@descope/pulumi-descope 0.3.4 → 0.3.13

package/accessKey.d.ts

@@ -0,0 +1,197 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "./types/input";
+import * as outputs from "./types/output";
+export declare class AccessKey extends pulumi.CustomResource {
+    /**
+     * Get an existing AccessKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessKeyState, opts?: pulumi.CustomResourceOptions): AccessKey;
+    /**
+     * Returns true if the given object is an instance of AccessKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is AccessKey;
+    /**
+     * The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
+     */
+    readonly boundUserId: pulumi.Output<string>;
+    /**
+     * The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
+     */
+    readonly cleartext: pulumi.Output<string>;
+    readonly clientId: pulumi.Output<string>;
+    /**
+     * The ID of the user or management key that created the access key. This value is set by the server and is read-only.
+     */
+    readonly createdBy: pulumi.Output<string>;
+    /**
+     * The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
+     */
+    readonly createdTime: pulumi.Output<number>;
+    /**
+     * A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
+     */
+    readonly customAttributes: pulumi.Output<string>;
+    /**
+     * A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
+     */
+    readonly customClaims: pulumi.Output<string>;
+    /**
+     * A description for the access key.
+     */
+    readonly description: pulumi.Output<string>;
+    /**
+     * The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
+     */
+    readonly expireTime: pulumi.Output<number>;
+    /**
+     * A name for the access key.
+     */
+    readonly name: pulumi.Output<string>;
+    /**
+     * A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
+     */
+    readonly permittedIps: pulumi.Output<string[]>;
+    /**
+     * The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
+     */
+    readonly projectId: pulumi.Output<string>;
+    /**
+     * A list of project-level roles to grant to the access key. Cannot be used together with `tenants`.
+     */
+    readonly roles: pulumi.Output<string[]>;
+    /**
+     * The status of the access key. Must be either `active` or `inactive`. A new access key cannot be created with an `inactive` status.
+     */
+    readonly status: pulumi.Output<string>;
+    /**
+     * A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with `roles`.
+     */
+    readonly tenants: pulumi.Output<outputs.AccessKeyTenant[]>;
+    /**
+     * Create a AccessKey resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: AccessKeyArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering AccessKey resources.
+ */
+export interface AccessKeyState {
+    /**
+     * The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
+     */
+    boundUserId?: pulumi.Input<string | undefined>;
+    /**
+     * The plaintext value of the access key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to exchange the key for a JWT.
+     */
+    cleartext?: pulumi.Input<string | undefined>;
+    clientId?: pulumi.Input<string | undefined>;
+    /**
+     * The ID of the user or management key that created the access key. This value is set by the server and is read-only.
+     */
+    createdBy?: pulumi.Input<string | undefined>;
+    /**
+     * The time the access key was created, as a Unix timestamp. This value is set by the server and is read-only.
+     */
+    createdTime?: pulumi.Input<number | undefined>;
+    /**
+     * A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
+     */
+    customAttributes?: pulumi.Input<string | undefined>;
+    /**
+     * A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
+     */
+    customClaims?: pulumi.Input<string | undefined>;
+    /**
+     * A description for the access key.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
+     */
+    expireTime?: pulumi.Input<number | undefined>;
+    /**
+     * A name for the access key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
+     */
+    permittedIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
+     */
+    projectId?: pulumi.Input<string | undefined>;
+    /**
+     * A list of project-level roles to grant to the access key. Cannot be used together with `tenants`.
+     */
+    roles?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * The status of the access key. Must be either `active` or `inactive`. A new access key cannot be created with an `inactive` status.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with `roles`.
+     */
+    tenants?: pulumi.Input<pulumi.Input<inputs.AccessKeyTenant>[] | undefined>;
+}
+/**
+ * The set of arguments for constructing a AccessKey resource.
+ */
+export interface AccessKeyArgs {
+    /**
+     * The ID of a user to bind this access key to. When the key is exchanged for a session JWT, the session acts on behalf of the bound user. Changing this value after creation will require the access key to be replaced.
+     */
+    boundUserId?: pulumi.Input<string | undefined>;
+    /**
+     * A JSON-encoded object of custom attribute values for the access key. The attributes must be defined in the project's access key custom attribute schema.
+     */
+    customAttributes?: pulumi.Input<string | undefined>;
+    /**
+     * A JSON-encoded object of custom claims to add to the JWT created when the access key is exchanged.
+     */
+    customClaims?: pulumi.Input<string | undefined>;
+    /**
+     * A description for the access key.
+     */
+    description?: pulumi.Input<string | undefined>;
+    /**
+     * The expiration time of the access key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the access key to be replaced.
+     */
+    expireTime?: pulumi.Input<number | undefined>;
+    /**
+     * A name for the access key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * A list of IP addresses or CIDR ranges that are allowed to use this access key. If not set, the key can be used from any IP address.
+     */
+    permittedIps?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * The ID of the Descope project this access key belongs to. Changing this value will require the resource to be deleted and recreated.
+     */
+    projectId: pulumi.Input<string>;
+    /**
+     * A list of project-level roles to grant to the access key. Cannot be used together with `tenants`.
+     */
+    roles?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * The status of the access key. Must be either `active` or `inactive`. A new access key cannot be created with an `inactive` status.
+     */
+    status?: pulumi.Input<string | undefined>;
+    /**
+     * A list of tenants to associate with the access key, each with its own set of roles. Cannot be used together with `roles`.
+     */
+    tenants?: pulumi.Input<pulumi.Input<inputs.AccessKeyTenant>[] | undefined>;
+}
+//# sourceMappingURL=accessKey.d.ts.map

