@databricks/sdk-uc-rfa 0.0.0-dev → 0.1.0-dev.2

package/src/v1/client.ts

@@ -0,0 +1,197 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+import {VERSION as AUTH_VERSION} from '@databricks/sdk-auth';
+import {createDefault} from '@databricks/sdk-core/clientinfo';
+import type {Logger} from '@databricks/sdk-core/logger';
+import {NoOpLogger} from '@databricks/sdk-core/logger';
+import type {CallOptions} from '@databricks/sdk-options/call';
+import type {ClientOptions} from '@databricks/sdk-options/client';
+import type {HttpClient} from '@databricks/sdk-core/http';
+import {newHttpClient} from './transport';
+import {
+  buildHttpRequest,
+  executeCall,
+  executeHttpCall,
+  marshalRequest,
+  parseResponse,
+} from './utils';
+import pkgJson from '../../package.json' with {type: 'json'};
+import type {
+  AccessRequestDestinations,
+  BatchCreateAccessRequestsRequest,
+  BatchCreateAccessRequestsResponse,
+  GetAccessRequestDestinationsRequest,
+  UpdateAccessRequestDestinationsRequest,
+} from './model';
+import {
+  marshalAccessRequestDestinationsSchema,
+  marshalBatchCreateAccessRequestsRequestSchema,
+  unmarshalAccessRequestDestinationsSchema,
+  unmarshalBatchCreateAccessRequestsResponseSchema,
+} from './model';
+
+// Package identity segment for this client to be used in the User-Agent header.
+const PACKAGE_SEGMENT = {
+  key: 'sdk-js-' + pkgJson.name.replace(/^@[^/]+\/sdk-/, ''),
+  value: pkgJson.version,
+};
+
+export class RfaClient {
+  private readonly host: string;
+  // Workspace ID used to route workspace-level calls on unified hosts (SPOG).
+  // When set, workspace-level methods send X-Databricks-Org-Id on every
+  // request.
+  private readonly workspaceId: string | undefined;
+  private readonly httpClient: HttpClient;
+  private readonly logger: Logger;
+  // User-Agent header value. Composed once at construction from
+  // createDefault() merged with this package's identity and the active
+  // credential's name.
+  private readonly userAgent: string;
+
+  constructor(options: ClientOptions) {
+    if (options.host === undefined) {
+      throw new Error('Host is required.');
+    }
+    this.host = options.host.replace(/\/$/, '');
+    this.workspaceId = options.workspaceId;
+    this.logger = options.logger ?? new NoOpLogger();
+    const info = createDefault()
+      .with(PACKAGE_SEGMENT)
+      .with({key: 'sdk-js-auth', value: AUTH_VERSION})
+      .with({key: 'auth', value: options.credentials?.name() ?? 'default'});
+    this.userAgent = info.toString();
+    this.httpClient = newHttpClient(options);
+  }
+
+  /**
+   * Creates access requests for Unity Catalog permissions for a specified principal on a securable object.
+   * This Batch API can take in multiple principals, securable objects,
+   * and permissions as the input and returns the access request destinations for each.
+   * Principals must be unique across the API call.
+   *
+   * The supported securable types are: "metastore", "catalog", "schema", "table",
+   * "external_location", "connection", "credential", "function", "registered_model", and "volume".
+   */
+  async batchCreateAccessRequests(
+    req: BatchCreateAccessRequestsRequest,
+    options?: CallOptions
+  ): Promise<BatchCreateAccessRequestsResponse> {
+    const url = `${this.host}/api/3.0/rfa/requests`;
+    const body = marshalRequest(
+      req,
+      marshalBatchCreateAccessRequestsRequestSchema
+    );
+    let resp: BatchCreateAccessRequestsResponse | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers({'Content-Type': 'application/json'});
+      if (this.workspaceId !== undefined) {
+        headers.set('X-Databricks-Org-Id', this.workspaceId);
+      }
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest('POST', url, headers, callSignal, body);
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = parseResponse(
+        respBody,
+        unmarshalBatchCreateAccessRequestsResponseSchema
+      );
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+
+  /**
+   * Gets an array of access request destinations for the specified securable.
+   * Any caller can see URL destinations or the destinations on the metastore.
