@origincloud/iam 0.24.0 → 0.25.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -5,7 +5,9 @@ import { type CallOptions, type Client, type Empty, type Service } from "@origin
|
|
|
5
5
|
* Service accounts: an organization's credentials for software, which
|
|
6
6
|
* authenticate with the OAuth 2.0 client credentials grant and never log
|
|
7
7
|
* in interactively. A new service account holds no role: grant it one with
|
|
8
|
-
* a role binding on its `member`.
|
|
8
|
+
* a role binding on its `member`. An `EXTERNAL` service account's client
|
|
9
|
+
* secret expires (`secretExpireTime`): rotate it before then with
|
|
10
|
+
* RotateServiceAccountSecret.
|
|
9
11
|
*/
|
|
10
12
|
export declare class ServiceAccountClient {
|
|
11
13
|
/**
|
|
@@ -34,10 +36,21 @@ export declare class ServiceAccountClient {
|
|
|
34
36
|
allServiceAccounts(request: ListServiceAccountsRequest, options?: CallOptions): AsyncGenerator<ServiceAccount, void, undefined>;
|
|
35
37
|
/**
|
|
36
38
|
* Creates a service account and, for an `EXTERNAL` one, its client
|
|
37
|
-
* secret
|
|
38
|
-
*
|
|
39
|
+
* secret, which expires after `secretLifetime`. The response is the
|
|
40
|
+
* only place the secret is ever shown: store it now. Needs
|
|
41
|
+
* `iam.service_account.create` on the organization.
|
|
39
42
|
*/
|
|
40
43
|
createServiceAccount(request: CreateServiceAccountRequest, options?: CallOptions): Promise<ServiceAccount>;
|
|
44
|
+
/**
|
|
45
|
+
* Issues a new client secret for an `EXTERNAL` service account and
|
|
46
|
+
* returns the service account with it in `clientSecret`, the only place
|
|
47
|
+
* it is ever shown. The previous secret is refused from then on, and the
|
|
48
|
+
* new one is accepted at once, also when the previous one had expired.
|
|
49
|
+
* It expires after `secretLifetime`. An access token issued before
|
|
50
|
+
* stays valid until it expires, within minutes. Needs
|
|
51
|
+
* `iam.service_account.create` on the organization.
|
|
52
|
+
*/
|
|
53
|
+
rotateServiceAccountSecret(request: RotateServiceAccountSecretRequest, options?: CallOptions): Promise<ServiceAccount>;
|
|
41
54
|
/**
|
|
42
55
|
* Deletes a service account for good: its credential is refused from
|
|
43
56
|
* then on, an access token it already holds is refused on its next
|
|
@@ -66,8 +79,8 @@ export interface ServiceAccount {
|
|
|
66
79
|
clientId?: string;
|
|
67
80
|
/**
|
|
68
81
|
* The OAuth 2.0 client secret it authenticates with. Set only in the
|
|
69
|
-
* response that created an `EXTERNAL` service account
|
|
70
|
-
* everywhere else: it can't be read again.
|
|
82
|
+
* response that created an `EXTERNAL` service account or rotated its
|
|
83
|
+
* secret, and empty everywhere else: it can't be read again.
|
|
71
84
|
*/
|
|
72
85
|
clientSecret?: string;
|
|
73
86
|
/** Where the service account is in its lifecycle. */
|
|
@@ -86,6 +99,13 @@ export interface ServiceAccount {
|
|
|
86
99
|
* leaves it unset.
|
|
87
100
|
*/
|
|
88
101
|
type?: ServiceAccount_Type;
|
|
102
|
+
/**
|
|
103
|
+
* When the client secret expires. From then on the secret is refused, so
|
|
104
|
+
* no new access token is issued with it, until RotateServiceAccountSecret
|
|
105
|
+
* issues a new one. Unset when the service account has no secret that
|
|
106
|
+
* expires, such as a `WORKLOAD` one.
|
|
107
|
+
*/
|
|
108
|
+
secretExpireTime?: string;
|
|
89
109
|
}
|
|
90
110
|
/**
|
|
91
111
|
* How the service account authenticates. Set when it is created; it
|
|
@@ -117,7 +137,10 @@ export type ServiceAccount_Type = (typeof ServiceAccount_Type)[keyof typeof Serv
|
|
|
117
137
|
export declare const ServiceAccount_State: {
|
|
118
138
|
/** Not set. */
|
|
119
139
|
readonly STATE_UNSPECIFIED: "STATE_UNSPECIFIED";
|
|
120
|
-
/**
|
|
140
|
+
/**
|
|
141
|
+
* Not deleted. An `EXTERNAL` service account's client secret is
|
|
142
|
+
* accepted until `secretExpireTime`.
