@hasna/connectors 1.3.43 → 1.3.45

package/connectors/teleport/scripts/release.ts

@@ -0,0 +1,179 @@
+#!/usr/bin/env bun
+/**
+ * Release script for publishing to npm
+ *
+ * Usage:
+ *   bun run release        # Build, bump version, and publish
+ *   bun run release:dry    # Dry run (preview only)
+ *
+ * Features:
+ *   - Auto-fetches current npm version
+ *   - Bumps patch version if needed
+ *   - Creates git tag
+ *   - Publishes to npm
+ */
+
+import { readFileSync, writeFileSync } from 'fs';
+import { execSync } from 'child_process';
+
+const isDryRun = process.argv.includes('--dry-run');
+
+interface PackageJson {
+  name: string;
+  version: string;
+  [key: string]: unknown;
+}
+
+function exec(command: string, silent = false): string {
+  try {
+    const result = execSync(command, {
+      encoding: 'utf-8',
+      stdio: silent ? 'pipe' : 'inherit',
+    });
+    return result?.trim() || '';
+  } catch (err) {
+    if (silent) {
+      return '';
+    }
+    throw err;
+  }
+}
+
+function log(message: string): void {
+  console.log(`\x1b[36m▸\x1b[0m ${message}`);
+}
+
+function success(message: string): void {
+  console.log(`\x1b[32m✓\x1b[0m ${message}`);
+}
+
+function warn(message: string): void {
+  console.log(`\x1b[33m⚠\x1b[0m ${message}`);
+}
+
+function error(message: string): void {
+  console.error(`\x1b[31m✗\x1b[0m ${message}`);
+}
+
+function parseVersion(version: string): { major: number; minor: number; patch: number } {
+  const [major, minor, patch] = version.split('.').map(Number);
+  return { major, minor, patch };
+}
+
+function bumpPatch(version: string): string {
+  const { major, minor, patch } = parseVersion(version);
+  return `${major}.${minor}.${patch + 1}`;
+}
+
+async function main(): Promise<void> {
+  // Read package.json
+  const packageJsonPath = 'package.json';
+  const packageJson: PackageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+  const { name, version: localVersion } = packageJson;
+
+  log(`Package: ${name}`);
+  log(`Local version: ${localVersion}`);
+
+  // Get current npm version
+  let npmVersion = '';
+  try {
+    npmVersion = exec(`npm view ${name} version 2>/dev/null`, true);
+    log(`npm version: ${npmVersion || 'not published'}`);
+  } catch {
+    log('npm version: not published yet');
+  }
+
+  // Determine new version
+  let newVersion = localVersion;
+  if (npmVersion) {
+    const localParsed = parseVersion(localVersion);
+    const npmParsed = parseVersion(npmVersion);
+
+    // If local version <= npm version, bump from npm version
+    if (
+      localParsed.major < npmParsed.major ||
+      (localParsed.major === npmParsed.major && localParsed.minor < npmParsed.minor) ||
+      (localParsed.major === npmParsed.major &&
+        localParsed.minor === npmParsed.minor &&
+        localParsed.patch <= npmParsed.patch)
+    ) {
+      newVersion = bumpPatch(npmVersion);
+    }
+  }
+
+  if (newVersion !== localVersion) {
+    log(`Bumping version: ${localVersion} → ${newVersion}`);
+
+    if (!isDryRun) {
+      packageJson.version = newVersion;
+      writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
+    }
+  } else {
+    log(`Version unchanged: ${newVersion}`);
+  }
+
+  // Run typecheck
+  log('Running typecheck...');
+  if (!isDryRun) {
+    exec('bun run typecheck');
+    success('Typecheck passed');
+  }
+
+  // Build
+  log('Building...');
+  if (!isDryRun) {
+    exec('bun run build');
+    success('Build completed');
+  }
+
+  // Git operations
+  const gitStatus = exec('git status --porcelain', true);
+  if (gitStatus) {
+    log('Staging changes...');
+    if (!isDryRun) {
