vanta-auditor-api-sdk 0.4.2 → 0.6.0

package/smoke-test/src/smoke.test.ts

@@ -0,0 +1,201 @@
+import { beforeAll, describe, expect, test } from "vitest";
+import { ServerList, Vanta } from "vanta-auditor-api-sdk";
+
+/**
+ * Live smoke test against a real Vanta API tenant. Run via `npm test` from this
+ * directory when the three SMOKE_* environment variables are populated;
+ * otherwise every test is reported as skipped. See ../SMOKE_TEST.md for
+ * fixture details and CI wiring.
+ */
+
+// Read env at module load — CI populates these via the SMOKE_* GitHub Actions
+// secrets; locally, export them yourself. When any required var is missing
+// every test reports as skipped so `npm test` doesn't break for engineers
+// without demo-account creds.
+const clientId = process.env["SMOKE_OAUTH_CLIENT_ID"] ?? "";
+const clientSecret = process.env["SMOKE_OAUTH_CLIENT_SECRET"] ?? "";
+const auditId = process.env["SMOKE_AUDIT_ID"] ?? "";
+
+const missingEnv = !clientId
+  ? "SMOKE_OAUTH_CLIENT_ID"
+  : !clientSecret
+    ? "SMOKE_OAUTH_CLIENT_SECRET"
+    : !auditId
+      ? "SMOKE_AUDIT_ID"
+      : "";
+
+const shouldSkip = missingEnv !== "";
+const skipReason = shouldSkip
+  ? `smoke test skipped — ${missingEnv} is not set (CI populates via SMOKE_* env vars)`
+  : "";
+
+let sdk: Vanta;
+
+describe.sequential("Vanta SDK smoke", () => {
+  beforeAll(async () => {
+    if (shouldSkip) return;
+
+    // Single source of truth for the Vanta Commercial host: the SDK's own
+    // ServerList, regenerated by Speakeasy from the spec. OAuth and SDK API
+    // calls share the SAME host — OAuth at /oauth/token, SDK at /v1/* — so
+    // deriving both from one place eliminates the class of drift where
+    // someone updates one and not the other.
+    const sdkServerUrl = ServerList.find((s) => s.includes("api.vanta.com"));
+    if (!sdkServerUrl) {
+      throw new Error(
+        `ServerList contains no Commercial entry — got ${JSON.stringify(ServerList)}. `
+          + `An overlay regression broke the server list; the smoke test can't `
+          + `run until the SDK is regenerated correctly.`,
+      );
+    }
+    const oauthBaseUrl = sdkServerUrl.replace(/\/v[0-9]+$/, "");
+
+    const accessToken = await fetchAccessToken(oauthBaseUrl, clientId, clientSecret);
+
+    sdk = new Vanta({
+      bearerAuth: accessToken,
+      serverURL: sdkServerUrl,
+      // Intentionally do NOT pass a `debugLogger` option — it would write
+      // request and response detail to stdout and surface in CI logs.
+    });
+  });
+
+  // Catches the case where the Speakeasy overlay regression drops the
+  // Commercial host from the generated ServerList. Deliberately permissive
+  // while the EU/AUS phantom entries are still in the spec — tighten to
+  // exact-match [Commercial, Gov] after the spec cleanup lands and the new
+  // regen produces the post-cleanup server list.
+  test.skipIf(shouldSkip)("ServerList contains Commercial", () => {
+    expect(ServerList.length).toBeGreaterThanOrEqual(1);
+    expect(ServerList[0]).toMatch(/^https:\/\/api\.vanta\.com/);
+  });
+
+  test.skipIf(shouldSkip)("listAudits finds fixture audit", async () => {
+    const res = await sdk.audits.list({});
+    const audits = res.results.data;
+    expect(audits).toBeDefined();
+    expect(
+      audits.some((a) => a.id === auditId),
+      `fixture audit ${auditId} not found in /audits results — was it deleted? `
+        + `See SMOKE_TEST.md for recovery steps.`,
+    ).toBe(true);
+  });
+
+  test.skipIf(shouldSkip)("listEvidence drills into evidence URLs", async (ctx) => {
+    const listRes = await sdk.audits.listEvidence({ auditId });
+    const evidence = listRes.results.data;
+    expect(evidence).toBeDefined();
+
+    if (evidence.length === 0) {
+      ctx.skip(
+        "fixture audit has no evidence — skipping getEvidenceUrls drill-down "
+          + "(see SMOKE_TEST.md for seeding guidance)",
+      );
+    }
+
+    const evidenceId = evidence[0]!.id;
