@ionite/valibot 0.0.21

package/dist/index.d.ts

@@ -0,0 +1,207 @@
+import { ApplicationValidators, AuthzEntityBase as AuthzEntityBaseType, Group as AuthzGroupType, BaseCustomer as BaseCustomerType, BaseTenant as BaseTenantType, BaseUser as BaseUserType, CreateTenantRequest, GroupResource, IAMAppValidators, IdTokenClaims, JWTAssertionClaims, OidcCallbackParams, Permission as PermissionType, RegisterIAMAppPayload, RegisterSSOAppPayload, Resource as ResourceType, Role as RoleType, ScimUser, SSOAppValidators, TenantResponse, TokenResponse, UpdateTenantRequest, WorkloadTokenResponse } from "@ionite/core";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+import * as v from "valibot";
+/**
+* Registration-time redirect-URI safety (AUDIT_HISTORY.md §10.2). An SSO `redirectUri` (or back-channel logout
+* URI) registered with an EC MUST be an absolute web URL: `https:` anywhere, `http:` only for
+* loopback (localhost dev). Non-web schemes (`javascript:`, `data:`, `file:`, …) and control-char
+* smuggling (`java\nscript:`) are rejected so a malicious URI can never enter EC registration and
+* later be reflected as an open-redirect / XSS sink. Kept in lock-step with the zod package.
+*/
+declare function isSafeRedirectUri(value: string): boolean;
+declare const BaseUser: StandardSchemaV1<unknown, BaseUserType>;
+/**
+* Extend-base schema for CIAM customers (magic link request body). Mirrors
+* `BaseUser` but binds to the `BaseCustomer` record type.
+*/
+declare const BaseCustomer: StandardSchemaV1<unknown, BaseCustomerType>;
+/**
+* Narrow tenant config-locator schema (`{ source?, path, ttl? }`). Exported under the same name as
+* the zod package's `TenantConfigLocatorSchema` for cross-package parity (AUDIT_HISTORY.md §12.3). Tenants store
+* a pointer that resolves against secrets sources declared on the root ES; it carries no connection
+* details or credentials.
+*/
+declare const TenantConfigLocatorSchema: unknown;
+declare const BaseTenant: StandardSchemaV1<unknown, BaseTenantType>;
+/**
+* Base tenant create-request shape (`POST`). Kept as a `v.object` (not cast) so `createTenantRequest`
+* can read its `.entries` to build an extended schema.
+*/
+declare const BaseTenantCreateRequestSchema: unknown;
+/**
+* Base tenant update-request shape (`PUT`). Every field is optional; omitted fields are preserved
+* from the stored record.
+*/
+declare const BaseTenantUpdateRequestSchema: unknown;
+/**
+* Individual Valibot schema factories for custom usage
+*/
+declare const valibotValidators: {
+	authzEntityBase: () => StandardSchemaV1<unknown, AuthzEntityBaseType>;
+	authzResource: () => StandardSchemaV1<unknown, ResourceType>;
+	authzPermission: () => StandardSchemaV1<unknown, PermissionType>;
+	authzRole: () => StandardSchemaV1<unknown, RoleType>;
+	authzGroup: () => StandardSchemaV1<unknown, AuthzGroupType>;
+	/**
+	* Creates a Valibot validator for OIDC callback parameters
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const callbackParams = valibotValidators.oidcCallbackParams();
+	* ```
+	*/
+	oidcCallbackParams: () => StandardSchemaV1<unknown, OidcCallbackParams>;
+	/**
+	* Creates a Valibot validator for ID token claims
+	* Use v.object() with looseObject to extend with custom claims
+	*
+	* @example Extending with custom claims
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	* import * as v from 'valibot';
+	*
+	* const customClaimsSchema = v.looseObject({
+	*   ...(valibotValidators.idTokenClaims() as any).entries,
+	*   custom_claim: v.string(),
+	*   roles: v.array(v.string()),
+	* });
+	* ```
+	*/
+	idTokenClaims: () => StandardSchemaV1<unknown, IdTokenClaims>;
+	/**
+	* Creates a Valibot validator for token responses from IdP
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const tokenResponse = valibotValidators.tokenResponse();