+      exec('git add package.json');
+      exec(`git commit -m "chore: release v${newVersion}"`);
+    }
+  }
+
+  // Create git tag
+  const tagName = `v${newVersion}`;
+  log(`Creating tag: ${tagName}`);
+  if (!isDryRun) {
+    try {
+      exec(`git tag ${tagName}`);
+      success(`Tag ${tagName} created`);
+    } catch {
+      warn(`Tag ${tagName} already exists`);
+    }
+  }
+
+  // Publish
+  log('Publishing to npm...');
+  if (isDryRun) {
+    warn('Dry run - skipping publish');
+    exec('npm publish --dry-run');
+  } else {
+    exec('npm publish');
+    success(`Published ${name}@${newVersion}`);
+  }
+
+  // Push tags
+  if (!isDryRun) {
+    log('Pushing tags...');
+    try {
+      exec('git push --tags');
+      success('Tags pushed');
+    } catch {
+      warn('Failed to push tags (you may need to push manually)');
+    }
+  }
+
+  console.log('');
+  success(`Release ${isDryRun ? '(dry run) ' : ''}complete: ${name}@${newVersion}`);
+}
+
+main().catch((err) => {
+  error(String(err));
+  process.exit(1);
+});

package/connectors/teleport/src/api/client.ts

@@ -0,0 +1,84 @@
+import type { TeleportConfig } from '../types';
+import { TeleportApiError } from '../types';
+
+export type QueryValue = string | number | boolean | undefined | string[];
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' ? (value as Record<string, unknown>) : {};
+}
+
+function buildQuery(params: Record<string, QueryValue>): string {
+  const q = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value === undefined || value === null || value === '') continue;
+    if (Array.isArray(value)) {
+      for (const item of value) q.append(key, String(item));
+    } else {
+      q.set(key, String(value));
+    }
+  }
+  const query = q.toString();
+  return query ? `?${query}` : '';
+}
+
+export class TeleportClient {
+  private readonly token: string;
+  private readonly baseUrl: string;
+
+  constructor(config: TeleportConfig) {
+    if (!config.baseUrl?.trim()) throw new Error('Teleport baseUrl is required');
+    if (!config.token?.trim()) throw new Error('Teleport token is required');
+    this.token = config.token.trim();
+    this.baseUrl = config.baseUrl.trim().replace(/\/$/, '');
+  }
+
+  getBaseUrl(): string {
+    return this.baseUrl;
+  }
+
+  async request<T>(
+    path: string,
+    options: {
+      method?: 'GET' | 'POST' | 'PUT' | 'DELETE';
+      query?: Record<string, QueryValue>;
+      body?: unknown;
+    } = {},
+  ): Promise<T> {
+    const { method = 'GET', query, body } = options;
+    const url = `${this.baseUrl}${path}${buildQuery(query ?? {})}`;
+    const headers: Record<string, string> = {
+      Authorization: `Bearer ${this.token}`,
+      Accept: 'application/json',
+    };
+    if (body !== undefined) headers['Content-Type'] = 'application/json';
+
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+    });
+
+    const text = await response.text();
+    const data: unknown = text
+      ? (() => {
+          try {
+            return JSON.parse(text);
+          } catch {
+            return { raw: text };
+          }
+        })()
+      : {};
+
+    if (!response.ok) {
+      const record = asRecord(data);
+      const message =
+        (typeof record.message === 'string' && record.message) ||
+        (typeof record.error === 'string' && record.error) ||
+        (typeof record.raw === 'string' && record.raw) ||
+        `request failed (${response.status})`;
+      throw new TeleportApiError(`Teleport: ${message}`, response.status);
+    }
+
+    return data as T;
+  }
+}

package/connectors/teleport/src/api/index.ts

@@ -0,0 +1,240 @@
