@opentdf/sdk 0.1.0-beta.1701

package/src/platform/policy/subjectmapping/subject_mapping_pb.js

@@ -0,0 +1,260 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file policy/subjectmapping/subject_mapping.proto (package policy.subjectmapping, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { proto3 } from "@bufbuild/protobuf";
+import { Action, SubjectConditionSet, SubjectMapping, SubjectProperty, SubjectSet } from "../objects_pb";
+import { MetadataMutable, MetadataUpdateEnum } from "../../common/common_pb";
+
+/**
+ * MatchSubjectMappingsRequest liberally returns a list of SubjectMappings based on the provided SubjectProperties. The SubjectMappings are returned
+ * if there is any single condition found among the structures that matches for one of the provided properties:
+ * 1. The external selector value, external value, and an IN operator
+ * 2. The external selector value, _no_ external value, and a NOT_IN operator
+ *
+ * Without this filtering, if a selector value was something like '.emailAddress' or '.username', every Subject is probably going to relate to that mapping
+ * in some way or another, potentially matching every single attribute in the DB if a policy admin has relied heavily on that field. There is no
+ * logic applied beyond a single condition within the query to avoid business logic interpreting the supplied conditions beyond the bare minimum
+ * initial filter.
+ *
+ * NOTE: if you have any issues, debug logs are available within the service to help identify why a mapping was or was not returned.
+ *
+ * @generated from message policy.subjectmapping.MatchSubjectMappingsRequest
+ */
+export const MatchSubjectMappingsRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.MatchSubjectMappingsRequest",
+  () => [
+    { no: 1, name: "subject_properties", kind: "message", T: SubjectProperty, repeated: true },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.MatchSubjectMappingsResponse
+ */
+export const MatchSubjectMappingsResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.MatchSubjectMappingsResponse",
+  () => [
+    { no: 1, name: "subject_mappings", kind: "message", T: SubjectMapping, repeated: true },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.GetSubjectMappingRequest
+ */
+export const GetSubjectMappingRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.GetSubjectMappingRequest",
+  () => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.GetSubjectMappingResponse
+ */
+export const GetSubjectMappingResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.GetSubjectMappingResponse",
+  () => [
+    { no: 1, name: "subject_mapping", kind: "message", T: SubjectMapping },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.ListSubjectMappingsRequest
+ */
+export const ListSubjectMappingsRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.ListSubjectMappingsRequest",
+  [],
+);
+
+/**
+ * @generated from message policy.subjectmapping.ListSubjectMappingsResponse
+ */
+export const ListSubjectMappingsResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.ListSubjectMappingsResponse",
+  () => [
+    { no: 1, name: "subject_mappings", kind: "message", T: SubjectMapping, repeated: true },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.CreateSubjectMappingRequest
+ */
+export const CreateSubjectMappingRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.CreateSubjectMappingRequest",
+  () => [
+    { no: 1, name: "attribute_value_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "actions", kind: "message", T: Action, repeated: true },
+    { no: 3, name: "existing_subject_condition_set_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "new_subject_condition_set", kind: "message", T: SubjectConditionSetCreate },
+    { no: 100, name: "metadata", kind: "message", T: MetadataMutable },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.CreateSubjectMappingResponse
+ */
+export const CreateSubjectMappingResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.CreateSubjectMappingResponse",
+  () => [
+    { no: 1, name: "subject_mapping", kind: "message", T: SubjectMapping },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.UpdateSubjectMappingRequest
+ */
+export const UpdateSubjectMappingRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.UpdateSubjectMappingRequest",
+  () => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "subject_condition_set_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "actions", kind: "message", T: Action, repeated: true },
+    { no: 100, name: "metadata", kind: "message", T: MetadataMutable },
