@ionite/ecv 0.0.24-beta.20260928.18 → 0.0.24-beta.20260930.19

package/dist/index.d.ts

@@ -1,6 +1,3 @@
-import { AppUnderTest, StartAppOptions, WaitForReadyOptions } from "@ionite/devtools";
-import { startAppUnderTest, waitForReady } from "@ionite/devtools";
-import { ConfigLocator, EnterpriseExtension, Ionite } from "@ionite/server";
 /** Serializable connection details provided by the ECV server control API. */
 interface SerializedEcvServerHandle {
 	baseUrl: string;
@@ -11,6 +8,7 @@ interface SerializedEcvServerHandle {
 		ION_VAULT_URL: string;
 		ION_VAULT_TOKEN: string;
 		ION_VAULT_PATH: string;
+		ION_ECV_CONTROL_TOKEN: string;
 		REDIS_URL?: string;
 	};
 	configLocator: {
@@ -44,6 +42,7 @@ interface OaaPushRecord {
 }
 interface EcvServerHandle extends SerializedEcvServerHandle {
 	reset(): Promise<void>;
+	decideAccessRequest(id: string, status: "approved" | "denied"): Promise<void>;
 	setTestUser(user: TestUser): Promise<void>;
 	mintTmHandle(input: {
 		audience: string;
@@ -61,6 +60,7 @@ interface EcvServerHandle extends SerializedEcvServerHandle {
 /** Restore control methods after a handle crosses Vitest's serializable `provide` boundary. */
 declare function ecvHandleFrom(serialized: SerializedEcvServerHandle): EcvServerHandle;
 declare function connectEcvServer(baseUrl: string, token?: string): Promise<EcvServerHandle>;
+import { ConfigLocator, EnterpriseExtension, Ionite } from "@ionite/server";
 /**
 * ionite Validator Types
 *
@@ -435,6 +435,26 @@ interface ValidationReport {
 	*/
 	duration: number;
 }
+interface EcvAccessRequestVariantOptions {
+	/** App-owned ECV endpoint that submits and reads access requests for this principal kind. */
+	accessRequestsPath: string;
+	/** App-owned ECV endpoint that probes the requested permission with this principal's session. */
+	permissionProbePath: string;
+	/** Principal represented by the matching ECV mock IdP identity. */
+	subject: string;
+	/** Requestable catalog target whose approval should add an entitlement claim. */
+	target: string;
+	/** CIAM provider key when the App has multiple customer access-request destinations. */
+	provider?: string;
+}
+interface EcvAccessRequestsOptions {
+	/** Validate workforce/SSO IdP-governed assignment. */
+	users?: EcvAccessRequestVariantOptions;
+	/** Validate customer/CIAM IdP-governed assignment. */
+	customers?: EcvAccessRequestVariantOptions;
+}
+import { AppUnderTest, StartAppOptions, WaitForReadyOptions } from "@ionite/devtools";
+import { startAppUnderTest, waitForReady } from "@ionite/devtools";
 declare function createAuthzClosureTests(): {
 	tests: TestDef[];
 };
@@ -447,7 +467,7 @@ declare function createOaaProjectionTests(config: AuthzValidationConfig): TestDe
 /**
 * Workload OAuth-scope tests (require the ECV mock server for JWKS + token minting). They validate
 * the two authorization sources for a workload: explicit `hasScope*` (token claims) and the
-* config-gated `scopesAsEntitlements` auto-honor inside `has*`.
+* config-gated `claimsAsEntitlements` derivation inside `has*`.
 */
 declare function createWorkloadScopeTests(config: AuthzValidationConfig): TestDef[];
 /**
@@ -509,6 +529,15 @@ declare function buildEcvTenantCatalog(config: ECVCatalogConfig, options?: EcvTe
 /** Options specific to one explicitly registered capability unit. */
 interface EcvUnitCatalogOptions {
 	expectedCallbackErrorPattern?: RegExp;
+	ssoClaimsAuthz?: {
+		permissionProbePath: string;
+		group: string;
+	};
+	ciamClaimsAuthz?: {
+		permissionProbePath: string;
+		group: string;
+	};
+	accessRequests?: EcvAccessRequestsOptions;
 }
 /** Build the static entries for one capability selected by the suite builder. */
 declare function buildEcvUnitCatalog(config: ECVCatalogConfig, unit: CapabilityKey2, options?: EcvUnitCatalogOptions): EcvCatalogEntry[];
@@ -572,7 +601,7 @@ declare class EcvContainer {
 }
 /**
 * Canonical `ion:*` scope strings the ECV harness embeds in workload tokens so deny-by-default SDK
-* endpoints (AUDIT_HISTORY.md §1.32) authorize via `scopesAsEntitlements`. They mirror the SDK-owned Permission
+* endpoints (AUDIT_HISTORY.md §1.32) authorize via `claimsAsEntitlements`. They mirror the SDK-owned Permission
 * ids so they can never drift from the gate.
