@miosa/sdk 1.2.5 → 1.2.7

package/src/resources/egress.test.ts

@@ -1,318 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { HttpClient } from "../http.js";
-import { EgressAudit, SandboxAudit } from "./egressAudit.js";
-import { EgressNetwork, SandboxNetwork } from "./egressNetwork.js";
-import { EgressSecrets, OAuthFlow, SandboxSecrets } from "./egressSecrets.js";
-
-const mockGet = vi.fn();
-const mockPost = vi.fn();
-const mockPatch = vi.fn();
-const mockDelete = vi.fn();
-const mockRequest = vi.fn();
-const mockStream = vi.fn();
-const mockGetBinary = vi.fn();
-
-function makeHttp(): HttpClient {
-  const http = {} as HttpClient;
-  http.get = mockGet;
-  http.post = mockPost;
-  http.patch = mockPatch;
-  http.delete = mockDelete;
-  http.request = mockRequest;
-  http.stream = mockStream;
-  http.getBinary = mockGetBinary;
-  return http;
-}
-
-beforeEach(() => {
-  vi.clearAllMocks();
-});
-
-// ─── client.secrets ──────────────────────────────────────────────────────────
-
-describe("EgressSecrets", () => {
-  it("set() POSTs to /egress/secrets with the right body", async () => {
-    mockPost.mockResolvedValue({
-      data: { id: "sec_1", name: "OPENAI_API_KEY" },
-    });
-
-    const client = new EgressSecrets(makeHttp());
-    const secret = await client.set({
-      name: "OPENAI_API_KEY",
-      value: "sk-abc123",
-      type: "api_key",
-      scope: "user",
-      exposeAsEnv: "OPENAI_API_KEY",
-    });
-
-    expect(mockPost).toHaveBeenCalledWith("/egress/secrets", {
-      name: "OPENAI_API_KEY",
-      value: "sk-abc123",
-      type: "api_key",
-      scope: "user",
-      expose_as_env: "OPENAI_API_KEY",
-    });
-    expect(secret.id).toBe("sec_1");
-  });
-
-  it("list({ scope: 'user' }) GETs /egress/secrets?scope=user", async () => {
-    mockGet.mockResolvedValue({ data: [{ id: "sec_1" }, { id: "sec_2" }] });
-
-    const result = await new EgressSecrets(makeHttp()).list({ scope: "user" });
-
-    expect(mockGet).toHaveBeenCalledWith("/egress/secrets", { scope: "user" });
-    expect(result).toHaveLength(2);
-  });
-
-  it("get() calls /egress/secrets/:id", async () => {
-    mockGet.mockResolvedValue({ data: { id: "sec_1" } });
-    await new EgressSecrets(makeHttp()).get("sec_1");
-    expect(mockGet).toHaveBeenCalledWith("/egress/secrets/sec_1");
-  });
-
-  it("rotate() PATCHes /egress/secrets/:id with new value", async () => {
-    mockPatch.mockResolvedValue({ data: { id: "sec_1" } });
-    await new EgressSecrets(makeHttp()).rotate("sec_1", {
-      newValue: "sk-new",
-      expiresAt: "2027-01-01T00:00:00Z",
-    });
-    expect(mockPatch).toHaveBeenCalledWith("/egress/secrets/sec_1", {
-      value: "sk-new",
-      expires_at: "2027-01-01T00:00:00Z",
-    });
-  });
-
-  it("delete() DELETEs /egress/secrets/:id", async () => {
-    mockDelete.mockResolvedValue(undefined);
-    await new EgressSecrets(makeHttp()).delete("sec_1");
-    expect(mockDelete).toHaveBeenCalledWith("/egress/secrets/sec_1");
-  });
-
-  it("connect() returns an OAuthFlow with authorizeUrl + state", async () => {
-    mockPost.mockResolvedValue({
-      data: {
-        authorize_url: "https://github.com/login/oauth/authorize?state=xyz",
-        state: "xyz",
-      },
-    });
-
-    const flow = await new EgressSecrets(makeHttp()).connect({
-      provider: "github",
-      exposeAsEnv: "GITHUB_TOKEN",
-    });
-
-    expect(mockPost).toHaveBeenCalledWith("/egress/oauth/start", {
-      provider: "github",
-      expose_as_env: "GITHUB_TOKEN",
-    });
-    expect(flow).toBeInstanceOf(OAuthFlow);
