@leaflow/sdk 0.196.0 → 0.198.0

package/dist/routes.js

@@ -3836,7 +3836,7 @@ export const routes = [
         contract: "iam",
         method: "GET",
         path: "/api/v1/invitations",
-        operationId: "list-project-invitations",
+        operationId: "list-invitations",
         securityScheme: "ScopedToken",
         upstreamUrl: "https://iam.leaflow.cloud",
     },
@@ -3894,21 +3894,12 @@ export const routes = [
         securityScheme: "ScopedToken",
         upstreamUrl: "https://iam.leaflow.cloud",
     },
-    {
-        service: "iam",
-        contract: "iam",
-        method: "PUT",
-        path: "/api/v1/members/{userId}/permissions",
-        operationId: "set-member-permissions",
-        securityScheme: "ScopedToken",
-        upstreamUrl: "https://iam.leaflow.cloud",
-    },
     {
         service: "iam",
         contract: "iam",
         method: "GET",
-        path: "/api/v1/policies",
-        operationId: "list-policies",
+        path: "/api/v1/members/{userId}/permissions",
+        operationId: "list-member-permissions",
         securityScheme: "ScopedToken",
         upstreamUrl: "https://iam.leaflow.cloud",
     },
@@ -3916,26 +3907,8 @@ export const routes = [
         service: "iam",
         contract: "iam",
         method: "POST",
-        path: "/api/v1/policies",
-        operationId: "attach-policy",
-        securityScheme: "ScopedToken",
-        upstreamUrl: "https://iam.leaflow.cloud",
-    },
-    {
-        service: "iam",
-        contract: "iam",
-        method: "GET",
-        path: "/api/v1/policies/{policyId}",
-        operationId: "get-policy",
-        securityScheme: "ScopedToken",
-        upstreamUrl: "https://iam.leaflow.cloud",
-    },
-    {
-        service: "iam",
-        contract: "iam",
-        method: "PUT",
-        path: "/api/v1/policies/{policyId}",
-        operationId: "update-policy",
+        path: "/api/v1/members/{userId}/permissions",
+        operationId: "create-member-permission",
         securityScheme: "ScopedToken",
         upstreamUrl: "https://iam.leaflow.cloud",
     },
@@ -3943,8 +3916,8 @@ export const routes = [
         service: "iam",
         contract: "iam",
         method: "DELETE",
-        path: "/api/v1/policies/{policyId}",
-        operationId: "detach-policy",
+        path: "/api/v1/members/{userId}/permissions/{permissionId}",
+        operationId: "delete-member-permission",
         securityScheme: "ScopedToken",
         upstreamUrl: "https://iam.leaflow.cloud",
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leaflow/sdk",
-  "version": "0.196.0",
+  "version": "0.198.0",
   "description": "Leaflow 平台 API 的 TypeScript SDK",
   "license": "MIT",
   "repository": {

package/dist/iam/v1/generated/validators/attachPolicyRequestBody.zod.d.ts

@@ -1,33 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export declare const attachPolicyRequestBodyDescriptionMax = 255;
-export declare const attachPolicyRequestBodyUserIdMax = 255;
-export declare const AttachPolicyRequestBody: zod.ZodObject<{
-    description: zod.ZodOptional<zod.ZodString>;
-    effect: zod.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-    }>;
-    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        id: zod.ZodString;
-        type: zod.ZodString;
-    }, zod.z.core.$strict>>>>;
-    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    user_id: zod.ZodString;
-}, zod.z.core.$strict>;
-export type AttachPolicyRequestBody = zod.input<typeof AttachPolicyRequestBody>;
-export type AttachPolicyRequestBodyOutput = zod.output<typeof AttachPolicyRequestBody>;

package/dist/iam/v1/generated/validators/attachPolicyRequestBody.zod.js

@@ -1,43 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-import { ResourceRefResource } from "./resourceRefResource.zod.js";
-export const attachPolicyRequestBodyDescriptionMax = 255;
-export const attachPolicyRequestBodyUserIdMax = 255;
-export const AttachPolicyRequestBody = zod.strictObject({
-    description: zod
-        .string()
-        .max(attachPolicyRequestBodyDescriptionMax)
-        .optional()
-        .describe("Why it was granted, written for a reader"),
-    effect: zod.enum(["allow", "deny"]),
-    permissions: zod
-        .array(zod.string())
-        .nullish()
-        .describe("Permission names attached directly, which avoids creating a role only one person holds"),
-    resources: zod
-        .array(ResourceRefResource)
-        .nullish()
-        .describe("The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists"),
-    roles: zod
-        .array(zod.string())
-        .nullish()
-        .describe("Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions"),
-    user_id: zod
-        .string()
-        .min(1)
-        .max(attachPolicyRequestBodyUserIdMax)
-        .describe("Must already be a member of this project"),
-});

package/dist/iam/v1/generated/validators/catalogListResponseBody.zod.d.ts

@@ -1,30 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export declare const CatalogListResponseBody: zod.ZodObject<{
-    items: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        permissions: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-            name: zod.ZodString;
-            owner_only: zod.ZodBoolean;
-            resource_type: zod.ZodString;
-        }, zod.z.core.$strict>>>;
-        resource_types: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-            name: zod.ZodString;
-        }, zod.z.core.$strict>>>;
-        service: zod.ZodString;
-    }, zod.z.core.$strict>>>;
-}, zod.z.core.$strict>;
-export type CatalogListResponseBody = zod.input<typeof CatalogListResponseBody>;
-export type CatalogListResponseBodyOutput = zod.output<typeof CatalogListResponseBody>;

