@zapier/policy-schema 0.5.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +100 -3
- package/dist/index.d.cts +93 -6
- package/dist/index.d.ts +93 -6
- package/dist/index.mjs +97 -4
- package/package.json +6 -1
package/dist/index.cjs
CHANGED
|
@@ -3,6 +3,21 @@
|
|
|
3
3
|
var zod = require('zod');
|
|
4
4
|
|
|
5
5
|
// src/schema.ts
|
|
6
|
+
var VALID_VERSIONS = [1, 2];
|
|
7
|
+
var VALID_EFFECTS = ["allow", "ask", "deny"];
|
|
8
|
+
var VALID_OPERATOR_LIST = [
|
|
9
|
+
"equals",
|
|
10
|
+
"exists",
|
|
11
|
+
"in",
|
|
12
|
+
"keys_in",
|
|
13
|
+
"matches",
|
|
14
|
+
"matches_host",
|
|
15
|
+
"matches_path",
|
|
16
|
+
"matches_url",
|
|
17
|
+
"range",
|
|
18
|
+
"size",
|
|
19
|
+
"values_in"
|
|
20
|
+
];
|
|
6
21
|
var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
|
|
7
22
|
var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
|
|
8
23
|
var JsonValueSchema = zod.z.lazy(
|
|
@@ -125,16 +140,94 @@ var OperatorSchema = zod.z.enum([
|
|
|
125
140
|
"size"
|
|
126
141
|
]);
|
|
127
142
|
var ConditionValueSchema = JsonValueSchema;
|
|
128
|
-
var
|
|
143
|
+
var V1StatementSchema = zod.z.object({
|
|
129
144
|
effect: zod.z.enum(["allow", "deny"]),
|
|
130
145
|
permissions: zod.z.array(zod.z.string()).min(1),
|
|
131
146
|
resources: zod.z.array(zod.z.string()).min(1),
|
|
132
147
|
conditions: zod.z.array(ConditionSchema).optional()
|
|
133
148
|
}).strict();
|
|
134
|
-
var
|
|
149
|
+
var V2StatementSchema = zod.z.object({
|
|
150
|
+
effect: zod.z.enum(["allow", "ask", "deny"]),
|
|
151
|
+
permissions: zod.z.array(zod.z.string()).min(1),
|
|
152
|
+
resources: zod.z.array(zod.z.string()).min(1),
|
|
153
|
+
conditions: zod.z.array(ConditionSchema).optional()
|
|
154
|
+
}).strict();
|
|
155
|
+
var StatementSchema = V2StatementSchema;
|
|
156
|
+
var V1PolicySchema = zod.z.object({
|
|
135
157
|
version: zod.z.literal(1),
|
|
136
|
-
statements: zod.z.array(
|
|
158
|
+
statements: zod.z.array(V1StatementSchema)
|
|
159
|
+
}).strict();
|
|
160
|
+
var V2PolicySchema = zod.z.object({
|
|
161
|
+
version: zod.z.literal(2),
|
|
162
|
+
statements: zod.z.array(V2StatementSchema)
|
|
137
163
|
}).strict();
|
|
164
|
+
var PolicySchema = zod.z.union([V1PolicySchema, V2PolicySchema]);
|
|
165
|
+
function getOpenApiSchema() {
|
|
166
|
+
return {
|
|
167
|
+
type: "object",
|
|
168
|
+
required: ["version", "statements"],
|
|
169
|
+
properties: {
|
|
170
|
+
version: {
|
|
171
|
+
type: "integer",
|
|
172
|
+
enum: [...VALID_VERSIONS],
|
|
173
|
+
description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
|
|
174
|
+
},
|
|
175
|
+
statements: {
|
|
176
|
+
type: "array",
|
|
177
|
+
description: "List of policy statements defining permissions.",
|
|
178
|
+
items: {
|
|
179
|
+
type: "object",
|
|
180
|
+
required: ["effect", "permissions", "resources"],
|
|
181
|
+
properties: {
|
|
182
|
+
effect: {
|
|
183
|
+
type: "string",
|
|
184
|
+
enum: [...VALID_EFFECTS].sort(),
|
|
185
|
+
description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
|
|
186
|
+
},
|
|
187
|
+
permissions: {
|
|
188
|
+
type: "array",
|
|
189
|
+
minItems: 1,
|
|
190
|
+
items: { type: "string" },
|
|
191
|
+
description: "List of permission identifiers."
