@zapier/policy-context 1.3.0 → 3.0.0

package/dist/index.js

@@ -1,5 +1,20 @@
 // src/types.ts
 import { z } from "zod";
+function containsUnsafeInteger(value) {
+  if (typeof value === "number") {
+    return Number.isInteger(value) && !Number.isSafeInteger(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some(containsUnsafeInteger);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.values(value).some(containsUnsafeInteger);
+  }
+  return false;
+}
+var SafeJsonValueSchema = z.json().refine((value) => !containsUnsafeInteger(value), {
+  message: "JSON integers must be within the IEEE-754 safe range; encode larger identifiers as strings"
+});
 var ParsedUrlSchema = z.object({
   scheme: z.string().describe('URL scheme, e.g. "https"'),
   host: z.string().describe('Hostname, e.g. "api.example.com"'),
@@ -58,7 +73,7 @@ var HttpRequestContextSchema = z.object({
    * `z.json()` still rejects non-JSON values (`Date`, `undefined`,
    * functions) at parse time. Same inferred `JsonValue` type either way.
    */
-  body_json: z.unknown().pipe(z.json()).nullable().describe("Parsed JSON body (if applicable)"),
+  body_json: z.unknown().pipe(SafeJsonValueSchema).nullable().describe("Parsed JSON body (if applicable)"),
   /** Zapier connection ID used for this request */
   connection_id: z.string().max(255).optional().describe("Zapier connection ID used for this request"),
   /** Optional human-readable reason for the request */
@@ -76,6 +91,11 @@ var ActionTypeSchema = z.enum([
 ]).meta({ id: "action_type", description: "Canonical Zapier action type." });
 var ACTION_RESOURCE_SEGMENT_PATTERN = /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;
 var ACTION_KEY_SEGMENT_PATTERN = /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;
+var CONNECTION_ID_CHARS = "[^/*\\x00-\\x20\\x7f-\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000\\ufeff]";
+var CONNECTION_ID_PATTERN = new RegExp(`^${CONNECTION_ID_CHARS}+$`);
+var CONNECTION_RESOURCE_PATTERN = new RegExp(
+  `^connection/(?:\\*|${CONNECTION_ID_CHARS}+)$`
+);
 function parseActionResource(resource) {
   const segments = resource.split("/");
   if (segments.length !== 4 || segments[0] !== "action") {
@@ -136,7 +156,7 @@ var ActionRunContextInputSchema = z.object({
   }),
   connection_id: z.string().max(255).optional().describe("Zapier connection ID used for this request"),
   /** Action input parameters. See body_json above for the pipe rationale. */
-  inputs: z.unknown().pipe(z.json()).optional().describe("Action input parameters"),
+  inputs: z.unknown().pipe(SafeJsonValueSchema).optional().describe("Action input parameters"),
   reason: z.string().max(1024).optional().describe("Optional human-readable reason for the request")
 }).meta({
   id: "ActionRunContext",
@@ -167,7 +187,7 @@ var ActionRunContextSchema = ActionRunContextInputSchema.transform(
       ...input.connection_id !== void 0 && {
         connection_id: input.connection_id
       },
-      ...input.inputs !== void 0 && { inputs: input.inputs },
+      ...input.inputs !== void 0 && input.inputs !== null && { inputs: input.inputs },
       ...input.reason !== void 0 && { reason: input.reason }
     };
   }
@@ -211,8 +231,15 @@ var IGNORED_HEADERS = /* @__PURE__ */ new Set([
   "x-real-ip",
   // Proxy internal — sdkapi-specific headers
   "x-is-interactive-session",
-  "x-relay-callback-url"
+  "x-relay-callback-url",
+  // Subsumed by isIgnoredHeader's x-zapier- prefix rule; kept for byte-parity
+  // with the approvalsapi source and for consumers reading the set directly.
