@leaflow/sdk 0.0.0-dev.35.g30ba751 → 0.0.0-dev.352.g85966ed

package/dist/iam/v1/generated/models.d.ts

@@ -0,0 +1,568 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+/**
+ * What a given `code` carries alongside the message. The keys depend on the code,
+ * and a client that does not recognise one ignores it.
+ */
+export type ErrorMeta = {
+    [key: string]: unknown;
+};
+export interface Error {
+    code?: string;
+    message: string;
+    /**
+     * What a given `code` carries alongside the message. The keys depend on the code,
+     * and a client that does not recognise one ignores it.
+     */
+    meta?: ErrorMeta;
+    status: number;
+}
+export interface PermissionResource {
+    /** The code of the permission, such as compute:instance.delete. **There is no display name here** — what a permission reads as is localised, and translation belongs to the layer rendering it. Until a translation catches up, the code itself is what is shown */
+    name: string;
+    /** Reserved for the project owner. Attaching it to a custom role has no effect */
+    owner_only: boolean;
+    /** The kind of resource this permission is decided against; empty means it is decided at project level. **It need not be the object being operated on** — a compute route carries no project_id and is isolated through its parent network, so compute:route.create is decided against compute:private_network. A non-empty value also means the permission can be scoped to particular instances; create and list are always empty */
+    resource_type: string;
+}
+export interface ResourceTypeResource {
+    /** The code of the resource type, such as dns:zone. There is no display name here either; what it reads as is decided by the layer rendering it */
+    name: string;
+}
+export interface CatalogResource {
+    /** @nullable */
+    permissions: PermissionResource[] | null;
+    /**
+     * The resource types this service declares. A scoped rule can only land on one of them
+     * @nullable
+     */
+    resource_types: ResourceTypeResource[] | null;
+    service: string;
+}
+export interface CatalogListResponseBody {
+    /** @nullable */
+    items: CatalogResource[] | null;
+}
+export interface ResourceRefResource {
+    /** A string rather than a UUID; a DNS zone is named by its domain, which IAM does not hold. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly */
+    id: string;
+    /** Of the form compute:instance or dns:zone, in the same namespace as permission names */
+    type: string;
+}
+export type RuleResourceEffect = (typeof RuleResourceEffect)[keyof typeof RuleResourceEffect];
+export declare const RuleResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface RuleResource {
+    effect: RuleResourceEffect;
+    /**
+     * A permission name, with a trailing wildcard supported (compute:instance.*). A wildcard must carry the service prefix; a bare wildcard would also grant the operations of services that go live later
+     * @nullable
+     */
+    permissions: string[] | null;
+    /**
+     * Empty means the rule holds across the whole project. A non-empty value means it holds only on those resources, and therefore answers no project-level question
+     * @nullable
+     */
+    resources: ResourceRefResource[] | null;
+}
+export interface GrantResource {
+    admin: boolean;
+    owner: boolean;
+    /**
+     * The role codes held, for display only
+     * @nullable
+     */
+    roles: string[] | null;
+    /**
+     * **The rules compiled from every policy that applies. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it
+     * @nullable
+     */
+    rules: RuleResource[] | null;
+}
+export type ProjectTraitResourceEffect = (typeof ProjectTraitResourceEffect)[keyof typeof ProjectTraitResourceEffect];
+export declare const ProjectTraitResourceEffect: {
+    readonly NoWrite: "NoWrite";
+    readonly NoAccess: "NoAccess";
+};
+export interface ProjectTraitResource {
+    key: string;
+    value: string;
+    effect: ProjectTraitResourceEffect;
+    reason: string;
+}
+export interface ProjectResource {
+    traits: ProjectTraitResource[];
+    /** @nullable */
+    deletion_requested_at: string | null;
+    created_at: string;
+    created_by: string;
+    /**
+     * When the project was deleted
+     * @nullable
+     */
+    deleted_at: string | null;
+    description: string;
+    id: string;
+    name: string;
