feat: add support for IP allowlist policies

jira: STL-2872
risk: low

Author: DmitriiNikitinGD

packages/gooddata-sdk/src/gooddata_sdk/__init__.py

@@ -109,6 +109,10 @@
     CatalogExportTemplate,
     CatalogExportTemplateAttributes,
 )
+from gooddata_sdk.catalog.organization.entity_model.ip_allowlist_policy import (
+    CatalogIpAllowlistPolicy,
+    CatalogIpAllowlistPolicyTargets,
+)
 from gooddata_sdk.catalog.organization.entity_model.jwk import (
     CatalogJwk,
     CatalogJwkAttributes,

packages/gooddata-sdk/src/gooddata_sdk/catalog/organization/entity_model/ip_allowlist_policy.py

@@ -0,0 +1,91 @@
+# (C) 2026 GoodData Corporation
+from __future__ import annotations
+
+from typing import Any
+
+from attrs import define, field
+from gooddata_api_client.model.assignee_identifier import AssigneeIdentifier
+from gooddata_api_client.model.ip_allowlist_policy_targets import IpAllowlistPolicyTargets
+from gooddata_api_client.model.json_api_agent_in_relationships_user_groups import JsonApiAgentInRelationshipsUserGroups
+from gooddata_api_client.model.json_api_automation_in_relationships_recipients import (
+    JsonApiAutomationInRelationshipsRecipients,
+)
+from gooddata_api_client.model.json_api_ip_allowlist_policy_in import JsonApiIpAllowlistPolicyIn
+from gooddata_api_client.model.json_api_ip_allowlist_policy_in_attributes import JsonApiIpAllowlistPolicyInAttributes
+from gooddata_api_client.model.json_api_ip_allowlist_policy_in_document import JsonApiIpAllowlistPolicyInDocument
+from gooddata_api_client.model.json_api_ip_allowlist_policy_in_relationships import (
+    JsonApiIpAllowlistPolicyInRelationships,
+)
+from gooddata_api_client.model.json_api_user_group_linkage import JsonApiUserGroupLinkage
+from gooddata_api_client.model.json_api_user_group_to_many_linkage import JsonApiUserGroupToManyLinkage
+from gooddata_api_client.model.json_api_user_linkage import JsonApiUserLinkage
+from gooddata_api_client.model.json_api_user_to_many_linkage import JsonApiUserToManyLinkage
+
+from gooddata_sdk.catalog.base import Base
+from gooddata_sdk.catalog.identifier import CatalogAssigneeIdentifier
+
+_POLICY_TYPE = "ipAllowlistPolicy"
+
+
+@define(kw_only=True)
+class CatalogIpAllowlistPolicy(Base):
+    """Represents an IP allowlist policy entity."""
+
+    id: str
+    allowed_sources: list[str] = field(factory=list)
+    users: list[CatalogAssigneeIdentifier] = field(factory=list)
+    user_groups: list[CatalogAssigneeIdentifier] = field(factory=list)
+
+    @staticmethod
+    def client_class() -> type[JsonApiIpAllowlistPolicyIn]:
+        return JsonApiIpAllowlistPolicyIn
+
+    @classmethod
+    def from_api(cls, entity: dict[str, Any]) -> CatalogIpAllowlistPolicy:
+        attributes = entity.get("attributes") or {}
+        relationships = entity.get("relationships") or {}
+        users = (relationships.get("users") or {}).get("data") or []
+        user_groups = (relationships.get("userGroups") or {}).get("data") or []
+        return cls(
+            id=entity["id"],
+            allowed_sources=list(attributes.get("allowedSources") or []),
+            users=[CatalogAssigneeIdentifier(id=user["id"], type=user["type"]) for user in users],
+            user_groups=[CatalogAssigneeIdentifier(id=group["id"], type=group["type"]) for group in user_groups],
+        )
+
+    def to_api(self) -> JsonApiIpAllowlistPolicyInDocument:
+        relationships: dict[str, Any] = {}
+        if self.users:
+            relationships["users"] = JsonApiAutomationInRelationshipsRecipients(
+                data=JsonApiUserToManyLinkage([JsonApiUserLinkage(id=user.id, type=user.type) for user in self.users])
+            )
+        if self.user_groups:
+            relationships["user_groups"] = JsonApiAgentInRelationshipsUserGroups(
+                data=JsonApiUserGroupToManyLinkage(
+                    [JsonApiUserGroupLinkage(id=group.id, type=group.type) for group in self.user_groups]
+                )
+            )
+        data_kwargs: dict[str, Any] = {
+            "id": self.id,
+            "type": _POLICY_TYPE,
+            "attributes": JsonApiIpAllowlistPolicyInAttributes(allowed_sources=self.allowed_sources),
+        }
+        if relationships:
+            data_kwargs["relationships"] = JsonApiIpAllowlistPolicyInRelationships(**relationships)
+        return JsonApiIpAllowlistPolicyInDocument(data=JsonApiIpAllowlistPolicyIn(**data_kwargs))
+
+
+@define(kw_only=True)
+class CatalogIpAllowlistPolicyTargets(Base):
+    """Target payload for IP allowlist policy add/remove target actions."""
+
+    targets: list[CatalogAssigneeIdentifier] = field(factory=list)
+
+    @staticmethod
+    def client_class() -> type[IpAllowlistPolicyTargets]:
+        return IpAllowlistPolicyTargets
+
+    def to_api(self) -> IpAllowlistPolicyTargets:
+        return IpAllowlistPolicyTargets(
+            targets=[AssigneeIdentifier(id=target.id, type=target.type) for target in self.targets]
+        )

