@cdot65/prisma-airs-sdk 0.6.6 → 0.6.8

package/README.md

@@ -24,7 +24,7 @@ Requires Node.js 18+. Zero external HTTP dependencies (native `fetch` + `crypto`
 | Service                 | Client                | Auth    | Capabilities                                               |
 | ----------------------- | --------------------- | ------- | ---------------------------------------------------------- |
 | **AI Runtime Security** | `Scanner`             | API Key | Sync/async content scanning, prompt injection detection    |
-| **Management**          | `ManagementClient`    | OAuth2  | Security profiles and custom topics CRUD                   |
+| **Management**          | `ManagementClient`    | OAuth2  | Profiles, topics, API keys, apps, DLP, deployment, logs    |
 | **Model Security**      | `ModelSecurityClient` | OAuth2  | ML model scanning, security groups, rule management        |
 | **AI Red Teaming**      | `RedTeamClient`       | OAuth2  | Automated red team scans, reports, targets, custom attacks |
 
@@ -53,28 +53,20 @@ console.log(result.action); // "allow" | "block"
 
 ### Management — Configuration CRUD (OAuth2)
 
-CRUD operations for all three Prisma AIRS services use OAuth2:
-
 ```ts
 import { ManagementClient } from '@cdot65/prisma-airs-sdk';
 
 const client = new ManagementClient(); // reads PANW_MGMT_* env vars
 
-// Security Profiles
-const profiles = await client.profiles.list();
-const created = await client.profiles.create({
-  profile_name: 'my-profile',
-  active: true,
-  policy: {
-    /* ... */
-  },
-});
-
-// Custom Topics
-const topic = await client.topics.create({
-  topic_name: 'pii-detector',
-  examples: ['SSN: 123-45-6789'],
-});
+// 8 sub-clients available:
+client.profiles; // AI security profile CRUD
+client.topics; // Custom detection topic CRUD
+client.apiKeys; // API key lifecycle (create, list, regenerate, delete)
+client.customerApps; // Customer application management
+client.dlpProfiles; // DLP data profile listing
+client.deploymentProfiles; // Deployment profile listing
+client.scanLogs; // Scan activity log queries
+client.oauth; // OAuth token management (get/invalidate)
 ```
 
 ### Model Security — ML Model Scanning (OAuth2)
@@ -84,6 +76,7 @@ import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
 
 const client = new ModelSecurityClient(); // falls back to PANW_MGMT_* env vars
 
+// 3 sub-clients: scans, securityGroups, securityRules
 const scans = await client.scans.list({ limit: 10 });
 const groups = await client.securityGroups.list();
 const rules = await client.securityRules.list();
@@ -96,6 +89,7 @@ import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
 
 const client = new RedTeamClient(); // falls back to PANW_MGMT_* env vars
 
+// 5 sub-clients: scans, reports, customAttackReports, targets, customAttacks
 const scans = await client.scans.list({ limit: 5 });
 const targets = await client.targets.list();
 const categories = await client.scans.getCategories();
@@ -118,15 +112,6 @@ export PANW_MGMT_CLIENT_SECRET=your-client-secret
 export PANW_MGMT_TSG_ID=1234567890
 ```
 
-## Scanner Methods
-
-| Method                                | Description                                |
-| ------------------------------------- | ------------------------------------------ |
-| `syncScan(aiProfile, content, opts?)` | Synchronous inline scan                    |
-| `asyncScan(scanObjects)`              | Batch async scan (up to 5)                 |
-| `queryByScanIds(scanIds)`             | Get results by scan IDs (up to 5)          |
-| `queryByReportIds(reportIds)`         | Get threat reports by report IDs (up to 5) |
-
 ## Error Handling
 
 ```ts
@@ -153,7 +138,7 @@ Full documentation at **[cdot65.github.io/prisma-airs-sdk](https://cdot65.github
 ```bash
 npm install
 npm run build          # tsup (CJS + ESM + .d.ts)
-npm run test           # vitest (617 tests, 99%+ coverage)
+npm run test           # vitest (829 tests, 99%+ coverage)
 npm run lint           # eslint
 npm run typecheck      # tsc --noEmit
 ```

package/dist/index.cjs

@@ -430,7 +430,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.6.6";
+var SDK_VERSION = "0.6.8";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -3248,6 +3248,49 @@ var OAuthClient = class {
   }
 };
 
