@hearth-auth/sdk 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/README.md +680 -0
  3. package/package.json +44 -0
  4. package/src/admin.ts +157 -0
  5. package/src/browser-auth.ts +130 -0
  6. package/src/claims.ts +180 -0
  7. package/src/client.ts +251 -0
  8. package/src/errors.ts +173 -0
  9. package/src/generated/google/api/annotations_pb.ts +44 -0
  10. package/src/generated/google/api/http_pb.ts +467 -0
  11. package/src/generated/hearth/authz/v1/authz_pb.ts +593 -0
  12. package/src/generated/hearth/cluster/v1/raft_pb.ts +183 -0
  13. package/src/generated/hearth/events/v1/audit_pb.ts +886 -0
  14. package/src/generated/hearth/identity/v1/identity_pb.ts +1673 -0
  15. package/src/generated/hearth/identity/v1/oauth_pb.ts +1138 -0
  16. package/src/generated/hearth/rbac/v1/rbac_pb.ts +2000 -0
  17. package/src/hearth-client.ts +288 -0
  18. package/src/hearth.ts +224 -0
  19. package/src/index.ts +106 -0
  20. package/src/introspection-client.ts +83 -0
  21. package/src/jwks-client.ts +45 -0
  22. package/src/middleware.ts +82 -0
  23. package/src/pkce.ts +129 -0
  24. package/src/react.tsx +57 -0
  25. package/src/session-version-cache.ts +167 -0
  26. package/src/types.ts +188 -0
  27. package/tests/admin-crud.test.ts +97 -0
  28. package/tests/auth-flow.test.ts +75 -0
  29. package/tests/authorize.test.ts +386 -0
  30. package/tests/claims.test.ts +159 -0
  31. package/tests/hasPermission.test.ts +152 -0
  32. package/tests/hearth-client.test.ts +243 -0
  33. package/tests/helpers.ts +90 -0
  34. package/tests/jwks.test.ts +62 -0
  35. package/tests/pkce.test.ts +210 -0
  36. package/tests/react-useHasPermission.test.tsx +92 -0
  37. package/tests/required-action.test.ts +276 -0
  38. package/tests/session-version.test.ts +391 -0
  39. package/tsconfig.json +16 -0
  40. package/vitest.config.ts +8 -0
@@ -0,0 +1,467 @@
1
+ // Copyright 2023 Google LLC
2
+ //
3
+ // Licensed under the Apache License, Version 2.0 (the "License");
4
+ // you may not use this file except in compliance with the License.
5
+ // You may obtain a copy of the License at
6
+ //
7
+ // http://www.apache.org/licenses/LICENSE-2.0
8
+ //
9
+ // Unless required by applicable law or agreed to in writing, software
10
+ // distributed under the License is distributed on an "AS IS" BASIS,
11
+ // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+ // See the License for the specific language governing permissions and
13
+ // limitations under the License.
14
+
15
+ // Vendored from github.com/googleapis/googleapis (Apache-2.0).
16
+ // See annotations.proto for the rationale.
17
+
18
+ // @generated by protoc-gen-es v2.12.0 with parameter "target=ts"
19
+ // @generated from file google/api/http.proto (package google.api, syntax proto3)
20
+ /* eslint-disable */
21
+
22
+ import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
23
+ import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
24
+ import type { Message } from "@bufbuild/protobuf";
25
+
26
+ /**
27
+ * Describes the file google/api/http.proto.