+	* ```
+	*/
+	tokenResponse: () => StandardSchemaV1<unknown, TokenResponse>;
+	/**
+	* Creates a Valibot validator for SCIM User resources
+	* Use v.object() to extend with custom SCIM extensions
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const userValidator = valibotValidators.scimUser();
+	* ```
+	*
+	* @example Extending with custom SCIM schema extensions
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	* import * as v from 'valibot';
+	*
+	* const customUserSchema = v.object({
+	*   ...(valibotValidators.scimUser() as any).entries,
+	*   'urn:ietf:params:scim:schemas:extension:custom:2.0:User': v.object({
+	*     customField: v.string(),
+	*   }),
+	* });
+	* ```
+	*/
+	scimUser: () => StandardSchemaV1<unknown, ScimUser>;
+	/**
+	* Creates a Valibot validator for SCIM Group resources
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const groupValidator = valibotValidators.scimGroup();
+	* ```
+	*/
+	scimGroup: () => StandardSchemaV1<unknown, GroupResource>;
+	/**
+	* Creates a Valibot validator for JWT Assertion Claims (workload identity)
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const jwtClaims = valibotValidators.jwtAssertionClaims();
+	* ```
+	*/
+	jwtAssertionClaims: () => StandardSchemaV1<unknown, JWTAssertionClaims>;
+	/**
+	* Creates a Valibot validator for workload token responses
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const workloadToken = valibotValidators.workloadTokenResponse();
+	* ```
+	*/
+	workloadTokenResponse: () => StandardSchemaV1<unknown, WorkloadTokenResponse>;
+	/**
+	* Creates a Valibot validator for tenant creation requests (`POST`).
+	* Use `extendedShape` to add app-specific attributes to the request body.
+	*/
+	createTenantRequest: <TExtendedShape extends v.ObjectEntries = Record<never, v.GenericSchema>>(extendedShape?: TExtendedShape) => StandardSchemaV1<unknown, CreateTenantRequest<v.InferOutput<v.ObjectSchema<TExtendedShape, undefined>>>>;
+	/**
+	* Creates a Valibot validator for tenant update requests (`PUT`). Every field is optional.
+	*/
+	updateTenantRequest: <TExtendedShape extends v.ObjectEntries = Record<never, v.GenericSchema>>(extendedShape?: TExtendedShape) => StandardSchemaV1<unknown, UpdateTenantRequest<v.InferOutput<v.ObjectSchema<TExtendedShape, undefined>>>>;
+	/**
+	* Creates a Valibot validator for BaseUser (workforce user extend-base).
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const baseUser = valibotValidators.baseUser();
+	* ```
+	*/
+	baseUser: () => StandardSchemaV1<unknown, BaseUserType>;
+	/**
+	* Creates a Valibot validator for BaseCustomer (CIAM magic link request body).
+	*
+	* @example
+	* ```typescript
+	* import { valibotValidators } from '@ionite/valibot';
+	*
+	* const customer = valibotValidators.customer();
+	* ```
+	*/
+	customer: () => StandardSchemaV1<unknown, BaseCustomerType>;
+	/**
+	* Creates a Valibot validator for tenant management responses.
+	*/
+	tenantResponse: () => StandardSchemaV1<unknown, TenantResponse>;
+	registerIAMAppPayload: () => StandardSchemaV1<unknown, RegisterIAMAppPayload>;
+	registerSSOAppPayload: () => StandardSchemaV1<unknown, RegisterSSOAppPayload>;
+};
+/**
+* Pre-built Valibot validators for ionite
+*
+* These validators implement the StandardSchemaV1 interface and can be used
+* directly in ionite configuration
+*
+* @example
+* ```typescript
+* import { createValidators } from '@ionite/valibot';
+*
+* const validators = createValidators();
+*
+* const ion = ionite(configSource, {
+*   validators,
+*   // ... other config
+* });
+* ```
+*/
+declare function createValidators(): ApplicationValidators;
+/**
+* EC registration validators for IAM and SSO app registration handlers.
+* Use with your EC's local registration handlers.