packages/gooddata-sdk/src/gooddata_sdk/catalog/organization/service.py

@@ -25,6 +25,10 @@
 from gooddata_sdk.catalog.catalog_service_base import CatalogServiceBase
 from gooddata_sdk.catalog.organization.entity_model.directive import CatalogCspDirective
 from gooddata_sdk.catalog.organization.entity_model.identity_provider import CatalogIdentityProvider
+from gooddata_sdk.catalog.organization.entity_model.ip_allowlist_policy import (
+    CatalogIpAllowlistPolicy,
+    CatalogIpAllowlistPolicyTargets,
+)
 from gooddata_sdk.catalog.organization.entity_model.jwk import CatalogJwk, CatalogJwkDocument
 from gooddata_sdk.catalog.organization.entity_model.llm_provider import (
     CatalogLlmProvider,
@@ -706,6 +710,62 @@ def list_llm_provider_models_by_id(self, id: str) -> CatalogLlmProviderModelsRes
         response = self._actions_api.list_llm_provider_models_by_id(id)
         return CatalogLlmProviderModelsResult.from_api(response)
 
+    # IP Allowlist Policy APIs
+
+    def get_ip_allowlist_policy(self, policy_id: str) -> CatalogIpAllowlistPolicy:
+        """Get an IP allowlist policy by ID.
+
+        Args:
+            policy_id: IP allowlist policy identifier.
+
+        Returns:
+            CatalogIpAllowlistPolicy: Retrieved policy.
+        """
+        response = self._entities_api.get_entity_ip_allowlist_policies(policy_id, _check_return_type=False)
+        return CatalogIpAllowlistPolicy.from_api(response.data)
+
+    def list_ip_allowlist_policies(self) -> list[CatalogIpAllowlistPolicy]:
+        """Return all IP allowlist policies in the organization."""
+        get_policies = functools.partial(
+            self._entities_api.get_all_entities_ip_allowlist_policies, _check_return_type=False
+        )
+        policies = load_all_entities(get_policies)
+        return [CatalogIpAllowlistPolicy.from_api(policy) for policy in policies.data]
+
+    def create_ip_allowlist_policy(self, policy: CatalogIpAllowlistPolicy) -> CatalogIpAllowlistPolicy:
+        """Create a new IP allowlist policy."""
+        response = self._entities_api.create_entity_ip_allowlist_policies(
+            json_api_ip_allowlist_policy_in_document=policy.to_api(), _check_return_type=False
+        )
+        return CatalogIpAllowlistPolicy.from_api(response.data)
+
+    def update_ip_allowlist_policy(self, policy: CatalogIpAllowlistPolicy) -> CatalogIpAllowlistPolicy:
+        """Replace an existing IP allowlist policy."""
+        response = self._entities_api.update_entity_ip_allowlist_policies(
+            policy.id, policy.to_api(), _check_return_type=False
+        )
+        return CatalogIpAllowlistPolicy.from_api(response.data)
+
+    def delete_ip_allowlist_policy(self, policy_id: str) -> None:
+        """Delete an IP allowlist policy."""
+        self._entities_api.delete_entity_ip_allowlist_policies(policy_id, _check_return_type=False)
+
+    def add_targets_to_ip_allowlist_policy(
+        self,
+        policy_id: str,
+        targets: CatalogIpAllowlistPolicyTargets,
+    ) -> None:
+        """Add users or user groups to an IP allowlist policy."""
+        self._actions_api.add_targets(policy_id, targets.to_api())
+
+    def remove_targets_from_ip_allowlist_policy(
+        self,
+        policy_id: str,
+        targets: CatalogIpAllowlistPolicyTargets,
+    ) -> None:
+        """Remove users or user groups from an IP allowlist policy."""
+        self._actions_api.remove_targets(policy_id, targets.to_api())
+
     # Layout APIs
 