|
|
143
|
+
*/
|
|
121
144
|
readonly ACTIVE: "ACTIVE";
|
|
122
145
|
/** Deleted: its credential is refused, and it holds no role binding. */
|
|
123
146
|
readonly DELETED: "DELETED";
|
|
@@ -171,10 +194,35 @@ export interface CreateServiceAccountRequest {
|
|
|
171
194
|
* request is refused with `CONFLICT` without that metadata.
|
|
172
195
|
*/
|
|
173
196
|
requestId?: string;
|
|
197
|
+
/**
|
|
198
|
+
* How long an `EXTERNAL` service account's client secret is accepted,
|
|
199
|
+
* from its creation: more than zero and at most 365 days. 90 days when
|
|
200
|
+
* left out. A `WORKLOAD` service account has no secret, and a create of
|
|
201
|
+
* one that sets it is refused.
|
|
202
|
+
*/
|
|
203
|
+
secretLifetime?: string;
|
|
174
204
|
}
|
|
175
205
|
/** The request for DeleteServiceAccount. */
|
|
176
206
|
export interface DeleteServiceAccountRequest {
|
|
177
207
|
/** The service account to delete. */
|
|
178
208
|
name?: string;
|
|
179
209
|
}
|
|
210
|
+
/** The request for RotateServiceAccountSecret. */
|
|
211
|
+
export interface RotateServiceAccountSecretRequest {
|
|
212
|
+
/** The `EXTERNAL` service account whose secret to replace. */
|
|
213
|
+
name?: string;
|
|
214
|
+
/**
|
|
215
|
+
* How long the new secret is accepted, from now: more than zero and at
|
|
216
|
+
* most 365 days. 90 days when left out.
|
|
217
|
+
*/
|
|
218
|
+
secretLifetime?: string;
|
|
219
|
+
/**
|
|
220
|
+
* A UUID. A repeat of the request with the same `requestId` within a
|
|
221
|
+
* day issues no secret and is refused with `CONFLICT`: the secret went
|
|
222
|
+
* to the first request only. Rotate again with a new `requestId` to get
|
|
223
|
+
* a working secret. The same `requestId` with a different request is
|
|
224
|
+
* refused with `CONFLICT` too.
|
|
225
|
+
*/
|
|
226
|
+
requestId?: string;
|
|
227
|
+
}
|
|
180
228
|
//# sourceMappingURL=service_account.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service_account.d.ts","sourceRoot":"","sources":["../../src/v1beta1/service_account.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B
|
|
1
|
+
{"version":3,"file":"service_account.d.ts","sourceRoot":"","sources":["../../src/v1beta1/service_account.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,qBAAa,oBAAoB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,+EAA+E;gBACnE,MAAM,EAAE,MAAM;IAI1B;;;OAGG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAa1G;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAa3H;;;;OAIG;IACI,kBAAkB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC;IAStI;;;;;OAKG;IACG,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAehH;;;;;;;;OAQG;IACG,0BAA0B,CAAC,OAAO,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAc5H;;;;;;;OAOG;IACG,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAWxG;AAED,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB;IAC9B;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;CAEK,CAAC;AAEX;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG,qDAAqD;AACrD,eAAO,MAAM,oBAAoB;IAC/B,eAAe;;IAEf;;;OAGG;;IAEH,wEAAwE;;CAEhE,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEpG,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,yCAAyC;IACzC,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,kDAAkD;AAClD,MAAM,WAAW,iCAAiC;IAChD,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
|
|
@@ -7,7 +7,9 @@ import { newRequestId, pathValue, query, } from "@origincloud/core";
|
|
|
7
7
|
* Service accounts: an organization's credentials for software, which
|
|
8
8
|
* authenticate with the OAuth 2.0 client credentials grant and never log
|
|
9
9
|
* in interactively. A new service account holds no role: grant it one with
|
|
10
|
-
* a role binding on its `member`.
