Class: Infrawrench::AccessRequestsNamespace

Inherits:
Object
  • Object
show all
Defined in:
lib/infrawrench/client.rb,
sig/infrawrench/sdk.rbs

Overview

client.access_requests

Instance Method Summary collapse

Constructor Details

#initialize(transport) ⇒ AccessRequestsNamespace

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns a new instance of AccessRequestsNamespace.

Parameters:



20
21
22
 
# File 'lib/infrawrench/client.rb', line 20

def initialize(transport)
  @transport = transport
end

Instance Method Details

#approve(request_id:, org_id: nil, body: nil, request_options: nil) ⇒ Hash

Approve an access request

Opens the elevation window: the requester holds the requested permissions from now until grantExpiresAt, on every surface at once (HTTP, the WebSocket gateway, chat, MCP tools). Two rules are enforced here and cannot be bypassed: you cannot decide your own request (403 self_approval), and you cannot grant a permission you do not hold yourself (403 exceeds_approver) — denying something aimed higher than you is allowed. Deciding a request that has already been decided or has timed out is a 409. Audit-logged.

Requires permission: access:approve.

POST /api/org/orgId/access-requests/requestId/approve

Raises on 400: Bad request

Raises on 403: Self-approval, or granting beyond the approver's own permissions

Raises on 404: Not found

Raises on 409: Already decided, or the request timed out

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • request_id (String)
  • body (Hash, nil) (defaults to: nil) —

    Request body, shaped as AccessDecision.

  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • request_id: (String)
  • org_id: (String, nil) (defaults to: nil)
  • body: (access_decision, nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Hash) —

    Parsed JSON, shaped as AccessRequest — see sig/infrawrench/sdk.rbs.

Raises:



55
56
57
58
59
60
61
62
63
 
# File 'lib/infrawrench/client.rb', line 55

def approve(request_id:, org_id: nil, body: nil, request_options: nil)
  @transport.request(
    http_method: "POST",
    path: "/api/org/{orgId}/access-requests/{requestId}/approve",
    path_params: { "orgId" => org_id, "requestId" => request_id },
    body: body,
    request_options: request_options
  )
end

#catalog(org_id: nil, request_options: nil) ⇒ Hash

Permissions a request may ask for

The server's permission catalog plus the subset the caller already holds and the bounds on grant length. Served rather than hard-coded in clients so a picker cannot drift from what the server will accept.

Requires permission: access:read.

GET /api/org/orgId/access-requests/catalog

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • org_id: (String, nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Hash) —

    Parsed JSON, shaped as AccessRequestCatalog — see sig/infrawrench/sdk.rbs.

Raises:



81
82
83
84
85
86
87
88
 
# File 'lib/infrawrench/client.rb', line 81

def catalog(org_id: nil, request_options: nil)
  @transport.request(
    http_method: "GET",
    path: "/api/org/{orgId}/access-requests/catalog",
    path_params: { "orgId" => org_id },
    request_options: request_options
  )
end

#create(org_id: nil, body: nil, request_options: nil) ⇒ Hash

Request elevated access

Ask for specific permissions, for a specific number of minutes, with a reason. Rejected with 400 when the caller's role already grants every permission asked for — that is almost always a wrong permission string rather than a real request. Fans out to push, Slack (with Approve/Deny buttons) and Microsoft Teams under the Pages opt-in. Audit-logged.

Requires permission: access:request.

POST /api/org/orgId/access-requests

Raises on 400: Bad request

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • body (Hash, nil) (defaults to: nil) —

    Request body, shaped as AccessRequestCreate.

  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • org_id: (String, nil) (defaults to: nil)
  • body: (access_request_create, nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Hash) —

    Parsed JSON, shaped as AccessRequest — see sig/infrawrench/sdk.rbs.

Raises:



110
111
112
113
114
115
116
117
118
 
# File 'lib/infrawrench/client.rb', line 110

def create(org_id: nil, body: nil, request_options: nil)
  @transport.request(
    http_method: "POST",
    path: "/api/org/{orgId}/access-requests",
    path_params: { "orgId" => org_id },
    body: body,
    request_options: request_options
  )
end

#deny(request_id:, org_id: nil, body: nil, request_options: nil) ⇒ Hash

Deny an access request

Records the refusal. Two rules are enforced here and cannot be bypassed: you cannot decide your own request (403 self_approval), and you cannot grant a permission you do not hold yourself (403 exceeds_approver) — denying something aimed higher than you is allowed. Deciding a request that has already been decided or has timed out is a 409. Audit-logged.

Requires permission: access:approve.