|
|
192
|
+
},
|
|
193
|
+
resources: {
|
|
194
|
+
type: "array",
|
|
195
|
+
minItems: 1,
|
|
196
|
+
items: { type: "string" },
|
|
197
|
+
description: "List of resource identifiers the statement applies to."
|
|
198
|
+
},
|
|
199
|
+
conditions: {
|
|
200
|
+
type: "array",
|
|
201
|
+
description: "Optional conditions that must be met for the statement to apply.",
|
|
202
|
+
items: {
|
|
203
|
+
type: "object",
|
|
204
|
+
required: ["path", "operator"],
|
|
205
|
+
properties: {
|
|
206
|
+
path: {
|
|
207
|
+
type: "array",
|
|
208
|
+
minItems: 1,
|
|
209
|
+
description: "Path to the value to evaluate in the request context.",
|
|
210
|
+
items: {
|
|
211
|
+
oneOf: [{ type: "string" }, { type: "integer" }]
|
|
212
|
+
}
|
|
213
|
+
},
|
|
214
|
+
operator: {
|
|
215
|
+
type: "string",
|
|
216
|
+
enum: [...VALID_OPERATOR_LIST],
|
|
217
|
+
description: "Comparison operator used to evaluate the condition."
|
|
218
|
+
},
|
|
219
|
+
value: {
|
|
220
|
+
description: "Value to compare against using the operator."
|
|
221
|
+
}
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
}
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
};
|
|
230
|
+
}
|
|
138
231
|
|
|
139
232
|
exports.ArrayOperatorSchema = ArrayOperatorSchema;
|
|
140
233
|
exports.ConditionSchema = ConditionSchema;
|
|
@@ -147,3 +240,7 @@ exports.ScalarOperatorSchema = ScalarOperatorSchema;
|
|
|
147
240
|
exports.SizeValueSchema = SizeValueSchema;
|
|
148
241
|
exports.StatementSchema = StatementSchema;
|
|
149
242
|
exports.UrlOperatorSchema = UrlOperatorSchema;
|
|
243
|
+
exports.VALID_EFFECTS = VALID_EFFECTS;
|
|
244
|
+
exports.VALID_OPERATOR_LIST = VALID_OPERATOR_LIST;
|
|
245
|
+
exports.VALID_VERSIONS = VALID_VERSIONS;
|
|
246
|
+
exports.getOpenApiSchema = getOpenApiSchema;
|
package/dist/index.d.cts
CHANGED
|
@@ -19,7 +19,7 @@ interface Condition {
|
|
|
19
19
|
operator: Operator;
|
|
20
20
|
value?: ConditionValue;
|
|
21
21
|
}
|
|
22
|
-
type Effect = "allow" | "deny";
|
|
22
|
+
type Effect = "allow" | "ask" | "deny";
|
|
23
23
|
interface Statement {
|
|
24
24
|
effect: Effect;
|
|
25
25
|
permissions: string[];
|
|
@@ -27,7 +27,7 @@ interface Statement {
|
|
|
27
27
|
conditions?: Condition[];
|
|
28
28
|
}
|
|
29
29
|
interface Policy {
|
|
30
|
-
version: 1;
|
|
30
|
+
version: 1 | 2;
|
|
31
31
|
statements: Statement[];
|
|
32
32
|
}
|
|
33
33
|
interface PolicyRequest {
|
|
@@ -36,7 +36,7 @@ interface PolicyRequest {
|
|
|
36
36
|
context?: Record<string, unknown>;
|
|
37
37
|
}
|
|
38
38
|
interface PolicyResult {
|
|
39
|
-
|
|
39
|
+
effect: Effect;
|
|
40
40
|
matchedStatement?: Statement;
|
|
41
41
|
}
|
|
42
42
|
interface ParsedUrl {
|
|
@@ -53,7 +53,24 @@ interface PolicyHttpRequest {
|
|
|
53
53
|
body: string | null;
|
|
54
54
|
body_json: unknown;
|
|
55
55
|
}
|
|
56
|
+
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
|
+
interface OpenApiSchema {
|
|
58
|
+
type?: string;
|
|
59
|
+
required?: string[];
|
|
60
|
+
properties?: Record<string, OpenApiSchema>;
|
|
61
|
+
items?: OpenApiSchema;
|
|
62
|
+
enum?: (string | number)[];
|
|
63
|
+
description?: string;
|
|
64
|
+
minItems?: number;
|
|
65
|
+
oneOf?: OpenApiSchema[];
|
|
66
|
+
}
|
|
56
67
|
|
|
68
|
+
/** Current policy document version. */
|
|
69
|
+
declare const VALID_VERSIONS: readonly [1, 2];
|
|
70
|
+
/** Valid policy effects. */
|
|
71
|
+
declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
|
|
72
|
+
/** Valid condition operators. */
|
|
73
|
+
declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
|
|
57
74
|
declare const RangeValueSchema: z.ZodObject<{
|
|
58
75
|
min: z.ZodOptional<z.ZodNumber>;
|
|
59
76
|
max: z.ZodOptional<z.ZodNumber>;
|
|
@@ -145,9 +162,11 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
145
162
|
matches_url: "matches_url";
|
|
146
163
|
}>;
|
|
147
164
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
|
+
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
148
166
|