28
+ */
29
+ export const file_google_api_http: GenFile = /*@__PURE__*/
30
+ fileDesc("ChVnb29nbGUvYXBpL2h0dHAucHJvdG8SCmdvb2dsZS5hcGkiVAoESHR0cBIjCgVydWxlcxgBIAMoCzIULmdvb2dsZS5hcGkuSHR0cFJ1bGUSJwofZnVsbHlfZGVjb2RlX3Jlc2VydmVkX2V4cGFuc2lvbhgCIAEoCCKBAgoISHR0cFJ1bGUSEAoIc2VsZWN0b3IYASABKAkSDQoDZ2V0GAIgASgJSAASDQoDcHV0GAMgASgJSAASDgoEcG9zdBgEIAEoCUgAEhAKBmRlbGV0ZRgFIAEoCUgAEg8KBXBhdGNoGAYgASgJSAASLwoGY3VzdG9tGAggASgLMh0uZ29vZ2xlLmFwaS5DdXN0b21IdHRwUGF0dGVybkgAEgwKBGJvZHkYByABKAkSFQoNcmVzcG9uc2VfYm9keRgMIAEoCRIxChNhZGRpdGlvbmFsX2JpbmRpbmdzGAsgAygLMhQuZ29vZ2xlLmFwaS5IdHRwUnVsZUIJCgdwYXR0ZXJuIi8KEUN1c3RvbUh0dHBQYXR0ZXJuEgwKBGtpbmQYASABKAkSDAoEcGF0aBgCIAEoCUJqCg5jb20uZ29vZ2xlLmFwaUIJSHR0cFByb3RvUAFaQWdvb2dsZS5nb2xhbmcub3JnL2dlbnByb3RvL2dvb2dsZWFwaXMvYXBpL2Fubm90YXRpb25zO2Fubm90YXRpb25z+AEBogIER0FQSWIGcHJvdG8z");
31
+
32
+ /**
33
+ * Defines the HTTP configuration for an API service. It contains a list of
34
+ * [HttpRule][google.api.HttpRule], each specifying the mapping of an RPC method
35
+ * to one or more HTTP REST API methods.
36
+ *
37
+ * @generated from message google.api.Http
38
+ */
39
+ export type Http = Message<"google.api.Http"> & {
40
+ /**
41
+ * A list of HTTP configuration rules that apply to individual API methods.
42
+ *
43
+ * **NOTE:** All service configuration rules follow "last one wins" order.
44
+ *
45
+ * @generated from field: repeated google.api.HttpRule rules = 1;
46
+ */
47
+ rules: HttpRule[];
48
+
49
+ /**
50
+ * When set to true, URL path parameters will be fully URI-decoded except in
51
+ * cases of single segment matches in reserved expansion, where "%2F" will be
52
+ * left encoded.
53
+ *
54
+ * The default behavior is to not decode RFC 6570 reserved characters in multi
55
+ * segment matches.
56
+ *
57
+ * @generated from field: bool fully_decode_reserved_expansion = 2;
58
+ */
59
+ fullyDecodeReservedExpansion: boolean;
60
+ };
61
+
62
+ /**
63
+ * Describes the message google.api.Http.
64
+ * Use `create(HttpSchema)` to create a new message.
65
+ */
66
+ export const HttpSchema: GenMessage<Http> = /*@__PURE__*/
67
+ messageDesc(file_google_api_http, 0);
68
+
69
+ /**
70
+ * # gRPC Transcoding
71
+ *
72
+ * gRPC Transcoding is a feature for mapping between a gRPC method and one or
73
+ * more HTTP REST endpoints. It allows developers to build a single API service
74
+ * that supports both gRPC APIs and REST APIs. Many systems, including [Google
75
+ * APIs](https://github.com/googleapis/googleapis),
76
+ * [Cloud Endpoints](https://cloud.google.com/endpoints), [gRPC
77
+ * Gateway](https://github.com/grpc-ecosystem/grpc-gateway),
78
+ * and [Envoy](https://github.com/envoyproxy/envoy) proxy support this feature
79
+ * and allow the gRPC/REST surface to be defined with a separate configuration
80
+ * file, an [OpenAPI spec](https://openapi.org/specification/) or a set of HTTP
81
+ * annotations on the gRPC service.
82
+ *
83
+ * The `HttpRule` defines the schema of the gRPC/REST mapping. The mapping
84
+ * specifies how different portions of the gRPC request message are mapped to
85
+ * the URL path, URL query parameters, and HTTP request body. It also controls
86
+ * how the gRPC response message is mapped to the HTTP response body. `HttpRule`
87
+ * is typically specified as an `google.api.http` annotation on the gRPC method.
