@zapier/policy-schema 0.18.0 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +145 -30
- package/dist/index.d.cts +370 -8
- package/dist/index.d.ts +370 -8
- package/dist/index.mjs +144 -31
- package/package.json +1 -1
package/dist/index.d.ts
CHANGED
|
@@ -3,14 +3,14 @@ import { z } from 'zod';
|
|
|
3
3
|
/** Release-candidate policy document version for the current experimental shape. */
|
|
4
4
|
declare const RUBBERDUCK_POLICY_VERSION: "rc-rubberduck";
|
|
5
5
|
/** Supported policy document versions. */
|
|
6
|
-
declare const VALID_VERSIONS: readonly [1, 2, 3, "rc-rubberduck"];
|
|
6
|
+
declare const VALID_VERSIONS: readonly [1, 2, 3, 4, "rc-rubberduck"];
|
|
7
7
|
/**
|
|
8
8
|
* Versions whose statements carry an id (s_/p_) and are therefore targeted by
|
|
9
9
|
* that id rather than canonical hash. Single source of truth shared with the
|
|
10
10
|
* engine's usesIds override-targeting predicate: "requires an id" and
|
|
11
11
|
* "targeted by id" coincide for every supported version.
|
|
12
12
|
*/
|
|
13
|
-
declare const ID_BASED_VERSIONS: Set<"rc-rubberduck" | 1 | 2 | 3>;
|
|
13
|
+
declare const ID_BASED_VERSIONS: Set<"rc-rubberduck" | 1 | 2 | 3 | 4>;
|
|
14
14
|
/** Valid policy effects. */
|
|
15
15
|
declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
|
|
16
16
|
/** Derived from VALID_EFFECTS — the constant is the single source of truth. */
|
|
@@ -359,6 +359,10 @@ type StatementId = z.infer<typeof StatementIdSchema>;
|
|
|
359
359
|
declare const PolicyIdSchema: z.ZodString;
|
|
360
360
|
/** Derived from PolicyIdSchema — the schema is the single source of truth. */
|
|
361
361
|
type PolicyId = z.infer<typeof PolicyIdSchema>;
|
|
362
|
+
/** Rule identifier for v4 policies. Must match ^r_\S+$ and be ≤512 chars. */
|
|
363
|
+
declare const RuleIdSchema: z.ZodString;
|
|
364
|
+
/** Derived from RuleIdSchema — the schema is the single source of truth. */
|
|
365
|
+
type RuleId = z.infer<typeof RuleIdSchema>;
|
|
362
366
|
/** Effect applied when no statement matches (rc-rubberduck, required). deny == implicit deny. */
|
|
363
367
|
declare const DefaultEffectSchema: z.ZodEnum<{
|
|
364
368
|
deny: "deny";
|
|
@@ -368,6 +372,8 @@ declare const DefaultEffectSchema: z.ZodEnum<{
|
|
|
368
372
|
type DefaultEffect = z.infer<typeof DefaultEffectSchema>;
|
|
369
373
|
/** Upper bound on v3 statement tiers. Raising this later is backwards-compatible. */
|
|
370
374
|
declare const V3_MAX_TIERS = 3;
|
|
375
|
+
/** Upper bound on v4 rule tiers. Separate from V3_MAX_TIERS so the two versions can diverge. */
|
|
376
|
+
declare const V4_MAX_TIERS = 3;
|
|
371
377
|
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
372
378
|
version: z.ZodLiteral<1>;
|
|
373
379
|
statements: z.ZodArray<z.ZodObject<{
|
|
@@ -790,6 +796,147 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
790
796
|
}, z.core.$strict>]>>;
|
|
791
797
|
}, z.core.$strict>]>>>;
|
|
792
798
|
}, z.core.$strict>>>;
|
|
799
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
800
|
+
version: z.ZodLiteral<4>;
|
|
801
|
+
rules: z.ZodArray<z.ZodArray<z.ZodObject<{
|
|
802
|
+
id: z.ZodString;
|
|
803
|
+
effect: z.ZodEnum<{
|
|
804
|
+
allow: "allow";
|
|
805
|
+
deny: "deny";
|
|
806
|
+
ask: "ask";
|
|
807
|
+
}>;
|
|
808
|
+
permissions: z.ZodArray<z.ZodString>;
|
|
809
|
+
resources: z.ZodArray<z.ZodString>;
|
|
810
|
+
conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
811
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
812
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
813
|
+
operator: z.ZodLiteral<"equals">;
|
|
814
|
+
value: z.ZodJSONSchema;
|
|
815
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
816
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
817
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
818
|
+
operator: z.ZodLiteral<"in">;
|
|
819
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
820
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
821
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
822
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
823
|
+
operator: z.ZodLiteral<"matches">;
|
|
824
|
+
value: z.ZodString;
|
|
825
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
826
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
827
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
828
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
829
|
+
value: z.ZodString;
|
|
830
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
831
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
832
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
833
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
834
|
+
value: z.ZodString;
|
|
835
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
836
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
837
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
838
|
+
operator: z.ZodLiteral<"range">;
|
|
839
|
+
value: z.ZodObject<{
|
|
840
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
841
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
842
|
+
}, z.core.$strict>;
|
|
843
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
844
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
845
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
846
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
847
|
+
value: z.ZodString;
|
|
848
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
849
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
