@synapseone/sdk 0.9.0-dev.77 → 0.9.0-dev.79

package/dist/iam.d.ts

@@ -164,11 +164,30 @@ export declare class IamService {
     revokeApiKey(keyId: string): Promise<unknown>;
     listApiKeys(accountId: string): Promise<unknown>;
     verifyApiKey(apiKey: string): Promise<unknown>;
+    /** Rotate a key: returns the new secret once; the old key stays valid for `graceSeconds` (0 = revoke now). */
+    rotateApiKey(keyId: string, graceSeconds?: number): Promise<{
+        id: string;
+        apiKey: string;
+        prefix: string;
+        rotatedFrom: string;
+        oldKeyExpiresAt: string;
+    }>;
+    setOrgAdmin(userId: string, isOrgAdmin: boolean): Promise<unknown>;
+    managedPolicies(): Promise<{
+        name: string;
+        description: string;
+        document: any;
+    }[]>;
+    /** Instantiate an AWS-style managed policy (e.g. `ReadOnlyAccess`) in an account. */
+    createManagedPolicy(accountId: string, slug: string, managed: string, description?: string): Promise<unknown>;
     createServiceAccount(accountId: string, slug: string, description?: string): Promise<unknown>;
     listServiceAccounts(accountId: string): Promise<unknown>;
     serviceAccountToken(saId: string, scopes?: string[]): Promise<{
         accessToken: string;
     }>;
+    serviceAccountRoles(saId: string): Promise<unknown>;
+    assignServiceAccountRole(saId: string, roleId: string): Promise<unknown>;
+    unassignServiceAccountRole(saId: string, roleId: string): Promise<unknown>;
     usageSummary(filter?: {
         from?: string | Date;
         to?: string | Date;

package/dist/iam.js

@@ -185,6 +185,23 @@ class IamService {
     verifyApiKey(apiKey) {
         return this.http.req(`/v1/keys/verify`, { method: 'POST', body: JSON.stringify({ apiKey }) });
     }
+    /** Rotate a key: returns the new secret once; the old key stays valid for `graceSeconds` (0 = revoke now). */
+    rotateApiKey(keyId, graceSeconds = 0) {
+        return this.http.req(`/v1/keys/${encodeURIComponent(keyId)}/rotate`, { method: 'POST', body: JSON.stringify({ graceSeconds }) });
+    }
+    // ---- org administrators & managed policies ----
+    setOrgAdmin(userId, isOrgAdmin) {
+        return this.http.req(`/v1/users/${encodeURIComponent(userId)}/org-admin`, { method: 'PUT', body: JSON.stringify({ isOrgAdmin }) });
+    }
+    managedPolicies() {
+        return this.http.req('/v1/managed-policies');
+    }
+    /** Instantiate an AWS-style managed policy (e.g. `ReadOnlyAccess`) in an account. */
+    createManagedPolicy(accountId, slug, managed, description) {
+        return this.http.req(`/v1/accounts/${encodeURIComponent(accountId)}/policies`, {
+            method: 'POST', body: JSON.stringify({ slug, managed, ...(description ? { description } : {}) }),
+        });
+    }
     // ---- service accounts ----
     createServiceAccount(accountId, slug, description = '') {
         return this.http.req(`/v1/accounts/${encodeURIComponent(accountId)}/service-accounts`, { method: 'POST', body: JSON.stringify({ slug, description }) });
@@ -198,6 +215,15 @@ class IamService {
             body: JSON.stringify(scopes === undefined ? {} : { scopes }),
         });
     }
+    serviceAccountRoles(saId) {
+        return this.http.req(`/v1/service-accounts/${encodeURIComponent(saId)}/roles`);
+    }
+    assignServiceAccountRole(saId, roleId) {
+        return this.http.req(`/v1/service-accounts/${encodeURIComponent(saId)}/roles`, { method: 'POST', body: JSON.stringify({ roleId }) });
+    }
+    unassignServiceAccountRole(saId, roleId) {
+        return this.http.req(`/v1/service-accounts/${encodeURIComponent(saId)}/roles/${encodeURIComponent(roleId)}`, { method: 'DELETE' });
+    }
     // ---- usage & telemetry ----
     usageSummary(filter) {
         const qs = new URLSearchParams();

package/dist/services.test.js

@@ -666,3 +666,42 @@ function payload(method, path, body) {
         }
     });
 });
+(0, node_test_1.describe)('IAM token management', () => {
+    (0, node_test_1.it)('rotation, org admins, managed policies and service-account roles', async () => {
+        const hits = [];
+        const server = node_http_1.default.createServer((req, res) => {
+            const chunks = [];
+            req.on('data', (c) => chunks.push(Buffer.from(c)));
+            req.on('end', () => {
+                hits.push({ method: req.method || 'GET', path: req.url || '/', body: Buffer.concat(chunks) });
+                res.setHeader('Content-Type', 'application/json');
+                res.end(JSON.stringify({ ok: true }));
+            });
+        });
+        await new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+        const a = server.address();
+        const c = new index_1.SynapseOneClient({ baseUrl: `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`, token: 'T' });
+        const last = () => hits[hits.length - 1];
+        try {
+            await c.iam.rotateApiKey('k1', 300);
+            strict_1.default.equal(last().path, '/v1/keys/k1/rotate');
+            strict_1.default.deepEqual(JSON.parse(last().body.toString()), { graceSeconds: 300 });
+            await c.iam.setOrgAdmin('u1', true);
+            strict_1.default.equal(last().method, 'PUT');
+            strict_1.default.deepEqual(JSON.parse(last().body.toString()), { isOrgAdmin: true });
+            await c.iam.managedPolicies();
+            strict_1.default.equal(last().path, '/v1/managed-policies');
+            await c.iam.createManagedPolicy('acc1', 'readers', 'ReadOnlyAccess');
+            strict_1.default.deepEqual(JSON.parse(last().body.toString()), { slug: 'readers', managed: 'ReadOnlyAccess' });
+            await c.iam.assignServiceAccountRole('sa1', 'r1');
+            strict_1.default.equal(last().path, '/v1/service-accounts/sa1/roles');
+            await c.iam.unassignServiceAccountRole('sa1', 'r1');
+            strict_1.default.equal(last().path, '/v1/service-accounts/sa1/roles/r1');
+            await c.iam.serviceAccountRoles('sa1');
+            strict_1.default.equal(last().method, 'GET');
+        }
+        finally {
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synapseone/sdk",
-  "version": "0.9.0-dev.77",
+  "version": "0.9.0-dev.79",
   "license": "Apache-2.0",
   "description": "synapseone SDK for JavaScript/TypeScript",
   "homepage": "https://synapseone.space",