+    updated_at: string;
+}
+export interface ProjectAccessResource {
+    grant: GrantResource;
+    project: ProjectResource;
+}
+export interface UpdateProjectRequestBody {
+    /** @maxLength 2000 */
+    description?: string;
+    /** @maxLength 128 */
+    name?: string;
+}
+export interface QuotaResource {
+    /** The service enforcing the quota. */
+    service: string;
+    name: string;
+    description: string;
+    /** The most this project may have. */
+    limit: number;
+}
+export interface QuotaListResponseBody {
+    items: QuotaResource[];
+}
+export interface MembershipResource {
+    traits: ProjectTraitResource[];
+    /** @nullable */
+    deleted_at: string | null;
+    /** @nullable */
+    deletion_requested_at: string | null;
+    grant: GrantResource;
+    member: boolean;
+    user_status: string;
+}
+export interface InvitationResource {
+    created_at: string;
+    email: string;
+    expires_at: string;
+    id: string;
+    invited_by: string;
+    project_id: string;
+    /**
+     * The role codes granted on redemption
+     * @nullable
+     */
+    roles: string[] | null;
+}
+export interface LengthAwarePageInvitationResource {
+    /** The items in this page */
+    items: InvitationResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface IssueInvitationRequestBody {
+    /** @maxLength 320 */
+    email: string;
+    /**
+     * The role codes granted on redemption. Each must already be defined in this project, and `OWNER` is not accepted
+     * @minItems 1
+     * @nullable
+     */
+    roles: string[] | null;
+}
+export interface IssuedInvitationResponseBody {
+    invitation: InvitationResource;
+    /** The token that redeems the invitation, **returned in this response only**. If it is lost, withdraw the invitation and send another */
+    token: string;
+}
+export interface BatchGetMembersRequestBody {
+    /**
+     * The account ids to resolve. Blank entries are ignored.
+     * @maxItems 100
+     * @items.maxLength 255
+     */
+    ids: string[];
+}
+/**
+ * A person referred to by an id held elsewhere in the project. Carries who they are, not what they may do — a member who has left holds nothing, and this shape has no grant to say so.
+ */
+export interface ResolvedMemberResource {
+    /** MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+    avatar_hash: string;
+    email: string;
+    first_name: string;
+    last_name: string;
+    /** True when this person is no longer a member of the project. */
+    left: boolean;
+    user_id: string;
+}
+export interface BatchGetMembersResponseBody {
+    /** The people that resolved. Ids that never belonged to this project are absent, as are ids that do not resolve at all. */
+    items: ResolvedMemberResource[];
+}
+export interface MemberResource {
+    /** MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+    avatar_hash: string;
+    created_at: string;
+    created_by: string;
+    email: string;
+    first_name: string;
+    grant: GrantResource;
+    last_name: string;
+    user_id: string;
+}
+export interface LengthAwarePageMemberResource {
+    /** The items in this page */
+    items: MemberResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface SetMemberRolesRequestBody {
+    /**
+     * **Every** role code this person is to hold. `OWNER` cannot appear here
+     * @nullable
+     */
+    roles: string[] | null;
+}
+export interface SetMemberPermissionsRequestBody {
+    /**
+     * **Every** permission name to be attached directly to this person, replaced in full. The permissions a role grants are neither listed here nor touched by this write
+     * @nullable
+     */
+    permissions: string[] | null;
+}
+export type PolicyResourceEffect = (typeof PolicyResourceEffect)[keyof typeof PolicyResourceEffect];
+export declare const PolicyResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface PolicyResource {
+    /** The base policy is the one whose effect is `allow` and which covers every resource. Each member holds exactly one, and it carries their ordinary roles. Change it with PUT /members/{userId}/roles and PUT /members/{userId}/permissions */
+    base: boolean;
+    created_at: string;
+    /** Why it was granted, written for a reader */
+    description: string;
+    effect: PolicyResourceEffect;
+    id: string;
+    /**
+     * Permission names attached directly to this person, without passing through a role