-    expect(flow.authorizeUrl).toBe(
-      "https://github.com/login/oauth/authorize?state=xyz",
-    );
-    expect(flow.state).toBe("xyz");
-  });
-
-  it("OAuthFlow.waitForCompletion polls /egress/oauth/status", async () => {
-    mockPost.mockResolvedValue({
-      data: { authorize_url: "https://example.com", state: "xyz" },
-    });
-    mockGet.mockResolvedValueOnce({
-      data: { status: "completed", secret_id: "sec_new" },
-    });
-
-    const flow = await new EgressSecrets(makeHttp()).connect({
-      provider: "github",
-    });
-    const result = await flow.waitForCompletion({
-      timeoutSec: 2,
-      pollIntervalMs: 1,
-    });
-
-    expect(mockGet).toHaveBeenCalledWith("/egress/oauth/status", {
-      state: "xyz",
-    });
-    expect(result.status).toBe("completed");
-  });
-
-  it("createBinding() POSTs to /egress/bindings", async () => {
-    mockPost.mockResolvedValue({ data: { id: "bnd_1" } });
-    await new EgressSecrets(makeHttp()).createBinding({
-      secretId: "sec_1",
-      resourceId: "sbx_1",
-      resourceType: "sandbox",
-      exposeAsEnv: "OPENAI_API_KEY",
-    });
-    expect(mockPost).toHaveBeenCalledWith("/egress/bindings", {
-      secret_id: "sec_1",
-      resource_id: "sbx_1",
-      resource_type: "sandbox",
-      expose_as_env: "OPENAI_API_KEY",
-    });
-  });
-
-  it("providers() GETs /egress/oauth/providers", async () => {
-    mockGet.mockResolvedValue({
-      data: [{ name: "github" }, { name: "slack" }],
-    });
-    const out = await new EgressSecrets(makeHttp()).providers();
-    expect(mockGet).toHaveBeenCalledWith("/egress/oauth/providers");
-    expect(out).toHaveLength(2);
-  });
-});
-
-// ─── client.network ──────────────────────────────────────────────────────────
-
-describe("EgressNetwork", () => {
-  it("allow() POSTs to /egress/allowlist with effect=allow", async () => {
-    mockPost.mockResolvedValue({ data: { id: "rul_1" } });
-    await new EgressNetwork(makeHttp()).allow("api.openai.com", {
-      methods: ["GET", "POST"],
-      pathGlob: "/v1/*",
-    });
-    expect(mockPost).toHaveBeenCalledWith("/egress/allowlist", {
-      host: "api.openai.com",
-      effect: "allow",
-      methods: ["GET", "POST"],
-      path_glob: "/v1/*",
-    });
-  });
-
-  it("deny() POSTs with effect=deny", async () => {
-    mockPost.mockResolvedValue({ data: { id: "rul_2" } });
-    await new EgressNetwork(makeHttp()).deny("169.254.169.254");
-    expect(mockPost).toHaveBeenCalledWith("/egress/allowlist", {
-      host: "169.254.169.254",
-      effect: "deny",
-    });
-  });
-
-  it("lockdown() PATCHes /egress/policies with mode=enforce", async () => {
-    mockPatch.mockResolvedValue({ data: {} });
-    await new EgressNetwork(makeHttp()).lockdown();
-    expect(mockPatch).toHaveBeenCalledWith("/egress/policies", {
-      mode: "enforce",
-    });
-  });
-
-  it("observe() PATCHes /egress/policies with mode=audit_only", async () => {
-    mockPatch.mockResolvedValue({ data: {} });
-    await new EgressNetwork(makeHttp()).observe();
-    expect(mockPatch).toHaveBeenCalledWith("/egress/policies", {
-      mode: "audit_only",
-    });
-  });
-
-  it("suggestions() GETs /egress/audit/suggestions with resource_id", async () => {
-    mockGet.mockResolvedValue({ data: [] });
-    await new EgressNetwork(makeHttp()).suggestions({
-      resourceId: "sbx_1",
-      since: "1d",
-    });
-    expect(mockGet).toHaveBeenCalledWith("/egress/audit/suggestions", {
-      resource_id: "sbx_1",
-      since: "1d",
-    });
-  });
-
-  it("policies() GETs /egress/policies", async () => {
