swift-sdk/Sources/Hanzo/APIs/KmsAPI.swift

//
// KmsAPI.swift
//
// Generated by openapi-generator
// https://openapi-generator.tech
//

import Foundation

open class KmsAPI {

    /**
     Returns the runtime configuration for the KMS console.
     
     - parameter apiConfiguration: The configuration for the http request.
     - returns: KmsConfig
     */
    @available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *)
    open class func getKmsConfig(apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) async throws(ErrorResponse) -> KmsConfig {
        return try await getKmsConfigWithRequestBuilder(apiConfiguration: apiConfiguration).execute().body
    }

    /**
     Returns the runtime configuration for the KMS console.
     - GET /v1/kms/config
     - Returns the runtime configuration for the KMS console.  What the console needs before anyone has signed in: the brand, the OIDC issuer it authenticates against, the API base for this subsystem and the path of the login exchange.  Public on purpose, and it holds nothing sensitive — it is deliberately kept under this subsystem's own namespace rather than under an admin prefix, so a gateway that admin-gates the admin routes cannot break the console's legitimate pre-login fetch.
     - Bearer Token:
       - type: http
       - name: bearer
     - parameter apiConfiguration: The configuration for the http request.
     - returns: RequestBuilder<KmsConfig> 
     */
    open class func getKmsConfigWithRequestBuilder(apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) -> RequestBuilder<KmsConfig> {
        let localVariablePath = "/v1/kms/config"
        let localVariableURLString = apiConfiguration.basePath + localVariablePath
        let localVariableParameters: [String: any Sendable]? = nil

        let localVariableUrlComponents = URLComponents(string: localVariableURLString)

        let localVariableNillableHeaders: [String: (any Sendable)?] = [
            :
        ]

        let localVariableHeaderParameters = APIHelper.rejectNilHeaders(localVariableNillableHeaders)

        let localVariableRequestBuilder: RequestBuilder<KmsConfig>.Type = apiConfiguration.requestBuilderFactory.getBuilder()

        return localVariableRequestBuilder.init(method: "GET", URLString: (localVariableUrlComponents?.string ?? localVariableURLString), parameters: localVariableParameters, headers: localVariableHeaderParameters, requiresAuthentication: true, apiConfiguration: apiConfiguration)
    }

    /**
     Reports whether this broker can actually serve secrets.
     
     - parameter apiConfiguration: The configuration for the http request.
     - returns: KmsHealth
     */
    @available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *)
    open class func getKmsHealth(apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) async throws(ErrorResponse) -> KmsHealth {
        return try await getKmsHealthWithRequestBuilder(apiConfiguration: apiConfiguration).execute().body
    }

    /**
     Reports whether this broker can actually serve secrets.
     - GET /v1/kms/health
     - Reports whether this broker can actually serve secrets.  A real readiness probe, not a liveness stub: 200 only when the store is open AND a master key is configured, with `signing` reporting whether signing keys are set up too. Anything less answers 503 with `ready:false` and the reason — no in-process store, or no master key — which are exactly the two states in which the secret operations refuse.  Not token-gated, because the platform must be able to probe it without a credential. It reports the broker's configuration state only; no secret, no key material and no tenant name appears in it.
     - Bearer Token:
       - type: http
       - name: bearer
     - parameter apiConfiguration: The configuration for the http request.
     - returns: RequestBuilder<KmsHealth> 
     */
    open class func getKmsHealthWithRequestBuilder(apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) -> RequestBuilder<KmsHealth> {
        let localVariablePath = "/v1/kms/health"
        let localVariableURLString = apiConfiguration.basePath + localVariablePath
        let localVariableParameters: [String: any Sendable]? = nil

        let localVariableUrlComponents = URLComponents(string: localVariableURLString)

        let localVariableNillableHeaders: [String: (any Sendable)?] = [
            :
        ]

        let localVariableHeaderParameters = APIHelper.rejectNilHeaders(localVariableNillableHeaders)

        let localVariableRequestBuilder: RequestBuilder<KmsHealth>.Type = apiConfiguration.requestBuilderFactory.getBuilder()

        return localVariableRequestBuilder.init(method: "GET", URLString: (localVariableUrlComponents?.string ?? localVariableURLString), parameters: localVariableParameters, headers: localVariableHeaderParameters, requiresAuthentication: true, apiConfiguration: apiConfiguration)
    }

    /**
     Lists the secrets your org holds, without their values.
     
     - parameter env: (query) Env selects the environment, which is part of a secret&#39;s storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \&quot;what is in here\&quot; without being told where to look. (optional)
     - parameter environment: (query) Environment is the KMS operator&#39;s spelling of Env, accepted so one caller need not learn the other&#39;s vocabulary. Env wins when both are sent. (optional)
     - parameter path: (query) Path narrows the listing to one subtree beneath the caller&#39;s org root, as a &#x60;/&#x60;-separated path such as &#x60;/ci&#x60;. OMITTED means the whole org. (optional)
     - parameter secretPath: (query) SecretPath is the KMS operator&#39;s spelling of Path. Path wins when both are sent. (optional)
     - parameter apiConfiguration: The configuration for the http request.
     - returns: KmsSecrets
     */
    @available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *)
    open class func getKmsSecrets(env: String? = nil, environment: String? = nil, path: String? = nil, secretPath: String? = nil, apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) async throws(ErrorResponse) -> KmsSecrets {
        return try await getKmsSecretsWithRequestBuilder(env: env, environment: environment, path: path, secretPath: secretPath, apiConfiguration: apiConfiguration).execute().body
    }

    /**
     Lists the secrets your org holds, without their values.
     - GET /v1/kms/secrets
     - Lists the secrets your org holds, without their values.  Returns the METADATA of the caller's own secrets: each one's name, path, environment and sealing scheme. No value and no ciphertext is included — this operation exists to enumerate what is held, and reading a value is a separate, per-secret call.  Scoped to the caller's own org and nothing else, structurally: there is no org in the path, the store root is derived from the validated org claim, and a caller therefore has no way to name another tenant's namespace. `path` narrows to a subpath and `env` selects the environment; both are also accepted under the operator's spellings, `secretPath` and `environment`. An omitted `env` means every environment and an omitted `path` means the whole org, because a default here reported a populated store as empty.  Admission is fail-closed and in order: a validated member, an org that is a DNS-1123 label, and a store holding a master key — 403, 400 and 503 respectively, all decided before any record is touched.
     - Bearer Token:
       - type: http
       - name: bearer
     - parameter env: (query) Env selects the environment, which is part of a secret&#39;s storage key. OMITTED means EVERY environment — this is the enumeration surface, so it must be able to answer \&quot;what is in here\&quot; without being told where to look. (optional)
     - parameter environment: (query) Environment is the KMS operator&#39;s spelling of Env, accepted so one caller need not learn the other&#39;s vocabulary. Env wins when both are sent. (optional)
     - parameter path: (query) Path narrows the listing to one subtree beneath the caller&#39;s org root, as a &#x60;/&#x60;-separated path such as &#x60;/ci&#x60;. OMITTED means the whole org. (optional)
     - parameter secretPath: (query) SecretPath is the KMS operator&#39;s spelling of Path. Path wins when both are sent. (optional)
     - parameter apiConfiguration: The configuration for the http request.
     - returns: RequestBuilder<KmsSecrets> 
     */
    open class func getKmsSecretsWithRequestBuilder(env: String? = nil, environment: String? = nil, path: String? = nil, secretPath: String? = nil, apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) -> RequestBuilder<KmsSecrets> {
        let localVariablePath = "/v1/kms/secrets"
        let localVariableURLString = apiConfiguration.basePath + localVariablePath
        let localVariableParameters: [String: any Sendable]? = nil

        var localVariableUrlComponents = URLComponents(string: localVariableURLString)
        localVariableUrlComponents?.queryItems = APIHelper.mapValuesToQueryItems([
            "env": (wrappedValue: env?.asParameter(codableHelper: apiConfiguration.codableHelper), isExplode: true),
            "environment": (wrappedValue: environment?.asParameter(codableHelper: apiConfiguration.codableHelper), isExplode: true),
            "path": (wrappedValue: path?.asParameter(codableHelper: apiConfiguration.codableHelper), isExplode: true),
            "secretPath": (wrappedValue: secretPath?.asParameter(codableHelper: apiConfiguration.codableHelper), isExplode: true),
        ])

        let localVariableNillableHeaders: [String: (any Sendable)?] = [
            :
        ]

        let localVariableHeaderParameters = APIHelper.rejectNilHeaders(localVariableNillableHeaders)

        let localVariableRequestBuilder: RequestBuilder<KmsSecrets>.Type = apiConfiguration.requestBuilderFactory.getBuilder()

        return localVariableRequestBuilder.init(method: "GET", URLString: (localVariableUrlComponents?.string ?? localVariableURLString), parameters: localVariableParameters, headers: localVariableHeaderParameters, requiresAuthentication: true, apiConfiguration: apiConfiguration)
    }

    /**
     Exchanges a machine credential for an IAM bearer token.
     
