@cdot65/prisma-airs-sdk 0.1.2 → 0.2.0

package/dist/index.js

@@ -25,10 +25,22 @@ var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
 var SDK_VERSION = "0.1.2";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
+var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
+var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
+var MGMT_CLIENT_ID = "PANW_MGMT_CLIENT_ID";
+var MGMT_CLIENT_SECRET = "PANW_MGMT_CLIENT_SECRET";
+var MGMT_TSG_ID = "PANW_MGMT_TSG_ID";
+var MGMT_ENDPOINT = "PANW_MGMT_ENDPOINT";
+var MGMT_TOKEN_ENDPOINT = "PANW_MGMT_TOKEN_ENDPOINT";
 var SYNC_SCAN_PATH = "/v1/scan/sync/request";
 var ASYNC_SCAN_PATH = "/v1/scan/async/request";
 var SCAN_RESULTS_PATH = "/v1/scan/results";
 var SCAN_REPORTS_PATH = "/v1/scan/reports";
+var MGMT_PROFILE_PATH = "/v1/mgmt/profile";
+var MGMT_PROFILES_TSG_PATH = "/v1/mgmt/profiles/tsg";
+var MGMT_TOPIC_PATH = "/v1/mgmt/topic";
+var MGMT_TOPICS_TSG_PATH = "/v1/mgmt/topics/tsg";
+var MGMT_TOPIC_FORCE_PATH = "/v1/mgmt/topic/force";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -37,6 +49,7 @@ var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
   ErrorType2["USER_REQUEST_PAYLOAD_ERROR"] = "AISEC_USER_REQUEST_PAYLOAD_ERROR";
   ErrorType2["MISSING_VARIABLE"] = "AISEC_MISSING_VARIABLE";
   ErrorType2["AISEC_SDK_ERROR"] = "AISEC_SDK_ERROR";
+  ErrorType2["OAUTH_ERROR"] = "AISEC_OAUTH_ERROR";
   return ErrorType2;
 })(ErrorType || {});
 var AISecSDKException = class _AISecSDKException extends Error {
@@ -657,6 +670,494 @@ var ErrorResponseSchema = z14.object({
     unit: z14.string().optional()
   }).optional()
 });
+
+// src/models/mgmt-security-profile.ts
+import { z as z15 } from "zod";
+var DlpDataProfileSchema = z15.object({
+  profile_name: z15.string(),
+  active: z15.boolean().optional()
+}).passthrough();
+var DlpSchema = z15.object({
+  dlp_status: z15.string().optional(),
+  data_profiles: z15.array(DlpDataProfileSchema).optional()
+}).passthrough();
+var DataLeakDetectionSchema = z15.object({
+  "data-leak-detection-status": z15.string().optional(),
+  dlp: DlpSchema.optional()
+}).passthrough();
+var AppProtectionSchema = z15.object({
+  "prompt-injection": z15.string().optional(),
+  "jailbreak-detection": z15.string().optional()
+}).passthrough();
+var ModelProtectionSchema = z15.object({
+  "model-denial-of-service": z15.string().optional()
+}).passthrough();
+var AgentProtectionSchema = z15.object({
+  "malicious-agent-activity": z15.string().optional()
+}).passthrough();
+var LatencySchema = z15.object({
+  status: z15.string().optional(),
+  max_latency_ms: z15.number().optional()
+}).passthrough();
+var ModelConfigurationSchema = z15.object({
+  latency: LatencySchema.optional()
+}).passthrough();
+var PolicySchema = z15.object({
+  "data-leak-detection": DataLeakDetectionSchema.optional(),
+  "app-protection": AppProtectionSchema.optional(),
+  "model-protection": ModelProtectionSchema.optional(),
+  "agent-protection": AgentProtectionSchema.optional(),
+  "model-configuration": ModelConfigurationSchema.optional()
+}).passthrough();
+var SecurityProfileSchema = z15.object({
+  profile_id: z15.string().optional(),
+  profile_name: z15.string(),
+  revision: z15.number().optional(),
+  active: z15.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: z15.string().optional(),
+  updated_by: z15.string().optional(),
+  last_modified_ts: z15.string().optional()
+}).passthrough();
+var CreateSecurityProfileRequestSchema = z15.object({
+  profile_id: z15.string().optional(),
+  profile_name: z15.string(),
+  revision: z15.number().optional(),
+  active: z15.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: z15.string().optional(),
+  updated_by: z15.string().optional(),
+  last_modified_ts: z15.string().optional()
+}).passthrough();
+var SecurityProfileListResponseSchema = z15.object({
+  ai_profiles: z15.array(SecurityProfileSchema),
+  next_offset: z15.number().optional()
+}).passthrough();
+var DeleteProfileResponseSchema = z15.object({
+  message: z15.string()
+}).passthrough();
+var DeleteProfileConflictSchema = z15.object({
+  message: z15.string(),
+  payload: z15.array(
+    z15.object({
+      policy_id: z15.string(),
+      policy_name: z15.string(),
+      priority: z15.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/mgmt-custom-topic.ts
+import { z as z16 } from "zod";
+var CustomTopicSchema = z16.object({
+  topic_id: z16.string().optional(),
+  topic_name: z16.string(),
+  revision: z16.number().optional(),
+  active: z16.boolean().optional(),
+  description: z16.string().optional(),
+  examples: z16.array(z16.string()).optional(),
+  created_by: z16.string().optional(),
+  updated_by: z16.string().optional(),
+  last_modified_ts: z16.string().optional(),
+  created_ts: z16.string().optional()