850
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
851
|
+
operator: z.ZodLiteral<"values_in">;
|
|
852
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
853
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
854
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
855
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
856
|
+
operator: z.ZodLiteral<"exists">;
|
|
857
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
858
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
859
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
860
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
861
|
+
value: z.ZodArray<z.ZodString>;
|
|
862
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
863
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
864
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
865
|
+
operator: z.ZodLiteral<"size">;
|
|
866
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
867
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
868
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
869
|
+
}, z.core.$strict>]>;
|
|
870
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
871
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
872
|
+
operator: z.ZodEnum<{
|
|
873
|
+
some: "some";
|
|
874
|
+
all: "all";
|
|
875
|
+
none: "none";
|
|
876
|
+
}>;
|
|
877
|
+
where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
878
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
879
|
+
operator: z.ZodLiteral<"equals">;
|
|
880
|
+
value: z.ZodJSONSchema;
|
|
881
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
882
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
883
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
884
|
+
operator: z.ZodLiteral<"in">;
|
|
885
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
886
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
887
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
888
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
889
|
+
operator: z.ZodLiteral<"matches">;
|
|
890
|
+
value: z.ZodString;
|
|
891
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
892
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
893
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
894
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
895
|
+
value: z.ZodString;
|
|
896
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
897
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
898
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
899
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
900
|
+
value: z.ZodString;
|
|
901
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
902
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
903
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
904
|
+
operator: z.ZodLiteral<"range">;
|
|
905
|
+
value: z.ZodObject<{
|
|
906
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
907
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
908
|
+
}, z.core.$strict>;
|
|
909
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
910
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
911
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
912
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
913
|
+
value: z.ZodString;
|
|
914
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
915
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
916
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
917
|
+
operator: z.ZodLiteral<"values_in">;
|
|
918
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
919
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
920
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
921
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
922
|
+
operator: z.ZodLiteral<"exists">;
|
|
923
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
924
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
925
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
926
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
927
|
+
value: z.ZodArray<z.ZodString>;
|
|
928
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
929
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
930
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
931
|
+
operator: z.ZodLiteral<"size">;
|
|
932
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
933
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
934
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
935
|
+
}, z.core.$strict>]>;
|
|
936
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
937
|
+
}, z.core.$strict>]>>;
|
|
938
|
+
}, z.core.$strict>]>>>;
|
|
939
|
+
}, z.core.$strict>>>;
|
|
793
940
|
}, z.core.$strict>, z.ZodObject<{
|
|
794
941
|
version: z.ZodLiteral<"rc-rubberduck">;
|
|
795
942
|
id: z.ZodString;
|
|
@@ -943,15 +1090,17 @@ type Policy = z.infer<typeof PolicySchema>;
|
|
|
943
1090
|
declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
|
|
944
1091
|
/**
|
|
945
1092
|
* Runtime schema for the Override type. Each variant has exactly one target
|
|
946
|
-
* field (statementHash for v1/v2, statementId
|
|
1093
|
+
* field (statementHash for v1/v2, statementId for v3/rc-rubberduck, policyId for
|
|
1094
|
+
* rc-rubberduck, ruleId for v4) and exactly
|
|
947
1095
|
* one binding mode (match, contextHash, or conditionals). `.strict()` keeps
|
|
948
1096
|
* the variants mutually exclusive (an object carrying fields from two variants
|
|
949
1097
|
* fails all branches).
|
|
950
1098
|
*
|
|
951
1099
|
* Targets are all non-null:
|
|
952
1100
|
* - statementHash: targets a v1/v2 statement by canonical hash
|
|
953
|
-
* - statementId: targets
|
|
1101
|
+
* - statementId: targets a v3/rc-rubberduck statement by id
|
|
954
1102
|
* - policyId: targets that policy's default effect (rc-rubberduck only)
|
|
1103
|
+
* - ruleId: targets a v4 rule by id
|
|
955
1104
|
*
|
|
956
1105
|
* Empty conditionals is intentional (the "blank check"): the override applies
|
|
957
1106
|
* whenever the targeted ask statement fires, with no extra conditions. Do not
|
|
@@ -1386,6 +1535,149 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
1386
1535
|
id: z.ZodOptional<z.ZodString>;
|
|
1387
1536
|
policyId: z.ZodString;
|
|
1388
1537
|
effect: z.ZodLiteral<"allow">;
|
|
1538
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1539
|
+
match: z.ZodLiteral<"any">;
|
|
1540
|
+
id: z.ZodOptional<z.ZodString>;
|
|
1541
|
+
ruleId: z.ZodString;
|
|
1542
|
+
effect: z.ZodLiteral<"allow">;
|
|
1543
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1544
|
+
contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
|
|
1545
|
+
id: z.ZodOptional<z.ZodString>;
|
|
1546
|
+
ruleId: z.ZodString;
|
|
1547
|
+
effect: z.ZodLiteral<"allow">;
|
|
1548
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1549
|
+
conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
1550
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1551
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1552
|
+
operator: z.ZodLiteral<"equals">;
|
|
1553
|
+
value: z.ZodJSONSchema;
|
|
1554
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1555
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1556
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1557
|
+
operator: z.ZodLiteral<"in">;
|
|
1558
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
1559
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1560
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1561
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1562
|
+
operator: z.ZodLiteral<"matches">;
|
|
1563
|
+
value: z.ZodString;
|
|
1564
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1565
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1566
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1567
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
1568
|
+
value: z.ZodString;
|
|
1569
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1570
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1571
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1572
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
1573
|
+
value: z.ZodString;
|
|
1574
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1575
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1576
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1577
|
+
operator: z.ZodLiteral<"range">;
|
|
1578
|
+
value: z.ZodObject<{
|
|
1579
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
1580
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
1581
|
+
}, z.core.$strict>;
|
|
1582
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1583
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1584
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1585
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
1586
|
+
value: z.ZodString;
|
|
1587
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1588
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1589
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1590
|
+
operator: z.ZodLiteral<"values_in">;
|
|
1591
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
1592
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1593
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1594
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1595
|
+
operator: z.ZodLiteral<"exists">;
|
|
1596
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1597
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1598
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1599
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
1600
|
+
value: z.ZodArray<z.ZodString>;
|
|
1601
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1602
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1603
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1604
|
+
operator: z.ZodLiteral<"size">;
|
|
1605
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
1606
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
1607
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
1608
|
+
}, z.core.$strict>]>;
|
|
1609
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1610
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1611
|
+
operator: z.ZodEnum<{
|
|
1612
|
+
some: "some";
|
|
1613
|
+
all: "all";
|
|
1614
|
+
none: "none";
|
|
1615
|
+
}>;
|
|
1616
|
+
where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
1617
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1618
|
+
operator: z.ZodLiteral<"equals">;
|
|
1619
|
+
value: z.ZodJSONSchema;
|
|
1620
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1621
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1622
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1623
|
+
operator: z.ZodLiteral<"in">;
|
|
1624
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
1625
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1626
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1627