+  "x-zapier-approval-token"
 ]);
+function isIgnoredHeader(name) {
+  const normalized = name.toLowerCase();
+  return IGNORED_HEADERS.has(normalized) || normalized.startsWith("zapier-") || normalized.startsWith("x-zapier-");
+}
 
 // src/builders.ts
 import { z as z2 } from "zod";
@@ -235,14 +262,14 @@ function buildExactHttpConditions(context) {
     conditions.push({
       path: ["url", "query", key],
       operator: "equals",
-      value: values
+      value: structuredClone(values)
     });
   }
   if (context.body_json !== null) {
     conditions.push({
       path: ["body_json"],
       operator: "equals",
-      value: context.body_json
+      value: structuredClone(context.body_json)
     });
   } else if (context.body !== null) {
     conditions.push({
@@ -252,7 +279,7 @@ function buildExactHttpConditions(context) {
     });
   }
   for (const [key, value] of Object.entries(context.headers)) {
-    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+    if (!isIgnoredHeader(key) && typeof value === "string") {
       conditions.push({
         path: ["headers", key.toLowerCase()],
         operator: "equals",
@@ -277,7 +304,7 @@ function buildExactActionConditions(context) {
     conditions.push({
       path: ["inputs"],
       operator: "equals",
-      value: context.inputs
+      value: structuredClone(context.inputs)
     });
   }
   return conditions;
@@ -294,7 +321,7 @@ var BuildHttpRequestContextOptionsSchema = z2.object({
   method: z2.string(),
   /** Raw URL string. Will be normalized with https:// if no protocol present. */
   url: z2.string(),
-  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
+  /** Raw headers from the request. Will be filtered through isIgnoredHeader. */
   headers: z2.record(
     z2.string(),
     z2.union([z2.string(), z2.array(z2.string()), z2.undefined()])
@@ -302,7 +329,7 @@ var BuildHttpRequestContextOptionsSchema = z2.object({
   /** Raw body string */
   body: z2.string().nullable().optional(),
   /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */
-  body_json: z2.json().optional(),
+  body_json: SafeJsonValueSchema.optional(),
   /** Connection ID associated with this request */
   connection_id: z2.string().optional()
 });
@@ -314,7 +341,7 @@ function buildHttpRequestContext(options) {
   if (parsed.headers) {
     for (const [key, value] of Object.entries(parsed.headers)) {
       const lowerKey = key.toLowerCase();
-      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
+      if (!isIgnoredHeader(lowerKey) && typeof value === "string") {
         headers[lowerKey] = value;
       }
     }
@@ -337,7 +364,7 @@ function buildHttpRequestContext(options) {
     method: parsed.method.toUpperCase(),
     url,
     headers,
-    body: parsed.body ?? null,
+    body: body_json === null ? parsed.body ?? null : null,
     body_json,
     connection_id: parsed.connection_id
   });
@@ -351,7 +378,7 @@ var BuildActionRunContextOptionsSchema = z2.object({
     message: "action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)"
   }),
   connection_id: z2.string().optional(),
-  inputs: z2.json().optional(),
+  inputs: SafeJsonValueSchema.optional(),
   reason: z2.string().optional()
 });
 function buildActionRunContext(options) {
@@ -372,6 +399,7 @@ function buildActionRunContext(options) {
 // src/policies.ts
 function buildAuthStatement(authenticationId) {
   return {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_use"],
     resources: [`connection/${authenticationId}`],
@@ -379,36 +407,38 @@ function buildAuthStatement(authenticationId) {
   };
 }
 function httpContextToPolicy(context) {
-  const statements = [];
-  if (context.connection_id) {
-    statements.push(buildAuthStatement(context.connection_id));
-  }
   const conditions = buildExactHttpConditions(context);
   conditions.push({
     path: ["url", "query"],
     operator: "keys_in",
     value: Object.keys(context.url.query)
   });
-  statements.push({
+  const statement = {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_execute"],
     resources: ["http"],
     conditions
-  });
-  return { version: 2, statements };
+  };
+  const statements = context.connection_id ? [buildAuthStatement(context.connection_id), statement] : [statement];
+  return {
+    version: 3,
+    statements: [statements]
+  };
 }
 function actionContextToPolicy(context) {
-  const statements = [];
-  if (context.connection_id) {
-    statements.push(buildAuthStatement(context.connection_id));
-  }
-  statements.push({
