@automate.ax/integration-contracts 0.104.0 → 0.107.0

package/dist/cloudflare/events.js

@@ -0,0 +1,178 @@
+import * as z from "zod";
+import { encodableSchema } from "@automate.ax/codec";
+import { fromCloudflare } from "./api.js";
+import { CLOUDFLARE_ALERT_TYPE_SCHEMA, CLOUDFLARE_NOTIFICATION_FILTERS_SCHEMA, } from "./schemas.js";
+const PROVIDER_EVENT_SCHEMA = z.looseObject({
+    account_id: z.string().optional(),
+    alert_correlation_id: z.string().optional(),
+    alert_event: z.string().optional(),
+    alert_type: CLOUDFLARE_ALERT_TYPE_SCHEMA.optional(),
+    data: z.record(z.string(), z.unknown()).optional(),
+    name: z.string().optional(),
+    policy_id: z.string().optional(),
+    policy_name: z.string().optional(),
+    text: z.string().optional(),
+    ts: z.union([z.number(), z.string()]).optional(),
+});
+export const CLOUDFLARE_EVENT_SCHEMA = z.object({
+    accountId: z.string().optional(),
+    alertCorrelationId: z.string().optional(),
+    alertEvent: z.string().optional(),
+    alertType: CLOUDFLARE_ALERT_TYPE_SCHEMA,
+    data: z.record(z.string(), encodableSchema).prefault({}),
+    name: z.string().optional(),
+    policyId: z.string().optional(),
+    policyName: z.string().optional(),
+    text: z.string().optional(),
+    timestamp: z.union([z.number(), z.string()]).optional(),
+});
+const LAYER_4_DDOS_DATA_SCHEMA = z.object({
+    accountName: z.string().optional(),
+    accountTag: z.string().optional(),
+    action: z.string().optional(),
+    attackId: z.string().optional(),
+    attackVector: z.string().optional(),
+    dashboardLink: z.string().optional(),
+    maxRate: z.string().optional(),
+    megabitsPerSecond: z.number().optional(),
+    mitigation: z.string().optional(),
+    packetsPerSecond: z.number().optional(),
+    protocol: z.string().optional(),
+    ruleDescription: z.string().optional(),
+    ruleId: z.string().optional(),
+    ruleName: z.string().optional(),
+    rulesetId: z.string().optional(),
+    rulesetOverrideId: z.string().optional(),
+    startTime: z.string().optional(),
+    targetId: z.string().optional(),
+    targetIp: z.string().optional(),
+    targetPort: z.number().optional(),
+});
+const LAYER_7_DDOS_DATA_SCHEMA = z.object({
+    accountName: z.string().optional(),
+    accountTag: z.string().optional(),
+    action: z.string().optional(),
+    attackId: z.string().optional(),
+    attackType: z.string().optional(),
+    dashboardLink: z.string().optional(),
+    maxRate: z.string().optional(),
+    mitigation: z.string().optional(),
+    requestsPerSecond: z.number().optional(),
+    ruleDescription: z.string().optional(),
+    ruleId: z.string().optional(),
+    ruleLink: z.string().optional(),
+    rulesetId: z.string().optional(),
+    rulesetOverrideId: z.string().optional(),
+    startTime: z.string().optional(),
+    targetHostname: z.string().optional(),
+    zoneName: z.string().optional(),
+    zoneTag: z.string().optional(),
+});
+const SSL_DATA_SCHEMA = z.object({
+    accountName: z.string().optional(),
+    accountTag: z.string().optional(),
+    certificateId: z.string().optional(),
+    certificatePackId: z.string().optional(),
+    certificateStatus: z.string().optional(),
+    eventType: z.string().optional(),
+    hostnames: z.string().optional(),
+    packCa: z.string().optional(),
+    packId: z.string().optional(),
+    packStatus: z.string().optional(),
+    packValidation: z.string().optional(),
+    zoneName: z.string().optional(),
+    zoneTag: z.string().optional(),
+});
+const HEALTH_CHECK_DATA_SCHEMA = z.object({
+    accountName: z.string().optional(),
+    accountTag: z.string().optional(),
+    failingRegions: z.string().optional(),
+    healthCheckId: z.string().optional(),
+    healthCheckName: z.string().optional(),
+    newHealthStatus: z.string().optional(),
+    newStatus: z.string().optional(),
+    oldStatus: z.string().optional(),
+    originIp: z.string().optional(),
+    reason: z.string().optional(),
+    statusChangeTime: z.string().optional(),
