-*
-* @param endpoint - Endpoint name parsed from the request path.
-*
-* @returns `true` for Partner/Backup list endpoints that document GET query requests.
-*/
-function isPartnerQueryEndpoint(endpoint) {
-	return PARTNER_QUERY_ENDPOINTS.has(endpoint);
-}
+require_partner_capabilities.PartnerEndpoint.ListGroups, require_partner_capabilities.PartnerEndpoint.ListGroupMembers, require_partner_capabilities.PartnerEndpoint.ListComputers;
 function utcDateString(ms) {
 	return new Date(ms).toISOString().slice(0, 10);
 }
+function b2FriendlyTimestamp(ms) {
+	const date = new Date(ms);
+	const pad = (n, width = 2) => String(n).padStart(width, "0");
+	return `d${`${pad(date.getUTCFullYear(), 4)}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}`}_m${`${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}`}`;
+}
 function utcDayStartMs(ms) {
 	const date = new Date(ms);
 	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
@@ -80,6 +64,9 @@ function compareStrings(left, right) {
 	if (left > right) return 1;
 	return 0;
 }
+function clonePartnerCapabilities(capabilities) {
+	return Object.freeze([...capabilities]);
+}
 /**
 * Handles Partner and Computer Backup simulator state and endpoint logic.
 *
@@ -109,6 +96,8 @@ var PartnerSimulator = class {
 	apiEnabled;
 	accountHasValidPhone;
 	accountInGoodStanding;
+	groupsCapabilities;
+	backupCapabilities;
 	/**
 	* Creates the Partner/Backup simulator facade.
 	*
@@ -122,6 +111,8 @@ var PartnerSimulator = class {
 		this.apiEnabled = options.partnerApiEnabled ?? true;
 		this.accountHasValidPhone = options.partnerAccountHasValidPhone ?? true;
 		this.accountInGoodStanding = options.partnerAccountInGoodStanding ?? true;
+		this.groupsCapabilities = clonePartnerCapabilities(options.partnerGroupsCapabilities ?? [require_partner.PartnerCapability.All]);
+		this.backupCapabilities = clonePartnerCapabilities(options.partnerBackupCapabilities ?? [require_partner.PartnerCapability.All]);
 	}
 	/**
 	* Reports whether v3 authorize should return Partner/Backup suites.
@@ -154,7 +145,9 @@ var PartnerSimulator = class {
 		const tokenStr = this.host.genId("sim_partner_auth_token");
 		this.issuedTokens.set(tokenStr, {
 			accountId: this.host.accountId,
-			expiresAt: this.host.now() + this.host.authTokenTtlMs
+			backupCapabilities: this.backupCapabilities,
+			expiresAt: this.host.now() + this.host.authTokenTtlMs,
+			groupsCapabilities: this.groupsCapabilities
 		});
 		return {
 			status: 200,
@@ -184,13 +177,13 @@ var PartnerSimulator = class {
 						s3ApiUrl: origin
 					},
 					groupsApi: {
-						capabilities: [require_partner.PartnerCapability.All],
+						capabilities: this.groupsCapabilities,
 						groupsApiUrl: `${origin}/partner`,
 						infoType: "groupsApi"
 					},
 					backupApi: {
 						backupApiUrl: `${origin}/backup`,
-						capabilities: [require_partner.PartnerCapability.All],
+						capabilities: this.backupCapabilities,
 						infoType: "backupApi"
 					}
 				},
@@ -201,27 +194,20 @@ var PartnerSimulator = class {
 	/**
 	* Handles b2_reserve_trial_create_account.
 	*
-	* @param body - Parsed JSON array request body.
+	* @param body - Parsed JSON request body.
 	* @param authToken - Partner authorization token.
 	*
 	* @returns Simulator JSON response.
 	*/
 	reserveTrialCreateAccount(body, authToken) {
-		const auth = this.authorizeRequest(authToken);
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ReserveTrialCreateAccount, authToken);
 		if ("status" in auth) return auth;
-		if (!Array.isArray(body)) return this.host.error(400, "bad_request", "request body must be an array");
-		if (body.length === 0) return this.host.error(400, "bad_request", "request body must include at least one account");
-		const entries = [];
-		const requestEmails = /* @__PURE__ */ new Set();
-		for (const item of body) {
-			const parsed = this.parseReserveTrialCreateAccountEntry(item, requestEmails);
-			if (parsed.error !== null) return parsed.error;
-			entries.push(parsed);
-		}
+		const parsed = this.parseReserveTrialCreateAccountRequest(body);
+		if (parsed.error !== null) return parsed.error;
 		const startDayMs = utcDayStartMs(this.host.now());
 		return {
 			status: 200,
-			body: entries.map(({ entry, normalizedEmail }) => this.createReserveTrialAccount(entry, normalizedEmail, startDayMs))
+			body: this.createReserveTrialAccount(parsed.entry, parsed.normalizedEmail, startDayMs)
 		};
 	}
 	/**
@@ -233,7 +219,7 @@ var PartnerSimulator = class {
 	* @returns Simulator JSON response.