-    mockGet.mockResolvedValue({ data: [{ id: "pol_1" }] });
-    const out = await new EgressNetwork(makeHttp()).policies();
-    expect(mockGet).toHaveBeenCalledWith("/egress/policies", {});
-    expect(out).toHaveLength(1);
-  });
-
-  it("removeRule() DELETEs /egress/allowlist/:id", async () => {
-    mockDelete.mockResolvedValue(undefined);
-    await new EgressNetwork(makeHttp()).removeRule("rul_1");
-    expect(mockDelete).toHaveBeenCalledWith("/egress/allowlist/rul_1");
-  });
-});
-
-// ─── client.audit ────────────────────────────────────────────────────────────
-
-describe("EgressAudit", () => {
-  it("list() GETs /egress/audit", async () => {
-    mockGet.mockResolvedValue({
-      data: [
-        { id: "evt_1", host: "api.openai.com" },
-        { id: "evt_2", host: "github.com" },
-      ],
-    });
-    const out = await new EgressAudit(makeHttp()).list();
-    expect(mockGet).toHaveBeenCalledWith("/egress/audit", {});
-    expect(out).toHaveLength(2);
-  });
-
-  it("list() passes filters as query params", async () => {
-    mockGet.mockResolvedValue({ data: [] });
-    await new EgressAudit(makeHttp()).list({
-      resourceId: "sbx_1",
-      host: "api.openai.com",
-      action: "denied",
-      limit: 50,
-    });
-    expect(mockGet).toHaveBeenCalledWith("/egress/audit", {
-      resource_id: "sbx_1",
-      host: "api.openai.com",
-      action: "denied",
-      limit: 50,
-    });
-  });
-
-  it("get() returns a single event", async () => {
-    mockGet.mockResolvedValue({ data: { id: "evt_1" } });
-    const out = await new EgressAudit(makeHttp()).get("evt_1");
-    expect(mockGet).toHaveBeenCalledWith("/egress/audit/evt_1");
-    expect(out.id).toBe("evt_1");
-  });
-});
-
-// ─── sandbox.* scoped namespaces ─────────────────────────────────────────────
-
-describe("Sandbox-scoped egress", () => {
-  it("sandbox.secrets.set() injects resource_id + resource_type", async () => {
-    mockPost.mockResolvedValue({ data: { id: "sec_1" } });
-    await new SandboxSecrets(makeHttp(), "sbx_abc").set({
-      name: "OPENAI_API_KEY",
-      value: "sk-abc",
-    });
-    expect(mockPost).toHaveBeenCalledWith("/egress/secrets", {
-      name: "OPENAI_API_KEY",
-      value: "sk-abc",
-      type: "api_key",
-      scope: "user",
-      resource_id: "sbx_abc",
-      resource_type: "sandbox",
-    });
-  });
-
-  it("sandbox.audit.list() includes resource_id in query params", async () => {
-    mockGet.mockResolvedValue({ data: [] });
-    await new SandboxAudit(makeHttp(), "sbx_abc").list();
-    expect(mockGet).toHaveBeenCalledWith("/egress/audit", {
-      resource_id: "sbx_abc",
-      resource_type: "sandbox",
-    });
-  });
-
-  it("sandbox.network.allow() scopes the rule to the sandbox", async () => {
-    mockPost.mockResolvedValue({ data: { id: "rul_1" } });
-    await new SandboxNetwork(makeHttp(), "sbx_abc").allow("api.openai.com");
-    expect(mockPost).toHaveBeenCalledWith("/egress/allowlist", {
-      host: "api.openai.com",
-      effect: "allow",
-      resource_id: "sbx_abc",
-      resource_type: "sandbox",
-    });
-  });
-
-  it("sandbox.network.lockdown() scopes the policy patch", async () => {
-    mockPatch.mockResolvedValue({ data: {} });
-    await new SandboxNetwork(makeHttp(), "sbx_abc").lockdown();
-    expect(mockPatch).toHaveBeenCalledWith("/egress/policies", {
-      mode: "enforce",
-      resource_id: "sbx_abc",
-      resource_type: "sandbox",
-    });
-  });
-});

package/src/resources/egressAudit.ts

@@ -1,245 +0,0 @@
-/**
- * Egress audit log — paginated query + live tail.
