@zapier/policy-context 0.9.0 → 1.0.0

package/dist/index.cjs

@@ -22,13 +22,16 @@ var index_exports = {};
 __export(index_exports, {
   AccessLevelSchema: () => AccessLevelSchema,
   ActionRunContextSchema: () => ActionRunContextSchema,
+  ActionTypeSchema: () => ActionTypeSchema,
   BuildActionRunContextOptionsSchema: () => BuildActionRunContextOptionsSchema,
   BuildHttpRequestContextOptionsSchema: () => BuildHttpRequestContextOptionsSchema,
   DEFAULT_PORTS: () => DEFAULT_PORTS,
   HttpRequestContextSchema: () => HttpRequestContextSchema,
   IGNORED_HEADERS: () => IGNORED_HEADERS,
-  JsonValueSchema: () => JsonValueSchema,
+  JsonValueSchema: () => import_policy_schema.JsonValueSchema,
   ParsedUrlSchema: () => ParsedUrlSchema,
+  READ_ACTION_TYPES: () => READ_ACTION_TYPES,
+  READ_HTTP_METHODS: () => READ_HTTP_METHODS,
   RequestContextSchema: () => RequestContextSchema,
   buildActionResource: () => buildActionResource,
   buildActionRunContext: () => buildActionRunContext,
@@ -39,6 +42,8 @@ __export(index_exports, {
   buildExactHttpConditions: () => buildExactHttpConditions,
   buildHttpRequestContext: () => buildHttpRequestContext,
   buildUrlString: () => buildUrlString,
+  isWriteRequest: () => isWriteRequest,
+  parseActionResource: () => parseActionResource,
   parseUrl: () => parseUrl,
   toExactPolicy: () => toExactPolicy
 });
@@ -46,14 +51,20 @@ module.exports = __toCommonJS(index_exports);
 
 // src/types.ts
 var import_zod = require("zod");
-var JsonValueSchema = import_zod.z.custom();
+var import_zod_to_openapi = require("@asteasolutions/zod-to-openapi");
+var import_policy_schema = require("@zapier/policy-schema");
+(0, import_zod_to_openapi.extendZodWithOpenApi)(import_zod.z);
 var ParsedUrlSchema = import_zod.z.object({
-  scheme: import_zod.z.string(),
-  host: import_zod.z.string(),
-  port: import_zod.z.number(),
-  path: import_zod.z.string(),
-  query: import_zod.z.record(import_zod.z.string(), import_zod.z.array(import_zod.z.string()))
-});
+  scheme: import_zod.z.string().openapi({ description: 'URL scheme, e.g. "https"' }),
+  host: import_zod.z.string().openapi({ description: 'Hostname, e.g. "api.example.com"' }),
+  port: import_zod.z.number().int().openapi({
+    description: "Port number (defaults to 443 for https, 80 for http)"
+  }),
+  path: import_zod.z.string().openapi({ description: 'URL path, e.g. "/v1/foo"' }),
+  query: import_zod.z.record(import_zod.z.string(), import_zod.z.array(import_zod.z.string())).openapi({
+    description: "Query parameters as key to string array mapping"
+  })
+}).openapi("ParsedUrl");
 var DEFAULT_PORTS = {
   http: 80,
   https: 443
@@ -88,33 +99,136 @@ function buildUrlString(parsed) {
 }
 var HttpRequestContextSchema = import_zod.z.object({
   request_type: import_zod.z.literal("http_request"),
-  method: import_zod.z.string(),
+  method: import_zod.z.string().max(10).transform((m) => m.toUpperCase()),
   /** Parsed URL components for policy condition matching */
   url: ParsedUrlSchema,
   /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */
-  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()),
+  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).openapi({
+    description: "Filtered headers (IGNORED_HEADERS excluded, keys lowercased)"
+  }),
   /** Raw body string */
-  body: import_zod.z.string().nullable(),
+  body: import_zod.z.string().max(65536).nullable(),
   /** Parsed JSON body */
-  body_json: JsonValueSchema.nullable(),
+  body_json: import_policy_schema.JsonValueSchema.nullable().openapi({
+    // `type: 'object'` is a placeholder so zod-to-openapi short-circuits
+    // introspection of the recursive JsonValueSchema (z.lazy). The
+    // generator script strips this `type` after emit so the produced
+    // schema matches the original "any JSON value" shape.
