@zapier/policy-schema 0.5.0 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.cjs CHANGED
@@ -3,6 +3,21 @@
3
3
  var zod = require('zod');
4
4
 
5
5
  // src/schema.ts
6
+ var VALID_VERSIONS = [1, 2];
7
+ var VALID_EFFECTS = ["allow", "ask", "deny"];
8
+ var VALID_OPERATOR_LIST = [
9
+ "equals",
10
+ "exists",
11
+ "in",
12
+ "keys_in",
13
+ "matches",
14
+ "matches_host",
15
+ "matches_path",
16
+ "matches_url",
17
+ "range",
18
+ "size",
19
+ "values_in"
20
+ ];
6
21
  var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
7
22
  var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
8
23
  var JsonValueSchema = zod.z.lazy(
@@ -125,16 +140,94 @@ var OperatorSchema = zod.z.enum([
125
140
  "size"
126
141
  ]);
127
142
  var ConditionValueSchema = JsonValueSchema;
128
- var StatementSchema = zod.z.object({
143
+ var V1StatementSchema = zod.z.object({
129
144
  effect: zod.z.enum(["allow", "deny"]),
130
145
  permissions: zod.z.array(zod.z.string()).min(1),
131
146
  resources: zod.z.array(zod.z.string()).min(1),
132
147
  conditions: zod.z.array(ConditionSchema).optional()
133
148
  }).strict();
134
- var PolicySchema = zod.z.object({
149
+ var V2StatementSchema = zod.z.object({
150
+ effect: zod.z.enum(["allow", "ask", "deny"]),
151
+ permissions: zod.z.array(zod.z.string()).min(1),
152
+ resources: zod.z.array(zod.z.string()).min(1),
153
+ conditions: zod.z.array(ConditionSchema).optional()
154
+ }).strict();
155
+ var StatementSchema = V2StatementSchema;
156
+ var V1PolicySchema = zod.z.object({
135
157
  version: zod.z.literal(1),
136
- statements: zod.z.array(StatementSchema)
158
+ statements: zod.z.array(V1StatementSchema)
159
+ }).strict();
160
+ var V2PolicySchema = zod.z.object({
161
+ version: zod.z.literal(2),
162
+ statements: zod.z.array(V2StatementSchema)
137
163
  }).strict();
164
+ var PolicySchema = zod.z.union([V1PolicySchema, V2PolicySchema]);
165
+ function getOpenApiSchema() {
166
+ return {
167
+ type: "object",
168
+ required: ["version", "statements"],
169
+ properties: {
170
+ version: {
171
+ type: "integer",
172
+ enum: [...VALID_VERSIONS],
173
+ description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
174
+ },
175
+ statements: {
176
+ type: "array",
177
+ description: "List of policy statements defining permissions.",
178
+ items: {
179
+ type: "object",
180
+ required: ["effect", "permissions", "resources"],
181
+ properties: {
182
+ effect: {
183
+ type: "string",
184
+ enum: [...VALID_EFFECTS].sort(),
185
+ description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
186
+ },
187
+ permissions: {
188
+ type: "array",
189
+ minItems: 1,
190
+ items: { type: "string" },
191
+ description: "List of permission identifiers."
192
+ },
193
+ resources: {
194
+ type: "array",
195
+ minItems: 1,
196
+ items: { type: "string" },
197
+ description: "List of resource identifiers the statement applies to."
198
+ },
199
+ conditions: {
200
+ type: "array",
201
+ description: "Optional conditions that must be met for the statement to apply.",
202
+ items: {
203
+ type: "object",
204
+ required: ["path", "operator"],
205
+ properties: {
206
+ path: {
207
+ type: "array",
208
+ minItems: 1,
209
+ description: "Path to the value to evaluate in the request context.",
210
+ items: {
211
+ oneOf: [{ type: "string" }, { type: "integer" }]
212
+ }
213
+ },
214
+ operator: {
215
+ type: "string",
216
+ enum: [...VALID_OPERATOR_LIST],
217
+ description: "Comparison operator used to evaluate the condition."
218
+ },
219
+ value: {
220
+ description: "Value to compare against using the operator."
