@ionite/zod 0.0.21

package/dist/index.d.ts

@@ -0,0 +1,250 @@
+import { ApplicationValidators, AuthzEntityBase as AuthzEntityBaseType, Group as AuthzGroupType, BaseCustomer as BaseCustomerType, BaseTenant as BaseTenantType, BaseUser as BaseUserType, CreateTenantRequest, GroupResource, IAMAppValidators, IdTokenClaims, JWTAssertionClaims, OidcCallbackParams, Permission as PermissionType, RegisterIAMAppPayload, RegisterSSOAppPayload, Resource as ResourceType, Role as RoleType, ScimUser, SSOAppValidators, TenantConfigLocator, TenantResponse, TokenResponse, UpdateTenantRequest, WorkloadTokenResponse } from "@ionite/core";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+import { z } from "zod";
+/**
+* Registration-time redirect-URI safety (AUDIT_HISTORY.md §10.2). An SSO `redirectUri` (or back-channel logout
+* URI) registered with an EC MUST be an absolute web URL: `https:` anywhere, `http:` only for
+* loopback (localhost dev). Non-web schemes (`javascript:`, `data:`, `file:`, …) and control-char
+* smuggling (`java\nscript:`) are rejected so a malicious URI can never enter EC registration and
+* later be reflected as an open-redirect / XSS sink. Kept in lock-step with the valibot package.
+*/
+declare function isSafeRedirectUri(value: string): boolean;
+type CustomerShape = {
+	userName: z.ZodString;
+	name: z.ZodString;
+	email: z.ZodType<string>;
+	id: z.ZodOptional<z.ZodString>;
+	avatar: z.ZodOptional<z.ZodType<string>>;
+	userType: z.ZodOptional<z.ZodString>;
+};
+type BaseUserShape = CustomerShape & {
+	ecid: z.ZodOptional<z.ZodType<string>>;
+	accountClass: z.ZodOptional<z.ZodString>;
+};
+declare const BaseUser: z.ZodObject<BaseUserShape> & z.ZodType<BaseUserType>;
+/**
+* Extend-base schema for CIAM customers (magic link request body). Mirrors
+* `BaseUser` but binds to the `BaseCustomer` record type. Apps may `.extend()`
+* this to add custom customer attributes.
+*/
+declare const BaseCustomer: z.ZodObject<CustomerShape> & z.ZodType<BaseCustomerType>;
+/**
+* Narrow tenant config-locator schema (`{ source?, path, ttl? }`). Tenants store a pointer to their
+* RemoteConfig that resolves against secrets sources declared on the root ES; it carries no
+* connection details or credentials (those live only in the root env/bootstrap config).
+*/
+declare const TenantConfigLocatorSchema: z.ZodType<TenantConfigLocator>;
+type BaseTenantShape = {
+	id: z.ZodString;
+	companyId: z.ZodString;
+	companyName: z.ZodString;
+	environmentType: z.ZodType<CreateTenantRequest["environmentType"]>;
+	status: z.ZodType<"pending" | "processing" | "completed" | "failed" | "action_required">;
+	createdAt: z.ZodDate;
+	updatedAt: z.ZodDate;
+	configLocator: z.ZodType<TenantConfigLocator>;
+	email: z.ZodOptional<z.ZodString>;
+	webhookUrl: z.ZodOptional<z.ZodString>;
+	callbackUrl: z.ZodOptional<z.ZodString>;
+	tenantUrl: z.ZodOptional<z.ZodString>;
+	error: z.ZodOptional<z.ZodString>;
+	actionUrl: z.ZodOptional<z.ZodString>;
+	requestToken: z.ZodOptional<z.ZodString>;
+	expiresAt: z.ZodOptional<z.ZodString>;
+};
+declare const BaseTenant: z.ZodObject<BaseTenantShape> & z.ZodType<BaseTenantType>;
+type BaseTenantCreateRequestSchemaShape = {
+	id: z.ZodString;
+	companyId: z.ZodString;
+	companyName: z.ZodString;
+	environmentType: z.ZodType<CreateTenantRequest["environmentType"]>;
+	configLocator: z.ZodType<TenantConfigLocator>;
+	email: z.ZodOptional<z.ZodType<string>>;
+	webhookUrl: z.ZodOptional<z.ZodType<string>>;
+	callbackUrl: z.ZodOptional<z.ZodType<string>>;
+};
+declare const BaseTenantCreateRequestSchema: z.ZodObject<BaseTenantCreateRequestSchemaShape> & z.ZodType<CreateTenantRequest>;
+type BaseTenantUpdateRequestSchemaShape = {
