@origincloud/kms 0.0.0-stage → 0.28.0

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@origincloud/kms",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.28.0",
+  "description": "Origin Cloud's KMS service: grants: permission for one platform host to use one key for one operation and one encryption context, for at most an hour at a time.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/origincloudhq/sdk-typescript.git",
+    "directory": "packages/kms"
+  },
+  "bugs": "https://github.com/origincloudhq/sdk-typescript/issues",
+  "keywords": [
+    "origincloud",
+    "origin-cloud",
+    "sdk",
+    "kms"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "exports": {
+    "./*": {
+      "types": "./dist/*/index.d.ts",
+      "default": "./dist/*/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!dist/**/*.tsbuildinfo"
+  ],
+  "peerDependencies": {
+    "@origincloud/core": "^0.28.0"
+  },
+  "devDependencies": {
+    "@origincloud/core": "^0.28.0"
+  }
+}

package/src/v1beta1/grant.ts

@@ -0,0 +1,240 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/kms/v1beta1/grant.proto
+
+import {
+  type CallOptions,
+  type Client,
+  type Empty,
+  type Service,
+  newRequestId,
+  pathValue,
+  query,
+} from "@origincloud/core";
+
+/**
+ * Calls GrantService.
+ *
+ * A key's grants.
+ *
+ * Making, renewing and deleting a grant needs `kms.grant.create`,
+ * `kms.grant.update` and `kms.grant.delete` on the key's project, which the
+ * platform's own services hold where you let them use your keys; none of
+ * them lets the holder use the key itself. Reading and listing need
+ * `kms.grant.get` and `kms.grant.list`.
+ */
+export class GrantClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of GrantService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("kms", true);
+  }
+
+  /**
+   * Returns a grant that hasn't expired; an expired one is `NOT_FOUND`. A
+   * grant made moments ago may be refused with `SERVICE_UNAVAILABLE`,
+   * retryable, until its zone's change arrives. Needs `kms.grant.get` on
+   * the project.
+   */
+  async getGrant(request: GetGrantRequest, options?: CallOptions): Promise<Grant> {
+    const p0 = pathValue("name", request.name, "projects/*/regions/*/keys/*/grants/*");
+    return this.service.call<Grant>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Lists a key's grants that haven't expired, in every zone, ordered by
+   * name. A grant made moments ago may be missing from the list until its
+   * zone's change arrives. Needs `kms.grant.list` on the project.
+   */
+  async listGrants(request: ListGrantsRequest, options?: CallOptions): Promise<ListGrantsResponse> {
+    const p0 = pathValue("parent", request.parent, "projects/*/regions/*/keys/*");
+    return this.service.call<ListGrantsResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}/grants`,
+        query: query(request, ["parent"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Iterates over everything listGrants lists from the request's page on,
+   * fetching the next page as the loop reaches it. A page that fails ends
+   * the iteration with its error.
+   */
+  async *allGrants(request: ListGrantsRequest, options?: CallOptions): AsyncGenerator<Grant, void, undefined> {
+    for (let page = request; ; ) {
+      const response = await this.listGrants(page, options);
+      yield* response.grants ?? [];
+      if (!response.nextPageToken) return;
+      page = { ...page, pageToken: response.nextPageToken };
+    }
+  }
+
+  /**
+   * Makes a grant on an `ENCRYPT_DECRYPT` key for one host, refused with
+   * `BAD_REQUEST` for a key of another purpose, a host that isn't one of
+   * the region's, an empty encryption context, or a `ttl` outside 1 to 60
+   * minutes, and with `CONFLICT` for a key that isn't enabled. Needs
+   * `kms.grant.create` on the project.
+   */
+  async createGrant(request: CreateGrantRequest, options?: CallOptions): Promise<Grant> {
+    if (!request.requestId) request = { ...request, requestId: newRequestId() };
+    const p0 = pathValue("parent", request.parent, "projects/*/regions/*/keys/*");
+    return this.service.call<Grant>(
+      {
+        method: "POST",
