@rstreamlabs/tunnels 1.0.1 → 1.0.2

package/dist/index.js

@@ -46,6 +46,7 @@ __export(index_exports, {
   authTokenPermissionsSchema: () => authTokenPermissionsSchema,
   authTokenSchema: () => authTokenSchema,
   authTokenScopesSchema: () => authTokenScopesSchema,
+  authTokenTunnelGrantSchema: () => authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema: () => authTokenTunnelsScopesSchema,
   clientSchema: () => clientSchema,
   createAPITURNCredentials: () => createAPITURNCredentials,
@@ -77,41 +78,6 @@ module.exports = __toCommonJS(index_exports);
 
 // src/auth-resource.ts
 var import_rstream = require("@rstreamlabs/rstream");
-var import_rstream2 = require("@rstreamlabs/rstream");
-var RstreamAuthResource = class {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async createAuthToken(params, options) {
-    const credentials = options?.credentials || this.client.credentials;
-    if (!(0, import_rstream2.isClientCredentials)(credentials)) {
-      throw new Error(
-        "Application credentials (client id, client secret) are required to create an auth token."
-      );
-    }
-    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
-    return createAuthTokenFromClientCredentials(credentials, params, {
-      engine
-    });
-  }
-};
-function createAuthTokenFromClientCredentials(credentials, params, options) {
-  const payload = {
-    metadata: {
-      engine: options?.engine,
-      scopes: params?.scopes
-    },
-    permissions: null,
-    project_id: params?.project_id,
-    workspace_id: params?.workspace_id
-  };
-  const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
-    claims: payload,
-    expiresInSeconds: params?.expires_in
-  });
-  return { token };
-}
 
 // src/zod.ts
 var z = __toESM(require("zod"));
@@ -141,9 +107,9 @@ function filters(base) {
   const shape = Object.fromEntries(entries);
   const node = z.lazy(
     () => z.union([
-      z.object(shape),
-      z.object({ AND: z.array(node) }),
-      z.object({ OR: z.array(node) })
+      z.object(shape).strict(),
+      z.object({ AND: z.array(node) }).strict(),
+      z.object({ OR: z.array(node) }).strict()
     ])
   );
   return node;
@@ -206,6 +172,7 @@ var listTunnelsResponseSchema = z2.array(tunnelSchema);
 
 // src/auth.ts
 var z3 = __toESM(require("zod"));
+var nonEmptyStringSchema = z3.string().trim().min(1);
 var authTokenPermissionsSchema = z3.array(z3.string());
 var authTokenTunnelsScopesSchema = z3.object({
   // Scopes for creating tunnels
@@ -254,45 +221,121 @@ var authTokenScopesSchema = z3.object({
   tunnels: authTokenTunnelsScopesSchema.optional()
   // Scopes related to tunnels
 });
+var authTokenTunnelGrantSchema = z3.object({
+  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
+  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
+  scopes: authTokenScopesSchema.optional()
+}).strict().superRefine((grant, ctx) => {
+  if (grant.workspaces !== void 0 && grant.projects !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "A grant cannot target workspaces and projects at the same time.",
+      path: ["projects"]
+    });
+  }
+});
+var authTokenCommonSchema = {
+  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
+  exp: z3.number().optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
+  iat: z3.number().optional(),
+  iss: z3.string().optional(),
+  jti: z3.string().optional(),
+  metadata: z3.object({
+    engine: z3.string().optional()
+  }).strict().optional(),
+  nbf: z3.number().optional(),
+  sub: z3.string().optional()
+};
 var authTokenSchema = z3.union([
   z3.object({
     type: z3.literal("auth"),
     userId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  }),
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("pat"),
-    token_endpoint: z3.string().optional()
-  }),
+    token_endpoint: z3.string().optional(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("app"),
     clientId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  })
-]).and(
-  z3.object({
-    workspace_id: z3.string().optional(),
-    project_id: z3.string().optional(),
-    metadata: z3.object({
-      engine: z3.string().optional(),
-      scopes: authTokenScopesSchema.optional()
-    }).optional()
-  })
-);
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict()
+]);
 var tokenSchema = authTokenSchema;
 var createAuthTokenParamsSchema = z3.object({
   expires_in: z3.number().default(60),
   // 1 minute
-  workspace_id: z3.string().optional(),
-  project_id: z3.string().optional(),
   scopes: authTokenScopesSchema.optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
   metadata: z3.unknown().optional()
   // Additional metadata
+}).strict().superRefine((params, ctx) => {
+  if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "Use either scopes or tunnelsGrants, not both.",
+      path: ["tunnelsGrants"]
+    });
+  }
 });
 var createAuthTokenResponseSchema = z3.object({
   token: z3.string()
 });
 
+// src/auth-resource.ts
+var import_rstream2 = require("@rstreamlabs/rstream");
+var RstreamAuthResource = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async createAuthToken(params, options) {
+    const credentials = options?.credentials || this.client.credentials;
+    if (!(0, import_rstream2.isClientCredentials)(credentials)) {
+      throw new Error(
+        "Application credentials (client id, client secret) are required to create an auth token."
+      );
+    }
+    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
+    return createAuthTokenFromClientCredentials(credentials, params, {
+      engine
+    });
+  }
+};
+function createAuthTokenFromClientCredentials(credentials, params, options) {
+  const tokenParams = createAuthTokenParamsSchema.parse(params ?? {});
+  const payload = {
+    metadata: {
+      engine: options?.engine
+    },
+    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams),
+    permissions: null
+  };
+  const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
+    claims: payload,
+    expiresInSeconds: tokenParams.expires_in
+  });
+  return { token };
+}
+function normalizeAuthTokenTunnelGrants(params) {
+  if (!params) {
+    return void 0;
+  }
+  const tunnelsGrants = params.tunnelsGrants;
+  if (tunnelsGrants !== void 0) {
+    return [...tunnelsGrants];
+  }
+  if (params.scopes) {
+    return [{ scopes: params.scopes }];
+  }
+  return void 0;
+}
+
 // src/client.ts
 var z4 = __toESM(require("zod"));
 var clientSchema = z4.object({
@@ -344,7 +387,7 @@ var RstreamClientsResource = class {
 
 // src/stream.ts
 var z5 = __toESM(require("zod"));
-var nonEmptyStringSchema = z5.string().min(1);
+var nonEmptyStringSchema2 = z5.string().min(1);
 var isoDateTimeSchema = z5.string().datetime();
 var ipAddressSchema = z5.string();
 var intNonNegSchema = z5.number().int().nonnegative();
@@ -363,12 +406,12 @@ var httpHeadersSchema = z5.record(
 );
 var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
 var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema,
+  method: nonEmptyStringSchema2,
   scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema.optional(),
-  path: nonEmptyStringSchema.optional(),
+  host: nonEmptyStringSchema2.optional(),
+  path: nonEmptyStringSchema2.optional(),
   query: z5.string().optional(),
-  url: nonEmptyStringSchema.optional(),
+  url: nonEmptyStringSchema2.optional(),
   headers: httpHeadersSchema.optional(),
   userAgent: z5.string().optional()
 });
@@ -463,7 +506,7 @@ var firewallSchema = z5.discriminatedUnion("decision", [
   })
 ]);
 var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelId: nonEmptyStringSchema2.optional(),
   tunnelName: z5.string().optional(),
   protocol: z5.string().optional(),
   published: z5.boolean().optional(),
@@ -514,13 +557,13 @@ var responseSchema = z5.discriminatedUnion("outcome", [
   responseFailedSchema
 ]);
 var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema.optional(),
-  project_id: nonEmptyStringSchema.optional(),
-  cluster_id: nonEmptyStringSchema.optional(),
-  user_id: nonEmptyStringSchema.optional(),
-  client_id: nonEmptyStringSchema.optional(),
-  tunnel_id: nonEmptyStringSchema.optional(),
-  stream_id: nonEmptyStringSchema,
+  workspace_id: nonEmptyStringSchema2.optional(),
+  project_id: nonEmptyStringSchema2.optional(),
+  cluster_id: nonEmptyStringSchema2.optional(),
+  user_id: nonEmptyStringSchema2.optional(),
+  client_id: nonEmptyStringSchema2.optional(),
+  tunnel_id: nonEmptyStringSchema2.optional(),
+  stream_id: nonEmptyStringSchema2,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
   request: z5.object({
@@ -1336,6 +1379,7 @@ function parseWebTTYServers(tunnels) {
   authTokenPermissionsSchema,
   authTokenSchema,
   authTokenScopesSchema,
+  authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema,
   clientSchema,
   createAPITURNCredentials,