221
+ }
222
+ }
223
+ }
224
+ }
225
+ }
226
+ }
227
+ }
228
+ }
229
+ };
230
+ }
138
231
 
139
232
  exports.ArrayOperatorSchema = ArrayOperatorSchema;
140
233
  exports.ConditionSchema = ConditionSchema;
@@ -147,3 +240,7 @@ exports.ScalarOperatorSchema = ScalarOperatorSchema;
147
240
  exports.SizeValueSchema = SizeValueSchema;
148
241
  exports.StatementSchema = StatementSchema;
149
242
  exports.UrlOperatorSchema = UrlOperatorSchema;
243
+ exports.VALID_EFFECTS = VALID_EFFECTS;
244
+ exports.VALID_OPERATOR_LIST = VALID_OPERATOR_LIST;
245
+ exports.VALID_VERSIONS = VALID_VERSIONS;
246
+ exports.getOpenApiSchema = getOpenApiSchema;
package/dist/index.d.cts CHANGED
@@ -19,7 +19,7 @@ interface Condition {
19
19
  operator: Operator;
20
20
  value?: ConditionValue;
21
21
  }
22
- type Effect = "allow" | "deny";
22
+ type Effect = "allow" | "ask" | "deny";
23
23
  interface Statement {
24
24
  effect: Effect;
25
25
  permissions: string[];
@@ -27,7 +27,7 @@ interface Statement {
27
27
  conditions?: Condition[];
28
28
  }
29
29
  interface Policy {
30
- version: 1;
30
+ version: 1 | 2;
31
31
  statements: Statement[];
32
32
  }
33
33
  interface PolicyRequest {
@@ -36,7 +36,7 @@ interface PolicyRequest {
36
36
  context?: Record<string, unknown>;
37
37
  }
38
38
  interface PolicyResult {
39
- allowed: boolean;
39
+ effect: Effect;
40
40
  matchedStatement?: Statement;
41
41
  }
42
42
  interface ParsedUrl {
@@ -53,7 +53,24 @@ interface PolicyHttpRequest {
53
53
  body: string | null;
54
54
  body_json: unknown;
55
55
  }
56
+ /** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
57
+ interface OpenApiSchema {
58
+ type?: string;
59
+ required?: string[];
60
+ properties?: Record<string, OpenApiSchema>;
61
+ items?: OpenApiSchema;
62
+ enum?: (string | number)[];
63
+ description?: string;
64
+ minItems?: number;
65
+ oneOf?: OpenApiSchema[];
66
+ }
56
67
 
68
+ /** Current policy document version. */
69
+ declare const VALID_VERSIONS: readonly [1, 2];
70
+ /** Valid policy effects. */
71
+ declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
72
+ /** Valid condition operators. */
73
+ declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
57
74
  declare const RangeValueSchema: z.ZodObject<{
58
75
  min: z.ZodOptional<z.ZodNumber>;
59
76
  max: z.ZodOptional<z.ZodNumber>;
@@ -145,9 +162,11 @@ declare const OperatorSchema: z.ZodEnum<{
145
162
  matches_url: "matches_url";
146
163
  }>;
147
164
  declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
165
+ /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
148
166
  declare const StatementSchema: z.ZodObject<{
149
167
  effect: z.ZodEnum<{
150
168
  allow: "allow";
169
+ ask: "ask";
151
170
  deny: "deny";
152
171
  }>;
153
172
  permissions: z.ZodArray<z.ZodString>;
@@ -203,7 +222,7 @@ declare const StatementSchema: z.ZodObject<{
203
222
  }, z.core.$strict>]>;
204
223
  }, z.core.$strict>]>>>;
205
224
  }, z.core.$strict>;
206
- declare const PolicySchema: z.ZodObject<{
225
+ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
207
226
  version: z.ZodLiteral<1>;
208
227
  statements: z.ZodArray<z.ZodObject<{
209
228
  effect: z.ZodEnum<{
@@ -263,6 +282,74 @@ declare const PolicySchema: z.ZodObject<{
263
282
  }, z.core.$strict>]>;
264
283
  }, z.core.$strict>]>>>;
265
284
  }, z.core.$strict>>;
266
- }, z.core.$strict>;
285
+ }, z.core.$strict>, z.ZodObject<{
286
+ version: z.ZodLiteral<2>;
287
+ statements: z.ZodArray<z.ZodObject<{
288
+ effect: z.ZodEnum<{
289
+ allow: "allow";
290
+ ask: "ask";
291
+ deny: "deny";
292
+ }>;
293
+ permissions: z.ZodArray<z.ZodString>;
294
+ resources: z.ZodArray<z.ZodString>;
295
+ conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
296
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
297
+ operator: z.ZodLiteral<"equals">;
298
+ value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
299
+ }, z.core.$strict>, z.ZodObject<{
300
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
