alchemy 2.0.0-beta.14 → 2.0.0-beta.16

package/lib/Cloudflare/ApiToken/Common.d.ts

@@ -0,0 +1,96 @@
+import { type PermissionGroupName } from "./PermissionGroups.ts";
+/**
+ * Resource keys recognized by Cloudflare API token policies.
+ *
+ * The literal `"com.cloudflare.api.account"` is rewritten by the account-scoped
+ * provider to `"com.cloudflare.api.account.${accountId}"` so callers don't have
+ * to splice the account ID themselves.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/api/reference/permissions/
+ */
+export type ApiTokenResourceKey = "com.cloudflare.api.account" | `com.cloudflare.api.account.${string}` | `com.cloudflare.api.account.zone.${string}` | `com.cloudflare.edge.r2.bucket.${string}` | (string & {});
+/**
+ * A permission group reference: either a typed Cloudflare permission-group
+ * name (resolved against the static catalog) or an explicit `{ id }` for
+ * names that aren't in the catalog or have multiple scopes.
+ */
+export type ApiTokenPermissionGroupRef = PermissionGroupName | {
+    id: string;
+    meta?: {
+        key?: string;
+        value?: string;
+    };
+};
+export interface ApiTokenPolicy {
+    effect: "allow" | "deny";
+    permissionGroups: ApiTokenPermissionGroupRef[];
+    resources: {
+        [K in ApiTokenResourceKey]?: string;
+    };
+}
+export interface ApiTokenCondition {
+    requestIp?: {
+        in?: string[];
+        notIn?: string[];
+    };
+}
+export type ApiTokenProps = {
+    /**
+     * Token name. Defaults to a generated physical name based on the
+     * resource's logical id, app name, and stage.
+     */
+    name?: string;
+    /**
+     * The Cloudflare account ID that owns this token. Defaults to the
+     * account ID resolved from the ambient {@link CloudflareEnvironment}.
+     */
+    accountId?: string;
+    /**
+     * Access policies attached to the token. At least one policy is required
+     * by Cloudflare.
+     */
+    policies: ApiTokenPolicy[];
+    /** ISO 8601 expiration timestamp. */
+    expiresOn?: string;
+    /** ISO 8601 "not before" timestamp. */
+    notBefore?: string;
+    /** Optional usage conditions (e.g. IP allowlist). */
+    condition?: ApiTokenCondition;
+};
+export type ResolvedPolicy = {
+    effect: "allow" | "deny";
+    permissionGroups: {
+        id: string;
+        meta?: {
+            key?: string;
+            value?: string;
+        };
+    }[];
+    resources: Record<string, unknown>;
+};
+export declare const resolvePermissionGroup: (ref: ApiTokenPermissionGroupRef) => {
+    id: string;
+    meta?: undefined;
+} | {
+    id: string;
+    meta: {
+        key?: string;
+        value?: string;
+    };
+};
+/**
+ * Rewrite the bare `"com.cloudflare.api.account"` key to the
+ * account-scoped form. Pass `accountId: undefined` to leave keys unchanged
+ * (e.g. for user-owned tokens whose policies don't carry an account scope).
+ */
+export declare const resolveResources: (resources: ApiTokenPolicy["resources"], accountId: string | undefined) => Record<string, string>;
+export declare const resolvePolicies: (policies: ApiTokenPolicy[], accountId: string | undefined) => ResolvedPolicy[];
+export declare const policyFingerprint: (policies: ResolvedPolicy[]) => string;
+export declare const conditionFingerprint: (condition: ApiTokenCondition | undefined) => string;
+export declare const buildConditionPayload: (condition: ApiTokenCondition | undefined) => {
+    requestIp: {
+        in: string[] | undefined;
+        notIn: string[] | undefined;
+    } | undefined;
+} | undefined;
+//# sourceMappingURL=Common.d.ts.map