+*/
+declare function createControlValidators(): {
+	iam: IAMAppValidators;
+	sso: SSOAppValidators;
+};
+export { valibotValidators, isSafeRedirectUri, createValidators, createControlValidators, TenantConfigLocatorSchema, BaseUser, BaseTenantUpdateRequestSchema, BaseTenantCreateRequestSchema, BaseTenant, BaseCustomer };

package/dist/index.js

@@ -0,0 +1 @@
+import{ION_SCIM_USER_EXTENSION_URN as q,isEcid as z,withValidate as H}from"@ionite/core";import*as j from"valibot";var N='must be a valid ECID formatted as "ecid:<realm>:<opaque>"',D=()=>j.optional(j.pipe(j.string(),j.check((k)=>z(k),N)));function Z(k){for(let K=0;K<k.length;K++){let Q=k.charCodeAt(K);if(Q<=31||Q===127)return!1}let P;try{P=new URL(k)}catch{return!1}if(P.protocol==="https:")return!0;if(P.protocol==="http:"){let K=P.hostname.toLowerCase();return K==="localhost"||K==="127.0.0.1"||K==="[::1]"||K==="::1"}return!1}var $="must be an absolute https URL (http is allowed only for localhost)",f=j.object({userName:j.string(),name:j.string(),email:j.pipe(j.string(),j.email()),id:j.optional(j.string()),avatar:j.optional(j.union([j.pipe(j.string(),j.url()),j.literal("")])),userType:j.optional(j.string()),ecid:D(),accountClass:j.optional(j.string())}),y=j.object({userName:j.string(),name:j.string(),email:j.pipe(j.string(),j.email()),id:j.optional(j.string()),avatar:j.optional(j.union([j.pipe(j.string(),j.url()),j.literal("")])),userType:j.optional(j.string())}),W=j.object({id:j.string(),name:j.string(),displayName:j.optional(j.string()),description:j.string(),externalId:j.optional(j.string()),metadata:j.optional(j.record(j.string(),j.unknown()))}),Y=j.object({source:j.optional(j.string()),path:j.string(),ttl:j.optional(j.number())}),M=j.object({id:j.pipe(j.string(),j.minLength(1)),companyId:j.string(),companyName:j.string(),environmentType:j.picklist(["POC","DEV","QA","PROD"]),status:j.picklist(["pending","processing","completed","failed","action_required"]),createdAt:j.date(),updatedAt:j.date(),configLocator:Y,email:j.optional(j.string()),webhookUrl:j.optional(j.string()),callbackUrl:j.optional(j.string()),tenantUrl:j.optional(j.string()),error:j.optional(j.string()),actionUrl:j.optional(j.string()),requestToken:j.optional(j.string()),expiresAt:j.optional(j.string())}),X=j.object({id:j.string(),companyId:j.string(),companyName:j.string(),environmentType:j.picklist(["POC","DEV","QA","PROD"]),configLocator:Y,email:j.optional(j.pipe(j.string(),j.email())),webhookUrl:j.optional(j.pipe(j.string(),j.url())),callbackUrl:j.optional(j.pipe(j.string(),j.url()))}),F=j.object({id:j.optional(j.string()),companyId:j.optional(j.string()),companyName:j.optional(j.string()),environmentType:j.optional(j.picklist(["POC","DEV","QA","PROD"])),configLocator:j.optional(Y),email:j.optional(j.pipe(j.string(),j.email())),webhookUrl:j.optional(j.pipe(j.string(),j.url())),callbackUrl:j.optional(j.pipe(j.string(),j.url()))}),J={authzEntityBase:()=>H(W),authzResource:()=>{let k=j.object({...W.entries,type:j.string(),parent:j.optional(j.lazy(()=>j.union([j.string(),k])))});return H(k)},authzPermission:()=>{let k=j.object({...W.entries,requestable:j.optional(j.boolean()),action:j.optional(j.string()),permissionTypes:j.optional(j.array(j.string())),resourceTypes:j.optional(j.array(j.string())),applyToSubResources:j.optional(j.boolean()),assignableSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"]))),recommendedSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"])))});return H(k)},authzRole:()=>{let k=J.authzPermission(),P=j.object({...W.entries,requestable:j.optional(j.boolean()),roles:j.optional(j.array(j.union([j.string(),j.lazy(()=>P)]))),permissions:j.optional(j.array(j.union([j.string(),k]))),assignableSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"]))),recommendedSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"])))});return H(P)},authzGroup:()=>{let