package/dist/iam/v1/generated/validators/catalogResource.zod.js

@@ -1,25 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-import { PermissionResource } from "./permissionResource.zod.js";
-import { ResourceTypeResource } from "./resourceTypeResource.zod.js";
-export const CatalogResource = zod.strictObject({
-    permissions: zod.array(PermissionResource).nullable(),
-    resource_types: zod
-        .array(ResourceTypeResource)
-        .nullable()
-        .describe("The resource types this service declares. A scoped rule can only land on one of them"),
-    service: zod.string(),
-});

package/dist/iam/v1/generated/validators/listPoliciesParams.zod.d.ts

@@ -1,21 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export declare const listPoliciesParamsUserIdMax = 255;
-export declare const ListPoliciesParams: zod.ZodObject<{
-    userId: zod.ZodOptional<zod.ZodString>;
-}, zod.z.core.$strict>;
-export type ListPoliciesParams = zod.input<typeof ListPoliciesParams>;
-export type ListPoliciesParamsOutput = zod.output<typeof ListPoliciesParams>;

package/dist/iam/v1/generated/validators/listPoliciesParams.zod.js

@@ -1,23 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export const listPoliciesParamsUserIdMax = 255;
-export const ListPoliciesParams = zod.strictObject({
-    userId: zod
-        .string()
-        .max(listPoliciesParamsUserIdMax)
-        .optional()
-        .describe("Restricts the result to one person. Omitting it covers the whole project"),
-});

package/dist/iam/v1/generated/validators/policyResource.zod.js

@@ -1,33 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-import { ResourceRefResource } from "./resourceRefResource.zod.js";
-export const PolicyResource = zod.strictObject({
-    base: zod
-        .boolean()
-        .describe("The base policy is the one whose effect is `allow` and which covers every resource. Each member holds exactly one, and it carries their ordinary roles. Change it with PUT /members/{userId}/roles and PUT /members/{userId}/permissions"),
-    created_at: zod.iso.datetime({ offset: true }),
-    description: zod.string().describe("Why it was granted, written for a reader"),
-    effect: zod.enum(["allow", "deny"]),
-    id: zod.uuid(),
-    permissions: zod
-        .array(zod.string())
-        .nullable()
-        .describe("Permission names attached directly to this person, without passing through a role"),
-    resources: zod.array(ResourceRefResource).nullable().describe("Empty means the whole project"),
-    roles: zod.array(zod.string()).nullable().describe("The role codes this policy carries"),
-    updated_at: zod.iso.datetime({ offset: true }),
-    user_id: zod.string(),
-});

package/dist/iam/v1/generated/validators/resourceTypeResource.zod.d.ts

@@ -1,20 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export declare const ResourceTypeResource: zod.ZodObject<{
-    name: zod.ZodString;
-}, zod.z.core.$strict>;
-export type ResourceTypeResource = zod.input<typeof ResourceTypeResource>;
-export type ResourceTypeResourceOutput = zod.output<typeof ResourceTypeResource>;

package/dist/iam/v1/generated/validators/resourceTypeResource.zod.js

@@ -1,20 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export const ResourceTypeResource = zod.strictObject({
-    name: zod
-        .string()
-        .describe("The code of the resource type, such as dns:zone. There is no display name here either; what it reads as is decided by the layer rendering it"),
-});

package/dist/iam/v1/generated/validators/setMemberPermissionsRequestBody.zod.d.ts

@@ -1,20 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export declare const SetMemberPermissionsRequestBody: zod.ZodObject<{
-    permissions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
-}, zod.z.core.$strict>;
-export type SetMemberPermissionsRequestBody = zod.input<typeof SetMemberPermissionsRequestBody>;
-export type SetMemberPermissionsRequestBodyOutput = zod.output<typeof SetMemberPermissionsRequestBody>;

package/dist/iam/v1/generated/validators/setMemberPermissionsRequestBody.zod.js

@@ -1,21 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-export const SetMemberPermissionsRequestBody = zod.strictObject({
-    permissions: zod
-        .array(zod.string())
-        .nullable()
-        .describe("**Every** permission name to be attached directly to this person, replaced in full. The permissions a role grants are neither listed here nor touched by this write"),
-});

package/dist/iam/v1/generated/validators/updatePolicyRequestBody.zod.js

@@ -1,39 +0,0 @@
-/**
- * Generated by orval 🍺
- * Do not edit manually.
- * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
- *
- * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
- * `projectId`, and the current project is the one the token states. Tokens are obtained from the
- * account API.
- *
- * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
- * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
- * OpenAPI spec version: 1.0.0
- */
-import * as zod from "zod";
-import { ResourceRefResource } from "./resourceRefResource.zod.js";
-export const updatePolicyRequestBodyDescriptionMax = 255;
-export const UpdatePolicyRequestBody = zod.strictObject({
-    description: zod
-        .string()
-        .max(updatePolicyRequestBodyDescriptionMax)
-        .optional()
-        .describe("Why it was granted, written for a reader. It is replaced together with the change, so that what remains does not explain an earlier version"),
-    effect: zod
-        .enum(["allow", "deny"])
-        .describe("Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE"),
-    permissions: zod
-        .array(zod.string())
-        .nullish()
-        .describe("Permission names attached directly, replaced in full. Anything not listed is withdrawn rather than kept"),
-    resources: zod
-        .array(ResourceRefResource)
-        .nullish()
-        .describe("The resource scope of this policy, replaced in full. What the scope contains can change; whether the policy has one cannot. A base policy cannot take a scope, and a scoped policy cannot have its scope cleared"),
-    roles: zod
-        .array(zod.string())
-        .nullish()
-        .describe("Each must be a role already defined in this project, replaced in full. As when attaching, `OWNER` and `ADMIN` are not accepted"),
-});