- *
- * Backed by:
- *   GET    /api/v1/egress/audit
- *   GET    /api/v1/egress/audit/:id
- *
- * `client.audit.tail()` long-polls the REST endpoint and yields new
- * events as they arrive. The sandbox-scoped variant
- * (`sandbox.audit.tail()`) upgrades to a live SSE connection backed by
- * `GET /sandboxes/:id/audit/stream` so the tail latency is
- * sub-second.
- */
-
-import type { HttpClient } from "../http.js";
-
-// ── Resource shapes ──────────────────────────────────────────────────────────
-
-export interface EgressAuditEvent {
-  id: string;
-  action?: string;
-  effect?: string;
-  host?: string;
-  method?: string;
-  path?: string;
-  status_code?: number;
-  actor_id?: string;
-  resource_id?: string;
-  resource_type?: string;
-  policy_id?: string;
-  rule_id?: string;
-  external_user_id?: string;
-  external_workspace_id?: string;
-  metadata?: Record<string, unknown>;
-  inserted_at?: string;
-  timestamp?: string;
-  [key: string]: unknown;
-}
-
-// ── Request payloads ─────────────────────────────────────────────────────────
-
-export interface AuditListParams {
-  resourceId?: string;
-  resource_id?: string;
-  resourceType?: string;
-  resource_type?: string;
-  host?: string;
-  action?: string;
-  since?: string;
-  until?: string;
-  limit?: number;
-  cursor?: string;
-  externalUserId?: string;
-  external_user_id?: string;
-  externalWorkspaceId?: string;
-  external_workspace_id?: string;
-}
-
-export interface AuditTailParams extends AuditListParams {
-  pollIntervalMs?: number;
-}
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-
-interface WireEnvelope<T> {
-  data?: T;
-  event?: T;
-  items?: T;
-}
-
-function unwrap<T>(payload: unknown): T {
-  if (payload && typeof payload === "object") {
-    const p = payload as Record<string, unknown>;
-    for (const k of ["data", "event", "items"]) {
-      if (k in p) return p[k] as T;
-    }
-  }
-  return payload as T;
-}
-
-function unwrapList<T>(payload: unknown): T[] {
-  if (Array.isArray(payload)) return payload as T[];
-  if (payload && typeof payload === "object") {
-    const p = payload as Record<string, unknown>;
-    for (const k of ["data", "events", "audit", "items"]) {
-      if (Array.isArray(p[k])) return p[k] as T[];
-    }
-  }
-  return [];
-}
-
-function stripUndefined(
-  input: Record<string, unknown>,
-): Record<string, unknown> {
-  return Object.fromEntries(
-    Object.entries(input).filter(([, v]) => v !== undefined),
-  );
-}
-
-function pickFirst<T>(...values: Array<T | undefined>): T | undefined {
-  for (const v of values) if (v !== undefined) return v;
-  return undefined;
-}
-
-function listQuery(
-  params: AuditListParams,
-): Record<string, string | number | boolean | undefined> {
-  return stripUndefined({
-    resource_id: pickFirst(params.resourceId, params.resource_id),
-    resource_type: pickFirst(params.resourceType, params.resource_type),
-    host: params.host,
-    action: params.action,
-    since: params.since,
-    until: params.until,
-    limit: params.limit,
-    cursor: params.cursor,
-    external_user_id: pickFirst(params.externalUserId, params.external_user_id),
-    external_workspace_id: pickFirst(
-      params.externalWorkspaceId,
-      params.external_workspace_id,
-    ),
-  }) as Record<string, string | number | boolean | undefined>;
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// ── Main resource ─────────────────────────────────────────────────────────────
-
-export class EgressAudit {
-  constructor(protected readonly http: HttpClient) {}
-
-  /** List audit events with optional filters. */
-  async list(params: AuditListParams = {}): Promise<EgressAuditEvent[]> {
-    const data = await this.http.get<unknown>(
-      "/egress/audit",
-      listQuery(params),
-    );
-    return unwrapList<EgressAuditEvent>(data);
-  }
-
-  /** Get a single audit event by id. */
-  async get(id: string): Promise<EgressAuditEvent> {
-    const data = await this.http.get<WireEnvelope<EgressAuditEvent>>(
-      `/egress/audit/${id}`,
-    );
-    return unwrap<EgressAuditEvent>(data);
-  }
-
-  /**
-   * Long-poll the audit endpoint and yield new events as they appear.
