@ionite/core 0.0.24-beta.20260921.8 → 0.0.24-beta.20260922.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +30 -11
- package/dist/index.js +2 -2
- package/dist/server.d.ts +77 -11
- package/dist/server.js +1 -1
- package/dist/shared/{core-j5xhxcmq.js → core-50rb7jf6.js} +3 -3
- package/package.json +1 -1
package/dist/index.d.ts
CHANGED
|
@@ -1498,11 +1498,13 @@ type AccessRequestCreate = {
|
|
|
1498
1498
|
subjectType: SubjectType;
|
|
1499
1499
|
targetType: EntitlementType;
|
|
1500
1500
|
target: string;
|
|
1501
|
+
operation: "grant" | "revoke";
|
|
1501
1502
|
justification?: string;
|
|
1502
1503
|
};
|
|
1503
1504
|
type AccessRequestResult = {
|
|
1504
1505
|
id: string;
|
|
1505
1506
|
status: "pending" | "approved" | "denied";
|
|
1507
|
+
operation: "grant" | "revoke";
|
|
1506
1508
|
trackingUrl: string;
|
|
1507
1509
|
};
|
|
1508
1510
|
/** SCIM resource types the delta patch adapter addresses. */
|
|
@@ -2256,15 +2258,17 @@ type IamPrincipalKind = {
|
|
|
2256
2258
|
assignment: IamAssignmentPolicy;
|
|
2257
2259
|
delta?: IamDeltaMode;
|
|
2258
2260
|
};
|
|
2261
|
+
/**
|
|
2262
|
+
* Destination-side inbox contract. The destination owns idempotency: when a pending request
|
|
2263
|
+
* already exists for the same (subjectType, subject, target, operation) tuple, `create` must
|
|
2264
|
+
* return that request with `created: false` (the handler answers 200 instead of 201). Operation
|
|
2265
|
+
* arrays are forbidden — one request carries exactly one `'grant' | 'revoke'`.
|
|
2266
|
+
*/
|
|
2259
2267
|
type IAMAccessRequestsConfig = {
|
|
2260
|
-
create: (request: AccessRequestCreate) => Promise<
|
|
2261
|
-
|
|
2262
|
-
|
|
2263
|
-
|
|
2264
|
-
subjectType: SubjectType;
|
|
2265
|
-
targetType: EntitlementType;
|
|
2266
|
-
target: AccessChange["target"];
|
|
2267
|
-
justification?: string;
|
|
2268
|
+
create: (request: AccessRequestCreate) => Promise<{
|
|
2269
|
+
request: AccessRequestResult;
|
|
2270
|
+
created: boolean;
|
|
2271
|
+
}>;
|
|
2268
2272
|
};
|
|
2269
2273
|
type IAMEntitlementRequestUrlContext = {
|
|
2270
2274
|
request: Request;
|
|
@@ -4987,6 +4991,14 @@ type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
|
|
|
4987
4991
|
tenant: TTenant;
|
|
4988
4992
|
previousLocator?: ConfigLocator;
|
|
4989
4993
|
}) => void | Promise<void>;
|
|
4994
|
+
/** Runs after a tenant POST has durably upserted its row. Awaited; the return value is ignored and failures are logged without rolling back the tenant. */
|
|
4995
|
+
onTenantCreated?: (context: {
|
|
4996
|
+
tenant: TTenant;
|
|
4997
|
+
}) => unknown;
|
|
4998
|
+
/** Runs after a tenant DELETE has removed its row. Awaited; the return value is ignored and failures are logged without changing the HTTP result. */
|
|
4999
|
+
onTenantDeleted?: (context: {
|
|
5000
|
+
tenantId: string;
|
|
5001
|
+
}) => unknown;
|
|
4990
5002
|
};
|
|
4991
5003
|
type RecordTenantConsentInput = {
|
|
4992
5004
|
handle: string;
|
|
@@ -5787,6 +5799,10 @@ type Authz = {
|
|
|
5787
5799
|
entitlements: {
|
|
5788
5800
|
list(options?: ListOptions): Promise<ListResult<Entitlement>>;
|
|
5789
5801
|
};
|
|
5802
|
+
/** Durable catalog authority, when wired. Used by explicit app-owned entitlement lifecycles. */
|
|
5803
|
+
readonly catalogStore?: AccessCatalogStore;
|
|
5804
|
+
/** Durable direct-grant authority, when wired. Used by explicit app-owned grant lifecycles. */
|
|
5805
|
+
readonly accessStore?: AccessAssignmentStore;
|
|
5790
5806
|
/** The wired closure index powering `has*`, when the app provided one via stores. */
|
|
5791
5807
|
accessIndex?: AccessIndex;
|
|
5792
5808
|
has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
|
|
@@ -5829,18 +5845,21 @@ type Authz = {
|
|
|
5829
5845
|
*/
|
|
5830
5846
|
grant(change: AccessChange): Promise<AccessChange>;
|
|
5831
5847
|
/**
|
|
5832
|
-
* Submit
|
|
5833
|
-
* policy is `'iam-request'`.