+    { no: 101, name: "metadata_update_behavior", kind: "enum", T: proto3.getEnumType(MetadataUpdateEnum) },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.UpdateSubjectMappingResponse
+ */
+export const UpdateSubjectMappingResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.UpdateSubjectMappingResponse",
+  () => [
+    { no: 1, name: "subject_mapping", kind: "message", T: SubjectMapping },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.DeleteSubjectMappingRequest
+ */
+export const DeleteSubjectMappingRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.DeleteSubjectMappingRequest",
+  () => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.DeleteSubjectMappingResponse
+ */
+export const DeleteSubjectMappingResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.DeleteSubjectMappingResponse",
+  () => [
+    { no: 1, name: "subject_mapping", kind: "message", T: SubjectMapping },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.GetSubjectConditionSetRequest
+ */
+export const GetSubjectConditionSetRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.GetSubjectConditionSetRequest",
+  () => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.GetSubjectConditionSetResponse
+ */
+export const GetSubjectConditionSetResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.GetSubjectConditionSetResponse",
+  () => [
+    { no: 1, name: "subject_condition_set", kind: "message", T: SubjectConditionSet },
+    { no: 2, name: "associated_subject_mappings", kind: "message", T: SubjectMapping, repeated: true },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.ListSubjectConditionSetsRequest
+ */
+export const ListSubjectConditionSetsRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.ListSubjectConditionSetsRequest",
+  [],
+);
+
+/**
+ * @generated from message policy.subjectmapping.ListSubjectConditionSetsResponse
+ */
+export const ListSubjectConditionSetsResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.ListSubjectConditionSetsResponse",
+  () => [
+    { no: 1, name: "subject_condition_sets", kind: "message", T: SubjectConditionSet, repeated: true },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.SubjectConditionSetCreate
+ */
+export const SubjectConditionSetCreate = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.SubjectConditionSetCreate",
+  () => [
+    { no: 1, name: "subject_sets", kind: "message", T: SubjectSet, repeated: true },
+    { no: 100, name: "metadata", kind: "message", T: MetadataMutable },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.CreateSubjectConditionSetRequest
+ */
+export const CreateSubjectConditionSetRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.CreateSubjectConditionSetRequest",
+  () => [
+    { no: 1, name: "subject_condition_set", kind: "message", T: SubjectConditionSetCreate },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.CreateSubjectConditionSetResponse
+ */
+export const CreateSubjectConditionSetResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.CreateSubjectConditionSetResponse",
+  () => [
+    { no: 1, name: "subject_condition_set", kind: "message", T: SubjectConditionSet },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.UpdateSubjectConditionSetRequest
+ */
+export const UpdateSubjectConditionSetRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.UpdateSubjectConditionSetRequest",
+  () => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "subject_sets", kind: "message", T: SubjectSet, repeated: true },
+    { no: 100, name: "metadata", kind: "message", T: MetadataMutable },
+    { no: 101, name: "metadata_update_behavior", kind: "enum", T: proto3.getEnumType(MetadataUpdateEnum) },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.UpdateSubjectConditionSetResponse
+ */
+export const UpdateSubjectConditionSetResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.UpdateSubjectConditionSetResponse",
+  () => [
+    { no: 1, name: "subject_condition_set", kind: "message", T: SubjectConditionSet },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.DeleteSubjectConditionSetRequest
+ */
+export const DeleteSubjectConditionSetRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.DeleteSubjectConditionSetRequest",
+  () => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ],
+);
+
+/**
+ * @generated from message policy.subjectmapping.DeleteSubjectConditionSetResponse
+ */
+export const DeleteSubjectConditionSetResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "policy.subjectmapping.DeleteSubjectConditionSetResponse",
+  () => [
+    { no: 1, name: "subject_condition_set", kind: "message", T: SubjectConditionSet },
+  ],
+);
+