+import { TeleportClient } from './client';
+import type {
+  TeleportAccessRequest,
+  TeleportAuthConnector,
+  TeleportConfig,
+  TeleportResourceId,
+  TeleportRole,
+  TeleportUser,
+} from '../types';
+
+export { TeleportClient } from './client';
+
+function requireString(value: string | undefined, label: string): string {
+  if (!value?.trim()) throw new Error(`Teleport: ${label} is required`);
+  return value.trim();
+}
+
+export class Teleport {
+  private readonly client: TeleportClient;
+
+  constructor(config: TeleportConfig) {
+    this.client = new TeleportClient(config);
+  }
+
+  static fromEnv(): Teleport {
+    const baseUrl = process.env.TELEPORT_BASE_URL;
+    const token = process.env.TELEPORT_TOKEN;
+    if (!baseUrl || !token) throw new Error('TELEPORT_BASE_URL and TELEPORT_TOKEN are required');
+    return new Teleport({ baseUrl, token });
+  }
+
+  async getPing(): Promise<unknown> {
+    return this.client.request('/v1/webapi/ping');
+  }
+
+  async listNodes(options: { searchAsRoles?: boolean; query?: string; pageSize?: number; startKey?: string } = {}): Promise<unknown> {
+    return this.client.request('/v1/sites/local/nodes', {
+      query: {
+        query: options.query,
+        page_size: options.pageSize,
+        start_key: options.startKey,
+        search_as_roles: options.searchAsRoles,
+      },
+    });
+  }
+
+  async getNode(name: string): Promise<unknown> {
+    return this.client.request(`/v1/sites/local/nodes/${encodeURIComponent(requireString(name, 'name'))}`);
+  }
+
+  async listApps(): Promise<unknown> {
+    return this.client.request('/v1/sites/local/apps');
+  }
+
+  async listKubernetesClusters(): Promise<unknown> {
+    return this.client.request('/v1/sites/local/kubernetes');
+  }
+
+  async listDatabases(): Promise<unknown> {
+    return this.client.request('/v1/sites/local/databases');
+  }
+
+  async listDesktops(): Promise<unknown> {
+    return this.client.request('/v1/sites/local/desktops');
+  }
+
+  async listSessions(options: { from?: string; to?: string; order?: 'ASC' | 'DESC'; pageSize?: number; startKey?: string } = {}): Promise<unknown> {
+    return this.client.request('/v1/sites/local/sessions', {
+      query: {
+        from: options.from,
+        to: options.to,
+        order: options.order,
+        page_size: options.pageSize,
+        start_key: options.startKey,
+      },
+    });
+  }
+
+  async getSession(id: string): Promise<unknown> {
+    return this.client.request(`/v1/sites/local/sessions/${encodeURIComponent(requireString(id, 'id'))}`);
+  }
+
+  async terminateSession(id: string, participantId?: string): Promise<unknown> {
+    return this.client.request(`/v1/sites/local/sessions/${encodeURIComponent(requireString(id, 'id'))}`, {
+      method: 'DELETE',
+      query: { participant_id: participantId },
+    });
+  }
+
+  async listUsers(): Promise<unknown> {
+    return this.client.request('/v1/users');
+  }
+
+  async getUser(name: string, withSecrets?: boolean): Promise<unknown> {
+    return this.client.request(`/v1/users/${encodeURIComponent(requireString(name, 'name'))}`, {
+      query: { with_secrets: withSecrets },
+    });
+  }
+
+  async createUser(user: TeleportUser): Promise<unknown> {
+    return this.client.request('/v1/users', { method: 'POST', body: user });
+  }
+
+  async updateUser(name: string, user: Record<string, unknown>): Promise<unknown> {
+    return this.client.request(`/v1/users/${encodeURIComponent(requireString(name, 'name'))}`, {
+      method: 'PUT',
+      body: user,
+    });
+  }
+
+  async deleteUser(name: string): Promise<unknown> {
