@leaflow/sdk 0.197.0 → 0.198.0

package/dist/iam/v1/generated/models.d.ts

@@ -79,23 +79,9 @@ export interface PermissionResource {
     /** The kind of resource this permission is decided against; empty means it is decided at project level. **It need not be the object being operated on** — a compute route carries no project_id and is isolated through its parent network, so compute:route.create is decided against compute:private_network. A non-empty value also means the permission can be scoped to particular instances; create and list are always empty */
     resource_type: string;
 }
-export interface ResourceTypeResource {
-    /** The code of the resource type, such as dns:zone. There is no display name here either; what it reads as is decided by the layer rendering it */
-    name: string;
-}
-export interface CatalogResource {
-    /** @nullable */
-    permissions: PermissionResource[] | null;
-    /**
-     * The resource types this service declares. A scoped rule can only land on one of them
-     * @nullable
-     */
-    resource_types: ResourceTypeResource[] | null;
-    service: string;
-}
-export interface CatalogListResponseBody {
+export interface PermissionListResponseBody {
     /** @nullable */
-    items: CatalogResource[] | null;
+    items: PermissionResource[] | null;
 }
 export interface ResourceRefResource {
     /** A string rather than a UUID; a DNS zone is named by its domain, which IAM does not hold. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly */
@@ -130,7 +116,7 @@ export interface GrantResource {
      */
     roles: string[] | null;
     /**
-     * **The rules compiled from every policy that applies. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it
+     * **The rules compiled from the roles and grants that apply. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it
      * @nullable
      */
     rules: RuleResource[] | null;
@@ -281,6 +267,35 @@ export interface BatchGetMembersResponseBody {
     /** The people that resolved. Ids that never belonged to this project are absent, as are ids that do not resolve at all. */
     items: ResolvedMemberResource[];
 }
+export type MemberPermissionResourceEffect = (typeof MemberPermissionResourceEffect)[keyof typeof MemberPermissionResourceEffect];
+export declare const MemberPermissionResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface MemberPermissionResource {
+    /** The id of this grant, used to revoke it */
+    id: string;
+    /**
+     * The code of the permission, such as compute:instance.delete
+     * @maxLength 128
+     */
+    permission: string;
+    effect: MemberPermissionResourceEffect;
+    /**
+     * The kind of resource this grant holds on, such as fleet:machine. Null with `resource_id` means it holds project-wide
+     * @maxLength 128
+     * @nullable
+     */
+    resource_type: string | null;
+    /**
+     * The resource identifier, which may carry a glob. Null with `resource_type` means the grant holds project-wide
+     * @maxLength 255
+     * @nullable
+     */
+    resource_id: string | null;
+    created_at: string;
+    updated_at: string;
+}
 export interface MemberResource {
     /** MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
     avatar_hash: string;
@@ -290,6 +305,11 @@ export interface MemberResource {
     first_name: string;
     grant: GrantResource;
     last_name: string;
+    /**
+     * The permissions granted to this person directly, apart from their roles
+     * @nullable
+     */
+    permissions: MemberPermissionResource[] | null;
     user_id: string;
 }
 export interface LengthAwarePageMemberResource {
@@ -309,113 +329,35 @@ export interface SetMemberRolesRequestBody {
      */
     roles: string[] | null;
 }
-export interface SetMemberPermissionsRequestBody {
-    /**
-     * **Every** permission name to be attached directly to this person, replaced in full. The permissions a role grants are neither listed here nor touched by this write
-     * @nullable
-     */
-    permissions: string[] | null;
-}
-export type PolicyResourceEffect = (typeof PolicyResourceEffect)[keyof typeof PolicyResourceEffect];
-export declare const PolicyResourceEffect: {
-    readonly allow: "allow";
-    readonly deny: "deny";
-};
-export interface PolicyResource {
-    /** The base policy is the one whose effect is `allow` and which covers every resource. Each member holds exactly one, and it carries their ordinary roles. Change it with PUT /members/{userId}/roles and PUT /members/{userId}/permissions */
-    base: boolean;
-    created_at: string;
-    /** Why it was granted, written for a reader */
