@internetdata/internetdata 2.1.0 → 2.2.1

package/dist/generated/types.gen.d.ts

@@ -14,21 +14,21 @@ export type Error = {
  */
 export type DatabaseFormat = 'csvgz' | 'mmdb';
 /**
- * Where your licence for a database family stands today. `licensed` is a
+ * Where your license for a database family stands today. `licensed` is a
  * live grant, `expired` one whose term has ended, and `unlicensed` a
  * database published but never bought.
  *
  */
 export type Standing = 'licensed' | 'expired' | 'unlicensed';
 /**
- * One database FAMILY, with your organization's licence beside it. A
- * licence covers the family, while a download names a specific version,
+ * One database FAMILY, with your organization's license beside it. A
+ * license covers the family, while a download names a specific version,
  * so the ids passed to `download` and `checksum` come from `versions`.
  *
  */
 export type Database = {
     /**
-     * The family, e.g. `vpn_ip`. What a licence is held against.
+     * The family, e.g. `vpn_ip`. What a license is held against.
      */
     base: string;
     name: string;
@@ -38,18 +38,18 @@ export type Database = {
     summary: string;
     standing: Standing;
     /**
-     * What your licence permits you to do with the data. Null when there
-     * is no licence, which is every family with standing `unlicensed`.
+     * What your license permits you to do with the data. Null when there
+     * is no license, which is every family with standing `unlicensed`.
      *
      */
     license_type: 'evaluation' | 'standard' | 'redistribute' | null;
     starts: string | null;
     /**
-     * A hard stop. Null when the licence has no end date, which is the normal case for a rolling agreement, and when there is no licence. A rolling licence reports its turnover date in renews_at instead.
+     * A hard stop. Null when the license has no end date, which is the normal case for a rolling agreement, and when there is no license. A rolling license reports its turnover date in renews_at instead.
      */
     expires: string | null;
     /**
-     * When a rolling licence next renews. Null when the licence has no defined term, when expires sets a hard stop instead, and when there is no licence.
+     * When a rolling license next renews. Null when the license has no defined term, when expires sets a hard stop instead, and when there is no license.
      */
     renews_at: string | null;
     /**
@@ -208,6 +208,227 @@ export type DbUnauthorizedIdError = {
 export type DbNotFoundError = {
     rc: 'DB_NOT_FOUND';
 };
+export type AccountRc = {
+    /**
+     * The outcome. `SUCCESS` on success; otherwise the reason.
+     */
+    rc: string;
+};
+export type Identity = {
+    rc: string;
+    user: AccountUser;
+    org: AccountOrgRef;
+    /**
+     * What this credential may do right now.
+     */
+    scopes: Array<string>;
+};
+export type AccountUser = {
+    id: string;
+    fullname?: string;
+    email?: string;
+};
+export type AccountOrgRef = {
+    id: string;
+};
+export type AccountOrgWrap = {
+    rc: string;
+    org: AccountOrg;
+};
+export type AccountOrg = {
+    id: string;
+    name?: string;
+    created?: string | null;
+};
+export type ApikeyList = {
+    rc: string;
+    keys: Array<ApikeyDetail>;
+};
+/**
+ * Key METADATA. Never the key itself.
+ */
+export type ApikeyDetail = {
+    id: string;
+    name: string;
+    /**
+     * The leading, non-secret part, so a key is recognisable without storing it.
+     */
+    key_prefix: string;
+    created: string;
+    expires?: string | null;
+    last_used_at?: string | null;
+    revoked_at?: string | null;
+    /**
+     * Source-IP allowlist. EMPTY MEANS UNRESTRICTED, not deny-all.
+     */
+    allowed_cidrs?: Array<string>;
+    allowed_scopes?: Array<string>;
+    /**
+     * Whether this key's secret can still be read back. False permanently for a key issued before secrets were stored recoverably.
+     */
+    retrievable?: boolean;
+};
+export type AccountCreateApikeyRequest = {
+    /**
+     * A label you will recognise later. Shown wherever the key is listed.
+     */
+    name: string;
+    /**
+     * What the new key may do. Omit for a key that carries no named scope, which is the safe default.
+     */
+    allowed_scopes?: Array<string>;
+};
+export type AccountCreatedApikey = {
+    rc: string;
+    id: string;
+    name?: string;
+    /**
+     * The secret. Returned once, here, and never again.
+     */
+    key: string;
+    key_prefix?: string;
+    allowed_cidrs?: Array<string>;
+    allowed_scopes?: Array<string>;
+};
+export type AccountRevealedApikey = {
+    rc: string;
+    /**
+     * The secret.
+     */
+    key: string;
+};
+export type OauthMetadata = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    device_authorization_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: Array<string>;
+    response_types_supported?: Array<string>;
+    grant_types_supported?: Array<string>;
+    code_challenge_methods_supported?: Array<string>;
+    /**
+     * Always `none`. Every client is public and has no secret.
+     */
+    token_endpoint_auth_methods_supported?: Array<string>;
+    /**
+     * RFC 9207. A redirect back from the authorization endpoint carries `iss`.
+     */
+    authorization_response_iss_parameter_supported?: boolean;
+    service_documentation?: string;
+};
+export type DeviceAuthorizationRequest = {
+    client_id: string;
+    /**
+     * Space-delimited. Anything your client is not registered for is dropped rather than refused.
+     */
+    scope?: string;
+    /**
+     * RFC 8707: what the token is for.
+     */
+    resource?: string;
+};
+export type DeviceAuthorization = {
+    /**
+     * Yours. Poll with it; never show it to anyone.
+     */
+    device_code: string;
+    /**
+     * Short and typable. This is what the person confirms.
+     */
+    user_code: string;
+    verification_uri: string;
+    /**
+     * The same page with the code already filled in.
+     */
+    verification_uri_complete?: string;
+    /**
+     * Seconds until both codes expire.
+     */
+    expires_in: number;
+    /**
+     * Seconds between polls.
+     */
+    interval: number;
+};
+export type TokenRequest = {
+    /**
+     * `urn:ietf:params:oauth:grant-type:device_code`, `authorization_code` or `refresh_token`.
+     */
+    grant_type: string;
+    client_id: string;
+    /**
+     * Required by the device code grant.
+     */
+    device_code?: string;
+    /**
+     * Required by the authorization code grant.
+     */
+    code?: string;
+    /**
+     * Required by the authorization code grant.
+     */
+    code_verifier?: string;
+    /**
+     * Authorization code grant: the `redirect_uri` the code was issued against, exactly.
+     */
+    redirect_uri?: string;
+    /**
+     * Required by the refresh token grant.
+     */
+    refresh_token?: string;
+};
+export type TokenResponse = {
+    access_token: string;
+    /**
+     * Always `Bearer`.
+     */
+    token_type: string;
+    /**
+     * Seconds until the access token expires.
+     */
+    expires_in: number;
+    /**
+     * Always returned. A refresh consumes the token it presents, so keep this one.
+     */
+    refresh_token?: string;
+    /**
+     * What was actually granted, which may be narrower than what was asked for.
+     */
+    scope?: string;
+    /**
+     * Not part of OAuth. The ID of the API key the person picked when they
+     * approved, returned by every grant while this authorization may still
+     * read that key back. Absent when no key was picked, or when the
+     * person's role no longer allows reading keys back.
+     *
+     */
+    'mslm:apikey_id'?: string;
+    /**
+     * Not part of OAuth. The API key itself, so a device ends up holding an
+     * ordinary key. Returned by the device code and authorization code
+     * grants only, never by a refresh, and only alongside
+     * `mslm:apikey_id`. Absent when that key's secret cannot be read back,
+     * which is the case for a key created before keys could be shown again
+     * in the console; a rotated key can be.