+   * Otherwise, only those with **BROWSE** permissions on the securable can see destinations.
+   *
+   * The supported securable types are: "metastore", "catalog", "schema", "table",
+   * "external_location", "connection", "credential", "function", "registered_model", and "volume".
+   */
+  async getAccessRequestDestinations(
+    req: GetAccessRequestDestinationsRequest,
+    options?: CallOptions
+  ): Promise<AccessRequestDestinations> {
+    const url = `${this.host}/api/3.0/rfa/destinations/${req.securableType ?? ''}/${req.fullName ?? ''}`;
+    let resp: AccessRequestDestinations | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers();
+      if (this.workspaceId !== undefined) {
+        headers.set('X-Databricks-Org-Id', this.workspaceId);
+      }
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest('GET', url, headers, callSignal);
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = parseResponse(respBody, unmarshalAccessRequestDestinationsSchema);
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+
+  /**
+   * Updates the access request destinations for the given securable.
+   * The caller must be a metastore admin, the owner of the securable, or a user that has the **MANAGE** privilege on the securable in order to assign destinations.
+   * Destinations cannot be updated for securables underneath schemas (tables, volumes, functions, and models). For these securable types, destinations are inherited from the parent securable.
+   * A maximum of 5 emails and 5 external notification destinations (Slack, Microsoft Teams, and Generic Webhook destinations) can be assigned to a securable.
+   * If a URL destination is assigned, no other destinations can be set.
+   *
+   * The supported securable types are: "metastore", "catalog", "schema", "table",
+   * "external_location", "connection", "credential", "function", "registered_model", and "volume".
+   */
+  async updateAccessRequestDestinations(
+    req: UpdateAccessRequestDestinationsRequest,
+    options?: CallOptions
+  ): Promise<AccessRequestDestinations> {
+    const url = `${this.host}/api/3.0/rfa/destinations`;
+    const params = new URLSearchParams();
+    if (req.updateMask !== undefined) {
+      params.append('update_mask', req.updateMask.toString());
+    }
+    const query = params.toString();
+    const fullUrl = query !== '' ? `${url}?${query}` : url;
+    const body = marshalRequest(
+      req.accessRequestDestinations,
+      marshalAccessRequestDestinationsSchema
+    );
+    let resp: AccessRequestDestinations | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers({'Content-Type': 'application/json'});
+      if (this.workspaceId !== undefined) {
+        headers.set('X-Databricks-Org-Id', this.workspaceId);
+      }
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest(
+        'PATCH',
+        fullUrl,
+        headers,
+        callSignal,
+        body
+      );
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = parseResponse(respBody, unmarshalAccessRequestDestinationsSchema);
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+}

package/src/v1/index.ts

@@ -0,0 +1,26 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+export {RfaClient} from './client';
+
+export {
+  DestinationType,
+  PrincipalType,
+  SecurableType,
+  SpecialDestination,
+} from './model';
+
+export type {
+  AccessRequestDestinations,
+  BatchCreateAccessRequestsRequest,
+  BatchCreateAccessRequestsResponse,
+  CreateAccessRequest,
+  CreateAccessRequestResponse,
+  GetAccessRequestDestinationsRequest,
+  NotificationDestination,
+  Principal,
+  Securable,
+  SecurablePermissions,
+  UpdateAccessRequestDestinationsRequest,
+} from './model';
+
+export {accessRequestDestinationsFieldMask} from './model';

package/src/v1/model.ts