+    type: "object",
+    description: "Parsed JSON body (if applicable)"
+  }),
   /** Zapier connection ID used for this request */
-  connection_id: import_zod.z.string().optional(),
+  connection_id: import_zod.z.string().max(255).optional().openapi({ description: "Zapier connection ID used for this request" }),
   /** Optional human-readable reason for the request */
-  reason: import_zod.z.string().optional()
-});
-var ActionRunContextSchema = import_zod.z.object({
+  reason: import_zod.z.string().max(1024).optional().openapi({ description: "Optional human-readable reason for the request" })
+}).openapi("HttpRequestContext");
+var ActionTypeSchema = import_zod.z.enum([
+  "filter",
+  "read",
+  "read_bulk",
+  "run",
+  "search",
+  "search_and_write",
+  "search_or_write",
+  "write"
+]).openapi("action_type", { description: "Canonical Zapier action type." });
+var ACTION_RESOURCE_SEGMENT_PATTERN = /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;
+function parseActionResource(resource) {
+  const segments = resource.split("/");
+  if (segments.length !== 4 || segments[0] !== "action") {
+    throw new Error(
+      `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`
+    );
+  }
+  const [, selectedApi, actionTypeRaw, actionKey] = segments;
+  if (!selectedApi || !actionTypeRaw || !actionKey) {
+    throw new Error(`action resource has empty segment: ${resource}`);
+  }
+  const actionType = ActionTypeSchema.safeParse(actionTypeRaw);
+  if (!actionType.success) {
+    throw new Error(
+      `action resource has unknown action_type "${actionTypeRaw}": ${resource}`
+    );
+  }
+  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {
+    throw new Error(
+      `action resource has invalid selected_api segment "${selectedApi}": ${resource}`
+    );
+  }
+  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(actionKey)) {
+    throw new Error(
+      `action resource has invalid action_key segment "${actionKey}": ${resource}`
+    );
+  }
+  return {
+    selected_api: selectedApi,
+    action_type: actionType.data,
+    action_key: actionKey
+  };
+}
+var ActionRunContextInputSchema = import_zod.z.object({
   request_type: import_zod.z.literal("action_run"),
-  selected_api: import_zod.z.string(),
-  action_type: import_zod.z.string(),
-  action_key: import_zod.z.string(),
-  connection_id: import_zod.z.string().optional(),
-  inputs: JsonValueSchema.optional(),
-  reason: import_zod.z.string().optional()
+  resource: import_zod.z.string().max(1024).optional().openapi({
+    description: "Canonical action resource, e.g. action/Slack@1.0.0/write/send_message"
+  }),
+  selected_api: import_zod.z.string().max(255).optional().openapi({
+    deprecated: true,
+    description: "Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`."
+  }),
+  action_type: ActionTypeSchema.optional().openapi({
+    deprecated: true,
+    description: "Legacy: canonical Zapier action type. Prefer `resource`."
+  }),
+  action_key: import_zod.z.string().max(255).optional().openapi({
+    deprecated: true,
+    description: "Legacy: action key, e.g. send_message. Prefer `resource`."
+  }),
+  connection_id: import_zod.z.string().max(255).optional().openapi({ description: "Zapier connection ID used for this request" }),
+  inputs: import_policy_schema.JsonValueSchema.optional().openapi({
+    // `type: 'object'` is a placeholder so zod-to-openapi short-circuits
+    // introspection of the recursive JsonValueSchema (z.lazy). The
+    // generator script strips this `type` after emit so the produced
+    // schema matches the original "any inputs" shape.
