@canopy-io/node 0.1.1 → 0.3.0

package/dist/index.js

@@ -617,6 +617,162 @@ function withConcurrency(options = {}) {
   return { headers: { "If-Match": options.ifMatch } };
 }
 
+// src/resources/organizations.ts
+var Organizations = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  list(query = {}) {
+    return paginate(
+      (params) => this.client.request("GET", "/api/v1/organizations", {
+        query: params
+      }),
+      { ...query }
+    );
+  }
+  get(id) {
+    return this.client.request("GET", `/api/v1/organizations/${enc(id)}`);
+  }
+  create(input) {
+    return this.client.request("POST", "/api/v1/organizations", {
+      body: input
+    });
+  }
+  /**
+   * Pass `ifMatch` with the organization's current `version` to make a
+   * read-modify-write safe — a concurrent edit answers 409 instead of being
+   * silently overwritten.
+   */
+  update(id, input, options = {}) {
+    return this.client.request("PATCH", `/api/v1/organizations/${enc(id)}`, {
+      body: input,
+      ...withConcurrency(options)
+    });
+  }
+  /**
+   * Removes the organization with its memberships, pending invitations,
+   * policy, connection bindings, and the tree beneath it. Member identities
+   * survive.
+   */
+  delete(id, options = {}) {
+    return this.client.request(
+      "DELETE",
+      `/api/v1/organizations/${enc(id)}`,
+      withConcurrency(options)
+    );
+  }
+  /** Empties the container: every organization goes, the step before switching it off. */
+  deleteAll() {
+    return this.client.request("DELETE", "/api/v1/organizations");
+  }
+  // ── Members: one role per member, held inside the organization only ──
+  listMembers(id, query = {}) {
+    return paginate(
+      (params) => this.client.request("GET", `/api/v1/organizations/${enc(id)}/members`, {
+        query: params
+      }),
+      { ...query }
+    );
+  }
+  addMember(id, input) {
+    return this.client.request(
+      "POST",
+      `/api/v1/organizations/${enc(id)}/members`,
+      { body: input }
+    );
+  }
+  changeMemberRole(id, identityId, input) {
+    return this.client.request(
+      "PATCH",
+      `/api/v1/organizations/${enc(id)}/members/${enc(identityId)}`,
+      { body: input }
+    );
+  }
+  /** Revokes that organization's one role; the identity and its other memberships are untouched. */
+  removeMember(id, identityId) {
+    return this.client.request(
+      "DELETE",
+      `/api/v1/organizations/${enc(id)}/members/${enc(identityId)}`
+    );
+  }
+  // ── Invitations: pending membership, carrying the role the recipient will hold ──
+  listInvites(id, query = {}) {
+    return paginate(
+      (params) => this.client.request("GET", `/api/v1/organizations/${enc(id)}/invites`, {
+        query: params
+      }),
+      { ...query }
+    );
+  }
+  createInvite(id, input) {
+    return this.client.request(
+      "POST",
+      `/api/v1/organizations/${enc(id)}/invites`,
+      { body: input }
+    );
+  }
+  revokeInvite(id, inviteId) {
+    return this.client.request(
+      "DELETE",
+      `/api/v1/organizations/${enc(id)}/invites/${enc(inviteId)}`
+    );
+  }
+  // ── Policy: the organization's tightening of the Environment's sign-in rules ──
+  /**
+   * The organization's own values (null inherits), the Environment baseline
+   * they tighten from, and the effective policy its members sign in under.
+   */
+  getPolicy(id) {
+    return this.client.request(
+      "GET",
+      `/api/v1/organizations/${enc(id)}/policy`
+    );
+  }
+  /**
+   * Can only tighten the Environment: a value that would loosen it answers
+   * 400 `organization.policy_loosens`. Pass `ifMatch` with the policy's
+   * `version` (0 until the organization sets one) for a safe
+   * read-modify-write.
+   */
+  updatePolicy(id, input, options = {}) {
+    return this.client.request(
+      "PATCH",
+      `/api/v1/organizations/${enc(id)}/policy`,
+      { body: input, ...withConcurrency(options) }
+    );
+  }
+  // ── SSO: the organization's own identity provider ──
+  listSsoConnections(id) {
+    return this.client.request(
+      "GET",
+      `/api/v1/organizations/${enc(id)}/sso-connections`
+    );
+  }
+  /**
+   * Sign-ins through the connection then land in this organization, joining
+   * as a member with `default_role_id`. The connection must already be bound
+   * to the organization's Environment, and a connection binds to one
+   * organization per Environment.
+   */
+  bindSsoConnection(id, input) {
+    return this.client.request(
+      "POST",
+      `/api/v1/organizations/${enc(id)}/sso-connections`,
+      { body: input }
+    );
+  }
+  unbindSsoConnection(id, connectionId) {
+    return this.client.request(
+      "DELETE",
+      `/api/v1/organizations/${enc(id)}/sso-connections/${enc(connectionId)}`
+    );
+  }
+};
+function enc(segment) {
+  return encodeURIComponent(segment);
+}
+
 // src/resources/permissions.ts
 var Permissions = class {
   constructor(client) {
@@ -778,12 +934,14 @@ var Canopy = class {
   identities;
   roles;
   assignments;
+  organizations;
   constructor(options) {
     this.client = new CanopyClient(options);
     this.permissions = new Permissions(this.client);
     this.identities = new Identities(this.client);
     this.roles = new Roles(this.client);
     this.assignments = new Assignments(this.client);
+    this.organizations = new Organizations(this.client);
   }
 };
 
