@cubist-labs/cubesigner-sdk 0.4.259 → 0.4.260

package/src/role.ts

@@ -484,8 +484,30 @@ export type NamedPolicyReference = {
   Reference: PolicyReference;
 };
 
+/** Explicit "permit" vs "deny" policy outcome, with or without a descriptive message. */
+export type Const = ConstOutcome | { outcome: ConstOutcome; message: string };
+
+/** Explicit "permit" vs "deny" policy outcome. */
+export type ConstOutcome = "Permit" | "Deny";
+
+/**
+ * A {@link https://github.com/google/cel-spec Common Expression Language}
+ * policy to evaluate against the following context:
+ *
+ * ```json
+ * {
+ *   "operation": OperationKind,
+ *   "identity": <UserOrRoleId>,
+ *   "body": <RequestBodyJson>
+ * }
+ * ```
+ */
+export type Cel = { Cel: string };
+
 /** Key policies that restrict the requests that the signing endpoints accept */
 export type KeyDenyPolicy =
+  | Const
+  | Cel
   | OperationAllowlist
   | TxReceiver
   | TxDeposit
@@ -508,6 +530,7 @@ export type KeyDenyPolicy =
   | PolicyAnd
   | PolicyOr
   | PolicyNot
+  | PolicyIte
   | NamedPolicyReference;
 
 /**
@@ -545,6 +568,30 @@ export type RolePolicy = RolePolicyRule[];
 
 export type RolePolicyRule = KeyDenyPolicy | PolicyReference;
 
+/** Conditional policy */
+export type Conditional = {
+  /** The condition to evaluate first. */
+  if: KeyDenyPolicy;
+
+  /** The policy to apply when the condition evaluates to 'Permit'. */
+  then: KeyDenyPolicy;
+};
+
+/** One or more conditional policies */
+export type Conditionals =
+  | Conditional
+  | {
+      conditionals: Conditional[];
+    };
+
+/** If-then-else policy */
+export type PolicyIte = {
+  IfThenElse: Conditionals & {
+    /** The policy to apply when none of the conditionals apply. */
+    else: KeyDenyPolicy;
+  };
+};
+
 export type PolicyAnd = {
   And: KeyDenyPolicy[];
 };