List saved searches

//native

/**

 * List saved searches

 * List one page of saved searches (reports and alerts) visible to the token. Owner and app default to "-" (all); each entry's acl.owner and acl.app are what Dispatch saved search needs. Page with count (default 30) and offset; next_offset is null on the last page.

 */

export async function main(

  auth: RT.Splunk,

  owner: string | undefined,

  app: string | undefined,

  search: string | undefined,

  count: number | undefined,

  offset: number | undefined

) {

  const base = auth.base_url.replace(/\/+$/, "")

  const pageSize = count || 30

  const start = offset ?? 0

  const url = new URL(

    `${base}/servicesNS/${encodeURIComponent(owner || "-")}/${encodeURIComponent(app || "-")}/saved/searches`

  )

  url.searchParams.append("output_mode", "json")

  url.searchParams.append("count", String(pageSize))

  url.searchParams.append("offset", String(start))

  if (search) url.searchParams.append("search", search)

  const response = await fetch(url, {

    headers: {

      Authorization: `Bearer ${auth.token}`,

      Accept: "application/json",

    },

  })

  if (!response.ok) {

    throw new Error(`${response.status} ${await response.text()}`)

  }

  const data = (await response.json()) as {

    entry?: unknown[]

    paging?: { total?: number }

  }

  const returned = data.entry?.length ?? 0

  const total = data.paging?.total

  // Stop on an empty page (Splunk SDK paginator rule), or earlier when the

  // feed's paging.total says this page reached the end.

  const done =

    returned === 0 || (typeof total === "number" && start + returned >= total)

  return { ...data, next_offset: done ? null : start + returned }

}