+    timeSinceLastFailure: z.string().optional(),
+    zoneName: z.string().optional(),
+    zoneTag: z.string().optional(),
+});
+const ACCESS_CERTIFICATE_DATA_SCHEMA = z.object({
+    accountName: z.string().optional(),
+    accountTag: z.string().optional(),
+    certificateId: z.string().optional(),
+    daysTilExpiration: z.number().optional(),
+    hostnames: z.string().optional(),
+    zoneName: z.string().optional(),
+    zoneTag: z.string().optional(),
+});
+/**
+ * Builds one alert-type-specific Cloudflare event schema.
+ *
+ * @param alertType - Exact Cloudflare policy alert type.
+ * @param data - Stable documented alert data schema.
+ */
+function semanticEvent(alertType, data) {
+    return CLOUDFLARE_EVENT_SCHEMA.extend({ alertType, data });
+}
+export const CLOUDFLARE_LAYER_4_DDOS_EVENT_SCHEMA = semanticEvent(z.literal("advanced_ddos_attack_l4_alert"), LAYER_4_DDOS_DATA_SCHEMA);
+export const CLOUDFLARE_LAYER_7_DDOS_EVENT_SCHEMA = semanticEvent(z.literal("advanced_ddos_attack_l7_alert"), LAYER_7_DDOS_DATA_SCHEMA);
+export const CLOUDFLARE_SSL_CERTIFICATE_EVENT_SCHEMA = semanticEvent(z.literal("dedicated_ssl_certificate_event_type"), SSL_DATA_SCHEMA);
+export const CLOUDFLARE_ORIGIN_HEALTH_CHECK_EVENT_SCHEMA = semanticEvent(z.literal("health_check_status_notification"), HEALTH_CHECK_DATA_SCHEMA);
+export const CLOUDFLARE_ACCESS_CERTIFICATE_EVENT_SCHEMA = semanticEvent(z.literal("access_custom_certificate_expiration_type"), ACCESS_CERTIFICATE_DATA_SCHEMA);
+export const CLOUDFLARE_TRIGGER_CONFIG_SCHEMA = z.object({
+    accountId: z.string().trim().min(1),
+    alertTypes: CLOUDFLARE_ALERT_TYPE_SCHEMA.array()
+        .min(1)
+        .refine((alertTypes) => new Set(alertTypes).size === alertTypes.length, "Choose each alert type once."),
+    filters: CLOUDFLARE_NOTIFICATION_FILTERS_SCHEMA.optional(),
+});
+export const cloudflareTriggerContracts = {
+    "cloudflare.accessCertificate.expiring": {
+        configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+        eventSchema: CLOUDFLARE_ACCESS_CERTIFICATE_EVENT_SCHEMA,
+    },
+    "cloudflare.layer4DdosAttack": {
+        configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+        eventSchema: CLOUDFLARE_LAYER_4_DDOS_EVENT_SCHEMA,
+    },
+    "cloudflare.layer7DdosAttack": {
+        configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+        eventSchema: CLOUDFLARE_LAYER_7_DDOS_EVENT_SCHEMA,
+    },
+    "cloudflare.notification": {
+        configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+        eventSchema: CLOUDFLARE_EVENT_SCHEMA,
+    },
+    "cloudflare.originHealthCheckStatusChanged": {
+        configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+        eventSchema: CLOUDFLARE_ORIGIN_HEALTH_CHECK_EVENT_SCHEMA,
+    },
+    "cloudflare.sslCertificate.event": {
+        configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+        eventSchema: CLOUDFLARE_SSL_CERTIFICATE_EVENT_SCHEMA,
+    },
+};
+/**
+ * Normalizes an authenticated Cloudflare notification webhook.
+ *
+ * @param value - Untrusted provider webhook payload.
+ * @param expectedAlertType - Alert type owned by the authenticated source.
+ */
+export function normalizeCloudflareEvent(value, expectedAlertType) {
+    const event = PROVIDER_EVENT_SCHEMA.parse(value);
+    return CLOUDFLARE_EVENT_SCHEMA.parse({
+        accountId: event.account_id,
+        alertCorrelationId: event.alert_correlation_id,
+        alertEvent: event.alert_event,
+        alertType: event.alert_type ?? expectedAlertType,
+        data: fromCloudflare(event.data ?? {}),
+        name: event.name,
+        policyId: event.policy_id,
+        policyName: event.policy_name,
+        text: event.text,
+        timestamp: event.ts,
+    });
+}

package/dist/cloudflare/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./api.js";
+export * from "./events.js";
+export * from "./schemas.js";

package/dist/cloudflare/index.js

@@ -0,0 +1,3 @@
+export * from "./api.js";
+export * from "./events.js";
+export * from "./schemas.js";