+    try {
+      const urlsRes = await sdk.audits.getEvidenceUrls({
+        auditId,
+        auditEvidenceId: evidenceId,
+      });
+      expect(urlsRes.results).toBeDefined();
+    } catch (e) {
+      // 4xx on a specific evidence usually means that evidence is in a state
+      // without URLs (not uploaded, processing, etc.). The SDK round-tripped
+      // an authenticated request and parsed a structured server response,
+      // which is what this smoke test exists to verify — the business-logic
+      // rejection is fixture state, not an SDK regression. Skip with detail.
+      //
+      // 5xx is re-thrown: a server error is a real signal, not fixture state.
+      //
+      // Duck-typed instead of `instanceof APIError`: when smoke-test installs
+      // the parent via `file:..`, npm's behavior varies between symlink and
+      // hard-copy across environments. A hard-copy gives us two separate
+      // class instances of APIError, and `instanceof` silently misses. The
+      // `statusCode` field is part of the documented VantaError contract.
+      const statusCode = (e as { statusCode?: unknown }).statusCode;
+      const body = (e as { body?: unknown }).body;
+      if (typeof statusCode === "number" && statusCode >= 400 && statusCode < 500) {
+        ctx.skip(
+          `getEvidenceUrls returned HTTP ${statusCode} for evidence ${evidenceId} `
+            + `— likely fixture state, not an SDK regression. Body: `
+            + `${typeof body === "string" ? body : ""}`,
+        );
+      }
+      throw e;
+    }
+  });
+
+  test.skipIf(shouldSkip)("listComments succeeds", async () => {
+    const res = await sdk.audits.listComments({ auditId });
+    expect(res.results.data).toBeDefined();
+  });
+
+  test.skipIf(shouldSkip)("listControls succeeds", async () => {
+    const res = await sdk.audits.listControls({ auditId });
+    expect(res.results.data).toBeDefined();
+  });
+});
+
+if (shouldSkip) {
+  // Surface the skip reason once at the top of the run so engineers don't
+  // wonder why every test is yellow.
+  console.warn(skipReason);
+}
+
+async function fetchAccessToken(
+  baseUrl: string,
+  oauthClientId: string,
+  oauthClientSecret: string,
+): Promise<string> {
+  // Vanta's OAuth requires an explicit `scope` parameter (per the spec's
+  // securitySchemes.oauth.flows.clientCredentials.scopes). v1 only exercises
+  // read endpoints under `audits`, so we request just `auditor-api.audit:read`.
+  // Add `auditor-api.auditor:read` when we add tests for `sdk.auditors.*`,
+  // and the `:write` variants when we add mutation tests.
+  const scope = "auditor-api.audit:read";
+  const form = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: oauthClientId,
+    client_secret: oauthClientSecret,
+    scope,
+  });
+
+  const resp = await fetch(`${baseUrl}/oauth/token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "Accept": "application/json",
+    },
+    body: form.toString(),
+  });
+
+  if (resp.status !== 200) {
+    // OAuth 2.0 error responses (RFC 6749 §5.2) contain
+    // {error, error_description} and never include the access_token or
+    // client_secret, so they're safe to log.
+    const raw = await resp.text();
+    let detail = raw;
+    try {
+      const parsed = JSON.parse(raw) as {
+        error?: string;
+        error_description?: string;
+      };
+      if (parsed.error !== undefined || parsed.error_description !== undefined) {
+        detail = `error=${parsed.error ?? "?"} error_description=${parsed.error_description ?? "?"}`;
+      }
+    } catch {
+      // body wasn't JSON — fall back to the raw string
+    }
+    throw new Error(
+      `OAuth token endpoint ${baseUrl}/oauth/token returned HTTP ${resp.status} — ${detail}`,
+    );
+  }
+
+  const body = (await resp.json()) as { access_token?: string };
+  if (!body.access_token) {
+    throw new Error("OAuth response missing access_token field");
+  }
+  return body.access_token;
+}