|
|
5848
|
+
* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
|
|
5849
|
+
* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
|
|
5850
|
+
* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
|
|
5834
5851
|
*/
|
|
5835
5852
|
requestAccess(change: {
|
|
5836
5853
|
subject: AccessChange["subject"];
|
|
5837
5854
|
subjectType: SubjectType;
|
|
5838
5855
|
targetType: EntitlementType;
|
|
5839
5856
|
target: AccessChange["target"];
|
|
5857
|
+
operation: "grant" | "revoke";
|
|
5840
5858
|
justification?: string;
|
|
5841
5859
|
}): Promise<{
|
|
5842
5860
|
id: string;
|
|
5843
5861
|
status: "pending" | "approved" | "denied";
|
|
5862
|
+
operation: "grant" | "revoke";
|
|
5844
5863
|
trackingUrl: string;
|
|
5845
5864
|
}>;
|
|
5846
5865
|
/**
|
|
@@ -6312,4 +6331,4 @@ type LfvErrorResponse = {
|
|
|
6312
6331
|
};
|
|
6313
6332
|
/** Generates a ULID */
|
|
6314
6333
|
declare function generateULID(prefix?: string): string;
|
|
6315
|
-
export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult,
|
|
6334
|
+
export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
|
package/dist/index.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{E,X,
|
|
2
|
-
`,"\\n")}function $e(O,
|
|
1
|
+
import{E,X,i,h,S,b,r,R,s,Q,U,u,e,d,W,_,V,H,ee,F,A,I,y,v,M,x,n,c,ne,k,J,re,se,w,N,L,l,a,t,D,oe,Y,ie,T,p,ae,ce,P,ue,m,C,G,B,de,o,f,g,pe,me,K,q}from"./shared/core-50rb7jf6.js";var Je="0.0.24-beta.20260922.11";class Ae extends Error{constructor(O,j){super(O,j.cause!==void 0?{cause:j.cause}:void 0);this.name="ConfigSourceError",this.kind=j.kind,this.recoverable=j.recoverable,this.code=j.code,this.status=j.status,this.path=j.path,this.sourceType=j.sourceType,Object.setPrototypeOf(this,Ae.prototype)}}function Ye(O){return O instanceof Ae}var Se=["workload"],Ie={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},we={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},xe={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Pe={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Oe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},_e={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},ve={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ke={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Se},Me={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ne={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ze=[Ie,we,xe,Pe,Oe,_e,ve,Ke,Me,Ne],Qe={"iam.read":{permission:Ie,subjectType:["workload"]},"iam.users.write":{permission:we,subjectType:["workload"]},"iam.groups.write":{permission:xe,subjectType:["workload"]},"iam.workloads.write":{permission:Pe,subjectType:["workload"]},"iam.customers.write":{permission:Oe,subjectType:["workload"]},"iam.access-requests.write":{permission:_e,subjectType:["workload"]},"capabilitiez.read":{permission:ve,subjectType:["workload"]},"ciam.magic-link.create":{permission:Ke,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Me,subjectType:["workload"]},"tenant.manage":{permission:Ne,subjectType:["workload"]}};var Xe=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function We(O){if(O===null||typeof O!