@zapier/policy-schema 0.17.0 → 0.19.0

package/dist/index.cjs

@@ -4,9 +4,10 @@ var zod = require('zod');
 
 // src/schema.ts
 var RUBBERDUCK_POLICY_VERSION = "rc-rubberduck";
-var VALID_VERSIONS = [1, 2, 3, RUBBERDUCK_POLICY_VERSION];
+var VALID_VERSIONS = [1, 2, 3, 4, RUBBERDUCK_POLICY_VERSION];
 var ID_BASED_VERSIONS = /* @__PURE__ */ new Set([
   3,
+  4,
   RUBBERDUCK_POLICY_VERSION
 ]);
 var VALID_EFFECTS = ["allow", "ask", "deny"];
@@ -27,33 +28,40 @@ var VALID_OPERATOR_LIST = [
   "values_in"
 ];
 var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
-var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
-var RelativePathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()]));
+var PathSegmentSchema = zod.z.union([zod.z.string(), zod.z.number().int()]);
+var PathSchema = zod.z.array(PathSegmentSchema).min(1);
+var RelativePathSchema = zod.z.array(PathSegmentSchema);
+var NegateField = { negate: zod.z.boolean().optional() };
 var ConditionValueSchema = zod.z.json();
 var EqualsConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("equals"),
-  value: ConditionValueSchema
+  value: ConditionValueSchema,
+  ...NegateField
 }).strict();
 var InConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("in"),
-  value: zod.z.array(ScalarSchema).min(1)
+  value: zod.z.array(ScalarSchema).min(1),
+  ...NegateField
 }).strict();
 var MatchesConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var MatchesHostConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches_host"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var MatchesPathConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches_path"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var RangeValueSchema = zod.z.object({
   min: zod.z.number().finite().optional(),
@@ -64,26 +72,31 @@ var RangeValueSchema = zod.z.object({
 var RangeConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("range"),
-  value: RangeValueSchema
+  value: RangeValueSchema,
+  ...NegateField
 }).strict();
 var MatchesUrlConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("matches_url"),
-  value: zod.z.string()
+  value: zod.z.string(),
+  ...NegateField
 }).strict();
 var ValuesInConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("values_in"),
-  value: zod.z.array(ScalarSchema).min(1)
+  value: zod.z.array(ScalarSchema).min(1),
+  ...NegateField
 }).strict();
 var ExistsConditionSchema = zod.z.object({
   path: PathSchema,
-  operator: zod.z.literal("exists")
+  operator: zod.z.literal("exists"),
+  ...NegateField
 }).strict();
 var KeysInConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("keys_in"),
-  value: zod.z.array(zod.z.string())
+  value: zod.z.array(zod.z.string()),
+  ...NegateField
 }).strict();
 var SizeValueSchema = zod.z.union([
   zod.z.number().int().nonnegative(),
@@ -92,7 +105,8 @@ var SizeValueSchema = zod.z.union([
 var SizeConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("size"),
-  value: SizeValueSchema
+  value: SizeValueSchema,
+  ...NegateField
 }).strict();
 var RelativeConditionSchema = zod.z.union([
   EqualsConditionSchema.extend({ path: RelativePathSchema }),
@@ -178,6 +192,7 @@ var V2StatementSchema = zod.z.object({
 var StatementSchema = V2StatementSchema;
 var StatementIdSchema = zod.z.string().regex(/^s_\S+$/, { error: "Statement id must match ^s_\\S+$" }).max(512);
 var PolicyIdSchema = zod.z.string().regex(/^p_\S+$/, { error: "Policy id must match ^p_\\S+$" }).max(512);
+var RuleIdSchema = zod.z.string().regex(/^r_\S+$/, { error: "Rule id must match ^r_\\S+$" }).max(512);
 var V1PolicySchema = zod.z.object({
   version: zod.z.literal(1),
   statements: zod.z.array(V1StatementSchema)
@@ -214,10 +229,25 @@ var V3PolicySchema = zod.z.object({
   // empty (e.g. `[[]]` denies everything).
   statements: zod.z.array(zod.z.array(V3StatementSchema)).min(1).max(V3_MAX_TIERS)
 }).strict();
+var V4_MAX_TIERS = 3;
+var V4RuleSchema = zod.z.object({
+  id: RuleIdSchema,
+  effect: zod.z.enum(["allow", "ask", "deny"]),
+  permissions: zod.z.array(zod.z.string()).min(1),
+  resources: zod.z.array(zod.z.string()).min(1),
+  conditions: zod.z.array(ConditionSchema).optional()
+}).strict();
+var V4PolicySchema = zod.z.object({
+  version: zod.z.literal(4),
+  // Ordered tiers, in priority order. 1..V4_MAX_TIERS tiers; a tier may be
+  // empty (e.g. `[[]]` denies everything). Renamed from v3's `statements`.