-    description: string;
-    effect: PolicyResourceEffect;
-    id: string;
-    /**
-     * Permission names attached directly to this person, without passing through a role
-     * @nullable
-     */
-    permissions: string[] | null;
-    /**
-     * Empty means the whole project
-     * @nullable
-     */
-    resources: ResourceRefResource[] | null;
-    /**
-     * The role codes this policy carries
-     * @nullable
-     */
-    roles: string[] | null;
-    updated_at: string;
-    user_id: string;
-}
-export interface PolicyListResponseBody {
+export interface MemberPermissionListResponseBody {
     /** @nullable */
-    items: PolicyResource[] | null;
+    items: MemberPermissionResource[] | null;
 }
-export type AttachPolicyRequestBodyEffect = (typeof AttachPolicyRequestBodyEffect)[keyof typeof AttachPolicyRequestBodyEffect];
-export declare const AttachPolicyRequestBodyEffect: {
+export type CreateMemberPermissionRequestBodyEffect = (typeof CreateMemberPermissionRequestBodyEffect)[keyof typeof CreateMemberPermissionRequestBodyEffect];
+export declare const CreateMemberPermissionRequestBodyEffect: {
     readonly allow: "allow";
     readonly deny: "deny";
 };
-export interface AttachPolicyRequestBody {
-    /**
-     * Why it was granted, written for a reader
-     * @maxLength 255
-     */
-    description?: string;
-    effect: AttachPolicyRequestBodyEffect;
-    /**
-     * Permission names attached directly, which avoids creating a role only one person holds
-     * @nullable
-     */
-    permissions?: string[] | null;
-    /**
-     * The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists
-     * @nullable
-     */
-    resources?: ResourceRefResource[] | null;
-    /**
-     * Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions
-     * @nullable
-     */
-    roles?: string[] | null;
+export interface CreateMemberPermissionRequestBody {
     /**
-     * Must already be a member of this project
+     * The code of the permission to grant
      * @minLength 1
-     * @maxLength 255
-     */
-    user_id: string;
-}
-/**
- * Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE
- */
-export type UpdatePolicyRequestBodyEffect = (typeof UpdatePolicyRequestBodyEffect)[keyof typeof UpdatePolicyRequestBodyEffect];
-export declare const UpdatePolicyRequestBodyEffect: {
-    readonly allow: "allow";
-    readonly deny: "deny";
-};
-export interface UpdatePolicyRequestBody {
-    /**
-     * Why it was granted, written for a reader. It is replaced together with the change, so that what remains does not explain an earlier version
-     * @maxLength 255
-     */
-    description?: string;
-    /** Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE */
-    effect: UpdatePolicyRequestBodyEffect;
-    /**
-     * Permission names attached directly, replaced in full. Anything not listed is withdrawn rather than kept
-     * @nullable
+     * @maxLength 128
      */
-    permissions?: string[] | null;
+    permission: string;
+    effect: CreateMemberPermissionRequestBodyEffect;
     /**
-     * The resource scope of this policy, replaced in full. What the scope contains can change; whether the policy has one cannot. A base policy cannot take a scope, and a scoped policy cannot have its scope cleared
+     * The kind of resource to hold on; give it together with `resource_id`. Both null grant the permission project-wide
+     * @maxLength 128
      * @nullable
      */
-    resources?: ResourceRefResource[] | null;
+    resource_type: string | null;
     /**
-     * Each must be a role already defined in this project, replaced in full. As when attaching, `OWNER` and `ADMIN` are not accepted
+     * The resource identifier to hold on, which may carry a glob. Give it together with `resource_type`
+     * @maxLength 255
      * @nullable
      */
-    roles?: string[] | null;
+    resource_id: string | null;
 }
 export interface TransferOwnershipRequestBody {
     /**
@@ -637,7 +579,7 @@ export interface CursorPagination {
     /** @nullable */
     next_cursor?: string | null;
 }
-export type ListProjectInvitationsParams = {
+export type ListInvitationsParams = {
     /**
      * Items returned in this page. Defaults to 50; at most 200.
      * @minimum 1
@@ -670,13 +612,6 @@ export type ListMembersParams = {
      */
     keyword?: string;
 };
-export type ListPoliciesParams = {
-    /**
-     * Restricts the result to one person. Omitting it covers the whole project
-     * @maxLength 255
-     */
-    userId?: string;
-};
 export type ListSshKeysParams = {
     /**
      * Items returned in this page. Defaults to 50; at most 200.

