@origincloud/iam 0.20.0 → 0.21.0

package/dist/v1beta1/federated_credential.d.ts

@@ -0,0 +1,161 @@
+import { type CallOptions, type Client, type Empty, type Service } from "@origincloud/core";
+/**
+ * Calls FederatedCredentialService.
+ *
+ * Federated credentials: a `WORKLOAD` service account's trust in the OIDC
+ * tokens of an identity provider outside Origin Cloud, such as the token
+ * GitHub Actions gives every job. Software holding a matching token
+ * exchanges it for the service account's access token, so no secret is
+ * stored where it runs. A trust policy names the token's issuer and
+ * audience exactly, and the claims it must carry. To change one, create
+ * the new one and delete the old.
+ */
+export declare class FederatedCredentialClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    readonly service: Service;
+    /** A client of FederatedCredentialService that sends its calls through `client`. */
+    constructor(client: Client);
+    /**
+     * Returns a federated credential, deleted or not. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    getFederatedCredential(request: GetFederatedCredentialRequest, options?: CallOptions): Promise<FederatedCredential>;
+    /**
+     * Lists a service account's federated credentials, oldest first. Deleted
+     * ones are listed only when `showDeleted` is set. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    listFederatedCredentials(request: ListFederatedCredentialsRequest, options?: CallOptions): Promise<ListFederatedCredentialsResponse>;
+    /**
+     * Iterates over everything listFederatedCredentials lists from the request's page on,
+     * fetching the next page as the loop reaches it. A page that fails ends
+     * the iteration with its error.
+     */
+    allFederatedCredentials(request: ListFederatedCredentialsRequest, options?: CallOptions): AsyncGenerator<FederatedCredential, void, undefined>;
+    /**
+     * Creates a federated credential on an active `WORKLOAD` service
+     * account. Anyone whose token matches it acts as the service account, so
+     * creating one needs `iam.service_account.create` and
+     * `iam.service_account.act_as` on the organization: the right to act as
+     * the account yourself. Refused with `INVALID_ARGUMENT` when a condition
+     * contains `*`, or when no condition names an identity that never
+     * changes: `repository_id` or `repository_owner_id` for GitHub Actions'
+     * issuer, `sub` for any other.
+     */
+    createFederatedCredential(request: CreateFederatedCredentialRequest, options?: CallOptions): Promise<FederatedCredential>;
+    /**
+     * Deletes a federated credential: no token is exchanged for it from then
+     * on, and an access token already exchanged for it is refused on its
+     * next request. It stays readable as `DELETED`. Deleting a deleted one
+     * succeeds. Needs `iam.service_account.revoke` on the organization.
+     */
+    deleteFederatedCredential(request: DeleteFederatedCredentialRequest, options?: CallOptions): Promise<Empty>;
+}
+/**
+ * A `WORKLOAD` service account's trust in an identity provider's OIDC
+ * tokens that carry the given claims.
+ */
+export interface FederatedCredential {
+    /** The federated credential's resource name. */
+    name?: string;
+    /** A name of your own, shown in the console; at most 100 characters. */
+    displayName?: string;
+    /**
+     * The identity provider whose tokens are trusted: a token's `iss`, matched
+     * exactly, an `https` URL that serves
+     * `/.well-known/openid-configuration`, such as