301
+ operator: z.ZodLiteral<"in">;
302
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
303
+ }, z.core.$strict>, z.ZodObject<{
304
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
305
+ operator: z.ZodLiteral<"matches">;
306
+ value: z.ZodString;
307
+ }, z.core.$strict>, z.ZodObject<{
308
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
309
+ operator: z.ZodLiteral<"matches_host">;
310
+ value: z.ZodString;
311
+ }, z.core.$strict>, z.ZodObject<{
312
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
313
+ operator: z.ZodLiteral<"matches_path">;
314
+ value: z.ZodString;
315
+ }, z.core.$strict>, z.ZodObject<{
316
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
317
+ operator: z.ZodLiteral<"range">;
318
+ value: z.ZodObject<{
319
+ min: z.ZodOptional<z.ZodNumber>;
320
+ max: z.ZodOptional<z.ZodNumber>;
321
+ }, z.core.$strict>;
322
+ }, z.core.$strict>, z.ZodObject<{
323
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
324
+ operator: z.ZodLiteral<"matches_url">;
325
+ value: z.ZodString;
326
+ }, z.core.$strict>, z.ZodObject<{
327
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
328
+ operator: z.ZodLiteral<"values_in">;
329
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
330
+ }, z.core.$strict>, z.ZodObject<{
331
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
332
+ operator: z.ZodLiteral<"exists">;
333
+ }, z.core.$strict>, z.ZodObject<{
334
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
335
+ operator: z.ZodLiteral<"keys_in">;
336
+ value: z.ZodArray<z.ZodString>;
337
+ }, z.core.$strict>, z.ZodObject<{
338
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
339
+ operator: z.ZodLiteral<"size">;
340
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
341
+ min: z.ZodOptional<z.ZodNumber>;
342
+ max: z.ZodOptional<z.ZodNumber>;
343
+ }, z.core.$strict>]>;
344
+ }, z.core.$strict>]>>>;
345
+ }, z.core.$strict>>;
346
+ }, z.core.$strict>]>;
347
+ /**
348
+ * Returns an OpenAPI-compatible JSON Schema object for a policy document.
349
+ *
350
+ * Derived from the same constants used by the Zod schemas so the
351
+ * documentation schema and runtime validation always stay in sync.
352
+ */
353
+ declare function getOpenApiSchema(): OpenApiSchema;
267
354
 
268
- export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
355
+ export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
package/dist/index.d.ts CHANGED
@@ -19,7 +19,7 @@ interface Condition {
19
19
  operator: Operator;
20
20
  value?: ConditionValue;
21
21
  }
22
- type Effect = "allow" | "deny";
22
+ type Effect = "allow" | "ask" | "deny";
23
23
  interface Statement {
24
24
  effect: Effect;
25
25
  permissions: string[];
@@ -27,7 +27,7 @@ interface Statement {
27
27
  conditions?: Condition[];
28
28
  }
29
29
  interface Policy {
30
- version: 1;
30
+ version: 1 | 2;
31
31
  statements: Statement[];
32
32
  }
33
33
  interface PolicyRequest {
@@ -36,7 +36,7 @@ interface PolicyRequest {
36
36
  context?: Record<string, unknown>;
37
37
  }
38
38
  interface PolicyResult {
39
- allowed: boolean;
39
+ effect: Effect;
40
40
  matchedStatement?: Statement;
41
41
  }
42
42
  interface ParsedUrl {
@@ -53,7 +53,24 @@ interface PolicyHttpRequest {
53
53
  body: string | null;
54
54
  body_json: unknown;
55
55
  }
56
+ /** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
57
+ interface OpenApiSchema {
58
+ type?: string;
59
+ required?: string[];
60
+ properties?: Record<string, OpenApiSchema>;
61
+ items?: OpenApiSchema;
62
+ enum?: (string | number)[];
63
+ description?: string;
64
+ minItems?: number;
65
+ oneOf?: OpenApiSchema[];
66
+ }
56
67
 
68
+ /** Current policy document version. */
69
+ declare const VALID_VERSIONS: readonly [1, 2];
70
+ /** Valid policy effects. */
71
+ declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
72
+ /** Valid condition operators. */
73
+ declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
57
74