+// src/oauth-config.ts
+function resolveOAuthConfig(opts) {
+  const { primaryEnvPrefix, fallbackEnvPrefix } = opts;
+  const clientId = opts.clientId ?? process.env[`${primaryEnvPrefix}_CLIENT_ID`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_CLIENT_ID`] : void 0);
+  const clientSecret = opts.clientSecret ?? process.env[`${primaryEnvPrefix}_CLIENT_SECRET`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_CLIENT_SECRET`] : void 0);
+  const tsgId = opts.tsgId ?? process.env[`${primaryEnvPrefix}_TSG_ID`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_TSG_ID`] : void 0);
+  const tokenEndpoint = opts.tokenEndpoint ?? process.env[`${primaryEnvPrefix}_TOKEN_ENDPOINT`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_TOKEN_ENDPOINT`] : void 0);
+  const numRetries = Math.min(
+    Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
+    MAX_NUMBER_OF_RETRIES
+  );
+  const envHint = fallbackEnvPrefix ? `${primaryEnvPrefix}_CLIENT_ID / ${fallbackEnvPrefix}_CLIENT_ID` : `${primaryEnvPrefix}_CLIENT_ID`;
+  if (!clientId) {
+    throw new AISecSDKException(
+      `clientId is required (option or ${envHint} env var)`,
+      "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+    );
+  }
+  const secretHint = fallbackEnvPrefix ? `${primaryEnvPrefix}_CLIENT_SECRET / ${fallbackEnvPrefix}_CLIENT_SECRET` : `${primaryEnvPrefix}_CLIENT_SECRET`;
+  if (!clientSecret) {
+    throw new AISecSDKException(
+      `clientSecret is required (option or ${secretHint} env var)`,
+      "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+    );
+  }
+  const tsgHint = fallbackEnvPrefix ? `${primaryEnvPrefix}_TSG_ID / ${fallbackEnvPrefix}_TSG_ID` : `${primaryEnvPrefix}_TSG_ID`;
+  if (!tsgId) {
+    throw new AISecSDKException(
+      `tsgId is required (option or ${tsgHint} env var)`,
+      "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+    );
+  }
+  const oauthClient = new OAuthClient({
+    clientId,
+    clientSecret,
+    tsgId,
+    tokenEndpoint,
+    tokenBufferMs: opts.tokenBufferMs,
+    onTokenRefresh: opts.onTokenRefresh
+  });
+  return { baseUrl: opts.baseUrl, oauthClient, numRetries, tsgId };
+}
+
 // src/management/management-http-client.ts
 async function managementHttpRequest(opts) {
   const { method, baseUrl, path, body, params, oauthClient, numRetries } = opts;
@@ -3342,6 +3385,40 @@ var ProfilesClient = class {
     });
     return res.data;
   }
+  /**
+   * Get a security profile by UUID.
+   * Fetches all profiles and filters — no dedicated API endpoint exists.
+   * @param profileId - UUID of the profile to retrieve.
+   * @returns The matching security profile.
+   */
+  async get(profileId) {
+    const { ai_profiles } = await this.list();
+    const profile = ai_profiles.find((p) => p.profile_id === profileId);
+    if (!profile) {
+      throw new AISecSDKException(
+        `Profile not found: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return profile;
+  }
+  /**
+   * Get a security profile by name.
+   * Returns the highest-revision match (latest version).
+   * @param profileName - Name of the profile to retrieve.
+   * @returns The matching security profile with the highest revision.
+   */
+  async getByName(profileName) {
+    const { ai_profiles } = await this.list();
+    const matches = ai_profiles.filter((p) => p.profile_name === profileName);
+    if (matches.length === 0) {
+      throw new AISecSDKException(
+        `Profile not found: ${profileName}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return matches.reduce((best, p) => (p.revision ?? 0) > (best.revision ?? 0) ? p : best);
+  }
   /**
    * Update an existing security profile.
    * @param profileId - UUID of the profile to update.
@@ -3853,80 +3930,57 @@ var ManagementClient = class {
   scanLogs;
   oauth;
   constructor(opts = {}) {
-    const clientId = opts.clientId ?? process.env[MGMT_CLIENT_ID];
-    const clientSecret = opts.clientSecret ?? process.env[MGMT_CLIENT_SECRET];
-    const tsgId = opts.tsgId ?? process.env[MGMT_TSG_ID];
     const apiEndpoint = opts.apiEndpoint ?? process.env[MGMT_ENDPOINT] ?? DEFAULT_MGMT_ENDPOINT;
-    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MGMT_TOKEN_ENDPOINT];
-    const numRetries = Math.min(
-      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
-      MAX_NUMBER_OF_RETRIES
-    );
-    if (!clientId) {
-      throw new AISecSDKException(
-        "clientId is required (option or PANW_MGMT_CLIENT_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!clientSecret) {
-      throw new AISecSDKException(
-        "clientSecret is required (option or PANW_MGMT_CLIENT_SECRET env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!tsgId) {
-      throw new AISecSDKException(
-        "tsgId is required (option or PANW_MGMT_TSG_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    const oauthClient = new OAuthClient({
-      clientId,
-      clientSecret,
-      tsgId,
-      tokenEndpoint
+    const { baseUrl, oauthClient, numRetries, tsgId } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: apiEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_MGMT"
     });
