workos 2.0.1

// Code generated by oagen. DO NOT EDIT.

use crate::client::Client;
#[allow(unused_imports)]
use crate::enums::*;
use crate::error::Error;
#[allow(unused_imports)]
use crate::models::*;
use serde::Serialize;

pub struct VaultApi<'a> {
    pub(crate) client: &'a Client,
}

#[derive(Debug, Clone, Serialize)]
pub struct CreateDataKeyParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: CreateDataKeyRequest,
}

impl CreateDataKeyParams {
    /// Construct a new `CreateDataKeyParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: CreateDataKeyRequest) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct CreateDecryptParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: DecryptRequest,
}

impl CreateDecryptParams {
    /// Construct a new `CreateDecryptParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: DecryptRequest) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct CreateRekeyParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: RekeyRequest,
}

impl CreateRekeyParams {
    /// Construct a new `CreateRekeyParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: RekeyRequest) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct ListKvParams {
    /// Upper limit on the number of objects to return.
    ///
    /// Defaults to `10`.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub limit: Option<i64>,
    /// Cursor for the previous page of results.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub before: Option<String>,
    /// Cursor for the next page of results.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub after: Option<String>,
    /// Sort direction for results.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub order: Option<VaultOrder>,
    /// Filter results by name or structured search JSON.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub search: Option<String>,
    /// ISO 8601 timestamp to filter by last modified time.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[serde(rename = "updatedAfter")]
    pub updated_after: Option<String>,
}

impl Default for ListKvParams {
    #[allow(deprecated)]
    fn default() -> Self {
        Self {
            limit: Some(10),
            before: Default::default(),
            after: Default::default(),
            order: Default::default(),
            search: Default::default(),
            updated_after: Default::default(),
        }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct CreateKvParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: CreateObjectRequest,
}

impl CreateKvParams {
    /// Construct a new `CreateKvParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: CreateObjectRequest) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct UpdateKvParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: UpdateObjectRequest,
}

impl UpdateKvParams {
    /// Construct a new `UpdateKvParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: UpdateObjectRequest) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Default, Serialize)]
pub struct DeleteKvParams {
    /// Expected current version for optimistic locking.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub version_check: Option<String>,
}

impl<'a> VaultApi<'a> {
    /// Create a data key
    ///
    /// Generate an isolated encryption key for local encryption operations.
    pub async fn create_data_key(
        &self,
        params: CreateDataKeyParams,
    ) -> Result<CreateDataKeyResponse, Error> {
        self.create_data_key_with_options(params, None).await
    }

    /// Variant of [`Self::create_data_key`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_data_key_with_options(
        &self,
        params: CreateDataKeyParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<CreateDataKeyResponse, Error> {
        let path = "/vault/v1/keys/data-key".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Decrypt a data key
    ///
    /// Decrypt a previously encrypted data key from WorkOS Vault.
    pub async fn create_decrypt(
        &self,
        params: CreateDecryptParams,
    ) -> Result<DecryptResponse, Error> {
        self.create_decrypt_with_options(params, None).await
    }

    /// Variant of [`Self::create_decrypt`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_decrypt_with_options(
        &self,
        params: CreateDecryptParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<DecryptResponse, Error> {
        let path = "/vault/v1/keys/decrypt".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Re-encrypt a data key
    ///
    /// Decrypt an existing data key and re-encrypt it under a new key context.
    pub async fn create_rekey(
        &self,
        params: CreateRekeyParams,
    ) -> Result<CreateDataKeyResponse, Error> {
        self.create_rekey_with_options(params, None).await
    }

    /// Variant of [`Self::create_rekey`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_rekey_with_options(
        &self,
        params: CreateRekeyParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<CreateDataKeyResponse, Error> {
        let path = "/vault/v1/keys/rekey".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// List objects
    ///
    /// List all encrypted objects with cursor-based pagination.
    pub async fn list_kv(&self, params: ListKvParams) -> Result<ObjectListResponse, Error> {
        self.list_kv_with_options(params, None).await
    }

    /// Variant of [`Self::list_kv`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_kv_with_options(
        &self,
        params: ListKvParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<ObjectListResponse, Error> {
        let path = "/vault/v1/kv".to_string();
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &params, options)
            .await
    }

    /// Returns an async [`futures_util::Stream`] that yields every `ObjectSummary`
    /// across all pages, advancing the `after` cursor under the hood.
    ///
    /// ```ignore
    /// use futures_util::TryStreamExt;
    /// let all: Vec<ObjectSummary> = self
    ///     .list_kv_auto_paging(params)
    ///     .try_collect()
    ///     .await?;
    /// ```
    pub fn list_kv_auto_paging(
        &self,
        params: ListKvParams,
    ) -> impl futures_util::Stream<Item = Result<ObjectSummary, Error>> + '_ {
        crate::pagination::auto_paginate_pages(move |after| {
            let mut params = params.clone();
            params.after = after;
            async move {
                let page = self.list_kv(params).await?;
                Ok((page.data, page.list_metadata.after))
            }
        })
    }

    /// Create an object
    ///
    /// Encrypt and store a new key-value object.
    pub async fn create_kv(&self, params: CreateKvParams) -> Result<ObjectMetadata, Error> {
        self.create_kv_with_options(params, None).await
    }

    /// Variant of [`Self::create_kv`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_kv_with_options(
        &self,
        params: CreateKvParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<ObjectMetadata, Error> {
        let path = "/vault/v1/kv".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Read an object by name
    ///
    /// Fetch and decrypt an object by its unique name.
    pub async fn get_name(&self, name: &str) -> Result<VaultObject, Error> {
        self.get_name_with_options(name, None).await
    }