declare const StatementSchema: z.ZodObject<{
|
|
149
167
|
effect: z.ZodEnum<{
|
|
150
168
|
allow: "allow";
|
|
169
|
+
ask: "ask";
|
|
151
170
|
deny: "deny";
|
|
152
171
|
}>;
|
|
153
172
|
permissions: z.ZodArray<z.ZodString>;
|
|
@@ -203,7 +222,7 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
203
222
|
}, z.core.$strict>]>;
|
|
204
223
|
}, z.core.$strict>]>>>;
|
|
205
224
|
}, z.core.$strict>;
|
|
206
|
-
declare const PolicySchema: z.ZodObject<{
|
|
225
|
+
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
207
226
|
version: z.ZodLiteral<1>;
|
|
208
227
|
statements: z.ZodArray<z.ZodObject<{
|
|
209
228
|
effect: z.ZodEnum<{
|
|
@@ -263,6 +282,74 @@ declare const PolicySchema: z.ZodObject<{
|
|
|
263
282
|
}, z.core.$strict>]>;
|
|
264
283
|
}, z.core.$strict>]>>>;
|
|
265
284
|
}, z.core.$strict>>;
|
|
266
|
-
}, z.core.$strict
|
|
285
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
286
|
+
version: z.ZodLiteral<2>;
|
|
287
|
+
statements: z.ZodArray<z.ZodObject<{
|
|
288
|
+
effect: z.ZodEnum<{
|
|
289
|
+
allow: "allow";
|
|
290
|
+
ask: "ask";
|
|
291
|
+
deny: "deny";
|
|
292
|
+
}>;
|
|
293
|
+
permissions: z.ZodArray<z.ZodString>;
|
|
294
|
+
resources: z.ZodArray<z.ZodString>;
|
|
295
|
+
conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
296
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
297
|
+
operator: z.ZodLiteral<"equals">;
|
|
298
|
+
value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
299
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
300
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
301
|
+
operator: z.ZodLiteral<"in">;
|
|
302
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
303
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
304
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
305
|
+
operator: z.ZodLiteral<"matches">;
|
|
306
|
+
value: z.ZodString;
|
|
307
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
308
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
309
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
310
|
+
value: z.ZodString;
|
|
311
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
312
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
313
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
314
|
+
value: z.ZodString;
|
|
315
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
316
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
317
|
+
operator: z.ZodLiteral<"range">;
|
|
318
|
+
value: z.ZodObject<{
|
|
319
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
320
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
321
|
+
}, z.core.$strict>;
|
|
322
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
323
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
324
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
325
|
+
value: z.ZodString;
|
|
326
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
327
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
328
|
+
operator: z.ZodLiteral<"values_in">;
|
|
329
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
330
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
331
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
332
|
+
operator: z.ZodLiteral<"exists">;
|
|
333
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
334
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
335
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
336
|
+
value: z.ZodArray<z.ZodString>;
|
|
337
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
338
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
339
|
+
operator: z.ZodLiteral<"size">;
|
|
340
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
341
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
342
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
343
|
+
}, z.core.$strict>]>;
|
|
344
|
+
}, z.core.$strict>]>>>;
|
|
345
|
+
}, z.core.$strict>>;
|
|
346
|
+
}, z.core.$strict>]>;
|
|
347
|
+
/**
|
|
348
|
+
* Returns an OpenAPI-compatible JSON Schema object for a policy document.