+     *
+     */
+    'mslm:apikey'?: string;
+};
+export type RevokeRequest = {
+    /**
+     * An access token or a refresh token.
+     */
+    token: string;
+    /**
+     * Accepted and not checked.
+     */
+    client_id?: string;
+};
+export type OauthError = {
+    error: string;
+    error_description?: string;
+};
 /**
  * Database identifier (e.g. `vpn_ip_v1`, `resproxy_provider_v1`).
  */
@@ -216,6 +437,10 @@ export type DbId = string;
  * Database file format.
  */
 export type DbFormat = DatabaseFormat;
+/**
+ * The key's id, as returned by the list endpoint. Never the key itself.
+ */
+export type ApikeyIdParam = string;
 export type ListDatabasesData = {
     body?: never;
     path?: never;
@@ -269,7 +494,7 @@ export type DownloadDatabaseV2Errors = {
      */
     401: Error;
     /**
-     * Your organization holds no licence for this database, or its term has
+     * Your organization holds no license for this database, or its term has
      * ended.
      * `rc`: `NOT_LICENSED`, `LICENSE_EXPIRED`.
      *
@@ -309,7 +534,7 @@ export type DatabaseMetadataV2Errors = {
      */
     401: Error;
     /**
-     * Your organization holds no licence for this database, or its term has
+     * Your organization holds no license for this database, or its term has
      * ended.
      * `rc`: `NOT_LICENSED`, `LICENSE_EXPIRED`.
      *
@@ -364,7 +589,7 @@ export type DatabaseChecksumV2Errors = {
      */
     401: Error;
     /**
-     * Your organization holds no licence for this database, or its term has
+     * Your organization holds no license for this database, or its term has
      * ended.
      * `rc`: `NOT_LICENSED`, `LICENSE_EXPIRED`.
      *
@@ -550,3 +775,360 @@ export type DatabaseMetadataResponses = {
     200: DbMetadataSuccessResponse;
 };
 export type DatabaseMetadataResponse = DatabaseMetadataResponses[keyof DatabaseMetadataResponses];
+export type AccountIdentityData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/identity';
+};
+export type AccountIdentityErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountIdentityError = AccountIdentityErrors[keyof AccountIdentityErrors];
+export type AccountIdentityResponses = {
+    /**
+     * The caller.
+     */
+    200: Identity;
+};
+export type AccountIdentityResponse = AccountIdentityResponses[keyof AccountIdentityResponses];
+export type AccountOrgData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/org';
+};
+export type AccountOrgErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountOrgError = AccountOrgErrors[keyof AccountOrgErrors];
+export type AccountOrgResponses = {
+    /**
+     * The organization.
+     */
+    200: AccountOrgWrap;
+};
+export type AccountOrgResponse = AccountOrgResponses[keyof AccountOrgResponses];
+export type AccountOrgMembersData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/org/members';
+};
+export type AccountOrgMembersErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountOrgMembersError = AccountOrgMembersErrors[keyof AccountOrgMembersErrors];
+export type AccountOrgMembersResponses = {
+    /**
+     * The members.
+     */
+    200: AccountRc;
+};
+export type AccountOrgMembersResponse = AccountOrgMembersResponses[keyof AccountOrgMembersResponses];
+export type AccountListApikeysData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/apikeys';
+};
+export type AccountListApikeysErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountListApikeysError = AccountListApikeysErrors[keyof AccountListApikeysErrors];
+export type AccountListApikeysResponses = {
+    /**
+     * The organization's keys, newest first.
+     */
+    200: ApikeyList;
+};
+export type AccountListApikeysResponse = AccountListApikeysResponses[keyof AccountListApikeysResponses];
+export type AccountCreateApikeyData = {
+    body: AccountCreateApikeyRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/apikeys';
+};
+export type AccountCreateApikeyErrors = {
+    /**
+     * The request body is missing a required field.