+}).passthrough();
+var CreateCustomTopicRequestSchema = z16.object({
+  topic_id: z16.string().optional(),
+  topic_name: z16.string(),
+  revision: z16.number().optional(),
+  active: z16.boolean().optional(),
+  description: z16.string().optional(),
+  examples: z16.array(z16.string()).optional(),
+  created_by: z16.string().optional(),
+  updated_by: z16.string().optional(),
+  last_modified_ts: z16.string().optional(),
+  created_ts: z16.string().optional()
+}).passthrough();
+var CustomTopicListResponseSchema = z16.object({
+  custom_topics: z16.array(CustomTopicSchema),
+  next_offset: z16.number().optional()
+}).passthrough();
+var DeleteTopicResponseSchema = z16.object({
+  message: z16.string()
+}).passthrough();
+var DeleteTopicConflictSchema = z16.object({
+  message: z16.string(),
+  payload: z16.array(
+    z16.object({
+      profile_id: z16.string(),
+      profile_name: z16.string(),
+      revision: z16.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/oauth-token.ts
+import { z as z17 } from "zod";
+var OAuthTokenResponseSchema = z17.object({
+  access_token: z17.string(),
+  token_type: z17.string().optional(),
+  expires_in: z17.number(),
+  scope: z17.string().optional()
+});
+
+// src/management/oauth-client.ts
+var TOKEN_BUFFER_MS = 3e4;
+var OAuthClient = class {
+  tokenEndpoint;
+  clientId;
+  clientSecret;
+  tsgId;
+  accessToken = null;
+  expiresAt = 0;
+  pendingFetch = null;
+  constructor(opts) {
+    this.clientId = opts.clientId;
+    this.clientSecret = opts.clientSecret;
+    this.tsgId = opts.tsgId;
+    this.tokenEndpoint = opts.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+  }
+  async getToken() {
+    if (this.accessToken && Date.now() < this.expiresAt - TOKEN_BUFFER_MS) {
+      return this.accessToken;
+    }
+    if (this.pendingFetch) {
+      return this.pendingFetch;
+    }
+    this.pendingFetch = this.fetchToken().finally(() => {
+      this.pendingFetch = null;
+    });
+    return this.pendingFetch;
+  }
+  clearToken() {
+    this.accessToken = null;
+    this.expiresAt = 0;
+  }
+  async fetchToken() {
+    const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      scope: `tsg_id:${this.tsgId}`
+    });
+    let response;
+    try {
+      response = await fetch(this.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Authorization: `Basic ${credentials}`
+        },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new AISecSDKException(
+        `Token request failed: ${err.message}`,
+        "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */
+      );
+    }
+    if (!response.ok) {
+      let errorMsg;
+      try {
+        const errorBody = await response.json();
+        errorMsg = errorBody.error_description ?? errorBody.error ?? `Token request failed with status ${response.status}`;
+      } catch {
+        errorMsg = `Token request failed with status ${response.status}`;
+      }
+      throw new AISecSDKException(errorMsg, "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */);
+    }
+    const data = OAuthTokenResponseSchema.parse(await response.json());
+    this.accessToken = data.access_token;
+    this.expiresAt = Date.now() + data.expires_in * 1e3;
+    return this.accessToken;
+  }
+};
+
+// src/management/management-http-client.ts
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function extractError(body, status) {
+  try {
+    const parsed = JSON.parse(body);
+    return parsed.error_message ?? parsed.message ?? `API error ${status}: ${body}`;
+  } catch {
+    return body ? `API error ${status}: ${body}` : `API error ${status}`;
+  }
+}
+async function managementHttpRequest(opts) {
+  const { method, baseUrl, path, body, params, oauthClient, numRetries } = opts;
+  let hadTokenRefresh = false;
+  for (let attempt = 0; attempt <= numRetries; attempt++) {
+    const token = await oauthClient.getToken();
+    const stripped = baseUrl.replace(/\/+$/, "");
+    const url = new URL(`${stripped}${path}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, value);
+      }
+    }
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      "User-Agent": USER_AGENT
+    };
+    let bodyStr;
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      bodyStr = JSON.stringify(body);
+    }
+    let response;
+    try {
+      response = await fetch(url.toString(), {
+        method,
+        headers,
+        body: bodyStr
+      });
+    } catch (err) {
+      if (attempt < numRetries) {
+        await sleep2(Math.pow(2, attempt) * 1e3);
+        continue;
+      }
+      throw new AISecSDKException(
+        err.message ?? "Network error",
+        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+      );
+    }
+    if (response.ok) {
+      const text = await response.text();