+	id: z.ZodOptional<z.ZodString>;
+	companyId: z.ZodOptional<z.ZodString>;
+	companyName: z.ZodOptional<z.ZodString>;
+	environmentType: z.ZodOptional<z.ZodType<UpdateTenantRequest["environmentType"]>>;
+	configLocator: z.ZodOptional<z.ZodType<TenantConfigLocator>>;
+	email: z.ZodOptional<z.ZodType<string>>;
+	webhookUrl: z.ZodOptional<z.ZodType<string>>;
+	callbackUrl: z.ZodOptional<z.ZodType<string>>;
+};
+declare const BaseTenantUpdateRequestSchema: z.ZodObject<BaseTenantUpdateRequestSchemaShape> & z.ZodType<UpdateTenantRequest>;
+/**
+* Individual Zod schema factories for custom usage
+*/
+declare const zodValidators: {
+	authzEntityBase: () => StandardSchemaV1<unknown, AuthzEntityBaseType>;
+	authzResource: () => StandardSchemaV1<unknown, ResourceType>;
+	authzPermission: () => StandardSchemaV1<unknown, PermissionType>;
+	authzRole: () => StandardSchemaV1<unknown, RoleType>;
+	authzGroup: () => StandardSchemaV1<unknown, AuthzGroupType>;
+	/**
+	* Creates a Zod validator for OIDC callback parameters
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const callbackParams = zodValidators.oidcCallbackParams();
+	* ```
+	*/
+	oidcCallbackParams: () => StandardSchemaV1<unknown, OidcCallbackParams>;
+	/**
+	* Creates a Zod validator for ID token claims
+	* Use .extend() to add custom claims validation
+	*
+	* @example Extending with custom claims
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	* import { z } from 'zod';
+	*
+	* const customClaimsSchema = (zodValidators.idTokenClaims() as any)
+	*   .extend({
+	*     custom_claim: z.string(),
+	*     roles: z.array(z.string()),
+	*   });
+	* ```
+	*/
+	idTokenClaims: () => StandardSchemaV1<unknown, IdTokenClaims>;
+	/**
+	* Creates a Zod validator for token responses from IdP
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const tokenResponse = zodValidators.tokenResponse();
+	* ```
+	*/
+	tokenResponse: () => StandardSchemaV1<unknown, TokenResponse>;
+	/**
+	* Creates a Zod validator for SCIM User resources
+	* Use .extend() to add custom SCIM extensions
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const userValidator = zodValidators.scimUser();
+	* ```
+	*
+	* @example Extending with custom SCIM schema extensions
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	* import { z } from 'zod';
+	*
+	* const customUserSchema = (zodValidators.scimUser() as any)
+	*   .extend({
+	*     'urn:ietf:params:scim:schemas:extension:custom:2.0:User': z.object({
+	*       customField: z.string(),
+	*     }),
+	*   });
+	* ```
+	*/
+	scimUser: () => StandardSchemaV1<unknown, ScimUser>;
+	/**
+	* Creates a Zod validator for SCIM Group resources
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const groupValidator = zodValidators.scimGroup();
+	* ```
+	*/
+	scimGroup: () => StandardSchemaV1<unknown, GroupResource>;
+	/**
+	* Creates a Zod validator for JWT Assertion Claims (workload identity)
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const jwtClaims = zodValidators.jwtAssertionClaims();
+	* ```
+	*/
+	jwtAssertionClaims: () => StandardSchemaV1<unknown, JWTAssertionClaims>;
+	/**
+	* Creates a Zod validator for workload token responses
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const workloadToken = zodValidators.workloadTokenResponse();
+	* ```
+	*/
+	workloadTokenResponse: () => StandardSchemaV1<unknown, WorkloadTokenResponse>;
+	/**
+	* Creates a Zod validator for BaseUser (workforce user extend-base).
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const baseUser = zodValidators.baseUser();
+	* ```
+	*/
+	baseUser: () => StandardSchemaV1<unknown, BaseUserType>;
+	/**
+	* Creates a Zod validator for BaseCustomer (CIAM magic link request body).
