@slicervm/sdk 0.1.6 → 0.1.7

package/dist/index.cjs

@@ -266,6 +266,7 @@ function createVMReqToWire(r) {
   if (r.ip !== void 0) o.ip = r.ip;
   if (r.tags !== void 0) o.tags = r.tags;
   if (r.secrets !== void 0) o.secrets = r.secrets;
+  if (r.network !== void 0) o.network = r.network;
   return o;
 }
 function createVMResFromWire(w) {
@@ -1262,17 +1263,173 @@ function buildListQuery(opts) {
   return s ? `?${s}` : "";
 }
 
+// src/proxy.ts
+var ProxySecretBearer = "bearer";
+var ProxySecretBasic = "basic";
+function clientFromWire(w) {
+  return { name: w.name, createdAt: w.created_at };
+}
+function clientCreatedFromWire(w) {
+  return { name: w.name, token: w.token, createdAt: w.created_at };
+}
+function secretFromWire2(w) {
+  const out = { name: w.name, host: w.host, createdAt: w.created_at };
+  if (w.type) out.type = w.type;
+  return out;
+}
+function ruleFromWire(w) {
+  const out = { host: w.host };
+  if (w.secret) out.secret = w.secret;
+  if (w.methods && w.methods.length > 0) out.methods = w.methods;
+  if (w.paths && w.paths.length > 0) out.paths = w.paths;
+  if (w.expires && w.expires !== "0001-01-01T00:00:00Z") out.expires = w.expires;
+  if (w.passthrough) out.passthrough = w.passthrough;
+  return out;
+}
+var ProxyAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+    this.clients = new ProxyClientsAPI(transport);
+    this.secrets = new ProxySecretsAPI(transport);
+    this.allows = new ProxyAllowsAPI(transport);
+  }
+  transport;
+  clients;
+  secrets;
+  allows;
+};
+var ProxyClientsAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Mint a new proxy client. The returned token is shown once. */
+  async create(name, opts = {}) {
+    const body = { name };
+    if (opts.token) body.token = opts.token;
+    const wire = await this.transport.request(
+      "POST",
+      "/proxy/v1/clients",
+      body
+    );
+    return clientCreatedFromWire(wire);
+  }
+  async list() {
+    const wire = await this.transport.request("GET", "/proxy/v1/clients");
+    return (wire ?? []).map(clientFromWire);
+  }
+  /**
+   * Revoke the token, drop every allow rule the client owned, and
+   * remove the client.
+   */
+  async delete(name) {
+    await this.transport.request("DELETE", `/proxy/v1/clients/${encodeURIComponent(name)}`);
+  }
+  /** List a client's allow rules in declaration order (first-match-wins). */
+  async rules(name) {
+    const wire = await this.transport.request(
+      "GET",
+      `/proxy/v1/clients/${encodeURIComponent(name)}`
+    );
+    return (wire ?? []).map(ruleFromWire);
+  }
+};
+var ProxySecretsAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  async create(req) {
+    const body = {
+      name: req.name,
+      host: req.host,
+      value: req.value
+    };
+    if (req.type) body.type = req.type;
+    await this.transport.request("POST", "/proxy/v1/secrets", body);
+  }
+  async list() {
+    const wire = await this.transport.request("GET", "/proxy/v1/secrets");
+    return (wire ?? []).map(secretFromWire2);
+  }
+  /**
+   * Remove a secret. Allow rules that reference it stop matching until
+   * the secret is recreated or the rule is rewritten.
+   */
+  async delete(name) {
+    await this.transport.request("DELETE", `/proxy/v1/secrets/${encodeURIComponent(name)}`);
+  }
+};
+var ProxyAllowsAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Add an allow rule. Returns the resolved rule with absolute `expires`. */
+  async add(req) {
+    const body = {
+      client: req.client,
+      host: req.host
+    };
+    if (req.secret) body.secret = req.secret;
+    if (req.methods && req.methods.length > 0) body.methods = req.methods;
+    if (req.paths && req.paths.length > 0) body.paths = req.paths;
+    if (req.ttlSeconds && req.ttlSeconds > 0) body.ttl_seconds = req.ttlSeconds;
+    if (req.passthrough) body.passthrough = true;
+    const wire = await this.transport.request(
+      "POST",
+      "/proxy/v1/allows",
+      body
+    );
+    return ruleFromWire(wire);
+  }
+  /**
+   * Host-bulk revoke: removes **every** rule on the client whose host
+   * matches. For surgical removal of one rule among siblings on the
+   * same host (e.g. several path-scoped rules on `github.com`), use
+   * `removeByTuple` instead.
+   */
+  async remove(client, host) {
+    await this.transport.request(
+      "DELETE",
+      `/proxy/v1/allows/${encodeURIComponent(client)}/${encodeURIComponent(host)}`
+    );
+  }
+  /**
+   * Surgical revoke: removes the single rule whose
+   * (host, methods, paths, passthrough) tuple matches the request.
+   * Pass exactly the same fields you used at create time. Method and
+   * host casing are normalised server-side, so `"GET"` / `"get"` and
+   * `"github.com"` / `"GITHUB.COM"` all match the same stored rule.
+   *
+   * Returns 404 (surfaced as a SlicerAPIError) when no rule matches.
+   */
+  async removeByTuple(req) {
+    const body = {
+      client: req.client,
+      host: req.host
+    };
+    if (req.secret) body.secret = req.secret;
+    if (req.methods && req.methods.length > 0) body.methods = req.methods;
+    if (req.paths && req.paths.length > 0) body.paths = req.paths;
+    if (req.passthrough) body.passthrough = true;
+    await this.transport.request("POST", "/proxy/v1/allows/revoke", body);
+  }
+};
+
 // src/client.ts
 var SlicerClient = class _SlicerClient {
   transport;
   hostGroups;
   vms;
   secrets;
+  proxy;
   constructor(opts) {
     this.transport = new TransportClient(opts);
     this.hostGroups = new HostGroupsAPI(this.transport);
     this.vms = new VMsAPI(this.transport);
     this.secrets = new SecretsAPI(this.transport);
+    this.proxy = new ProxyAPI(this.transport);
   }
   static fromEnv(overrides = {}) {
     const baseURL = overrides.baseURL ?? process.env.SLICER_URL;
@@ -1441,6 +1598,12 @@ exports.GiB = GiB;
 exports.HostGroupsAPI = HostGroupsAPI;
 exports.MiB = MiB;
 exports.NonRootUser = NonRootUser;
+exports.ProxyAPI = ProxyAPI;
+exports.ProxyAllowsAPI = ProxyAllowsAPI;
+exports.ProxyClientsAPI = ProxyClientsAPI;
+exports.ProxySecretBasic = ProxySecretBasic;
+exports.ProxySecretBearer = ProxySecretBearer;
+exports.ProxySecretsAPI = ProxySecretsAPI;
 exports.SecretExistsError = SecretExistsError;
 exports.SecretsAPI = SecretsAPI;
 exports.SlicerAPIError = SlicerAPIError;