+  const statement = {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_execute"],
     resources: [context.resource],
     conditions: buildExactActionConditions(context)
-  });
-  return { version: 2, statements };
+  };
+  const statements = context.connection_id ? [buildAuthStatement(context.connection_id), statement] : [statement];
+  return {
+    version: 3,
+    statements: [statements]
+  };
 }
 function toExactPolicy(context) {
   if (context.request_type === "http_request") {
@@ -417,9 +447,140 @@ function toExactPolicy(context) {
   return actionContextToPolicy(context);
 }
 
-// src/connection-policy.ts
+// src/zapier-policy.ts
+import { isStatementSubsumedBy } from "@zapier/policy";
+import { PolicySchema } from "@zapier/policy-schema";
 import { z as z3 } from "zod";
-var AccessLevelSchema = z3.enum(["read", "read_write"]);
+var SELECTED_API_GLOB_PART_PATTERN = /^[A-Za-z0-9._+*-]+$/;
+var ACTION_KEY_GLOB_PART_PATTERN = /^[A-Za-z0-9._+:*-]+$/;
+var PERMISSIONS = /* @__PURE__ */ new Set([
+  "can_execute",
+  "can_use",
+  "can_view",
+  "can_edit",
+  "*"
+]);
+var EFFECT_PRECEDENCE = { allow: 0, ask: 1, deny: 2 };
+function isSelectedApiPattern(value) {
+  return isGlobSegment(
+    value,
+    ACTION_RESOURCE_SEGMENT_PATTERN,
+    SELECTED_API_GLOB_PART_PATTERN
+  );
+}
+function isActionKeyPattern(value) {
+  return isGlobSegment(
+    value,
+    ACTION_KEY_SEGMENT_PATTERN,
+    ACTION_KEY_GLOB_PART_PATTERN
+  );
+}
+function isGlobSegment(value, exactPattern, globPartPattern) {
+  if (exactPattern.test(value)) {
+    return true;
+  }
+  if (!value.includes("*") || value.includes("**")) {
+    return false;
+  }
+  const parts = value.split("@");
+  return parts.length <= 2 && parts.every((part) => globPartPattern.test(part));
+}
+function isActionResourcePattern(value) {
+  const segments = value.split("/");
+  if (segments.length !== 4 || segments[0] !== "action") {
+    return false;
+  }
+  const [, selectedApi, actionType, actionKey] = segments;
+  return selectedApi !== void 0 && actionType !== void 0 && actionKey !== void 0 && isSelectedApiPattern(selectedApi) && (actionType === "*" || ActionTypeSchema.safeParse(actionType).success) && isActionKeyPattern(actionKey);
+}
+var ActionResourcePatternSchema = z3.string().refine(isActionResourcePattern, {
+  message: "Expected action/{selected_api}/{canonical_action_type|*}/{action_key_pattern}"
+});
+function resourceFamily(resource) {
+  if (resource === "*" || resource === "http") {
+    return resource;
+  }
+  if (ActionResourcePatternSchema.safeParse(resource).success) {
+    return "action";
+  }
+  if (CONNECTION_RESOURCE_PATTERN.test(resource)) {
+    return "connection";
+  }
+  return void 0;
+}
+function permissionAppliesTo(permission, family) {
+  if (permission === "*" || family === "*") {
+    return true;
+  }
+  return permission === "can_execute" ? family === "action" || family === "http" : family === "connection";
+}
+var ZapierPolicySchema = PolicySchema.superRefine((policy, ctx) => {
+  const tiers = policy.version === 3 ? policy.statements.map((statements, tierIndex) => ({
+    statements,
+    path: ["statements", tierIndex]
+  })) : [{ statements: policy.statements, path: ["statements"] }];
+  tiers.forEach(({ statements, path }) => {
+    statements.forEach((statement, statementIndex) => {
+      const families = statement.resources.map((resource, resourceIndex) => {
+        const family = resourceFamily(resource);
+        if (family === void 0) {
+          ctx.addIssue({
+            code: "custom",
+            message: 'Expected "http", "connection/{id|*}", a valid action pattern, or "*"',
+            path: [...path, statementIndex, "resources", resourceIndex]
+          });
+        }
+        return family;
+      });
+      statement.permissions.forEach((permission, permissionIndex) => {
+        if (!PERMISSIONS.has(permission)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `Unknown Zapier permission "${permission}"`,
+            path: [...path, statementIndex, "permissions", permissionIndex]
+          });
+          return;
+        }
+        const incompatibleFamily = families.find(
+          (family) => family !== void 0 && !permissionAppliesTo(permission, family)
+        );
+        if (incompatibleFamily !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            message: `Permission "${permission}" cannot apply to ${incompatibleFamily} resources`,
+            path: [...path, statementIndex, "permissions", permissionIndex]