88
+ *
89
+ * Each mapping specifies a URL path template and an HTTP method. The path
90
+ * template may refer to one or more fields in the gRPC request message, as long
91
+ * as each field is a non-repeated primitive with no nesting. The path template
92
+ * controls how fields of the request message are mapped to the URL path.
93
+ *
94
+ * Example:
95
+ *
96
+ * service Messaging {
97
+ * rpc GetMessage(GetMessageRequest) returns (Message) {
98
+ * option (google.api.http) = {
99
+ * get: "/v1/{name=messages/*}"
100
+ * };
101
+ * }
102
+ * }
103
+ * message GetMessageRequest {
104
+ * string name = 1; // Mapped to URL path.
105
+ * }
106
+ * message Message {
107
+ * string text = 1; // The resource content.
108
+ * }
109
+ *
110
+ * This enables an HTTP REST to gRPC mapping as below:
111
+ *
112
+ * HTTP | gRPC
113
+ * -----|-----
114
+ * `GET /v1/messages/123456` | `GetMessage(name: "messages/123456")`
115
+ *
116
+ * Any fields in the request message which are not bound by the path template
117
+ * automatically become HTTP query parameters if there is no HTTP request body.
118
+ * For example:
119
+ *
120
+ * service Messaging {
121
+ * rpc ListMessages(ListMessagesRequest) returns (ListMessagesResponse) {
122
+ * option (google.api.http) = {
123
+ * get: "/v1/messages"
124
+ * };
125
+ * }
126
+ * }
127
+ * message ListMessagesRequest {
128
+ * string user_id = 1;
129
+ * int64 page_size = 2;
130
+ * string page_token = 3;
131
+ * }
132
+ *
133
+ * This enables a HTTP JSON to RPC mapping as below:
134
+ *
135
+ * HTTP | gRPC
136
+ * -----|-----
137
+ * `GET /v1/messages?user_id=123456&page_size=50&page_token=abc` |
138
+ * `ListMessages(user_id: "123456", page_size: 50, page_token: "abc")`
139
+ *
140
+ * The HTTP verb may also be specified independently of the URL path and query
141
+ * parameters. For example, a request message with a field called `body`:
142
+ *
143
+ * service Messaging {
144
+ * rpc UpdateMessage(UpdateMessageRequest) returns (Message) {
145
+ * option (google.api.http) = {
146
+ * patch: "/v1/messages/{message_id}"
147
+ * body: "message"
148
+ * };
149
+ * }
150
+ * }
151
+ * message UpdateMessageRequest {
152
+ * string message_id = 1; // mapped to the URL
153
+ * Message message = 2; // mapped to the body
154
+ * }
155
+ *
156
+ *
157
+ * The following HTTP JSON to RPC mapping is enabled, where the representation
158
+ * of the JSON in the request body is determined by protos JSON encoding:
159
+ *
160
+ * HTTP | gRPC
161
+ * -----|-----
162
+ * `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id:
163
+ * "123456" message { text: "Hi!" })`
164
+ *
165
+ * The special name `*` can be used in the body mapping to define that every
166
+ * field not bound by the path template should be mapped to the request body.
167
+ * This enables the following alternative definition of the update method:
168
+ *
169
+ * service Messaging {
170
+ * rpc UpdateMessage(UpdateMessageRequest) returns (Message) {
171
+ * option (google.api.http) = {
172
+ * patch: "/v1/messages/{message_id}"
173
+ * body: "*"
174
+ * };
175
+ * }
176
+ * }
177
+ * message UpdateMessageRequest {
178
+ * string message_id = 1;
179
+ * string text = 2;
180
+ * }
181
+ *
182
+ *
183
+ * The following HTTP JSON to RPC mapping is enabled:
184
+ *
185
+ * HTTP | gRPC
186
+ * -----|-----
187
+ * `PATCH /v1/messages/123456 { "text": "Hi!" }` | `UpdateMessage(message_id:
188
+ * "123456" text: "Hi!")`
189
+ *
190
+ * Note that when using `*` in the body mapping, it is not possible to have
191
+ * HTTP parameters, as all fields not bound by the path end in the body. This
192
+ * makes this option more rarely used in practice when defining REST APIs. The
193
+ * common usage of `*` is in custom methods which don't use the URL at all for
194
+ * transferring data.