|
|
10
|
+
* a role binding on its `member`. An `EXTERNAL` service account's client
|
|
11
|
+
* secret expires (`secretExpireTime`): rotate it before then with
|
|
12
|
+
* RotateServiceAccountSecret.
|
|
11
13
|
*/
|
|
12
14
|
export class ServiceAccountClient {
|
|
13
15
|
/**
|
|
@@ -62,8 +64,9 @@ export class ServiceAccountClient {
|
|
|
62
64
|
}
|
|
63
65
|
/**
|
|
64
66
|
* Creates a service account and, for an `EXTERNAL` one, its client
|
|
65
|
-
* secret
|
|
66
|
-
*
|
|
67
|
+
* secret, which expires after `secretLifetime`. The response is the
|
|
68
|
+
* only place the secret is ever shown: store it now. Needs
|
|
69
|
+
* `iam.service_account.create` on the organization.
|
|
67
70
|
*/
|
|
68
71
|
async createServiceAccount(request, options) {
|
|
69
72
|
if (!request.requestId)
|
|
@@ -77,6 +80,26 @@ export class ServiceAccountClient {
|
|
|
77
80
|
idempotent: true,
|
|
78
81
|
}, options);
|
|
79
82
|
}
|
|
83
|
+
/**
|
|
84
|
+
* Issues a new client secret for an `EXTERNAL` service account and
|
|
85
|
+
* returns the service account with it in `clientSecret`, the only place
|
|
86
|
+
* it is ever shown. The previous secret is refused from then on, and the
|
|
87
|
+
* new one is accepted at once, also when the previous one had expired.
|
|
88
|
+
* It expires after `secretLifetime`. An access token issued before
|
|
89
|
+
* stays valid until it expires, within minutes. Needs
|
|
90
|
+
* `iam.service_account.create` on the organization.
|
|
91
|
+
*/
|
|
92
|
+
async rotateServiceAccountSecret(request, options) {
|
|
93
|
+
if (!request.requestId)
|
|
94
|
+
request = { ...request, requestId: newRequestId() };
|
|
95
|
+
const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*");
|
|
96
|
+
return this.service.call({
|
|
97
|
+
method: "POST",
|
|
98
|
+
path: `/v1beta1/${p0}:rotateSecret`,
|
|
99
|
+
body: request,
|
|
100
|
+
idempotent: true,
|
|
101
|
+
}, options);
|
|
102
|
+
}
|
|
80
103
|
/**
|
|
81
104
|
* Deletes a service account for good: its credential is refused from
|
|
82
105
|
* then on, an access token it already holds is refused on its next
|
|
@@ -119,7 +142,10 @@ export const ServiceAccount_Type = {
|
|
|
119
142
|
export const ServiceAccount_State = {
|
|
120
143
|
/** Not set. */
|
|
121
144
|
STATE_UNSPECIFIED: "STATE_UNSPECIFIED",
|
|
122
|
-
/**
|
|
145
|
+
/**
|
|
146
|
+
* Not deleted. An `EXTERNAL` service account's client secret is
|
|
147
|
+
* accepted until `secretExpireTime`.
|
|
148
|
+
*/
|
|
123
149
|
ACTIVE: "ACTIVE",
|
|
124
150
|
/** Deleted: its credential is refused, and it holds no role binding. */
|
|
125
151
|
DELETED: "DELETED",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service_account.js","sourceRoot":"","sources":["../../src/v1beta1/service_account.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,wDAAwD;AAExD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B
|
|
1
|
+
{"version":3,"file":"service_account.js","sourceRoot":"","sources":["../../src/v1beta1/service_account.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,wDAAwD;AAExD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;;OAGG;IACM,OAAO,CAAU;IAE1B,+EAA+E;IAC/E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAmC,EAAE,OAAqB;QAClF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,kBAAkB;YACtC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,kBAAkB,CAAC,OAAmC,EAAE,OAAqB;QAClF,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/D,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAqB;QACpF,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,kBAAkB;YACtC,IAAI,EAAE,OAAO,CAAC,cAAc;YAC5B,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACnD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,0BAA0B,CAAC,OAA0C,EAAE,OAAqB;QAChG,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAqB;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;SAChC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAiDD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC;;;OAGG;IACH,gBAAgB,EAAE,kBAAkB;IACpC;;;OAGG;IACH,QAAQ,EAAE,UAAU;IACpB;;;OAGG;IACH,QAAQ,EAAE,UAAU;CACZ,CAAC;AAQX,qDAAqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,eAAe;IACf,iBAAiB,EAAE,mBAAmB;IACtC;;;OAGG;IACH,MAAM,EAAE,QAAQ;IAChB,wEAAwE;IACxE,OAAO,EAAE,SAAS;CACV,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@origincloud/iam",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.25.1",
|
|
4
4
|
"description": "Origin Cloud's IAM service: users, service accounts, roles, role bindings, permissions and the audit log.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
|
|
@@ -34,9 +34,9 @@
|
|
|
34
34
|
"!dist/**/*.tsbuildinfo"
|
|
35
35
|
],
|
|
36
36
|
"peerDependencies": {
|
|
37
|
-
"@origincloud/core": "^0.
