@camunda/ccma-api 5.20.1 → 6.0.0

package/dist/services/control/control.approvals.service.d.ts

@@ -1,4 +1,4 @@
-import type { ApprovalEntityType, ApprovalJobDto, ApprovalJobStatus, ApprovalSortField, ApprovalSortOrder, ApprovalStatusCountsDto, ApprovalUseCaseDto, ClusterBulkOperationPayloadDto, ClusterBulkOperationType, ClusterCorpseKind, ClusterPlanModificationConfig, ClusterTtlDeletionPayload, EnterpriseIncludingValueMetrics, GenerationEnvVarsDto, GenerationImageVersionsDto, LicensingModelType, ReleaseTrainPublishPayload, ReleaseTrainRollbackPayload } from '@camunda/ccma-shared-types';
+import type { ApprovalEntityType, ApprovalJobDto, ApprovalJobStatus, ApprovalOverrideGrantDto, ApprovalSortField, ApprovalSortOrder, ApprovalStatusCountsDto, ApprovalUseCaseDto, ClusterBulkOperationPayloadDto, ClusterBulkOperationType, ClusterCorpseKind, ClusterPlanModificationConfig, ClusterTtlDeletionPayload, EnterpriseIncludingValueMetrics, GenerationEnvVarsDto, GenerationImageVersionsDto, LicensingModelType, ReleaseTrainPublishPayload, ReleaseTrainRollbackPayload } from '@camunda/ccma-shared-types';
 import type { RequestBaseParams } from '../../types/general.types.js';
 export interface ApprovalPageDto {
     approvals: ApprovalJobDto[];
@@ -103,6 +103,19 @@ export interface CreateApprovalRequest<TPayload> extends RequestBaseParams {
         requiredAcks?: number;
     };
 }
+/** An override needs a reason, which goes to the audit trail. */
+export interface OverrideApprovalRequest extends RequestBaseParams {
+    params: {
+        id: string;
+        reason: string;
+    };
+}
+export interface GrantApprovalOverridePayloadDto {
+    /** The Camundi who gets the grant. It can be the person who asks. */
+    granteeEmail: string;
+    /** At most `APPROVAL_OVERRIDE_MAX_HOURS`, counted from the run. */
+    durationHours: number;
+}
 export interface SendToExpiredTrialPayloadDto {
     orgId: string;
     orgName?: string;
@@ -282,6 +295,24 @@ export interface ChangeOrgLimitsPayloadDto {
     /** The new override. `null` clears it, and the default of the plan applies. */
     value: string | number | boolean | null;
 }
+export interface LlmBudgetTopUpPayloadDto {
+    orgId: string;
+    /** A copy, so a list shows a name that a person knows. Nothing reads it. */
+    orgName?: string;
+    /**
+     * The budget that the person who asked READ. Accounts compares it with the
+     * budget when the action runs, and changes nothing when the two differ.
+     */
+    expectedBudget: number;
+    /** The spend that the person who asked read. The approver reads it. */
+    spend: number;
+    /**
+     * True when the person who asked confirmed a top-up with the spend below
+     * `LLM_BUDGET_TOP_UP_THRESHOLD`. Without it, such a request fails when it
+     * runs.
+     */
+    belowThreshold: boolean;
+}
 /** One generation of a change-generation-versions request. */
 export interface ChangeGenerationVersionsTargetDto {
     id: string;
@@ -737,6 +768,17 @@ export declare class ControlApprovalsService {
         approval: ApprovalJobDto;
         created: boolean;
     }>;
+    /**
+     * Opens a llm-budget-top-up request.
+     *
+     * Opening one needs `accounts:admin:mayChangeOrgLimits`, the same
+     * permission that approving needs. A 200 means that a request for the same
+     * organization is already open.
+     */
+    static createLlmBudgetTopUp(params: CreateApprovalRequest<LlmBudgetTopUpPayloadDto>): Promise<{
+        approval: ApprovalJobDto;
+        created: boolean;
+    }>;
     /**
      * Opens a delete-sso-connection request.
      *
@@ -754,7 +796,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `AccountsPermissions.ENTERPRISE_ORG_CONVERT`, the same
      * permission that approving needs. A 200 means that a request for the same
      * organization is already open. The route answers 404 while
-     * `control.onboardToEnterpriseApproval` is off.