package/lib/Cloudflare/ApiToken/Common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Common.d.ts","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B,4BAA4B,GAC5B,8BAA8B,MAAM,EAAE,GACtC,mCAAmC,MAAM,EAAE,GAC3C,iCAAiC,MAAM,EAAE,GACzC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,mBAAmB,GACnB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;IAC/C,SAAS,EAAE;SAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,EAAE,MAAM;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IAC5E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,KAAK,0BAA0B;;;;;;cA7CrC,MAAM;gBAAU,MAAM;;CA0DtD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,cAAc,CAAC,WAAW,CAAC,EACtC,WAAW,MAAM,GAAG,SAAS,KAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAWvB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,cAAc,EAAE,EAC1B,WAAW,MAAM,GAAG,SAAS,KAC5B,cAAc,EAKZ,CAAC;AAEN,eAAO,MAAM,iBAAiB,GAAI,UAAU,cAAc,EAAE,KAAG,MAW5D,CAAC;AAEJ,eAAO,MAAM,oBAAoB,GAC/B,WAAW,iBAAiB,GAAG,SAAS,KACvC,MAIC,CAAC;AAEL,eAAO,MAAM,qBAAqB,GAChC,WAAW,iBAAiB,GAAG,SAAS;;;;;aAW3B,CAAC"}

package/lib/Cloudflare/ApiToken/Common.js

@@ -0,0 +1,61 @@
+import { PERMISSION_GROUPS_BY_NAME, } from "./PermissionGroups.js";
+export const resolvePermissionGroup = (ref) => {
+    if (typeof ref === "string") {
+        const group = PERMISSION_GROUPS_BY_NAME[ref];
+        if (!group) {
+            // Should be unreachable due to the typed union, but guard anyway in
+            // case Cloudflare retires a name we still have in the catalog.
+            throw new Error(`Unknown Cloudflare permission group: "${ref}". Pass an explicit { id } instead.`);
+        }
+        return { id: group.id };
+    }
+    return ref.meta ? { id: ref.id, meta: ref.meta } : { id: ref.id };
+};
+/**
+ * Rewrite the bare `"com.cloudflare.api.account"` key to the
+ * account-scoped form. Pass `accountId: undefined` to leave keys unchanged
+ * (e.g. for user-owned tokens whose policies don't carry an account scope).
+ */
+export const resolveResources = (resources, accountId) => {
+    const out = {};
+    for (const [key, value] of Object.entries(resources)) {
+        if (value === undefined)
+            continue;
+        if (key === "com.cloudflare.api.account" && accountId) {
+            out[`com.cloudflare.api.account.${accountId}`] = value;
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+};
+export const resolvePolicies = (policies, accountId) => policies.map((policy) => ({
+    effect: policy.effect,
+    permissionGroups: policy.permissionGroups.map(resolvePermissionGroup),
+    resources: resolveResources(policy.resources, accountId),
+}));
+export const policyFingerprint = (policies) => JSON.stringify(policies.map((p) => ({
+    effect: p.effect,
+    permissionGroups: [...p.permissionGroups]
+        .map((g) => ({ id: g.id, meta: g.meta ?? null }))
+        .sort((a, b) => a.id.localeCompare(b.id)),
+    resources: Object.keys(p.resources)
+        .sort()
+        .map((k) => [k, p.resources[k]]),
+})));
+export const conditionFingerprint = (condition) => JSON.stringify({
+    in: [...(condition?.requestIp?.in ?? [])].sort(),
+    notIn: [...(condition?.requestIp?.notIn ?? [])].sort(),
+});
+export const buildConditionPayload = (condition) => condition
+    ? {
+        requestIp: condition.requestIp
+            ? {
+                in: condition.requestIp.in,
+                notIn: condition.requestIp.notIn,
+            }
+            : undefined,
+    }
+    : undefined;
+//# sourceMappingURL=Common.js.map

package/lib/Cloudflare/ApiToken/Common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Common.js","sourceRoot":"","sources":["../../../src/Cloudflare/ApiToken/Common.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAsE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAA+B,EAAE,EAAE;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,qCAAqC,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACpE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,SAAsC,EACtC,SAA6B,EACL,EAAE;IAC1B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,4BAA4B,IAAI,SAAS,EAAE,CAAC;YACtD,GAAG,CAAC,8BAA8B,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAA0B,EAC1B,SAA6B,EACX,EAAE,CACpB,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACrE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;CACzD,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA0B,EAAU,EAAE,CACtE,IAAI,CAAC,SAAS,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;SAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC,CACJ,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAwC,EAChC,EAAE,CACV,IAAI,CAAC,SAAS,CAAC;IACb,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;CACvD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,SAAwC,EACxC,EAAE,CACF,SAAS;IACP,CAAC,CAAC;QACE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC5B,CAAC,CAAC;gBACE,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;gBAC1B,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK;aACjC;YACH,CAAC,CAAC,SAAS;KACd;IACH,CAAC,CAAC,SAAS,CAAC"}