@zapier/policy-schema 0.12.0 → 0.15.0

package/dist/index.mjs

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 
 // src/schema.ts
-var VALID_VERSIONS = [1, 2];
+var RUBBERDUCK_POLICY_VERSION = "rc-rubberduck";
+var VALID_VERSIONS = [1, 2, RUBBERDUCK_POLICY_VERSION];
 var VALID_EFFECTS = ["allow", "ask", "deny"];
 var VALID_OPERATOR_LIST = [
   "equals",
@@ -18,10 +19,11 @@ var VALID_OPERATOR_LIST = [
 ];
 var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
 var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
+var ConditionValueSchema = z.json();
 var EqualsConditionSchema = z.object({
   path: PathSchema,
   operator: z.literal("equals"),
-  value: z.json()
+  value: ConditionValueSchema
 }).strict();
 var InConditionSchema = z.object({
   path: PathSchema,
@@ -127,7 +129,6 @@ var OperatorSchema = z.enum([
   "keys_in",
   "size"
 ]);
-var ConditionValueSchema = z.json();
 var V1StatementSchema = z.object({
   id: z.string().optional(),
   effect: z.enum(["allow", "deny"]),
@@ -143,24 +144,116 @@ var V2StatementSchema = z.object({
   conditions: z.array(ConditionSchema).optional()
 }).strict();
 var StatementSchema = V2StatementSchema;
+var StatementIdSchema = z.string().regex(/^s_\S+$/, { error: "Statement id must match ^s_\\S+$" }).max(512);
+var PolicyIdSchema = z.string().regex(/^p_\S+$/, { error: "Policy id must match ^p_\\S+$" }).max(512);
 var V1PolicySchema = z.object({
   version: z.literal(1),
   statements: z.array(V1StatementSchema)
 }).strict();
+var DefaultEffectSchema = z.enum(["deny", "ask"]);
 var V2PolicySchema = z.object({
   version: z.literal(2),
   statements: z.array(V2StatementSchema)
 }).strict();
-var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
+var RcRubberduckStatementSchema = z.object({
+  id: StatementIdSchema,
+  effect: z.enum(["allow", "ask", "deny"]),
+  permissions: z.array(z.string()).min(1),
+  resources: z.array(z.string()).min(1),
+  conditions: z.array(ConditionSchema).optional()
+}).strict();
+var RcRubberduckPolicySchema = z.object({
+  version: z.literal(RUBBERDUCK_POLICY_VERSION),
+  id: PolicyIdSchema,
+  defaultEffect: DefaultEffectSchema,
+  statements: z.array(RcRubberduckStatementSchema)
+}).strict();
+var PolicySchema = z.union([
+  V1PolicySchema,
+  V2PolicySchema,
+  RcRubberduckPolicySchema
+]);
+var CanonicalHashSchema = z.custom(
+  (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value),
+  { error: "Expected a 64-character lowercase hex SHA-256 digest" }
+);
+var OverrideHashBaseShape = {
+  id: z.string().optional(),
+  /**
+   * The canonical hash of the targeted statement.
+   * Used for v1/v2 policies. Must be a valid SHA-256 hex digest (non-null).
+   */
+  statementHash: CanonicalHashSchema,
+  effect: z.literal("allow")
+};
+var OverrideIdBaseShape = {
+  id: z.string().optional(),
+  /**
+   * The statement id of the targeted statement. Used for rc-rubberduck policies.
+   * Must be a valid statement id (non-null). To target the policy's default
+   * effect, use policyId instead.
+   */
+  statementId: StatementIdSchema,
+  effect: z.literal("allow")
+};
+var OverridePolicyIdBaseShape = {
+  id: z.string().optional(),
+  /**
+   * Targets the policy's default effect. Only applies when this policyId
+   * matches the evaluated policy's id. Used for rc-rubberduck policies.
+   */
+  policyId: PolicyIdSchema,
+  effect: z.literal("allow")
+};
+var OverrideSchema = z.union([
+  // statementHash × match
+  z.object({ ...OverrideHashBaseShape, match: z.literal("any") }).strict(),
+  // statementHash × contextHash
+  z.object({ ...OverrideHashBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // statementHash × conditionals
+  z.object({
+    ...OverrideHashBaseShape,
+    conditionals: z.array(ConditionSchema)
+  }).strict(),
+  // statementId × match
+  z.object({ ...OverrideIdBaseShape, match: z.literal("any") }).strict(),
+  // statementId × contextHash
+  z.object({ ...OverrideIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // statementId × conditionals
+  z.object({
+    ...OverrideIdBaseShape,
+    conditionals: z.array(ConditionSchema)
+  }).strict(),
+  // policyId × match
+  z.object({ ...OverridePolicyIdBaseShape, match: z.literal("any") }).strict(),
+  // policyId × contextHash
+  z.object({ ...OverridePolicyIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // policyId × conditionals
+  z.object({
+    ...OverridePolicyIdBaseShape,
+    conditionals: z.array(ConditionSchema)
+  }).strict()
+]);
 function getOpenApiSchema() {
   return {
     type: "object",
     required: ["version", "statements"],
     properties: {
       version: {
-        type: "integer",
-        enum: [...VALID_VERSIONS],
-        description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
+        anyOf: [
+          { type: "integer", enum: [1, 2] },
+          { type: "string", enum: [RUBBERDUCK_POLICY_VERSION] }
+        ],
+        description: "Policy schema version. Stable versions are 1 and 2; supported release candidates are rc-rubberduck."
+      },
+      id: {
+        type: "string",
+        description: "Policy id (required for rc-rubberduck policies). Must use the p_ prefix and contain no whitespace."
+      },
+      defaultEffect: {
+        type: "string",
+        enum: [...DefaultEffectSchema.options],
+        description: "Effect applied when no statement matches. Required on rc-rubberduck policies; deny equals implicit deny."
       },
       statements: {
         type: "array",
@@ -171,12 +264,12 @@ function getOpenApiSchema() {
           properties: {
             id: {
               type: "string",
-              description: "Optional identifier for debugging and provenance. Included in canonical hash."
+              description: "Statement identifier. Required for rc-rubberduck policies; must use the s_ prefix with no whitespace. Optional on v1/v2 for debugging and provenance."
             },
             effect: {
               type: "string",
               enum: [...VALID_EFFECTS].sort(),
-              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
+              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2 and rc-rubberduck policies."
             },
             permissions: {
               type: "array",
@@ -223,4 +316,4 @@ function getOpenApiSchema() {
   };
 }
 
-export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+export { ArrayOperatorSchema, CanonicalHashSchema, ConditionSchema, ConditionValueSchema, DefaultEffectSchema, OperatorSchema, OtherOperatorSchema, OverrideSchema, PolicyIdSchema, PolicySchema, RUBBERDUCK_POLICY_VERSION, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementIdSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-schema",
-  "version": "0.12.0",
+  "version": "0.15.0",
   "description": "Zod schemas and TypeScript types for the Zapier policy engine",
   "type": "module",
   "main": "dist/index.cjs",