@@ -0,0 +1,384 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+import {FieldMask} from '@databricks/sdk-core/wkt';
+import type {FieldMaskSchema} from '@databricks/sdk-core/wkt';
+import {z} from 'zod';
+
+export enum DestinationType {
+  DESTINATION_TYPE_UNSPECIFIED = 'DESTINATION_TYPE_UNSPECIFIED',
+  EMAIL = 'EMAIL',
+  SLACK = 'SLACK',
+  GENERIC_WEBHOOK = 'GENERIC_WEBHOOK',
+  MICROSOFT_TEAMS = 'MICROSOFT_TEAMS',
+  URL = 'URL',
+}
+
+export enum PrincipalType {
+  PRINCIPAL_TYPE_UNSPECIFIED = 'PRINCIPAL_TYPE_UNSPECIFIED',
+  USER_PRINCIPAL = 'USER_PRINCIPAL',
+  GROUP_PRINCIPAL = 'GROUP_PRINCIPAL',
+  SERVICE_PRINCIPAL = 'SERVICE_PRINCIPAL',
+}
+
+/** The type of Unity Catalog securable. */
+export enum SecurableType {
+  CATALOG = 'CATALOG',
+  SCHEMA = 'SCHEMA',
+  TABLE = 'TABLE',
+  STORAGE_CREDENTIAL = 'STORAGE_CREDENTIAL',
+  EXTERNAL_LOCATION = 'EXTERNAL_LOCATION',
+  FUNCTION = 'FUNCTION',
+  SHARE = 'SHARE',
+  PROVIDER = 'PROVIDER',
+  RECIPIENT = 'RECIPIENT',
+  CLEAN_ROOM = 'CLEAN_ROOM',
+  METASTORE = 'METASTORE',
+  PIPELINE = 'PIPELINE',
+  VOLUME = 'VOLUME',
+  CONNECTION = 'CONNECTION',
+  CREDENTIAL = 'CREDENTIAL',
+  EXTERNAL_METADATA = 'EXTERNAL_METADATA',
+  /** TODO: [UC-2980] Staging tables aren't full-fleged securables yet. */
+  STAGING_TABLE = 'STAGING_TABLE',
+}
+
+export enum SpecialDestination {
+  SPECIAL_DESTINATION_UNSPECIFIED = 'SPECIAL_DESTINATION_UNSPECIFIED',
+  SPECIAL_DESTINATION_CATALOG_OWNER = 'SPECIAL_DESTINATION_CATALOG_OWNER',
+  SPECIAL_DESTINATION_EXTERNAL_LOCATION_OWNER = 'SPECIAL_DESTINATION_EXTERNAL_LOCATION_OWNER',
+  SPECIAL_DESTINATION_CONNECTION_OWNER = 'SPECIAL_DESTINATION_CONNECTION_OWNER',
+  SPECIAL_DESTINATION_CREDENTIAL_OWNER = 'SPECIAL_DESTINATION_CREDENTIAL_OWNER',
+  SPECIAL_DESTINATION_METASTORE_OWNER = 'SPECIAL_DESTINATION_METASTORE_OWNER',
+}
+
+export interface AccessRequestDestinations {
+  /** The access request destinations for the securable. */
+  destinations?: NotificationDestination[] | undefined;
+  /** The securable for which the access request destinations are being modified or read. */
+  securable?: Securable | undefined;
+  /**
+   * Indicates whether any destinations are hidden from the caller due to a lack of permissions.
+   * This value is true if the caller does not have permission to see all destinations.
+   */
+  areAnyDestinationsHidden?: boolean | undefined;
+  /**
+   * The source securable from which the destinations are inherited. Either the same value as securable (if destination
+   * is set directly on the securable) or the nearest parent securable with destinations set.
+   */
+  destinationSourceSecurable?: Securable | undefined;
+  /** The type of the securable. Redundant with the type in the securable object, but necessary for Terraform integration */
+  securableType?: string | undefined;
+  /** The full name of the securable. Redundant with the name in the securable object, but necessary for Terraform integration */
+  fullName?: string | undefined;
+}
+
+export interface BatchCreateAccessRequestsRequest {
+  /**
+   * A list of individual access requests, where each request corresponds to
+   * a set of permissions being requested on a list of securables for a specified principal.
+   *
+   * At most 30 requests per API call.
+   */
+  requests?: CreateAccessRequest[] | undefined;
+}
+
+export interface BatchCreateAccessRequestsResponse {
+  /** The access request destinations for each securable object the principal requested. */
+  responses?: CreateAccessRequestResponse[] | undefined;
+}
+
+export interface CreateAccessRequest {
+  /**
+   * Optional. The principal this request is for.
+   * Empty `behalf_of` defaults to the requester's identity.
+   *
+   * Principals must be unique across the API call.
+   */
+  behalfOf?: Principal | undefined;
+  /**
+   * Optional. Comment associated with the request.