package/accessKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessKey.d.ts","sourceRoot":"","sources":["../accessKey.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C,qBAAa,SAAU,SAAQ,MAAM,CAAC,cAAc;IAChD;;;;;;;;OAQG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,SAAS;IAOpI;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,SAAS;IAOpD;;OAEG;IACH,SAAwB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D;;OAEG;IACH,SAAgC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,SAAgC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE;;OAEG;IACH,SAAgC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE;;OAEG;IACH,SAAgC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE;;OAEG;IACH,SAAwB,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE;;OAEG;IACH,SAAwB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D;;OAEG;IACH,SAAwB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D;;OAEG;IACH,SAAwB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD;;OAEG;IACH,SAAwB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D;;OAEG;IACH,SAAwB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD;;OAEG;IACH,SAAwB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD;;OAEG;IACH,SAAwB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD;;OAEG;IACH,SAAwB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE1E;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CA+CrF;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC3B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAChE;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IACzD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChD;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAChE;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IACzD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;CAC9E"}

package/accessKey.js

@@ -0,0 +1,105 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessKey = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
+class AccessKey extends pulumi.CustomResource {
+    /**
+     * Get an existing AccessKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new AccessKey(name, state, { ...opts, id: id });
+    }
+    /** @internal */
+    static __pulumiType = 'descope:index/accessKey:AccessKey';
+    /**
+     * Returns true if the given object is an instance of AccessKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === AccessKey.__pulumiType;
+    }
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["boundUserId"] = state?.boundUserId;
+            resourceInputs["cleartext"] = state?.cleartext;
+            resourceInputs["clientId"] = state?.clientId;
+            resourceInputs["createdBy"] = state?.createdBy;
+            resourceInputs["createdTime"] = state?.createdTime;
+            resourceInputs["customAttributes"] = state?.customAttributes;
+            resourceInputs["customClaims"] = state?.customClaims;
+            resourceInputs["description"] = state?.description;
+            resourceInputs["expireTime"] = state?.expireTime;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["permittedIps"] = state?.permittedIps;
+            resourceInputs["projectId"] = state?.projectId;
+            resourceInputs["roles"] = state?.roles;
+            resourceInputs["status"] = state?.status;
+            resourceInputs["tenants"] = state?.tenants;
+        }
+        else {
+            const args = argsOrState;
+            if (args?.projectId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'projectId'");
+            }
+            resourceInputs["boundUserId"] = args?.boundUserId;
+            resourceInputs["customAttributes"] = args?.customAttributes;
+            resourceInputs["customClaims"] = args?.customClaims;
+            resourceInputs["description"] = args?.description;
+            resourceInputs["expireTime"] = args?.expireTime;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["permittedIps"] = args?.permittedIps;
+            resourceInputs["projectId"] = args?.projectId;
+            resourceInputs["roles"] = args?.roles;
+            resourceInputs["status"] = args?.status;
+            resourceInputs["tenants"] = args?.tenants;
+            resourceInputs["cleartext"] = undefined /*out*/;
+            resourceInputs["clientId"] = undefined /*out*/;
+            resourceInputs["createdBy"] = undefined /*out*/;
+            resourceInputs["createdTime"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["cleartext"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(AccessKey.__pulumiType, name, resourceInputs, opts);
+    }
+}
+exports.AccessKey = AccessKey;
+//# sourceMappingURL=accessKey.js.map