 	*/
 	createGroupMember(body, authToken) {
-		const auth = this.authorizeRequest(authToken, { checkPhone: false });
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.CreateGroupMember, authToken, { checkPhone: false });
 		if ("status" in auth) return auth;
 		const record = requestObject(body);
 		const request = this.parseCreateGroupMemberRequest(record);
@@ -279,11 +265,11 @@ var PartnerSimulator = class {
 		});
 		return {
 			status: 200,
-			body: [{
+			body: {
 				applicationKeyId: applicationKeyId$1,
 				applicationKey,
 				groupMember: this.publicGroupMember(stored)
-			}]
+			}
 		};
 	}
 	/**
@@ -295,7 +281,7 @@ var PartnerSimulator = class {
 	* @returns Simulator JSON response.
 	*/
 	ejectGroupMember(body, authToken) {
-		const auth = this.authorizeRequest(authToken);
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.EjectGroupMember, authToken);
 		if ("status" in auth) return auth;
 		const record = requestObject(body);
 		const request = this.parseEjectGroupMemberRequest(record);
@@ -334,7 +320,7 @@ var PartnerSimulator = class {
 	* @returns Simulator JSON response.
 	*/
 	listGroups(body, authToken) {
-		const auth = this.authorizeRequest(authToken, { checkPhone: false });
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ListGroups, authToken, { checkPhone: false });
 		if ("status" in auth) return auth;
 		const record = requestObject(body);
 		const adminAccountId = this.requiredString(record, "adminAccountId", 400, "bad_request");
@@ -373,7 +359,7 @@ var PartnerSimulator = class {
 	* @returns Simulator JSON response.
 	*/
 	listGroupMembers(body, authToken) {
-		const auth = this.authorizeRequest(authToken, { checkPhone: false });
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ListGroupMembers, authToken, { checkPhone: false });
 		if ("status" in auth) return auth;
 		const record = requestObject(body);
 		const request = this.parseListGroupMembersRequest(record);
@@ -390,12 +376,12 @@ var PartnerSimulator = class {
 		const next = members[normalizedStartIndex + request.maxMemberCount];
 		return {
 			status: 200,
-			body: [{
+			body: {
 				groupId: require_ids.groupId(group.groupId),
 				groupName: group.groupName,
 				groupMembers: page.map((member) => this.publicListedGroupMember(member)),
 				nextEmail: next === void 0 ? null : next.email
-			}]
+			}
 		};
 	}
 	/**
@@ -407,7 +393,7 @@ var PartnerSimulator = class {
 	* @returns Simulator JSON response.
 	*/
 	listComputers(body, authToken) {
-		const auth = this.authorizeRequest(authToken, { checkPhone: false });
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.ListComputers, authToken, { checkPhone: false });
 		if ("status" in auth) return auth;
 		const record = requestObject(body);
 		const accountId = this.requiredString(record, "accountId", 400, "invalid_account_id");
@@ -446,7 +432,7 @@ var PartnerSimulator = class {
 	* @returns Simulator JSON response.