 */
 /** All three SCIM scopes (read + user/group writes) — the IAM suite reads and writes with one token. */
@@ -587,7 +616,7 @@ declare const ION_TENANT_SCOPE: string;
 * identity.
 *
 * The SDK gates its protected endpoints deny-by-default (AUDIT_HISTORY.md §1.32). When the app under test enables
-* `RemoteConfig.authz.scopesAsEntitlements` (the ECV mock vault does), the requested `scope` is honored
+* `workload.incoming.claimsAsEntitlements` with `claims: ['scope']` (the ECV mock vault does), the requested `scope` is honored
 * as the matching entitlement — so pass the `ion:*` permission id(s) the endpoint requires (e.g.
 * `ion:tenant:manage`, `ion:capabilitiez:read`, or the IAM scopes). Omit `scope` to mint an
 * authenticated-but-unauthorized token (useful for asserting 403 denial).
@@ -882,7 +911,7 @@ declare function validateVaultWebSocketTransport(): Promise<ValidationSuiteResul
 *
 * Keep this synchronized with packages/ecv/package.json via publish.ts.
 */
-declare const ECV_VERSION = "0.0.24-beta.20260928.18";
+declare const ECV_VERSION = "0.0.24-beta.20260930.19";
 /**
 * Runs all Workload validation tests
 */
@@ -933,6 +962,12 @@ interface EcvSsoLoginOptions {
 	/** Register a named assertion that failed callbacks expose this generic error marker. */
 	expectedCallbackErrorPattern?: RegExp;
 }
+interface EcvClaimsAuthzOptions {
+	/** App-owned endpoint that returns 200 when the principal holds the tested permission and 403 otherwise. */
+	permissionProbePath: string;
+	/** Catalog group id the configured issuer's `groups` claim expands. */
+	group: string;
+}
 type EcvTenantsOptions = EcvTenantCatalogOptions;
 /** Navigable ECV unit registrar returned by {@link ecvSuite}. */
 interface EcvSuite {
@@ -941,12 +976,14 @@ interface EcvSuite {
 		jit: () => void;
 		logout: () => void;
 		back_channel_logout: () => void;
+		claims_authz: (options: EcvClaimsAuthzOptions) => void;
 	};
 	ciam: {
 		customer: () => void;
 		magic_link: () => void;
 		oidc_login: () => void;
 		logout: () => void;
+		claims_authz: (options: EcvClaimsAuthzOptions) => void;
 	};
 	iam: {
 		users: () => void;
@@ -957,9 +994,11 @@ interface EcvSuite {
 	workload: {
 		incoming: () => void;
 		outgoing: () => void;
+		claims_authz: () => void;
 	};
 	authz: {
 		oaa: () => void;
+		access_requests: (options: EcvAccessRequestsOptions) => void;
 	};
 	/** Register root tenant-management and cross-tenant isolation assertions. */
 	tenants: (options?: EcvTenantsOptions) => void;
@@ -976,4 +1015,4 @@ interface EcvSuite {
 declare function ecvSuite(config: EcvSuiteOptions): EcvSuite;
 /** Print the legacy structured report used by the deferred standalone runner. */
 declare function printReport(report: ValidationReport): void;
-export { AppUnderTest, AuthzValidationConfig, CIAMValidationConfig, ECVCatalogConfig, ECV_VERSION, EcvCatalogEntry, EcvCatalogUnit, EcvContainer, EcvContainerOptions, EcvPostgresOptions, EcvServerHandle, EcvSsoLoginOptions, EcvSuite, EcvSuiteHooks, EcvSuiteOptions, EcvSuiteSetup, EcvTenantCatalogOptions, EcvTenantsOptions, EcvTestContext, EcvTestEnvironmentOptions, EcvUnitCatalogOptions, IAMValidationConfig, ION_CAPABILITIEZ_SCOPE, ION_IAM_SCOPES, ION_TENANT_SCOPE, OaaPushRecord, ProvisionTenantOptions, ProvisionedTenant, QUARANTINED_SDK_VERSIONS, SSOValidationConfig, SUPPORTED_SDK_RANGE, SerializedEcvServerHandle, StartAppOptions, StartedEcvContainer, StartedEcvTestEnvironment, TenantManagementTestConfig, TenantValidationConfig, TenantValidationProfile, TestDef, TestUser, ValidationConfig, ValidationReport, ValidationResult, ValidationSuiteResult, WaitForReadyOptions, WorkloadValidationConfig, assert, assertEqual, assertValid, buildEcvMetaCatalog, buildEcvSdkCatalog, buildEcvTenantCatalog, buildEcvUnitCatalog, completeLoginFlow, connectEcvServer, createAuthzClosureTests, createCIAMTests, createConfigBoundaryTests, createConfigLifecycleTests, createConfigRetryTests, createDisplayCookieTests, createFetcher, createHarnessSelfTests, createIAMTests, createIamDeltaPatchTests, createIamPrincipalPullTests, createKmsTests, createLfvCallbackTests, createOaaProjectionTests, createOtelTests, createPerformanceTuningTests, createProtocolSurfaceTests, createRedisStoreTests, createSSOTests, createSecretsHardeningTests, createSessionEntriesTests, createSsoControlContractTests, createSsoIdTokenVerificationTests, createSsoSessionWindowTests, createSsoTokenClientAuthTests, createTenantAccessTests, createTenantLifecycleTests, createTenantManagementTests, createTenantTests, createValidatorParityTests, createVaultCoordinationTests, createVaultWebSocketTransportTests, createWorkloadScopeTests, createWorkloadTests, ecvHandleFrom, ecvSuite, fetchCapabilitiezManifest, getTenantAuthToken, printReport, provisionTenant, resolveBaseUrl, runLoginToCallback, runTest, satisfiesSdkRange, skipTest, startAppUnderTest, startEcvTestEnvironment, validateAuthz, validateCIAM, validateDisplayCookies, validateIAM, validateIamDelta, validateIamPrincipals, validateKms, validateLfvDelivery, validateOtel, validatePerformanceTuning, validateProtocolSurface, validateRedisStores, validateSSO, validateSecretsHardening, validateSessionEntries, validateSsoControlContract, validateSsoIdTokenVerification, validateSsoSessionWindow, validateSsoTokenClientAuth, validateTenant, validateTenantAccess, validateTenantLifecycle, validateValidatorParity, validateVaultCoordination, validateVaultWebSocketTransport, validateWorkload, waitForReady };
+export { AppUnderTest, AuthzValidationConfig, CIAMValidationConfig, ECVCatalogConfig, ECV_VERSION, EcvAccessRequestVariantOptions, EcvAccessRequestsOptions, EcvCatalogEntry, EcvCatalogUnit, EcvClaimsAuthzOptions, EcvContainer, EcvContainerOptions, EcvPostgresOptions, EcvServerHandle, EcvSsoLoginOptions, EcvSuite, EcvSuiteHooks, EcvSuiteOptions, EcvSuiteSetup, EcvTenantCatalogOptions, EcvTenantsOptions, EcvTestContext, EcvTestEnvironmentOptions, EcvUnitCatalogOptions, IAMValidationConfig, ION_CAPABILITIEZ_SCOPE, ION_IAM_SCOPES, ION_TENANT_SCOPE, OaaPushRecord, ProvisionTenantOptions, ProvisionedTenant, QUARANTINED_SDK_VERSIONS, SSOValidationConfig, SUPPORTED_SDK_RANGE, SerializedEcvServerHandle, StartAppOptions, StartedEcvContainer, StartedEcvTestEnvironment, TenantManagementTestConfig, TenantValidationConfig, TenantValidationProfile, TestDef, TestUser, ValidationConfig, ValidationReport, ValidationResult, ValidationSuiteResult, WaitForReadyOptions, WorkloadValidationConfig, assert, assertEqual, assertValid, buildEcvMetaCatalog, buildEcvSdkCatalog, buildEcvTenantCatalog, buildEcvUnitCatalog, completeLoginFlow, connectEcvServer, createAuthzClosureTests, createCIAMTests, createConfigBoundaryTests, createConfigLifecycleTests, createConfigRetryTests, createDisplayCookieTests, createFetcher, createHarnessSelfTests, createIAMTests, createIamDeltaPatchTests, createIamPrincipalPullTests, createKmsTests, createLfvCallbackTests, createOaaProjectionTests, createOtelTests, createPerformanceTuningTests, createProtocolSurfaceTests, createRedisStoreTests, createSSOTests, createSecretsHardeningTests, createSessionEntriesTests, createSsoControlContractTests, createSsoIdTokenVerificationTests, createSsoSessionWindowTests, createSsoTokenClientAuthTests, createTenantAccessTests, createTenantLifecycleTests, createTenantManagementTests, createTenantTests, createValidatorParityTests, createVaultCoordinationTests, createVaultWebSocketTransportTests, createWorkloadScopeTests, createWorkloadTests, ecvHandleFrom, ecvSuite, fetchCapabilitiezManifest, getTenantAuthToken, printReport, provisionTenant, resolveBaseUrl, runLoginToCallback, runTest, satisfiesSdkRange, skipTest, startAppUnderTest, startEcvTestEnvironment, validateAuthz, validateCIAM, validateDisplayCookies, validateIAM, validateIamDelta, validateIamPrincipals, validateKms, validateLfvDelivery, validateOtel, validatePerformanceTuning, validateProtocolSurface, validateRedisStores, validateSSO, validateSecretsHardening, validateSessionEntries, validateSsoControlContract, validateSsoIdTokenVerification, validateSsoSessionWindow, validateSsoTokenClientAuth, validateTenant, validateTenantAccess, validateTenantLifecycle, validateValidatorParity, validateVaultCoordination, validateVaultWebSocketTransport, validateWorkload, waitForReady };

package/dist/index.js

@@ -1 +1 @@
-import{ie,ce,n,a,s,c,e,t,o,u,p,Z,de,le,m,h,ue,U,q,M,N,L,l,r,D,pe,g,f,me,y,he,w,ge,i,V,Q,ee,v,fe,b,ye,k,we,S,ve,be,T,z,ke,C,Se,R,Te,x,Ce,E,Re,A,xe,d,Ee,te,B,I,Ae,P,Ie,_,Pe,_e,j,J,G,W,K,F,se,H,Y,O,je,ae,Oe,ne,Ue,re,$e,oe,qe,X,Me}from"./shared/ecv-x9smnj0y.js";export{i as ECV_VERSION,O as EcvContainer,L as ION_CAPABILITIEZ_SCOPE,N as ION_IAM_SCOPES,l as ION_TENANT_SCOPE,Q as QUARANTINED_SDK_VERSIONS,V as SUPPORTED_SDK_RANGE,Y as StartedEcvContainer,e as assert,t as assertEqual,o as assertValid,G as buildEcvMetaCatalog,W as buildEcvSdkCatalog,K as buildEcvTenantCatalog,F as buildEcvUnitCatalog,z as completeLoginFlow,H as connectEcvServer,u as createAuthzClosureTests,m as createCIAMTests,q as createConfigBoundaryTests,U as createConfigLifecycleTests,M as createConfigRetryTests,R as createDisplayCookieTests,a as createFetcher,D as createHarnessSelfTests,g as createIAMTests,f as createIamDeltaPatchTests,y as createIamPrincipalPullTests,w as createKmsTests,h as createLfvCallbackTests,p as createOaaProjectionTests,v as createOtelTests,ae as createPerformanceTuningTests,b as createProtocolSurfaceTests,ne as createRedisStoreTests,T as createSSOTests,k as createSecretsHardeningTests,S as createSessionEntriesTests,C as createSsoControlContractTests,x as createSsoIdTokenVerificationTests,E as createSsoSessionWindowTests,A as createSsoTokenClientAuthTests,I as createTenantAccessTests,re as createTenantLifecycleTests,B as createTenantManagementTests,te as createTenantTests,oe as createValidatorParityTests,P as createVaultCoordinationTests,_ as createVaultWebSocketTransportTests,Z as createWorkloadScopeTests,j as createWorkloadTests,se as ecvHandleFrom,X as ecvSuite,J as fetchCapabilitiezManifest,r as getTenantAuthToken,Me as printReport,d as provisionTenant,n as resolveBaseUrl,ke as runLoginToCallback,s as runTest,ee as satisfiesSdkRange,c as skipTest,ie as