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1628
|
+
operator: z.ZodLiteral<"matches">;
|
|
1629
|
+
value: z.ZodString;
|
|
1630
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1631
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1632
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1633
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
1634
|
+
value: z.ZodString;
|
|
1635
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1636
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1637
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1638
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
1639
|
+
value: z.ZodString;
|
|
1640
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1641
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1642
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1643
|
+
operator: z.ZodLiteral<"range">;
|
|
1644
|
+
value: z.ZodObject<{
|
|
1645
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
1646
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
1647
|
+
}, z.core.$strict>;
|
|
1648
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1649
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1650
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1651
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
1652
|
+
value: z.ZodString;
|
|
1653
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1654
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1655
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1656
|
+
operator: z.ZodLiteral<"values_in">;
|
|
1657
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
1658
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1659
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1660
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1661
|
+
operator: z.ZodLiteral<"exists">;
|
|
1662
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1663
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1664
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1665
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
1666
|
+
value: z.ZodArray<z.ZodString>;
|
|
1667
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1668
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
1669
|
+
negate: z.ZodOptional<z.ZodBoolean>;
|
|
1670
|
+
operator: z.ZodLiteral<"size">;
|
|
1671
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
1672
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
1673
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
1674
|
+
}, z.core.$strict>]>;
|
|
1675
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
1676
|
+
}, z.core.$strict>]>>;
|
|
1677
|
+
}, z.core.$strict>]>>;
|
|
1678
|
+
id: z.ZodOptional<z.ZodString>;
|
|
1679
|
+
ruleId: z.ZodString;
|
|
1680
|
+
effect: z.ZodLiteral<"allow">;
|
|
1389
1681
|
}, z.core.$strict>]>;
|
|
1390
1682
|
/** Derived from OverrideSchema — the schema is the single source of truth. */
|
|
1391
1683
|
type Override = z.infer<typeof OverrideSchema>;
|
|
@@ -1401,10 +1693,10 @@ type JsonValue = string | number | boolean | null | JsonValue[] | {
|
|
|
1401
1693
|
[key: string]: JsonValue;
|
|
1402
1694
|
};
|
|
1403
1695
|
type ConditionValue = JsonValue | RangeValue | SizeValue;
|
|
1404
|
-
|
|
1696
|
+
/** One permission/resource pair checked against the shared request context. */
|
|
1697
|
+
interface PolicyCheck {
|
|
1405
1698
|
permission: string;
|
|
1406
1699
|
resource: string;
|
|
1407
|
-
context?: Record<string, unknown>;
|
|
1408
1700
|
}
|
|
1409
1701
|
/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
|
|
1410
1702
|
type CanonicalHash = string & {
|
|
@@ -1432,9 +1724,29 @@ interface StatementTrace {
|
|
|
1432
1724
|
passed: boolean;
|
|
1433
1725
|
overrides?: OverrideTrace[];
|
|
1434
1726
|
}
|
|
1727
|
+
/**
|
|
1728
|
+
* v4 rule trace. Identical to StatementTrace but the matched object is keyed
|
|
1729
|
+
* `rule` instead of `statement`, matching the v4 `statements`->`rules` rename.
|
|
1730
|
+
*/
|
|
1731
|
+
interface RuleTrace {
|
|
1732
|
+
rule: Statement;
|
|
1733
|
+
permissionMatched: boolean;
|
|
1734
|
+
resourceMatched: boolean;
|
|
1735
|
+
conditionResults?: ConditionTrace[];
|
|
1736
|
+
passed: boolean;
|
|
1737
|
+
overrides?: OverrideTrace[];
|
|
1738
|
+
}
|
|
1739
|
+
/**
|
|
1740
|
+
* One request, one context, one or more checks. `requestContext` describes the
|
|
1741
|
+
* whole request and is shared by every check; it is required and must be
|
|
1742
|
+
* non-empty — an empty context has no binding to a real request, and an
|
|
1743
|
+
* approval token for it could be replayed against anything. A single check
|
|
1744
|
+
* is a one-element `checks` array.
|
|
1745
|
+
*/
|
|
1435
1746
|
interface EvaluatePolicyOptions {
|
|
1436
1747
|
policy: Policy;
|
|
1437
|
-
|
|
1748
|
+
requestContext: Record<string, unknown>;
|
|
1749
|
+
checks: PolicyCheck[];
|
|
1438
1750
|
overrides?: Override[];
|
|
1439
1751
|
trace?: boolean;
|
|
1440
1752
|
}
|
|
@@ -1443,10 +1755,59 @@ interface PolicyResult {
|
|
|
1443
1755
|
effect: Effect;
|
|
1444
1756
|
explicit: boolean;
|
|
1445
1757
|
reason: PolicyReason;
|
|
1758
|
+
/**
|
|
1759
|
+
* Ids of passed, non-overridden ask statements, in statement order. Empty
|
|
1760
|
+
* unless `effect === "ask"`; always empty for v1/v2 (no statement ids) and
|
|
1761
|
+
* for an ask that came from the policy's ask defaultEffect.