+	*
+	* @example
+	* ```typescript
+	* import { zodValidators } from '@ionite/zod';
+	*
+	* const customer = zodValidators.customer();
+	* ```
+	*/
+	customer: () => StandardSchemaV1<unknown, BaseCustomerType>;
+	/**
+	* Creates a Zod validator for tenant creation requests (`POST`).
+	* Use `extendedShape` to add app-specific attributes to the request body.
+	*/
+	createTenantRequest: <TExtendedShape extends z.ZodRawShape = Record<never, z.ZodTypeAny>>(extendedShape?: TExtendedShape) => StandardSchemaV1<unknown, CreateTenantRequest<z.infer<z.ZodObject<TExtendedShape>>>>;
+	/**
+	* Creates a Zod validator for tenant update requests (`PUT`). Every field is optional; omitted
+	* fields are preserved from the stored record.
+	*/
+	updateTenantRequest: <TExtendedShape extends z.ZodRawShape = Record<never, z.ZodTypeAny>>(extendedShape?: TExtendedShape) => StandardSchemaV1<unknown, UpdateTenantRequest<z.infer<z.ZodObject<TExtendedShape>>>>;
+	/**
+	* Creates a Zod validator for tenant management responses.
+	*/
+	tenantResponse: () => StandardSchemaV1<unknown, TenantResponse>;
+	registerIAMAppPayload: () => StandardSchemaV1<unknown, RegisterIAMAppPayload>;
+	registerSSOAppPayload: () => StandardSchemaV1<unknown, RegisterSSOAppPayload>;
+};
+/**
+* Pre-built Zod validators for ionite
+*
+* These validators implement the StandardSchemaV1 interface and can be used
+* directly in ionite configuration
+*
+* @example
+* ```typescript
+* import { createValidators } from '@ionite/zod';
+*
+* const validators = createValidators();
+*
+* const ion = ionite(configSource, {
+*   validators,
+*   // ... other config
+* });
+* ```
+*/
+declare function createValidators(): ApplicationValidators;
+/**
+* EC registration validators for IAM and SSO app registration handlers.
+* Use with your EC's local registration handlers.
+*/
+declare function createControlValidators(): {
+	iam: IAMAppValidators;
+	sso: SSOAppValidators;
+};
+export { zodValidators, isSafeRedirectUri, createValidators, createControlValidators, TenantConfigLocatorSchema, BaseUser, BaseTenantUpdateRequestSchema, BaseTenantCreateRequestSchema, BaseTenant, BaseCustomer };

package/dist/index.js

@@ -0,0 +1 @@
+import{ION_SCIM_USER_EXTENSION_URN as O,isEcid as q,withValidate as H}from"@ionite/core";import{z as j}from"zod";function Z(k){for(let K=0;K<k.length;K++){let Q=k.charCodeAt(K);if(Q<=31||Q===127)return!1}let P;try{P=new URL(k)}catch{return!1}if(P.protocol==="https:")return!0;if(P.protocol==="http:"){let K=P.hostname.toLowerCase();return K==="localhost"||K==="127.0.0.1"||K==="[::1]"||K==="::1"}return!1}var $="must be an absolute https URL (http is allowed only for localhost)",N='must be a valid ECID formatted as "ecid:<realm>:<opaque>"',F=()=>j.string().refine(q,N).optional(),W=j.object({id:j.string(),name:j.string(),displayName:j.string().optional(),description:j.string(),externalId:j.string().optional(),metadata:j.record(j.string(),j.unknown()).optional()}),f=j.object({userName:j.string(),name:j.string(),email:j.email(),id:j.string().optional(),avatar:j.union([j.url(),j.literal("")]).optional(),userType:j.string().optional(),ecid:F(),accountClass:j.string().optional()}),y=j.object({userName:j.string(),name:j.string(),email:j.email(),id:j.string().optional(),avatar:j.union([j.url(),j.literal("")]).optional(),userType:j.string().optional()}),Y=j.object({source:j.string().optional(),path:j.string(),ttl:j.number().optional()}),v=j.object({id:j.string().min(1),companyId:j.string(),companyName:j.string(),environmentType:j.enum(["POC","DEV","QA","PROD"]),status:j.enum(["pending","processing","completed","failed","action_required"]),createdAt:j.date(),updatedAt:j.date(),configLocator:Y,email:j.string().optional(),webhookUrl:j.string().optional(),callbackUrl:j.string().optional(),tenantUrl:j.string().optional(),error:j.string().optional(),actionUrl:j.string().optional(),requestToken:j.string().optional(),expiresAt:j.string().optional()}),X=j.object({id:j.string(),companyId:j.string(),companyName:j.string(),environmentType:j.enum(["POC","DEV","QA","PROD"]),configLocator:Y,email:j.email().optional(),webhookUrl:j.url().optional(),callbackUrl:j.url().optional()}),b=j.object({id:j.string().optional(),companyId:j.string().optional(),companyName:j.string().optional(),environmentType:j.enum(["POC","DEV","QA","PROD"]).optional(),configLocator:Y.optional(),email:j.email().optional(),webhookUrl:j.url().optional(),callbackUrl:j.url().optional()}),J={authzEntityBase:()=>H(W),authzResource:()=>{let