195
+ *
196
+ * It is possible to define multiple HTTP methods for one RPC by using the
197
+ * `additional_bindings` option. Example:
198
+ *
199
+ * service Messaging {
200
+ * rpc GetMessage(GetMessageRequest) returns (Message) {
201
+ * option (google.api.http) = {
202
+ * get: "/v1/messages/{message_id}"
203
+ * additional_bindings {
204
+ * get: "/v1/users/{user_id}/messages/{message_id}"
205
+ * }
206
+ * };
207
+ * }
208
+ * }
209
+ * message GetMessageRequest {
210
+ * string message_id = 1;
211
+ * string user_id = 2;
212
+ * }
213
+ *
214
+ * This enables the following two alternative HTTP JSON to RPC mappings:
215
+ *
216
+ * HTTP | gRPC
217
+ * -----|-----
218
+ * `GET /v1/messages/123456` | `GetMessage(message_id: "123456")`
219
+ * `GET /v1/users/me/messages/123456` | `GetMessage(user_id: "me" message_id:
220
+ * "123456")`
221
+ *
222
+ * ## Rules for HTTP mapping
223
+ *
224
+ * 1. Leaf request fields (recursive expansion nested messages in the request
225
+ * message) are classified into three categories:
226
+ * - Fields referred by the URL path template. They are passed via the URL
227
+ * path.
228
+ * - Fields referred by the [HttpRule.body][google.api.HttpRule.body]. They
229
+ * are passed via the HTTP request body.
230
+ * - All other fields are passed via the URL query parameters, and the
231
+ * parameter name is the field path in the request message. A repeated
232
+ * field can be represented as multiple query parameters under the same
233
+ * name.
234
+ * 2. If [HttpRule.body][google.api.HttpRule.body] is "*", there is no URL
235
+ * query parameter, all fields are passed via URL path and HTTP request
236
+ * body.
237
+ * 3. If [HttpRule.body][google.api.HttpRule.body] is omitted, there is no HTTP
238
+ * request body, all fields are passed via URL path and URL query
239
+ * parameters.
240
+ *
241
+ * ### Path template syntax
242
+ *
243
+ * Template = "/" Segments [ Verb ] ;
244
+ * Segments = Segment { "/" Segment } ;
245
+ * Segment = "*" | "**" | LITERAL | Variable ;
246
+ * Variable = "{" FieldPath [ "=" Segments ] "}" ;
247
+ * FieldPath = IDENT { "." IDENT } ;
248
+ * Verb = ":" LITERAL ;
249
+ *
250
+ * The syntax `*` matches a single URL path segment. The syntax `**` matches
251
+ * zero or more URL path segments, which must be the last part of the URL path
252
+ * except the `Verb`.
253
+ *
254
+ * The syntax `Variable` matches part of the URL path as specified by its
255
+ * template. A variable template must not contain other variables. If a variable
256
+ * matches a single path segment, its template may be omitted, e.g. `{var}`
257
+ * is equivalent to `{var=*}`.
258
+ *
259
+ * The syntax `LITERAL` matches literal text in the URL path. If the `LITERAL`
260
+ * contains any reserved character, such characters should be percent-encoded
261
+ * before the matching.
262
+ *
263
+ * If a variable contains exactly one path segment, such as `"{var}"` or
264
+ * `"{var=*}"`, when such a variable is expanded into a URL path on the client
265
+ * side, all characters except `[-_.~0-9a-zA-Z]` are percent-encoded. The
266
+ * server side does the reverse decoding. Such variables show up in the
267
+ * [Discovery
268
+ * Document](https://developers.google.com/discovery/v1/reference/apis) as
269
+ * `{var}`.