package/dist/index.mjs

@@ -1,40 +1,5 @@
 // src/auth-resource.ts
 import { createClientCredentialsToken } from "@rstreamlabs/rstream";
-import { isClientCredentials } from "@rstreamlabs/rstream";
-var RstreamAuthResource = class {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async createAuthToken(params, options) {
-    const credentials = options?.credentials || this.client.credentials;
-    if (!isClientCredentials(credentials)) {
-      throw new Error(
-        "Application credentials (client id, client secret) are required to create an auth token."
-      );
-    }
-    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
-    return createAuthTokenFromClientCredentials(credentials, params, {
-      engine
-    });
-  }
-};
-function createAuthTokenFromClientCredentials(credentials, params, options) {
-  const payload = {
-    metadata: {
-      engine: options?.engine,
-      scopes: params?.scopes
-    },
-    permissions: null,
-    project_id: params?.project_id,
-    workspace_id: params?.workspace_id
-  };
-  const { token } = createClientCredentialsToken(credentials, {
-    claims: payload,
-    expiresInSeconds: params?.expires_in
-  });
-  return { token };
-}
 
 // src/zod.ts
 import * as z from "zod";
@@ -64,9 +29,9 @@ function filters(base) {
   const shape = Object.fromEntries(entries);
   const node = z.lazy(
     () => z.union([
-      z.object(shape),
-      z.object({ AND: z.array(node) }),
-      z.object({ OR: z.array(node) })
+      z.object(shape).strict(),
+      z.object({ AND: z.array(node) }).strict(),
+      z.object({ OR: z.array(node) }).strict()
     ])
   );
   return node;
@@ -129,6 +94,7 @@ var listTunnelsResponseSchema = z2.array(tunnelSchema);
 
 // src/auth.ts
 import * as z3 from "zod";
+var nonEmptyStringSchema = z3.string().trim().min(1);
 var authTokenPermissionsSchema = z3.array(z3.string());
 var authTokenTunnelsScopesSchema = z3.object({
   // Scopes for creating tunnels
@@ -177,45 +143,121 @@ var authTokenScopesSchema = z3.object({
   tunnels: authTokenTunnelsScopesSchema.optional()
   // Scopes related to tunnels
 });
+var authTokenTunnelGrantSchema = z3.object({
+  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
+  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
+  scopes: authTokenScopesSchema.optional()
+}).strict().superRefine((grant, ctx) => {
+  if (grant.workspaces !== void 0 && grant.projects !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "A grant cannot target workspaces and projects at the same time.",
+      path: ["projects"]
+    });
+  }
+});
+var authTokenCommonSchema = {
+  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
+  exp: z3.number().optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
+  iat: z3.number().optional(),
+  iss: z3.string().optional(),
+  jti: z3.string().optional(),
+  metadata: z3.object({
+    engine: z3.string().optional()
+  }).strict().optional(),
+  nbf: z3.number().optional(),
+  sub: z3.string().optional()
+};
 var authTokenSchema = z3.union([
   z3.object({
     type: z3.literal("auth"),
     userId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  }),
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("pat"),
-    token_endpoint: z3.string().optional()
-  }),
+    token_endpoint: z3.string().optional(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("app"),
     clientId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  })
-]).and(
-  z3.object({
-    workspace_id: z3.string().optional(),
-    project_id: z3.string().optional(),
-    metadata: z3.object({
-      engine: z3.string().optional(),
-      scopes: authTokenScopesSchema.optional()
-    }).optional()
-  })
-);
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict()
+]);
 var tokenSchema = authTokenSchema;
 var createAuthTokenParamsSchema = z3.object({
   expires_in: z3.number().default(60),
   // 1 minute
-  workspace_id: z3.string().optional(),
-  project_id: z3.string().optional(),
   scopes: authTokenScopesSchema.optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
   metadata: z3.unknown().optional()
   // Additional metadata
+}).strict().superRefine((params, ctx) => {
+  if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "Use either scopes or tunnelsGrants, not both.",
+      path: ["tunnelsGrants"]
+    });
+  }
 });
 var createAuthTokenResponseSchema = z3.object({
   token: z3.string()
 });
 