k=W.extend({type:j.string(),parent:j.lazy(()=>j.union([j.string(),k])).optional()});return H(k)},authzPermission:()=>{let k=W.extend({requestable:j.boolean().optional(),action:j.string().optional(),permissionTypes:j.array(j.string()).optional(),resourceTypes:j.array(j.string()).optional(),applyToSubResources:j.boolean().optional(),assignableSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional(),recommendedSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional()});return H(k)},authzRole:()=>{let k=J.authzPermission(),P=W.extend({requestable:j.boolean().optional(),roles:j.array(j.union([j.string(),j.lazy(()=>P)])).optional(),permissions:j.array(j.union([j.string(),k])).optional(),assignableSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional(),recommendedSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional()});return H(P)},authzGroup:()=>{let k=J.authzRole(),P=J.authzPermission(),K=J.authzResource(),Q=W.extend({requestable:j.boolean().optional(),groups:j.array(j.union([j.string(),j.lazy(()=>Q)])).optional(),roles:j.array(j.union([j.string(),k])).optional(),permissions:j.array(j.union([j.string(),P])).optional(),resources:j.array(j.union([j.string(),K])).optional(),assignableSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional(),recommendedSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional()});return H(Q)},oidcCallbackParams:()=>j.object({code:j.string(),state:j.string().optional(),session_state:j.string().optional(),error:j.string().optional(),error_description:j.string().optional(),error_uri:j.string().optional(),iss:j.string().optional()}),idTokenClaims:()=>j.object({sub:j.string(),iss:j.string(),aud:j.union([j.string(),j.array(j.string()).nonempty()]),exp:j.number(),iat:j.number().optional(),sid:j.string().optional(),name:j.string().optional(),email:j.union([j.email(),j.string().regex(/^[^@]+@localhost$/i)]).optional(),preferred_username:j.string().optional(),picture:j.url().optional()}).passthrough(),tokenResponse:()=>j.object({access_token:j.string(),id_token:j.string(),refresh_token:j.string().optional(),token_type:j.string(),expires_in:j.number().optional(),scope:j.string().optional(),refresh_expires_in:j.number().optional(),session_state:j.string().optional(),expires:j.string().optional()}),scimUser:()=>{let k=j.object({formatted:j.string().optional(),familyName:j.string().optional(),givenName:j.string().optional(),middleName:j.string().optional(),honorificPrefix:j.string().optional(),honorificSuffix:j.string().optional()}),P=j.object({value:j.email(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),K=j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),Q=j.object({formatted:j.string().optional(),streetAddress:j.string().optional(),locality:j.string().optional(),region:j.string().optional(),postalCode:j.string().optional(),country:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),D=j.object({value:j.string(),$ref:j.string().optional(),display:j.string().optional(),type:j.string().optional()}),G=j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),L=j.object({employeeNumber:j.string().optional(),costCenter:j.string().optional(),organization:j.string().optional(),division:j.string().optional(),department:j.string().optional(),manager:j.object({value:j.string().optional(),$ref:j.string().optional(),displayName:j.string().optional()}).optional()});return j.object({id:j.string().optional(),externalId:j.string().optional(),meta:j.object({resourceType:j.string().optional(),created:j.string().optional(),lastModified:j.string().optional(),location:j.string().optional(),version:j.string().optional()}).optional(),userName:j.string(),name:k.optional(),displayName:j.string().optional(),nickName:j.string().optional(),profileUrl:j.url().optional(),title:j.string().optional(),userType:j.string().optional(),preferredLanguage:j.string().optional(),locale:j.string().optional(),timezone:j.string().optional(),active:j.boolean().optional(),password:j.never().optional(),emails:j.array(P).optional(),phoneNumbers:j.array(K).optional(),ims:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),photos:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),addresses:j.array(Q).optional(),groups:j.array(D).optional(),entitlements:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),roles:j.array(G).optional(),x509Certificates:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":L.optional(),[O]:j.object({ecid:F(),accountClass:j.string().optional()}).optional(),schemas:j.array(j.string()).optional()})},scimGroup:()=>{let