=="object")return O;let j={};for(let[z,Z]of Object.entries(O)){if(Xe.includes(z)||z==="validators"||z==="setStores")continue;j[z]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?We(Z):Z}return j}function et(O){return We(O)}function be(O,j){if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`${j} must be an object.`);return O}function Re(O,j){if(O===void 0)return;if(typeof O!=="string"||O.length===0||!Number.isFinite(Date.parse(O)))throw Error(`${j} must be a valid timestamp string.`);return O}function je(O,j,z){if(!Array.isArray(O)||!z.allowEmpty&&O.length===0)throw Error(`${j} keys must be ${z.allowEmpty?"an":"a non-empty"} array.`);let Z=new Set;return O.map((ge,te)=>{let le=be(ge,`${j} keys[${te}]`);if(typeof le.id!=="string"||le.id.length===0)throw Error(`${j} keys[${te}].id must be a non-empty string.`);if(Z.has(le.id))throw Error(`${j} contains duplicate key id "${le.id}".`);if(Z.add(le.id),!["pending","active","deprecated","rotated","revoked"].includes(String(le.state)))throw Error(`${j} keys[${te}].state is invalid.`);if(le.value!==void 0&&(typeof le.value!=="string"||le.value.length===0))throw Error(`${j} keys[${te}].value must be a non-empty string when present.`);let fe=le.meta===void 0?void 0:be(le.meta,`${j} keys[${te}].meta`);return{id:le.id,state:le.state,...le.value===void 0?{}:{value:le.value},...le.notBefore===void 0?{}:{notBefore:Re(le.notBefore,`${j} keys[${te}].notBefore`)},...le.notAfter===void 0?{}:{notAfter:Re(le.notAfter,`${j} keys[${te}].notAfter`)},...le.createdAt===void 0?{}:{createdAt:Re(le.createdAt,`${j} keys[${te}].createdAt`)},...le.activatedAt===void 0?{}:{activatedAt:Re(le.activatedAt,`${j} keys[${te}].activatedAt`)},...le.deprecatedAt===void 0?{}:{deprecatedAt:Re(le.deprecatedAt,`${j} keys[${te}].deprecatedAt`)},...le.rotatedAt===void 0?{}:{rotatedAt:Re(le.rotatedAt,`${j} keys[${te}].rotatedAt`)},...le.revokedAt===void 0?{}:{revokedAt:Re(le.revokedAt,`${j} keys[${te}].revokedAt`)},...fe?{meta:{...fe}}:{}}})}function tt(O,j,z){if(O===void 0)return;if(!Array.isArray(O))throw Error(`${z} slots must be an array.`);let Z=new Set,ge=O.map((te,le)=>{if(te===null)return null;if(typeof te!=="string"||te.length===0)throw Error(`${z} slots[${le}] must be a non-empty key id or null.`);if(Z.has(te))throw Error(`${z} slots contain duplicate key id "${te}".`);Z.add(te);let fe=j.find((ye)=>ye.id===te);if(!fe)throw Error(`${z} slot key "${te}" is not present in keys.`);if(fe.state!=="active")throw Error(`${z} slot key "${te}" must have state "active".`);if(!fe.value)throw Error(`${z} slot key "${te}" must include a value.`);return te});if(j.length===0&&ge.some((te)=>te!==null))throw Error(`${z} slots must be omitted or all-null when keys is empty.`);return ge}function ot(O){let z=be(O,"KMS pool");if(z.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Z=je(z.keys,"KMS pool",{allowEmpty:!0}),ge=tt(z.slots,Z,"KMS pool");return ge?{kind:"kms",slots:ge,keys:Z}:{kind:"kms",keys:Z}}function rt(O){let z=be(O,"KMS pool control document");if(z.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:je(z.keys,"KMS pool control document",{allowEmpty:!0})}}var nt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Ue(O){if(typeof O==="string")return O;try{return JSON.stringify(O)??String(O)}catch{return String(O)}}function Ee(O){let j=Ue(O);return/^[A-Za-z0-9_./:@+|-]+$/.test(j)?j:JSON.stringify(j)}function st(O){return Ue(O).replaceAll("\r","\\r").replaceAll(`