-   *
-   * Tenant-wide `client.audit.tail()` is REST-based long polling. A
-   * live WebSocket / SSE tail is only available for the sandbox-scoped
-   * variant — see {@link SandboxAudit.tail}.
-   */
-  async *tail(
-    params: AuditTailParams = {},
-  ): AsyncIterableIterator<EgressAuditEvent> {
-    const pollMs = params.pollIntervalMs ?? 2000;
-    let since: string | undefined = params.since;
-    const seen = new Set<string>();
-    while (true) {
-      const queryParams: AuditListParams = { ...params };
-      if (since !== undefined) queryParams.since = since;
-      const data = await this.http.get<unknown>(
-        "/egress/audit",
-        listQuery(queryParams),
-      );
-      const events = unwrapList<EgressAuditEvent>(data);
-      for (const event of events) {
-        if (event.id && seen.has(event.id)) continue;
-        if (event.id) seen.add(event.id);
-        yield event;
-        const ts = event.inserted_at ?? event.timestamp;
-        if (typeof ts === "string") since = ts;
-      }
-      await sleep(pollMs);
-    }
-  }
-}
-
-// ── Resource-scoped wrappers ─────────────────────────────────────────────────
-
-/**
- * Sandbox-bound view of {@link EgressAudit}. `list()` pre-scopes
- * `resource_id` + `resource_type="sandbox"`. `tail()` upgrades to the
- * per-sandbox SSE stream for sub-second tail latency.
- */
-export class SandboxAudit {
-  protected readonly resourceType: string = "sandbox";
-  private readonly delegate: EgressAudit;
-
-  constructor(
-    protected readonly http: HttpClient,
-    protected readonly resourceId: string,
-  ) {
-    this.delegate = new EgressAudit(http);
-  }
-
-  list(params: AuditListParams = {}): Promise<EgressAuditEvent[]> {
-    return this.delegate.list({
-      ...params,
-      resource_id: params.resourceId ?? params.resource_id ?? this.resourceId,
-      resource_type:
-        params.resourceType ?? params.resource_type ?? this.resourceType,
-    });
-  }
-
-  get(id: string): Promise<EgressAuditEvent> {
-    return this.delegate.get(id);
-  }
-
-  /** SSE tail of the sandbox-scoped audit stream. */
-  async *tail(
-    params: AuditTailParams = {},
-  ): AsyncIterableIterator<EgressAuditEvent> {
-    const streamPath =
-      this.resourceType === "sandbox"
-        ? `/sandboxes/${this.resourceId}/audit/stream`
-        : `/computers/${this.resourceId}/audit/stream`;
-    try {
-      const stream = this.http.stream<EgressAuditEvent>(streamPath, {
-        method: "GET",
-      });
-      for await (const event of stream) {
-        yield event;
-      }
-    } catch {
-      // SSE endpoint unavailable — fall back to long-poll on the
-      // tenant-wide endpoint with this resource pre-filtered.
-      yield* this.delegate.tail({
-        ...params,
-        resource_id: this.resourceId,
-        resource_type: this.resourceType,
-      });
-    }
-  }
-}
-
-/** Computer-bound audit — same surface, `resource_type="computer"`. */
-export class ComputerAudit extends SandboxAudit {
-  protected readonly resourceType: string = "computer";
-}