package/dist/iam/v1/generated/models.js

@@ -11,15 +11,11 @@ export const ProjectResourceStatus = {
     deleting: "deleting",
     deleted: "deleted",
 };
-export const PolicyResourceEffect = {
+export const MemberPermissionResourceEffect = {
     allow: "allow",
     deny: "deny",
 };
-export const AttachPolicyRequestBodyEffect = {
-    allow: "allow",
-    deny: "deny",
-};
-export const UpdatePolicyRequestBodyEffect = {
+export const CreateMemberPermissionRequestBodyEffect = {
     allow: "allow",
     deny: "deny",
 };

package/dist/iam/v1/generated/schemas.zod.d.ts

@@ -41,12 +41,12 @@ export declare const SetProjectSlugBody: zod.ZodObject<{
  * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
  * @summary List the invitations this project is still waiting on
  */
-export declare const listProjectInvitationsQueryLimitDefault = 50;
-export declare const listProjectInvitationsQueryLimitMax = 200;
-export declare const listProjectInvitationsQueryOffsetDefault = 0;
-export declare const listProjectInvitationsQueryOffsetMin = 0;
-export declare const listProjectInvitationsQueryOffsetMax = 10000;
-export declare const ListProjectInvitationsQueryParams: zod.ZodObject<{
+export declare const listInvitationsQueryLimitDefault = 50;
+export declare const listInvitationsQueryLimitMax = 200;
+export declare const listInvitationsQueryOffsetDefault = 0;
+export declare const listInvitationsQueryOffsetMin = 0;
+export declare const listInvitationsQueryOffsetMax = 10000;
+export declare const ListInvitationsQueryParams: zod.ZodObject<{
     limit: zod.ZodDefault<zod.ZodInt>;
     offset: zod.ZodDefault<zod.ZodInt>;
 }, zod.z.core.$strict>;
@@ -109,75 +109,44 @@ export declare const SetMemberRolesBody: zod.ZodObject<{
     roles: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
 }, zod.z.core.$strict>;
 /**
- * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
- * @summary Set the permissions attached directly to a member
+ * Every row states one permission this person holds apart from their roles: project-wide when `resource_type` and `resource_id` are null, otherwise only on that resource. What a role grants is not listed here; the member's grant carries the roles and their compiled rules.
+ *
+ * Visible to any member, on the same rule as the member list.
+ * @summary List the permissions granted directly to a member
  */
-export declare const setMemberPermissionsPathUserIdMax = 255;
-export declare const SetMemberPermissionsParams: zod.ZodObject<{
+export declare const listMemberPermissionsPathUserIdMax = 255;
+export declare const ListMemberPermissionsParams: zod.ZodObject<{
     userId: zod.ZodString;
 }, zod.z.core.$strict>;
-export declare const SetMemberPermissionsBody: zod.ZodObject<{
-    permissions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
-}, zod.z.core.$strict>;
-/**
- * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
- * @summary List the policies in this project
- */
-export declare const listPoliciesQueryUserIdMax = 255;
-export declare const ListPoliciesQueryParams: zod.ZodObject<{
-    userId: zod.ZodOptional<zod.ZodString>;
-}, zod.z.core.$strict>;
 /**
- * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
- * @summary Attach a policy
- */
-export declare const AttachPolicyBody: zod.ZodObject<{
-    description: zod.ZodOptional<zod.ZodString>;
-    effect: zod.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-    }>;
-    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        id: zod.ZodString;
-        type: zod.ZodString;
-    }, zod.z.core.$strict>>>>;
-    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    user_id: zod.ZodString;
-}, zod.z.core.$strict>;
-/**
- * Visible to any member, on the same rule as list-policies; no further permission is required.
- * @summary Get a policy
- */
-export declare const GetPolicyParams: zod.ZodObject<{
-    policyId: zod.ZodUUID;
-}, zod.z.core.$strict>;
-/**
- * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
- * @summary Update a policy
+ * Creates one permission row. The same row twice answers 409; changing a grant means revoking the row and creating another, so that each row records when it was granted.
+ *
+ * `OWNER` and `ADMIN` cannot be granted here, being facts on the membership. A permission that carries no resource dimension cannot be scoped: IAM refuses the row at grant time rather than storing a scope that would never hold.
+ *
+ * Requires `iam:members.manage`.
+ * @summary Grant a permission to a member
  */
-export declare const UpdatePolicyParams: zod.ZodObject<{
-    policyId: zod.ZodUUID;
+export declare const createMemberPermissionPathUserIdMax = 255;
+export declare const CreateMemberPermissionParams: zod.ZodObject<{
+    userId: zod.ZodString;
 }, zod.z.core.$strict>;
-export declare const UpdatePolicyBody: zod.ZodObject<{
-    description: zod.ZodOptional<zod.ZodString>;
+export declare const CreateMemberPermissionBody: zod.ZodObject<{
+    permission: zod.ZodString;
     effect: zod.ZodEnum<{
         allow: "allow";
         deny: "deny";
     }>;
-    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        id: zod.ZodString;
-        type: zod.ZodString;
-    }, zod.z.core.$strict>>>>;
-    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    resource_type: zod.ZodNullable<zod.ZodString>;
+    resource_id: zod.ZodNullable<zod.ZodString>;
 }, zod.z.core.$strict>;
 /**
- * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
- * @summary Detach a policy
+ * Removes that one row. Requires `iam:members.manage`.
+ * @summary Revoke a permission granted directly to a member
  */
-export declare const DetachPolicyParams: zod.ZodObject<{
-    policyId: zod.ZodUUID;
+export declare const deleteMemberPermissionPathUserIdMax = 255;
+export declare const DeleteMemberPermissionParams: zod.ZodObject<{
+    userId: zod.ZodString;
+    permissionId: zod.ZodUUID;
 }, zod.z.core.$strict>;
 /**
  * The only way `OWNER` moves, and only the owner can initiate it.