|
|
1762
|
+
*/
|
|
1763
|
+
askRuleIds: string[];
|
|
1446
1764
|
statements: StatementTrace[];
|
|
1447
1765
|
/** Trace mode only. Present when no statement matched and an ask default was consulted (never attached for deny defaults). */
|
|
1448
1766
|
default?: DefaultTrace;
|
|
1449
1767
|
}
|
|
1768
|
+
/**
|
|
1769
|
+
* Result of evaluating a v4 policy. Version-gated shape: the trace array is
|
|
1770
|
+
* keyed `rules` (of RuleTrace) instead of `statements`, matching the v4
|
|
1771
|
+
* `statements`->`rules` rename. Only ever returned for a v4 policy; all other
|
|
1772
|
+
* versions return {@link PolicyResult}. v4 has no ask default (no
|
|
1773
|
+
* defaultEffect), so there is no `default` field.
|
|
1774
|
+
*/
|
|
1775
|
+
interface PolicyResultV4 {
|
|
1776
|
+
effect: Effect;
|
|
1777
|
+
explicit: boolean;
|
|
1778
|
+
reason: PolicyReason;
|
|
1779
|
+
/** Ids of passed, non-overridden ask rules. Empty unless `effect === "ask"`. */
|
|
1780
|
+
askRuleIds: string[];
|
|
1781
|
+
rules: RuleTrace[];
|
|
1782
|
+
}
|
|
1783
|
+
/**
|
|
1784
|
+
* Result of `evaluatePolicy`: the combined decision plus one per-check result.
|
|
1785
|
+
* Every check is always evaluated, so on successful return `results` always
|
|
1786
|
+
* has one entry per input check, in `checks` order (`results[i]` corresponds
|
|
1787
|
+
* to `checks[i]`). A call can still throw for an invalid override (e.g. one
|
|
1788
|
+
* targeting a deny statement or default) even when an earlier check already
|
|
1789
|
+
* decided the call denies -- that override was invalid regardless of check
|
|
1790
|
+
* order; evaluating every check is what surfaces it.
|
|
1791
|
+
*
|
|
1792
|
+
* - Deny on any check wins the combined effect (a deny cannot be approved
|
|
1793
|
+
* around), and `askRuleIds` is empty -- but `results` still reports every
|
|
1794
|
+
* check that was evaluated.
|
|
1795
|
+
* - `askRuleIds` is the union of every asking check's non-overridden ask
|
|
1796
|
+
* statement/rule ids, deduplicated, first-appearance order. Empty
|
|
1797
|
+
* unless `effect === "ask"`.
|
|
1798
|
+
*
|
|
1799
|
+
* No combined `explicit`/`reason`: with multiple checks, which check's
|
|
1800
|
+
* explicit/reason "wins" is an artifact of check order rather than a
|
|
1801
|
+
* meaningful signal (e.g. an implicit deny on check[0] and an explicit deny
|
|
1802
|
+
* on check[1] would report differently depending on which check ran first,
|
|
1803
|
+
* even though the combined effect is deny either way). A caller that needs
|
|
1804
|
+
* explicit/reason must read the per-check `results` (ENT-2614 review).
|
|
1805
|
+
*/
|
|
1806
|
+
interface EvaluatePolicyResult<R extends PolicyResult | PolicyResultV4 = PolicyResult | PolicyResultV4> {
|
|
1807
|
+
effect: Effect;
|
|
1808
|
+
askRuleIds: string[];
|
|
1809
|
+
results: R[];
|
|
1810
|
+
}
|
|
1450
1811
|
interface ParsedUrl {
|
|
1451
1812
|
scheme: string;
|
|
1452
1813
|
host: string;
|
|
@@ -1476,10 +1837,11 @@ interface OpenApiSchema {
|
|
|
1476
1837
|
properties?: Record<string, OpenApiSchema>;
|
|
1477
1838
|
items?: OpenApiSchema;
|
|
1478
1839
|
enum?: (string | number)[];
|
|
1840
|
+
const?: string | number;
|
|
1479
1841
|
description?: string;
|
|
1480
1842
|
minItems?: number;
|
|
1481
1843
|
oneOf?: OpenApiSchema[];
|
|
1482
1844
|
anyOf?: OpenApiSchema[];
|
|
1483
1845
|
}
|
|
1484
1846
|
|
|
1485
|
-
export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, ID_BASED_VERSIONS, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type
|
|
1847
|
+
export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, type EvaluatePolicyResult, ID_BASED_VERSIONS, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyCheck, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyResult, type PolicyResultV4, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type RuleId, RuleIdSchema, type RuleTrace, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, V3_MAX_TIERS, V4_MAX_TIERS, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|