+     * @nullable
+     */
+    permissions: string[] | null;
+    /**
+     * Empty means the whole project
+     * @nullable
+     */
+    resources: ResourceRefResource[] | null;
+    /**
+     * The role codes this policy carries
+     * @nullable
+     */
+    roles: string[] | null;
+    updated_at: string;
+    user_id: string;
+}
+export interface PolicyListResponseBody {
+    /** @nullable */
+    items: PolicyResource[] | null;
+}
+export type AttachPolicyRequestBodyEffect = (typeof AttachPolicyRequestBodyEffect)[keyof typeof AttachPolicyRequestBodyEffect];
+export declare const AttachPolicyRequestBodyEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface AttachPolicyRequestBody {
+    /**
+     * Why it was granted, written for a reader
+     * @maxLength 255
+     */
+    description?: string;
+    effect: AttachPolicyRequestBodyEffect;
+    /**
+     * Permission names attached directly, which avoids creating a role only one person holds
+     * @nullable
+     */
+    permissions?: string[] | null;
+    /**
+     * The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists
+     * @nullable
+     */
+    resources?: ResourceRefResource[] | null;
+    /**
+     * Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions
+     * @nullable
+     */
+    roles?: string[] | null;
+    /**
+     * Must already be a member of this project
+     * @minLength 1
+     * @maxLength 255
+     */
+    user_id: string;
+}
+/**
+ * Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE
+ */
+export type UpdatePolicyRequestBodyEffect = (typeof UpdatePolicyRequestBodyEffect)[keyof typeof UpdatePolicyRequestBodyEffect];
+export declare const UpdatePolicyRequestBodyEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface UpdatePolicyRequestBody {
+    /**
+     * Why it was granted, written for a reader. It is replaced together with the change, so that what remains does not explain an earlier version
+     * @maxLength 255
+     */
+    description?: string;
+    /** Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE */
+    effect: UpdatePolicyRequestBodyEffect;
+    /**
+     * Permission names attached directly, replaced in full. Anything not listed is withdrawn rather than kept
+     * @nullable
+     */
+    permissions?: string[] | null;
+    /**
+     * The resource scope of this policy, replaced in full. What the scope contains can change; whether the policy has one cannot. A base policy cannot take a scope, and a scoped policy cannot have its scope cleared
+     * @nullable
+     */
+    resources?: ResourceRefResource[] | null;
+    /**
+     * Each must be a role already defined in this project, replaced in full. As when attaching, `OWNER` and `ADMIN` are not accepted
+     * @nullable
+     */
+    roles?: string[] | null;
+}
+export interface TransferOwnershipRequestBody {
+    /**
+     * The recipient must already be a member of this project
+     * @minLength 1
+     * @maxLength 255
+     */
+    to_user_id: string;
+}
+export interface OwnershipTransferResponseBody {
+    /** The former owner, who keeps every other role held. Ownership is transferred rather than the person removed */
+    from: MemberResource;
+    to: MemberResource;
+}
+export interface RoleResource {
+    /** A built-in role can be neither deleted nor have its permissions changed */
+    builtin: boolean;
+    code: string;
+    created_at: string;
+    description: string;
+    name: string;
+    /** @nullable */
+    permissions: string[] | null;
+    updated_at: string;
+}
+export interface RoleListResponseBody {
+    /** @nullable */
+    items: RoleResource[] | null;
+}
+export interface CreateRoleRequestBody {
+    /**
+     * Begins with a lower-case letter and may contain digits and underscores. It cannot be changed once created, as member bindings and invitations refer to it
+     * @minLength 1
+     * @maxLength 64
+     */
+    code: string;
+    /** @maxLength 255 */
+    description?: string;
+    /**
+     * @minLength 1
+     * @maxLength 64
+     */
+    name: string;
+    /**
+     * A permission name. The ones reserved for the owner are refused, since attaching them would have no effect
+     * @nullable
+     */
+    permissions?: string[] | null;
+}
+export interface UpdateRoleRequestBody {
+    /** @maxLength 255 */
+    description?: string;
+    /**
+     * @minLength 1
+     * @maxLength 64
