@wtfalch/edge 0.8.0 → 0.10.0

package/dist/client.d.ts

@@ -1,10 +1,19 @@
 import { type ClientOptions } from './transport.js';
-import type { AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, FindServiceTokenResponse, ListClaimsResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
  * refused by the service for any credential but the platform's own. */
 export declare function createEdgeClient(options: ClientOptions): {
+    /** The org's gates. Needs `gates:read` (`gates:edit` for `setPeople`). */
+    gates: {
+        /** The org's gates, each with the people who pass it now. */
+        list: () => Promise<ListGatesResponse>;
+        /** Replaces the people who pass a gate with `emails` (1 to 1000), then ends
+         * the sessions of each person dropped. `notRevoked` names any whose session
+         * could not be ended; the list is replaced regardless. */
+        setPeople: (id: string, emails: string[]) => Promise<SetGatePeopleResponse>;
+    };
     /** The org's DNS records. Needs `records:read` (`records:edit` for changes). */
     records: {
         /** The org's own records, then every other live record in the zone as a
@@ -84,6 +93,19 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** Writes platform rows for the live apps named. Nothing is deleted or
              * recreated, and an app nobody names is left alone. */
             adopt: (input: AdoptAccessAppsRequest) => Promise<AdoptAccessAppsResponse>;
+            /** Resolves when the Cloudflare token holds every Access right gates
+             * need. Rejects with `not_configured`, naming each right it lacks. */
+            readiness: () => Promise<AccessReadinessResponse>;
+            /** Creates the OIDC provider, or updates the one of that name; returns
+             * its id. The client secret is never returned. */
+            ensureProvider: (input: EnsureAccessProviderRequest) => Promise<AccessProviderView>;
+            /** Makes a company's gate. Rejects with `conflict` when the company
+             * already has a gate of that key. */
+            createGate: (input: CreatePlatformGateRequest) => Promise<PlatformGateView>;
+            /** Replaces the hostnames a gate covers. */
+            replaceGateHostnames: (id: string, input: ReplacePlatformGateHostnamesRequest) => Promise<PlatformGateView>;
+            /** Deletes a gate with its application, policy and group. */
+            deleteGate: (id: string) => Promise<PlatformGateView>;
         };
         /** Cloudflare rate limiting rules the platform owns. A zone's rules share
          * one ruleset, so each rule is owned on its own; a rule's `id` is
@@ -104,6 +126,22 @@ export declare function createEdgeClient(options: ClientOptions): {
              * Cloudflare, and anything nobody names is left alone. */
             adopt: (input: AdoptRateLimitRulesRequest) => Promise<AdoptRateLimitRulesResponse>;
         };
+        /** Cloudflare zones the platform made or adopted. A zone is the root of a
+         * company's domain, so there is no delete. A zone's `id` is Cloudflare's zone id. */
+        zones: {
+            /** The live zone with exactly this name (none: an empty list), with its owner (`null`: no row). */
+            list: (filter: ListPlatformZonesRequest) => Promise<ListPlatformZonesResponse>;
+            /** Creates the zone, or returns the one edge already made for that name
+             * (201 when new, 200 after); `nameServers` are what the registrar must
+             * delegate to. Rejects with `conflict` when a zone of that name already
+             * exists at Cloudflare that nobody adopted (adopt it instead, reason
+             * `exists`) or another create of it is in progress (reason `busy`), and
+             * with `conflict` (reason `upstream_rejected`) when Cloudflare refuses
+             * the zone for good. */
+            create: (input: CreatePlatformZoneRequest) => Promise<PlatformZoneView>;
+            /** Writes platform rows for the zones named. Nothing is changed at Cloudflare. */
+            adopt: (input: AdoptZonesRequest) => Promise<AdoptZonesResponse>;
+        };
         /** Cloudflare Workers scripts and routes the platform owns. A script's
          * `id` is its name; a route's `id` is Cloudflare's route id. */
         workers: {

