@zapier/policy-schema 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +100 -3
- package/dist/index.d.cts +89 -4
- package/dist/index.d.ts +89 -4
- package/dist/index.mjs +97 -4
- package/package.json +1 -1
package/dist/index.cjs
CHANGED
|
@@ -3,6 +3,21 @@
|
|
|
3
3
|
var zod = require('zod');
|
|
4
4
|
|
|
5
5
|
// src/schema.ts
|
|
6
|
+
var VALID_VERSIONS = [1, 2];
|
|
7
|
+
var VALID_EFFECTS = ["allow", "ask", "deny"];
|
|
8
|
+
var VALID_OPERATOR_LIST = [
|
|
9
|
+
"equals",
|
|
10
|
+
"exists",
|
|
11
|
+
"in",
|
|
12
|
+
"keys_in",
|
|
13
|
+
"matches",
|
|
14
|
+
"matches_host",
|
|
15
|
+
"matches_path",
|
|
16
|
+
"matches_url",
|
|
17
|
+
"range",
|
|
18
|
+
"size",
|
|
19
|
+
"values_in"
|
|
20
|
+
];
|
|
6
21
|
var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
|
|
7
22
|
var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
|
|
8
23
|
var JsonValueSchema = zod.z.lazy(
|
|
@@ -125,16 +140,94 @@ var OperatorSchema = zod.z.enum([
|
|
|
125
140
|
"size"
|
|
126
141
|
]);
|
|
127
142
|
var ConditionValueSchema = JsonValueSchema;
|
|
128
|
-
var
|
|
143
|
+
var V1StatementSchema = zod.z.object({
|
|
144
|
+
effect: zod.z.enum(["allow", "deny"]),
|
|
145
|
+
permissions: zod.z.array(zod.z.string()).min(1),
|
|
146
|
+
resources: zod.z.array(zod.z.string()).min(1),
|
|
147
|
+
conditions: zod.z.array(ConditionSchema).optional()
|
|
148
|
+
}).strict();
|
|
149
|
+
var V2StatementSchema = zod.z.object({
|
|
129
150
|
effect: zod.z.enum(["allow", "ask", "deny"]),
|
|
130
151
|
permissions: zod.z.array(zod.z.string()).min(1),
|
|
131
152
|
resources: zod.z.array(zod.z.string()).min(1),
|
|
132
153
|
conditions: zod.z.array(ConditionSchema).optional()
|
|
133
154
|
}).strict();
|
|
134
|
-
var
|
|
155
|
+
var StatementSchema = V2StatementSchema;
|
|
156
|
+
var V1PolicySchema = zod.z.object({
|
|
157
|
+
version: zod.z.literal(1),
|
|
158
|
+
statements: zod.z.array(V1StatementSchema)
|
|
159
|
+
}).strict();
|
|
160
|
+
var V2PolicySchema = zod.z.object({
|
|
135
161
|
version: zod.z.literal(2),
|
|
136
|
-
statements: zod.z.array(
|
|
162
|
+
statements: zod.z.array(V2StatementSchema)
|
|
137
163
|
}).strict();
|
|
164
|
+
var PolicySchema = zod.z.union([V1PolicySchema, V2PolicySchema]);
|
|
165
|
+
function getOpenApiSchema() {
|
|
166
|
+
return {
|
|
167
|
+
type: "object",
|
|
168
|
+
required: ["version", "statements"],
|
|
169
|
+
properties: {
|
|
170
|
+
version: {
|
|
171
|
+
type: "integer",
|
|
172
|
+
enum: [...VALID_VERSIONS],
|
|
173
|
+
description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
|
|
174
|
+
},
|
|
175
|
+
statements: {
|
|
176
|
+
type: "array",
|
|
177
|
+
description: "List of policy statements defining permissions.",
|
|
178
|
+
items: {
|
|
179
|
+
type: "object",
|
|
180
|
+
required: ["effect", "permissions", "resources"],
|
|
181
|
+
properties: {
|
|
182
|
+
effect: {
|
|
183
|
+
type: "string",
|
|
184
|
+
enum: [...VALID_EFFECTS].sort(),
|
|
185
|
+
description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
|
|
186
|
+
},
|
|
187
|
+
permissions: {
|
|
188
|
+
type: "array",
|
|
189
|
+
minItems: 1,
|
|
190
|
+
items: { type: "string" },
|
|
191
|
+
description: "List of permission identifiers."