|
|
2
|
+
`,"\\n")}function $e(O,j,z){if(z==null)return;if(z instanceof Error){if(O.push(`${j}.name=${Ee(z.name)}`),O.push(`${j}.message=${Ee(z.message)}`),z.stack)O.push(`${j}.stack=${Ee(z.stack)}`);return}O.push(`${j}=${Ee(z)}`)}function Te(O,j,z=[],Z=new Date){let ge=st(j instanceof Error?j.message:j??""),te=[];for(let[le,fe]of z.entries()){if(fe&&typeof fe==="object"&&!Array.isArray(fe)&&!(fe instanceof Error)&&Object.getPrototypeOf(fe)===Object.prototype){for(let[ye,ke]of Object.entries(fe))$e(te,ye,ke);continue}$e(te,`param.${le}`,fe)}return[Z.toISOString(),nt[O],ge,...te].filter(Boolean).join(" ")}var qe={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},it=qe,at={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},pt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ct={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},mt={trace:()=>{},debug:(O,...j)=>globalThis.console.debug(Te("debug",O,j)),info:(O,...j)=>globalThis.console.info(Te("info",O,j)),warn:(O,...j)=>globalThis.console.warn(Te("warn",O,j)),error:(O,...j)=>globalThis.console.error(Te("error",O,j))};function ut(O,j){if(typeof j!=="number"||j<=0)return O;return new Promise((z,Z)=>{let ge=setTimeout(()=>{Z(Error(`Authz catalog entry did not become ready within ${j}ms`))},j);O.then(()=>{clearTimeout(ge),z()},(te)=>{clearTimeout(ge),Z(te)})})}function dt(O,j){let z=!1,Z,ge=j.then(()=>{z=!0},(le)=>{z=!1,Z=le}),te=O;return Object.defineProperty(te,"ready",{enumerable:!1,configurable:!0,value:(le)=>ut(ge.then(()=>{if(!z)throw Z}),le)}),Object.defineProperty(te,"isReady",{enumerable:!1,configurable:!0,value:()=>z}),te}var Le=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function De(O){if(!O.id.trim())throw Error("defineSecretType: id is required");let j=O.mimeType?.trim()||Le[O.format],z=Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:j,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},typeId:O.id});return Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:j,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},...O.schema?{schema:O.schema}:{},toRegistryEntry:()=>z})}function lt(O="jsonc"){return{format:O,mimeType:Le[O],typeId:O}}class ze extends Error{constructor(O,j){super(`Secret content type mismatch: expected "${O.mimeType}" (${O.format}) but received "${j.mimeType}" (${j.format})`);this.name="SecretContentTypeMismatchError",this.expected=O,this.received=j}}var gt=De({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Ve={beforeTenantSegments:["ui"]},Ge={beforeTenantSegments:["api"]};function Fe(O){return(O??[]).map((j)=>j.trim()).filter(Boolean)}function yt(O){let j=O.trim();if(!j)return"/";let z=j.replace(/\\/g,"/").replace(/\/+/g,"/");return z.startsWith("/")?z:`/${z}`}function Be(O){return yt(O).split("/").filter(Boolean)}function he(O){return{beforeTenantSegments:Fe(O?.beforeTenantSegments),afterTenantSegments:Fe(O?.afterTenantSegments)}}function ft(O){return{type:"path",ui:he(O?.ui??Ve),api:he(O?.api??Ge)}}function St(O,j){let z=he(j),Z=z.beforeTenantSegments??[],ge=z.afterTenantSegments??[],te=Be(O),le=Z.length+1+ge.length;if(te.length<le)return null;for(let Ce=0;Ce<Z.length;Ce++)if(te[Ce]!