package/accessKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessKey.js","sourceRoot":"","sources":["../accessKey.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AAGzC,uDAAyC;AAEzC,MAAa,SAAU,SAAQ,MAAM,CAAC,cAAc;IAChD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAsB,EAAE,IAAmC;QACpH,OAAO,IAAI,SAAS,CAAC,IAAI,EAAO,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,mCAAmC,CAAC;IAE1E;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,SAAS,CAAC,YAAY,CAAC;IAC1D,CAAC;IAoED,YAAY,IAAY,EAAE,WAA4C,EAAE,IAAmC;QACvG,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAyC,CAAC;YACxD,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,WAAW,CAAC;YACnD,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;YAC/C,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;YAC7C,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;YAC/C,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,WAAW,CAAC;YACnD,cAAc,CAAC,kBAAkB,CAAC,GAAG,KAAK,EAAE,gBAAgB,CAAC;YAC7D,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,EAAE,YAAY,CAAC;YACrD,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,WAAW,CAAC;YACnD,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,UAAU,CAAC;YACjD,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC;YACrC,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,EAAE,YAAY,CAAC;YACrD,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;YAC/C,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC;YACvC,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC;YACzC,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC;SAC9C;aAAM;YACH,MAAM,IAAI,GAAG,WAAwC,CAAC;YACtD,IAAI,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;aAC5D;YACD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,EAAE,gBAAgB,CAAC;YAC5D,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC;YAChD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;YACtC,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAChD,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC/C,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAChD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACrD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;;AA3IL,8BA4IC"}

package/config/index.d.ts

@@ -1 +1,2 @@
 export * from "./vars";
+//# sourceMappingURL=index.d.ts.map

package/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../config/index.ts"],"names":[],"mappings":"AAIA,cAAc,QAAQ,CAAC"}

package/config/vars.d.ts

@@ -7,3 +7,4 @@ export declare const baseUrl: string | undefined;
  */
 export declare const managementKey: string | undefined;
 export declare const projectId: string | undefined;
+//# sourceMappingURL=vars.d.ts.map

package/config/vars.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vars.d.ts","sourceRoot":"","sources":["../../config/vars.ts"],"names":[],"mappings":"AASA;;GAEG;AACH,MAAM,CAAC,OAAO,CAAC,MAAM,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;AAQjD;;GAEG;AACH,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;AAQvD,MAAM,CAAC,OAAO,CAAC,MAAM,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC"}

package/config/vars.js

@@ -1,8 +1,31 @@
 "use strict";
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-const pulumi = require("@pulumi/pulumi");
+const pulumi = __importStar(require("@pulumi/pulumi"));
 const __config = new pulumi.Config("descope");
 Object.defineProperty(exports, "baseUrl", {
     get() {

package/config/vars.js.map

@@ -1 +1 @@
-{"version":3,"file":"vars.js","sourceRoot":"","sources":["../../config/vars.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;AAEjF,yCAAyC;AAIzC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAM9C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE;IACtC,GAAG;QACC,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,UAAU,EAAE,IAAI;CACnB,CAAC,CAAC;AAMH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE;IAC5C,GAAG;QACC,OAAO,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;IACD,UAAU,EAAE,IAAI;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE;IACxC,GAAG;QACC,OAAO,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,UAAU,EAAE,IAAI;CACnB,CAAC,CAAC"}
+{"version":3,"file":"vars.js","sourceRoot":"","sources":["../../config/vars.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AAIzC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAM9C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE;IACtC,GAAG;QACC,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,UAAU,EAAE,IAAI;CACnB,CAAC,CAAC;AAMH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE;IAC5C,GAAG;QACC,OAAO,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;IACD,UAAU,EAAE,IAAI;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE;IACxC,GAAG;QACC,OAAO,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,UAAU,EAAE,IAAI;CACnB,CAAC,CAAC"}