+     * `https://token.actions.githubusercontent.com`.
+     */
+    issuer?: string;
+    /**
+     * The audience a token must be issued for, its `aud`, matched exactly;
+     * `https://sts.origincloudapis.eu` when the create leaves it empty.
+     */
+    audience?: string;
+    /**
+     * The claims a token must carry, each with exactly this value, such as
+     * `repository_id` and `environment` for GitHub Actions. At least one, on
+     * an identity that never changes.
+     */
+    conditions?: Record<string, string>;
+    /** Where the federated credential is in its lifecycle. */
+    state?: FederatedCredential_State;
+    /**
+     * Who created the federated credential, written as a role binding's
+     * member is.
+     */
+    creator?: string;
+    /** When the federated credential was created. */
+    createTime?: string;
+    /** When the federated credential was deleted; unset while it is active. */
+    deleteTime?: string;
+}
+/** Where the federated credential is in its lifecycle. */
+export declare const FederatedCredential_State: {
+    /** Not set. */
+    readonly STATE_UNSPECIFIED: "STATE_UNSPECIFIED";
+    /** Tokens that match it are exchanged. */
+    readonly ACTIVE: "ACTIVE";
+    /** Deleted: no token is exchanged for it. */
+    readonly DELETED: "DELETED";
+};
+/** Where the federated credential is in its lifecycle. */
+export type FederatedCredential_State = (typeof FederatedCredential_State)[keyof typeof FederatedCredential_State];
+/** The request for GetFederatedCredential. */
+export interface GetFederatedCredentialRequest {
+    /** The federated credential to return. */
+    name?: string;
+}
+/** The request for ListFederatedCredentials. */
+export interface ListFederatedCredentialsRequest {
+    /**
+     * The service account whose federated credentials to list,
+     * `organizations/{organization}/serviceAccounts/{service_account}`.
+     */
+    parent?: string;
+    /**
+     * The most federated credentials to return; the server clamps it, and 0
+     * means its default.
+     */
+    pageSize?: number;
+    /** A previous response's `nextPageToken`, for the page after it. */
+    pageToken?: string;
+    /** Whether deleted federated credentials are listed too. */
+    showDeleted?: boolean;
+}
+/** The response for ListFederatedCredentials. */
+export interface ListFederatedCredentialsResponse {
+    /** The federated credentials on this page. */
+    federatedCredentials?: FederatedCredential[];
+    /** The token for the next page; empty on the last one. */
+    nextPageToken?: string;
+}
+/** The request for CreateFederatedCredential. */
+export interface CreateFederatedCredentialRequest {
+    /**
+     * The `WORKLOAD` service account to create the federated credential on,
+     * `organizations/{organization}/serviceAccounts/{service_account}`.
+     */
+    parent?: string;
+    /**
+     * The federated credential to create: its `displayName`, `issuer`,
+     * `conditions`, and optionally its `audience`.
+     */
+    federatedCredential?: FederatedCredential;
+    /**
+     * A UUID. A repeat of the request with the same `requestId` within a
+     * day returns the federated credential the first request created, as it
+     * is now, instead of creating a second. The same `requestId` with a
+     * different request is refused with `CONFLICT`.
+     */
+    requestId?: string;
+}
+/** The request for DeleteFederatedCredential. */
+export interface DeleteFederatedCredentialRequest {
+    /** The federated credential to delete. */
+    name?: string;
+}
+//# sourceMappingURL=federated_credential.d.ts.map