k=j.object({value:j.string(),$ref:j.string().optional(),display:j.string().optional(),type:j.enum(["User","Group"]).optional()});return j.object({id:j.string().optional(),externalId:j.string().optional(),meta:j.object({resourceType:j.string().optional(),created:j.string().optional(),lastModified:j.string().optional(),location:j.string().optional(),version:j.string().optional()}).optional(),displayName:j.string(),members:j.array(k).optional(),"urn:ionite:params:scim:schemas:extension:authz:2.0:Group":j.object({type:j.enum(["group","role","permission"]).optional(),requestable:j.boolean().optional(),description:j.string().optional(),resources:j.array(j.string()).optional()}).optional(),schemas:j.array(j.string()).optional()})},jwtAssertionClaims:()=>j.object({iss:j.string(),sub:j.string(),aud:j.union([j.string(),j.array(j.string())]).optional(),exp:j.number(),iat:j.number(),jti:j.string().optional(),scope:j.string().optional()}).passthrough(),workloadTokenResponse:()=>j.object({access_token:j.string(),token_type:j.string(),expires_in:j.number().optional(),scope:j.string().optional(),refresh_token:j.string().optional(),expires:j.string().optional()}),baseUser:()=>f,customer:()=>y,createTenantRequest:(k)=>k?X.extend(k):X,updateTenantRequest:(k)=>k?b.extend(k):b,tenantResponse:()=>j.union([j.object({tenantUrl:j.url().optional(),status:j.enum(["pending","processing","completed","failed"]),error:j.string().optional()}),j.object({status:j.literal("action_required"),actionUrl:j.url(),requestToken:j.string(),expiresAt:j.string()})]),registerIAMAppPayload:()=>j.object({id:j.string().min(1),companyId:j.string().min(1),companyName:j.string().min(1),environmentType:j.enum(["POC","DEV","QA","PROD"]),tenantUrl:j.url().optional(),displayName:j.string().optional(),productId:j.string().optional(),applicationId:j.string().optional(),scimBaseUrl:j.url().optional(),workload:j.record(j.string(),j.unknown()).optional()}),registerSSOAppPayload:()=>j.object({redirectUris:j.array(j.string().refine(Z,{message:`redirectUri ${$}`})).min(1),backchannelLogoutUri:j.string().refine(Z,{message:`backchannelLogoutUri ${$}`}).optional(),displayName:j.string().optional(),defaultScope:j.string().optional(),issuerTenant:j.string().optional(),applicationId:j.string().optional()})};function x(){return{sso:{callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())},iam:{user:H(J.scimUser()),group:H(J.scimGroup())},workload:{jwtAssertionClaims:H(J.jwtAssertionClaims()),tokenResponse:H(J.workloadTokenResponse())},tenant:{createTenantRequest:H(J.createTenantRequest()),updateTenantRequest:H(J.updateTenantRequest()),tenantResponse:H(J.tenantResponse())},ciam:{customer:H(J.customer()),callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())}}}function I(){return{iam:{registerIAMAppPayload:H(J.registerIAMAppPayload())},sso:{registerSSOAppPayload:H(J.registerSSOAppPayload())}}}export{J as zodValidators,Z as isSafeRedirectUri,x as createValidators,I as createControlValidators,Y as TenantConfigLocatorSchema,f as BaseUser,b as BaseTenantUpdateRequestSchema,X as BaseTenantCreateRequestSchema,v as BaseTenant,y as BaseCustomer};

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@ionite/zod",
+  "version": "0.0.21",
+  "description": "Zod validators for ionite (SSO, IAM, workload, tenant, CIAM)",
+  "type": "module",
+  "engines": {
+    "node": ">=20.6"
+  },
+  "author": "ionite",
+  "license": "Proprietary",
+  "dependencies": {
+    "@ionite/core": "^0.0.21",
+    "@standard-schema/spec": "^1.1.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  },
+  "files": [
+    "dist"
+  ],
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./styles.css": "./dist/index.css",
+    "./package.json": "./package.json"
+  }
+}