package/descoper.d.ts

@@ -0,0 +1,178 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "./types/input";
+import * as outputs from "./types/output";
+/**
+ * Manages a Descope console user and their access control settings. Console users (referred to as "Descopers") are team members who access the [Descope console](https://app.descope.com) to manage projects.
+ *
+ * Access is controlled via RBAC, where each Descoper can be granted one of four roles:
+ * - `admin` – Full access to project settings
+ * - `developer` – Can edit flows and configurations
+ * - `support` – Can view user data and audit logs
+ * - `auditor` – Read-only access to audit logs
+ *
+ * Roles can be scoped to the entire company, to specific projects by ID, or to all projects with a given tag.
+ *
+ * ## Example Usage
+ *
+ * ### Company Admin
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as descope from "@descope/pulumi-descope";
+ *
+ * const admin = new descope.Descoper("admin", {
+ *     email: "admin@example.com",
+ *     name: "Alice Admin",
+ *     rbac: {
+ *         isCompanyAdmin: true,
+ *     },
+ * });
+ * ```
+ *
+ * ### Developer for Specific Projects
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as descope from "@descope/pulumi-descope";
+ *
+ * const developer = new descope.Descoper("developer", {
+ *     email: "dev@example.com",
+ *     name: "Bob Dev",
+ *     rbac: {
+ *         projectRoles: [{
+ *             role: "developer",
+ *             projectIds: [
+ *                 "P123abc",
+ *                 "P456def",
+ *             ],
+ *         }],
+ *     },
+ * });
+ * ```
+ *
+ * ### Support Access via Project Tags
+ *
+ * Grant a support engineer access to all projects tagged `production`:
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as descope from "@descope/pulumi-descope";
+ *
+ * const support = new descope.Descoper("support", {
+ *     email: "support@example.com",
+ *     rbac: {
+ *         tagRoles: [{
+ *             role: "support",
+ *             tags: ["production"],
+ *         }],
+ *     },
+ * });
+ * ```
+ *
+ * ### Multi-Role Access
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as descope from "@descope/pulumi-descope";
+ *
+ * const multiRole = new descope.Descoper("multi_role", {
+ *     email: "lead@example.com",
+ *     rbac: {
+ *         projectRoles: [
+ *             {
+ *                 role: "admin",
+ *                 projectIds: ["P123abc"],
+ *             },
+ *             {
+ *                 role: "developer",
+ *                 projectIds: ["P789ghi"],
+ *             },
+ *         ],
+ *     },
+ * });
+ * ```
+ */
+export declare class Descoper extends pulumi.CustomResource {
+    /**
+     * Get an existing Descoper resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: DescoperState, opts?: pulumi.CustomResourceOptions): Descoper;
+    /**
+     * Returns true if the given object is an instance of Descoper.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is Descoper;
+    /**
+     * The email address of the Descope console user.
+     */
+    readonly email: pulumi.Output<string>;
+    /**
+     * The display name of the Descope console user.
+     */
+    readonly name: pulumi.Output<string>;
+    /**
+     * The phone number of the Descope console user.
+     */
+    readonly phone: pulumi.Output<string>;
+    /**
+     * Access control settings for the Descope console user. This defines the permissions granted to the user, either as a company admin or for specific projects or project tags.
+     */
+    readonly rbac: pulumi.Output<outputs.DescoperRbac>;
+    /**
+     * Create a Descoper resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: DescoperArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering Descoper resources.
+ */
+export interface DescoperState {
+    /**
+     * The email address of the Descope console user.
+     */
+    email?: pulumi.Input<string | undefined>;
+    /**
+     * The display name of the Descope console user.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * The phone number of the Descope console user.
+     */
+    phone?: pulumi.Input<string | undefined>;
+    /**
+     * Access control settings for the Descope console user. This defines the permissions granted to the user, either as a company admin or for specific projects or project tags.
+     */
+    rbac?: pulumi.Input<inputs.DescoperRbac | undefined>;
+}
+/**
+ * The set of arguments for constructing a Descoper resource.
+ */
+export interface DescoperArgs {
+    /**
+     * The email address of the Descope console user.
+     */
+    email: pulumi.Input<string>;
+    /**
+     * The display name of the Descope console user.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * The phone number of the Descope console user.
+     */
+    phone?: pulumi.Input<string | undefined>;
+    /**
+     * Access control settings for the Descope console user. This defines the permissions granted to the user, either as a company admin or for specific projects or project tags.
+     */
+    rbac: pulumi.Input<inputs.DescoperRbac>;
+}
+//# sourceMappingURL=descoper.d.ts.map

package/descoper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descoper.d.ts","sourceRoot":"","sources":["../descoper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,qBAAa,QAAS,SAAQ,MAAM,CAAC,cAAc;IAC/C;;;;;;;;OAQG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,QAAQ;IAOlI;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,QAAQ;IAOnD;;OAEG;IACH,SAAwB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD;;OAEG;IACH,SAAwB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElE;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CA0BpF;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC1B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;CAC3C"}