package/dist/iam/v1/generated/schemas.zod.js

@@ -13,19 +13,17 @@
  * OpenAPI spec version: 1.0.0
  */
 import * as zod from "zod";
-import { AttachPolicyRequestBody } from "./validators/attachPolicyRequestBody.zod.js";
 import { BatchGetMembersRequestBody } from "./validators/batchGetMembersRequestBody.zod.js";
 import { CreateApplicationRequestBody } from "./validators/createApplicationRequestBody.zod.js";
+import { CreateMemberPermissionRequestBody } from "./validators/createMemberPermissionRequestBody.zod.js";
 import { CreateRoleRequestBody } from "./validators/createRoleRequestBody.zod.js";
 import { CreateSSHKeyRequestBody } from "./validators/createSSHKeyRequestBody.zod.js";
 import { IssueInvitationRequestBody } from "./validators/issueInvitationRequestBody.zod.js";
 import { RenameSSHKeyRequestBody } from "./validators/renameSSHKeyRequestBody.zod.js";
-import { SetMemberPermissionsRequestBody } from "./validators/setMemberPermissionsRequestBody.zod.js";
 import { SetMemberRolesRequestBody } from "./validators/setMemberRolesRequestBody.zod.js";
 import { SetProjectSlugRequestBody } from "./validators/setProjectSlugRequestBody.zod.js";
 import { TransferOwnershipRequestBody } from "./validators/transferOwnershipRequestBody.zod.js";
 import { UpdateApplicationRequestBody } from "./validators/updateApplicationRequestBody.zod.js";
-import { UpdatePolicyRequestBody } from "./validators/updatePolicyRequestBody.zod.js";
 import { UpdateProjectRequestBody } from "./validators/updateProjectRequestBody.zod.js";
 import { UpdateRoleRequestBody } from "./validators/updateRoleRequestBody.zod.js";
 /**
@@ -51,23 +49,23 @@ export const SetProjectSlugBody = SetProjectSlugRequestBody;
  * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
  * @summary List the invitations this project is still waiting on
  */
-export const listProjectInvitationsQueryLimitDefault = 50;
-export const listProjectInvitationsQueryLimitMax = 200;
-export const listProjectInvitationsQueryOffsetDefault = 0;
-export const listProjectInvitationsQueryOffsetMin = 0;
-export const listProjectInvitationsQueryOffsetMax = 10000;
-export const ListProjectInvitationsQueryParams = zod.strictObject({
+export const listInvitationsQueryLimitDefault = 50;
+export const listInvitationsQueryLimitMax = 200;
+export const listInvitationsQueryOffsetDefault = 0;
+export const listInvitationsQueryOffsetMin = 0;
+export const listInvitationsQueryOffsetMax = 10000;
+export const ListInvitationsQueryParams = zod.strictObject({
     limit: zod
         .int()
         .min(1)
-        .max(listProjectInvitationsQueryLimitMax)
-        .default(listProjectInvitationsQueryLimitDefault)
+        .max(listInvitationsQueryLimitMax)
+        .default(listInvitationsQueryLimitDefault)
         .describe("Items returned in this page. Defaults to 50; at most 200."),
     offset: zod
         .int()
-        .min(listProjectInvitationsQueryOffsetMin)
-        .max(listProjectInvitationsQueryOffsetMax)
-        .default(listProjectInvitationsQueryOffsetDefault)
+        .min(listInvitationsQueryOffsetMin)
+        .max(listInvitationsQueryOffsetMax)
+        .default(listInvitationsQueryOffsetDefault)
         .describe("Items to skip. Defaults to 0; at most 10000."),
 });
 /**
@@ -136,52 +134,36 @@ export const SetMemberRolesParams = zod.strictObject({
 });
 export const SetMemberRolesBody = SetMemberRolesRequestBody;