     def get_declarative_notification_channels(self) -> list[CatalogDeclarativeNotificationChannel]:

packages/gooddata-sdk/tests/catalog/unit_tests/test_ip_allowlist_policy.py

@@ -0,0 +1,160 @@
+# (C) 2026 GoodData Corporation
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+from gooddata_sdk.catalog.identifier import CatalogAssigneeIdentifier
+from gooddata_sdk.catalog.organization.entity_model.ip_allowlist_policy import (
+    CatalogIpAllowlistPolicy,
+    CatalogIpAllowlistPolicyTargets,
+)
+from gooddata_sdk.catalog.organization.service import CatalogOrganizationService
+
+
+def _make_service() -> tuple[CatalogOrganizationService, MagicMock, MagicMock]:
+    """Build a service whose entities-api and actions-api sides are fully mocked."""
+    fake_entities_api = MagicMock(name="EntitiesApi")
+    fake_actions_api = MagicMock(name="ActionsApi")
+    fake_client = SimpleNamespace(
+        entities_api=fake_entities_api,
+        layout_api=MagicMock(name="LayoutApi"),
+        actions_api=fake_actions_api,
+        user_management_api=MagicMock(name="UserManagementApi"),
+    )
+    service = CatalogOrganizationService(fake_client)  # type: ignore[arg-type]
+    return service, fake_entities_api, fake_actions_api
+
+
+def test_ip_allowlist_policy_from_api_reads_attributes_and_relationships() -> None:
+    policy = CatalogIpAllowlistPolicy.from_api(
+        {
+            "id": "corp-vpn-only",
+            "type": "ipAllowlistPolicy",
+            "attributes": {"allowedSources": ["203.0.113.10/32", "198.51.100.0/24"]},
+            "relationships": {
+                "users": {"data": [{"id": "admin", "type": "user"}]},
+                "userGroups": {"data": [{"id": "admins", "type": "userGroup"}]},
+            },
+        }
+    )
+
+    assert policy.id == "corp-vpn-only"
+    assert policy.allowed_sources == ["203.0.113.10/32", "198.51.100.0/24"]
+    assert policy.users == [CatalogAssigneeIdentifier(id="admin", type="user")]
+    assert policy.user_groups == [CatalogAssigneeIdentifier(id="admins", type="userGroup")]
+
+
+def test_ip_allowlist_policy_from_api_defaults_missing_optional_fields() -> None:
+    policy = CatalogIpAllowlistPolicy.from_api({"id": "corp-vpn-only", "type": "ipAllowlistPolicy"})
+
+    assert policy.id == "corp-vpn-only"
+    assert policy.allowed_sources == []
+    assert policy.users == []
+    assert policy.user_groups == []
+
+
+def test_ip_allowlist_policy_to_api_uses_json_api_shape() -> None:
+    policy = CatalogIpAllowlistPolicy(
+        id="corp-vpn-only",
+        allowed_sources=["203.0.113.10/32"],
+        users=[CatalogAssigneeIdentifier(id="admin", type="user")],
+        user_groups=[CatalogAssigneeIdentifier(id="admins", type="userGroup")],
+    )
+
+    document = policy.to_api()
+    data = document.data
+
+    assert data.id == "corp-vpn-only"
+    assert data.type == "ipAllowlistPolicy"
+    assert data.attributes.allowed_sources == ["203.0.113.10/32"]
+    users = data.relationships.users.data.value
+    assert [(user.id, user.type) for user in users] == [("admin", "user")]
+    user_groups = data.relationships.user_groups.data.value
+    assert [(group.id, group.type) for group in user_groups] == [("admins", "userGroup")]
+
+
+def test_ip_allowlist_policy_to_api_omits_empty_relationships() -> None:
+    policy = CatalogIpAllowlistPolicy(id="corp-vpn-only", allowed_sources=["203.0.113.10/32"])
+
+    document = policy.to_api()
+
+    assert document.data.attributes.allowed_sources == ["203.0.113.10/32"]