package/src/platform/wellknownconfiguration/wellknown_configuration_connect.d.ts

@@ -0,0 +1,26 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file wellknownconfiguration/wellknown_configuration.proto (package wellknownconfiguration, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { GetWellKnownConfigurationRequest, GetWellKnownConfigurationResponse } from "./wellknown_configuration_pb";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service wellknownconfiguration.WellKnownService
+ */
+export declare const WellKnownService: {
+  readonly typeName: "wellknownconfiguration.WellKnownService",
+  readonly methods: {
+    /**
+     * @generated from rpc wellknownconfiguration.WellKnownService.GetWellKnownConfiguration
+     */
+    readonly getWellKnownConfiguration: {
+      readonly name: "GetWellKnownConfiguration",
+      readonly I: typeof GetWellKnownConfigurationRequest,
+      readonly O: typeof GetWellKnownConfigurationResponse,
+      readonly kind: MethodKind.Unary,
+    },
+  }
+};
+

package/src/platform/wellknownconfiguration/wellknown_configuration_connect.js

@@ -0,0 +1,26 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file wellknownconfiguration/wellknown_configuration.proto (package wellknownconfiguration, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { GetWellKnownConfigurationRequest, GetWellKnownConfigurationResponse } from "./wellknown_configuration_pb";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service wellknownconfiguration.WellKnownService
+ */
+export const WellKnownService = {
+  typeName: "wellknownconfiguration.WellKnownService",
+  methods: {
+    /**
+     * @generated from rpc wellknownconfiguration.WellKnownService.GetWellKnownConfiguration
+     */
+    getWellKnownConfiguration: {
+      name: "GetWellKnownConfiguration",
+      I: GetWellKnownConfigurationRequest,
+      O: GetWellKnownConfigurationResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+};
+

package/src/platform/wellknownconfiguration/wellknown_configuration_pb.d.ts

@@ -0,0 +1,75 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file wellknownconfiguration/wellknown_configuration.proto (package wellknownconfiguration, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage, Struct } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+
+/**
+ * @generated from message wellknownconfiguration.WellKnownConfig
+ */
+export declare class WellKnownConfig extends Message<WellKnownConfig> {
+  /**
+   * @generated from field: map<string, google.protobuf.Struct> configuration = 1;
+   */
+  configuration: { [key: string]: Struct };
+
+  constructor(data?: PartialMessage<WellKnownConfig>);
+
+  static readonly runtime: typeof proto3;
+  static readonly typeName = "wellknownconfiguration.WellKnownConfig";
+  static readonly fields: FieldList;
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): WellKnownConfig;
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): WellKnownConfig;
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): WellKnownConfig;
+
+  static equals(a: WellKnownConfig | PlainMessage<WellKnownConfig> | undefined, b: WellKnownConfig | PlainMessage<WellKnownConfig> | undefined): boolean;
+}
+
+/**
+ * @generated from message wellknownconfiguration.GetWellKnownConfigurationRequest
+ */
+export declare class GetWellKnownConfigurationRequest extends Message<GetWellKnownConfigurationRequest> {
+  constructor(data?: PartialMessage<GetWellKnownConfigurationRequest>);
+
+  static readonly runtime: typeof proto3;
+  static readonly typeName = "wellknownconfiguration.GetWellKnownConfigurationRequest";
+  static readonly fields: FieldList;
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetWellKnownConfigurationRequest;
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetWellKnownConfigurationRequest;
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetWellKnownConfigurationRequest;
+
+  static equals(a: GetWellKnownConfigurationRequest | PlainMessage<GetWellKnownConfigurationRequest> | undefined, b: GetWellKnownConfigurationRequest | PlainMessage<GetWellKnownConfigurationRequest> | undefined): boolean;
+}
+
+/**
+ * @generated from message wellknownconfiguration.GetWellKnownConfigurationResponse
+ */
+export declare class GetWellKnownConfigurationResponse extends Message<GetWellKnownConfigurationResponse> {
+  /**
+   * @generated from field: google.protobuf.Struct configuration = 1;
+   */
+  configuration?: Struct;
+
+  constructor(data?: PartialMessage<GetWellKnownConfigurationResponse>);
+
+  static readonly runtime: typeof proto3;
+  static readonly typeName = "wellknownconfiguration.GetWellKnownConfigurationResponse";
+  static readonly fields: FieldList;
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetWellKnownConfigurationResponse;
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetWellKnownConfigurationResponse;
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetWellKnownConfigurationResponse;
+
+  static equals(a: GetWellKnownConfigurationResponse | PlainMessage<GetWellKnownConfigurationResponse> | undefined, b: GetWellKnownConfigurationResponse | PlainMessage<GetWellKnownConfigurationResponse> | undefined): boolean;
+}
+

package/src/platform/wellknownconfiguration/wellknown_configuration_pb.js

@@ -0,0 +1,35 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=js+dts,import_extension=none"
+// @generated from file wellknownconfiguration/wellknown_configuration.proto (package wellknownconfiguration, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { proto3, Struct } from "@bufbuild/protobuf";
+
+/**
+ * @generated from message wellknownconfiguration.WellKnownConfig
+ */
+export const WellKnownConfig = /*@__PURE__*/ proto3.makeMessageType(
+  "wellknownconfiguration.WellKnownConfig",
+  () => [
+    { no: 1, name: "configuration", kind: "map", K: 9 /* ScalarType.STRING */, V: {kind: "message", T: Struct} },
+  ],
+);
+
+/**
+ * @generated from message wellknownconfiguration.GetWellKnownConfigurationRequest
+ */
+export const GetWellKnownConfigurationRequest = /*@__PURE__*/ proto3.makeMessageType(
+  "wellknownconfiguration.GetWellKnownConfigurationRequest",
+  [],
+);
+
+/**
+ * @generated from message wellknownconfiguration.GetWellKnownConfigurationResponse
+ */
+export const GetWellKnownConfigurationResponse = /*@__PURE__*/ proto3.makeMessageType(
+  "wellknownconfiguration.GetWellKnownConfigurationResponse",
+  () => [
+    { no: 1, name: "configuration", kind: "message", T: Struct },
+  ],
+);
+

package/src/policy/api.ts

@@ -0,0 +1,61 @@
+import { NetworkError, ServiceError } from '../errors.js';
+import { AuthProvider } from '../auth/auth.js';
+import { rstrip } from '../utils.js';
+import { GetAttributeValuesByFqnsResponse, Value } from './attributes.js';
+
+export async function attributeFQNsAsValues(
+  kasUrl: string,
+  authProvider: AuthProvider,
+  ...fqns: string[]
+): Promise<Value[]> {
+  const avs = new URLSearchParams();
+  for (const fqn of fqns) {
+    avs.append('fqns', fqn);
+  }
+  avs.append('withValue.withKeyAccessGrants', 'true');
+  avs.append('withValue.withAttribute.withKeyAccessGrants', 'true');
+  const uNoSlash = rstrip(kasUrl, '/');
+  const uNoKas = uNoSlash.endsWith('/kas') ? uNoSlash.slice(0, -4) : uNoSlash;
+  const url = `${uNoKas}/attributes/*/fqn?${avs}`;
+  const req = await authProvider.withCreds({
+    url,
+    headers: {},
+    method: 'GET',
+  });
+  let response: Response;
+  try {
+    response = await fetch(req.url, {
+      mode: 'cors',
+      credentials: 'same-origin',
+      headers: req.headers,
+      redirect: 'follow',
+      referrerPolicy: 'no-referrer',
+    });
+  } catch (e) {
+    throw new NetworkError(`network error [${req.method} ${req.url}]`, e);
+  }
+
+  if (!response.ok) {
+    throw new ServiceError(`${req.method} ${req.url} => ${response.status} ${response.statusText}`);
+  }
+
+  let resp: GetAttributeValuesByFqnsResponse;
+  try {
+    resp = (await response.json()) as GetAttributeValuesByFqnsResponse;
+  } catch (e) {
+    throw new ServiceError(`response parse error [${req.method} ${req.url}]`, e);
+  }
+
+  const values: Value[] = [];
+  for (const [fqn, av] of Object.entries(resp.fqnAttributeValues)) {
+    if (!av.value) {
+      console.log(`Missing value definition for [${fqn}]; is this a valid attribute?`);
+      continue;
+    }
+    if (av.attribute && !av.value.attribute) {
+      av.value.attribute = av.attribute;
+    }
+    values.push(av.value);
+  }
+  return values;
+}