startAppUnderTest,je as startEcvTestEnvironment,de as validateAuthz,le as validateCIAM,Te as validateDisplayCookies,pe as validateIAM,me as validateIamDelta,he as validateIamPrincipals,ge as validateKms,ue as validateLfvDelivery,fe as validateOtel,Oe as validatePerformanceTuning,ye as validateProtocolSurface,Ue as validateRedisStores,be as validateSSO,we as validateSecretsHardening,ve as validateSessionEntries,Se as validateSsoControlContract,Ce as validateSsoIdTokenVerification,Re as validateSsoSessionWindow,xe as validateSsoTokenClientAuth,Ee as validateTenant,Ae as validateTenantAccess,$e as validateTenantLifecycle,qe as validateValidatorParity,Ie as validateVaultCoordination,Pe as validateVaultWebSocketTransport,_e as validateWorkload,ce as waitForReady};
+import{ie,ce,n,a,s,c,e,t,o,u,p,Z,de,le,m,O,q,l,r,h,ue,M,N,L,D,pe,g,f,me,y,he,w,ge,i,z,Q,ee,v,fe,b,ye,k,we,S,ve,be,T,V,ke,C,Se,R,Te,x,Ce,E,Re,A,xe,d,Ee,te,B,I,Ae,P,Ie,_,Pe,_e,j,J,G,W,K,F,se,H,Y,U,je,ae,Ue,ne,Oe,re,qe,oe,$e,X,Me}from"./shared/ecv-e1pn2rgg.js";export{i as ECV_VERSION,U as EcvContainer,q as ION_CAPABILITIEZ_SCOPE,O as ION_IAM_SCOPES,l as ION_TENANT_SCOPE,Q as QUARANTINED_SDK_VERSIONS,z as SUPPORTED_SDK_RANGE,Y as StartedEcvContainer,e as assert,t as assertEqual,o as assertValid,G as buildEcvMetaCatalog,W as buildEcvSdkCatalog,K as buildEcvTenantCatalog,F as buildEcvUnitCatalog,V as completeLoginFlow,H as connectEcvServer,u as createAuthzClosureTests,m as createCIAMTests,N as createConfigBoundaryTests,M as createConfigLifecycleTests,L as createConfigRetryTests,R as createDisplayCookieTests,a as createFetcher,D as createHarnessSelfTests,g as createIAMTests,f as createIamDeltaPatchTests,y as createIamPrincipalPullTests,w as createKmsTests,h as createLfvCallbackTests,p as createOaaProjectionTests,v as createOtelTests,ae as createPerformanceTuningTests,b as createProtocolSurfaceTests,ne as createRedisStoreTests,T as createSSOTests,k as createSecretsHardeningTests,S as createSessionEntriesTests,C as createSsoControlContractTests,x as createSsoIdTokenVerificationTests,E as createSsoSessionWindowTests,A as createSsoTokenClientAuthTests,I as createTenantAccessTests,re as createTenantLifecycleTests,B as createTenantManagementTests,te as createTenantTests,oe as createValidatorParityTests,P as createVaultCoordinationTests,_ as createVaultWebSocketTransportTests,Z as createWorkloadScopeTests,j as createWorkloadTests,se as ecvHandleFrom,X as ecvSuite,J as fetchCapabilitiezManifest,r as getTenantAuthToken,Me as printReport,d as provisionTenant,n as resolveBaseUrl,ke as runLoginToCallback,s as runTest,ee as satisfiesSdkRange,c as skipTest,ie as startAppUnderTest,je as startEcvTestEnvironment,de as validateAuthz,le as validateCIAM,Te as validateDisplayCookies,pe as validateIAM,me as validateIamDelta,he as validateIamPrincipals,ge as validateKms,ue as validateLfvDelivery,fe as validateOtel,Ue as validatePerformanceTuning,ye as validateProtocolSurface,Oe as validateRedisStores,be as validateSSO,we as validateSecretsHardening,ve as validateSessionEntries,Se as validateSsoControlContract,Ce as validateSsoIdTokenVerification,Re as validateSsoSessionWindow,xe as validateSsoTokenClientAuth,Ee as validateTenant,Ae as validateTenantAccess,qe as validateTenantLifecycle,$e as validateValidatorParity,Ie as validateVaultCoordination,Pe as validateVaultWebSocketTransport,_e as validateWorkload,ce as waitForReady};