+    assert "relationships" not in document.data
+
+
+def test_ip_allowlist_targets_to_api_uses_action_payload_shape() -> None:
+    targets = CatalogIpAllowlistPolicyTargets(
+        targets=[
+            CatalogAssigneeIdentifier(id="admin", type="user"),
+            CatalogAssigneeIdentifier(id="admins", type="userGroup"),
+        ]
+    )
+
+    payload = targets.to_api()
+
+    assert [(target.id, target.type) for target in payload.targets] == [
+        ("admin", "user"),
+        ("admins", "userGroup"),
+    ]
+
+
+def test_ip_allowlist_policy_crud_methods_call_generated_client() -> None:
+    service, entities_api, _ = _make_service()
+    policy_out = SimpleNamespace(
+        data={
+            "id": "corp-vpn-only",
+            "type": "ipAllowlistPolicy",
+            "attributes": {"allowedSources": ["203.0.113.10/32"]},
+        }
+    )
+    entities_api.get_entity_ip_allowlist_policies.return_value = policy_out
+    entities_api.create_entity_ip_allowlist_policies.return_value = policy_out
+    entities_api.update_entity_ip_allowlist_policies.return_value = policy_out
+
+    policy = CatalogIpAllowlistPolicy(id="corp-vpn-only", allowed_sources=["203.0.113.10/32"])
+
+    assert service.get_ip_allowlist_policy("corp-vpn-only").id == "corp-vpn-only"
+    assert service.create_ip_allowlist_policy(policy).allowed_sources == ["203.0.113.10/32"]
+    assert service.update_ip_allowlist_policy(policy).id == "corp-vpn-only"
+    service.delete_ip_allowlist_policy("corp-vpn-only")
+
+    assert entities_api.get_entity_ip_allowlist_policies.call_args.args[0] == "corp-vpn-only"
+    create_doc = entities_api.create_entity_ip_allowlist_policies.call_args.kwargs[
+        "json_api_ip_allowlist_policy_in_document"
+    ]
+    assert create_doc.data.id == "corp-vpn-only"
+    assert entities_api.update_entity_ip_allowlist_policies.call_args.args[0] == "corp-vpn-only"
+    assert entities_api.delete_entity_ip_allowlist_policies.call_args.args[0] == "corp-vpn-only"
+
+
+def test_list_ip_allowlist_policies_loads_all_entities() -> None:
+    service, entities_api, _ = _make_service()
+    entities_api.get_all_entities_ip_allowlist_policies.return_value = SimpleNamespace(
+        data=[
+            {"id": "first", "type": "ipAllowlistPolicy"},
+            {"id": "second", "type": "ipAllowlistPolicy"},
+        ],
+        included=[],
+        links=SimpleNamespace(next=None),
+    )
+
+    policies = service.list_ip_allowlist_policies()
+
+    assert [policy.id for policy in policies] == ["first", "second"]
+    assert entities_api.get_all_entities_ip_allowlist_policies.called
+
+
+def test_ip_allowlist_target_actions_call_generated_client() -> None:
+    service, _, actions_api = _make_service()
+    targets = CatalogIpAllowlistPolicyTargets(targets=[CatalogAssigneeIdentifier(id="admin", type="user")])
+
+    service.add_targets_to_ip_allowlist_policy("corp-vpn-only", targets)
+    service.remove_targets_from_ip_allowlist_policy("corp-vpn-only", targets)
+
+    add_targets = actions_api.add_targets.call_args.args[1].targets
+    assert actions_api.add_targets.call_args.args[0] == "corp-vpn-only"
+    assert [(target.id, target.type) for target in add_targets] == [("admin", "user")]
+    remove_targets = actions_api.remove_targets.call_args.args[1].targets
+    assert actions_api.remove_targets.call_args.args[0] == "corp-vpn-only"
+    assert [(target.id, target.type) for target in remove_targets] == [("admin", "user")]