|
|
192
|
+
},
|
|
193
|
+
resources: {
|
|
194
|
+
type: "array",
|
|
195
|
+
minItems: 1,
|
|
196
|
+
items: { type: "string" },
|
|
197
|
+
description: "List of resource identifiers the statement applies to."
|
|
198
|
+
},
|
|
199
|
+
conditions: {
|
|
200
|
+
type: "array",
|
|
201
|
+
description: "Optional conditions that must be met for the statement to apply.",
|
|
202
|
+
items: {
|
|
203
|
+
type: "object",
|
|
204
|
+
required: ["path", "operator"],
|
|
205
|
+
properties: {
|
|
206
|
+
path: {
|
|
207
|
+
type: "array",
|
|
208
|
+
minItems: 1,
|
|
209
|
+
description: "Path to the value to evaluate in the request context.",
|
|
210
|
+
items: {
|
|
211
|
+
oneOf: [{ type: "string" }, { type: "integer" }]
|
|
212
|
+
}
|
|
213
|
+
},
|
|
214
|
+
operator: {
|
|
215
|
+
type: "string",
|
|
216
|
+
enum: [...VALID_OPERATOR_LIST],
|
|
217
|
+
description: "Comparison operator used to evaluate the condition."
|
|
218
|
+
},
|
|
219
|
+
value: {
|
|
220
|
+
description: "Value to compare against using the operator."
|
|
221
|
+
}
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
}
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
};
|
|
230
|
+
}
|
|
138
231
|
|
|
139
232
|
exports.ArrayOperatorSchema = ArrayOperatorSchema;
|
|
140
233
|
exports.ConditionSchema = ConditionSchema;
|
|
@@ -147,3 +240,7 @@ exports.ScalarOperatorSchema = ScalarOperatorSchema;
|
|
|
147
240
|
exports.SizeValueSchema = SizeValueSchema;
|
|
148
241
|
exports.StatementSchema = StatementSchema;
|
|
149
242
|
exports.UrlOperatorSchema = UrlOperatorSchema;
|
|
243
|
+
exports.VALID_EFFECTS = VALID_EFFECTS;
|
|
244
|
+
exports.VALID_OPERATOR_LIST = VALID_OPERATOR_LIST;
|
|
245
|
+
exports.VALID_VERSIONS = VALID_VERSIONS;
|
|
246
|
+
exports.getOpenApiSchema = getOpenApiSchema;
|
package/dist/index.d.cts
CHANGED
|
@@ -27,7 +27,7 @@ interface Statement {
|
|
|
27
27
|
conditions?: Condition[];
|
|
28
28
|
}
|
|
29
29
|
interface Policy {
|
|
30
|
-
version: 2;
|
|
30
|
+
version: 1 | 2;
|
|
31
31
|
statements: Statement[];
|
|
32
32
|
}
|
|
33
33
|
interface PolicyRequest {
|
|
@@ -53,7 +53,24 @@ interface PolicyHttpRequest {
|
|
|
53
53
|
body: string | null;
|
|
54
54
|
body_json: unknown;
|
|
55
55
|
}
|
|
56
|
+
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
|
+
interface OpenApiSchema {
|
|
58
|
+
type?: string;
|
|
59
|
+
required?: string[];
|
|
60
|
+
properties?: Record<string, OpenApiSchema>;
|
|
61
|
+
items?: OpenApiSchema;
|
|
62
|
+
enum?: (string | number)[];
|
|
63
|
+
description?: string;
|
|
64
|
+
minItems?: number;
|
|
65
|
+
oneOf?: OpenApiSchema[];
|
|
66
|
+
}
|
|
56
67
|
|
|
68
|
+
/** Current policy document version. */
|
|
69
|
+
declare const VALID_VERSIONS: readonly [1, 2];
|
|
70
|
+
/** Valid policy effects. */
|
|
71
|
+
declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
|
|
72
|
+
/** Valid condition operators. */
|
|
73
|
+
declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
|
|
57
74
|
declare const RangeValueSchema: z.ZodObject<{
|
|
58
75
|
min: z.ZodOptional<z.ZodNumber>;
|
|
59
76
|
max: z.ZodOptional<z.ZodNumber>;
|
|
@@ -145,6 +162,7 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
145
162
|
matches_url: "matches_url";
|
|
146
163
|
}>;
|
|
147
164
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
|
+
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
148
166
|
declare const StatementSchema: z.ZodObject<{
|
|
149
167
|
effect: z.ZodEnum<{
|
|
150
168
|
allow: "allow";
|
|
@@ -204,7 +222,67 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
204
222
|
}, z.core.$strict>]>;
|
|
205
223
|
}, z.core.$strict>]>>>;
