@zuplo/runtime 5.2288.0 → 5.2290.0

package/out/types/index.d.ts

@@ -170,6 +170,28 @@ export declare interface ApiKeyInboundPolicyOptions {
     disableAutomaticallyAddingKeyHeaderToOpenApi?: boolean;
 }
 
+/**
+ * Authentication options for api token authentication.
+ */
+declare interface APITokenCredentialConfig {
+    /**
+     * The type of authentication to use.
+     */
+    method: "api-token";
+    /**
+     * The token key to use for authentication.
+     */
+    token: string;
+    /**
+     * The name of the header to use for authentication.
+     */
+    headerName?: string;
+    /**
+     * The prefix to use for the header value.
+     */
+    headerValuePrefix?: string;
+}
+
 /**
  * A list of attributes that will be included in the authorization request.
  */
@@ -903,6 +925,32 @@ export declare interface ClerkJwtInboundPolicyOptions {
     frontendApiUrl: string;
 }
 
+/**
+ * Authentication options for OIDC authentication.
+ */
+declare interface ClientCredentialsConfig {
+    /**
+     * The type of authentication to use.
+     */
+    method: "client-credentials";
+    /**
+     * The client ID.
+     */
+    clientId: string;
+    /**
+     * The client secret.
+     */
+    clientSecret: string;
+    /**
+     * The oauth endpoint url.
+     */
+    oauthTokenEndpointUrl: string;
+    /**
+     * API Audience.
+     */
+    apiAudience?: string;
+}
+
 /**
  * Authenticate requests with JWT tokens issued by AWS Cognito.
  *
@@ -1511,6 +1559,20 @@ export declare interface HandlerDefinition {
     options?: unknown;
 }
 
+/**
+ * Request header authentication.
+ */
+declare interface HeaderCredentialsConfig {
+    /**
+     * The type of authentication to use.
+     */
+    method: "header";
+    /**
+     * The name of the header to use for authentication.
+     */
+    headerName: string;
+}
+
 export declare type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH";
 
 /**
@@ -3651,6 +3713,82 @@ declare namespace OpenAPIV3_1 {
         {};
 }
 
+/**
+ * Authorize requests using OpenFGA.
+ *
+ * @remarks
+ * This policy will authorize requests using OpenFGA. If the
+ * request is not authorized, a 403 response will be returned.
+ *
+ *
+ * @title OpenFGA Authorization Inbound
+ * @beta
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class OpenFGAAuthZInboundPolicy extends InboundPolicy<OpenFGAAuthZInboundPolicyOptions> {
+    private client;
+    private authorizer;
+    private cache;
+    static setContextChecks(context: ZuploContext, checks: OpenFGACheck | OpenFGACheck[]): void;
+    constructor(options: OpenFGAAuthZInboundPolicyOptions, policyName: string);
+    /**
+     * The handler that is called each time this policy is invoked
+     *
+     * @param request - The incoming Request
+     * @param context - The current context of the Request
+     * @returns A Response or Request object
+     */
+    handler(request: ZuploRequest, context: ZuploContext): Promise<ZuploRequest | Response>;
+    private getAuthorizer;
+}
+
+/**
+ * The options for this policy.
+ */
+export declare interface OpenFGAAuthZInboundPolicyOptions {
+    /**
+     * The URL of the OpenFGA service.
+     */
+    apiUrl: string;
+    /**
+     * The ID of the store.
+     */
+    storeId?: string;
+    /**
+     * The ID of the authorization model.
+     */
+    authorizationModelId?: string;
+    /**
+     * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+     */
+    allowUnauthorizedRequests?: boolean;
+    credentials?: UnauthenticatedCredentialConfig | APITokenCredentialConfig | HeaderCredentialsConfig | ClientCredentialsConfig;
+}
+
+declare interface OpenFGACheck {
+    /**
+     * The user to check the relation for. If not provided, the user will be set to the request user.
+     */
+    user: string;
+    /**
+     * The relation to check.
+     */
+    relation: string;
+    /**
+     * The object to check the relation for.
+     */
+    object: string;
+    /**
+     * Additional request context that will be used to evaluate any ABAC conditions encountered in the query evaluation.
+     */
+    context?: object;
+    contextualTuples?: Array<TupleKey>;
+}
+
 /**
  * The Open ID JWT Authentication policy allows you to authenticate incoming requests using an Open ID compliant bearer token.
  *
@@ -4100,6 +4238,26 @@ export declare function ReadmeMetricsInboundPolicy(request: ZuploRequest, contex
  */
 export declare function redirectHandler(request: ZuploRequest, context: ZuploContext): Promise<Response>;
 
+/**
+ *
+ * @export
+ * @interface RelationshipCondition
+ */
+declare interface RelationshipCondition {
+    /**
+     * A reference (by name) of the relationship condition defined in the authorization model.
+     * @type {string}
+     * @memberof RelationshipCondition
+     */
+    name: string;
+    /**
+     * Additional context/data to persist along with the condition. The keys must match the parameters defined by the condition, and the value types must match the parameter type definitions.
+     * @type {object}
+     * @memberof RelationshipCondition
+     */
+    context?: object;
+}
+
 /**
  * Remove headers from the incoming request.
  *
@@ -4873,6 +5031,48 @@ export declare abstract class TelemetryPlugin extends RuntimePlugin {
 
 /* Excluded from this release type: trackFeature */
 
+/**
+ *
+ * @export
+ * @interface TupleKey
+ */
+declare interface TupleKey {
+    /**
+     *
+     * @type {string}
+     * @memberof TupleKey
+     */
+    user: string;
+    /**
+     *
+     * @type {string}
+     * @memberof TupleKey
+     */
+    relation: string;
+    /**
+     *
+     * @type {string}
+     * @memberof TupleKey
+     */
+    object: string;
+    /**
+     *
+     * @type {RelationshipCondition}
+     * @memberof TupleKey
+     */
+    condition?: RelationshipCondition;
+}
+
+/**
+ * No authentication.
+ */
+declare interface UnauthenticatedCredentialConfig {
+    /**
+     * The type of authentication to use.
+     */
+    method: "none";
+}
+
 /**
  * Uses Azure Active Directory to add an Authorization header to the request in order to authenticate requests using Azure identity.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/runtime",
-  "version": "5.2288.0",
+  "version": "5.2290.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {