@zapier/policy-schema 0.15.0 → 0.18.0

package/dist/index.cjs

@@ -4,9 +4,14 @@ var zod = require('zod');
 
 // src/schema.ts
 var RUBBERDUCK_POLICY_VERSION = "rc-rubberduck";
-var VALID_VERSIONS = [1, 2, RUBBERDUCK_POLICY_VERSION];
+var VALID_VERSIONS = [1, 2, 3, RUBBERDUCK_POLICY_VERSION];
+var ID_BASED_VERSIONS = /* @__PURE__ */ new Set([
+  3,
+  RUBBERDUCK_POLICY_VERSION
+]);
 var VALID_EFFECTS = ["allow", "ask", "deny"];
 var VALID_OPERATOR_LIST = [
+  "all",
   "equals",
   "exists",
   "in",
@@ -15,37 +20,47 @@ var VALID_OPERATOR_LIST = [
   "matches_host",
   "matches_path",
   "matches_url",
+  "none",
   "range",
   "size",
+  "some",
   "values_in"
 ];
 var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
-var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
+var PathSegmentSchema = zod.z.union([zod.z.string(), zod.z.number().int()]);
+var PathSchema = zod.z.array(PathSegmentSchema).min(1);
+var RelativePathSchema = zod.z.array(PathSegmentSchema);
+var NegateField = { negate: zod.z.boolean().optional() };
 var ConditionValueSchema = zod.z.json();
 var EqualsConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("equals"),
-  value: ConditionValueSchema
+  value: ConditionValueSchema,
+  ...NegateField
 }).strict();
 var InConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("in"),
-  value: zod.z.array(ScalarSchema).min(1)
+  value: zod.z.array(ScalarSchema).min(1),
+  ...NegateField
 }).strict();
 var MatchesConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var MatchesHostConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches_host"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var MatchesPathConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches_path"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var RangeValueSchema = zod.z.object({
   min: zod.z.number().finite().optional(),
@@ -56,26 +71,31 @@ var RangeValueSchema = zod.z.object({
 var RangeConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("range"),
-  value: RangeValueSchema
+  value: RangeValueSchema,
+  ...NegateField
 }).strict();
 var MatchesUrlConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches_url"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var ValuesInConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("values_in"),
-  value: zod.z.array(ScalarSchema).min(1)
+  value: zod.z.array(ScalarSchema).min(1),
+  ...NegateField
 }).strict();
 var ExistsConditionSchema = zod.z.object({
   path: PathSchema,
-  operator: zod.z.literal("exists")
+  operator: zod.z.literal("exists"),
+  ...NegateField
 }).strict();
 var KeysInConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("keys_in"),
-  value: zod.z.array(zod.z.string())
+  value: zod.z.array(zod.z.string()),
+  ...NegateField
 }).strict();
 var SizeValueSchema = zod.z.union([
   zod.z.number().int().nonnegative(),
@@ -84,7 +104,26 @@ var SizeValueSchema = zod.z.union([
 var SizeConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("size"),
-  value: SizeValueSchema
+  value: SizeValueSchema,
+  ...NegateField
+}).strict();
+var RelativeConditionSchema = zod.z.union([
+  EqualsConditionSchema.extend({ path: RelativePathSchema }),
+  InConditionSchema.extend({ path: RelativePathSchema }),
+  MatchesConditionSchema.extend({ path: RelativePathSchema }),
+  MatchesHostConditionSchema.extend({ path: RelativePathSchema }),
+  MatchesPathConditionSchema.extend({ path: RelativePathSchema }),
+  RangeConditionSchema.extend({ path: RelativePathSchema }),
+  MatchesUrlConditionSchema.extend({ path: RelativePathSchema }),
+  ValuesInConditionSchema.extend({ path: RelativePathSchema }),
+  ExistsConditionSchema.extend({ path: RelativePathSchema }),
+  KeysInConditionSchema.extend({ path: RelativePathSchema }),
+  SizeConditionSchema.extend({ path: RelativePathSchema })
+]);
+var QuantifierConditionSchema = zod.z.object({
+  path: PathSchema,
+  operator: zod.z.enum(["some", "all", "none"]),
+  where: zod.z.array(RelativeConditionSchema).min(1)
 }).strict();
 var ConditionSchema = zod.z.union([
   // Scalar operators
@@ -101,7 +140,8 @@ var ConditionSchema = zod.z.union([
   // Other operators
   ExistsConditionSchema,
   KeysInConditionSchema,
-  SizeConditionSchema
+  SizeConditionSchema,
+  QuantifierConditionSchema
 ]);
 var ScalarOperatorSchema = zod.z.enum([
   "equals",
@@ -111,7 +151,7 @@ var ScalarOperatorSchema = zod.z.enum([
   "matches_path",
   "range"
 ]);
-var ArrayOperatorSchema = zod.z.enum(["values_in"]);
+var ArrayOperatorSchema = zod.z.enum(["values_in", "some", "all", "none"]);
 var UrlOperatorSchema = zod.z.enum(["matches_url"]);
 var OtherOperatorSchema = zod.z.enum(["exists", "keys_in", "size"]);
 var OperatorSchema = zod.z.enum([
@@ -126,6 +166,9 @@ var OperatorSchema = zod.z.enum([
   "matches_url",
   // Array
   "values_in",
+  "some",
+  "all",
+  "none",
   // Other
   "exists",
   "keys_in",
@@ -170,9 +213,24 @@ var RcRubberduckPolicySchema = zod.z.object({
   defaultEffect: DefaultEffectSchema,
   statements: zod.z.array(RcRubberduckStatementSchema)
 }).strict();
+var V3_MAX_TIERS = 3;
+var V3StatementSchema = zod.z.object({
+  id: StatementIdSchema,
+  effect: zod.z.enum(["allow", "ask", "deny"]),
+  permissions: zod.z.array(zod.z.string()).min(1),
+  resources: zod.z.array(zod.z.string()).min(1),
+  conditions: zod.z.array(ConditionSchema).optional()
+}).strict();
+var V3PolicySchema = zod.z.object({
+  version: zod.z.literal(3),
+  // Ordered tiers, in priority order. 1..V3_MAX_TIERS tiers; a tier may be
+  // empty (e.g. `[[]]` denies everything).
+  statements: zod.z.array(zod.z.array(V3StatementSchema)).min(1).max(V3_MAX_TIERS)
+}).strict();
 var PolicySchema = zod.z.union([
   V1PolicySchema,
   V2PolicySchema,
+  V3PolicySchema,
   RcRubberduckPolicySchema
 ]);
 var CanonicalHashSchema = zod.z.custom(
@@ -237,76 +295,87 @@ var OverrideSchema = zod.z.union([
   }).strict()
 ]);
 function getOpenApiSchema() {
-  return {
+  const statementItems = {
     type: "object",
-    required: ["version", "statements"],
+    required: ["effect", "permissions", "resources"],
     properties: {
-      version: {
-        anyOf: [
-          { type: "integer", enum: [1, 2] },
-          { type: "string", enum: [RUBBERDUCK_POLICY_VERSION] }
-        ],
-        description: "Policy schema version. Stable versions are 1 and 2; supported release candidates are rc-rubberduck."
-      },
       id: {
         type: "string",
-        description: "Policy id (required for rc-rubberduck policies). Must use the p_ prefix and contain no whitespace."
+        description: "Statement identifier. Required for v3 and rc-rubberduck policies; must use the s_ prefix with no whitespace. Optional on v1/v2 for debugging and provenance."
       },
-      defaultEffect: {
+      effect: {
         type: "string",
-        enum: [...DefaultEffectSchema.options],
-        description: "Effect applied when no statement matches. Required on rc-rubberduck policies; deny equals implicit deny."
+        enum: [...VALID_EFFECTS].sort(),
+        description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2, version 3, and rc-rubberduck policies."
       },
-      statements: {
+      permissions: {
+        type: "array",
+        minItems: 1,
+        items: { type: "string" },
+        description: "List of permission identifiers."
+      },
+      resources: {
         type: "array",
-        description: "List of policy statements defining permissions.",
+        minItems: 1,
+        items: { type: "string" },
+        description: "List of resource identifiers the statement applies to."
+      },
+      conditions: {
+        type: "array",
+        description: "Optional conditions that must be met for the statement to apply.",
         items: {
           type: "object",
-          required: ["effect", "permissions", "resources"],
+          required: ["path", "operator"],
           properties: {
-            id: {
-              type: "string",
-              description: "Statement identifier. Required for rc-rubberduck policies; must use the s_ prefix with no whitespace. Optional on v1/v2 for debugging and provenance."
+            path: {
+              type: "array",
+              minItems: 1,
+              description: "Path to the value to evaluate in the request context.",
+              items: {
+                anyOf: [{ type: "string" }, { type: "integer" }]
+              }
             },
-            effect: {
+            operator: {
               type: "string",
-              enum: [...VALID_EFFECTS].sort(),
-              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2 and rc-rubberduck policies."