==Z[Ce])return null;let fe=Z.length,ye=te[fe];if(!ye)return null;for(let Ce=0;Ce<ge.length;Ce++)if(te[fe+1+Ce]!==ge[Ce])return null;let ke=te.slice(fe+1+ge.length);return{id:decodeURIComponent(ye),restSegments:ke,restPath:ke.length>0?`/${ke.join("/")}`:"/"}}function Ct(O,j="/",z){let Z=he(z),ge=Z.beforeTenantSegments??[],te=Z.afterTenantSegments??[],le=Be(j),fe=[...ge,encodeURIComponent(O),...te,...le];return fe.length>0?`/${fe.join("/")}`:"/"}function kt(O){return{"~standard":{version:1,vendor:O,validate:(j)=>{if(typeof j!=="object"||j===null)return{issues:[{message:"Expected an object"}]};let z=j,Z=[],ge={...z},te=["iss","sub"];for(let ye of te)if(ye in z){if(typeof z[ye]!=="string")Z.push({message:`${ye} must be a string`,path:[ye]})}else Z.push({message:`${ye} is required`,path:[ye]});if("aud"in z&&z.aud!==void 0){let ye=z.aud;if(typeof ye!=="string"&&!Array.isArray(ye))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ye)&&!ye.every((ke)=>typeof ke==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let le=["jti","scope"];for(let ye of le)if(ye in z&&z[ye]!==void 0){if(typeof z[ye]!=="string")Z.push({message:`${ye} must be a string`,path:[ye]})}let fe=["exp","iat"];for(let ye of fe)if(ye in z){if(typeof z[ye]!=="number")Z.push({message:`${ye} must be a number`,path:[ye]})}else Z.push({message:`${ye} is required`,path:[ye]});if(Z.length>0)return{issues:Z};return{value:ge}}}}}function Rt(O){return{"~standard":{version:1,vendor:O,validate:(j)=>{if(typeof j!=="object"||j===null)return{issues:[{message:"Expected an object"}]};let z=j,Z=[],ge={};if("access_token"in z)if(typeof z.access_token==="string")ge.access_token=z.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in z)if(typeof z.token_type==="string")ge.token_type=z.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in z)if(typeof z.scope==="string"||z.scope===void 0)ge.scope=z.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in z)if(typeof z.refresh_token==="string"||z.refresh_token===void 0)ge.refresh_token=z.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in z)if(typeof z.expires==="string"||z.expires===void 0)ge.expires=z.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in z)if(typeof z.expires_in==="number"||z.expires_in===void 0)ge.expires_in=z.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:ge}}}}}function Tt(O){let j=new Uint8Array(O);return crypto.getRandomValues(j),j}function ht(O){let j="",z=Tt(O);for(let Z=0;Z<O;Z++){let ge=z[Z]%32;j+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ge)}return j}function At(O,j){let z="";for(let Z=j;Z>0;Z--){let ge=O%32;z="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ge)+z,O=Math.floor(O/32)}return z}function bt(O){let j=Date.now(),z=At(j,10),Z=ht(16);return`${O??""}${z}${Z}`}export{V as AssignmentPolicyError,U as CANONICAL_RISK_LEVELS,Ae as ConfigSourceError,u as DEFAULT_RISK_LEVEL,Le as DEFAULT_SECRET_MIME_TYPES,Ge as DEFAULT_TENANT_API_NAMESPACE,Ve as DEFAULT_TENANT_UI_NAMESPACE,ne as ECID_SCHEME,k as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,Me as ION_AUTHZ_OAA_SYNC,ve as ION_CAPABILITIEZ_READ,Ke as ION_CIAM_MAGIC_LINK_CREATE,Qe as ION_ENDPOINT_PERMISSIONS,_e as ION_IAM_ACCESS_REQUESTS_WRITE,Oe as ION_IAM_CUSTOMERS_WRITE,xe as ION_IAM_GROUPS_WRITE,Ie