|
|
206
224
|
}, z.core.$strict>;
|
|
207
|
-
declare const PolicySchema: z.ZodObject<{
|
|
225
|
+
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
226
|
+
version: z.ZodLiteral<1>;
|
|
227
|
+
statements: z.ZodArray<z.ZodObject<{
|
|
228
|
+
effect: z.ZodEnum<{
|
|
229
|
+
allow: "allow";
|
|
230
|
+
deny: "deny";
|
|
231
|
+
}>;
|
|
232
|
+
permissions: z.ZodArray<z.ZodString>;
|
|
233
|
+
resources: z.ZodArray<z.ZodString>;
|
|
234
|
+
conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
235
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
236
|
+
operator: z.ZodLiteral<"equals">;
|
|
237
|
+
value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
238
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
239
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
240
|
+
operator: z.ZodLiteral<"in">;
|
|
241
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
242
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
243
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
244
|
+
operator: z.ZodLiteral<"matches">;
|
|
245
|
+
value: z.ZodString;
|
|
246
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
247
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
248
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
249
|
+
value: z.ZodString;
|
|
250
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
251
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
252
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
253
|
+
value: z.ZodString;
|
|
254
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
255
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
256
|
+
operator: z.ZodLiteral<"range">;
|
|
257
|
+
value: z.ZodObject<{
|
|
258
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
259
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
260
|
+
}, z.core.$strict>;
|
|
261
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
262
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
263
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
264
|
+
value: z.ZodString;
|
|
265
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
266
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
267
|
+
operator: z.ZodLiteral<"values_in">;
|
|
268
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
269
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
270
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
271
|
+
operator: z.ZodLiteral<"exists">;
|
|
272
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
273
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
274
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
275
|
+
value: z.ZodArray<z.ZodString>;
|
|
276
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
277
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
278
|
+
operator: z.ZodLiteral<"size">;
|
|
279
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
280
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
281
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
282
|
+
}, z.core.$strict>]>;
|
|
283
|
+
}, z.core.$strict>]>>>;
|
|
284
|
+
}, z.core.$strict>>;
|
|
285
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
208
286
|
version: z.ZodLiteral<2>;
|
|
209
287
|
statements: z.ZodArray<z.ZodObject<{
|
|
210
288
|
effect: z.ZodEnum<{
|
|
@@ -265,6 +343,13 @@ declare const PolicySchema: z.ZodObject<{
|
|
|
265
343
|
}, z.core.$strict>]>;
|
|
266
344
|
}, z.core.$strict>]>>>;
|
|
267
345
|
}, z.core.$strict>>;
|
|
268
|
-
}, z.core.$strict>;
|
|
346
|
+
}, z.core.$strict>]>;
|
|
347
|
+
/**
|
|
348
|
+
* Returns an OpenAPI-compatible JSON Schema object for a policy document.