+     * `control.camundiApprovalFlow` is off.
      */
     static createOnboardToEnterprise(params: CreateApprovalRequest<OnboardToEnterprisePayloadDto>): Promise<{
         approval: ApprovalJobDto;
@@ -776,7 +818,7 @@ export declare class ControlApprovalsService {
      *
      * Opening one needs `AccountsPermissions.READ_ALL`.
      * A holder of `SALES_PLAN_SWITCH` approves it, and the last approval runs
-     * it. The route answers 404 while `control.approvalInNegotiation` is off.
+     * it.
      */
     static createRequestInNegotiation(params: CreateApprovalRequest<RequestInNegotiationPayloadDto>): Promise<{
         approval: ApprovalJobDto;
@@ -788,7 +830,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN`,
      * the same permission that approving needs. A 200 means that a request
      * over the same generations is already open. The route answers 404 while
-     * `control.changeGenerationVersions` is off.
+     * `control.camundiApprovalFlow` is off.
      */
     static createChangeGenerationVersions(params: CreateApprovalRequest<ChangeGenerationVersionsPayloadDto>): Promise<{
         approval: ApprovalJobDto;
@@ -800,7 +842,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN`,
      * the same permission that approving needs. A 200 means that a request
      * over the same generation is already open. The route answers 404 while
-     * `control.editGeneration` is off.
+     * `control.camundiApprovalFlow` is off.
      */
     static createEditGeneration(params: CreateApprovalRequest<EditGenerationPayloadDto>): Promise<{
         approval: ApprovalJobDto;
@@ -812,7 +854,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `ConsolePermissions.CLUSTERS_DELETE_CLUSTER`, the same
      * permission that approving needs. A 200 means that a request for the same
      * kind is already open. The route answers 404 while
-     * `control.deleteClusterCorpses` is off, 409 when console has no corpse
+     * `control.camundiApprovalFlow` is off, 409 when console has no corpse
      * that a request can take, and 412 when console does not answer its
      * corpses.
      */
@@ -826,7 +868,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE`,
      * the same permission that approving needs. A 200 means that a request for
      * the same plan type is already open. The route answers 404 while
-     * `control.forceDeleteClusterPlanType` is off or when console does not know
+     * `control.camundiApprovalFlow` is off or when console does not know
      * the plan type, 409 when no cluster uses the type or more than the cap do,
      * and 412 when console does not answer its clusters.
      */
@@ -840,7 +882,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `AccountsPermissions.ENTERPRISE_ORG_CONVERT`, the same
      * permission that approving needs. A 200 means that a request with the
      * same organization name is already open. The route answers 404 while
-     * `control.automatedEnterpriseOnboarding` is off.
+     * `control.camundiApprovalFlow` is off.
      */
     static createAutomatedEnterpriseOnboarding(params: CreateApprovalRequest<AutomatedEnterpriseOnboardingPayloadDto>): Promise<{
         approval: ApprovalJobDto;
@@ -852,7 +894,7 @@ export declare class ControlApprovalsService {
      * Opening one needs `ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE`,
      * the same permission that approving needs. A 200 means that a request for
      * the same cluster is already open. The route answers 404 while
-     * `control.changeClusterPlanType` is off.
+     * `control.camundiApprovalFlow` is off.
      */
     static createChangeClusterPlanType(params: CreateApprovalRequest<ChangeClusterPlanTypePayloadDto>): Promise<{
         approval: ApprovalJobDto;
@@ -958,13 +1000,34 @@ export declare class ControlApprovalsService {
      * read `status` and `executionError` of the answer.
      */
     static execute(params: ApprovalIdRequest): Promise<ApprovalJobDto>;
+    /**
+     * Runs a `pending` request with the approval override grant of the caller,
+     * in place of the approvals that it still needs. control-backend answers
+     * 404 while `control.approvalOverride` is off.
+     */
+    static override(params: OverrideApprovalRequest): Promise<ApprovalJobDto>;
+    /**
+     * Opens a grant-approval-override request. Opening one needs
+     * `accounts:admin:changeRole`, and it needs two approvals. A 200 means
+     * that a request for the same grantee is already open.