as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Pe as ION_IAM_WORKLOADS_WRITE,g as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,f as ION_SCIM_WORKLOAD_SCHEMA,Ze as ION_SDK_PERMISSIONS,Ne as ION_TENANT_MANAGE,G as IoniteError,S as KNOWN_BASE_CUSTOMER_KEYS,h as KNOWN_BASE_USER_KEYS,i as KNOWN_ENTITLEMENT_KEYS,b as KNOWN_WORKLOAD_KEYS,d as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,ze as SecretContentTypeMismatchError,m as StoreConflictError,n as accessRefId,c as accessRootId,w as assertEcid,_ as assertRequiredSubjectType,W as assertValidSubjectTypeScoping,Ct as buildTenantPath,I as catalogEntityStore,P as claimsToUser,X as configTrustedClientGrants,r as customAttributes,q as customerResourceSchema,at as debugLogger,ue as decodeUser,p as deepEqualPlain,it as defaultLogger,lt as defaultSecretContentType,F as defineCatalog,De as defineSecretType,M as deprecateRetiredCodeCatalogRows,re as formatEcid,Te as formatLogLine,bt as generateULID,A as getCodeCatalogEntity,me as groupResourceSchema,l as idTokenClaimsSchema,pt as infoLogger,H as isCodeCatalog,B as isConfigLocator,Ye as isConfigSourceError,J as isEcid,C as isStoreConflictError,kt as jwtAssertionClaimsSchema,R as list,s as listGenerator,St as matchTenantPath,Q as matchesListFilter,v as materializeCodeCatalogEntity,y as mergeCodeCatalogEntity,oe as mergeConfig,t as must,he as normalizeTenantPathNamespace,ft as normalizeTenantRoutingStrategy,N as oidcCallbackSchema,se as parseEcid,ie as parseJsonc,rt as parseKmsPoolControlDocument,ot as parseKmsPoolDocument,mt as prettyLogger,dt as readyCatalogEntry,gt as remoteConfigSecretType,et as serializeConfig,qe as silentLogger,ae as stableConfigHash,Y as stripJsonComments,de as tmIntegrationState,ee as toCodeCatalog,L as tokenResponseSchema,T as trimTrailingSlash,E as trustedClientPermissionsForPrincipal,x as unionCatalogRead,pe as userSchema,D as validationFailureResponse,Je as version,ce as waitOn,ct as warnLogger,a as withValidate,K as workloadResourceSchema,Rt as workloadTokenResponseSchema};
|
package/dist/server.d.ts
CHANGED
|
@@ -1364,11 +1364,13 @@ type AccessRequestCreate = {
|
|
|
1364
1364
|
subjectType: SubjectType;
|
|
1365
1365
|
targetType: EntitlementType;
|
|
1366
1366
|
target: string;
|
|
1367
|
+
operation: "grant" | "revoke";
|
|
1367
1368
|
justification?: string;
|
|
1368
1369
|
};
|
|
1369
1370
|
type AccessRequestResult = {
|
|
1370
1371
|
id: string;
|
|
1371
1372
|
status: "pending" | "approved" | "denied";
|
|
1373
|
+
operation: "grant" | "revoke";
|
|
1372
1374
|
trackingUrl: string;
|
|
1373
1375
|
};
|
|
1374
1376
|
/** SCIM resource types the delta patch adapter addresses. */
|
|
@@ -2107,15 +2109,17 @@ type IamPrincipalKind = {
|
|
|
2107
2109
|
assignment: IamAssignmentPolicy;
|
|
2108
2110
|
delta?: IamDeltaMode;
|
|
2109
2111
|
};
|
|
2112
|
+
/**
|
|
2113
|
+
* Destination-side inbox contract. The destination owns idempotency: when a pending request
|
|
2114
|
+
* already exists for the same (subjectType, subject, target, operation) tuple, `create` must
|
|
2115
|
+
* return that request with `created: false` (the handler answers 200 instead of 201). Operation
|
|
2116
|
+
* arrays are forbidden — one request carries exactly one `'grant' | 'revoke'`.