+    return this.client.request(`/v1/users/${encodeURIComponent(requireString(name, 'name'))}`, { method: 'DELETE' });
+  }
+
+  async listRoles(): Promise<unknown> {
+    return this.client.request('/v1/roles');
+  }
+
+  async getRole(name: string): Promise<unknown> {
+    return this.client.request(`/v1/roles/${encodeURIComponent(requireString(name, 'name'))}`);
+  }
+
+  async upsertRole(role: TeleportRole): Promise<unknown> {
+    return this.client.request('/v1/roles', { method: 'POST', body: role });
+  }
+
+  async deleteRole(name: string): Promise<unknown> {
+    return this.client.request(`/v1/roles/${encodeURIComponent(requireString(name, 'name'))}`, { method: 'DELETE' });
+  }
+
+  async listAccessRequests(options: { state?: TeleportAccessRequest['state']; user?: string } = {}): Promise<unknown> {
+    return this.client.request('/v1/access_requests', {
+      query: { state: options.state, user: options.user },
+    });
+  }
+
+  async getAccessRequest(id: string): Promise<unknown> {
+    return this.client.request(`/v1/access_requests/${encodeURIComponent(requireString(id, 'id'))}`);
+  }
+
+  async createAccessRequest(options: {
+    user: string;
+    roles: string[];
+    resourceIds?: TeleportResourceId[];
+    reason?: string;
+    suggestedReviewers?: string[];
+  }): Promise<unknown> {
+    return this.client.request('/v1/access_requests', {
+      method: 'POST',
+      body: {
+        user: options.user,
+        roles: options.roles,
+        resource_ids: options.resourceIds,
+        request_reason: options.reason,
+        suggested_reviewers: options.suggestedReviewers,
+      },
+    });
+  }
+
+  async approveAccessRequest(id: string, reason?: string): Promise<unknown> {
+    return this.client.request(`/v1/access_requests/${encodeURIComponent(requireString(id, 'id'))}/review`, {
+      method: 'POST',
+      body: { state: 'APPROVED', reason },
+    });
+  }
+
+  async denyAccessRequest(id: string, reason?: string): Promise<unknown> {
+    return this.client.request(`/v1/access_requests/${encodeURIComponent(requireString(id, 'id'))}/review`, {
+      method: 'POST',
+      body: { state: 'DENIED', reason },
+    });
+  }
+
+  async deleteAccessRequest(id: string): Promise<unknown> {
+    return this.client.request(`/v1/access_requests/${encodeURIComponent(requireString(id, 'id'))}`, { method: 'DELETE' });
+  }
+
+  async listTokens(): Promise<unknown> {
+    return this.client.request('/v1/tokens');
+  }
+
+  async createToken(options: { roles: string[]; ttl?: string; name?: string; allowedCidrs?: string[] }): Promise<unknown> {
+    return this.client.request('/v1/tokens', {
+      method: 'POST',
+      body: {
+        roles: options.roles,
+        ttl: options.ttl,
+        name: options.name,
+        allowed_cidrs: options.allowedCidrs,
+      },
+    });
+  }
+
+  async deleteToken(name: string): Promise<unknown> {
+    return this.client.request(`/v1/tokens/${encodeURIComponent(requireString(name, 'name'))}`, { method: 'DELETE' });
+  }
+
+  async getAuditEvents(options: {
+    from: string;
+    to: string;
+    eventType?: string[];
+    pageSize?: number;
+    startKey?: string;
+    order?: 'ASC' | 'DESC';
+  }): Promise<unknown> {
+    return this.client.request('/v1/events/search', {
+      query: {
+        from: options.from,
+        to: options.to,
+        event_type: options.eventType,
+        page_size: options.pageSize,
+        start_key: options.startKey,
+        order: options.order,
+      },
+    });
+  }
+
+  async getSessionRecording(sessionId: string): Promise<unknown> {