    /// Variant of [`Self::get_name`] that accepts per-request [`crate::RequestOptions`].
    pub async fn get_name_with_options(
        &self,
        name: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<VaultObject, Error> {
        let name = crate::client::path_segment(name);
        let path = format!("/vault/v1/kv/name/{name}");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Read an object by ID
    ///
    /// Fetch and decrypt an object by its unique identifier.
    pub async fn get_kv(&self, id: &str) -> Result<VaultObject, Error> {
        self.get_kv_with_options(id, None).await
    }

    /// Variant of [`Self::get_kv`] that accepts per-request [`crate::RequestOptions`].
    pub async fn get_kv_with_options(
        &self,
        id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<VaultObject, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/vault/v1/kv/{id}");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Update an object
    ///
    /// Update the value of an existing encrypted object.
    pub async fn update_kv(
        &self,
        id: &str,
        params: UpdateKvParams,
    ) -> Result<ObjectWithoutValue, Error> {
        self.update_kv_with_options(id, params, None).await
    }

    /// Variant of [`Self::update_kv`] that accepts per-request [`crate::RequestOptions`].
    pub async fn update_kv_with_options(
        &self,
        id: &str,
        params: UpdateKvParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<ObjectWithoutValue, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/vault/v1/kv/{id}");
        let method = http::Method::PUT;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Delete an object
    ///
    /// Delete an encrypted object.
    pub async fn delete_kv(
        &self,
        id: &str,
        params: DeleteKvParams,
    ) -> Result<DeleteObjectResponse, Error> {
        self.delete_kv_with_options(id, params, None).await
    }

    /// Variant of [`Self::delete_kv`] that accepts per-request [`crate::RequestOptions`].
    pub async fn delete_kv_with_options(
        &self,
        id: &str,
        params: DeleteKvParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<DeleteObjectResponse, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/vault/v1/kv/{id}");
        let method = http::Method::DELETE;
        self.client
            .request_with_query_opts(method, &path, &params, options)
            .await
    }

    /// Describe an object
    ///
    /// Fetch metadata for an object without decrypting it.
    pub async fn list_kv_metadata(&self, id: &str) -> Result<ObjectWithoutValue, Error> {
        self.list_kv_metadata_with_options(id, None).await
    }

    /// Variant of [`Self::list_kv_metadata`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_kv_metadata_with_options(
        &self,
        id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<ObjectWithoutValue, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/vault/v1/kv/{id}/metadata");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    // @oagen-ignore-start
    /// Generates a fresh data key and locally encrypts `data` with AES-256-GCM.
    ///
    /// # Security
    ///
    /// `associated_data` is the **only** binding between the ciphertext
    /// envelope and the calling application: the encrypted-key prefix
    /// (`encrypted_keys` and its LEB128 length) sits **outside** the
    /// AEAD-authenticated region. Callers MUST pass an `associated_data`
    /// value that is unique per record and unguessable to an attacker
    /// with write access to the ciphertext store (e.g., the immutable
    /// record id mixed with an environment-scoped secret). A constant or
    /// empty value lets an attacker who can replace stored bytes
    /// substitute a separately-generated envelope — including their own
    /// `encrypted_keys` and ciphertext — under the same context, and
    /// `decrypt` will succeed against the attacker-controlled plaintext.
    pub async fn encrypt(
        &self,
        data: &str,
        context: std::collections::HashMap<String, String>,
        associated_data: &str,
    ) -> Result<crate::helpers::vault_crypto::VaultEncryptResult, Error> {
        let pair = self
            .create_data_key(CreateDataKeyParams::new(CreateDataKeyRequest { context }))
            .await?;
        let encrypted = crate::helpers::vault_crypto::local_encrypt(
            data,
            pair.data_key.expose(),
            pair.encrypted_keys.expose(),
            associated_data,
        )?;
        Ok(crate::helpers::vault_crypto::VaultEncryptResult {
            encrypted_data: encrypted,
            context: pair.context,
            encrypted_keys: pair.encrypted_keys.expose().to_string(),
        })
    }

    /// Decrypts data previously encrypted with [`Self::encrypt`]. Calls the API to
    /// decrypt the data key, then performs local AES-GCM decryption.
    ///
    /// # Security
    ///
    /// `associated_data` is the only authenticated binding between this
    /// envelope and the calling application — see [`Self::encrypt`] for
    /// the full requirement. If the value passed here is not unique per
    /// record and unguessable, a successful return does **not** prove
    /// that the stored bytes were authored by this application.
    pub async fn decrypt(
        &self,
        encrypted_data: &str,
        associated_data: &str,
    ) -> Result<String, Error> {
        let encrypted_keys_b64 =
            crate::helpers::vault_crypto::extract_encrypted_keys(encrypted_data)?;

        let dk = self
            .create_decrypt(CreateDecryptParams::new(DecryptRequest {
                keys: encrypted_keys_b64,
            }))
            .await?;
        crate::helpers::vault_crypto::local_decrypt(
            encrypted_data,
            dk.data_key.expose(),
            associated_data,
        )
    }
    // @oagen-ignore-end

    /// List object versions
    ///
    /// Retrieve all versions for a specific object.
    pub async fn list_kv_versions(&self, id: &str) -> Result<VersionListResponse, Error> {
        self.list_kv_versions_with_options(id, None).await
    }

    /// Variant of [`Self::list_kv_versions`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_kv_versions_with_options(
        &self,
        id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<VersionListResponse, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/vault/v1/kv/{id}/versions");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }
}