@coffre/client 0.1.6 → 0.1.8

package/dist/index.js

@@ -216,7 +216,9 @@ set: (member, access) => call("PATCH /access/:member", { member }, access) },
 		},
 		audit: {
 			list: (query = {}) => call("GET /audit", {}, query),
-			verify: () => call("GET /audit/verification", {})
+			verify: () => call("GET /audit/verification", {}),
+			/** What an escrowed key is checked against: public material, owners and root admins only. */
+			keys: () => call("GET /audit/keys", {})
 		}
 	};
 }

package/dist/routes.d.ts

@@ -0,0 +1,41 @@
+import { a as Params, o as RouteInput, s as RouteKey } from "./index-BJZEgxE8.js";
+//#region src/routes.d.ts
+export type GetKey = Extract<RouteKey, `GET ${string}`>;
+/** Each GET route, with what to ask it. */
+export type GetCalls = { [K in GetKey]: {
+  params: Params<K>;
+  input?: RouteInput<K>;
+}[]; };
+/** What the GET routes are asked about: places, secrets and members to name. */
+export type Subjects = {
+  places: {
+    project: string;
+    environment: string;
+  }[];
+  /** Secrets whose history to ask for. */
+  secrets: {
+    project: string;
+    environment: string;
+    key: string;
+  }[];
+  /** `user:…` and `token:…`. */
+  members: string[];
+  /** Tokens whose credentials to list. */
+  services: string[];
+};
+export declare function getCalls({ places, secrets, members, services }: Subjects): GetCalls;
+/** Each GET call as a URL, with its parameters and query filled in. */
+export declare function getUrls(origin: string, calls: GetCalls): {
+  key: GetKey;
+  url: string;
+}[];
+/**
+ * Every route as a method and a URL, each parameter a made-up value: what
+ * a caller with no right to any of them would send.
+ */
+export declare function everyRoute(origin: string): {
+  key: RouteKey;
+  method: string;
+  url: string;
+}[];
+//#endregion

package/dist/routes.js

@@ -0,0 +1,102 @@
+//#region src/routes.ts
+function getCalls({ places, secrets, members, services }) {
+	const first = places[0];
+	return {
+		"GET /me": [{ params: {} }],
+		"GET /projects": [{ params: {} }],
+		"GET /secrets/:project/:environment": places.map((params) => ({ params })),
+		"GET /secrets/:project/:environment/:key/versions": secrets.map((params) => ({ params })),
+		"GET /members": [{ params: {} }, ...first === void 0 ? [] : [{
+			params: {},
+			input: { path: `${first.project}/${first.environment}` }
+		}]],
+		"GET /members/:member": members.map((member) => ({ params: { member } })),
+		"GET /members/:member/tokens": services.map((member) => ({ params: { member } })),
+		"GET /sessions": [{ params: {} }],
+		"GET /identities": [{ params: {} }],
+		"GET /device-logins/:code": [{ params: { code: "BCDF-GHJK" } }],
+		"GET /syncs/providers": [{ params: {} }],
+		"GET /syncs/:project/:environment": places.map((params) => ({ params })),
+		"GET /audit": [{
+			params: {},
+			input: { limit: 500 }
+		}, {
+			params: {},
+			input: {
+				limit: 500,
+				detail: "1"
+			}
+		}],
+		"GET /audit/verification": [{ params: {} }],
+		"GET /audit/keys": [{ params: {} }]
+	};
+}
+/** Each GET call as a URL, with its parameters and query filled in. */
+function getUrls(origin, calls) {
+	const urls = [];
+	for (const [key, asks] of Object.entries(calls)) for (const { params, input } of asks) urls.push({
+		key,
+		url: address(origin, key, params, input)
+	});
+	return urls;
+}
+/** Every route, whatever its method. */
+const EVERY_ROUTE = {
+	"GET /me": true,
+	"GET /projects": true,
+	"PUT /projects/:project": true,
+	"PATCH /projects/:project": true,
+	"PUT /projects/:project/:environment": true,
+	"PATCH /projects/:project/:environment": true,
+	"GET /secrets/:project/:environment": true,
+	"PATCH /secrets/:project/:environment": true,
+	"PATCH /secrets/:project/:environment/:key": true,
+	"GET /secrets/:project/:environment/:key/versions": true,
+	"POST /secrets/:project/:environment/:key/restore": true,
+	"POST /reveals": true,
+	"GET /members": true,
+	"GET /members/:member": true,
+	"PUT /members/:member": true,
+	"DELETE /members/:member": true,
+	"GET /members/:member/tokens": true,
+	"POST /members/:member/tokens": true,
+	"DELETE /members/:member/tokens/:id": true,
+	"PATCH /access/:member": true,
+	"GET /sessions": true,
+	"DELETE /sessions/:id": true,
+	"GET /identities": true,
+	"DELETE /identities/:id": true,
+	"GET /device-logins/:code": true,
+	"POST /device-logins/:code": true,
+	"GET /syncs/providers": true,
+	"GET /syncs/:project/:environment": true,
+	"POST /syncs/:project/:environment": true,
+	"PATCH /syncs/by-id/:id": true,
+	"DELETE /syncs/by-id/:id": true,
+	"POST /syncs/by-id/:id/runs": true,
+	"GET /audit": true,
+	"GET /audit/verification": true,
+	"GET /audit/keys": true
+};
+/**
+* Every route as a method and a URL, each parameter a made-up value: what
+* a caller with no right to any of them would send.
+*/
+function everyRoute(origin) {
+	return Object.keys(EVERY_ROUTE).map((key) => {
+		const [method, pattern] = key.split(" ");
+		return {
+			key,
+			method,
+			url: `${origin}/api${pattern.replace(/:(\w+)/g, (_, name) => encodeURIComponent(name === "member" ? "token:conformance-nobody" : "conformance-nobody"))}`
+		};
+	});
+}
+function address(origin, key, params, input) {
+	const path = key.slice(4).replace(/:(\w+)/g, (_, name) => encodeURIComponent(params[name]));
+	const url = new URL(`${origin}/api${path}`);
+	for (const [name, value] of Object.entries(input ?? {})) url.searchParams.set(name, String(value));
+	return url.href;
+}
+//#endregion
+export { everyRoute, getCalls, getUrls };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/client",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "The coffre API as typed function calls.",
   "license": "MIT",
   "repository": {
@@ -22,6 +22,11 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./routes": {
+      "coffre:source": "./src/routes.ts",
+      "types": "./dist/routes.d.ts",
+      "default": "./dist/routes.js"
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {

package/src/api.ts

@@ -726,6 +726,27 @@ export type Api = {
       reason: string;
     };
   };
+  "GET /audit/keys": {
+    input: undefined;
+    output: {
+      app: {
+        keyId: string;
+      };
+      vault: {
+        current: {
+          vaultId: string;
+          provider: string;
+        };
+        checks: {
+          seq: number;
+          vaultId: string;
+          provider: string;
+          version: string;
+          wrapped: string;
+        }[];
+      };
+    };
+  };
 };
 
 export type AccessValue = "access-manager" | "auditor" | "developer" | "maintainer" | "owner" | "viewer" | null | {

package/src/index.ts

@@ -260,6 +260,8 @@ export function createClient(options: ClientOptions) {
     audit: {
       list: (query: RouteInput<'GET /audit'> = {}) => call('GET /audit', {}, query),
       verify: () => call('GET /audit/verification', {}),
+      /** What an escrowed key is checked against: public material, owners and root admins only. */
+      keys: () => call('GET /audit/keys', {}),
     },
   };
 }

package/src/routes.ts

@@ -0,0 +1,115 @@
+// The API's routes, as checks call them: `coffre verify instance` and the
+// local conformance run. Both tables are typed over the route map, so a
+// route added to the server fails the typecheck here until it is listed,
+// and from then on every check that walks a table covers it: the anonymous
+// refusal, the canary scans, the cross-site one.
+import type { Params, RouteInput, RouteKey } from './index.ts';
+
+export type GetKey = Extract<RouteKey, `GET ${string}`>;
+
+/** Each GET route, with what to ask it. */
+export type GetCalls = { [K in GetKey]: { params: Params<K>; input?: RouteInput<K> }[] };
+
+/** What the GET routes are asked about: places, secrets and members to name. */
+export type Subjects = {
+  places: { project: string; environment: string }[];
+  /** Secrets whose history to ask for. */
+  secrets: { project: string; environment: string; key: string }[];
+  /** `user:…` and `token:…`. */
+  members: string[];
+  /** Tokens whose credentials to list. */
+  services: string[];
+};
+
+export function getCalls({ places, secrets, members, services }: Subjects): GetCalls {
+  const first = places[0];
+  return {
+    'GET /me': [{ params: {} }],
+    'GET /projects': [{ params: {} }],
+    'GET /secrets/:project/:environment': places.map((params) => ({ params })),
+    'GET /secrets/:project/:environment/:key/versions': secrets.map((params) => ({ params })),
+    'GET /members': [
+      { params: {} },
+      ...(first === undefined ? [] : [{ params: {}, input: { path: `${first.project}/${first.environment}` } }]),
+    ],
+    'GET /members/:member': members.map((member) => ({ params: { member } })),
+    'GET /members/:member/tokens': services.map((member) => ({ params: { member } })),
+    'GET /sessions': [{ params: {} }],
+    'GET /identities': [{ params: {} }],
+    'GET /device-logins/:code': [{ params: { code: 'BCDF-GHJK' } }],
+    'GET /syncs/providers': [{ params: {} }],
+    'GET /syncs/:project/:environment': places.map((params) => ({ params })),
