Node.js SDK

import { PolicyEffect, ConditionOperator } from '@tigeridentity/sdk';

// Create a geo-fencing policy
const policy = await client.policies.create({
  name: 'geo-restricted-access',
  description: 'Restrict access based on geographic location',
  rules: [
    {
      effect: PolicyEffect.Allow,
      conditions: [
        {
          field: 'context.location.country',
          operator: ConditionOperator.In,
          value: ['US', 'CA', 'GB'],
        },
        {
          field: 'context.vpn',
          operator: ConditionOperator.Equals,
          value: false,
        },
      ],
    },
  ],
  resources: ['customer:*', 'order:*'],
  actions: ['read', 'write'],
});

console.log(`Created policy: ${policy.id}`);

import express from 'express';
import { TigerClient } from '@tigeridentity/sdk';

const app = express();
const tiger = new TigerClient({ apiKey: process.env.TIGER_API_KEY });

// Middleware to check access
function requireAccess(action: string, resourceFn: (req: any) => string) {
  return async (req: express.Request, res: express.Response, next: express.NextFunction) => {
    const resource = resourceFn(req);
    const principalId = `user-${req.user?.id}`;

    try {
      const result = await tiger.decisions.evaluate({
        principalId,
        action,
        resource,
        context: {
          ipAddress: req.ip,
          userAgent: req.get('user-agent'),
          path: req.path,
        },
      });

      if (!result.allowed) {
        return res.status(403).json({
          error: 'Access denied',
          reason: result.reason,
        });
      }

      next();
    } catch (error) {
      console.error('Access check failed:', error);
      res.status(500).json({ error: 'Internal server error' });
    }
  };
}

// Protected routes
app.get(
  '/projects/:id',
  requireAccess('read', (req) => `project:${req.params.id}`)
);

app.delete(
  '/projects/:id',
  requireAccess('delete', (req) => `project:${req.params.id}`)
);

app.listen(3000);

import { TigerClient, WebhookEvent, WebhookEventType } from '@tigeridentity/sdk';

const tiger = new TigerClient({ apiKey: process.env.TIGER_API_KEY });

// Express webhook endpoint
app.post('/webhooks/tiger', async (req, res) => {
  const signature = req.get('x-tiger-signature');
  const timestamp = req.get('x-tiger-timestamp');

  try {
    // Verify webhook signature
    const isValid = tiger.webhooks.verify({
      payload: JSON.stringify(req.body),
      signature: signature!,
      timestamp: timestamp!,
      secret: process.env.TIGER_WEBHOOK_SECRET!,
    });

    if (!isValid) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const event: WebhookEvent = req.body;

    // Handle different event types
    switch (event.type) {
      case WebhookEventType.SessionRevoked:
        console.log(`Session revoked: ${event.data.sessionId}`);
        // Invalidate local session cache
        await invalidateSession(event.data.sessionId);
        break;

      case WebhookEventType.RiskScoreChanged:
        console.log(`Risk score changed: ${event.data.principalId}`);
        // Re-evaluate active sessions
        await reevaluateUserSessions(event.data.principalId);
        break;

      case WebhookEventType.PrincipalDisabled:
        console.log(`Principal disabled: ${event.data.principalId}`);
        // Terminate all sessions
        await terminateAllSessions(event.data.principalId);
        break;

      case WebhookEventType.PolicyUpdated:
        console.log(`Policy updated: ${event.data.policyId}`);
        // Clear policy cache
        await clearPolicyCache();
        break;
    }

    res.json({ received: true });
  } catch (error) {
    console.error('Webhook error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});