@lukoweb/apitogo 0.1.148 → 0.2.1

package/src/config/v2/schema.ts

@@ -0,0 +1,211 @@
+import { z } from "zod";
+
+/**
+ * Config version 2 (Tenant Service Model, section 5; Reference, section 3).
+ *
+ * The schema is structural: shape, types, enums and ranges. Rules that relate fields to each other or to the
+ * outside world (dependencies between services, files that must exist, provider capabilities) belong to
+ * `apitogo check`.
+ */
+export const CONFIG_VERSION = 2;
+
+const SECRET_REFERENCE = /^secret:[A-Za-z_][A-Za-z0-9_]*$/;
+
+/** A reference to a project secret, never the secret itself. */
+const secretRef = z.string().refine((value) => SECRET_REFERENCE.test(value), {
+  error:
+    'must be a secret reference such as "secret:NAME", not the secret itself. Store the value with `apitogo secrets set NAME`',
+  params: { code: "CONFIG_INLINE_SECRET" },
+});
+
+const httpsUrl = z.url({
+  protocol: /^https$/,
+  error: "must be an https:// URL",
+});
+
+const nonEmpty = z.string().min(1, { error: "must not be empty" });
+
+/** A path relative to the config file. */
+const path = nonEmpty;
+const pathList = z.array(nonEmpty);
+
+const enabled = z.boolean().optional();
+
+export const PortalSchema = z.strictObject({
+  enabled,
+  dir: path.optional(),
+  name: z.string().min(1).max(80).optional(),
+  docs: z
+    .strictObject({
+      provider: z.enum(["apitogo", "external"]).optional(),
+      enabled,
+      content: pathList.optional(),
+      url: httpsUrl.optional(),
+    })
+    .optional(),
+  console: z.strictObject({ enabled }).optional(),
+  theme: path.optional(),
+  requireAuth: z
+    .union([z.boolean(), z.strictObject({ exclude: pathList })], {
+      error: 'must be true, false or { "exclude": ["/route", ...] }',
+    })
+    .optional(),
+  search: z.enum(["pagefind", "inkeep", "none"]).optional(),
+});
+
+const GatewayOriginSchema = z.strictObject({
+  mode: z.enum(["managed", "proxy"]),
+  source: path.optional(),
+  runtime: z.enum(["nodejs", "python", "dotnet"]).optional(),
+  runtimeVersion: nonEmpty.optional(),
+  exclude: pathList.optional(),
+  url: httpsUrl.optional(),
+});
+
+export const GatewaySchema = z.strictObject({
+  enabled,
+  provider: nonEmpty.optional(),
+  origin: GatewayOriginSchema,
+  specs: z.array(path).min(1, { error: "needs at least one OpenAPI file" }),
+  auth: z
+    .strictObject({
+      mode: z.enum(["identity", "oidc"]),
+      metadataUrl: httpsUrl.optional(),
+      issuers: z.array(httpsUrl).optional(),
+      audiences: z.array(nonEmpty).optional(),
+    })
+    .optional(),
+  policies: z
+    .strictObject({
+      rateLimit: z
+        .strictObject({
+          calls: z.int().positive(),
+          periodSeconds: z.int().positive(),
+        })
+        .optional(),
+      quota: z
+        .strictObject({
+          calls: z.int().positive(),
+          periodDays: z.int().min(1),
+        })
+        .optional(),
+      cors: z.array(z.url()).optional(),
+    })
+    .optional(),
+});
+
+const connectionId = z.string().regex(/^[a-z0-9-]{1,32}$/, {
+  error: "must be 1 to 32 lowercase letters, digits or hyphens",
+});
+
+export const IdentitySchema = z.strictObject({
+  enabled,
+  provider: z.enum(["apitogo", "oidc"]).optional(),
+  native: z.boolean().optional(),
+  connections: z
+    .array(
+      z.strictObject({
+        id: connectionId,
+        type: z.literal("oidc"),
+        authority: httpsUrl,
+        clientId: nonEmpty,
+        clientSecret: secretRef,
+        scopes: z.array(nonEmpty).optional(),
+        displayName: nonEmpty.optional(),
+      }),
+    )
+    .optional(),
+  clients: z
+    .array(
+      z.strictObject({
+        id: nonEmpty,
+        type: z.enum(["spa", "web", "m2m"]),
+        redirectUris: z.array(nonEmpty).optional(),
+        postLogoutRedirectUris: z.array(nonEmpty).optional(),
+        allowedOrigins: z.array(nonEmpty).optional(),
+        scopes: z.array(nonEmpty).optional(),
+        audiences: z.array(nonEmpty).optional(),
+        secret: secretRef.optional(),
+      }),
+    )
+    .optional(),
+  issuer: httpsUrl.optional(),
+  clientId: nonEmpty.optional(),
+  providerOptions: z
+    .strictObject({
+      // The Identity design doc (8.7) does not name the token lifetime keys yet; tighten when it does.
+      tokens: z.record(z.string(), z.unknown()).optional(),
+      password: z
+        .strictObject({
+          minLength: z.int().min(8).max(128).optional(),
+          checkBreached: z.boolean().optional(),
+        })
+        .optional(),
+      signup: z
+        .strictObject({
+          mode: z.enum(["open", "closed", "invite"]).optional(),
+          allowedEmailDomains: z.array(nonEmpty).optional(),
+        })
+        .optional(),
+      mfa: z
+        .strictObject({
+          mode: z.enum(["off", "optional", "required"]).optional(),
+        })
+        .optional(),
+      branding: z
+        .strictObject({
+          logo: nonEmpty.optional(),
+          color: z
+            .string()
+            .regex(/^#[0-9a-fA-F]{6}$/, {
+              error: "must be a hex colour such as #1a2b3c",
+            })
+            .optional(),
+        })
+        .optional(),
+      audience: nonEmpty.optional(),
+      customDomain: z
+        .string()
+        .regex(/^(?=.{1,253}$)([a-z0-9-]+\.)+[a-z]{2,}$/, {
+          error: "must be a lowercase hostname such as id.acme.com",
+        })
+        .optional(),
+    })
+    .optional(),
+});
+
+/**
+ * There is deliberately no `provider` field: plans entitlements follow the gateway provider and only
+ * `billing.provider` is selectable (decision 21).
+ */
+export const PlansSchema = z.strictObject({
+  enabled,
+  file: path.optional(),
+  billing: z
+    .strictObject({
+      provider: z.enum(["stripe", "none"]).optional(),
+      apiKey: secretRef.optional(),
+      webhookSecret: secretRef.optional(),
+      successUrl: httpsUrl.optional(),
+      cancelUrl: httpsUrl.optional(),
+    })
+    .optional(),
+});
+
+export const ConfigV2Schema = z.strictObject({
+  $schema: z.string().optional(),
+  version: z.literal(CONFIG_VERSION, {
+    error: `must be ${CONFIG_VERSION}`,
+  }),
+  project: z
+    .strictObject({ id: nonEmpty.optional(), name: nonEmpty.optional() })
+    .optional(),
+  layout: z.enum(["standalone", "embedded"]).optional(),
+  portal: PortalSchema.optional(),
+  gateway: GatewaySchema.optional(),
+  identity: IdentitySchema.optional(),
+  plans: PlansSchema.optional(),
+});
+
+export type ConfigV2 = z.infer<typeof ConfigV2Schema>;
+export type Layout = NonNullable<ConfigV2["layout"]>;