+     */
+    static createGrantApprovalOverride(params: CreateApprovalRequest<GrantApprovalOverridePayloadDto>): Promise<{
+        approval: ApprovalJobDto;
+        created: boolean;
+    }>;
+    /**
+     * The approval override grant of the caller that is active now, or
+     * `undefined`. control-backend answers 404 while `control.approvalOverride`
+     * is off.
+     */
+    static getMyOverrideGrant(params: RequestBaseParams): Promise<ApprovalOverrideGrantDto | undefined>;
     /** Opens a send-to-expired-trial request. Any signed-in Camundi can. */
     static createSendToExpiredTrial(params: CreateApprovalRequest<SendToExpiredTrialPayloadDto>): Promise<ApprovalJobDto>;
     /**
      * Opens an extend-trial request.
      *
-     * Opening one needs `accounts:admin:extendTrial`, and the reason is
-     * necessary. The request needs no approval, so the answer already holds the
+     * Opening one needs `accounts:admin:extendTrial`. The opener gives the one
+     * approval, so no reason is necessary and the answer already holds the
      * outcome.
      */
     static createExtendTrial(params: CreateExtendTrialRequest): Promise<ApprovalJobDto>;

package/dist/services/control/control.approvals.service.js

@@ -215,6 +215,20 @@ class ControlApprovalsService {
       "api/approvals/change-org-limits"
     );
   }
+  /**
+   * Opens a llm-budget-top-up request.
+   *
+   * Opening one needs `accounts:admin:mayChangeOrgLimits`, the same
+   * permission that approving needs. A 200 means that a request for the same
+   * organization is already open.
+   */
+  static async createLlmBudgetTopUp(params) {
+    return ControlApprovalsService.create(
+      params,
+      "createLlmBudgetTopUp",
+      "api/approvals/llm-budget-top-up"
+    );
+  }
   /**
    * Opens a delete-sso-connection request.
    *
@@ -235,7 +249,7 @@ class ControlApprovalsService {
    * Opening one needs `AccountsPermissions.ENTERPRISE_ORG_CONVERT`, the same
    * permission that approving needs. A 200 means that a request for the same
    * organization is already open. The route answers 404 while
-   * `control.onboardToEnterpriseApproval` is off.
+   * `control.camundiApprovalFlow` is off.
    */
   static async createOnboardToEnterprise(params) {
     return ControlApprovalsService.create(
@@ -263,7 +277,7 @@ class ControlApprovalsService {
    *
    * Opening one needs `AccountsPermissions.READ_ALL`.
    * A holder of `SALES_PLAN_SWITCH` approves it, and the last approval runs
-   * it. The route answers 404 while `control.approvalInNegotiation` is off.
+   * it.
    */
   static async createRequestInNegotiation(params) {
     return ControlApprovalsService.create(
@@ -278,7 +292,7 @@ class ControlApprovalsService {
    * Opening one needs `ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN`,
    * the same permission that approving needs. A 200 means that a request
    * over the same generations is already open. The route answers 404 while
-   * `control.changeGenerationVersions` is off.
+   * `control.camundiApprovalFlow` is off.
    */
   static async createChangeGenerationVersions(params) {
     return ControlApprovalsService.create(
@@ -293,7 +307,7 @@ class ControlApprovalsService {
    * Opening one needs `ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN`,
    * the same permission that approving needs. A 200 means that a request
    * over the same generation is already open. The route answers 404 while
-   * `control.editGeneration` is off.
+   * `control.camundiApprovalFlow` is off.
    */
   static async createEditGeneration(params) {
     return ControlApprovalsService.create(
@@ -310,7 +324,7 @@ class ControlApprovalsService {
    * Opening one needs `ConsolePermissions.CLUSTERS_DELETE_CLUSTER`, the same
    * permission that approving needs. A 200 means that a request for the same
    * kind is already open. The route answers 404 while
-   * `control.deleteClusterCorpses` is off, 409 when console has no corpse
+   * `control.camundiApprovalFlow` is off, 409 when console has no corpse
    * that a request can take, and 412 when console does not answer its
    * corpses.