|
|
37
|
+
"@origincloud/core": "^0.25.1"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
|
-
"@origincloud/core": "^0.
|
|
40
|
+
"@origincloud/core": "^0.25.1"
|
|
41
41
|
}
|
|
42
42
|
}
|
|
@@ -17,7 +17,9 @@ import {
|
|
|
17
17
|
* Service accounts: an organization's credentials for software, which
|
|
18
18
|
* authenticate with the OAuth 2.0 client credentials grant and never log
|
|
19
19
|
* in interactively. A new service account holds no role: grant it one with
|
|
20
|
-
* a role binding on its `member`.
|
|
20
|
+
* a role binding on its `member`. An `EXTERNAL` service account's client
|
|
21
|
+
* secret expires (`secretExpireTime`): rotate it before then with
|
|
22
|
+
* RotateServiceAccountSecret.
|
|
21
23
|
*/
|
|
22
24
|
export class ServiceAccountClient {
|
|
23
25
|
/**
|
|
@@ -82,8 +84,9 @@ export class ServiceAccountClient {
|
|
|
82
84
|
|
|
83
85
|
/**
|
|
84
86
|
* Creates a service account and, for an `EXTERNAL` one, its client
|
|
85
|
-
* secret
|
|
86
|
-
*
|
|
87
|
+
* secret, which expires after `secretLifetime`. The response is the
|
|
88
|
+
* only place the secret is ever shown: store it now. Needs
|
|
89
|
+
* `iam.service_account.create` on the organization.
|
|
87
90
|
*/
|
|
88
91
|
async createServiceAccount(request: CreateServiceAccountRequest, options?: CallOptions): Promise<ServiceAccount> {
|
|
89
92
|
if (!request.requestId) request = { ...request, requestId: newRequestId() };
|
|
@@ -100,6 +103,29 @@ export class ServiceAccountClient {
|
|
|
100
103
|
);
|
|
101
104
|
}
|
|
102
105
|
|
|
106
|
+
/**
|
|
107
|
+
* Issues a new client secret for an `EXTERNAL` service account and
|
|
108
|
+
* returns the service account with it in `clientSecret`, the only place
|
|
109
|
+
* it is ever shown. The previous secret is refused from then on, and the
|
|
110
|
+
* new one is accepted at once, also when the previous one had expired.
|
|
111
|
+
* It expires after `secretLifetime`. An access token issued before
|
|
112
|
+
* stays valid until it expires, within minutes. Needs
|
|
113
|
+
* `iam.service_account.create` on the organization.
|
|
114
|
+
*/
|
|
115
|
+
async rotateServiceAccountSecret(request: RotateServiceAccountSecretRequest, options?: CallOptions): Promise<ServiceAccount> {
|
|
116
|
+
if (!request.requestId) request = { ...request, requestId: newRequestId() };
|
|
117
|
+
const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*");
|
|
118
|
+
return this.service.call<ServiceAccount>(
|
|
119
|
+
{
|
|
120
|
+
method: "POST",
|
|
121
|
+
path: `/v1beta1/${p0}:rotateSecret`,
|
|
122
|
+
body: request,
|
|
123
|
+
idempotent: true,
|
|
124
|
+
},
|
|
125
|
+
options,
|
|
126
|
+
);
|
|
127
|
+
}
|
|
128
|
+
|
|
103
129
|
/**
|
|
104
130
|
* Deletes a service account for good: its credential is refused from
|
|
105
131
|
* then on, an access token it already holds is refused on its next
|
|
@@ -139,8 +165,8 @@ export interface ServiceAccount {
|
|
|
139
165
|
clientId?: string;
|
|
140
166
|
/**
|
|
141
167
|
* The OAuth 2.0 client secret it authenticates with. Set only in the
|
|
142
|
-
* response that created an `EXTERNAL` service account
|
|
143
|
-
* everywhere else: it can't be read again.
|
|
168
|
+
* response that created an `EXTERNAL` service account or rotated its
|
|
169
|
+
* secret, and empty everywhere else: it can't be read again.
|
|
144
170
|
*/
|
|
145
171
|
clientSecret?: string;
|
|
146
172
|
/** Where the service account is in its lifecycle. */
|
|
@@ -159,6 +185,13 @@ export interface ServiceAccount {
|
|
|
159
185
|
* leaves it unset.
|
|
160
186
|
*/
|
|
161
187
|
type?: ServiceAccount_Type;
|
|
188
|
+
/**
|
|
189
|
+
* When the client secret expires. From then on the secret is refused, so
|
|
190
|
+
* no new access token is issued with it, until RotateServiceAccountSecret
|
|
191
|
+
* issues a new one. Unset when the service account has no secret that
|
|
192
|
+
* expires, such as a `WORKLOAD` one.
|
|
193
|
+
*/
|
|
194
|
+
secretExpireTime?: string;
|
|
162
195
|
}
|
|
163
196
|
|
|
164
197
|
/**
|
|
@@ -193,7 +226,10 @@ export type ServiceAccount_Type = (typeof ServiceAccount_Type)[keyof typeof Serv
|
|
|
193
226
|
export const ServiceAccount_State = {
|
|
194
227
|
/** Not set. */
|
|
195
228
|
STATE_UNSPECIFIED: "STATE_UNSPECIFIED",
|
|
196
|
-
/**
|
|
229
|
+
/**
|
|
230
|
+
* Not deleted. An `EXTERNAL` service account's client secret is
|
|
231
|
+
* accepted until `secretExpireTime`.
|
|
232
|
+
*/
|
|
197
233
|
ACTIVE: "ACTIVE",
|
|
198
234
|
/** Deleted: its credential is refused, and it holds no role binding. */
|
|
199
235
|
DELETED: "DELETED",
|
|
@@ -252,6 +288,13 @@ export interface CreateServiceAccountRequest {
|
|
|
252
288
|
* request is refused with `CONFLICT` without that metadata.
|
|
253
289
|
*/
|
|
254
290
|
requestId?: string;
|
|
291
|
+
/**
|
|
292
|
+
* How long an `EXTERNAL` service account's client secret is accepted,
|
|
293
|
+
* from its creation: more than zero and at most 365 days. 90 days when
|
|
294
|
+
* left out. A `WORKLOAD` service account has no secret, and a create of
|
|
295
|
+
* one that sets it is refused.
|
|
296
|
+
*/
|
|
297
|
+
secretLifetime?: string;
|
|
255
298
|
}
|
|
256
299
|
|
|
257
300
|
/** The request for DeleteServiceAccount. */
|
|
@@ -259,3 +302,22 @@ export interface DeleteServiceAccountRequest {
|
|
|
259
302
|
/** The service account to delete. */
|
|
260
303
|
name?: string;
|
|
261
304
|
}
|
|
305
|
+
|
|
306
|
+
/** The request for RotateServiceAccountSecret. */
|
|
307
|
+
export interface RotateServiceAccountSecretRequest {
|
|
308
|
+
/** The `EXTERNAL` service account whose secret to replace. */
|
|
309
|
+
name?: string;
|
|
310
|
+
/**
|
|
311
|
+
* How long the new secret is accepted, from now: more than zero and at
|
|
312
|
+
* most 365 days. 90 days when left out.
|
|
313
|
+
*/
|
|
314
|
+
secretLifetime?: string;
|
|
315
|
+
/**
|
|
316
|
+
* A UUID. A repeat of the request with the same `requestId` within a
|
|
317
|
+
* day issues no secret and is refused with `CONFLICT`: the secret went
|
|
318
|
+
* to the first request only. Rotate again with a new `requestId` to get
|
|
319
|
+
* a working secret. The same `requestId` with a different request is
|
|
320
|
+
* refused with `CONFLICT` too.
|
|
321
|
+
*/
|
|
322
|
+
requestId?: string;
|
|
323
|
+
}
|