+    'GET /audit': [{ params: {}, input: { limit: 500 } }, { params: {}, input: { limit: 500, detail: '1' } }],
+    'GET /audit/verification': [{ params: {} }],
+    'GET /audit/keys': [{ params: {} }],
+  };
+}
+
+/** Each GET call as a URL, with its parameters and query filled in. */
+export function getUrls(origin: string, calls: GetCalls): { key: GetKey; url: string }[] {
+  const urls: { key: GetKey; url: string }[] = [];
+  for (const [key, asks] of Object.entries(calls) as [GetKey, { params: Record<string, string>; input?: object }[]][]) {
+    for (const { params, input } of asks) urls.push({ key, url: address(origin, key, params, input) });
+  }
+  return urls;
+}
+
+/** Every route, whatever its method. */
+const EVERY_ROUTE: { [K in RouteKey]: true } = {
+  'GET /me': true,
+  'GET /projects': true,
+  'PUT /projects/:project': true,
+  'PATCH /projects/:project': true,
+  'PUT /projects/:project/:environment': true,
+  'PATCH /projects/:project/:environment': true,
+  'GET /secrets/:project/:environment': true,
+  'PATCH /secrets/:project/:environment': true,
+  'PATCH /secrets/:project/:environment/:key': true,
+  'GET /secrets/:project/:environment/:key/versions': true,
+  'POST /secrets/:project/:environment/:key/restore': true,
+  'POST /reveals': true,
+  'GET /members': true,
+  'GET /members/:member': true,
+  'PUT /members/:member': true,
+  'DELETE /members/:member': true,
+  'GET /members/:member/tokens': true,
+  'POST /members/:member/tokens': true,
+  'DELETE /members/:member/tokens/:id': true,
+  'PATCH /access/:member': true,
+  'GET /sessions': true,
+  'DELETE /sessions/:id': true,
+  'GET /identities': true,
+  'DELETE /identities/:id': true,
+  'GET /device-logins/:code': true,
+  'POST /device-logins/:code': true,
+  'GET /syncs/providers': true,
+  'GET /syncs/:project/:environment': true,
+  'POST /syncs/:project/:environment': true,
+  'PATCH /syncs/by-id/:id': true,
+  'DELETE /syncs/by-id/:id': true,
+  'POST /syncs/by-id/:id/runs': true,
+  'GET /audit': true,
+  'GET /audit/verification': true,
+  'GET /audit/keys': true,
+};
+
+/**
+ * Every route as a method and a URL, each parameter a made-up value: what
+ * a caller with no right to any of them would send.
+ */
+export function everyRoute(origin: string): { key: RouteKey; method: string; url: string }[] {
+  return (Object.keys(EVERY_ROUTE) as RouteKey[]).map((key) => {
+    const [method, pattern] = key.split(' ') as [string, string];
+    const path = pattern.replace(/:(\w+)/g, (_, name: string) =>
+      encodeURIComponent(name === 'member' ? 'token:conformance-nobody' : 'conformance-nobody'),
+    );
+    return { key, method, url: `${origin}/api${path}` };
+  });
+}
+
+function address(origin: string, key: GetKey, params: Record<string, string>, input: object | undefined): string {
+  const path = key.slice('GET '.length).replace(/:(\w+)/g, (_, name: string) => encodeURIComponent(params[name]!));
+  const url = new URL(`${origin}/api${path}`);
+  for (const [name, value] of Object.entries(input ?? {})) url.searchParams.set(name, String(value));
+  return url.href;
+}