|
|
2117
|
+
*/
|
|
2110
2118
|
type IAMAccessRequestsConfig = {
|
|
2111
|
-
create: (request: AccessRequestCreate) => Promise<
|
|
2112
|
-
|
|
2113
|
-
|
|
2114
|
-
|
|
2115
|
-
subjectType: SubjectType;
|
|
2116
|
-
targetType: EntitlementType;
|
|
2117
|
-
target: AccessChange["target"];
|
|
2118
|
-
justification?: string;
|
|
2119
|
+
create: (request: AccessRequestCreate) => Promise<{
|
|
2120
|
+
request: AccessRequestResult;
|
|
2121
|
+
created: boolean;
|
|
2122
|
+
}>;
|
|
2119
2123
|
};
|
|
2120
2124
|
type IAMEntitlementRequestUrlContext = {
|
|
2121
2125
|
request: Request;
|
|
@@ -5148,6 +5152,10 @@ type Authz = {
|
|
|
5148
5152
|
entitlements: {
|
|
5149
5153
|
list(options?: ListOptions): Promise<ListResult<Entitlement>>;
|
|
5150
5154
|
};
|
|
5155
|
+
/** Durable catalog authority, when wired. Used by explicit app-owned entitlement lifecycles. */
|
|
5156
|
+
readonly catalogStore?: AccessCatalogStore;
|
|
5157
|
+
/** Durable direct-grant authority, when wired. Used by explicit app-owned grant lifecycles. */
|
|
5158
|
+
readonly accessStore?: AccessAssignmentStore;
|
|
5151
5159
|
/** The wired closure index powering `has*`, when the app provided one via stores. */
|
|
5152
5160
|
accessIndex?: AccessIndex;
|
|
5153
5161
|
has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group2 | Role2 | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
|
|
@@ -5190,18 +5198,21 @@ type Authz = {
|
|
|
5190
5198
|
*/
|
|
5191
5199
|
grant(change: AccessChange): Promise<AccessChange>;
|
|
5192
5200
|
/**
|
|
5193
|
-
* Submit
|
|
5194
|
-
* policy is `'iam-request'`.
|
|
5201
|
+
* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
|
|
5202
|
+
* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
|
|
5203
|
+
* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
|
|
5195
5204
|
*/
|
|
5196
5205
|
requestAccess(change: {
|
|
5197
5206
|
subject: AccessChange["subject"];
|
|
5198
5207
|
subjectType: SubjectType;
|
|
5199
5208
|
targetType: EntitlementType;
|
|
5200
5209
|
target: AccessChange["target"];
|
|
5210
|
+
operation: "grant" | "revoke";
|
|
5201
5211
|
justification?: string;
|
|
5202
5212
|
}): Promise<{
|
|
5203
5213
|
id: string;
|
|
5204
5214
|
status: "pending" | "approved" | "denied";
|
|
5215
|
+
operation: "grant" | "revoke";
|
|
5205
5216
|
trackingUrl: string;
|
|
5206
5217
|
}>;
|
|
5207
5218
|
/**
|
|
@@ -5737,4 +5748,59 @@ type VerifyUserOptions = {
|
|
|
5737
5748
|
* does not match, or the token is expired.
|
|
5738
5749
|
*/
|
|
5739
5750
|
declare function verifyUser(jwt: string, options: VerifyUserOptions): Promise<WorkforceUser>;
|
|
5740
|
-
|
|
5751
|
+
declare const TENANT_OWNER_PERMISSION = "tenant.owner";
|
|
5752
|
+
/**
|
|
5753
|
+
* Catalog row for the shared owner permission. The `id` is fixed to {@link TENANT_OWNER_PERMISSION}
|
|
5754
|
+
* because `resolveTenantOwner`, `materializeTenantOwnerEntitlement`, and `getOwnedTenantIds` all
|
|
5755
|
+
* address that id — an app that renames it must also thread `ownerPermission` through every helper.