|
|
349
|
+
*
|
|
350
|
+
* Derived from the same constants used by the Zod schemas so the
|
|
351
|
+
* documentation schema and runtime validation always stay in sync.
|
|
352
|
+
*/
|
|
353
|
+
declare function getOpenApiSchema(): OpenApiSchema;
|
|
269
354
|
|
|
270
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
|
|
355
|
+
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.d.ts
CHANGED
|
@@ -27,7 +27,7 @@ interface Statement {
|
|
|
27
27
|
conditions?: Condition[];
|
|
28
28
|
}
|
|
29
29
|
interface Policy {
|
|
30
|
-
version: 2;
|
|
30
|
+
version: 1 | 2;
|
|
31
31
|
statements: Statement[];
|
|
32
32
|
}
|
|
33
33
|
interface PolicyRequest {
|
|
@@ -53,7 +53,24 @@ interface PolicyHttpRequest {
|
|
|
53
53
|
body: string | null;
|
|
54
54
|
body_json: unknown;
|
|
55
55
|
}
|
|
56
|
+
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
|
+
interface OpenApiSchema {
|
|
58
|
+
type?: string;
|
|
59
|
+
required?: string[];
|
|
60
|
+
properties?: Record<string, OpenApiSchema>;
|
|
61
|
+
items?: OpenApiSchema;
|
|
62
|
+
enum?: (string | number)[];
|
|
63
|
+
description?: string;
|
|
64
|
+
minItems?: number;
|
|
65
|
+
oneOf?: OpenApiSchema[];
|
|
66
|
+
}
|
|
56
67
|
|
|
68
|
+
/** Current policy document version. */
|
|
69
|
+
declare const VALID_VERSIONS: readonly [1, 2];
|
|
70
|
+
/** Valid policy effects. */
|
|
71
|
+
declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
|
|
72
|
+
/** Valid condition operators. */
|
|
73
|
+
declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
|
|
57
74
|
declare const RangeValueSchema: z.ZodObject<{
|
|
58
75
|
min: z.ZodOptional<z.ZodNumber>;
|
|
59
76
|
max: z.ZodOptional<z.ZodNumber>;
|
|
@@ -145,6 +162,7 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
145
162
|
matches_url: "matches_url";
|
|
146
163
|
}>;
|
|
147
164
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
|
+
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
148
166
|
declare const StatementSchema: z.ZodObject<{
|
|
149
167
|
effect: z.ZodEnum<{
|
|
150
168
|
allow: "allow";
|
|
@@ -204,7 +222,67 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
204
222
|
}, z.core.$strict>]>;
|
|
205
223
|
}, z.core.$strict>]>>>;
|
|
206
224
|
}, z.core.$strict>;
|
|
207
|
-
declare const PolicySchema: z.ZodObject<{
|
|
225
|
+
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
226
|
+
version: z.ZodLiteral<1>;
|
|
227
|
+
statements: z.ZodArray<z.ZodObject<{
|
|
228
|
+
effect: z.ZodEnum<{
|
|
229
|
+
allow: "allow";
|
|
230
|
+
deny: "deny";
|
|
231
|
+
}>;
|
|
232
|
+
permissions: z.ZodArray<z.ZodString>;
|
|
233
|
+
resources: z.ZodArray<z.ZodString>;
|
|
234
|
+
conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
|
|
235
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
236
|
+
operator: z.ZodLiteral<"equals">;
|
|
237
|
+
value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
238
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
239
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
240
|
+
operator: z.ZodLiteral<"in">;
|
|
241
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
242
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
243
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
244
|
+
operator: z.ZodLiteral<"matches">;
|
|
245
|
+
value: z.ZodString;
|
|
246
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
247
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
248
|
+
operator: z.ZodLiteral<"matches_host">;
|
|