270
+ *
271
+ * If a variable contains multiple path segments, such as `"{var=foo/*}"` or
272
+ * `"{var=**}"`, when such a variable is expanded into a URL path on the client
273
+ * side, all characters except `[-_.~/0-9a-zA-Z]` are percent-encoded. The
274
+ * server side does the reverse decoding, except "%2F" and "%2f" are left
275
+ * unchanged. Such variables show up in the
276
+ * [Discovery
277
+ * Document](https://developers.google.com/discovery/v1/reference/apis) as
278
+ * `{+var}`.
279
+ *
280
+ * ## Using gRPC API Service Configuration
281
+ *
282
+ * gRPC API Service Configuration (service config) is a configuration language
283
+ * for configuring a gRPC service to become a user-facing product. The
284
+ * service config is simply the YAML representation of the `google.api.Service`
285
+ * proto message.
286
+ *
287
+ * As an alternative to annotating your proto file, you can configure gRPC
288
+ * transcoding in your service config YAML files. You do this by specifying a
289
+ * `HttpRule` that maps the gRPC method to a REST endpoint, achieving the same
290
+ * effect as the proto annotation. This can be particularly useful if you
291
+ * have a proto that is reused in multiple services. Note that any transcoding
292
+ * specified in the service config will override any matching transcoding
293
+ * configuration in the proto.
294
+ *
295
+ * Example:
296
+ *
297
+ * http:
298
+ * rules:
299
+ * # Selects a gRPC method and applies HttpRule to it.
300
+ * - selector: example.v1.Messaging.GetMessage
301
+ * get: /v1/messages/{message_id}/{sub.subfield}
302
+ *
303
+ * ## Special notes
304
+ *
305
+ * When gRPC Transcoding is used to map a gRPC to JSON REST endpoints, the
306
+ * proto-to-JSON conversion must follow the [proto3
307
+ * specification](https://developers.google.com/protocol-buffers/docs/proto3#json).
308
+ *
309
+ * While the single segment variable follows the proto-to-JSON conversion,
310
+ * the multi segment variable does not follow the standard proto-to-JSON
311
+ * conversion. The reason is that the multi segment variable cannot be mapped to
312
+ * a URL path, and the multi segment variable is a URL path itself.
313
+ *
314
+ * The following variables show up in the Discovery Document as `{+var}`:
315
+ *
316
+ * * `{var}` without a template
317
+ * * `{var=*}` (single segment)
318
+ * * `{var=**}` (multi segment, URL path)
319
+ * * `{var=foo/*}` (URL path prefix)
320
+ * * `{var=**\/bar}` (URL path suffix)
321
+ *
322
+ * Variables with templates other than the above do not appear in the Discovery
323
+ * Document.
324
+ *
325
+ * @generated from message google.api.HttpRule
326
+ */
327
+ export type HttpRule = Message<"google.api.HttpRule"> & {
328
+ /**
329
+ * Selects a method to which this rule applies.
330
+ *
331
+ * Refer to [selector][google.api.DocumentationRule.selector] for syntax
332
+ * details.
333
+ *
334
+ * @generated from field: string selector = 1;
335
+ */
336
+ selector: string;
337
+
338
+ /**
339
+ * Determines the URL pattern is matched by this rules. This pattern can be
340
+ * used with any of the {get|put|post|delete|patch} methods. A custom method
341
+ * can be defined using the 'custom' field.
342
+ *
343
+ * @generated from oneof google.api.HttpRule.pattern
344
+ */
345
+ pattern: {
346
+ /**
347
+ * Maps to HTTP GET. Used for listing and getting information about
348
+ * resources.
349
+ *
350
+ * @generated from field: string get = 2;
351
+ */
352
+ value: string;
353
+ case: "get";
354
+ } | {
355
+ /**
356
+ * Maps to HTTP PUT. Used for replacing a resource.