+    return this.client.request(`/v1/sessions/${encodeURIComponent(requireString(sessionId, 'sessionId'))}/recording`);
+  }
+
+  async listAuthConnectors(): Promise<unknown> {
+    return this.client.request('/v1/auth_connectors');
+  }
+
+  async upsertAuthConnector(connector: TeleportAuthConnector): Promise<unknown> {
+    return this.client.request('/v1/auth_connectors', { method: 'POST', body: connector });
+  }
+
+  async deleteAuthConnector(kind: TeleportAuthConnector['kind'], name: string): Promise<unknown> {
+    return this.client.request(
+      `/v1/auth_connectors/${encodeURIComponent(kind)}/${encodeURIComponent(requireString(name, 'name'))}`,
+      { method: 'DELETE' },
+    );
+  }
+
+  getClient(): TeleportClient {
+    return this.client;
+  }
+}

package/connectors/teleport/src/api/teleport.test.ts

@@ -0,0 +1,167 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test';
+import { Teleport } from './index';
+import { TeleportClient } from './client';
+
+type TeleportApi = Teleport;
+type TeleportMethodName = keyof {
+  [K in keyof TeleportApi as TeleportApi[K] extends (...args: never[]) => unknown ? K : never]: true;
+};
+
+type CapturedRequest = { url: URL; method: string; headers: Headers; body?: unknown };
+
+const mockConfig = { baseUrl: 'https://teleport.example.com', token: ' tp-tok ' };
+const originalFetch = globalThis.fetch;
+
+function parseBody(body: BodyInit | null | undefined): unknown {
+  if (typeof body !== 'string' || body.length === 0) return undefined;
+  return JSON.parse(body);
+}
+
+function installFetchMock(response?: Response): CapturedRequest[] {
+  const captured: CapturedRequest[] = [];
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = new URL(typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url);
+    captured.push({
+      url,
+      method: init?.method ?? 'GET',
+      headers: new Headers(init?.headers),
+      body: parseBody(init?.body),
+    });
+    if (response) return response.clone();
+    return Response.json({});
+  }) as typeof fetch;
+  return captured;
+}
+
+const routeCases: Array<{
+  name: TeleportMethodName;
+  method: string;
+  args?: unknown[];
+  path: string;
+  query?: Record<string, string>;
+  body?: unknown;
+}> = [
+  { name: 'getPing', method: 'GET', path: '/v1/webapi/ping' },
+  { name: 'listNodes', method: 'GET', args: [{ searchAsRoles: true, query: 'labels.env=prod', pageSize: 25, startKey: 'next' }], path: '/v1/sites/local/nodes', query: { query: 'labels.env=prod', page_size: '25', start_key: 'next', search_as_roles: 'true' } },
+  { name: 'getNode', method: 'GET', args: ['node/1'], path: '/v1/sites/local/nodes/node%2F1' },
+  { name: 'listApps', method: 'GET', path: '/v1/sites/local/apps' },
+  { name: 'listKubernetesClusters', method: 'GET', path: '/v1/sites/local/kubernetes' },
+  { name: 'listDatabases', method: 'GET', path: '/v1/sites/local/databases' },
+  { name: 'listDesktops', method: 'GET', path: '/v1/sites/local/desktops' },
+  { name: 'listSessions', method: 'GET', args: [{ from: '2026-05-01T00:00:00Z', to: '2026-05-15T00:00:00Z', order: 'DESC', pageSize: 50, startKey: 'next' }], path: '/v1/sites/local/sessions', query: { from: '2026-05-01T00:00:00Z', to: '2026-05-15T00:00:00Z', order: 'DESC', page_size: '50', start_key: 'next' } },
+  { name: 'getSession', method: 'GET', args: ['session/1'], path: '/v1/sites/local/sessions/session%2F1' },
+  { name: 'terminateSession', method: 'DELETE', args: ['session/1', 'participant-1'], path: '/v1/sites/local/sessions/session%2F1', query: { participant_id: 'participant-1' } },
+  { name: 'listUsers', method: 'GET', path: '/v1/users' },
