@leaflow/sdk 0.108.0 → 0.109.0

package/dist/iam/v1/generated/models.d.ts

@@ -0,0 +1,557 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+/**
+ * What a given `code` carries alongside the message. The keys depend on the code,
+ * and a client that does not recognise one ignores it.
+ */
+export type ErrorMeta = {
+    [key: string]: unknown;
+};
+export interface Error {
+    code?: string;
+    message: string;
+    /**
+     * What a given `code` carries alongside the message. The keys depend on the code,
+     * and a client that does not recognise one ignores it.
+     */
+    meta?: ErrorMeta;
+    status: number;
+}
+export interface PermissionResource {
+    /** The code of the permission, such as compute:instance.delete. **There is no display name here** — what a permission reads as is localised, and translation belongs to the layer rendering it. Until a translation catches up, the code itself is what is shown */
+    name: string;
+    /** Reserved for the project owner. Attaching it to a custom role has no effect */
+    owner_only: boolean;
+    /** The kind of resource this permission is decided against; empty means it is decided at project level. **It need not be the object being operated on** — a compute route carries no project_id and is isolated through its parent network, so compute:route.create is decided against compute:private_network. A non-empty value also means the permission can be scoped to particular instances; create and list are always empty */
+    resource_type: string;
+}
+export interface ResourceTypeResource {
+    /** The code of the resource type, such as dns:zone. There is no display name here either; what it reads as is decided by the layer rendering it */
+    name: string;
+}
+export interface CatalogResource {
+    /** @nullable */
+    permissions: PermissionResource[] | null;
+    /**
+     * The resource types this service declares. A scoped rule can only land on one of them
+     * @nullable
+     */
+    resource_types: ResourceTypeResource[] | null;
+    service: string;
+}
+export interface CatalogListResponseBody {
+    /** @nullable */
+    items: CatalogResource[] | null;
+}
+export interface ResourceRefResource {
+    /** A string rather than a UUID; a DNS zone is named by its domain, which IAM does not hold. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly */
+    id: string;
+    /** Of the form compute:instance or dns:zone, in the same namespace as permission names */
+    type: string;
+}
+export type RuleResourceEffect = (typeof RuleResourceEffect)[keyof typeof RuleResourceEffect];
+export declare const RuleResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface RuleResource {
+    effect: RuleResourceEffect;
+    /**
+     * A permission name, with a trailing wildcard supported (compute:instance.*). A wildcard must carry the service prefix; a bare wildcard would also grant the operations of services that go live later
+     * @nullable
+     */
+    permissions: string[] | null;
+    /**
+     * Empty means the rule holds across the whole project. A non-empty value means it holds only on those resources, and therefore answers no project-level question
+     * @nullable
+     */
+    resources: ResourceRefResource[] | null;
+}
+export interface GrantResource {
+    admin: boolean;
+    owner: boolean;
+    /**
+     * The role codes held, for display only
+     * @nullable
+     */
+    roles: string[] | null;
+    /**
+     * **The rules compiled from every policy that applies. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it
+     * @nullable
+     */
+    rules: RuleResource[] | null;
+}
+export type ProjectTraitResourceEffect = (typeof ProjectTraitResourceEffect)[keyof typeof ProjectTraitResourceEffect];
+export declare const ProjectTraitResourceEffect: {
+    readonly NoWrite: "NoWrite";
+    readonly NoAccess: "NoAccess";
+};
+export interface ProjectTraitResource {
+    key: string;
+    value: string;
+    effect: ProjectTraitResourceEffect;
+    reason: string;
+}
+export interface ProjectResource {
+    traits: ProjectTraitResource[];
+    /** @nullable */
+    deletion_requested_at: string | null;
+    created_at: string;
+    created_by: string;
+    /**
+     * When the project was deleted
+     * @nullable
+     */
+    deleted_at: string | null;
+    description: string;
+    id: string;
+    name: string;
+    updated_at: string;
+}
+export interface ProjectAccessResource {
+    grant: GrantResource;
+    project: ProjectResource;
+}
+export interface UpdateProjectRequestBody {
+    /** @maxLength 2000 */
+    description?: string;
+    /** @maxLength 128 */
+    name?: string;
+}
+export interface MembershipResource {
+    traits: ProjectTraitResource[];
+    /** @nullable */
+    deleted_at: string | null;
+    /** @nullable */
+    deletion_requested_at: string | null;
+    grant: GrantResource;
+    member: boolean;
+    user_status: string;
+}
+export interface InvitationResource {
+    created_at: string;
+    email: string;
+    expires_at: string;
+    id: string;
+    invited_by: string;
+    project_id: string;
+    /**
+     * The role codes granted on redemption
+     * @nullable
+     */
+    roles: string[] | null;
+}
+export interface LengthAwarePageInvitationResource {
+    /** The items in this page */
+    items: InvitationResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface IssueInvitationRequestBody {
+    /** @maxLength 320 */
+    email: string;
+    /**
+     * The role codes granted on redemption. Each must already be defined in this project, and `OWNER` is not accepted
+     * @minItems 1
+     * @nullable
+     */
+    roles: string[] | null;
+}
+export interface IssuedInvitationResponseBody {
+    invitation: InvitationResource;
+    /** The token that redeems the invitation, **returned in this response only**. If it is lost, withdraw the invitation and send another */
+    token: string;
+}
+export interface BatchGetMembersRequestBody {
+    /**
+     * The account ids to resolve. Blank entries are ignored.
+     * @maxItems 100
+     * @items.maxLength 255
+     */
+    ids: string[];
+}
+/**
+ * A person referred to by an id held elsewhere in the project. Carries who they are, not what they may do — a member who has left holds nothing, and this shape has no grant to say so.
+ */
+export interface ResolvedMemberResource {
+    /** MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+    avatar_hash: string;
+    email: string;
+    first_name: string;
+    last_name: string;
+    /** True when this person is no longer a member of the project. */
+    left: boolean;
+    user_id: string;
+}
+export interface BatchGetMembersResponseBody {
+    /** The people that resolved. Ids that never belonged to this project are absent, as are ids that do not resolve at all. */
+    items: ResolvedMemberResource[];
+}
+export interface MemberResource {
+    /** MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+    avatar_hash: string;
+    created_at: string;
+    created_by: string;
+    email: string;
+    first_name: string;
+    grant: GrantResource;
+    last_name: string;
+    user_id: string;
+}
+export interface LengthAwarePageMemberResource {
+    /** The items in this page */
+    items: MemberResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface SetMemberRolesRequestBody {
+    /**
+     * **Every** role code this person is to hold. `OWNER` cannot appear here
+     * @nullable
+     */
+    roles: string[] | null;
+}
+export interface SetMemberPermissionsRequestBody {
+    /**
+     * **Every** permission name to be attached directly to this person, replaced in full. The permissions a role grants are neither listed here nor touched by this write
+     * @nullable
+     */
+    permissions: string[] | null;
+}
+export type PolicyResourceEffect = (typeof PolicyResourceEffect)[keyof typeof PolicyResourceEffect];
+export declare const PolicyResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface PolicyResource {
+    /** The base policy is the one whose effect is `allow` and which covers every resource. Each member holds exactly one, and it carries their ordinary roles. Change it with PUT /members/{userId}/roles and PUT /members/{userId}/permissions */
+    base: boolean;
+    created_at: string;
+    /** Why it was granted, written for a reader */
+    description: string;
+    effect: PolicyResourceEffect;
+    id: string;
+    /**
+     * Permission names attached directly to this person, without passing through a role
+     * @nullable
+     */
+    permissions: string[] | null;
+    /**
+     * Empty means the whole project
+     * @nullable
+     */
+    resources: ResourceRefResource[] | null;
+    /**
+     * The role codes this policy carries
+     * @nullable
+     */
+    roles: string[] | null;
+    updated_at: string;
+    user_id: string;
+}
+export interface PolicyListResponseBody {
+    /** @nullable */
+    items: PolicyResource[] | null;
+}
+export type AttachPolicyRequestBodyEffect = (typeof AttachPolicyRequestBodyEffect)[keyof typeof AttachPolicyRequestBodyEffect];
+export declare const AttachPolicyRequestBodyEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface AttachPolicyRequestBody {
+    /**
+     * Why it was granted, written for a reader
+     * @maxLength 255
+     */
+    description?: string;
+    effect: AttachPolicyRequestBodyEffect;
+    /**
+     * Permission names attached directly, which avoids creating a role only one person holds
+     * @nullable
+     */
+    permissions?: string[] | null;
+    /**
+     * The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists
+     * @nullable
+     */
+    resources?: ResourceRefResource[] | null;
+    /**
+     * Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions
+     * @nullable
+     */
+    roles?: string[] | null;
+    /**
+     * Must already be a member of this project
+     * @minLength 1
+     * @maxLength 255
+     */
+    user_id: string;
+}
+/**
+ * Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE
+ */
+export type UpdatePolicyRequestBodyEffect = (typeof UpdatePolicyRequestBodyEffect)[keyof typeof UpdatePolicyRequestBodyEffect];
+export declare const UpdatePolicyRequestBodyEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface UpdatePolicyRequestBody {
+    /**
+     * Why it was granted, written for a reader. It is replaced together with the change, so that what remains does not explain an earlier version
+     * @maxLength 255
+     */
+    description?: string;
+    /** Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE */
+    effect: UpdatePolicyRequestBodyEffect;
+    /**
+     * Permission names attached directly, replaced in full. Anything not listed is withdrawn rather than kept
+     * @nullable
+     */
+    permissions?: string[] | null;
+    /**
+     * The resource scope of this policy, replaced in full. What the scope contains can change; whether the policy has one cannot. A base policy cannot take a scope, and a scoped policy cannot have its scope cleared
+     * @nullable
+     */
+    resources?: ResourceRefResource[] | null;
+    /**
+     * Each must be a role already defined in this project, replaced in full. As when attaching, `OWNER` and `ADMIN` are not accepted
+     * @nullable
+     */
+    roles?: string[] | null;
+}
+export interface TransferOwnershipRequestBody {
+    /**
+     * The recipient must already be a member of this project
+     * @minLength 1
+     * @maxLength 255
+     */
+    to_user_id: string;
+}
+export interface OwnershipTransferResponseBody {
+    /** The former owner, who keeps every other role held. Ownership is transferred rather than the person removed */
+    from: MemberResource;
+    to: MemberResource;
+}
+export interface RoleResource {
+    /** A built-in role can be neither deleted nor have its permissions changed */
+    builtin: boolean;
+    code: string;
+    created_at: string;
+    description: string;
+    name: string;
+    /** @nullable */
+    permissions: string[] | null;
+    updated_at: string;
+}
+export interface RoleListResponseBody {
+    /** @nullable */
+    items: RoleResource[] | null;
+}
+export interface CreateRoleRequestBody {
+    /**
+     * Begins with a lower-case letter and may contain digits and underscores. It cannot be changed once created, as member bindings and invitations refer to it
+     * @minLength 1
+     * @maxLength 64
+     */
+    code: string;
+    /** @maxLength 255 */
+    description?: string;
+    /**
+     * @minLength 1
+     * @maxLength 64
+     */
+    name: string;
+    /**
+     * A permission name. The ones reserved for the owner are refused, since attaching them would have no effect
+     * @nullable
+     */
+    permissions?: string[] | null;
+}
+export interface UpdateRoleRequestBody {
+    /** @maxLength 255 */
+    description?: string;
+    /**
+     * @minLength 1
+     * @maxLength 64
+     */
+    name: string;
+    /** @nullable */
+    permissions?: string[] | null;
+}
+export type SSHKeyResourceStatus = (typeof SSHKeyResourceStatus)[keyof typeof SSHKeyResourceStatus];
+export declare const SSHKeyResourceStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly REVOKED: "REVOKED";
+};
+export interface SSHKeyResource {
+    created_at: string;
+    fingerprint: string;
+    /** The key the platform generates and holds. Its private key is not handed out */
+    has_private_key: boolean;
+    id: string;
+    key_type: string;
+    name: string;
+    /** Who the key belongs to. Absent means it belongs to the project itself */
+    owner_user_id?: string;
+    public_key: string;
+    /**
+     * A purpose label. The key the platform generates carries `platform`
+     * @nullable
+     */
+    purposes: string[] | null;
+    status: SSHKeyResourceStatus;
+}
+export interface LengthAwarePageSSHKeyResource {
+    /** The items in this page */
+    items: SSHKeyResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+/**
+ * Who this key belongs to
+ */
+export type CreateSSHKeyRequestBodyOwner = (typeof CreateSSHKeyRequestBodyOwner)[keyof typeof CreateSSHKeyRequestBodyOwner];
+export declare const CreateSSHKeyRequestBodyOwner: {
+    readonly me: "me";
+    readonly project: "project";
+};
+export interface CreateSSHKeyRequestBody {
+    /**
+     * @minLength 1
+     * @maxLength 128
+     */
+    name: string;
+    /** Who this key belongs to */
+    owner?: CreateSSHKeyRequestBodyOwner;
+    /**
+     * The public key in OpenSSH format. The type and the fingerprint are derived from it and cannot be changed
+     * @minLength 1
+     * @maxLength 16384
+     */
+    public_key: string;
+    /**
+     * A purpose label, such as ci or bastion
+     * @maxItems 16
+     * @nullable
+     */
+    purposes?: string[] | null;
+}
+export interface RenameSSHKeyRequestBody {
+    /**
+     * @minLength 1
+     * @maxLength 128
+     */
+    name: string;
+}
+/**
+ * Pagination metadata for stable numbered pages. total_count is returned only when the operation can determine it without an unbounded scan.