+      const data = text ? JSON.parse(text) : {};
+      return { status: response.status, data };
+    }
+    if (response.status === 401 && !hadTokenRefresh) {
+      hadTokenRefresh = true;
+      oauthClient.clearToken();
+      attempt--;
+      continue;
+    }
+    if (HTTP_FORCE_RETRY_STATUS_CODES.includes(response.status) && attempt < numRetries) {
+      await sleep2(Math.pow(2, attempt) * 1e3);
+      continue;
+    }
+    const errorText = await response.text();
+    const errorMessage = extractError(errorText, response.status);
+    const errorType = response.status >= 500 ? "AISEC_SERVER_SIDE_ERROR" /* SERVER_SIDE_ERROR */ : "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */;
+    throw new AISecSDKException(errorMessage, errorType);
+  }
+  throw new AISecSDKException("Max retries exceeded", "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */);
+}
+
+// src/management/profiles.ts
+var ProfilesClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_PROFILE_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILES_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async update(profileId, request) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/uuid/${profileId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async delete(profileId) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/${profileId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/topics.ts
+var TopicsClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_TOPIC_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPICS_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async update(topicId, request) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/uuid/${topicId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async delete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async forceDelete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_FORCE_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/client.ts
+var ManagementClient = class {
+  profiles;
+  topics;
+  constructor(opts = {}) {
+    const clientId = opts.clientId ?? process.env[MGMT_CLIENT_ID];
+    const clientSecret = opts.clientSecret ?? process.env[MGMT_CLIENT_SECRET];
+    const tsgId = opts.tsgId ?? process.env[MGMT_TSG_ID];
+    const apiEndpoint = opts.apiEndpoint ?? process.env[MGMT_ENDPOINT] ?? DEFAULT_MGMT_ENDPOINT;
+    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MGMT_TOKEN_ENDPOINT];
+    const numRetries = Math.min(
+      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
+      MAX_NUMBER_OF_RETRIES
+    );
+    if (!clientId) {
+      throw new AISecSDKException(
+        "clientId is required (option or PANW_MGMT_CLIENT_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!clientSecret) {
+      throw new AISecSDKException(
+        "clientSecret is required (option or PANW_MGMT_CLIENT_SECRET env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!tsgId) {
+      throw new AISecSDKException(
+        "tsgId is required (option or PANW_MGMT_TSG_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    const oauthClient = new OAuthClient({
+      clientId,
+      clientSecret,
+      tsgId,
+      tokenEndpoint
+    });
+    this.profiles = new ProfilesClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+    this.topics = new TopicsClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+  }
+};
 export {
   AISecSDKException,
   AI_SEC_API_ENDPOINT,
@@ -669,9 +1170,19 @@ export {
   AsyncScanResponseSchema,
   BEARER,
   Content,
+  CreateCustomTopicRequestSchema,
+  CreateSecurityProfileRequestSchema,
+  CustomTopicListResponseSchema,
+  CustomTopicSchema,
   DEFAULT_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT,
   DSDetailResultSchema,
   DSResultMetadataSchema,
+  DeleteProfileConflictSchema,
+  DeleteProfileResponseSchema,
+  DeleteTopicConflictSchema,
+  DeleteTopicResponseSchema,
   DetectionServiceResultSchema,
   DlpReportSchema,
   ErrorResponseSchema,
@@ -695,9 +1206,22 @@ export {
   MAX_SESSION_ID_STR_LENGTH,
   MAX_TOKEN_LENGTH,
   MAX_TRANSACTION_ID_STR_LENGTH,
+  MGMT_CLIENT_ID,
+  MGMT_CLIENT_SECRET,
+  MGMT_ENDPOINT,
+  MGMT_PROFILES_TSG_PATH,
+  MGMT_PROFILE_PATH,
+  MGMT_TOKEN_ENDPOINT,
+  MGMT_TOPICS_TSG_PATH,
+  MGMT_TOPIC_FORCE_PATH,
+  MGMT_TOPIC_PATH,
+  MGMT_TSG_ID,
+  ManagementClient,
   MaskedDataSchema,
   MetadataSchema,
   PAYLOAD_HASH,
+  PolicySchema,
+  ProfilesClient,
   PromptDetectedSchema,
   PromptDetectionDetailsSchema,
   ResponseDetectedSchema,
@@ -712,10 +1236,13 @@ export {
   ScanResponseSchema,
   ScanSummarySchema,
   Scanner,
+  SecurityProfileListResponseSchema,
+  SecurityProfileSchema,
   ThreatScanReportSchema,
   ToolDetectedSchema,
   ToolEventMetadataSchema,
   ToolEventSchema,
+  TopicsClient,
   USER_AGENT,
   UrlfEntrySchema,
   globalConfiguration,