+  rules: zod.z.array(zod.z.array(V4RuleSchema)).min(1).max(V4_MAX_TIERS)
+}).strict();
 var PolicySchema = zod.z.union([
   V1PolicySchema,
   V2PolicySchema,
   V3PolicySchema,
+  V4PolicySchema,
   RcRubberduckPolicySchema
 ]);
 var CanonicalHashSchema = zod.z.custom(
@@ -252,6 +282,12 @@ var OverridePolicyIdBaseShape = {
   policyId: PolicyIdSchema,
   effect: zod.z.literal("allow")
 };
+var OverrideRuleIdBaseShape = {
+  id: zod.z.string().optional(),
+  /** Targets a v4 rule by id (r_ prefix, non-null). */
+  ruleId: RuleIdSchema,
+  effect: zod.z.literal("allow")
+};
 var OverrideSchema = zod.z.union([
   // statementHash × match
   zod.z.object({ ...OverrideHashBaseShape, match: zod.z.literal("any") }).strict(),
@@ -279,6 +315,15 @@ var OverrideSchema = zod.z.union([
   zod.z.object({
     ...OverridePolicyIdBaseShape,
     conditionals: zod.z.array(ConditionSchema)
+  }).strict(),
+  // ruleId × match
+  zod.z.object({ ...OverrideRuleIdBaseShape, match: zod.z.literal("any") }).strict(),
+  // ruleId × contextHash
+  zod.z.object({ ...OverrideRuleIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // ruleId × conditionals
+  zod.z.object({
+    ...OverrideRuleIdBaseShape,
+    conditionals: zod.z.array(ConditionSchema)
   }).strict()
 ]);
 function getOpenApiSchema() {
@@ -293,7 +338,7 @@ function getOpenApiSchema() {
       effect: {
         type: "string",
         enum: [...VALID_EFFECTS].sort(),
-        description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2, version 3, and rc-rubberduck policies."
+        description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2, version 3, version 4, and rc-rubberduck policies."
       },
       permissions: {
         type: "array",
@@ -330,6 +375,10 @@ function getOpenApiSchema() {
             value: {
               description: "Value to compare against using the operator."
             },
+            negate: {
+              type: "boolean",
+              description: "When true, the condition passes only if the operator would have failed. Not permitted on the some, all, and none quantifiers."
+            },
             where: {
               type: "array",
               minItems: 1,
@@ -355,6 +404,10 @@ function getOpenApiSchema() {
                   },
                   value: {
                     description: "Value to compare against using the operator."
+                  },
+                  negate: {
+                    type: "boolean",
+                    description: "When true, the relative condition passes only if the operator would have failed."
                   }
                 }
               }
@@ -364,42 +417,123 @@ function getOpenApiSchema() {
       }
     }
   };
-  return {
-    type: "object",
-    required: ["version", "statements"],
+  const ruleItems = {
+    ...statementItems,
     properties: {
-      version: {
-        anyOf: [
-          { type: "integer", enum: [1, 2, 3] },
-          { type: "string", enum: [RUBBERDUCK_POLICY_VERSION] }
-        ],
-        description: "Policy schema version. Stable versions are 1, 2, and 3; supported release candidates are rc-rubberduck."
-      },
+      ...statementItems.properties,
       id: {
         type: "string",
-        description: "Policy id (required for rc-rubberduck policies; not permitted on any other version). Must use the p_ prefix and contain no whitespace."
+        description: "Rule identifier. Required for v4 policies; must use the r_ prefix with no whitespace."
       },
-      defaultEffect: {
-        type: "string",
-        enum: [...DefaultEffectSchema.options],
-        description: "Effect applied when no statement matches. Required on rc-rubberduck policies (deny equals implicit deny); not permitted on any other version."
+      resources: {
+        ...statementItems.properties.resources,
+        description: "List of resource identifiers the rule applies to."
