@wtfalch/edge 0.9.0 → 0.10.0

package/dist/client.d.ts

@@ -1,10 +1,19 @@
 import { type ClientOptions } from './transport.js';
-import type { AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, FindServiceTokenResponse, ListClaimsResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
+import type { AccessProviderView, AccessReadinessResponse, AdoptAccessAppsRequest, AdoptAccessAppsResponse, AdoptRateLimitRulesRequest, AdoptRateLimitRulesResponse, AdoptRecordsRequest, AdoptRecordsResponse, AdoptTunnelsRequest, AdoptTunnelsResponse, AdoptWorkersRequest, AdoptWorkersResponse, AdoptZonesRequest, AdoptZonesResponse, AvailableResponse, ClaimNameRequest, CreatePlatformAccessAppRequest, CreatePlatformAccessPolicyRequest, CreatePlatformGateRequest, CreatePlatformRateLimitRuleRequest, CreatePlatformRecordRequest, CreatePlatformTunnelRequest, CreatePlatformWorkerRouteRequest, CreatePlatformZoneRequest, EnsureAccessProviderRequest, FindServiceTokenResponse, ListClaimsResponse, ListGatesResponse, ListPlatformAccessAppsRequest, ListPlatformAccessAppsResponse, ListPlatformAccessPoliciesResponse, ListPlatformRateLimitRulesRequest, ListPlatformRateLimitRulesResponse, ListPlatformRecordsRequest, ListPlatformRecordsResponse, ListPlatformTunnelsResponse, ListPlatformWorkerRoutesRequest, ListPlatformWorkerRoutesResponse, ListPlatformWorkerScriptsResponse, ListPlatformZonesRequest, ListPlatformZonesResponse, ListRecordsResponse, MintKeyRequest, MintKeyResponse, NameClaim, OrgSettingsRequest, PlatformAccessAppView, PlatformAccessPolicyView, PlatformGateView, PlatformRateLimitRuleView, PlatformRecordView, PlatformTunnelView, PlatformWorkerRouteView, PlatformWorkerScriptView, PlatformZoneView, PutPlatformTunnelConfigRequest, RecordInput, RecordPatch, RecordView, ReplacePlatformGateHostnamesRequest, SetGatePeopleResponse, TokenResponse, UpdatePlatformRecordRequest, UploadPlatformWorkerScriptRequest } from './types.js';
 export { EdgeApiError, type ClientOptions } from './transport.js';
 /** Called with an entry's key: the key carries its organisation and domain, so
  * no call names either. `setReservedLabels`, `mintKey` and `revokeKey` are
  * refused by the service for any credential but the platform's own. */
 export declare function createEdgeClient(options: ClientOptions): {
+    /** The org's gates. Needs `gates:read` (`gates:edit` for `setPeople`). */
+    gates: {
+        /** The org's gates, each with the people who pass it now. */
+        list: () => Promise<ListGatesResponse>;
+        /** Replaces the people who pass a gate with `emails` (1 to 1000), then ends
+         * the sessions of each person dropped. `notRevoked` names any whose session
+         * could not be ended; the list is replaced regardless. */
+        setPeople: (id: string, emails: string[]) => Promise<SetGatePeopleResponse>;
+    };
     /** The org's DNS records. Needs `records:read` (`records:edit` for changes). */
     records: {
         /** The org's own records, then every other live record in the zone as a
@@ -84,6 +93,19 @@ export declare function createEdgeClient(options: ClientOptions): {
             /** Writes platform rows for the live apps named. Nothing is deleted or
              * recreated, and an app nobody names is left alone. */
             adopt: (input: AdoptAccessAppsRequest) => Promise<AdoptAccessAppsResponse>;
+            /** Resolves when the Cloudflare token holds every Access right gates
+             * need. Rejects with `not_configured`, naming each right it lacks. */
+            readiness: () => Promise<AccessReadinessResponse>;
+            /** Creates the OIDC provider, or updates the one of that name; returns
+             * its id. The client secret is never returned. */
+            ensureProvider: (input: EnsureAccessProviderRequest) => Promise<AccessProviderView>;
+            /** Makes a company's gate. Rejects with `conflict` when the company
+             * already has a gate of that key. */
+            createGate: (input: CreatePlatformGateRequest) => Promise<PlatformGateView>;
+            /** Replaces the hostnames a gate covers. */
+            replaceGateHostnames: (id: string, input: ReplacePlatformGateHostnamesRequest) => Promise<PlatformGateView>;
+            /** Deletes a gate with its application, policy and group. */
+            deleteGate: (id: string) => Promise<PlatformGateView>;
         };
         /** Cloudflare rate limiting rules the platform owns. A zone's rules share
          * one ruleset, so each rule is owned on its own; a rule's `id` is