+    type: "object",
+    description: "Action input parameters"
+  }),
+  reason: import_zod.z.string().max(1024).optional().openapi({ description: "Optional human-readable reason for the request" })
+}).openapi("ActionRunContext", {
+  description: "Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window \u2014 approvalsapi normalizes it to the canonical form before storage."
+});
+var ActionRunContextSchema = ActionRunContextInputSchema.transform(
+  (input, ctx) => {
+    const resource = input.resource ?? (input.selected_api && input.action_type && input.action_key ? `action/${input.selected_api}/${input.action_type}/${input.action_key}` : void 0);
+    if (resource === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        message: "action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`"
+      });
+      return import_zod.z.NEVER;
+    }
+    try {
+      parseActionResource(resource);
+    } catch (err) {
+      ctx.addIssue({
+        code: "custom",
+        message: err instanceof Error ? err.message : String(err)
+      });
+      return import_zod.z.NEVER;
+    }
+    return {
+      request_type: "action_run",
+      resource,
+      ...input.connection_id !== void 0 && {
+        connection_id: input.connection_id
+      },
+      ...input.inputs !== void 0 && { inputs: input.inputs },
+      ...input.reason !== void 0 && { reason: input.reason }
+    };
+  }
+);
+var RequestContextSchema = import_zod.z.union([HttpRequestContextSchema, ActionRunContextSchema]).openapi("RequestContext", {
+  description: "Discriminated union over request_type."
 });
-var RequestContextSchema = import_zod.z.discriminatedUnion("request_type", [
-  HttpRequestContextSchema,
-  ActionRunContextSchema
-]);
 
 // src/constants.ts
 var IGNORED_HEADERS = /* @__PURE__ */ new Set([
@@ -148,74 +262,6 @@ var IGNORED_HEADERS = /* @__PURE__ */ new Set([
 
 // src/builders.ts
 var import_zod2 = require("zod");
-var BuildHttpRequestContextOptionsSchema = import_zod2.z.object({
-  method: import_zod2.z.string(),
-  /** Raw URL string. Will be normalized with https:// if no protocol present. */
-  url: import_zod2.z.string(),
-  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
-  headers: import_zod2.z.record(
-    import_zod2.z.string(),
-    import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), import_zod2.z.undefined()])
-  ).optional(),
-  /** Raw body string */
-  body: import_zod2.z.string().nullable().optional(),
-  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */
-  body_json: JsonValueSchema.optional(),
-  /** Connection ID associated with this request */
-  connection_id: import_zod2.z.string().optional()
-});
-function buildHttpRequestContext(options) {
-  const rawUrl = options.url.includes("://") ? options.url : `https://${options.url}`;
-  const url = parseUrl(rawUrl);
-  const headers = {};
-  if (options.headers) {
-    for (const [key, value] of Object.entries(options.headers)) {
-      const lowerKey = key.toLowerCase();
-      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
-        headers[lowerKey] = value;
-      }
-    }
-  }
-  let body_json = null;
-  if (options.body_json !== void 0) {
-    body_json = options.body_json;
-  } else if (options.body) {
-    const contentType = headers["content-type"];
-    const isJson = typeof contentType === "string" && (contentType.includes("application/json") || contentType.includes("application/") && contentType.includes("+json"));
-    if (isJson) {
-      try {
-        body_json = JSON.parse(options.body);
-      } catch {
-      }
-    }
-  }
-  return HttpRequestContextSchema.parse({
-    request_type: "http_request",
-    method: options.method,
-    url,
-    headers,
-    body: options.body ?? null,
-    body_json,
-    connection_id: options.connection_id
-  });
-}
-var BuildActionRunContextOptionsSchema = import_zod2.z.object({
-  selected_api: import_zod2.z.string(),
-  action_type: import_zod2.z.string(),
-  action_key: import_zod2.z.string(),