 /**
- * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
- * @summary Set the permissions attached directly to a member
- */
-export const setMemberPermissionsPathUserIdMax = 255;
-export const SetMemberPermissionsParams = zod.strictObject({
-    userId: zod.string().max(setMemberPermissionsPathUserIdMax),
-});
-export const SetMemberPermissionsBody = SetMemberPermissionsRequestBody;
-/**
- * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
- * @summary List the policies in this project
- */
-export const listPoliciesQueryUserIdMax = 255;
-export const ListPoliciesQueryParams = zod.strictObject({
-    userId: zod
-        .string()
-        .max(listPoliciesQueryUserIdMax)
-        .optional()
-        .describe("Restricts the result to one person. Omitting it covers the whole project"),
-});
-/**
- * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
- * @summary Attach a policy
- */
-export const AttachPolicyBody = AttachPolicyRequestBody;
-/**
- * Visible to any member, on the same rule as list-policies; no further permission is required.
- * @summary Get a policy
+ * Every row states one permission this person holds apart from their roles: project-wide when `resource_type` and `resource_id` are null, otherwise only on that resource. What a role grants is not listed here; the member's grant carries the roles and their compiled rules.
+ *
+ * Visible to any member, on the same rule as the member list.
+ * @summary List the permissions granted directly to a member
  */
-export const GetPolicyParams = zod.strictObject({
-    policyId: zod.uuid(),
+export const listMemberPermissionsPathUserIdMax = 255;
+export const ListMemberPermissionsParams = zod.strictObject({
+    userId: zod.string().max(listMemberPermissionsPathUserIdMax),
 });
 /**
- * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
- * @summary Update a policy
+ * Creates one permission row. The same row twice answers 409; changing a grant means revoking the row and creating another, so that each row records when it was granted.
+ *
+ * `OWNER` and `ADMIN` cannot be granted here, being facts on the membership. A permission that carries no resource dimension cannot be scoped: IAM refuses the row at grant time rather than storing a scope that would never hold.
+ *
+ * Requires `iam:members.manage`.
+ * @summary Grant a permission to a member
  */
-export const UpdatePolicyParams = zod.strictObject({
-    policyId: zod.uuid(),
+export const createMemberPermissionPathUserIdMax = 255;
+export const CreateMemberPermissionParams = zod.strictObject({
+    userId: zod.string().max(createMemberPermissionPathUserIdMax),
 });
-export const UpdatePolicyBody = UpdatePolicyRequestBody;
+export const CreateMemberPermissionBody = CreateMemberPermissionRequestBody;
 /**
- * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
- * @summary Detach a policy
+ * Removes that one row. Requires `iam:members.manage`.
+ * @summary Revoke a permission granted directly to a member
  */
-export const DetachPolicyParams = zod.strictObject({
-    policyId: zod.uuid(),
+export const deleteMemberPermissionPathUserIdMax = 255;
+export const DeleteMemberPermissionParams = zod.strictObject({
+    userId: zod.string().max(deleteMemberPermissionPathUserIdMax),
+    permissionId: zod.uuid(),
 });
 /**
  * The only way `OWNER` moves, and only the owner can initiate it.