 	*/
 	deleteComputer(body, authToken) {
-		const auth = this.authorizeRequest(authToken, { checkPhone: false });
+		const auth = this.authorizeRequest(require_partner_capabilities.PartnerEndpoint.DeleteComputer, authToken, { checkPhone: false });
 		if ("status" in auth) return auth;
 		const record = requestObject(body);
 		const accountId = this.requiredString(record, "accountId", 400, "invalid_account_id");
@@ -463,7 +449,7 @@ var PartnerSimulator = class {
 			body: [this.publicComputer(computer)]
 		};
 	}
-	authorizeRequest(authToken, options = {}) {
+	authorizeRequest(endpoint, authToken, options = {}) {
 		if (authToken === void 0 || authToken.trim() === "" || /\s/.test(authToken)) return this.host.error(403, "access_denied", "missing or malformed Partner API Authorization header");
 		if (!this.validateIssuedTokens) {
 			if (!this.apiEnabled) return this.host.error(403, "access_denied", "account is not enabled for Partner API");
@@ -476,28 +462,37 @@ var PartnerSimulator = class {
 		if (!this.apiEnabled) return this.host.error(403, "access_denied", "account is not enabled for Partner API");
 		if (options.checkPhone !== false && !this.accountHasValidPhone) return this.host.error(403, "access_denied", "account does not have a valid phone number");
 		if (!this.accountInGoodStanding) return this.host.error(403, "access_denied", "account is not in good standing");
+		const capabilityError = this.authorizeEndpointCapabilities(endpoint, token);
+		if (capabilityError !== null) return capabilityError;
 		return { accountId: token.accountId };
 	}
+	authorizeEndpointCapabilities(endpoint, token) {
+		const requirement = require_partner_capabilities.partnerEndpointCapabilityRequirementFor(endpoint);
+		if (requirement === null) return this.host.error(401, "unauthorized", `no Partner capability policy for ${endpoint}`);
+		const granted = requirement.suite === "groups" ? token.groupsCapabilities : token.backupCapabilities;
+		const missing = require_partner_capabilities.missingPartnerCapabilities(requirement.capabilities, granted);
+		if (missing.length === 0) return null;
+		return this.host.error(401, "unauthorized", `Partner token lacks required capabilities: ${missing.join(", ")}`);
+	}
 	authorizeAccount(auth, requestedAccountId) {
 		if (auth.accountId === null) return null;
 		if (auth.accountId === requestedAccountId) return null;
 		return this.host.error(403, "unauthorized", "Partner token is not authorized for requested account");
 	}
-	parseReserveTrialCreateAccountEntry(value, requestEmails) {
-		if (typeof value !== "object" || value === null) return { error: this.host.error(400, "bad_request", "trial account request must be an object") };
+	parseReserveTrialCreateAccountRequest(value) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return { error: this.host.error(400, "bad_request", "trial account request must be an object") };
 		const record = value;
 		const email = record["email"];
 		if (typeof email !== "string") return { error: this.host.error(400, "bad_request", "email is required") };
 		if (!isValidEmailAddress(email)) return { error: this.host.error(400, "bad_request", "email address is invalid") };
 		const normalizedEmail = normalizeEmail(email);
-		if (this.knownEmails.has(normalizedEmail) || requestEmails.has(normalizedEmail)) return { error: this.host.error(400, "bad_request", "email must not already exist as a Backblaze account") };
+		if (this.knownEmails.has(normalizedEmail)) return { error: this.host.error(400, "bad_request", "email must not already exist as a Backblaze account") };
 		const term = record["term"];
 		if (typeof term !== "number" || !Number.isInteger(term) || term < 7 || term > 30) return { error: this.host.error(400, "bad_request", "term must be between 7 and 30 days") };
 		const storage = record["storage"];
 		if (typeof storage !== "number" || !Number.isInteger(storage) || storage < 1 || storage > 50) return { error: this.host.error(400, "bad_request", "storage must be between 1 and 50 TB") };
 		const region = record["region"];
 		if (region !== void 0 && region !== null && (typeof region !== "string" || !PARTNER_REGIONS.has(region))) return { error: this.host.error(400, "bad_request", "region is not supported") };
-		requestEmails.add(normalizedEmail);
 		return {
 			entry: {
 				email,
@@ -666,9 +661,9 @@ var PartnerSimulator = class {
 		return computers;
 	}
 	publicGroup(group) {
-		const timestamp = new Date(group.createdTimestamp).toISOString();
+		const timestamp = b2FriendlyTimestamp(group.createdTimestamp);
 		return {
-			accountStandingDetails: { state: "good_standing" },
+			accountStandingDetails: { state: "B2_GOOD_STANDING" },
 			b2Stats: this.emptyB2Stats(group.createdTimestamp),
 			groupId: require_ids.groupId(group.groupId),
 			groupName: group.groupName,
@@ -705,15 +700,14 @@ var PartnerSimulator = class {
 	}
 	emptyB2Stats(timestamp) {
 		return {
-			b2BytesStoredCount: "0",
-			b2FilesStoredCount: "0",
-			b2StatsAsOfTimestamp: new Date(timestamp).toISOString(),
-			bucketCount: "0"
+			b2BytesStoredCount: 0,
+			b2FilesStoredCount: 0,
+			b2StatsAsOfTimestamp: b2FriendlyTimestamp(timestamp),
+			bucketCount: 0
 		};
 	}
 };
 //#endregion
 exports.PartnerSimulator = PartnerSimulator;
-exports.isPartnerQueryEndpoint = isPartnerQueryEndpoint;
 
 //# sourceMappingURL=partner.cjs.map