     - parameter kmsLogin: (body)  
     - parameter apiConfiguration: The configuration for the http request.
     - returns: KmsToken
     */
    @available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *)
    open class func postKmsAuthLogin(kmsLogin: KmsLogin, apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) async throws(ErrorResponse) -> KmsToken {
        return try await postKmsAuthLoginWithRequestBuilder(kmsLogin: kmsLogin, apiConfiguration: apiConfiguration).execute().body
    }

    /**
     Exchanges a machine credential for an IAM bearer token.
     - POST /v1/kms/auth/login
     - Exchanges a machine credential for an IAM bearer token.  Takes a tenant's machine credential — a client id and client secret — and returns an owner-scoped IAM access token with its lifetime, which is the bearer the caller then carries on the org-scoped secret operations.  It is deliberately public and unauthenticated, because it IS the credential exchange and runs before any principal exists. That makes it the one route in this subsystem rate-limited PER SOURCE IP, keyed on the real TCP peer rather than on any caller-supplied header, and body-capped in the same place.  The submitted secret is never logged and never echoed, and failures collapse to one clean status with no upstream detail: 401 when the credential does not authenticate, 502 when the identity provider is unreachable, 503 when no issuer is configured. That is on purpose — a richer error would be a validity oracle for guessed credentials.
     - Bearer Token:
       - type: http
       - name: bearer
     - parameter kmsLogin: (body)  
     - parameter apiConfiguration: The configuration for the http request.
     - returns: RequestBuilder<KmsToken> 
     */
    open class func postKmsAuthLoginWithRequestBuilder(kmsLogin: KmsLogin, apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) -> RequestBuilder<KmsToken> {
        let localVariablePath = "/v1/kms/auth/login"
        let localVariableURLString = apiConfiguration.basePath + localVariablePath
        let localVariableParameters = JSONEncodingHelper.encodingParameters(forEncodableObject: kmsLogin, codableHelper: apiConfiguration.codableHelper)

        let localVariableUrlComponents = URLComponents(string: localVariableURLString)

        let localVariableNillableHeaders: [String: (any Sendable)?] = [
            "Content-Type": "application/json",
        ]

        let localVariableHeaderParameters = APIHelper.rejectNilHeaders(localVariableNillableHeaders)

        let localVariableRequestBuilder: RequestBuilder<KmsToken>.Type = apiConfiguration.requestBuilderFactory.getBuilder()

        return localVariableRequestBuilder.init(method: "POST", URLString: (localVariableUrlComponents?.string ?? localVariableURLString), parameters: localVariableParameters, headers: localVariableHeaderParameters, requiresAuthentication: true, apiConfiguration: apiConfiguration)
    }

    /**
     Stores or replaces one secret in your org.
     
     - parameter kmsPut: (body)  
     - parameter apiConfiguration: The configuration for the http request.
     - returns: KmsStored
     */
    @available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *)
    open class func postKmsSecrets(kmsPut: KmsPut, apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) async throws(ErrorResponse) -> KmsStored {
        return try await postKmsSecretsWithRequestBuilder(kmsPut: kmsPut, apiConfiguration: apiConfiguration).execute().body
    }

    /**
     Stores or replaces one secret in your org.
     - POST /v1/kms/secrets
     - Stores or replaces one secret in your org.  Upserts one secret under the caller's own org. The value is sealed before it is written — a fresh per-secret data key, itself wrapped by the master key — so plaintext never reaches disk. The receipt confirms the name and environment that were written and does not echo the value.  `env` is REQUIRED on a write and has no default, which is the rule most easily got wrong here: reads and deletes still fall back to the default environment for older callers, but a write must not, because the environment is part of the storage key. A silently defaulted write lands in a bucket the readers that resolve project, environment and path never look in, and the stale value keeps being served — so the write fails loudly instead.  `name` is required, `path` is an optional subpath beneath the org root, and the org is taken from the validated claim rather than the body.  Requires ADMIN authority over the org — a member reads, an admin writes. A machine credential holds no membership and so is never an org admin: it can read the secrets it was issued for and cannot replace one. Fail-closed admission, in order: admin of the org, well-formed org, master key present — 403, 400 and 503, all decided before any record is touched.
     - Bearer Token:
       - type: http
       - name: bearer
     - parameter kmsPut: (body)  
     - parameter apiConfiguration: The configuration for the http request.
     - returns: RequestBuilder<KmsStored> 
     */
    open class func postKmsSecretsWithRequestBuilder(kmsPut: KmsPut, apiConfiguration: HanzoAPIConfiguration = HanzoAPIConfiguration.shared) -> RequestBuilder<KmsStored> {
        let localVariablePath = "/v1/kms/secrets"
        let localVariableURLString = apiConfiguration.basePath + localVariablePath
        let localVariableParameters = JSONEncodingHelper.encodingParameters(forEncodableObject: kmsPut, codableHelper: apiConfiguration.codableHelper)

        let localVariableUrlComponents = URLComponents(string: localVariableURLString)

        let localVariableNillableHeaders: [String: (any Sendable)?] = [
            "Content-Type": "application/json",
        ]

        let localVariableHeaderParameters = APIHelper.rejectNilHeaders(localVariableNillableHeaders)

        let localVariableRequestBuilder: RequestBuilder<KmsStored>.Type = apiConfiguration.requestBuilderFactory.getBuilder()

        return localVariableRequestBuilder.init(method: "POST", URLString: (localVariableUrlComponents?.string ?? localVariableURLString), parameters: localVariableParameters, headers: localVariableHeaderParameters, requiresAuthentication: true, apiConfiguration: apiConfiguration)
    }
}