+     */
+    name: string;
+    /** @nullable */
+    permissions?: string[] | null;
+}
+export type SSHKeyResourceStatus = (typeof SSHKeyResourceStatus)[keyof typeof SSHKeyResourceStatus];
+export declare const SSHKeyResourceStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly REVOKED: "REVOKED";
+};
+export interface SSHKeyResource {
+    created_at: string;
+    fingerprint: string;
+    /** The key the platform generates and holds. Its private key is not handed out */
+    has_private_key: boolean;
+    id: string;
+    key_type: string;
+    name: string;
+    /** Who the key belongs to. Absent means it belongs to the project itself */
+    owner_user_id?: string;
+    public_key: string;
+    /**
+     * A purpose label. The key the platform generates carries `platform`
+     * @nullable
+     */
+    purposes: string[] | null;
+    status: SSHKeyResourceStatus;
+}
+export interface LengthAwarePageSSHKeyResource {
+    /** The items in this page */
+    items: SSHKeyResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+/**
+ * Who this key belongs to
+ */
+export type CreateSSHKeyRequestBodyOwner = (typeof CreateSSHKeyRequestBodyOwner)[keyof typeof CreateSSHKeyRequestBodyOwner];
+export declare const CreateSSHKeyRequestBodyOwner: {
+    readonly me: "me";
+    readonly project: "project";
+};
+export interface CreateSSHKeyRequestBody {
+    /**
+     * @minLength 1
+     * @maxLength 128
+     */
+    name: string;
+    /** Who this key belongs to */
+    owner?: CreateSSHKeyRequestBodyOwner;
+    /**
+     * The public key in OpenSSH format. The type and the fingerprint are derived from it and cannot be changed
+     * @minLength 1
+     * @maxLength 16384
+     */
+    public_key: string;
+    /**
+     * A purpose label, such as ci or bastion
+     * @maxItems 16
+     * @nullable
+     */
+    purposes?: string[] | null;
+}
+export interface RenameSSHKeyRequestBody {
+    /**
+     * @minLength 1
+     * @maxLength 128
+     */
+    name: string;
+}
+/**
+ * Pagination metadata for stable numbered pages. total_count is returned only when the operation can determine it without an unbounded scan.
+ */
+export interface OffsetPagination {
+    /** @minimum 1 */
+    page: number;
+    /** @minimum 1 */
+    page_size: number;
+    /** @minimum 0 */
+    total_count?: number;
+}
+/**
+ * Pagination metadata for keyset traversal. Pass next_cursor as cursor to read the following page; null means there is no following page.
+ */
+export interface CursorPagination {
+    /** @minimum 1 */
+    page_size: number;
+    /** @nullable */
+    next_cursor?: string | null;
+}
+export type ListProjectInvitationsParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+};
+export type ListMembersParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+    /**
+     * Matches against user id, email address or name
+     * @maxLength 255
+     */
+    keyword?: string;
+};
+export type ListPoliciesParams = {
+    /**
+     * Restricts the result to one person. Omitting it covers the whole project
+     * @maxLength 255
+     */
+    userId?: string;
+};
+export type ListSshKeysParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+    /**
+     * Both kinds are returned while this is absent
+     */
+    status?: ListSshKeysStatus;
+    /**
+     * Lists only the keys carrying this purpose. The key the platform generates carries `platform`
+     * @maxLength 64
+     */
+    purpose?: string;
+};
+export type ListSshKeysStatus = (typeof ListSshKeysStatus)[keyof typeof ListSshKeysStatus];
+export declare const ListSshKeysStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly REVOKED: "REVOKED";
+};

package/dist/iam/v1/generated/models.js

@@ -0,0 +1,32 @@
+export const RuleResourceEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const ProjectTraitResourceEffect = {
+    NoWrite: "NoWrite",
+    NoAccess: "NoAccess",
+};
+export const PolicyResourceEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const AttachPolicyRequestBodyEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const UpdatePolicyRequestBodyEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const SSHKeyResourceStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};
+export const CreateSSHKeyRequestBodyOwner = {
+    me: "me",
+    project: "project",
+};
+export const ListSshKeysStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};