-  connection_id: import_zod2.z.string().optional(),
-  inputs: JsonValueSchema.optional()
-});
-function buildActionRunContext(options) {
-  return ActionRunContextSchema.parse({
-    request_type: "action_run",
-    selected_api: options.selected_api,
-    action_type: options.action_type,
-    action_key: options.action_key,
-    connection_id: options.connection_id,
-    inputs: options.inputs
-  });
-}
 
 // src/conditions.ts
 function buildExactHttpConditions(context) {
@@ -244,6 +290,12 @@ function buildExactHttpConditions(context) {
       operator: "equals",
       value: context.body_json
     });
+  } else if (context.body !== null) {
+    conditions.push({
+      path: ["body"],
+      operator: "equals",
+      value: context.body
+    });
   }
   for (const [key, value] of Object.entries(context.headers)) {
     if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
@@ -267,7 +319,7 @@ function buildDomainHttpConditions(context) {
 }
 function buildExactActionConditions(context) {
   const conditions = [];
-  if (context.inputs !== void 0 && context.inputs !== null && typeof context.inputs === "object") {
+  if (context.inputs !== void 0 && context.inputs !== null) {
     conditions.push({
       path: ["inputs"],
       operator: "equals",
@@ -276,11 +328,91 @@ function buildExactActionConditions(context) {
   }
   return conditions;
 }
-function buildActionResource(context) {
-  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;
+function buildActionResource(parts) {
+  return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;
 }
-function buildBroadActionResource(context) {
-  return `action/${context.selected_api}/*/*`;
+function buildBroadActionResource(parts) {
+  return `action/${parts.selected_api}/${parts.action_type}/*`;
+}
+
+// src/builders.ts
+var BuildHttpRequestContextOptionsSchema = import_zod2.z.object({
+  method: import_zod2.z.string(),
+  /** Raw URL string. Will be normalized with https:// if no protocol present. */
+  url: import_zod2.z.string(),
+  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
+  headers: import_zod2.z.record(
+    import_zod2.z.string(),
+    import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), import_zod2.z.undefined()])
+  ).optional(),
+  /** Raw body string */
+  body: import_zod2.z.string().nullable().optional(),
+  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */
+  body_json: import_policy_schema.JsonValueSchema.optional(),
+  /** Connection ID associated with this request */
+  connection_id: import_zod2.z.string().optional()
+});
+function buildHttpRequestContext(options) {
+  const parsed = BuildHttpRequestContextOptionsSchema.parse(options);
+  const rawUrl = parsed.url.includes("://") ? parsed.url : `https://${parsed.url}`;
+  const url = parseUrl(rawUrl);
+  const headers = {};
+  if (parsed.headers) {
+    for (const [key, value] of Object.entries(parsed.headers)) {
+      const lowerKey = key.toLowerCase();
+      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
+        headers[lowerKey] = value;
+      }
+    }
+  }
+  let body_json = null;
+  if (parsed.body_json !== void 0) {
+    body_json = parsed.body_json;
+  } else if (parsed.body) {
+    const contentType = headers["content-type"];
+    const isJson = typeof contentType === "string" && (contentType.includes("application/json") || contentType.includes("application/") && contentType.includes("+json"));
+    if (isJson) {
+      try {
+        body_json = JSON.parse(parsed.body);
+      } catch {
+      }
+    }
+  }
+  return HttpRequestContextSchema.parse({
+    request_type: "http_request",
+    method: parsed.method.toUpperCase(),
+    url,
+    headers,
+    body: parsed.body ?? null,
+    body_json,
+    connection_id: parsed.connection_id
+  });
+}
+var BuildActionRunContextOptionsSchema = import_zod2.z.object({
+  selected_api: import_zod2.z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {
+    message: "selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)"