@@ -872,10 +1030,30 @@ var LocalAuthorizer = class {
     return { ...this.stats };
   }
   /**
-   * Drop everything held. Not needed in normal operation, where entries expire
-   * on their own; useful in tests and after a known change.
+   * Drop what is held so the next evaluate refetches.
+   *
+   * With an `identityId`, only that identity's grants are dropped — the
+   * cached hierarchy and every other identity's entries stay warm. This is
+   * the shape an assignment webhook wants: the event names the identity
+   * whose authority moved, and nothing else needs to pay a refetch for it.
+   *
+   * With no argument, everything goes: grants and the hierarchy tree. Not
+   * needed in normal operation, where entries expire on their own; useful in
+   * tests and after a change whose reach you cannot name (a role's
+   * permissions edited, a node moved).
+   *
+   * Multi-instance honesty: an invalidation reaches THIS process only. A
+   * webhook lands on one instance behind a load balancer; the others serve
+   * their cached grants until their own TTL expires. Unless the app fans the
+   * event out over its own pub/sub, the fleet-wide revocation guarantee is
+   * the TTL, and webhook-driven invalidation is a latency optimization on
+   * top of it — size the TTL to the revocation latency you can promise.
    */
-  invalidate() {
+  invalidate(identityId) {
+    if (identityId !== void 0) {
+      this.grants.delete(identityId);
+      return;
+    }
     this.grants.clear();
     this.tree = void 0;
   }
@@ -988,6 +1166,13 @@ var DEFAULT_JWKS_MIN_REFETCH_INTERVAL_MS = 30 * 1e3;
 var DEFAULT_JWKS_TIMEOUT_MS = 5e3;
 var PRINCIPAL_TYPES = /* @__PURE__ */ new Set(["user", "identity", "api_key", "platform"]);
 var DEFAULT_CLOCK_TOLERANCE_SEC = 60;
+function orgContext(claims) {
+  const { org_id, org_role } = claims;
+  if (typeof org_id !== "string" || org_id === "" || typeof org_role !== "string" || org_role === "") {
+    return null;
+  }
+  return { orgId: org_id, orgRole: org_role };
+}
 function decodeBase64Url(value) {
   const padded = value.replace(/-/g, "+").replace(/_/g, "/");
   const binary = atob(padded.padEnd(Math.ceil(padded.length / 4) * 4, "="));
@@ -1298,6 +1483,6 @@ var TokenVerifier = class {
   }
 };
 
-export { Assignments, Canopy, CanopyAuthorizerError, CanopyClient, CanopyConnectionError, CanopyError, CanopyTokenError, Identities, LocalAuthorizer, Paginator, Permissions, Roles, TokenVerifier, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, paginate, withConcurrency };
+export { Assignments, Canopy, CanopyAuthorizerError, CanopyClient, CanopyConnectionError, CanopyError, CanopyTokenError, Identities, LocalAuthorizer, Organizations, Paginator, Permissions, Roles, TokenVerifier, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, orgContext, paginate, withConcurrency };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map