  declare const RangeValueSchema: z.ZodObject<{
58
75
  min: z.ZodOptional<z.ZodNumber>;
59
76
  max: z.ZodOptional<z.ZodNumber>;
@@ -145,9 +162,11 @@ declare const OperatorSchema: z.ZodEnum<{
145
162
  matches_url: "matches_url";
146
163
  }>;
147
164
  declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
165
+ /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
148
166
  declare const StatementSchema: z.ZodObject<{
149
167
  effect: z.ZodEnum<{
150
168
  allow: "allow";
169
+ ask: "ask";
151
170
  deny: "deny";
152
171
  }>;
153
172
  permissions: z.ZodArray<z.ZodString>;
@@ -203,7 +222,7 @@ declare const StatementSchema: z.ZodObject<{
203
222
  }, z.core.$strict>]>;
204
223
  }, z.core.$strict>]>>>;
205
224
  }, z.core.$strict>;
206
- declare const PolicySchema: z.ZodObject<{
225
+ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
207
226
  version: z.ZodLiteral<1>;
208
227
  statements: z.ZodArray<z.ZodObject<{
209
228
  effect: z.ZodEnum<{
@@ -263,6 +282,74 @@ declare const PolicySchema: z.ZodObject<{
263
282
  }, z.core.$strict>]>;
264
283
  }, z.core.$strict>]>>>;
265
284
  }, z.core.$strict>>;
266
- }, z.core.$strict>;
285
+ }, z.core.$strict>, z.ZodObject<{
286
+ version: z.ZodLiteral<2>;
287
+ statements: z.ZodArray<z.ZodObject<{
288
+ effect: z.ZodEnum<{
289
+ allow: "allow";
290
+ ask: "ask";
291
+ deny: "deny";
292
+ }>;
293
+ permissions: z.ZodArray<z.ZodString>;
294
+ resources: z.ZodArray<z.ZodString>;
295
+ conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
296
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
297
+ operator: z.ZodLiteral<"equals">;
298
+ value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
299
+ }, z.core.$strict>, z.ZodObject<{
300
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
301
+ operator: z.ZodLiteral<"in">;
302
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
303
+ }, z.core.$strict>, z.ZodObject<{
304
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
305
+ operator: z.ZodLiteral<"matches">;
306
+ value: z.ZodString;
307
+ }, z.core.$strict>, z.ZodObject<{
308
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
309
+ operator: z.ZodLiteral<"matches_host">;
310
+ value: z.ZodString;
311
+ }, z.core.$strict>, z.ZodObject<{
312
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
313
+ operator: z.ZodLiteral<"matches_path">;
314
+ value: z.ZodString;
315
+ }, z.core.$strict>, z.ZodObject<{
316
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
317
+ operator: z.ZodLiteral<"range">;
318
+ value: z.ZodObject<{
319
+ min: z.ZodOptional<z.ZodNumber>;
320
+ max: z.ZodOptional<z.ZodNumber>;
321
+ }, z.core.$strict>;
322
+ }, z.core.$strict>, z.ZodObject<{
323
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
324
+ operator: z.ZodLiteral<"matches_url">;
325
+ value: z.ZodString;
326
+ }, z.core.$strict>, z.ZodObject<{
327
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
328
+ operator: z.ZodLiteral<"values_in">;
329
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
330
+ }, z.core.$strict>, z.ZodObject<{
331
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
332
+ operator: z.ZodLiteral<"exists">;
333
+ }, z.core.$strict>, z.ZodObject<{
334
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
335
+ operator: z.ZodLiteral<"keys_in">;
336
+ value: z.ZodArray<z.ZodString>;
337
+ }, z.core.$strict>, z.ZodObject<{
338
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
339
+ operator: z.ZodLiteral<"size">;
340
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
341
+ min: z.ZodOptional<z.ZodNumber>;
342
+ max: z.ZodOptional<z.ZodNumber>;
343
+ }, z.core.$strict>]>;
344
+ }, z.core.$strict>]>>>;
345
+ }, z.core.$strict>>;
346
+ }, z.core.$strict>]>;
347
+ /**
348
+ * Returns an OpenAPI-compatible JSON Schema object for a policy document.
349
+ *
350
+ * Derived from the same constants used by the Zod schemas so the
351
+ * documentation schema and runtime validation always stay in sync.