+  { name: 'getUser', method: 'GET', args: ['ada/user', true], path: '/v1/users/ada%2Fuser', query: { with_secrets: 'true' } },
+  { name: 'createUser', method: 'POST', args: [{ metadata: { name: 'ada' }, spec: { roles: ['editor'] } }], path: '/v1/users', body: { metadata: { name: 'ada' }, spec: { roles: ['editor'] } } },
+  { name: 'updateUser', method: 'PUT', args: ['ada/user', { metadata: { name: 'ada' }, spec: { roles: ['admin'] } }], path: '/v1/users/ada%2Fuser', body: { metadata: { name: 'ada' }, spec: { roles: ['admin'] } } },
+  { name: 'deleteUser', method: 'DELETE', args: ['ada/user'], path: '/v1/users/ada%2Fuser' },
+  { name: 'listRoles', method: 'GET', path: '/v1/roles' },
+  { name: 'getRole', method: 'GET', args: ['access/role'], path: '/v1/roles/access%2Frole' },
+  { name: 'upsertRole', method: 'POST', args: [{ metadata: { name: 'access' }, spec: { allow: {} } }], path: '/v1/roles', body: { metadata: { name: 'access' }, spec: { allow: {} } } },
+  { name: 'deleteRole', method: 'DELETE', args: ['access/role'], path: '/v1/roles/access%2Frole' },
+  { name: 'listAccessRequests', method: 'GET', args: [{ state: 'PENDING', user: 'ada' }], path: '/v1/access_requests', query: { state: 'PENDING', user: 'ada' } },
+  { name: 'getAccessRequest', method: 'GET', args: ['req/1'], path: '/v1/access_requests/req%2F1' },
+  { name: 'createAccessRequest', method: 'POST', args: [{ user: 'ada', roles: ['editor'], resourceIds: [{ kind: 'node', name: 'node-1', cluster: 'root' }], reason: 'debug', suggestedReviewers: ['ops'] }], path: '/v1/access_requests', body: { user: 'ada', roles: ['editor'], resource_ids: [{ kind: 'node', name: 'node-1', cluster: 'root' }], request_reason: 'debug', suggested_reviewers: ['ops'] } },
+  { name: 'approveAccessRequest', method: 'POST', args: ['req/1', 'lgtm'], path: '/v1/access_requests/req%2F1/review', body: { state: 'APPROVED', reason: 'lgtm' } },
+  { name: 'denyAccessRequest', method: 'POST', args: ['req/1', 'nope'], path: '/v1/access_requests/req%2F1/review', body: { state: 'DENIED', reason: 'nope' } },
+  { name: 'deleteAccessRequest', method: 'DELETE', args: ['req/1'], path: '/v1/access_requests/req%2F1' },
+  { name: 'listTokens', method: 'GET', path: '/v1/tokens' },
+  { name: 'createToken', method: 'POST', args: [{ roles: ['node'], ttl: '1h', name: 'node-token', allowedCidrs: ['203.0.113.0/24'] }], path: '/v1/tokens', body: { roles: ['node'], ttl: '1h', name: 'node-token', allowed_cidrs: ['203.0.113.0/24'] } },
+  { name: 'deleteToken', method: 'DELETE', args: ['node/token'], path: '/v1/tokens/node%2Ftoken' },
+  { name: 'getAuditEvents', method: 'GET', args: [{ from: '2026-05-01T00:00:00Z', to: '2026-05-15T00:00:00Z', eventType: ['session.start'], pageSize: 100, startKey: 'next', order: 'ASC' }], path: '/v1/events/search', query: { from: '2026-05-01T00:00:00Z', to: '2026-05-15T00:00:00Z', event_type: 'session.start', page_size: '100', start_key: 'next', order: 'ASC' } },
+  { name: 'getSessionRecording', method: 'GET', args: ['session/1'], path: '/v1/sessions/session%2F1/recording' },
+  { name: 'listAuthConnectors', method: 'GET', path: '/v1/auth_connectors' },
+  { name: 'upsertAuthConnector', method: 'POST', args: [{ kind: 'oidc', metadata: { name: 'google' }, spec: { issuer_url: 'https://accounts.example.com' } }], path: '/v1/auth_connectors', body: { kind: 'oidc', metadata: { name: 'google' }, spec: { issuer_url: 'https://accounts.example.com' } } },
+  { name: 'deleteAuthConnector', method: 'DELETE', args: ['oidc', 'google/oidc'], path: '/v1/auth_connectors/oidc/google%2Foidc' },
+];
+
+beforeEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe('TeleportClient', () => {