+        path: `/v1beta1/${p0}/grants`,
+        body: request.grant,
+        query: query(request, ["parent", "grant"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Extends a grant that hasn't expired to `ttl` from now. An expired
+   * grant isn't renewed: `CONFLICT`, and a new one is made instead. Needs
+   * `kms.grant.update` on the project.
+   */
+  async renewGrant(request: RenewGrantRequest, options?: CallOptions): Promise<Grant> {
+    const p0 = pathValue("name", request.name, "projects/*/regions/*/keys/*/grants/*");
+    return this.service.call<Grant>(
+      {
+        method: "POST",
+        path: `/v1beta1/${p0}:renew`,
+        body: request,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Ends a grant before it expires: from then on it opens nothing. Needs
+   * `kms.grant.delete` on the project.
+   */
+  async deleteGrant(request: DeleteGrantRequest, options?: CallOptions): Promise<Empty> {
+    const p0 = pathValue("name", request.name, "projects/*/regions/*/keys/*/grants/*");
+    return this.service.call<Empty>(
+      {
+        method: "DELETE",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+      },
+      options,
+    );
+  }
+}
+
+/**
+ * A grant: one host may use one key for one operation, with exactly one
+ * encryption context, until `expireTime`.
+ */
+export interface Grant {
+  /** The grant's resource name. */
+  name?: string;
+  /** What the host may do with the key. */
+  operation?: Grant_Operation;
+  /**
+   * The platform host the grant is for, by the SPIFFE ID its certificate
+   * names, which ends in `/zones/{zone}/hosts/{host}`.
+   */
+  grantee?: string;
+  /** The encryption context a use must carry, exactly; never empty. */
+  encryptionContext?: Record<string, string>;
+  /** How long the grant lives from now: 1 to 60 minutes. */
+  ttl?: string;
+  /** The zone that keeps the grant: its host's. */
+  zone?: string;
+  /** Who made the grant. */
+  delegate?: string;
+  /** When the grant was made. */
+  createTime?: string;
+  /** When the grant was last renewed, or made. */
+  renewTime?: string;
+  /** When the grant stops opening anything unless renewed before. */
+  expireTime?: string;
+}
+
+/** What a grant lets its host do. */
+export const Grant_Operation = {
+  /** Not set. */
+  OPERATION_UNSPECIFIED: "OPERATION_UNSPECIFIED",
+  /**
+   * Decrypt ciphertexts made under the key with the grant's encryption
+   * context.
+   */
+  DECRYPT: "DECRYPT",
+} as const;
+
+/** What a grant lets its host do. */
+export type Grant_Operation = (typeof Grant_Operation)[keyof typeof Grant_Operation];
+
+/** The request for GetGrant. */
+export interface GetGrantRequest {
+  /** The grant to return. */
+  name?: string;
+}
+
+/** The request for ListGrants. */
+export interface ListGrantsRequest {
+  /** The key whose grants to list. */
+  parent?: string;
+  /**
+   * The most grants to return; the server clamps it, and 0 means its
+   * default.
+   */
+  pageSize?: number;
+  /** A previous response's `nextPageToken`, for the page after it. */
+  pageToken?: string;
+}
+
+/** The response for ListGrants. */
+export interface ListGrantsResponse {
+  /** The grants on this page. */
+  grants?: Grant[];
+  /** The token for the next page; empty on the last one. */
+  nextPageToken?: string;
+}
+
+/** The request for CreateGrant. */
+export interface CreateGrantRequest {
+  /** The key to grant. */
+  parent?: string;
+  /** The grant to make: its operation, host, encryption context and `ttl`. */
+  grant?: Grant;
+  /**
+   * A UUID; a repeat with the same id within a day returns the grant the
+   * first request made, instead of making a second.
+   */
+  requestId?: string;
+}
+
+/** The request for RenewGrant. */
+export interface RenewGrantRequest {
+  /** The grant to renew. */
+  name?: string;
+  /** How long the grant lives from now: 1 to 60 minutes. */
+  ttl?: string;
+}
+
+/** The request for DeleteGrant. */
+export interface DeleteGrantRequest {
+  /** The grant to end. */
+  name?: string;
+}

package/src/v1beta1/index.ts

@@ -0,0 +1,4 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+
+export * from "./grant.js";
+export * from "./key.js";