352
+ */
353
+ declare function getOpenApiSchema(): OpenApiSchema;
267
354
 
268
- export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
355
+ export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
package/dist/index.mjs CHANGED
@@ -1,6 +1,21 @@
1
1
  import { z } from 'zod';
2
2
 
3
3
  // src/schema.ts
4
+ var VALID_VERSIONS = [1, 2];
5
+ var VALID_EFFECTS = ["allow", "ask", "deny"];
6
+ var VALID_OPERATOR_LIST = [
7
+ "equals",
8
+ "exists",
9
+ "in",
10
+ "keys_in",
11
+ "matches",
12
+ "matches_host",
13
+ "matches_path",
14
+ "matches_url",
15
+ "range",
16
+ "size",
17
+ "values_in"
18
+ ];
4
19
  var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
5
20
  var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
6
21
  var JsonValueSchema = z.lazy(
@@ -123,15 +138,93 @@ var OperatorSchema = z.enum([
123
138
  "size"
124
139
  ]);
125
140
  var ConditionValueSchema = JsonValueSchema;
126
- var StatementSchema = z.object({
141
+ var V1StatementSchema = z.object({
127
142
  effect: z.enum(["allow", "deny"]),
128
143
  permissions: z.array(z.string()).min(1),
129
144
  resources: z.array(z.string()).min(1),
130
145
  conditions: z.array(ConditionSchema).optional()
131
146
  }).strict();
132
- var PolicySchema = z.object({
147
+ var V2StatementSchema = z.object({
148
+ effect: z.enum(["allow", "ask", "deny"]),
149
+ permissions: z.array(z.string()).min(1),
150
+ resources: z.array(z.string()).min(1),
151
+ conditions: z.array(ConditionSchema).optional()
152
+ }).strict();
153
+ var StatementSchema = V2StatementSchema;
154
+ var V1PolicySchema = z.object({
133
155
  version: z.literal(1),
134
- statements: z.array(StatementSchema)
156
+ statements: z.array(V1StatementSchema)
157
+ }).strict();
158
+ var V2PolicySchema = z.object({
159
+ version: z.literal(2),
160
+ statements: z.array(V2StatementSchema)
135
161
  }).strict();
162
+ var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
163
+ function getOpenApiSchema() {
164
+ return {
165
+ type: "object",
166
+ required: ["version", "statements"],
167
+ properties: {
168
+ version: {
169
+ type: "integer",
170
+ enum: [...VALID_VERSIONS],
171
+ description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
172
+ },
173
+ statements: {
174
+ type: "array",
175
+ description: "List of policy statements defining permissions.",
176
+ items: {
177
+ type: "object",
178
+ required: ["effect", "permissions", "resources"],
179
+ properties: {
180
+ effect: {
181
+ type: "string",
182
+ enum: [...VALID_EFFECTS].sort(),
183
+ description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
184
+ },
185
+ permissions: {
186
+ type: "array",
187
+ minItems: 1,
188
+ items: { type: "string" },
189
+ description: "List of permission identifiers."
190
+ },
191
+ resources: {
192
+ type: "array",
193
+ minItems: 1,
194
+ items: { type: "string" },
195
+ description: "List of resource identifiers the statement applies to."
196
+ },
197
+ conditions: {
198
+ type: "array",
199
+ description: "Optional conditions that must be met for the statement to apply.",
200
+ items: {
201
+ type: "object",
202
+ required: ["path", "operator"],
203
+ properties: {
204
+ path: {
205
+ type: "array",
206
+ minItems: 1,
207
+ description: "Path to the value to evaluate in the request context.",
208
+ items: {
209
+ oneOf: [{ type: "string" }, { type: "integer" }]
210
+ }
211
+ },
212
+ operator: {
213
+ type: "string",
214
+ enum: [...VALID_OPERATOR_LIST],
215
+ description: "Comparison operator used to evaluate the condition."
216
+ },
217
+ value: {
218
+ description: "Value to compare against using the operator."
219
+ }
220
+ }
221
+ }
222
+ }
223
+ }
224
+ }
225
+ }
226
+ }
227
+ };
228
+ }
136
229
 
137
- export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema };
230
+ export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@zapier/policy-schema",
3
- "version": "0.5.0",
3
+ "version": "0.7.1",
4
4
  "description": "Zod schemas and TypeScript types for the Zapier policy engine",
5
5
  "type": "module",
6
6
  "main": "dist/index.cjs",
@@ -22,6 +22,11 @@
22
22
  "dist",
23
23
  "README.md"
24
24
  ],
25
+ "repository": {
26
+ "type": "git",
27
+ "url": "https://gitlab.com/zapier/team-identity-platform/policy.git",
28
+ "directory": "typescript/schema"
29
+ },
25
30
  "publishConfig": {
26
31
  "access": "public"
27
32
  },