+  test('throws when baseUrl is missing', () => {
+    expect(() => new TeleportClient({ baseUrl: '', token: 'tok' })).toThrow('Teleport baseUrl is required');
+  });
+
+  test('throws when token is missing', () => {
+    expect(() => new TeleportClient({ baseUrl: 'https://teleport.example.com', token: '' })).toThrow('Teleport token is required');
+  });
+
+  test('strips trailing slash from base URL', () => {
+    const client = new TeleportClient({ baseUrl: 'https://teleport.example.com/', token: 'tok' });
+    expect(client.getBaseUrl()).toBe('https://teleport.example.com');
+  });
+});
+
+describe('Teleport API routes', () => {
+  test('covers every command route and request shape', async () => {
+    expect(routeCases).toHaveLength(33);
+    expect(new Set(routeCases.map((tc) => tc.name)).size).toBe(routeCases.length);
+
+    const api = new Teleport(mockConfig);
+
+    for (const tc of routeCases) {
+      const captured = installFetchMock();
+      const fn = api[tc.name] as (...args: unknown[]) => Promise<unknown>;
+      await fn.call(api, ...(tc.args ?? []));
+      const req = captured[0]!;
+      expect(req.method, tc.name).toBe(tc.method);
+      expect(req.url.origin, tc.name).toBe('https://teleport.example.com');
+      expect(req.url.pathname, tc.name).toBe(tc.path);
+      expect(Object.fromEntries(req.url.searchParams.entries()), tc.name).toEqual(tc.query ?? {});
+      expect(req.headers.get('Authorization'), tc.name).toBe('Bearer tp-tok');
+      expect(req.headers.get('Accept'), tc.name).toBe('application/json');
+      if (tc.body === undefined) {
+        expect(req.headers.get('Content-Type'), tc.name).toBeNull();
+        expect(req.body, tc.name).toBeUndefined();
+      } else {
+        expect(req.headers.get('Content-Type'), tc.name).toBe('application/json');
+        expect(req.body, tc.name).toEqual(tc.body);
+      }
+    }
+  });
+
+  test('getPing hits /v1/webapi/ping with Bearer auth', async () => {
+    const captured = installFetchMock();
+    await new Teleport(mockConfig).getPing();
+    expect(captured[0]!.url.pathname).toBe('/v1/webapi/ping');
+    expect(captured[0]!.headers.get('Authorization')).toBe('Bearer tp-tok');
+  });
+
+  test('approveAccessRequest POSTs review with state=APPROVED', async () => {
+    const captured = installFetchMock();
+    await new Teleport(mockConfig).approveAccessRequest('req-1', 'lgtm');
+    expect(captured[0]!.method).toBe('POST');
+    expect(captured[0]!.url.pathname).toBe('/v1/access_requests/req-1/review');
+    expect(captured[0]!.body).toEqual({ state: 'APPROVED', reason: 'lgtm' });
+  });
+
+  test('non-2xx responses surface Teleport error message', async () => {
+    installFetchMock(Response.json({ message: 'permission denied' }, { status: 403 }));
+    await expect(new Teleport(mockConfig).getPing()).rejects.toThrow('Teleport: permission denied');
+  });
+});
+
+describe('Teleport.fromEnv', () => {
+  const originalBaseUrl = process.env.TELEPORT_BASE_URL;
+  const originalToken = process.env.TELEPORT_TOKEN;
+
+  afterEach(() => {
+    if (originalBaseUrl === undefined) delete process.env.TELEPORT_BASE_URL;
+    else process.env.TELEPORT_BASE_URL = originalBaseUrl;
+    if (originalToken === undefined) delete process.env.TELEPORT_TOKEN;
+    else process.env.TELEPORT_TOKEN = originalToken;
+  });
+
+  test('requires TELEPORT_BASE_URL and TELEPORT_TOKEN', () => {
+    delete process.env.TELEPORT_BASE_URL;
+    delete process.env.TELEPORT_TOKEN;
+    expect(() => Teleport.fromEnv()).toThrow('TELEPORT_BASE_URL and TELEPORT_TOKEN are required');
+  });
+});