@origincloud/sts 0.25.0 → 0.25.2

package/dist/v1beta1/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./sts.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/v1beta1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/v1beta1/index.ts"],"names":[],"mappings":"AAEA,cAAc,UAAU,CAAC"}

package/dist/v1beta1/index.js

@@ -0,0 +1,3 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+export * from "./sts.js";
+//# sourceMappingURL=index.js.map

package/dist/v1beta1/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/v1beta1/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,cAAc,UAAU,CAAC"}

package/dist/v1beta1/sts.d.ts

@@ -0,0 +1,64 @@
+import type { CallOptions, Client, Service } from "@origincloud/core";
+/**
+ * Calls SecurityTokenService.
+ *
+ * The security token service: it turns a token from an identity provider
+ * outside Origin Cloud, such as a CI job's OIDC token, into the access token
+ * of a `WORKLOAD` service account that trusts it through a federated
+ * credential. It authenticates no caller: the token is the proof.
+ */
+export declare class SecurityTokenClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    readonly service: Service;
+    /** A client of SecurityTokenService that sends its calls through `client`. */
+    constructor(client: Client);
+    /**
+     * Assumes a `WORKLOAD` service account with an OIDC token. Exactly one
+     * federated credential, of the named service account or of any, must
+     * trust the token: its issuer and audience, and every one of its
+     * conditions. The token is verified with its issuer's published keys
+     * (RS256), and a pull request's job is admitted only by a credential that
+     * names its `event_name`. Refused with `PERMISSION_DENIED` when the token
+     * isn't trusted, without saying why, and with `UNAVAILABLE` when its
+     * issuer or the trust can't be read now.
+     */
+    assumeServiceAccount(request: AssumeServiceAccountRequest, options?: CallOptions): Promise<AssumeServiceAccountResponse>;
+}
+/** The request of `AssumeServiceAccount`. */
+export interface AssumeServiceAccountRequest {
+    /** The OIDC token, a JWT its issuer signed, such as a CI job's. */
+    token?: string;
+    /**
+     * The service account to assume,
+     * `organizations/{organization}/serviceAccounts/{service_account}`. Only
+     * its federated credentials are considered. Without it, any service
+     * account's credential that trusts the token is.
+     */
+    serviceAccount?: string;
+    /**
+     * How long the access token lives: from 60 seconds to 1 hour, 15 minutes
+     * when unset.
+     */
+    lifetime?: string;
+}
+/** The response of `AssumeServiceAccount`. */
+export interface AssumeServiceAccountResponse {
+    /**
+     * The service account's access token, sent as `Authorization: Bearer
+     * <access_token>`.
+     */
+    accessToken?: string;
+    /** When the access token expires. */
+    expireTime?: string;
+    /**
+     * The service account assumed,
+     * `organizations/{organization}/serviceAccounts/{service_account}`.
+     */
+    serviceAccount?: string;
+    /** The federated credential that trusted the token. */
+    federatedCredential?: string;
+}
+//# sourceMappingURL=sts.d.ts.map

package/dist/v1beta1/sts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts.d.ts","sourceRoot":"","sources":["../../src/v1beta1/sts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEtE;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,8EAA8E;gBAClE,MAAM,EAAE,MAAM;IAI1B;;;;;;;;;OASG;IACG,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,4BAA4B,CAAC;CAW/H;AAED,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC1C,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/v1beta1/sts.js

@@ -0,0 +1,40 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/sts/v1beta1/sts.proto
+/**
+ * Calls SecurityTokenService.
+ *
+ * The security token service: it turns a token from an identity provider
+ * outside Origin Cloud, such as a CI job's OIDC token, into the access token
+ * of a `WORKLOAD` service account that trusts it through a federated
+ * credential. It authenticates no caller: the token is the proof.
+ */
+export class SecurityTokenClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    service;
+    /** A client of SecurityTokenService that sends its calls through `client`. */
+    constructor(client) {
+        this.service = client.service("sts", false);
+    }
+    /**
+     * Assumes a `WORKLOAD` service account with an OIDC token. Exactly one
+     * federated credential, of the named service account or of any, must
+     * trust the token: its issuer and audience, and every one of its
+     * conditions. The token is verified with its issuer's published keys
+     * (RS256), and a pull request's job is admitted only by a credential that
+     * names its `event_name`. Refused with `PERMISSION_DENIED` when the token
+     * isn't trusted, without saying why, and with `UNAVAILABLE` when its
+     * issuer or the trust can't be read now.
+     */
+    async assumeServiceAccount(request, options) {
+        return this.service.call({
+            method: "POST",
+            path: `/v1beta1:assumeServiceAccount`,
+            body: request,
+            unauthenticated: true,
+        }, options);
+    }
+}
+//# sourceMappingURL=sts.js.map

package/dist/v1beta1/sts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts.js","sourceRoot":"","sources":["../../src/v1beta1/sts.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,4CAA4C;AAI5C;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;OAGG;IACM,OAAO,CAAU;IAE1B,8EAA8E;IAC9E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAqB;QACpF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,OAAO;YACb,eAAe,EAAE,IAAI;SACtB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@origincloud/sts",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "Origin Cloud's STS service: the security token service: it turns a token from an identity provider outside Origin Cloud, such as a CI job's OIDC token, into the access token of a WORKLOAD service account that trusts it through a federated credential.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
@@ -34,9 +34,9 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "peerDependencies": {
-    "@origincloud/core": "^0.25.0"
+    "@origincloud/core": "^0.25.2"
   },
   "devDependencies": {
-    "@origincloud/core": "^0.25.0"
+    "@origincloud/core": "^0.25.2"
   }
 }

package/src/v1beta1/sts.ts

@@ -20,7 +20,7 @@ export class SecurityTokenClient {
 
   /** A client of SecurityTokenService that sends its calls through `client`. */
   constructor(client: Client) {
-    this.service = client.service("sts", true);
+    this.service = client.service("sts", false);
   }
 
   /**
@@ -39,6 +39,7 @@ export class SecurityTokenClient {
         method: "POST",
         path: `/v1beta1:assumeServiceAccount`,
         body: request,
+        unauthenticated: true,
       },
       options,
     );