357
+ *
358
+ * @generated from field: string put = 3;
359
+ */
360
+ value: string;
361
+ case: "put";
362
+ } | {
363
+ /**
364
+ * Maps to HTTP POST. Used for creating a resource or performing an action.
365
+ *
366
+ * @generated from field: string post = 4;
367
+ */
368
+ value: string;
369
+ case: "post";
370
+ } | {
371
+ /**
372
+ * Maps to HTTP DELETE. Used for deleting a resource.
373
+ *
374
+ * @generated from field: string delete = 5;
375
+ */
376
+ value: string;
377
+ case: "delete";
378
+ } | {
379
+ /**
380
+ * Maps to HTTP PATCH. Used for updating a resource.
381
+ *
382
+ * @generated from field: string patch = 6;
383
+ */
384
+ value: string;
385
+ case: "patch";
386
+ } | {
387
+ /**
388
+ * The custom pattern is used for specifying an HTTP method that is not
389
+ * included in the `pattern` field, such as HEAD, or "*" to leave the
390
+ * HTTP method unspecified for this rule. The wild-card rule is useful
391
+ * for services that provide content to Web (HTML) clients.
392
+ *
393
+ * @generated from field: google.api.CustomHttpPattern custom = 8;
394
+ */
395
+ value: CustomHttpPattern;
396
+ case: "custom";
397
+ } | { case: undefined; value?: undefined };
398
+
399
+ /**
400
+ * The name of the request field whose value is mapped to the HTTP request
401
+ * body, or `*` for mapping all request fields not captured by the path
402
+ * pattern to the HTTP body, or omitted for not having any HTTP request body.
403
+ *
404
+ * NOTE: the referred field must be present at the top-level of the request
405
+ * message type.
406
+ *
407
+ * @generated from field: string body = 7;
408
+ */
409
+ body: string;
410
+
411
+ /**
412
+ * Optional. The name of the response field whose value is mapped to the HTTP
413
+ * response body. When omitted, the entire response message will be used
414
+ * as the HTTP response body.
415
+ *
416
+ * NOTE: The referred field must be present at the top-level of the response
417
+ * message type.
418
+ *
419
+ * @generated from field: string response_body = 12;
420
+ */
421
+ responseBody: string;
422
+
423
+ /**
424
+ * Additional HTTP bindings for the selector. Nested bindings must
425
+ * not contain an `additional_bindings` field themselves (that is,
426
+ * the nesting may only be one level deep).
427
+ *
428
+ * @generated from field: repeated google.api.HttpRule additional_bindings = 11;
429
+ */
430
+ additionalBindings: HttpRule[];
431
+ };
432
+
433
+ /**
434
+ * Describes the message google.api.HttpRule.
435
+ * Use `create(HttpRuleSchema)` to create a new message.
436
+ */
437
+ export const HttpRuleSchema: GenMessage<HttpRule> = /*@__PURE__*/
438
+ messageDesc(file_google_api_http, 1);
439
+
440
+ /**
441
+ * A custom pattern is used for defining custom HTTP verb.
442
+ *
443
+ * @generated from message google.api.CustomHttpPattern
444
+ */
445
+ export type CustomHttpPattern = Message<"google.api.CustomHttpPattern"> & {
446
+ /**
447
+ * The name of this custom HTTP verb.
448
+ *
449
+ * @generated from field: string kind = 1;
450
+ */
451
+ kind: string;
452
+
453
+ /**
454
+ * The path matched by this custom verb.
455
+ *
456
+ * @generated from field: string path = 2;
457
+ */
458
+ path: string;
459
+ };
460
+
461
+ /**
462
+ * Describes the message google.api.CustomHttpPattern.
463
+ * Use `create(CustomHttpPatternSchema)` to create a new message.
464
+ */
465
+ export const CustomHttpPatternSchema: GenMessage<CustomHttpPattern> = /*@__PURE__*/
466
+ messageDesc(file_google_api_http, 2);
467
+