+// src/auth-resource.ts
+import { isClientCredentials } from "@rstreamlabs/rstream";
+var RstreamAuthResource = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async createAuthToken(params, options) {
+    const credentials = options?.credentials || this.client.credentials;
+    if (!isClientCredentials(credentials)) {
+      throw new Error(
+        "Application credentials (client id, client secret) are required to create an auth token."
+      );
+    }
+    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
+    return createAuthTokenFromClientCredentials(credentials, params, {
+      engine
+    });
+  }
+};
+function createAuthTokenFromClientCredentials(credentials, params, options) {
+  const tokenParams = createAuthTokenParamsSchema.parse(params ?? {});
+  const payload = {
+    metadata: {
+      engine: options?.engine
+    },
+    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams),
+    permissions: null
+  };
+  const { token } = createClientCredentialsToken(credentials, {
+    claims: payload,
+    expiresInSeconds: tokenParams.expires_in
+  });
+  return { token };
+}
+function normalizeAuthTokenTunnelGrants(params) {
+  if (!params) {
+    return void 0;
+  }
+  const tunnelsGrants = params.tunnelsGrants;
+  if (tunnelsGrants !== void 0) {
+    return [...tunnelsGrants];
+  }
+  if (params.scopes) {
+    return [{ scopes: params.scopes }];
+  }
+  return void 0;
+}
+
 // src/client.ts
 import * as z4 from "zod";
 var clientSchema = z4.object({
@@ -267,7 +309,7 @@ var RstreamClientsResource = class {
 
 // src/stream.ts
 import * as z5 from "zod";
-var nonEmptyStringSchema = z5.string().min(1);
+var nonEmptyStringSchema2 = z5.string().min(1);
 var isoDateTimeSchema = z5.string().datetime();
 var ipAddressSchema = z5.string();
 var intNonNegSchema = z5.number().int().nonnegative();
@@ -286,12 +328,12 @@ var httpHeadersSchema = z5.record(
 );
 var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
 var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema,
+  method: nonEmptyStringSchema2,
   scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema.optional(),
-  path: nonEmptyStringSchema.optional(),
+  host: nonEmptyStringSchema2.optional(),
+  path: nonEmptyStringSchema2.optional(),
   query: z5.string().optional(),
-  url: nonEmptyStringSchema.optional(),
+  url: nonEmptyStringSchema2.optional(),
   headers: httpHeadersSchema.optional(),
   userAgent: z5.string().optional()
 });
@@ -386,7 +428,7 @@ var firewallSchema = z5.discriminatedUnion("decision", [
   })
 ]);
 var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelId: nonEmptyStringSchema2.optional(),
   tunnelName: z5.string().optional(),
   protocol: z5.string().optional(),
   published: z5.boolean().optional(),
@@ -437,13 +479,13 @@ var responseSchema = z5.discriminatedUnion("outcome", [
   responseFailedSchema
 ]);
 var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema.optional(),
-  project_id: nonEmptyStringSchema.optional(),
-  cluster_id: nonEmptyStringSchema.optional(),
-  user_id: nonEmptyStringSchema.optional(),
-  client_id: nonEmptyStringSchema.optional(),
-  tunnel_id: nonEmptyStringSchema.optional(),
-  stream_id: nonEmptyStringSchema,
+  workspace_id: nonEmptyStringSchema2.optional(),
+  project_id: nonEmptyStringSchema2.optional(),
+  cluster_id: nonEmptyStringSchema2.optional(),
+  user_id: nonEmptyStringSchema2.optional(),
+  client_id: nonEmptyStringSchema2.optional(),
+  tunnel_id: nonEmptyStringSchema2.optional(),
+  stream_id: nonEmptyStringSchema2,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
   request: z5.object({
@@ -1258,6 +1300,7 @@ export {
   authTokenPermissionsSchema,
   authTokenSchema,
   authTokenScopesSchema,
+  authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema,
   clientSchema,
   createAPITURNCredentials,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "JS/TS SDK for the rstream tunnels data plane and engine APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "license": "Apache-2.0",