+              enum: [...VALID_OPERATOR_LIST],
+              description: "Comparison operator used to evaluate the condition."
             },
-            permissions: {
-              type: "array",
-              minItems: 1,
-              items: { type: "string" },
-              description: "List of permission identifiers."
+            value: {
+              description: "Value to compare against using the operator."
             },
-            resources: {
-              type: "array",
-              minItems: 1,
-              items: { type: "string" },
-              description: "List of resource identifiers the statement applies to."
+            negate: {
+              type: "boolean",
+              description: "When true, the condition passes only if the operator would have failed. Not permitted on the some, all, and none quantifiers."
             },
-            conditions: {
+            where: {
               type: "array",
-              description: "Optional conditions that must be met for the statement to apply.",
+              minItems: 1,
+              description: "Conditions evaluated relative to each collection element for some, all, and none.",
               items: {
                 type: "object",
                 required: ["path", "operator"],
                 properties: {
                   path: {
                     type: "array",
-                    minItems: 1,
-                    description: "Path to the value to evaluate in the request context.",
+                    minItems: 0,
+                    description: "Path relative to the collection element; an empty path selects the element itself.",
                     items: {
                       anyOf: [{ type: "string" }, { type: "integer" }]
                     }
                   },
                   operator: {
                     type: "string",
-                    enum: [...VALID_OPERATOR_LIST],
-                    description: "Comparison operator used to evaluate the condition."
+                    enum: [...VALID_OPERATOR_LIST].filter(
+                      (operator) => operator !== "some" && operator !== "all" && operator !== "none"
+                    ),
+                    description: "Non-quantifier operator evaluated against the collection element."
                   },
                   value: {
                     description: "Value to compare against using the operator."
+                  },
+                  negate: {
+                    type: "boolean",
+                    description: "When true, the relative condition passes only if the operator would have failed."
                   }
                 }
               }
@@ -316,6 +385,42 @@ function getOpenApiSchema() {
       }
     }
   };
+  return {
+    type: "object",
+    required: ["version", "statements"],
+    properties: {
+      version: {
+        anyOf: [
+          { type: "integer", enum: [1, 2, 3] },
+          { type: "string", enum: [RUBBERDUCK_POLICY_VERSION] }
+        ],
+        description: "Policy schema version. Stable versions are 1, 2, and 3; supported release candidates are rc-rubberduck."
+      },
+      id: {
+        type: "string",
+        description: "Policy id (required for rc-rubberduck policies; not permitted on any other version). Must use the p_ prefix and contain no whitespace."
+      },
+      defaultEffect: {
+        type: "string",
+        enum: [...DefaultEffectSchema.options],
+        description: "Effect applied when no statement matches. Required on rc-rubberduck policies (deny equals implicit deny); not permitted on any other version."
+      },
+      statements: {
+        type: "array",
+        description: "Policy statements. For v1/v2/rc-rubberduck each entry is a statement. For v3 each entry is a tier (a list of statements); tiers are in priority order and evaluated first-to-last (the first tier with a match decides), so `statements` is a list of lists.",
+        items: {
+          anyOf: [
+            statementItems,
+            {
+              type: "array",
+              description: "A v3 tier: statements evaluated together with deny > ask > allow precedence.",
+              items: statementItems
+            }
+          ]
+        }
+      }
+    }
+  };
 }
 
 exports.ArrayOperatorSchema = ArrayOperatorSchema;
@@ -323,6 +428,7 @@ exports.CanonicalHashSchema = CanonicalHashSchema;
 exports.ConditionSchema = ConditionSchema;
 exports.ConditionValueSchema = ConditionValueSchema;
 exports.DefaultEffectSchema = DefaultEffectSchema;
+exports.ID_BASED_VERSIONS = ID_BASED_VERSIONS;
 exports.OperatorSchema = OperatorSchema;
 exports.OtherOperatorSchema = OtherOperatorSchema;
 exports.OverrideSchema = OverrideSchema;
@@ -335,6 +441,7 @@ exports.SizeValueSchema = SizeValueSchema;
 exports.StatementIdSchema = StatementIdSchema;
 exports.StatementSchema = StatementSchema;
 exports.UrlOperatorSchema = UrlOperatorSchema;
+exports.V3_MAX_TIERS = V3_MAX_TIERS;
 exports.VALID_EFFECTS = VALID_EFFECTS;
 exports.VALID_OPERATOR_LIST = VALID_OPERATOR_LIST;
 exports.VALID_VERSIONS = VALID_VERSIONS;