+ */
+export interface OffsetPagination {
+    /** @minimum 1 */
+    page: number;
+    /** @minimum 1 */
+    page_size: number;
+    /** @minimum 0 */
+    total_count?: number;
+}
+/**
+ * Pagination metadata for keyset traversal. Pass next_cursor as cursor to read the following page; null means there is no following page.
+ */
+export interface CursorPagination {
+    /** @minimum 1 */
+    page_size: number;
+    /** @nullable */
+    next_cursor?: string | null;
+}
+export type ListProjectInvitationsParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+};
+export type ListMembersParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+    /**
+     * Matches against user id, email address or name
+     * @maxLength 255
+     */
+    keyword?: string;
+};
+export type ListPoliciesParams = {
+    /**
+     * Restricts the result to one person. Omitting it covers the whole project
+     * @maxLength 255
+     */
+    userId?: string;
+};
+export type ListSshKeysParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+    /**
+     * Both kinds are returned while this is absent
+     */
+    status?: ListSshKeysStatus;
+    /**
+     * Lists only the keys carrying this purpose. The key the platform generates carries `platform`
+     * @maxLength 64
+     */
+    purpose?: string;
+};
+export type ListSshKeysStatus = (typeof ListSshKeysStatus)[keyof typeof ListSshKeysStatus];
+export declare const ListSshKeysStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly REVOKED: "REVOKED";
+};

package/dist/iam/v1/generated/models.js

@@ -0,0 +1,32 @@
+export const RuleResourceEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const ProjectTraitResourceEffect = {
+    NoWrite: "NoWrite",
+    NoAccess: "NoAccess",
+};
+export const PolicyResourceEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const AttachPolicyRequestBodyEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const UpdatePolicyRequestBodyEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const SSHKeyResourceStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};
+export const CreateSSHKeyRequestBodyOwner = {
+    me: "me",
+    project: "project",
+};
+export const ListSshKeysStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};

package/dist/iam/v1/generated/schemas.zod.d.ts

@@ -25,12 +25,13 @@ export declare const UpdateProjectBody: zod.ZodObject<{
  * @summary List the invitations this project is still waiting on
  */
 export declare const listProjectInvitationsQueryLimitDefault = 50;
-export declare const listProjectInvitationsQueryLimitMax = 100;
+export declare const listProjectInvitationsQueryLimitMax = 200;
+export declare const listProjectInvitationsQueryOffsetDefault = 0;
 export declare const listProjectInvitationsQueryOffsetMin = 0;
 export declare const listProjectInvitationsQueryOffsetMax = 10000;
 export declare const ListProjectInvitationsQueryParams: zod.ZodObject<{
     limit: zod.ZodDefault<zod.ZodInt>;
-    offset: zod.ZodOptional<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
 }, zod.z.core.$strict>;
 /**
  * An invitation stands for 14 days. The roles it carries are validated against the project as it stood when the invitation was sent, so it expires rather than outliving the arrangement it rests on.
@@ -61,13 +62,14 @@ export declare const BatchGetMembersBody: zod.ZodObject<{
  * @summary List the members of a project
  */
 export declare const listMembersQueryLimitDefault = 50;
-export declare const listMembersQueryLimitMax = 100;
+export declare const listMembersQueryLimitMax = 200;
+export declare const listMembersQueryOffsetDefault = 0;
 export declare const listMembersQueryOffsetMin = 0;
 export declare const listMembersQueryOffsetMax = 10000;
 export declare const listMembersQueryKeywordMax = 255;
 export declare const ListMembersQueryParams: zod.ZodObject<{
     limit: zod.ZodDefault<zod.ZodInt>;
-    offset: zod.ZodOptional<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
     keyword: zod.ZodOptional<zod.ZodString>;
 }, zod.z.core.$strict>;
 /**
@@ -209,13 +211,14 @@ export declare const DeleteRoleParams: zod.ZodObject<{
  * @summary List the SSH keys of this project
  */
 export declare const listSshKeysQueryLimitDefault = 50;
-export declare const listSshKeysQueryLimitMax = 100;
+export declare const listSshKeysQueryLimitMax = 200;
+export declare const listSshKeysQueryOffsetDefault = 0;
 export declare const listSshKeysQueryOffsetMin = 0;
 export declare const listSshKeysQueryOffsetMax = 10000;
 export declare const listSshKeysQueryPurposeMax = 64;
 export declare const ListSshKeysQueryParams: zod.ZodObject<{
     limit: zod.ZodDefault<zod.ZodInt>;
-    offset: zod.ZodOptional<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
     status: zod.ZodOptional<zod.ZodEnum<{
         ACTIVE: "ACTIVE";
         REVOKED: "REVOKED";