|
|
349
|
+
*
|
|
350
|
+
* Derived from the same constants used by the Zod schemas so the
|
|
351
|
+
* documentation schema and runtime validation always stay in sync.
|
|
352
|
+
*/
|
|
353
|
+
declare function getOpenApiSchema(): OpenApiSchema;
|
|
267
354
|
|
|
268
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
|
|
355
|
+
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.d.ts
CHANGED
|
@@ -19,7 +19,7 @@ interface Condition {
|
|
|
19
19
|
operator: Operator;
|
|
20
20
|
value?: ConditionValue;
|
|
21
21
|
}
|
|
22
|
-
type Effect = "allow" | "deny";
|
|
22
|
+
type Effect = "allow" | "ask" | "deny";
|
|
23
23
|
interface Statement {
|
|
24
24
|
effect: Effect;
|
|
25
25
|
permissions: string[];
|
|
@@ -27,7 +27,7 @@ interface Statement {
|
|
|
27
27
|
conditions?: Condition[];
|
|
28
28
|
}
|
|
29
29
|
interface Policy {
|
|
30
|
-
version: 1;
|
|
30
|
+
version: 1 | 2;
|
|
31
31
|
statements: Statement[];
|
|
32
32
|
}
|
|
33
33
|
interface PolicyRequest {
|
|
@@ -36,7 +36,7 @@ interface PolicyRequest {
|
|
|
36
36
|
context?: Record<string, unknown>;
|
|
37
37
|
}
|
|
38
38
|
interface PolicyResult {
|
|
39
|
-
|
|
39
|
+
effect: Effect;
|
|
40
40
|
matchedStatement?: Statement;
|
|
41
41
|
}
|
|
42
42
|
interface ParsedUrl {
|
|
@@ -53,7 +53,24 @@ interface PolicyHttpRequest {
|
|
|
53
53
|
body: string | null;
|
|
54
54
|
body_json: unknown;
|
|
55
55
|
}
|
|
56
|
+
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
|
+
interface OpenApiSchema {
|
|
58
|
+
type?: string;
|
|
59
|
+
required?: string[];
|
|
60
|
+
properties?: Record<string, OpenApiSchema>;
|
|
61
|
+
items?: OpenApiSchema;
|
|
62
|
+
enum?: (string | number)[];
|
|
63
|
+
description?: string;
|
|
64
|
+
minItems?: number;
|
|
65
|
+
oneOf?: OpenApiSchema[];
|
|
66
|
+
}
|
|
56
67
|
|
|
68
|
+
/** Current policy document version. */
|
|
69
|
+
declare const VALID_VERSIONS: readonly [1, 2];
|
|
70
|
+
/** Valid policy effects. */
|
|
71
|
+
declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
|
|
72
|
+
/** Valid condition operators. */
|
|
73
|
+
declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
|
|
57
74
|
declare const RangeValueSchema: z.ZodObject<{
|
|
58
75
|
min: z.ZodOptional<z.ZodNumber>;
|
|
59
76
|
max: z.ZodOptional<z.ZodNumber>;
|
|
@@ -145,9 +162,11 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
145
162
|
matches_url: "matches_url";
|
|
146
163
|
}>;
|
|
147
164
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
|
+
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
148
166
|
declare const StatementSchema: z.ZodObject<{
|
|
149
167
|
effect: z.ZodEnum<{
|
|
150
168
|
allow: "allow";
|
|
169
|
+
ask: "ask";
|
|
151
170
|
deny: "deny";
|
|
152
171
|
}>;
|
|
153
172
|
permissions: z.ZodArray<z.ZodString>;
|
|
@@ -203,7 +222,7 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
203
222
|
}, z.core.$strict>]>;
|
|
204
223
|
}, z.core.$strict>]>>>;
|
|
205
224
|
}, z.core.$strict>;
|
|
206
|
-
declare const PolicySchema: z.ZodObject<{
|
|
225
|
+
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
207
226
|
version: z.ZodLiteral<1>;
|
|
208
227
|
statements: z.ZodArray<z.ZodObject<{
|
|
209
228
|
effect: z.ZodEnum<{
|
|
@@ -263,6 +282,74 @@ declare const PolicySchema: z.ZodObject<{
|
|
|
263
282
|
}, z.core.$strict>]>;
|
|
264
283
|
}, z.core.$strict>]>>>;
|
|
265
284
|
}, z.core.$strict>>;
|
|
266
|
-
}, z.core.$strict
|
|
285
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
286
|
+
version: z.ZodLiteral<2>;
|
|
287
|
+
statements: z.ZodArray<z.ZodObject<{
|
|
288
|
+
effect: z.ZodEnum<{
|
|
289
|
+
allow: "allow";
|
|
290
|
+
ask: "ask";
|
|
291
|
+
deny: "deny";
|
|
292
|
+
}>;
|
|
293
|
+
permissions: z.ZodArray<z.ZodString>;
|
|
294
|
+
resources: z.ZodArray<z.ZodString>;
|
|
295
|
+
conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
296
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
297
|
+