+     */
+    400: AccountRc;
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountCreateApikeyError = AccountCreateApikeyErrors[keyof AccountCreateApikeyErrors];
+export type AccountCreateApikeyResponses = {
+    /**
+     * The new key, including its secret.
+     */
+    200: AccountCreatedApikey;
+};
+export type AccountCreateApikeyResponse = AccountCreateApikeyResponses[keyof AccountCreateApikeyResponses];
+export type AccountRotateApikeyData = {
+    body?: never;
+    path: {
+        /**
+         * The key's id, as returned by the list endpoint. Never the key itself.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/iam/apikeys/{id}/rotate';
+};
+export type AccountRotateApikeyErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+    /**
+     * No such key in this organization.
+     */
+    404: AccountRc;
+};
+export type AccountRotateApikeyError = AccountRotateApikeyErrors[keyof AccountRotateApikeyErrors];
+export type AccountRotateApikeyResponses = {
+    /**
+     * The key, with its new secret.
+     */
+    200: AccountCreatedApikey;
+};
+export type AccountRotateApikeyResponse = AccountRotateApikeyResponses[keyof AccountRotateApikeyResponses];
+export type AccountRevokeApikeyData = {
+    body?: never;
+    path: {
+        /**
+         * The key's id, as returned by the list endpoint. Never the key itself.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/iam/apikeys/{id}/revoke';
+};
+export type AccountRevokeApikeyErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+    /**
+     * No such key in this organization.
+     */
+    404: AccountRc;
+};
+export type AccountRevokeApikeyError = AccountRevokeApikeyErrors[keyof AccountRevokeApikeyErrors];
+export type AccountRevokeApikeyResponses = {
+    /**
+     * Revoked.
+     */
+    200: AccountRc;
+};
+export type AccountRevokeApikeyResponse = AccountRevokeApikeyResponses[keyof AccountRevokeApikeyResponses];
+export type AccountRevealApikeyData = {
+    body?: never;
+    path: {
+        /**
+         * The key's id, as returned by the list endpoint. Never the key itself.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/iam/apikeys/{id}/reveal';
+};
+export type AccountRevealApikeyErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+    /**
+     * No such key in this organization, or its secret was never stored
+     * recoverably (`NOT_RETRIEVABLE`).
+     *
+     */
+    404: AccountRc;
+};
+export type AccountRevealApikeyError = AccountRevealApikeyErrors[keyof AccountRevealApikeyErrors];
+export type AccountRevealApikeyResponses = {
+    /**
+     * The key's secret.
+     */
+    200: AccountRevealedApikey;
+};
+export type AccountRevealApikeyResponse = AccountRevealApikeyResponses[keyof AccountRevealApikeyResponses];
+export type OauthMetadataData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/.well-known/oauth-authorization-server';
+};
+export type OauthMetadataResponses = {
+    /**
+     * The server's metadata.
+     */
+    200: OauthMetadata;
+};
+export type OauthMetadataResponse = OauthMetadataResponses[keyof OauthMetadataResponses];
+export type OauthDeviceAuthorizationData = {
+    body: DeviceAuthorizationRequest;
+    path?: never;
+    query?: never;
+    url: '/oauth/device_authorization';
+};
+export type OauthDeviceAuthorizationErrors = {
+    /**
+     * `invalid_request`, `unauthorized_client` when the client may not use
+     * the device flow, or `slow_down` when this address has started too
+     * many authorizations.
+     *
+     */
+    400: OauthError;
+    /**
+     * `invalid_client`: the `client_id` is not registered.
+     */
+    401: OauthError;
+};
+export type OauthDeviceAuthorizationError = OauthDeviceAuthorizationErrors[keyof OauthDeviceAuthorizationErrors];
+export type OauthDeviceAuthorizationResponses = {
+    /**
+     * A pending device authorization.
+     */
+    200: DeviceAuthorization;
+};
+export type OauthDeviceAuthorizationResponse = OauthDeviceAuthorizationResponses[keyof OauthDeviceAuthorizationResponses];
+export type OauthAuthorizeData = {
+    body?: never;
+    path?: never;
+    query: {
+        client_id: string;
+        redirect_uri: string;
+        response_type: 'code';
+        code_challenge: string;
+        /**
+         * S256 only. `plain` is refused rather than downgraded.
+         */
+        code_challenge_method?: 'S256';
+        scope?: string;
+        /**
+         * Returned unchanged. Use it to bind the response to your request.
+         */
+        state?: string;
+        /**
+         * RFC 8707. What the token is FOR, so it cannot be replayed elsewhere.
+         */
+        resource?: string;
+    };
+    url: '/oauth/authorize';
+};
+export type OauthAuthorizeErrors = {
+    /**
+     * Shown to the user. An unverified redirect target is never sent an error.
+     */
+    400: unknown;
+};
+export type OauthTokenData = {
+    body: TokenRequest;
+    path?: never;
+    query?: never;
+    url: '/oauth/token';
+};
+export type OauthTokenErrors = {
+    /**
+     * An RFC 6749 error. `authorization_pending` and `slow_down` are
+     * normal answers while polling a device authorization, not failures.
+     * `access_denied` means the person refused, and `expired_token` that
+     * the device code is no longer valid: it expired, or it was already
+     * exchanged or refused. `invalid_grant` means the code, device code or
+     * refresh token is not valid for this `client_id`. `slow_down` also
+     * answers any grant when this address sends too many requests.
+     *
+     */
+    400: OauthError;
+    /**
+     * `invalid_client`: the `client_id` is not registered.
+     */
+    401: OauthError;
+};
+export type OauthTokenError = OauthTokenErrors[keyof OauthTokenErrors];
+export type OauthTokenResponses = {
+    /**
+     * Tokens.
+     */
+    200: TokenResponse;
+};
+export type OauthTokenResponse = OauthTokenResponses[keyof OauthTokenResponses];
+export type OauthRevokeData = {
+    body: RevokeRequest;
+    path?: never;
+    query?: never;
+    url: '/oauth/revoke';
+};
+export type OauthRevokeResponses = {
+    /**
+     * Always, whatever was presented.
+     */
+    200: {
+        [key: string]: unknown;
+    };
+};
+export type OauthRevokeResponse = OauthRevokeResponses[keyof OauthRevokeResponses];

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { InternetData, DatabaseApi, DEFAULT_BASE_URL } from './client.js';
 export type { DownloadDestination, DownloadsOptions, Options } from './client.js';
-export { InternetDataError } from './errors.js';
+export { OauthApi } from './oauth.js';
+export type { OauthOptions, DeviceAuthorizationOptions, PollDeviceTokenOptions, OauthMetadata, DeviceAuthorization, TokenResponse, } from './oauth.js';
+export { InternetDataError, OauthError, OauthAccessDeniedError, OauthExpiredTokenError, } from './errors.js';
 export type { ErrorKind } from './errors.js';
 export { DATABASE_FORMATS, DATASET_FORMATS, LICENSE_TYPES, STANDINGS } from './types.js';
 export type { Database, DatabaseFormat, DatabaseMetadata, DatabaseMetadataColumn, DatabaseVersion, DatasetFormat, DbChecksums, Download, LicenseType, Standing, } from './types.js';

package/dist/index.js

@@ -1,4 +1,5 @@
 export { InternetData, DatabaseApi, DEFAULT_BASE_URL } from './client.js';
-export { InternetDataError } from './errors.js';
+export { OauthApi } from './oauth.js';
+export { InternetDataError, OauthError, OauthAccessDeniedError, OauthExpiredTokenError, } from './errors.js';
 export { DATABASE_FORMATS, DATASET_FORMATS, LICENSE_TYPES, STANDINGS } from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAKtC,OAAO,EACH,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,EAAE,sBAAsB,GAChF,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}