+   *
+   * At most 200 characters, can only contain lowercase/uppercase
+   * letters (a-z, A-Z), numbers (0-9), punctuation, and spaces.
+   */
+  comment?: string | undefined;
+  /**
+   * List of securables and their corresponding requested UC privileges.
+   *
+   * At most 30 securables can be requested for a principal per batched call.
+   * Each securable can only be requested once per principal.
+   */
+  securablePermissions?: SecurablePermissions[] | undefined;
+}
+
+export interface CreateAccessRequestResponse {
+  /** The principal the request was made on behalf of. */
+  behalfOf?: Principal | undefined;
+  /** The access request destinations for all the securables the principal requested. */
+  requestDestinations?: AccessRequestDestinations[] | undefined;
+}
+
+export interface GetAccessRequestDestinationsRequest {
+  /** The type of the securable. */
+  securableType?: string | undefined;
+  /** The full name of the securable. */
+  fullName?: string | undefined;
+}
+
+export interface NotificationDestination {
+  /**
+   * The identifier for the destination. This is the email address for EMAIL destinations, the URL for URL destinations,
+   * or the unique <Databricks> notification destination ID for all other external destinations.
+   */
+  destinationId?: string | undefined;
+  /** The type of the destination. */
+  destinationType?: DestinationType | undefined;
+  /**
+   * This field is used to denote whether the destination is the email of the owner of the securable object.
+   * The special destination cannot be assigned to a securable and only represents the default destination of the securable.
+   * The securable types that support default special destinations are: "catalog", "external_location", "connection", "credential", and "metastore".
+   * The **destination_type** of a **special_destination** is always EMAIL.
+   */
+  specialDestination?: SpecialDestination | undefined;
+}
+
+export interface Principal {
+  /** <Databricks> user, group or service principal ID. */
+  id?: string | undefined;
+  principalType?: PrincipalType | undefined;
+}
+
+/**
+ * Generic definition of a securable, which is uniquely defined in a metastore
+ * by its type and full name.
+ */
+export interface Securable {
+  /**
+   * Required. The type of securable (catalog/schema/table).
+   * Optional if resource_name is present.
+   */
+  type?: SecurableType | undefined;
+  /**
+   * Required. The full name of the catalog/schema/table.
+   * Optional if resource_name is present.
+   */
+  fullName?: string | undefined;
+  /**
+   * Optional. The name of the Share object that contains the securable when the securable is
+   * getting shared in D2D Delta Sharing.
+   */
+  providerShare?: string | undefined;
+}
+
+export interface SecurablePermissions {
+  /** The securable for which the access request destinations are being requested. */
+  securable?: Securable | undefined;
+  /** List of requested Unity Catalog permissions. */
+  permissions?: string[] | undefined;
+}
+
+export interface UpdateAccessRequestDestinationsRequest {
+  /**
+   * The access request destinations to assign to the securable.
+   * For each destination, a **destination_id** and **destination_type** must be defined.
