@vibexp/api-client 0.97.0 → 0.98.0

package/dist/axios/sdk.gen.js

@@ -4181,6 +4181,347 @@ export const listAdminAiSummarySettingsAudit = (options) => (options?.client ??
     url: '/api/v1/admin/settings/ai-summary/audit',
     ...options
 });
+/**
+ * List the sign-in identity providers
+ *
+ * Returns every stored sign-in identity provider in sign-in page order, each
+ * with its health on the replica serving the request, whether a client secret
+ * is stored (`has_client_secret`; the secret itself is never returned) and the
+ * derived `redirect_uri` to register with the identity provider, together with
+ * the authentication settings `version`. Reading the list resolves the enabled
+ * providers first, so `health` reflects their current configuration.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const listAdminAuthProviders = (options) => (options?.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/providers',
+    ...options
+});
+/**
+ * Create a sign-in identity provider
+ *
+ * Validates and stores a new provider, taking effect on the next sign-in with
+ * no restart, and appends one entry (`action: upsert`) to the `auth_providers`
+ * audit log in the same transaction. The client secret is stored encrypted and
+ * never returned. A body carrying an unknown field is rejected with 400.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const createAdminAuthProvider = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/providers',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Test a sign-in identity provider
+ *
+ * Checks a stored provider (`id`), an unsaved candidate, or a stored provider
+ * with some fields replaced (see `AdminAuthProviderTestRequest`): OIDC
+ * discovery for `oidc` and `google`, a credential check against GitHub for
+ * `github`. Nothing is stored and nothing is audited. A failed test is still a
+ * 200, reported with `is_valid: false`.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const testAdminAuthProvider = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/providers/test',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete a sign-in identity provider
+ *
+ * Removes the provider, taking effect on the next sign-in, and appends one
+ * entry (`action: delete`) to the `auth_providers` audit log in the same
+ * transaction.
+ *
+ * Lockout guard: deleting the last enabled provider, or the provider the
+ * calling admin's session was issued by, is rejected with 409 `lockout_risk`
+ * unless `confirm_lockout_risk=true` is passed.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const deleteAdminAuthProvider = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/providers/{id}',
+    ...options
+});
+/**
+ * Replace a sign-in identity provider
+ *
+ * Validates and stores a whole replacement of the provider's editable fields
+ * (`type` and `slug` are immutable), taking effect on the next sign-in, and
+ * appends one entry (`action: upsert`) to the `auth_providers` audit log in the
+ * same transaction. Omitting `client_secret` keeps the stored one.
+ *
+ * Lockout guard: a change that disables the last enabled provider, or the
+ * provider the calling admin's session was issued by, is rejected with 409
+ * `lockout_risk` (the problem's `metadata.reason` is `no_enabled_provider` or
+ * `own_provider`) unless the body sets `confirm_lockout_risk: true`.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const updateAdminAuthProvider = (options) => (options.client ?? client).put({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/providers/{id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Reset the sign-in access allowlist to open access
+ *
+ * Removes the stored allowlist, so every user may sign in, and appends one
+ * entry (`action: delete`) to the `auth_allowlist` audit log. Idempotent and
+ * unconditional: with nothing stored it is still a 204 and writes no audit
+ * entry.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const resetAdminAuthAllowlist = (options) => (options?.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/allowlist',
+    ...options
+});
+/**
+ * Get the sign-in access allowlist
+ *
+ * Returns the stored access allowlist. Always 200: with nothing stored both
+ * lists are empty, `active` is false and `version` is null.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const getAdminAuthAllowlist = (options) => (options?.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/allowlist',
+    ...options
+});
+/**
+ * Replace the sign-in access allowlist
+ *
+ * Validates, normalizes and stores a whole replacement of the access
+ * allowlist, enforced on signed-in users within seconds with no restart, and
+ * appends one entry (`action: upsert`) to the `auth_allowlist` audit log in the
+ * same transaction. Use the preview operation first to see who would be
+ * affected. A body that omits a list, sends one as null, or carries an unknown
+ * field is rejected with 400.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const updateAdminAuthAllowlist = (options) => (options.client ?? client).put({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/allowlist',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Preview the impact of a candidate access allowlist
+ *
+ * Reports the active users who would stop matching if the candidate replaced
+ * the stored allowlist: their count and a capped sample of their emails.
+ * Nothing is stored and nothing is audited.
+ * Instance admin or a first-run setup session; every other request receives 404.
+ *
+ */
+export const previewAdminAuthAllowlist = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/allowlist/preview',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List the instance admins
+ *
+ * Returns the root admins (the emails named in config.yaml's
+ * `auth.instance_admins`, read-only) and the admins granted in the database.
+ * Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+ *
+ */
+export const listAdminInstanceAdmins = (options) => (options?.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/admins',
+    ...options
+});
+/**
+ * Grant instance admin to an existing user
+ *
+ * Makes an existing, active user an instance admin, named by `user_id` or
+ * `email`, and appends one entry to the `instance_admins` audit log.
+ * Idempotent: granting a user who already holds a grant returns it unchanged
+ * and audits nothing. Only a ROOT admin may grant: a database-granted admin
+ * receives 403.
+ * Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+ *
+ */
+export const grantAdminInstanceAdmin = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/admins',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Revoke a database-granted instance admin
+ *
+ * Removes the user's instance admin grant and appends one entry to the
+ * `instance_admins` audit log. Only a ROOT admin may revoke: a database-granted
+ * admin receives 403.
+ * Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+ *
+ */
+export const revokeAdminInstanceAdmin = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/admins/{user_id}',
+    ...options
+});
+/**
+ * List an authentication setting's audit log
+ *
+ * Returns one page of the audit log of one authentication setting
+ * (`auth_providers`, `auth_allowlist`, `instance_admins` or `auth_setup`),
+ * newest first, with each actor's display name resolved. Snapshots never
+ * contain a credential. Pass the previous page's `next_cursor` to continue.
+ * Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+ *
+ */
+export const listAdminAuthSettingsAudit = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/admin/settings/auth/audit',
+    ...options
+});
 /**
  * List a resource's comments
  *