package/dist/client.js

@@ -10,6 +10,17 @@ function query(values) {
 export function createEdgeClient(options) {
     const call = createTransport(options);
     return {
+        /** The org's gates. Needs `gates:read` (`gates:edit` for `setPeople`). */
+        gates: {
+            /** The org's gates, each with the people who pass it now. */
+            list: () => call('GET', '/v1/gates'),
+            /** Replaces the people who pass a gate with `emails` (1 to 1000), then ends
+             * the sessions of each person dropped. `notRevoked` names any whose session
+             * could not be ended; the list is replaced regardless. */
+            setPeople: (id, emails) => call('PUT', `/v1/gates/${encodeURIComponent(id)}/people`, {
+                emails,
+            }),
+        },
         /** The org's DNS records. Needs `records:read` (`records:edit` for changes). */
         records: {
             /** The org's own records, then every other live record in the zone as a
@@ -87,6 +98,19 @@ export function createEdgeClient(options) {
                 /** Writes platform rows for the live apps named. Nothing is deleted or
                  * recreated, and an app nobody names is left alone. */
                 adopt: (input) => call('POST', '/v1/platform/access/apps/adopt', input),
+                /** Resolves when the Cloudflare token holds every Access right gates
+                 * need. Rejects with `not_configured`, naming each right it lacks. */
+                readiness: () => call('GET', '/v1/platform/access/readiness'),
+                /** Creates the OIDC provider, or updates the one of that name; returns
+                 * its id. The client secret is never returned. */
+                ensureProvider: (input) => call('PUT', '/v1/platform/access/identity-providers', input),
+                /** Makes a company's gate. Rejects with `conflict` when the company
+                 * already has a gate of that key. */
+                createGate: (input) => call('POST', '/v1/platform/access/gates', input),
+                /** Replaces the hostnames a gate covers. */
+                replaceGateHostnames: (id, input) => call('PUT', `/v1/platform/access/gates/${encodeURIComponent(id)}/hostnames`, input),
+                /** Deletes a gate with its application, policy and group. */
+                deleteGate: (id) => call('DELETE', `/v1/platform/access/gates/${encodeURIComponent(id)}`),
             },
             /** Cloudflare rate limiting rules the platform owns. A zone's rules share
              * one ruleset, so each rule is owned on its own; a rule's `id` is

package/dist/types.d.ts

@@ -359,6 +359,75 @@ export interface CreatePlatformAccessPolicyRequest {
     exclude?: AccessRule[];
     require?: AccessRule[];
 }
+/** The sign-in provider every gate requires: a generic OIDC provider, found by `name`. */
+export interface EnsureAccessProviderRequest {
+    name: string;
+    clientId: string;
+    /** Sent to Cloudflare and never returned. */
+    clientSecret: string;
+    authUrl: string;
+    tokenUrl: string;
+    certsUrl: string;
+    scopes: string[];
+    claims: string[];
+}
+export interface AccessProviderView {
+    /** Cloudflare's id for the provider: what a gate takes as `providerId`. */
+    id: string;
+    name: string;
+}
+/** Whether the Cloudflare token holds every Access right gates need. A token that lacks one rejects with `not_configured`, naming each missing right. */
+export interface AccessReadinessResponse {
+    ready: true;
+}
+/** Makes a company's gate: an application over `hostnames`, a group of `emails`, and a policy that requires the provider and one OIDC claim. */
+export interface CreatePlatformGateRequest {
+    organisationId: string;
+    /** A lower-case DNS label, unique in the company. */
+    key: string;
+    /** The hostnames the gate covers, a leading `*.` allowed. */
+    hostnames: string[];
+    /** The provider's id from `ensureProvider`. */
+    providerId: string;
+    claimName: string;
+    claimValue: string;
+    /** The first list of people: 1 to 1000 addresses. */
+    emails: string[];
+}
+export interface ReplacePlatformGateHostnamesRequest {
+    hostnames: string[];
+}
+/** A company's gate. `id` is edge's gate id, which the change and delete calls take. */
+export interface PlatformGateView {
+    id: string;
+    organisationId: string;
+    key: string;
+    hostnames: string[];
+    providerId: string;
+    applicationId: string;
+    groupId: string;
+}
+/** A gate as its company sees it. */
+export interface GateView {
+    /** Edge's gate id: what `setPeople` takes. */
+    id: string;
+    key: string;
+    hostnames: string[];
+    /** The addresses that pass the gate, lower-case. */
+    people: string[];
+}
+export interface ListGatesResponse {
+    gates: GateView[];
+}
+/** The whole list of people for a gate: 1 to 1000 addresses. Duplicates collapse and case is ignored. */
+export interface SetGatePeopleRequest {
+    emails: string[];
+}
+/** The gate with its new people. The list is replaced even when a revoke fails. */
+export interface SetGatePeopleResponse extends GateView {
+    /** Addresses the new list dropped whose sessions could not be ended. Empty when all were. */
+    notRevoked: string[];
+}
 /** A service token's id and name. Its secret is never returned. */
 export interface FindServiceTokenResponse {
     token: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/edge",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "license": "MIT",
   "description": "Public client SDK and API types for the edge service.",