+   */
+  accessRequestDestinations?: AccessRequestDestinations | undefined;
+  updateMask?: FieldMask<AccessRequestDestinations> | undefined;
+}
+
+export const unmarshalAccessRequestDestinationsSchema: z.ZodType<AccessRequestDestinations> =
+  z
+    .object({
+      destinations: z
+        .array(z.lazy(() => unmarshalNotificationDestinationSchema))
+        .optional(),
+      securable: z.lazy(() => unmarshalSecurableSchema).optional(),
+      are_any_destinations_hidden: z.boolean().optional(),
+      destination_source_securable: z
+        .lazy(() => unmarshalSecurableSchema)
+        .optional(),
+      securable_type: z.string().optional(),
+      full_name: z.string().optional(),
+    })
+    .transform(d => ({
+      destinations: d.destinations,
+      securable: d.securable,
+      areAnyDestinationsHidden: d.are_any_destinations_hidden,
+      destinationSourceSecurable: d.destination_source_securable,
+      securableType: d.securable_type,
+      fullName: d.full_name,
+    }));
+
+export const unmarshalBatchCreateAccessRequestsResponseSchema: z.ZodType<BatchCreateAccessRequestsResponse> =
+  z
+    .object({
+      responses: z
+        .array(z.lazy(() => unmarshalCreateAccessRequestResponseSchema))
+        .optional(),
+    })
+    .transform(d => ({
+      responses: d.responses,
+    }));
+
+export const unmarshalCreateAccessRequestResponseSchema: z.ZodType<CreateAccessRequestResponse> =
+  z
+    .object({
+      behalf_of: z.lazy(() => unmarshalPrincipalSchema).optional(),
+      request_destinations: z
+        .array(z.lazy(() => unmarshalAccessRequestDestinationsSchema))
+        .optional(),
+    })
+    .transform(d => ({
+      behalfOf: d.behalf_of,
+      requestDestinations: d.request_destinations,
+    }));
+
+export const unmarshalNotificationDestinationSchema: z.ZodType<NotificationDestination> =
+  z
+    .object({
+      destination_id: z.string().optional(),
+      destination_type: z.enum(DestinationType).optional(),
+      special_destination: z.enum(SpecialDestination).optional(),
+    })
+    .transform(d => ({
+      destinationId: d.destination_id,
+      destinationType: d.destination_type,
+      specialDestination: d.special_destination,
+    }));
+
+export const unmarshalPrincipalSchema: z.ZodType<Principal> = z
+  .object({
+    id: z.string().optional(),
+    principal_type: z.enum(PrincipalType).optional(),
+  })
+  .transform(d => ({
+    id: d.id,
+    principalType: d.principal_type,
+  }));
+
+export const unmarshalSecurableSchema: z.ZodType<Securable> = z
+  .object({
+    type: z.enum(SecurableType).optional(),
+    full_name: z.string().optional(),
+    provider_share: z.string().optional(),
+  })
+  .transform(d => ({
+    type: d.type,
+    fullName: d.full_name,
+    providerShare: d.provider_share,
+  }));
+
+export const marshalAccessRequestDestinationsSchema: z.ZodType = z
+  .object({
+    destinations: z
+      .array(z.lazy(() => marshalNotificationDestinationSchema))
+      .optional(),
+    securable: z.lazy(() => marshalSecurableSchema).optional(),
+    areAnyDestinationsHidden: z.boolean().optional(),
+    destinationSourceSecurable: z.lazy(() => marshalSecurableSchema).optional(),
+    securableType: z.string().optional(),
+    fullName: z.string().optional(),
+  })
+  .transform(d => ({
+    destinations: d.destinations,
+    securable: d.securable,
+    are_any_destinations_hidden: d.areAnyDestinationsHidden,
+    destination_source_securable: d.destinationSourceSecurable,
+    securable_type: d.securableType,
+    full_name: d.fullName,
+  }));
+
+export const marshalBatchCreateAccessRequestsRequestSchema: z.ZodType = z
+  .object({
+    requests: z
+      .array(z.lazy(() => marshalCreateAccessRequestSchema))
+      .optional(),
+  })
+  .transform(d => ({
+    requests: d.requests,
+  }));
+
+export const marshalCreateAccessRequestSchema: z.ZodType = z
+  .object({
+    behalfOf: z.lazy(() => marshalPrincipalSchema).optional(),
+    comment: z.string().optional(),
+    securablePermissions: z
+      .array(z.lazy(() => marshalSecurablePermissionsSchema))
+      .optional(),
+  })
+  .transform(d => ({
+    behalf_of: d.behalfOf,
+    comment: d.comment,
+    securable_permissions: d.securablePermissions,
+  }));
+
+export const marshalNotificationDestinationSchema: z.ZodType = z
+  .object({
+    destinationId: z.string().optional(),