operator: z.ZodLiteral<"equals">;
|
|
298
|
+
value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
299
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
300
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
301
|
+
operator: z.ZodLiteral<"in">;
|
|
302
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
303
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
304
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
305
|
+
operator: z.ZodLiteral<"matches">;
|
|
306
|
+
value: z.ZodString;
|
|
307
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
308
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
309
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
310
|
+
value: z.ZodString;
|
|
311
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
312
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
313
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
314
|
+
value: z.ZodString;
|
|
315
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
316
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
317
|
+
operator: z.ZodLiteral<"range">;
|
|
318
|
+
value: z.ZodObject<{
|
|
319
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
320
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
321
|
+
}, z.core.$strict>;
|
|
322
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
323
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
324
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
325
|
+
value: z.ZodString;
|
|
326
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
327
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
328
|
+
operator: z.ZodLiteral<"values_in">;
|
|
329
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
330
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
331
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
332
|
+
operator: z.ZodLiteral<"exists">;
|
|
333
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
334
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
335
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
336
|
+
value: z.ZodArray<z.ZodString>;
|
|
337
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
338
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
339
|
+
operator: z.ZodLiteral<"size">;
|
|
340
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
341
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
342
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
343
|
+
}, z.core.$strict>]>;
|
|
344
|
+
}, z.core.$strict>]>>>;
|
|
345
|
+
}, z.core.$strict>>;
|
|
346
|
+
}, z.core.$strict>]>;
|
|
347
|
+
/**
|
|
348
|
+
* Returns an OpenAPI-compatible JSON Schema object for a policy document.
|
|
349
|
+
*
|
|
350
|
+
* Derived from the same constants used by the Zod schemas so the
|
|
351
|
+
* documentation schema and runtime validation always stay in sync.
|
|
352
|
+
*/
|
|
353
|
+
declare function getOpenApiSchema(): OpenApiSchema;
|
|
267
354
|
|
|
268
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
|
|
355
|
+
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.mjs
CHANGED
|
@@ -1,6 +1,21 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
|
|
3
3
|
// src/schema.ts
|
|
4
|
+
var VALID_VERSIONS = [1, 2];
|
|
5
|
+
var VALID_EFFECTS = ["allow", "ask", "deny"];
|
|
6
|
+
var VALID_OPERATOR_LIST = [
|
|
7
|
+
"equals",
|
|
8
|
+
"exists",
|
|
9
|
+
"in",
|
|
10
|
+
"keys_in",
|
|
11
|
+
"matches",
|
|
12
|
+
"matches_host",
|
|
13
|
+
"matches_path",
|
|
14
|
+
"matches_url",
|
|
15
|
+
"range",
|
|
16
|
+
"size",
|
|
17
|
+
"values_in"
|
|
18
|
+
];
|
|
4
19
|
var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
|
|
5
20
|
var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
|
|
6
21
|
var JsonValueSchema = z.lazy(
|
|
@@ -123,15 +138,93 @@ var OperatorSchema = z.enum([
|
|
|
123
138
|
"size"
|
|
124
139
|
]);
|
|
125
140
|
var ConditionValueSchema = JsonValueSchema;
|
|
126
|
-
var
|
|
141
|
+
var V1StatementSchema = z.object({