       },
-      statements: {
-        type: "array",
-        description: "Policy statements. For v1/v2/rc-rubberduck each entry is a statement. For v3 each entry is a tier (a list of statements); tiers are in priority order and evaluated first-to-last (the first tier with a match decides), so `statements` is a list of lists.",
-        items: {
-          anyOf: [
-            statementItems,
-            {
-              type: "array",
-              description: "A v3 tier: statements evaluated together with deny > ask > allow precedence.",
-              items: statementItems
-            }
-          ]
-        }
+      conditions: {
+        ...statementItems.properties.conditions,
+        description: "Optional conditions that must be met for the rule to apply."
       }
     }
   };
+  const versionDescription = "Policy schema version. Stable versions are 1, 2, 3, and 4; supported release candidates are rc-rubberduck.";
+  const flatStatements = {
+    type: "array",
+    description: "Policy statements; each entry is a statement.",
+    items: statementItems
+  };
+  const statementTiers = {
+    type: "array",
+    description: "v3 tiers in priority order; each entry is a tier (a list of statements) evaluated first-to-last (the first tier with a match decides), so `statements` is a list of lists.",
+    items: {
+      type: "array",
+      description: "A v3 tier: statements evaluated together with deny > ask > allow precedence.",
+      items: statementItems
+    }
+  };
+  const ruleTiers = {
+    type: "array",
+    description: "v4 rules in priority order; each entry is a tier (a list of rules) evaluated first-to-last (the first tier with a match decides), so `rules` is a list of lists.",
+    items: {
+      type: "array",
+      description: "A v4 tier: rules evaluated together with deny > ask > allow precedence.",
+      items: ruleItems
+    }
+  };
+  const idProperty = {
+    type: "string",
+    description: "Policy id (rc-rubberduck only). Must use the p_ prefix and contain no whitespace."
+  };
+  const defaultEffectProperty = {
+    type: "string",
+    enum: [...DefaultEffectSchema.options],
+    description: "Effect applied when no statement matches (rc-rubberduck only; deny equals implicit deny)."
+  };
+  return {
+    oneOf: [
+      {
+        type: "object",
+        required: ["version", "statements"],
+        properties: {
+          version: {
+            type: "integer",
+            const: 1,
+            description: versionDescription
+          },
+          statements: flatStatements
+        }
+      },
+      {
+        type: "object",
+        required: ["version", "statements"],
+        properties: {
+          version: {
+            type: "integer",
+            const: 2,
+            description: versionDescription
+          },
+          statements: flatStatements
+        }
+      },
+      {
+        type: "object",
+        required: ["version", "statements"],
+        properties: {
+          version: {
+            type: "integer",
+            const: 3,
+            description: versionDescription
+          },
+          statements: statementTiers
+        }
+      },
+      {
+        type: "object",
+        required: ["version", "rules"],
+        properties: {
+          version: {
+            type: "integer",
+            const: 4,
+            description: versionDescription
+          },
+          rules: ruleTiers
+        }
+      },
+      {
+        type: "object",
+        required: ["version", "id", "defaultEffect", "statements"],
+        properties: {
+          version: {
+            type: "string",
+            const: RUBBERDUCK_POLICY_VERSION,
+            description: versionDescription
+          },
+          id: idProperty,
+          defaultEffect: defaultEffectProperty,
+          statements: flatStatements
+        }
+      }
+    ]
+  };
 }
 
 exports.ArrayOperatorSchema = ArrayOperatorSchema;
@@ -415,12 +549,14 @@ exports.PolicyIdSchema = PolicyIdSchema;
 exports.PolicySchema = PolicySchema;
 exports.RUBBERDUCK_POLICY_VERSION = RUBBERDUCK_POLICY_VERSION;
 exports.RangeValueSchema = RangeValueSchema;
+exports.RuleIdSchema = RuleIdSchema;
 exports.ScalarOperatorSchema = ScalarOperatorSchema;
 exports.SizeValueSchema = SizeValueSchema;
 exports.StatementIdSchema = StatementIdSchema;
 exports.StatementSchema = StatementSchema;
 exports.UrlOperatorSchema = UrlOperatorSchema;
 exports.V3_MAX_TIERS = V3_MAX_TIERS;
+exports.V4_MAX_TIERS = V4_MAX_TIERS;
 exports.VALID_EFFECTS = VALID_EFFECTS;
 exports.VALID_OPERATOR_LIST = VALID_OPERATOR_LIST;
 exports.VALID_VERSIONS = VALID_VERSIONS;