+    destinationType: z.enum(DestinationType).optional(),
+    specialDestination: z.enum(SpecialDestination).optional(),
+  })
+  .transform(d => ({
+    destination_id: d.destinationId,
+    destination_type: d.destinationType,
+    special_destination: d.specialDestination,
+  }));
+
+export const marshalPrincipalSchema: z.ZodType = z
+  .object({
+    id: z.string().optional(),
+    principalType: z.enum(PrincipalType).optional(),
+  })
+  .transform(d => ({
+    id: d.id,
+    principal_type: d.principalType,
+  }));
+
+export const marshalSecurableSchema: z.ZodType = z
+  .object({
+    type: z.enum(SecurableType).optional(),
+    fullName: z.string().optional(),
+    providerShare: z.string().optional(),
+  })
+  .transform(d => ({
+    type: d.type,
+    full_name: d.fullName,
+    provider_share: d.providerShare,
+  }));
+
+export const marshalSecurablePermissionsSchema: z.ZodType = z
+  .object({
+    securable: z.lazy(() => marshalSecurableSchema).optional(),
+    permissions: z.array(z.string()).optional(),
+  })
+  .transform(d => ({
+    securable: d.securable,
+    permissions: d.permissions,
+  }));
+
+const accessRequestDestinationsFieldMaskSchema: FieldMaskSchema = {
+  areAnyDestinationsHidden: {wire: 'are_any_destinations_hidden'},
+  destinationSourceSecurable: {
+    wire: 'destination_source_securable',
+    children: () => securableFieldMaskSchema,
+  },
+  destinations: {wire: 'destinations'},
+  fullName: {wire: 'full_name'},
+  securable: {wire: 'securable', children: () => securableFieldMaskSchema},
+  securableType: {wire: 'securable_type'},
+};
+
+export function accessRequestDestinationsFieldMask(
+  ...paths: string[]
+): FieldMask<AccessRequestDestinations> {
+  return FieldMask.build<AccessRequestDestinations>(
+    paths,
+    accessRequestDestinationsFieldMaskSchema
+  );
+}
+
+const securableFieldMaskSchema: FieldMaskSchema = {
+  fullName: {wire: 'full_name'},
+  providerShare: {wire: 'provider_share'},
+  type: {wire: 'type'},
+};

package/src/v1/transport.ts

@@ -0,0 +1,73 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+import type {Credentials} from '@databricks/sdk-auth';
+import {defaultCredentials} from '@databricks/sdk-auth/credentials';
+import type {
+  HttpClient,
+  HttpRequest,
+  HttpResponse,
+} from '@databricks/sdk-core/http';
+import {newFetchHttpClient} from '@databricks/sdk-core/http';
+import type {ClientOptions} from '@databricks/sdk-options/client';
+
+/** Creates a new HTTP client with the given options. */
+export function newHttpClient(options?: ClientOptions): HttpClient {
+  const opts = options ?? {};
+
+  // If an HTTP client is provided, use it as-is. Throw if other options are
+  // also set, since they would be silently ignored.
+  if (opts.httpClient !== undefined) {
+    if (opts.credentials !== undefined || opts.timeout !== undefined) {
+      throw new Error(
+        'httpClient cannot be combined with credentials or timeout'
+      );
+    }
+    return opts.httpClient;
+  }
+
+  const credentials = opts.credentials ?? defaultCredentials();
+
+  const base = newFetchHttpClient();
+  let client: HttpClient = new AuthHttpClient(base, credentials);
+
+  if (opts.timeout !== undefined) {
+    client = new TimeoutHttpClient(client, opts.timeout);
+  }
+
+  return client;
+}
+
+/** Wraps an HttpClient and adds authentication headers to requests. */
+class AuthHttpClient implements HttpClient {
+  constructor(
+    private readonly base: HttpClient,
+    private readonly credentials: Credentials
+  ) {}
+
+  async send(request: HttpRequest): Promise<HttpResponse> {
+    const authHeaders = await this.credentials.authHeaders();
+    // Do not modify the original request.
+    const headers = new Headers(request.headers);
+    for (const h of authHeaders) {
+      headers.set(h.key, h.value);
+    }
+    return this.base.send({...request, headers});
+  }
+}
+
+/** Wraps an HttpClient and applies a default timeout to requests. */
+class TimeoutHttpClient implements HttpClient {
+  constructor(
+    private readonly base: HttpClient,
+    private readonly timeout: number
+  ) {}
+
+  async send(request: HttpRequest): Promise<HttpResponse> {
+    const timeoutSignal = AbortSignal.timeout(this.timeout);
+    const signal =
+      request.signal !== undefined
+        ? AbortSignal.any([request.signal, timeoutSignal])
+        : timeoutSignal;
+    return this.base.send({...request, signal});
+  }
+}