|
|
127
142
|
effect: z.enum(["allow", "deny"]),
|
|
128
143
|
permissions: z.array(z.string()).min(1),
|
|
129
144
|
resources: z.array(z.string()).min(1),
|
|
130
145
|
conditions: z.array(ConditionSchema).optional()
|
|
131
146
|
}).strict();
|
|
132
|
-
var
|
|
147
|
+
var V2StatementSchema = z.object({
|
|
148
|
+
effect: z.enum(["allow", "ask", "deny"]),
|
|
149
|
+
permissions: z.array(z.string()).min(1),
|
|
150
|
+
resources: z.array(z.string()).min(1),
|
|
151
|
+
conditions: z.array(ConditionSchema).optional()
|
|
152
|
+
}).strict();
|
|
153
|
+
var StatementSchema = V2StatementSchema;
|
|
154
|
+
var V1PolicySchema = z.object({
|
|
133
155
|
version: z.literal(1),
|
|
134
|
-
statements: z.array(
|
|
156
|
+
statements: z.array(V1StatementSchema)
|
|
157
|
+
}).strict();
|
|
158
|
+
var V2PolicySchema = z.object({
|
|
159
|
+
version: z.literal(2),
|
|
160
|
+
statements: z.array(V2StatementSchema)
|
|
135
161
|
}).strict();
|
|
162
|
+
var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
|
|
163
|
+
function getOpenApiSchema() {
|
|
164
|
+
return {
|
|
165
|
+
type: "object",
|
|
166
|
+
required: ["version", "statements"],
|
|
167
|
+
properties: {
|
|
168
|
+
version: {
|
|
169
|
+
type: "integer",
|
|
170
|
+
enum: [...VALID_VERSIONS],
|
|
171
|
+
description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
|
|
172
|
+
},
|
|
173
|
+
statements: {
|
|
174
|
+
type: "array",
|
|
175
|
+
description: "List of policy statements defining permissions.",
|
|
176
|
+
items: {
|
|
177
|
+
type: "object",
|
|
178
|
+
required: ["effect", "permissions", "resources"],
|
|
179
|
+
properties: {
|
|
180
|
+
effect: {
|
|
181
|
+
type: "string",
|
|
182
|
+
enum: [...VALID_EFFECTS].sort(),
|
|
183
|
+
description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
|
|
184
|
+
},
|
|
185
|
+
permissions: {
|
|
186
|
+
type: "array",
|
|
187
|
+
minItems: 1,
|
|
188
|
+
items: { type: "string" },
|
|
189
|
+
description: "List of permission identifiers."
|
|
190
|
+
},
|
|
191
|
+
resources: {
|
|
192
|
+
type: "array",
|
|
193
|
+
minItems: 1,
|
|
194
|
+
items: { type: "string" },
|
|
195
|
+
description: "List of resource identifiers the statement applies to."
|
|
196
|
+
},
|
|
197
|
+
conditions: {
|
|
198
|
+
type: "array",
|
|
199
|
+
description: "Optional conditions that must be met for the statement to apply.",
|
|
200
|
+
items: {
|
|
201
|
+
type: "object",
|
|
202
|
+
required: ["path", "operator"],
|
|
203
|
+
properties: {
|
|
204
|
+
path: {
|
|
205
|
+
type: "array",
|
|
206
|
+
minItems: 1,
|
|
207
|
+
description: "Path to the value to evaluate in the request context.",
|
|
208
|
+
items: {
|
|
209
|
+
oneOf: [{ type: "string" }, { type: "integer" }]
|
|
210
|
+
}
|
|
211
|
+
},
|
|
212
|
+
operator: {
|
|
213
|
+
type: "string",
|
|
214
|
+
enum: [...VALID_OPERATOR_LIST],
|
|
215
|
+
description: "Comparison operator used to evaluate the condition."
|
|
216
|
+
},
|
|
217
|
+
value: {
|
|
218
|
+
description: "Value to compare against using the operator."
|
|
219
|
+
}
|
|
220
|
+
}
|
|
221
|
+
}
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
}
|
|
227
|
+
};
|
|
228
|
+
}
|
|
136
229
|
|
|
137
|
-
export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema };
|
|
230
|
+
export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@zapier/policy-schema",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.7.1",
|
|
4
4
|
"description": "Zod schemas and TypeScript types for the Zapier policy engine",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.cjs",
|
|
@@ -22,6 +22,11 @@
|
|
|
22
22
|
"dist",
|
|
23
23
|
"README.md"
|
|
24
24
|
],
|
|
25
|
+
"repository": {
|
|
26
|
+
"type": "git",
|
|
27
|
+
"url": "https://gitlab.com/zapier/team-identity-platform/policy.git",
|
|
28
|
+
"directory": "typescript/schema"
|
|
29
|
+
},
|
|
25
30
|
"publishConfig": {
|
|
26
31
|
"access": "public"
|
|
27
32
|
},
|