249
|
+
value: z.ZodString;
|
|
250
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
251
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
252
|
+
operator: z.ZodLiteral<"matches_path">;
|
|
253
|
+
value: z.ZodString;
|
|
254
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
255
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
256
|
+
operator: z.ZodLiteral<"range">;
|
|
257
|
+
value: z.ZodObject<{
|
|
258
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
259
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
260
|
+
}, z.core.$strict>;
|
|
261
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
262
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
263
|
+
operator: z.ZodLiteral<"matches_url">;
|
|
264
|
+
value: z.ZodString;
|
|
265
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
266
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
267
|
+
operator: z.ZodLiteral<"values_in">;
|
|
268
|
+
value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
|
|
269
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
270
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
271
|
+
operator: z.ZodLiteral<"exists">;
|
|
272
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
273
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
274
|
+
operator: z.ZodLiteral<"keys_in">;
|
|
275
|
+
value: z.ZodArray<z.ZodString>;
|
|
276
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
277
|
+
path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
|
|
278
|
+
operator: z.ZodLiteral<"size">;
|
|
279
|
+
value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
|
|
280
|
+
min: z.ZodOptional<z.ZodNumber>;
|
|
281
|
+
max: z.ZodOptional<z.ZodNumber>;
|
|
282
|
+
}, z.core.$strict>]>;
|
|
283
|
+
}, z.core.$strict>]>>>;
|
|
284
|
+
}, z.core.$strict>>;
|
|
285
|
+
}, z.core.$strict>, z.ZodObject<{
|
|
208
286
|
version: z.ZodLiteral<2>;
|
|
209
287
|
statements: z.ZodArray<z.ZodObject<{
|
|
210
288
|
effect: z.ZodEnum<{
|
|
@@ -265,6 +343,13 @@ declare const PolicySchema: z.ZodObject<{
|
|
|
265
343
|
}, z.core.$strict>]>;
|
|
266
344
|
}, z.core.$strict>]>>>;
|
|
267
345
|
}, z.core.$strict>>;
|
|
268
|
-
}, z.core.$strict>;
|
|
346
|
+
}, z.core.$strict>]>;
|
|
347
|
+
/**
|
|
348
|
+
* Returns an OpenAPI-compatible JSON Schema object for a policy document.
|
|
349
|
+
*
|
|
350
|
+
* Derived from the same constants used by the Zod schemas so the
|
|
351
|
+
* documentation schema and runtime validation always stay in sync.
|
|
352
|
+
*/
|
|
353
|
+
declare function getOpenApiSchema(): OpenApiSchema;
|
|
269
354
|
|
|
270
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
|
|
355
|
+
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.mjs
CHANGED
|
@@ -1,6 +1,21 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
|
|
3
3
|
// src/schema.ts
|
|
4
|
+
var VALID_VERSIONS = [1, 2];
|
|
5
|
+
var VALID_EFFECTS = ["allow", "ask", "deny"];
|
|
6
|
+
var VALID_OPERATOR_LIST = [
|
|
7
|
+
"equals",
|
|
8
|
+
"exists",
|
|
9
|
+
"in",
|
|
10
|
+
"keys_in",
|
|
11
|
+
"matches",
|
|
12
|
+
"matches_host",
|
|
13
|
+
"matches_path",
|
|
14
|
+
"matches_url",
|
|
15
|
+
"range",
|
|
16
|
+
"size",
|
|
17
|
+
"values_in"
|
|
18
|
+
];
|
|
4
19
|
var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
|
|
5
20
|
var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
|
|
6
21
|
var JsonValueSchema = z.lazy(
|
|
@@ -123,15 +138,93 @@ var OperatorSchema = z.enum([
|
|
|
123
138
|
"size"