+          });
+        }
+      });
+      const maskingStatementIndex = statements.findIndex(
+        (maskingStatement, maskingIndex) => maskingIndex !== statementIndex && EFFECT_PRECEDENCE[maskingStatement.effect] > EFFECT_PRECEDENCE[statement.effect] && isStatementSubsumedBy(statement, {
+          ...maskingStatement,
+          effect: statement.effect
+        })
+      );
+      if (maskingStatementIndex !== -1) {
+        const maskingStatement = statements[maskingStatementIndex];
+        const maskingId = maskingStatement.id ? ` (id "${maskingStatement.id}")` : "";
+        ctx.addIssue({
+          code: "custom",
+          message: `Statement is entirely masked by higher-precedence statement at index ${maskingStatementIndex}${maskingId}`,
+          path: [...path, statementIndex]
+        });
+      }
+    });
+  });
+});
+
+// src/connection-policy.ts
+import { z as z4 } from "zod";
+var AccessLevelSchema = z4.enum(["read", "read_write"]);
+function requireAccessLevel(accessLevel) {
+  if (!AccessLevelSchema.safeParse(accessLevel).success) {
+    throw new Error(
+      `invalid access_level "${accessLevel}": expected "read" or "read_write"`
+    );
+  }
+}
 var READ_HTTP_METHODS = ["GET", "HEAD", "OPTIONS"];
 var READ_ACTION_TYPES = [
   "read",
@@ -439,7 +600,19 @@ function isWriteRequest(context) {
 }
 function buildConnectionPolicy(options) {
   const { connectionId, selectedApi, accessLevel } = options;
+  requireAccessLevel(accessLevel);
+  if (!CONNECTION_ID_PATTERN.test(connectionId)) {
+    throw new Error(
+      `invalid connection_id "${connectionId}": must not contain "/", "*", or whitespace`
+    );
+  }
+  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {
+    throw new Error(
+      `invalid selected_api "${selectedApi}": must not contain "/", "*", or whitespace`
+    );
+  }
   const authStatement = {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_use"],
     resources: [`connection/${connectionId}`],
@@ -459,6 +632,7 @@ function buildConnectionPolicy(options) {
     });
   }
   const httpStatement = {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_execute"],
     resources: ["http"],
@@ -467,20 +641,22 @@ function buildConnectionPolicy(options) {
   const apiPattern = globSelectedApiVersion(selectedApi);
   const actionResources = accessLevel === "read" ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`) : [`action/${apiPattern}/*/*`];
   const actionStatement = {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_execute"],
     resources: actionResources,
     conditions: [connectionCondition]
   };
   return {
-    version: 2,
-    statements: [authStatement, httpStatement, actionStatement]
+    version: 3,
+    statements: [[authStatement, httpStatement, actionStatement]]
   };
 }
 
 // src/connectionless-policy.ts
 function buildConnectionlessPolicy(options) {
   const { context, accessLevel } = options;
+  requireAccessLevel(accessLevel);
   if (context.request_type === "http_request") {
     const conditions = [
       {
@@ -497,26 +673,35 @@ function buildConnectionlessPolicy(options) {
       });
     }
     const statement2 = {
+      id: `s_${crypto.randomUUID()}`,
       effect: "allow",
       permissions: ["can_execute"],
       resources: ["http"],
       conditions
     };
-    return { version: 2, statements: [statement2] };
+    return {
+      version: 3,
+      statements: [[statement2]]
+    };
   }
   const { selected_api } = parseActionResource(context.resource);
   const apiPattern = globSelectedApiVersion(selected_api);
   const resources = accessLevel === "read" ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`) : [`action/${apiPattern}/*/*`];
   const statement = {
+    id: `s_${crypto.randomUUID()}`,
     effect: "allow",
     permissions: ["can_execute"],
     resources,
     conditions: []
   };
-  return { version: 2, statements: [statement] };
+  return {
+    version: 3,
+    statements: [[statement]]
+  };
 }
 export {
   AccessLevelSchema,
+  ActionResourcePatternSchema,
   ActionRunContextInputSchema,
   ActionRunContextSchema,
   ActionTypeSchema,
@@ -529,6 +714,7 @@ export {
   READ_ACTION_TYPES,
   READ_HTTP_METHODS,
   RequestContextSchema,
+  ZapierPolicySchema,
   buildActionResource,
   buildActionRunContext,
   buildBroadActionResource,
@@ -540,6 +726,7 @@ export {
   buildHttpRequestContext,
   buildUrlString,
   globSelectedApiVersion,
+  isIgnoredHeader,
   isWriteRequest,
   parseActionResource,
   parseUrl,