package/dist/v1beta1/federated_credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated_credential.d.ts","sourceRoot":"","sources":["../../src/v1beta1/federated_credential.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,qBAAa,yBAAyB;IACpC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,oFAAoF;gBACxE,MAAM,EAAE,MAAM;IAI1B;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAazH;;;;OAIG;IACG,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAa1I;;;;OAIG;IACI,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC;IASrJ;;;;;;;;;OASG;IACG,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAe/H;;;;;OAKG;IACG,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAWlH;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,yBAAyB,CAAC;IAClC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB;IACpC,eAAe;;IAEf,0CAA0C;;IAE1C,6CAA6C;;CAErC,CAAC;AAEX,0DAA0D;AAC1D,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAEnH,8CAA8C;AAC9C,MAAM,WAAW,6BAA6B;IAC5C,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gDAAgD;AAChD,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,WAAW,gCAAgC;IAC/C,8CAA8C;IAC9C,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iDAAiD;AACjD,MAAM,WAAW,gCAAgC;IAC/C,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/v1beta1/federated_credential.js

@@ -0,0 +1,112 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/federated_credential.proto
+import { newRequestId, pathValue, query, } from "@origincloud/core";
+/**
+ * Calls FederatedCredentialService.
+ *
+ * Federated credentials: a `WORKLOAD` service account's trust in the OIDC
+ * tokens of an identity provider outside Origin Cloud, such as the token
+ * GitHub Actions gives every job. Software holding a matching token
+ * exchanges it for the service account's access token, so no secret is
+ * stored where it runs. A trust policy names the token's issuer and
+ * audience exactly, and the claims it must carry. To change one, create
+ * the new one and delete the old.
+ */
+export class FederatedCredentialClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    service;
+    /** A client of FederatedCredentialService that sends its calls through `client`. */
+    constructor(client) {
+        this.service = client.service("iam", false);
+    }
+    /**
+     * Returns a federated credential, deleted or not. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    async getFederatedCredential(request, options) {
+        const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*/federatedCredentials/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Lists a service account's federated credentials, oldest first. Deleted
+     * ones are listed only when `showDeleted` is set. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    async listFederatedCredentials(request, options) {
+        const p0 = pathValue("parent", request.parent, "organizations/*/serviceAccounts/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}/federatedCredentials`,
+            query: query(request, ["parent"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Iterates over everything listFederatedCredentials lists from the request's page on,
+     * fetching the next page as the loop reaches it. A page that fails ends
+     * the iteration with its error.
+     */
+    async *allFederatedCredentials(request, options) {
+        for (let page = request;;) {
+            const response = await this.listFederatedCredentials(page, options);
+            yield* response.federatedCredentials ?? [];
+            if (!response.nextPageToken)
+                return;
+            page = { ...page, pageToken: response.nextPageToken };
+        }
+    }
+    /**
+     * Creates a federated credential on an active `WORKLOAD` service
+     * account. Anyone whose token matches it acts as the service account, so
+     * creating one needs `iam.service_account.create` and
+     * `iam.service_account.act_as` on the organization: the right to act as
+     * the account yourself. Refused with `INVALID_ARGUMENT` when a condition
+     * contains `*`, or when no condition names an identity that never
+     * changes: `repository_id` or `repository_owner_id` for GitHub Actions'
+     * issuer, `sub` for any other.
+     */
+    async createFederatedCredential(request, options) {
+        if (!request.requestId)
+            request = { ...request, requestId: newRequestId() };
+        const p0 = pathValue("parent", request.parent, "organizations/*/serviceAccounts/*");
+        return this.service.call({
+            method: "POST",
+            path: `/v1beta1/${p0}/federatedCredentials`,
+            body: request.federatedCredential,
+            query: query(request, ["parent", "federatedCredential"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Deletes a federated credential: no token is exchanged for it from then
+     * on, and an access token already exchanged for it is refused on its
+     * next request. It stays readable as `DELETED`. Deleting a deleted one
+     * succeeds. Needs `iam.service_account.revoke` on the organization.
+     */
+    async deleteFederatedCredential(request, options) {
+        const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*/federatedCredentials/*");
+        return this.service.call({
+            method: "DELETE",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+        }, options);
+    }
+}
+/** Where the federated credential is in its lifecycle. */
+export const FederatedCredential_State = {
+    /** Not set. */
+    STATE_UNSPECIFIED: "STATE_UNSPECIFIED",
+    /** Tokens that match it are exchanged. */
+    ACTIVE: "ACTIVE",
+    /** Deleted: no token is exchanged for it. */
+    DELETED: "DELETED",
+};
+//# sourceMappingURL=federated_credential.js.map

package/dist/v1beta1/federated_credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated_credential.js","sourceRoot":"","sources":["../../src/v1beta1/federated_credential.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6DAA6D;AAE7D,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACpC;;;OAGG;IACM,OAAO,CAAU;IAE1B,oFAAoF;IACpF,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAsC,EAAE,OAAqB;QACxF,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,0DAA0D,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAwC,EAAE,OAAqB;QAC5F,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,uBAAuB;YAC3C,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAwC,EAAE,OAAqB;QAC5F,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpE,KAAK,CAAC,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAAC,OAAyC,EAAE,OAAqB;QAC9F,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,uBAAuB;YAC3C,IAAI,EAAE,OAAO,CAAC,mBAAmB;YACjC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YACxD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB,CAAC,OAAyC,EAAE,OAAqB;QAC9F,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,0DAA0D,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;SAChC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AA0CD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe;IACf,iBAAiB,EAAE,mBAAmB;IACtC,0CAA0C;IAC1C,MAAM,EAAE,QAAQ;IAChB,6CAA6C;IAC7C,OAAO,EAAE,SAAS;CACV,CAAC"}

package/dist/v1beta1/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./audit_log.js";
+export * from "./federated_credential.js";
 export * from "./permission.js";
 export * from "./role.js";
 export * from "./role_binding.js";

package/dist/v1beta1/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/v1beta1/index.ts"],"names":[],"mappings":"AAEA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/v1beta1/index.ts"],"names":[],"mappings":"AAEA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,WAAW,CAAC"}

package/dist/v1beta1/index.js

@@ -1,5 +1,6 @@
 // Code generated by the SDK's generator (generator/). DO NOT EDIT.
 export * from "./audit_log.js";
+export * from "./federated_credential.js";
 export * from "./permission.js";
 export * from "./role.js";
 export * from "./role_binding.js";

