@cubist-labs/cubesigner-sdk 0.2.24 → 0.3.1

package/src/role.ts

@@ -48,6 +48,13 @@ export type TxDepositPubkey = { TxDeposit: { kind: DepositContract; pubkey: stri
  */
 export type TxDepositRole = { TxDeposit: { kind: DepositContract; role_id: string } };
 
+/**
+ * Only allow connections from clients whose IP addresses match any of these IPv4 CIDR blocks.
+ *
+ * @example { SourceIpAllowlist: [ "123.456.78.9/16" ] }
+ */
+export type SourceIpAllowlist = { SourceIpAllowlist: string[] };
+
 /** All different kinds of sensitive operations. */
 export enum OperationKind {
   BlobSign = "BlobSign", // eslint-disable-line no-unused-vars
@@ -100,6 +107,17 @@ export type RequireMfa = {
 export const AllowRawBlobSigning = "AllowRawBlobSigning" as const;
 export type AllowRawBlobSigning = typeof AllowRawBlobSigning;
 
+/** Allow EIP-191 signing */
+export const AllowEip191Signing = "AllowEip191Signing" as const;
+export type AllowEip191Signing = typeof AllowEip191Signing;
+
+/** Allow EIP-712 signing */
+export const AllowEip712Signing = "AllowEip712Signing" as const;
+export type AllowEip712Signing = typeof AllowEip712Signing;
+
+/** Key policies that restrict the requests that the signing endpoints accept */
+type KeyDenyPolicy = TxReceiver | TxDeposit | SourceIpAllowlist | RequireMfa;
+
 /**
  * Key policy
  *
@@ -124,7 +142,15 @@ export type AllowRawBlobSigning = typeof AllowRawBlobSigning;
  *   }
  * ]
  */
-export type KeyPolicy = (TxReceiver | TxDeposit | RequireMfa | AllowRawBlobSigning)[];
+export type KeyPolicy = (
+  | KeyDenyPolicy
+  | AllowRawBlobSigning
+  | AllowEip191Signing
+  | AllowEip712Signing
+)[];
+
+/** Role policy */
+export type RolePolicy = KeyDenyPolicy[];
 
 /** A key guarded by a policy. */
 export class KeyWithPolicies {
@@ -154,15 +180,30 @@ export class KeyWithPolicies {
 /** Roles. */
 export class Role {
   readonly #csc: CubeSignerClient;
+  /** The role information */
+  #data: RoleInfo;
 
   /** Human-readable name for the role */
-  public readonly name?: string;
+  get name(): string | undefined {
+    return this.#data.name ?? undefined;
+  }
 
   /**
    * The ID of the role.
    * @example Role#bfe3eccb-731e-430d-b1e5-ac1363e6b06b
    */
-  readonly id: string;
+  get id(): string {
+    return this.#data.role_id;
+  }
+
+  /**
+   * @return {RoleInfo} the cached properties of this role. The cached properties
+   * reflect the state of the last fetch or update (e.g., after awaiting
+   * `Role.enabled()` or `Role.disable()`).
+   */
+  get cached(): RoleInfo {
+    return this.#data;
+  }
 
   /** Delete the role. */
   async delete(): Promise<void> {
@@ -185,6 +226,35 @@ export class Role {
     await this.update({ enabled: false });
   }
 
+  /**
+   * Set new policy (overwriting any policies previously set for this role)
+   * @param {RolePolicy} policy The new policy to set
+   */
+  async setPolicy(policy: RolePolicy) {
+    await this.update({ policy: policy as unknown as Record<string, never>[] });
+  }
+
+  /**
+   * Append to existing role policy. This append is not atomic---it uses
+   * {@link policy} to fetch the current policy and then {@link setPolicy}
+   * to set the policy---and should not be used in across concurrent sessions.
+   *
+   * @param {RolePolicy} policy The policy to append to the existing one.
+   */
+  async appendPolicy(policy: RolePolicy) {
+    const existing = await this.policy();
+    await this.setPolicy([...existing, ...policy]);
+  }
+
+  /**
+   * Get the policy for the role.
+   * @return {Promise<RolePolicy>} The policy for the role.
+   */
+  async policy(): Promise<RolePolicy> {
+    const data = await this.fetch();
+    return (data.policy ?? []) as unknown as RolePolicy;
+  }
+
   /**
    * The list of all users with access to the role.
    * @example [
@@ -301,8 +371,7 @@ export class Role {
    */
   constructor(csc: CubeSignerClient, data: RoleInfo) {
     this.#csc = csc;
-    this.id = data.role_id;
-    this.name = data.name ?? undefined;
+    this.#data = data;
   }
 
   /**
@@ -312,7 +381,8 @@ export class Role {
    * @return {Promise<RoleInfo>} The updated role information.
    */
   private async update(request: UpdateRoleRequest): Promise<RoleInfo> {
-    return await this.#csc.roleUpdate(this.id, request);
+    this.#data = await this.#csc.roleUpdate(this.id, request);
+    return this.#data;
   }
 
   /**
@@ -322,6 +392,7 @@ export class Role {
    * @internal
    */
   private async fetch(): Promise<RoleInfo> {
-    return await this.#csc.roleGet(this.id);
+    this.#data = await this.#csc.roleGet(this.id);
+    return this.#data;
   }
 }