package/dist/iam/v1/generated/validators/{updatePolicyRequestBody.zod.d.ts → createMemberPermissionRequestBody.zod.d.ts}

@@ -13,19 +13,17 @@
  * OpenAPI spec version: 1.0.0
  */
 import * as zod from "zod";
-export declare const updatePolicyRequestBodyDescriptionMax = 255;
-export declare const UpdatePolicyRequestBody: zod.ZodObject<{
-    description: zod.ZodOptional<zod.ZodString>;
+export declare const createMemberPermissionRequestBodyPermissionMax = 128;
+export declare const createMemberPermissionRequestBodyResourceTypeMax = 128;
+export declare const createMemberPermissionRequestBodyResourceIdMax = 255;
+export declare const CreateMemberPermissionRequestBody: zod.ZodObject<{
+    permission: zod.ZodString;
     effect: zod.ZodEnum<{
         allow: "allow";
         deny: "deny";
     }>;
-    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        id: zod.ZodString;
-        type: zod.ZodString;
-    }, zod.z.core.$strict>>>>;
-    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    resource_type: zod.ZodNullable<zod.ZodString>;
+    resource_id: zod.ZodNullable<zod.ZodString>;
 }, zod.z.core.$strict>;
-export type UpdatePolicyRequestBody = zod.input<typeof UpdatePolicyRequestBody>;
-export type UpdatePolicyRequestBodyOutput = zod.output<typeof UpdatePolicyRequestBody>;
+export type CreateMemberPermissionRequestBody = zod.input<typeof CreateMemberPermissionRequestBody>;
+export type CreateMemberPermissionRequestBodyOutput = zod.output<typeof CreateMemberPermissionRequestBody>;

package/dist/iam/v1/generated/validators/createMemberPermissionRequestBody.zod.js