    */
@@ -327,7 +341,7 @@ class ControlApprovalsService {
    * Opening one needs `ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE`,
    * the same permission that approving needs. A 200 means that a request for
    * the same plan type is already open. The route answers 404 while
-   * `control.forceDeleteClusterPlanType` is off or when console does not know
+   * `control.camundiApprovalFlow` is off or when console does not know
    * the plan type, 409 when no cluster uses the type or more than the cap do,
    * and 412 when console does not answer its clusters.
    */
@@ -344,7 +358,7 @@ class ControlApprovalsService {
    * Opening one needs `AccountsPermissions.ENTERPRISE_ORG_CONVERT`, the same
    * permission that approving needs. A 200 means that a request with the
    * same organization name is already open. The route answers 404 while
-   * `control.automatedEnterpriseOnboarding` is off.
+   * `control.camundiApprovalFlow` is off.
    */
   static async createAutomatedEnterpriseOnboarding(params) {
     return ControlApprovalsService.create(
@@ -359,7 +373,7 @@ class ControlApprovalsService {
    * Opening one needs `ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE`,
    * the same permission that approving needs. A 200 means that a request for
    * the same cluster is already open. The route answers 404 while
-   * `control.changeClusterPlanType` is off.
+   * `control.camundiApprovalFlow` is off.
    */
   static async createChangeClusterPlanType(params) {
     return ControlApprovalsService.create(
@@ -526,6 +540,62 @@ class ControlApprovalsService {
       "post"
     );
   }
+  /**
+   * Runs a `pending` request with the approval override grant of the caller,
+   * in place of the approvals that it still needs. control-backend answers
+   * 404 while `control.approvalOverride` is off.
+   */
+  static async override(params) {
+    return ControlApprovalsService.readOne(
+      params,
+      "override",
+      `api/approvals/${params.params.id}/override`,
+      "api/approvals/:id/override",
+      "post",
+      { reason: params.params.reason }
+    );
+  }
+  /**
+   * Opens a grant-approval-override request. Opening one needs
+   * `accounts:admin:changeRole`, and it needs two approvals. A 200 means
+   * that a request for the same grantee is already open.
+   */
+  static async createGrantApprovalOverride(params) {
+    return ControlApprovalsService.create(
+      params,
+      "createGrantApprovalOverride",
+      "api/approvals/grant-approval-override"
+    );
+  }
+  /**
+   * The approval override grant of the caller that is active now, or
+   * `undefined`. control-backend answers 404 while `control.approvalOverride`
+   * is off.
+   */
+  static async getMyOverrideGrant(params) {
+    const serviceContext = contextFor(
+      "getMyOverrideGrant",
+      "api/approvals/override-grants/me",
+      "api/approvals/override-grants/me",
+      "get",
+      params.config.metrics?.source || "unset"
+    );
+    const response = await request({
+      config: params.config,
+      base: BASE,
+      url: serviceContext.method.url,
+      method: "get",
+      metricsDetails: serviceContext
+    });
+    if (!response.ok) {
+      throw new HttpError(
+        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,
+        response.status,
+        response.statusText
+      );
+    }
+    return response.body?.grant;
+  }
   /** Opens a send-to-expired-trial request. Any signed-in Camundi can. */
   static async createSendToExpiredTrial(params) {
     const { approval } = await ControlApprovalsService.create(
@@ -538,8 +608,8 @@ class ControlApprovalsService {
   /**
    * Opens an extend-trial request.
    *
-   * Opening one needs `accounts:admin:extendTrial`, and the reason is
-   * necessary. The request needs no approval, so the answer already holds the
+   * Opening one needs `accounts:admin:extendTrial`. The opener gives the one
+   * approval, so no reason is necessary and the answer already holds the
    * outcome.
    */
   static async createExtendTrial(params) {
@@ -691,7 +761,10 @@ class ControlApprovalsService {
       redactBody: options.redactBody,
       body: {
         payload: params.params.payload,
-        reason: params.params.reason,
+        // control-backend accepts no reason, but it refuses an empty one
+        // (`min(1)`). A dialog sends the text of its textarea, so a blank
+        // text must leave the field out.
+        reason: params.params.reason?.trim() ? params.params.reason : void 0,
         requiredAcks: params.params.requiredAcks
       }
     });