     this.profiles = new ProfilesClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.topics = new TopicsClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.apiKeys = new ApiKeysClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.customerApps = new CustomerAppsClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.dlpProfiles = new DlpProfilesClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
     this.deploymentProfiles = new DeploymentProfilesClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
     this.scanLogs = new ScanLogsClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
     this.oauth = new OAuthManagementClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
@@ -4542,55 +4596,34 @@ var ModelSecurityClient = class {
   oauthClient;
   numRetries;
   constructor(opts = {}) {
-    const clientId = opts.clientId ?? process.env[MODEL_SEC_CLIENT_ID] ?? process.env[MGMT_CLIENT_ID];
-    const clientSecret = opts.clientSecret ?? process.env[MODEL_SEC_CLIENT_SECRET] ?? process.env[MGMT_CLIENT_SECRET];
-    const tsgId = opts.tsgId ?? process.env[MODEL_SEC_TSG_ID] ?? process.env[MGMT_TSG_ID];
     const dataEndpoint = opts.dataEndpoint ?? process.env[MODEL_SEC_DATA_ENDPOINT] ?? DEFAULT_MODEL_SEC_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[MODEL_SEC_MGMT_ENDPOINT] ?? DEFAULT_MODEL_SEC_MGMT_ENDPOINT;
-    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MODEL_SEC_TOKEN_ENDPOINT] ?? process.env[MGMT_TOKEN_ENDPOINT];
-    const numRetries = Math.min(
-      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
-      MAX_NUMBER_OF_RETRIES
-    );
-    if (!clientId) {
-      throw new AISecSDKException(
-        "clientId is required (option or PANW_MODEL_SEC_CLIENT_ID / PANW_MGMT_CLIENT_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!clientSecret) {
-      throw new AISecSDKException(
-        "clientSecret is required (option or PANW_MODEL_SEC_CLIENT_SECRET / PANW_MGMT_CLIENT_SECRET env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!tsgId) {
-      throw new AISecSDKException(
-        "tsgId is required (option or PANW_MODEL_SEC_TSG_ID / PANW_MGMT_TSG_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    this.oauthClient = new OAuthClient({
-      clientId,
-      clientSecret,
-      tsgId,
-      tokenEndpoint
+    const { oauthClient, numRetries } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: mgmtEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_MODEL_SEC",
+      fallbackEnvPrefix: "PANW_MGMT"
     });
+    this.oauthClient = oauthClient;
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new ModelSecurityScansClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.securityGroups = new ModelSecurityGroupsClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.securityRules = new ModelSecurityRulesClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
   }
@@ -5742,61 +5775,45 @@ var RedTeamClient = class {
   oauthClient;
   numRetries;
   constructor(opts = {}) {
-    const clientId = opts.clientId ?? process.env[RED_TEAM_CLIENT_ID] ?? process.env[MGMT_CLIENT_ID];
-    const clientSecret = opts.clientSecret ?? process.env[RED_TEAM_CLIENT_SECRET] ?? process.env[MGMT_CLIENT_SECRET];
-    const tsgId = opts.tsgId ?? process.env[RED_TEAM_TSG_ID] ?? process.env[MGMT_TSG_ID];
     const dataEndpoint = opts.dataEndpoint ?? process.env[RED_TEAM_DATA_ENDPOINT] ?? DEFAULT_RED_TEAM_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[RED_TEAM_MGMT_ENDPOINT] ?? DEFAULT_RED_TEAM_MGMT_ENDPOINT;
-    const tokenEndpoint = opts.tokenEndpoint ?? process.env[RED_TEAM_TOKEN_ENDPOINT] ?? process.env[MGMT_TOKEN_ENDPOINT];
-    const numRetries = Math.min(
-      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
-      MAX_NUMBER_OF_RETRIES
-    );
-    if (!clientId) {
-      throw new AISecSDKException(
-        "clientId is required (option or PANW_RED_TEAM_CLIENT_ID / PANW_MGMT_CLIENT_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!clientSecret) {
-      throw new AISecSDKException(
-        "clientSecret is required (option or PANW_RED_TEAM_CLIENT_SECRET / PANW_MGMT_CLIENT_SECRET env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!tsgId) {
-      throw new AISecSDKException(
-        "tsgId is required (option or PANW_RED_TEAM_TSG_ID / PANW_MGMT_TSG_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    this.oauthClient = new OAuthClient({ clientId, clientSecret, tsgId, tokenEndpoint });
+    const { oauthClient, numRetries } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: dataEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_RED_TEAM",
+      fallbackEnvPrefix: "PANW_MGMT"
+    });
+    this.oauthClient = oauthClient;
     this.dataEndpoint = dataEndpoint;
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new RedTeamScansClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.reports = new RedTeamReportsClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.customAttackReports = new RedTeamCustomAttackReportsClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.targets = new RedTeamTargetsClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.customAttacks = new RedTeamCustomAttacksClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
   }