package/smoke-test/vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["src/**/*.test.ts"],
+    testTimeout: 30_000,
+    // Live calls to api.vanta.com — keep file-level parallelism off so we
+    // don't pound the demo tenant from multiple workers simultaneously.
+    fileParallelism: false,
+  },
+});

package/src/funcs/auditorsCreate.ts

@@ -4,6 +4,7 @@
 
 import { VantaCore } from "../core.js";
 import { encodeJSON } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
 import * as M from "../lib/matchers.js";
 import { compactMap } from "../lib/primitives.js";
 import { safeParse } from "../lib/schemas.js";
@@ -128,7 +129,8 @@ async function $do(
 
   const doResult = await client._do(req, {
     context,
-    errorCodes: ["4XX", "5XX"],
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
     retryConfig: context.retryConfig,
     retryCodes: context.retryCodes,
   });

package/src/funcs/auditsAcceptInformationRequestEvidence.ts

@@ -0,0 +1,195 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { VantaCore } from "../core.js";
+import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { VantaError } from "../models/errors/vantaerror.js";
+import * as operations from "../models/operations/index.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Accept evidence for an information request
+ *
+ * @remarks
+ * Accepts evidence for an information request, confirming that all submitted evidence
+ * meets audit requirements. This action changes the request's approvalStatus to
+ * an approved state and creates an activity log entry.
+ *
+ * Acceptance workflow:
+ * 1. Auditor reviews submitted evidence
+ * 2. If evidence is satisfactory, auditor calls this endpoint
+ * 3. Request status changes to approved state and is considered complete for this audit cycle
+ *
+ * Use this endpoint when:
+ * - All required evidence has been submitted
+ * - Evidence quality meets audit standards
+ * - Evidence addresses all specified framework codes
+ * - No additional information is needed
+ */
+export function auditsAcceptInformationRequestEvidence(
+  client: VantaCore,
+  request: operations.AcceptInformationRequestEvidenceRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.InformationRequest,
+    | VantaError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: VantaCore,
+  request: operations.AcceptInformationRequestEvidenceRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.InformationRequest,
+      | VantaError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) =>
+      operations.AcceptInformationRequestEvidenceRequest$outboundSchema.parse(
+        value,
+      ),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = encodeJSON(
+    "body",
+    payload.AcceptInformationRequestEvidenceInput,
+    { explode: true },
+  );
+
+  const pathParams = {
+    auditId: encodeSimple("auditId", payload.auditId, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+    requestId: encodeSimple("requestId", payload.requestId, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+  const path = pathToFunc(
+    "/audits/{auditId}/information-requests/{requestId}/accept-evidence",
+  )(pathParams);
+
+  const headers = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.bearerAuth);
+  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "AcceptInformationRequestEvidence",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.bearerAuth,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "POST",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const [result] = await M.match<
+    components.InformationRequest,
+    | VantaError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.InformationRequest$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req);
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/funcs/auditsCreateCommentForEvidence.ts

@@ -4,6 +4,7 @@
 
 import { VantaCore } from "../core.js";
 import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
 import * as M from "../lib/matchers.js";
 import { compactMap } from "../lib/primitives.js";
 import { safeParse } from "../lib/schemas.js";
@@ -99,7 +100,6 @@ async function $do(
       charEncoding: "percent",
     }),
   };
-
   const path = pathToFunc(
     "/audits/{auditId}/evidence/{auditEvidenceId}/comments",
   )(pathParams);
@@ -145,7 +145,8 @@ async function $do(
 
   const doResult = await client._do(req, {
     context,
-    errorCodes: ["4XX", "5XX"],
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
     retryConfig: context.retryConfig,
     retryCodes: context.retryCodes,
   });

package/src/funcs/auditsCreateCommentForInformationRequest.ts

@@ -0,0 +1,182 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { VantaCore } from "../core.js";
+import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { VantaError } from "../models/errors/vantaerror.js";
+import * as operations from "../models/operations/index.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Create a comment for an information request
+ *
+ * @remarks
+ * Creates a new comment for an information request. The comment author must be an auditor
+ * in the audit firm making the request. The comment will be associated with the information
+ * request and visible to all authorized users.
+ */
+export function auditsCreateCommentForInformationRequest(
+  client: VantaCore,
+  request: operations.CreateCommentForInformationRequestRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.InformationRequestComment,
+    | VantaError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: VantaCore,
+  request: operations.CreateCommentForInformationRequestRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.InformationRequestComment,
+      | VantaError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) =>
+      operations.CreateCommentForInformationRequestRequest$outboundSchema.parse(
+        value,
+      ),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = encodeJSON("body", payload.AddInformationRequestCommentInput, {
+    explode: true,
+  });
+
+  const pathParams = {
+    auditId: encodeSimple("auditId", payload.auditId, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+    requestId: encodeSimple("requestId", payload.requestId, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+  const path = pathToFunc(
+    "/audits/{auditId}/information-requests/{requestId}/comments",
+  )(pathParams);
+
+  const headers = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.bearerAuth);
+  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "CreateCommentForInformationRequest",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.bearerAuth,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "POST",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const [result] = await M.match<
+    components.InformationRequestComment,
+    | VantaError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.InformationRequestComment$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req);
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/funcs/auditsCreateCustomControl.ts

@@ -4,6 +4,7 @@
 
 import { VantaCore } from "../core.js";
 import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
 import * as M from "../lib/matchers.js";
 import { compactMap } from "../lib/primitives.js";
 import { safeParse } from "../lib/schemas.js";
@@ -95,7 +96,6 @@ async function $do(
       charEncoding: "percent",
     }),
   };
-
   const path = pathToFunc("/audits/{auditId}/controls/custom-controls")(
     pathParams,
   );
@@ -141,7 +141,8 @@ async function $do(
 
   const doResult = await client._do(req, {
     context,
-    errorCodes: ["4XX", "5XX"],
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
     retryConfig: context.retryConfig,
     retryCodes: context.retryCodes,
   });

package/src/funcs/auditsCreateCustomEvidenceRequest.ts

@@ -4,6 +4,7 @@
 
 import { VantaCore } from "../core.js";
 import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
 import * as M from "../lib/matchers.js";
 import { compactMap } from "../lib/primitives.js";
 import { safeParse } from "../lib/schemas.js";
@@ -95,7 +96,6 @@ async function $do(
       charEncoding: "percent",
     }),
   };
-
   const path = pathToFunc(
     "/audits/{auditId}/evidence/custom-evidence-requests",
   )(pathParams);
@@ -141,7 +141,8 @@ async function $do(
 
   const doResult = await client._do(req, {
     context,
-    errorCodes: ["4XX", "5XX"],
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
     retryConfig: context.retryConfig,
     retryCodes: context.retryCodes,
   });