@ory/argus 0.14.0 → 1.0.0

package/dist/local/configs.d.ts

@@ -4,6 +4,7 @@
  * Each function returns the file content as a string. The local manager
  * writes these into .ory-dev/ory/ at runtime so Docker Compose can mount them.
  */
+import { type ResolvedLocalPorts } from "./ports.js";
 export type ConsoleSource = "env" | "default";
 export interface GatewayConfig {
     /** Path under GATEWAY_URL that returns 2xx when the gateway is ready. */
@@ -63,6 +64,29 @@ export declare function getGatewayConfig(): GatewayConfig;
  * root** (two levels up) — see {@link monorepoRootForConsoleApp}.
  */
 export declare function getConsoleConfig(projectRoot?: string): ConsoleConfig;
+export interface OathkeeperConfig {
+    /** Whether to front the Keto `/user/*` read path with Oathkeeper. */
+    enabled: boolean;
+}
+/**
+ * Resolve whether the local stack should front Keto's token-authenticated
+ * `/user/*` read path with a real **Oathkeeper** service.
+ *
+ * **On by default** so the local stack mirrors the hosted token-introspection
+ * contract: an Oathkeeper service configured like the hosted
+ * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
+ * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
+ * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
+ * read permissions locally, exactly as it is on a hosted Ory project. (The
+ * plugin's agent DCR / user PKCE tokens are populated before any permission read
+ * runs, so this is transparent in the normal flow.)
+ *
+ * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
+ * to a transparent nginx passthrough that strips `/user` and forwards straight to
+ * keto-read with **no** auth — a leaner stack that matches the hosted *path shape*
+ * only, useful when iterating on something unrelated to the auth layer.
+ */
+export declare function getOathkeeperConfig(): OathkeeperConfig;
 /**
  * Render the docker-compose YAML.
  *
@@ -70,32 +94,64 @@ export declare function getConsoleConfig(projectRoot?: string): ConsoleConfig;
  * emitted. When omitted, it is resolved via `getConsoleConfig(projectRoot)`.
  * The nginx API gateway and the login UI are always emitted.
  */
-export declare function dockerComposeYaml(projectRoot?: string, consoleCfg?: ConsoleConfig): string;
+export declare function dockerComposeYaml(projectRoot?: string, consoleCfg?: ConsoleConfig, oathkeeperCfg?: OathkeeperConfig): string;
 export declare function kratosConfigYaml(): string;
 export declare function kratosIdentitySchema(): string;
 export declare function ketoConfigYaml(): string;
 export declare function hydraConfigYaml(): string;
+/**
+ * Oathkeeper server config. Only written when `ORY_LOCAL_OATHKEEPER` is set.
+ *
+ * Serves the proxy (the gateway forwards `/user/*` here) and the API port, and
+ * declares the handlers the access rule references: the `oauth2_introspection`
+ * authenticator introspects the plugin's OAuth2 access token against Hydra's
+ * admin introspection endpoint, `allow` authorizes, and `noop` mutates. Rules
+ * use the `regexp` matching strategy so the `/user/*` URL pattern resolves.
+ */
+export declare function oathkeeperConfigYaml(): string;
+/**
+ * Oathkeeper access rule mirroring the hosted
+ * `ory-corp:cloud:keto:read:user-token` rule: token-introspect the caller,
+ * `allow`, and forward to keto-read with the `/user` prefix stripped. Scoped to
+ * the same read surface as hosted — `/user/relation-tuples*` and
+ * `/user/namespaces*` — on GET/HEAD/POST.
+ */
+export declare function oathkeeperAccessRulesYaml(): string;
 /**
  * Nginx config that acts as a unified API gateway, replicating what
  * Ory Network does: route all API paths to the correct backend service
  * so the @ory/client SDK works with a single basePath.
  */
-export declare function nginxConf(): string;
-export declare const GATEWAY_PORT = 4000;
-export declare const GATEWAY_URL = "http://localhost:4000";
-export declare const CONSOLE_PORT = 4100;
-export declare const CONSOLE_URL = "http://localhost:4100";
-export declare const LOGIN_UI_PORT = 4455;
-export declare const LOGIN_UI_URL = "http://localhost:4455";
-export declare const KRATOS_PUBLIC_PORT = 4433;
-export declare const KRATOS_ADMIN_PORT = 4434;
-export declare const KETO_READ_PORT = 4466;
-export declare const KETO_WRITE_PORT = 4467;
-export declare const HYDRA_PUBLIC_PORT = 4444;
-export declare const HYDRA_ADMIN_PORT = 4445;
-export declare const JAEGER_UI_PORT = 16686;
-export declare const JAEGER_OTLP_HTTP_PORT = 4318;
-export declare const JAEGER_UI_URL = "http://localhost:16686";
-export declare const JAEGER_OTLP_HTTP_URL = "http://localhost:4318";
+export declare function nginxConf(oathkeeperEnabled?: boolean): string;
+/**
+ * Problems found while resolving ports (an unparseable value, an offset that
+ * runs off the end of the port range, two services pinned to one port). The
+ * manager prints these before starting so a typo'd override doesn't silently
+ * fall back to a default the user thought they had changed.
+ */
+export declare const LOCAL_PORT_WARNINGS: readonly string[];
+/** The host every generated URL advertises, and where that value came from. */
+export declare const LOCAL_STACK_HOST: string;
+export declare const LOCAL_STACK_HOST_SOURCE: import("./ports.js").LocalHostSource;
+export declare const GATEWAY_PORT: number;
+export declare const GATEWAY_URL: string;
+export declare const CONSOLE_PORT: number;
+export declare const CONSOLE_URL: string;
+export declare const LOGIN_UI_PORT: number;
+export declare const LOGIN_UI_URL: string;
+export declare const KRATOS_PUBLIC_PORT: number;
+export declare const KRATOS_ADMIN_PORT: number;
+export declare const KETO_READ_PORT: number;
+export declare const KETO_WRITE_PORT: number;
+export declare const HYDRA_PUBLIC_PORT: number;
+export declare const HYDRA_ADMIN_PORT: number;
+export declare const HYDRA_TOKEN_USER_PORT: number;
+/** Oathkeeper proxy port — the gateway forwards `/user/*` here when
+ * `ORY_LOCAL_OATHKEEPER` is set. Defaults clear of the login-UI port. */
+export declare const OATHKEEPER_PROXY_PORT: number;
+/** Oathkeeper API/rules port. */
+export declare const OATHKEEPER_API_PORT: number;
+/** The resolved host-port set, for the preflight check and `local status`. */
+export declare function getLocalPorts(): ResolvedLocalPorts;
 /** URL the manager probes to confirm the gateway is healthy. */
 export declare function gatewayHealthUrl(): string;