permdock 0.6.0 → 0.8.0

package/schemas/cloud-api-v1.json

@@ -30,6 +30,25 @@
         }
       }
     },
+    "/openapi.json": {
+      "get": {
+        "security": [],
+        "summary": "This document, the contract of https://permdock.com/api. permdock/schemas/cloud-api-v1.json ships the same document in the npm package.",
+        "responses": {
+          "200": {
+            "description": "The OpenAPI 3.1 document",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": ["openapi", "paths"]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/oauth/authorize": {
       "get": {
         "security": [],
@@ -330,6 +349,16 @@
       }
     },
     "/v1/projects": {
+      "parameters": [
+        {
+          "name": "cursor",
+          "in": "query",
+          "description": "The `next` of the previous page",
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
       "get": {
         "security": [
           {
@@ -378,7 +407,15 @@
             }
           },
           "401": {
-            "description": "Missing, expired or revoked token",
+            "description": "Missing, expired or revoked token; a refused token carries `error=\"invalid_token\"`",
+            "headers": {
+              "WWW-Authenticate": {
+                "description": "RFC 6750 Bearer challenge (`Bearer realm=\"permdock\", error=\"invalid_token\"`)",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -388,7 +425,15 @@
             }
           },
           "403": {
-            "description": "The token may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment",
+            "description": "The token lacks projects:read (`error=\"insufficient_scope\"` with `scope`), or may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment",
+            "headers": {
+              "WWW-Authenticate": {
+                "description": "RFC 6750 Bearer challenge (`Bearer realm=\"permdock\", error=\"insufficient_scope\", scope=\"projects:read\"`)",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -479,7 +524,15 @@
             }
           },
           "401": {
-            "description": "Missing, expired or revoked token",
+            "description": "Missing, expired or revoked token; a refused token carries `error=\"invalid_token\"`",
+            "headers": {
+              "WWW-Authenticate": {
+                "description": "RFC 6750 Bearer challenge (`Bearer realm=\"permdock\", error=\"invalid_token\"`)",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -489,7 +542,15 @@
             }
           },
           "403": {
-            "description": "The token may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment",
+            "description": "The token lacks projects:read (`error=\"insufficient_scope\"` with `scope`), or may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment",
+            "headers": {
+              "WWW-Authenticate": {
+                "description": "RFC 6750 Bearer challenge (`Bearer realm=\"permdock\", error=\"insufficient_scope\", scope=\"projects:read\"`)",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -590,7 +651,15 @@
             }
           },
           "401": {
-            "description": "Missing, expired or revoked token",
+            "description": "Missing, expired or revoked token; a refused token carries `error=\"invalid_token\"`",
+            "headers": {
+              "WWW-Authenticate": {
+                "description": "RFC 6750 Bearer challenge (`Bearer realm=\"permdock\", error=\"invalid_token\"`)",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -600,7 +669,15 @@
             }
           },
           "403": {
-            "description": "The token may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment",
+            "description": "The token lacks policy:read (`error=\"insufficient_scope\"` with `scope`), or may not read this project; a PERMDOCK_CLOUD_TOKEN reads only its own environment",
+            "headers": {
+              "WWW-Authenticate": {
+                "description": "RFC 6750 Bearer challenge (`Bearer realm=\"permdock\", error=\"insufficient_scope\", scope=\"policy:read\"`)",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -1266,6 +1343,63 @@
         }
       ]
     },
+    "/v1/environment": {
+      "get": {
+        "security": [
+          {
+            "client": []
+          }
+        ],
+        "summary": "The environment the key belongs to; cloud() calls it when no environment is configured",
+        "responses": {
+          "200": {
+            "description": "The key's environment",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": ["environment", "issuer", "jwks_uri"],
+                  "properties": {
+                    "environment": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri"
+                    },
+                    "jwks_uri": {
+                      "type": "string",
+                      "format": "uri"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or unknown key",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "A key of another kind",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/environments/{env}/decisions": {
       "post": {
         "security": [
@@ -5268,6 +5402,10 @@
           "name": {
             "type": "string"
           },
+          "slug": {
+            "type": "string",
+            "description": "The project's URL-safe name, unique in its organization"
+          },
           "environment": {
             "type": "string",
             "minLength": 1
@@ -5288,6 +5426,11 @@
                 "type": "string"
               }
             }
+          },
+          "updatedAt": {
+            "type": "string",
+            "format": "date-time",
+            "description": "When the project last changed, RFC 3339"
           }
         }
       },
@@ -5392,7 +5535,9 @@
             "scopes": {
               "projects:read": "List and read the projects the person belongs to",
               "policy:read": "Read a project's pushed catalog, manifest and policy",
-              "catalog:write": "Push a catalog and policy with permdock cloud push"
+              "catalog:write": "Push a catalog and policy with permdock cloud push",
+              "evidence:read": "Read a project's decision log and exports, the evidence an access review uses",
+              "approvals:read": "Read a project's approval requests and their verdicts"
             }
           }
         }

package/schemas/connector-v1.json

@@ -73,6 +73,7 @@
             },
             "headers": {
               "type": "object",
+              "description": "Request headers sent to the collector, such as an Authorization header; write-only.",
               "additionalProperties": {
                 "type": "string"
               }
@@ -125,6 +126,13 @@
             "endpoint": {
               "type": "string",
               "pattern": "^https://"
+            },
+            "headers": {
+              "type": "object",
+              "description": "Request headers sent to the collector, such as the Splunk HEC Authorization or Datadog DD-API-KEY; write-only.",
+              "additionalProperties": {
+                "type": "string"
+              }
             }
           }
         }

package/schemas/supabase-claims-v1.json

@@ -47,6 +47,11 @@
           "description": "true when the size budget cut memberships or attrs.",
           "type": "boolean"
         },
+        "team_ids": {
+          "description": "The uuid of every team the user belongs to (supabase.hook.teams), cut by the memberships budget.",
+          "type": "array",
+          "items": { "type": "string" }
+        },
         "tenant_id": {
           "description": "The active tenant (the default rls.tenantClaim): the canonical text of one instance of the first scope.",
           "type": "string"