package/dist/v1beta1/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/v1beta1/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/v1beta1/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@origincloud/iam",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Origin Cloud's IAM service: users, service accounts, roles, role bindings, permissions and the audit log.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
@@ -34,9 +34,9 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "peerDependencies": {
-    "@origincloud/core": "^0.20.0"
+    "@origincloud/core": "^0.21.0"
   },
   "devDependencies": {
-    "@origincloud/core": "^0.20.0"
+    "@origincloud/core": "^0.21.0"
   }
 }

package/src/v1beta1/federated_credential.ts

@@ -0,0 +1,240 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/federated_credential.proto
+
+import {
+  type CallOptions,
+  type Client,
+  type Empty,
+  type Service,
+  newRequestId,
+  pathValue,
+  query,
+} from "@origincloud/core";
+
+/**
+ * Calls FederatedCredentialService.
+ *
+ * Federated credentials: a `WORKLOAD` service account's trust in the OIDC
+ * tokens of an identity provider outside Origin Cloud, such as the token
+ * GitHub Actions gives every job. Software holding a matching token
+ * exchanges it for the service account's access token, so no secret is
+ * stored where it runs. A trust policy names the token's issuer and
+ * audience exactly, and the claims it must carry. To change one, create
+ * the new one and delete the old.
+ */
+export class FederatedCredentialClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of FederatedCredentialService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /**
+   * Returns a federated credential, deleted or not. Needs
+   * `iam.service_account.list` on the organization.
+   */
+  async getFederatedCredential(request: GetFederatedCredentialRequest, options?: CallOptions): Promise<FederatedCredential> {
+    const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*/federatedCredentials/*");
+    return this.service.call<FederatedCredential>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Lists a service account's federated credentials, oldest first. Deleted
+   * ones are listed only when `showDeleted` is set. Needs
+   * `iam.service_account.list` on the organization.
+   */
+  async listFederatedCredentials(request: ListFederatedCredentialsRequest, options?: CallOptions): Promise<ListFederatedCredentialsResponse> {
+    const p0 = pathValue("parent", request.parent, "organizations/*/serviceAccounts/*");
+    return this.service.call<ListFederatedCredentialsResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}/federatedCredentials`,
+        query: query(request, ["parent"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Iterates over everything listFederatedCredentials lists from the request's page on,
+   * fetching the next page as the loop reaches it. A page that fails ends
+   * the iteration with its error.
+   */
+  async *allFederatedCredentials(request: ListFederatedCredentialsRequest, options?: CallOptions): AsyncGenerator<FederatedCredential, void, undefined> {
+    for (let page = request; ; ) {
+      const response = await this.listFederatedCredentials(page, options);
+      yield* response.federatedCredentials ?? [];
+      if (!response.nextPageToken) return;
+      page = { ...page, pageToken: response.nextPageToken };
+    }
+  }
+
+  /**
+   * Creates a federated credential on an active `WORKLOAD` service
+   * account. Anyone whose token matches it acts as the service account, so
+   * creating one needs `iam.service_account.create` and
+   * `iam.service_account.act_as` on the organization: the right to act as
+   * the account yourself. Refused with `INVALID_ARGUMENT` when a condition
+   * contains `*`, or when no condition names an identity that never
+   * changes: `repository_id` or `repository_owner_id` for GitHub Actions'
+   * issuer, `sub` for any other.
+   */
+  async createFederatedCredential(request: CreateFederatedCredentialRequest, options?: CallOptions): Promise<FederatedCredential> {
+    if (!request.requestId) request = { ...request, requestId: newRequestId() };
+    const p0 = pathValue("parent", request.parent, "organizations/*/serviceAccounts/*");
+    return this.service.call<FederatedCredential>(
+      {
+        method: "POST",
+        path: `/v1beta1/${p0}/federatedCredentials`,
+        body: request.federatedCredential,
+        query: query(request, ["parent", "federatedCredential"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Deletes a federated credential: no token is exchanged for it from then
+   * on, and an access token already exchanged for it is refused on its