POST /api/org/orgId/access-requests/requestId/deny

Raises on 400: Bad request

Raises on 403: Self-approval, or granting beyond the approver's own permissions

Raises on 404: Not found

Raises on 409: Already decided, or the request timed out

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • request_id (String)
  • body (Hash, nil) (defaults to: nil) —

    Request body, shaped as AccessDecision.

  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • request_id: (String)
  • org_id: (String, nil) (defaults to: nil)
  • body: (access_decision, nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Hash) —

    Parsed JSON, shaped as AccessRequest — see sig/infrawrench/sdk.rbs.

Raises:



148
149
150
151
152
153
154
155
156
 
# File 'lib/infrawrench/client.rb', line 148

def deny(request_id:, org_id: nil, body: nil, request_options: nil)
  @transport.request(
    http_method: "POST",
    path: "/api/org/{orgId}/access-requests/{requestId}/deny",
    path_params: { "orgId" => org_id, "requestId" => request_id },
    body: body,
    request_options: request_options
  )
end

#list(org_id: nil, status: nil, mine: nil, active: nil, request_options: nil) ⇒ Array<Hash>

List access requests

The organization's break-glass requests, newest first. A pending listing hides rows whose timeout has already passed, so the queue never offers a decision that would immediately be refused.

Requires permission: access:read.

GET /api/org/orgId/access-requests

Raises on 400: Bad request

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • status (String, nil) (defaults to: nil) —

    pending (awaiting a decision), approved, denied, or expired (nobody decided in time, or the requester withdrew it). An approved row is only granting permissions while active is true.

  • mine (String, nil) (defaults to: nil) —

    Only the caller's own requests.

  • active (String, nil) (defaults to: nil) —

    Only rows granting permissions right now.

  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • org_id: (String, nil) (defaults to: nil)
  • status: ("pending", "approved", "denied", "expired", nil) (defaults to: nil)
  • mine: ("1", nil) (defaults to: nil)
  • active: ("1", nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Array<Hash>) —

    Parsed JSON, shaped as Array<AccessRequest> — see sig/infrawrench/sdk.rbs.

Raises:



181
182
183
184
185
186
187
188
189
 
# File 'lib/infrawrench/client.rb', line 181

def list(org_id: nil, status: nil, mine: nil, active: nil, request_options: nil)
  @transport.request(
    http_method: "GET",
    path: "/api/org/{orgId}/access-requests",
    path_params: { "orgId" => org_id },
    query: { "status" => status, "mine" => mine, "active" => active },
    request_options: request_options
  )
end

#revoke(request_id:, org_id: nil, request_options: nil) ⇒ Hash

End a live elevation early

Allowed for anyone with access:approve and for the holder — giving back an elevation you no longer need must never require finding an approver. Applies from the next permission resolution; nothing is cached. Audit-logged.

POST /api/org/orgId/access-requests/requestId/revoke

Raises on 404: Not found

Raises on 409: The grant is not active

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • request_id (String)
  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • request_id: (String)
  • org_id: (String, nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Hash) —

    Parsed JSON, shaped as AccessRequest — see sig/infrawrench/sdk.rbs.

Raises:



210
211
212
213
214
215
216
217
 
# File 'lib/infrawrench/client.rb', line 210

def revoke(request_id:, org_id: nil, request_options: nil)
  @transport.request(
    http_method: "POST",
    path: "/api/org/{orgId}/access-requests/{requestId}/revoke",
    path_params: { "orgId" => org_id, "requestId" => request_id },
    request_options: request_options
  )
end

#withdraw(request_id:, org_id: nil, request_options: nil) ⇒ Hash

Withdraw your own pending request

Its own operation rather than a self-denial, so the audit trail distinguishes 'nobody would approve this' from 'they decided they didn't need it'. Audit-logged.

Requires permission: access:request.

POST /api/org/orgId/access-requests/requestId/withdraw

Raises on 404: Not found

Raises on 409: Already decided or expired

Parameters:

  • org_id (String, nil) (defaults to: nil) —

    Organization id. Defaults to the org_id the client was constructed with.

  • request_id (String)
  • request_options (Hash, nil) (defaults to: nil) —

    Per-call :headers, :timeout and :open_timeout.

  • request_id: (String)
  • org_id: (String, nil) (defaults to: nil)
  • request_options: (Hash[Symbol, untyped], nil) (defaults to: nil)

Returns:

  • (Hash) —

    Parsed JSON, shaped as Ok — see sig/infrawrench/sdk.rbs.

Raises:



239
240
241
242
243
244
245
246
 
# File 'lib/infrawrench/client.rb', line 239

def withdraw(request_id:, org_id: nil, request_options: nil)
  @transport.request(
    http_method: "POST",
    path: "/api/org/{orgId}/access-requests/{requestId}/withdraw",
    path_params: { "orgId" => org_id, "requestId" => request_id },
    request_options: request_options
  )
end