|
|
5756
|
+
* Presentation fields are overridable defaults.
|
|
5757
|
+
*/
|
|
5758
|
+
declare function tenantOwnerPermission(overrides?: Partial<Omit<Permission, "id">>): Permission;
|
|
5759
|
+
declare function tenantResourceId(tenantId: string): string;
|
|
5760
|
+
declare function tenantOwnerEntitlementId(tenantId: string): string;
|
|
5761
|
+
type TenantAccessSessionKind = "sso" | "customer" | "owner";
|
|
5762
|
+
type TenantAccessSession<Kind extends TenantAccessSessionKind = TenantAccessSessionKind> = {
|
|
5763
|
+
id: string;
|
|
5764
|
+
email?: string;
|
|
5765
|
+
name?: string;
|
|
5766
|
+
kind: Kind;
|
|
5767
|
+
};
|
|
5768
|
+
type TenantAccessDenialReason = "not_found" | "forbidden" | "unavailable" | "unauthenticated";
|
|
5769
|
+
type TenantAccessDenial = {
|
|
5770
|
+
allow: false;
|
|
5771
|
+
reason: TenantAccessDenialReason;
|
|
5772
|
+
response(): Response;
|
|
5773
|
+
};
|
|
5774
|
+
type TenantAccessResult<Kind extends TenantAccessSessionKind = TenantAccessSessionKind> = {
|
|
5775
|
+
allow: true;
|
|
5776
|
+
session: TenantAccessSession<Kind>;
|
|
5777
|
+
} | TenantAccessDenial;
|
|
5778
|
+
type ResolveTenantSessionOptions = {
|
|
5779
|
+
rootIon: Ionite;
|
|
5780
|
+
tenantIon: Ionite | undefined;
|
|
5781
|
+
tenantId: string;
|
|
5782
|
+
permission?: string;
|
|
5783
|
+
allowTenantCustomer?: boolean;
|
|
5784
|
+
ownerPermission?: string;
|
|
5785
|
+
};
|
|
5786
|
+
type ResolveTenantOwnerOptions = {
|
|
5787
|
+
rootIon: Ionite;
|
|
5788
|
+
tenantId: string;
|
|
5789
|
+
ownerPermission?: string;
|
|
5790
|
+
};
|
|
5791
|
+
declare function resolveTenantOwner(request: Request, options: ResolveTenantOwnerOptions): Promise<TenantAccessResult<"owner">>;
|
|
5792
|
+
declare function resolveTenantSession(request: Request, options: ResolveTenantSessionOptions & {
|
|
5793
|
+
allowTenantCustomer: true;
|
|
5794
|
+
}): Promise<TenantAccessResult>;
|
|
5795
|
+
declare function resolveTenantSession(request: Request, options: ResolveTenantSessionOptions & {
|
|
5796
|
+
allowTenantCustomer?: false;
|
|
5797
|
+
}): Promise<TenantAccessResult<"sso" | "owner">>;
|
|
5798
|
+
declare function getOwnedTenantIds(rootIon: Ionite, customerId: string): Promise<string[]>;
|
|
5799
|
+
type TenantAccessLoginUrlOptions = {
|
|
5800
|
+
tenantIon: Ionite | undefined;
|
|
5801
|
+
fallbackPath: string;
|
|
5802
|
+
redirectTo: string;
|
|
5803
|
+
tenantIonBasePath?: (tenantId: string) => string;
|
|
5804
|
+
};
|
|
5805
|
+
declare function tenantAccessLoginUrl(tenantId: string, options: TenantAccessLoginUrlOptions): string;
|
|
5806
|
+
export { AccessRequestCreate, AccessRequestResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, StateCookie, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signLfvPayload, sso, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
|