package/src/policy/attributes.ts

@@ -0,0 +1,117 @@
+export type Metadata = {
+  /**
+   * created_at set by server (entity who created will recorded in an audit event)
+   * Format: date-time
+   */
+  createdAt?: string;
+
+  /**
+   * updated_at set by server (entity who updated will recorded in an audit event)
+   * Format: date-time
+   */
+  updatedAt?: string;
+
+  /** optional short description */
+  labels?: Record<string, string>;
+};
+
+export type KasPublicKeyAlgorithm =
+  | 'KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED'
+  | 'KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048'
+  | 'KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1';
+
+export type KasPublicKey = {
+  /** x509 ASN.1 content in PEM envelope, usually */
+  pem: string;
+  /** A unique string identifier for this key */
+  kid: string;
+  /**
+   * @description A known algorithm type with any additional parameters encoded.
+   * To start, these may be `rsa:2048` for encrypting ZTDF files and
+   * `ec:secp256r1` for nanoTDF, but more formats may be added as needed.
+   */
+  alg: KasPublicKeyAlgorithm;
+};
+
+export type KasPublicKeySet = {
+  keys: KasPublicKey[];
+};
+
+export type PublicKey = {
+  /** kas public key url - optional since can also be retrieved via public key */
+  remote?: string;
+  /** public key; PEM of RSA public key; prefer `cached` */
+  local?: string;
+  /** public key with additional information. Current preferred version */
+  cached?: KasPublicKeySet;
+};
+
+export type KeyAccessServer = {
+  id?: string;
+  /** Address of a KAS instance */
+  uri: string;
+  publicKey?: PublicKey;
+  metadata?: Metadata;
+};
+
+export type Namespace = {
+  /** uuid */
+  id?: string;
+  /** used to partition Attribute Definitions, support by namespace AuthN and enable federation */
+  name?: string;
+  fqn: string;
+  /** active by default until explicitly deactivated */
+  active?: boolean;
+  metadata?: Metadata;
+  grants?: KeyAccessServer[];
+};
+
+export type AttributeRuleType =
+  | 'ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED'
+  | 'ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF'
+  | 'ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF'
+  | 'ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY';
+
+export type Attribute = {
+  /** UUID */
+  id?: string;
+  namespace?: Namespace;
+  /** attribute name */
+  name?: string;
+  /** attribute rule enum */
+  rule?: AttributeRuleType;
+  values?: Value[];
+  grants?: KeyAccessServer[];
+  fqn: string;
+  /** active by default until explicitly deactivated */
+  active?: boolean;
+  /** Common metadata */
+  metadata?: Metadata;
+};
+
+// This is not currently needed by the client, but may be returned.
+// Setting it to unknown to allow it to be ignored for now.
+export type SubjectMapping = unknown;
+
+export type Value = {
+  id?: string;
+  attribute?: Attribute;
+  value?: string;
+  /** list of key access servers */
+  grants?: KeyAccessServer[];
+  fqn: string;
+  /** active by default until explicitly deactivated */
+  active?: boolean;
+  subjectMappings?: SubjectMapping[];
+  /** Common metadata */
+  metadata?: Metadata;
+};
+
+export type AttributeAndValue = {
+  attribute: Attribute;
+  value: Value;
+};
+
+export type GetAttributeValuesByFqnsResponse = {
+  fqnAttributeValues: Record<string, AttributeAndValue>;
+};