+   * next request. It stays readable as `DELETED`. Deleting a deleted one
+   * succeeds. Needs `iam.service_account.revoke` on the organization.
+   */
+  async deleteFederatedCredential(request: DeleteFederatedCredentialRequest, options?: CallOptions): Promise<Empty> {
+    const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*/federatedCredentials/*");
+    return this.service.call<Empty>(
+      {
+        method: "DELETE",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+      },
+      options,
+    );
+  }
+}
+
+/**
+ * A `WORKLOAD` service account's trust in an identity provider's OIDC
+ * tokens that carry the given claims.
+ */
+export interface FederatedCredential {
+  /** The federated credential's resource name. */
+  name?: string;
+  /** A name of your own, shown in the console; at most 100 characters. */
+  displayName?: string;
+  /**
+   * The identity provider whose tokens are trusted: a token's `iss`, matched
+   * exactly, an `https` URL that serves
+   * `/.well-known/openid-configuration`, such as
+   * `https://token.actions.githubusercontent.com`.
+   */
+  issuer?: string;
+  /**
+   * The audience a token must be issued for, its `aud`, matched exactly;
+   * `https://sts.origincloudapis.eu` when the create leaves it empty.
+   */
+  audience?: string;
+  /**
+   * The claims a token must carry, each with exactly this value, such as
+   * `repository_id` and `environment` for GitHub Actions. At least one, on
+   * an identity that never changes.
+   */
+  conditions?: Record<string, string>;
+  /** Where the federated credential is in its lifecycle. */
+  state?: FederatedCredential_State;
+  /**
+   * Who created the federated credential, written as a role binding's
+   * member is.
+   */
+  creator?: string;
+  /** When the federated credential was created. */
+  createTime?: string;
+  /** When the federated credential was deleted; unset while it is active. */
+  deleteTime?: string;
+}
+
+/** Where the federated credential is in its lifecycle. */
+export const FederatedCredential_State = {
+  /** Not set. */
+  STATE_UNSPECIFIED: "STATE_UNSPECIFIED",
+  /** Tokens that match it are exchanged. */
+  ACTIVE: "ACTIVE",
+  /** Deleted: no token is exchanged for it. */
+  DELETED: "DELETED",
+} as const;
+
+/** Where the federated credential is in its lifecycle. */
+export type FederatedCredential_State = (typeof FederatedCredential_State)[keyof typeof FederatedCredential_State];
+
+/** The request for GetFederatedCredential. */
+export interface GetFederatedCredentialRequest {
+  /** The federated credential to return. */
+  name?: string;
+}
+
+/** The request for ListFederatedCredentials. */
+export interface ListFederatedCredentialsRequest {
+  /**
+   * The service account whose federated credentials to list,
+   * `organizations/{organization}/serviceAccounts/{service_account}`.
+   */
+  parent?: string;
+  /**
+   * The most federated credentials to return; the server clamps it, and 0
+   * means its default.
+   */
+  pageSize?: number;
+  /** A previous response's `nextPageToken`, for the page after it. */
+  pageToken?: string;
+  /** Whether deleted federated credentials are listed too. */
+  showDeleted?: boolean;
+}
+
+/** The response for ListFederatedCredentials. */
+export interface ListFederatedCredentialsResponse {
+  /** The federated credentials on this page. */
+  federatedCredentials?: FederatedCredential[];
+  /** The token for the next page; empty on the last one. */
+  nextPageToken?: string;
+}
+
+/** The request for CreateFederatedCredential. */
+export interface CreateFederatedCredentialRequest {
+  /**
+   * The `WORKLOAD` service account to create the federated credential on,
+   * `organizations/{organization}/serviceAccounts/{service_account}`.
+   */
+  parent?: string;
+  /**
+   * The federated credential to create: its `displayName`, `issuer`,
+   * `conditions`, and optionally its `audience`.
+   */
+  federatedCredential?: FederatedCredential;
+  /**
+   * A UUID. A repeat of the request with the same `requestId` within a
+   * day returns the federated credential the first request created, as it
+   * is now, instead of creating a second. The same `requestId` with a
+   * different request is refused with `CONFLICT`.
+   */
+  requestId?: string;
+}
+
+/** The request for DeleteFederatedCredential. */
+export interface DeleteFederatedCredentialRequest {
+  /** The federated credential to delete. */
+  name?: string;
+}

package/src/v1beta1/index.ts

@@ -1,6 +1,7 @@
 // Code generated by the SDK's generator (generator/). DO NOT EDIT.
 
 export * from "./audit_log.js";
+export * from "./federated_credential.js";
 export * from "./permission.js";
 export * from "./role.js";
 export * from "./role_binding.js";