@@ -0,0 +1,36 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const createMemberPermissionRequestBodyPermissionMax = 128;
+export const createMemberPermissionRequestBodyResourceTypeMax = 128;
+export const createMemberPermissionRequestBodyResourceIdMax = 255;
+export const CreateMemberPermissionRequestBody = zod.strictObject({
+    permission: zod
+        .string()
+        .min(1)
+        .max(createMemberPermissionRequestBodyPermissionMax)
+        .describe("The code of the permission to grant"),
+    effect: zod.enum(["allow", "deny"]),
+    resource_type: zod
+        .string()
+        .max(createMemberPermissionRequestBodyResourceTypeMax)
+        .nullable()
+        .describe("The kind of resource to hold on; give it together with `resource_id`. Both null grant the permission project-wide"),
+    resource_id: zod
+        .string()
+        .max(createMemberPermissionRequestBodyResourceIdMax)
+        .nullable()
+        .describe("The resource identifier to hold on, which may carry a glob. Give it together with `resource_type`"),
+});

package/dist/iam/v1/generated/validators/grantResource.zod.js

@@ -21,5 +21,5 @@ export const GrantResource = zod.strictObject({
     rules: zod
         .array(RuleResource)
         .nullable()
-        .describe("**The rules compiled from every policy that applies. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it"),
+        .describe("**The rules compiled from the roles and grants that apply. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it"),
 });

package/dist/iam/v1/generated/validators/lengthAwarePageMemberResource.zod.d.ts

@@ -37,6 +37,18 @@ export declare const LengthAwarePageMemberResource: zod.ZodObject<{
             }, zod.z.core.$strict>>>;
         }, zod.z.core.$strict>;
         last_name: zod.ZodString;
+        permissions: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+            id: zod.ZodUUID;
+            permission: zod.ZodString;
+            effect: zod.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>;
+            resource_type: zod.ZodNullable<zod.ZodString>;
+            resource_id: zod.ZodNullable<zod.ZodString>;
+            created_at: zod.z.ZodISODateTime;
+            updated_at: zod.z.ZodISODateTime;
+        }, zod.z.core.$strict>>>;
         user_id: zod.ZodString;
     }, zod.z.core.$strict>>;
     limit: zod.ZodInt;

package/dist/iam/v1/generated/validators/{listProjectInvitationsParams.zod.d.ts → listInvitationsParams.zod.d.ts}

@@ -13,14 +13,14 @@
  * OpenAPI spec version: 1.0.0
  */
 import * as zod from "zod";
-export declare const listProjectInvitationsParamsLimitDefault = 50;
-export declare const listProjectInvitationsParamsLimitMax = 200;
-export declare const listProjectInvitationsParamsOffsetDefault = 0;
-export declare const listProjectInvitationsParamsOffsetMin = 0;
-export declare const listProjectInvitationsParamsOffsetMax = 10000;
-export declare const ListProjectInvitationsParams: zod.ZodObject<{
+export declare const listInvitationsParamsLimitDefault = 50;
+export declare const listInvitationsParamsLimitMax = 200;
+export declare const listInvitationsParamsOffsetDefault = 0;
+export declare const listInvitationsParamsOffsetMin = 0;
+export declare const listInvitationsParamsOffsetMax = 10000;
+export declare const ListInvitationsParams: zod.ZodObject<{
     limit: zod.ZodDefault<zod.ZodInt>;
     offset: zod.ZodDefault<zod.ZodInt>;
 }, zod.z.core.$strict>;
-export type ListProjectInvitationsParams = zod.input<typeof ListProjectInvitationsParams>;
-export type ListProjectInvitationsParamsOutput = zod.output<typeof ListProjectInvitationsParams>;
+export type ListInvitationsParams = zod.input<typeof ListInvitationsParams>;
+export type ListInvitationsParamsOutput = zod.output<typeof ListInvitationsParams>;