k=J.authzRole(),P=J.authzPermission(),K=J.authzResource(),Q=j.object({...W.entries,requestable:j.optional(j.boolean()),groups:j.optional(j.array(j.union([j.string(),j.lazy(()=>Q)]))),roles:j.optional(j.array(j.union([j.string(),k]))),permissions:j.optional(j.array(j.union([j.string(),P]))),resources:j.optional(j.array(j.union([j.string(),K]))),assignableSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"]))),recommendedSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"])))});return H(Q)},oidcCallbackParams:()=>j.object({code:j.string(),state:j.optional(j.string()),session_state:j.optional(j.string()),error:j.optional(j.string()),error_description:j.optional(j.string()),error_uri:j.optional(j.string()),iss:j.optional(j.string())}),idTokenClaims:()=>j.looseObject({sub:j.string(),iss:j.string(),aud:j.union([j.string(),j.pipe(j.array(j.string()),j.minLength(1))]),exp:j.number(),iat:j.optional(j.number()),sid:j.optional(j.string()),name:j.optional(j.string()),email:j.optional(j.union([j.pipe(j.string(),j.email()),j.pipe(j.string(),j.regex(/^[^@]+@localhost$/i))])),preferred_username:j.optional(j.string()),picture:j.optional(j.pipe(j.string(),j.url()))}),tokenResponse:()=>j.object({access_token:j.string(),id_token:j.string(),refresh_token:j.optional(j.string()),token_type:j.string(),expires_in:j.optional(j.number()),scope:j.optional(j.string()),refresh_expires_in:j.optional(j.number()),session_state:j.optional(j.string()),expires:j.optional(j.string())}),scimUser:()=>{let k=j.object({formatted:j.optional(j.string()),familyName:j.optional(j.string()),givenName:j.optional(j.string()),middleName:j.optional(j.string()),honorificPrefix:j.optional(j.string()),honorificSuffix:j.optional(j.string())}),P=j.object({value:j.pipe(j.string(),j.email()),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),K=j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),Q=j.object({formatted:j.optional(j.string()),streetAddress:j.optional(j.string()),locality:j.optional(j.string()),region:j.optional(j.string()),postalCode:j.optional(j.string()),country:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),G=j.object({value:j.string(),$ref:j.optional(j.string()),display:j.optional(j.string()),type:j.optional(j.string())}),L=j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),O=j.object({employeeNumber:j.optional(j.string()),costCenter:j.optional(j.string()),organization:j.optional(j.string()),division:j.optional(j.string()),department:j.optional(j.string()),manager:j.optional(j.object({value:j.optional(j.string()),$ref:j.optional(j.string()),displayName:j.optional(j.string())}))});return j.object({id:j.optional(j.string()),externalId:j.optional(j.string()),meta:j.optional(j.object({resourceType:j.optional(j.string()),created:j.optional(j.string()),lastModified:j.optional(j.string()),location:j.optional(j.string()),version:j.optional(j.string())})),userName:j.string(),name:j.optional(k),displayName:j.optional(j.string()),nickName:j.optional(j.string()),profileUrl:j.optional(j.pipe(j.string(),j.url())),title:j.optional(j.string()),userType:j.optional(j.string()),preferredLanguage:j.optional(j.string()),locale:j.optional(j.string()),timezone:j.optional(j.string()),active:j.optional(j.boolean()),password:j.optional(j.never()),emails:j.optional(j.array(P)),phoneNumbers:j.optional(j.array(K)),ims:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),photos:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),addresses:j.optional(j.array(Q)),groups:j.optional(j.array(G)),entitlements:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),roles:j.optional(j.array(L)),x509Certificates:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":j.optional(O),[q]:j.optional(j.object({ecid:D(),accountClass:j.optional(j.string())})),schemas:j.optional(j.array(j.string()))})},scimGroup:()=>{let k=j.object({value:j.string(),$ref:j.optional(j.string()),display:j.optional(j.string()),type:j.optional(j.picklist(["User","Group"]))});return j.object({id:j.optional(j.string()),externalId:j.optional(j.string()),meta:j.optional(j.object({resourceType:j.optional(j.string()),created:j.optional(j.string()),lastModified:j.optional(j.string()),location:j.optional(j.string()),version:j.optional(j.string())})),displayName:j.string(),members:j.optional(j.array(k)),"urn:ionite:params:scim:schemas:extension:authz:2.0:Group":j.optional(j.object({type:j.optional(j.picklist(["group","role","permission"])),requestable:j.optional(j.boolean()),description:j.optional(j.string()),resources:j.optional(j.array(j.string()))})),schemas:j.optional(j.array(j.string()))})},jwtAssertionClaims:()=>j.looseObject({iss:j.string(),sub:j.string(),aud:j.optional(j.union([j.string(),j.array(j.string())])),exp:j.number(),iat:j.number(),jti:j.optional(j.string()),scope:j.optional(j.string())}),workloadTokenResponse:()=>j.object({access_token:j.string(),token_type:j.string(),expires_in:j.optional(j.number()),scope:j.optional(j.string()),refresh_token:j.optional(j.string()),expires:j.optional(j.string())}),createTenantRequest:(k)=>k?j.object({...X.entries,...k}):X,updateTenantRequest:(k)=>k?j.object({...F.entries,...k}):F,baseUser:()=>f,customer:()=>y,tenantResponse:()=>j.union([j.object({tenantUrl:j.optional(j.pipe(j.string(),j.url())),status:j.picklist(["pending","processing","completed","failed"]),error:j.optional(j.string())}),j.object({status:j.literal("action_required"),actionUrl:j.pipe(j.string(),j.url()),requestToken:j.string(),expiresAt:j.string()})]),registerIAMAppPayload:()=>j.object({id:j.pipe(j.string(),j.minLength(1)),companyId:j.pipe(j.string(),j.minLength(1)),companyName:j.pipe(j.string(),j.minLength(1)),environmentType:j.picklist(["POC","DEV","QA","PROD"]),tenantUrl:j.optional(j.pipe(j.string(),j.url())),displayName:j.optional(j.string()),productId:j.optional(j.string()),applicationId:j.optional(j.string()),scimBaseUrl:j.optional(j.pipe(j.string(),j.url())),workload:j.optional(j.record(j.string(),j.unknown()))}),registerSSOAppPayload:()=>j.object({redirectUris:j.pipe(j.array(j.pipe(j.string(),j.check(Z,`redirectUri ${$}`))),j.minLength(1)),backchannelLogoutUri:j.optional(j.pipe(j.string(),j.check(Z,`backchannelLogoutUri ${$}`))),displayName:j.optional(j.string()),defaultScope:j.optional(j.string()),issuerTenant:j.optional(j.string()),applicationId:j.optional(j.string())})};function x(){return{sso:{callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())},iam:{user:H(J.scimUser()),group:H(J.scimGroup())},workload:{jwtAssertionClaims:H(J.jwtAssertionClaims()),tokenResponse:H(J.workloadTokenResponse())},tenant:{createTenantRequest:H(J.createTenantRequest()),updateTenantRequest:H(J.updateTenantRequest()),tenantResponse:H(J.tenantResponse())},ciam:{customer:H(J.customer()),callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())}}}function I(){return{iam:{registerIAMAppPayload:H(J.registerIAMAppPayload())},sso:{registerSSOAppPayload:H(J.registerSSOAppPayload())}}}export{J as valibotValidators,Z as isSafeRedirectUri,x as createValidators,I as createControlValidators,Y as TenantConfigLocatorSchema,f as BaseUser,F as BaseTenantUpdateRequestSchema,X as BaseTenantCreateRequestSchema,M as BaseTenant,y as BaseCustomer};

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@ionite/valibot",
+  "version": "0.0.21",
+  "description": "Valibot validators for ionite (SSO, IAM, workload, tenant, CIAM)",
+  "type": "module",
+  "engines": {
+    "node": ">=20.6"
+  },
+  "author": "ionite",
+  "license": "Proprietary",
+  "dependencies": {
+    "@ionite/core": "^0.0.21",
+    "@standard-schema/spec": "^1.1.0",
+    "valibot": "^1.4.2"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  },
+  "files": [
+    "dist"
+  ],
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./styles.css": "./dist/index.css",
+    "./package.json": "./package.json"
+  }
+}