|
|
124
139
|
]);
|
|
125
140
|
var ConditionValueSchema = JsonValueSchema;
|
|
126
|
-
var
|
|
141
|
+
var V1StatementSchema = z.object({
|
|
142
|
+
effect: z.enum(["allow", "deny"]),
|
|
143
|
+
permissions: z.array(z.string()).min(1),
|
|
144
|
+
resources: z.array(z.string()).min(1),
|
|
145
|
+
conditions: z.array(ConditionSchema).optional()
|
|
146
|
+
}).strict();
|
|
147
|
+
var V2StatementSchema = z.object({
|
|
127
148
|
effect: z.enum(["allow", "ask", "deny"]),
|
|
128
149
|
permissions: z.array(z.string()).min(1),
|
|
129
150
|
resources: z.array(z.string()).min(1),
|
|
130
151
|
conditions: z.array(ConditionSchema).optional()
|
|
131
152
|
}).strict();
|
|
132
|
-
var
|
|
153
|
+
var StatementSchema = V2StatementSchema;
|
|
154
|
+
var V1PolicySchema = z.object({
|
|
155
|
+
version: z.literal(1),
|
|
156
|
+
statements: z.array(V1StatementSchema)
|
|
157
|
+
}).strict();
|
|
158
|
+
var V2PolicySchema = z.object({
|
|
133
159
|
version: z.literal(2),
|
|
134
|
-
statements: z.array(
|
|
160
|
+
statements: z.array(V2StatementSchema)
|
|
135
161
|
}).strict();
|
|
162
|
+
var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
|
|
163
|
+
function getOpenApiSchema() {
|
|
164
|
+
return {
|
|
165
|
+
type: "object",
|
|
166
|
+
required: ["version", "statements"],
|
|
167
|
+
properties: {
|
|
168
|
+
version: {
|
|
169
|
+
type: "integer",
|
|
170
|
+
enum: [...VALID_VERSIONS],
|
|
171
|
+
description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
|
|
172
|
+
},
|
|
173
|
+
statements: {
|
|
174
|
+
type: "array",
|
|
175
|
+
description: "List of policy statements defining permissions.",
|
|
176
|
+
items: {
|
|
177
|
+
type: "object",
|
|
178
|
+
required: ["effect", "permissions", "resources"],
|
|
179
|
+
properties: {
|
|
180
|
+
effect: {
|
|
181
|
+
type: "string",
|
|
182
|
+
enum: [...VALID_EFFECTS].sort(),
|
|
183
|
+
description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
|
|
184
|
+
},
|
|
185
|
+
permissions: {
|
|
186
|
+
type: "array",
|
|
187
|
+
minItems: 1,
|
|
188
|
+
items: { type: "string" },
|
|
189
|
+
description: "List of permission identifiers."
|
|
190
|
+
},
|
|
191
|
+
resources: {
|
|
192
|
+
type: "array",
|
|
193
|
+
minItems: 1,
|
|
194
|
+
items: { type: "string" },
|
|
195
|
+
description: "List of resource identifiers the statement applies to."
|
|
196
|
+
},
|
|
197
|
+
conditions: {
|
|
198
|
+
type: "array",
|
|
199
|
+
description: "Optional conditions that must be met for the statement to apply.",
|
|
200
|
+
items: {
|
|
201
|
+
type: "object",
|
|
202
|
+
required: ["path", "operator"],
|
|
203
|
+
properties: {
|
|
204
|
+
path: {
|
|
205
|
+
type: "array",
|
|
206
|
+
minItems: 1,
|
|
207
|
+
description: "Path to the value to evaluate in the request context.",
|
|
208
|
+
items: {
|
|
209
|
+
oneOf: [{ type: "string" }, { type: "integer" }]
|
|
210
|
+
}
|
|
211
|
+
},
|
|
212
|
+
operator: {
|
|
213
|
+
type: "string",
|
|
214
|
+
enum: [...VALID_OPERATOR_LIST],
|
|
215
|
+
description: "Comparison operator used to evaluate the condition."
|
|
216
|
+
},
|
|
217
|
+
value: {
|
|
218
|
+
description: "Value to compare against using the operator."
|
|
219
|
+
}
|
|
220
|
+
}
|
|
221
|
+
}
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
}
|
|
227
|
+
};
|
|
228
|
+
}
|
|
136
229
|
|
|
137
|
-
export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema };
|
|
230
|
+
export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|