+  }),
+  action_type: ActionTypeSchema,
+  action_key: import_zod2.z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {
+    message: "action_key must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)"
+  }),
+  connection_id: import_zod2.z.string().optional(),
+  inputs: import_policy_schema.JsonValueSchema.optional(),
+  reason: import_zod2.z.string().optional()
+});
+function buildActionRunContext(options) {
+  const parsed = BuildActionRunContextOptionsSchema.parse(options);
+  return ActionRunContextSchema.parse({
+    request_type: "action_run",
+    resource: buildActionResource({
+      selected_api: parsed.selected_api,
+      action_type: parsed.action_type,
+      action_key: parsed.action_key
+    }),
+    connection_id: parsed.connection_id,
+    inputs: parsed.inputs,
+    reason: parsed.reason
+  });
 }
 
 // src/policies.ts
@@ -319,7 +451,7 @@ function actionContextToPolicy(context) {
   statements.push({
     effect: "allow",
     permissions: ["can_execute"],
-    resources: [buildActionResource(context)],
+    resources: [context.resource],
     conditions: buildExactActionConditions(context)
   });
   return { version: 2, statements };
@@ -333,9 +465,28 @@ function toExactPolicy(context) {
 
 // src/connection-policy.ts
 var import_zod3 = require("zod");
+function globSelectedApiVersion(selectedApi) {
+  const at = selectedApi.indexOf("@");
+  return at === -1 ? selectedApi : selectedApi.slice(0, at) + "@*";
+}
 var AccessLevelSchema = import_zod3.z.enum(["read", "read_write"]);
 var READ_HTTP_METHODS = ["GET", "HEAD", "OPTIONS"];
-var READ_ACTION_TYPES = ["read", "search"];
+var READ_ACTION_TYPES = [
+  "read",
+  "read_bulk",
+  "search"
+];
+var READ_HTTP_METHOD_SET = new Set(READ_HTTP_METHODS);
+var READ_ACTION_TYPE_SET = new Set(
+  READ_ACTION_TYPES
+);
+function isWriteRequest(context) {
+  if (context.request_type === "http_request") {
+    return !READ_HTTP_METHOD_SET.has(context.method);
+  }
+  const { action_type } = parseActionResource(context.resource);
+  return !READ_ACTION_TYPE_SET.has(action_type);
+}
 function buildConnectionPolicy(options) {
   const { connectionId, selectedApi, accessLevel } = options;
   const authStatement = {
@@ -354,7 +505,7 @@ function buildConnectionPolicy(options) {
     httpConditions.push({
       path: ["method"],
       operator: "in",
-      value: READ_HTTP_METHODS
+      value: [...READ_HTTP_METHODS]
     });
   }
   const httpStatement = {
@@ -363,19 +514,13 @@ function buildConnectionPolicy(options) {
     resources: ["http"],
     conditions: httpConditions
   };
-  const actionConditions = [connectionCondition];
-  if (accessLevel === "read") {
-    actionConditions.push({
-      path: ["action_type"],
-      operator: "in",
-      value: READ_ACTION_TYPES
-    });
-  }
+  const apiPattern = globSelectedApiVersion(selectedApi);
+  const actionResources = accessLevel === "read" ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`) : [`action/${apiPattern}/*/*`];
   const actionStatement = {
     effect: "allow",
     permissions: ["can_execute"],
-    resources: [`action/${selectedApi}/*/*`],
-    conditions: actionConditions
+    resources: actionResources,
+    conditions: [connectionCondition]
   };
   return {
     version: 2,
@@ -386,6 +531,7 @@ function buildConnectionPolicy(options) {
 0 && (module.exports = {
   AccessLevelSchema,
   ActionRunContextSchema,
+  ActionTypeSchema,
   BuildActionRunContextOptionsSchema,
   BuildHttpRequestContextOptionsSchema,
   DEFAULT_PORTS,
@@ -393,6 +539,8 @@ function buildConnectionPolicy(options) {
   IGNORED_HEADERS,
   JsonValueSchema,
   ParsedUrlSchema,
+  READ_ACTION_TYPES,
+  READ_HTTP_METHODS,
   RequestContextSchema,
   buildActionResource,
   buildActionRunContext,
@@ -403,6 +551,8 @@ function buildConnectionPolicy(options) {
   buildExactHttpConditions,
   buildHttpRequestContext,
   buildUrlString,
+  isWriteRequest,
+  parseActionResource,
   parseUrl,
   toExactPolicy
 });