package/dist/client.js

@@ -10,6 +10,17 @@ function query(values) {
 export function createEdgeClient(options) {
     const call = createTransport(options);
     return {
+        /** The org's gates. Needs `gates:read` (`gates:edit` for `setPeople`). */
+        gates: {
+            /** The org's gates, each with the people who pass it now. */
+            list: () => call('GET', '/v1/gates'),
+            /** Replaces the people who pass a gate with `emails` (1 to 1000), then ends
+             * the sessions of each person dropped. `notRevoked` names any whose session
+             * could not be ended; the list is replaced regardless. */
+            setPeople: (id, emails) => call('PUT', `/v1/gates/${encodeURIComponent(id)}/people`, {
+                emails,
+            }),
+        },
         /** The org's DNS records. Needs `records:read` (`records:edit` for changes). */
         records: {
             /** The org's own records, then every other live record in the zone as a
@@ -87,6 +98,19 @@ export function createEdgeClient(options) {
                 /** Writes platform rows for the live apps named. Nothing is deleted or
                  * recreated, and an app nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/access/apps/adopt', input),
+                /** Resolves when the Cloudflare token holds every Access right gates
+                 * need. Rejects with `not_configured`, naming each right it lacks. */
+                readiness: () => call('GET', '/v1/platform/access/readiness'),
+                /** Creates the OIDC provider, or updates the one of that name; returns
+                 * its id. The client secret is never returned. */
+                ensureProvider: (input) => call('PUT', '/v1/platform/access/identity-providers', input),
+                /** Makes a company's gate. Rejects with `conflict` when the company
+                 * already has a gate of that key. */
+                createGate: (input) => call('POST', '/v1/platform/access/gates', input),
+                /** Replaces the hostnames a gate covers. */
+                replaceGateHostnames: (id, input) => call('PUT', `/v1/platform/access/gates/${encodeURIComponent(id)}/hostnames`, input),
+                /** Deletes a gate with its application, policy and group. */
+                deleteGate: (id) => call('DELETE', `/v1/platform/access/gates/${encodeURIComponent(id)}`),
             },
             /** Cloudflare rate limiting rules the platform owns. A zone's rules share
              * one ruleset, so each rule is owned on its own; a rule's `id` is
@@ -107,6 +131,22 @@ export function createEdgeClient(options) {
                  * Cloudflare, and anything nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/ratelimits/adopt', input),
             },
+            /** Cloudflare zones the platform made or adopted. A zone is the root of a
+             * company's domain, so there is no delete. A zone's `id` is Cloudflare's zone id. */
+            zones: {
+                /** The live zone with exactly this name (none: an empty list), with its owner (`null`: no row). */
+                list: (filter) => call('GET', `/v1/platform/zones?${new URLSearchParams({ name: filter.name })}`),
+                /** Creates the zone, or returns the one edge already made for that name
+                 * (201 when new, 200 after); `nameServers` are what the registrar must
+                 * delegate to. Rejects with `conflict` when a zone of that name already
+                 * exists at Cloudflare that nobody adopted (adopt it instead, reason
+                 * `exists`) or another create of it is in progress (reason `busy`), and
+                 * with `conflict` (reason `upstream_rejected`) when Cloudflare refuses
+                 * the zone for good. */
+                create: (input) => call('POST', '/v1/platform/zones', input),
+                /** Writes platform rows for the zones named. Nothing is changed at Cloudflare. */
+                adopt: (input) => call('POST', '/v1/platform/zones/adopt', input),
+            },
             /** Cloudflare Workers scripts and routes the platform owns. A script's
              * `id` is its name; a route's `id` is Cloudflare's route id. */
             workers: {

package/dist/types.d.ts

@@ -359,6 +359,75 @@ export interface CreatePlatformAccessPolicyRequest {
     exclude?: AccessRule[];
     require?: AccessRule[];
 }
+/** The sign-in provider every gate requires: a generic OIDC provider, found by `name`. */
+export interface EnsureAccessProviderRequest {
+    name: string;
+    clientId: string;
+    /** Sent to Cloudflare and never returned. */
+    clientSecret: string;
+    authUrl: string;
+    tokenUrl: string;
+    certsUrl: string;
+    scopes: string[];
+    claims: string[];
+}
+export interface AccessProviderView {
+    /** Cloudflare's id for the provider: what a gate takes as `providerId`. */
+    id: string;
+    name: string;
+}
+/** Whether the Cloudflare token holds every Access right gates need. A token that lacks one rejects with `not_configured`, naming each missing right. */
+export interface AccessReadinessResponse {
+    ready: true;
+}
+/** Makes a company's gate: an application over `hostnames`, a group of `emails`, and a policy that requires the provider and one OIDC claim. */
+export interface CreatePlatformGateRequest {
+    organisationId: string;
+    /** A lower-case DNS label, unique in the company. */
+    key: string;
+    /** The hostnames the gate covers, a leading `*.` allowed. */
+    hostnames: string[];
+    /** The provider's id from `ensureProvider`. */
+    providerId: string;
+    claimName: string;
+    claimValue: string;
+    /** The first list of people: 1 to 1000 addresses. */
+    emails: string[];
+}
+export interface ReplacePlatformGateHostnamesRequest {
+    hostnames: string[];
+}
+/** A company's gate. `id` is edge's gate id, which the change and delete calls take. */
+export interface PlatformGateView {
+    id: string;
+    organisationId: string;
+    key: string;
+    hostnames: string[];
+    providerId: string;
+    applicationId: string;
+    groupId: string;
+}
+/** A gate as its company sees it. */
+export interface GateView {
+    /** Edge's gate id: what `setPeople` takes. */
+    id: string;
+    key: string;
+    hostnames: string[];
+    /** The addresses that pass the gate, lower-case. */
+    people: string[];
+}
+export interface ListGatesResponse {
+    gates: GateView[];
+}
+/** The whole list of people for a gate: 1 to 1000 addresses. Duplicates collapse and case is ignored. */
+export interface SetGatePeopleRequest {
+    emails: string[];
+}
+/** The gate with its new people. The list is replaced even when a revoke fails. */
+export interface SetGatePeopleResponse extends GateView {
+    /** Addresses the new list dropped whose sessions could not be ended. Empty when all were. */
+    notRevoked: string[];
+}
 /** A service token's id and name. Its secret is never returned. */
 export interface FindServiceTokenResponse {
     token: {
@@ -567,3 +636,52 @@ export interface AdoptRateLimitRulesResponse {
     /** Live rules in the named zones that no entry named. Reported, never touched. */
     unclaimed: PlatformRateLimitRuleView[];
 }
+/** A Cloudflare zone seen with the platform credential. A zone is the root of a
+ * company's domain, so edge only looks it up, creates it and adopts it: there is no delete. */
+export interface PlatformZoneView {
+    /** Cloudflare's zone id. */
+    id: string;
+    name: string;
+    /** Cloudflare's zone status, such as `pending` until the registrar delegates. */
+    status: string;
+    /** What the domain's registrar must delegate to. */
+    nameServers: string[];
+    /** Who owns it: the platform, or `null` when no row exists (a live zone
+     * nobody adopted: reported, never touched). */
+    owner: 'platform' | null;
+    /** The company the zone serves; `'platform'` when none. `null` for a zone with no row. */
+    organisationId: string | null;
+    state: 'pending' | 'active' | 'removed' | null;
+}
+export interface ListPlatformZonesRequest {
+    /** The zone's exact name, such as `example.com`. */
+    name: string;
+}
+/** Empty when no zone has that name. */
+export interface ListPlatformZonesResponse {
+    zones: PlatformZoneView[];
+}
+export interface CreatePlatformZoneRequest {
+    /** The domain's apex, such as `example.com`. Lower-cased. */
+    name: string;
+    /** The company the zone serves. Omit for a zone that serves none. */
+    organisationId?: string;
+}
+export interface AdoptZoneEntry {
+    name: string;
+}
+export interface AdoptZonesRequest {
+    zones: AdoptZoneEntry[];
+    /** The company the adopted zones serve. Omit for none. */
+    organisationId?: string;
+}
+export interface AdoptZonesResponse {
+    adopted: PlatformZoneView[];
+    alreadyAdopted: PlatformZoneView[];
+    /** `taken`: a row for that name holds a different zone. */
+    skipped: Array<{
+        zone: PlatformZoneView;
+        reason: 'taken';
+    }>;
+    notFound: AdoptZoneEntry[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",