@zapier/policy-schema 0.7.1 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +13 -1
- package/dist/index.d.cts +62 -2
- package/dist/index.d.ts +62 -2
- package/dist/index.mjs +13 -1
- package/package.json +1 -1
package/dist/index.cjs
CHANGED
|
@@ -141,12 +141,16 @@ var OperatorSchema = zod.z.enum([
|
|
|
141
141
|
]);
|
|
142
142
|
var ConditionValueSchema = JsonValueSchema;
|
|
143
143
|
var V1StatementSchema = zod.z.object({
|
|
144
|
+
id: zod.z.string().optional(),
|
|
145
|
+
label: zod.z.string().optional(),
|
|
144
146
|
effect: zod.z.enum(["allow", "deny"]),
|
|
145
147
|
permissions: zod.z.array(zod.z.string()).min(1),
|
|
146
148
|
resources: zod.z.array(zod.z.string()).min(1),
|
|
147
149
|
conditions: zod.z.array(ConditionSchema).optional()
|
|
148
150
|
}).strict();
|
|
149
151
|
var V2StatementSchema = zod.z.object({
|
|
152
|
+
id: zod.z.string().optional(),
|
|
153
|
+
label: zod.z.string().optional(),
|
|
150
154
|
effect: zod.z.enum(["allow", "ask", "deny"]),
|
|
151
155
|
permissions: zod.z.array(zod.z.string()).min(1),
|
|
152
156
|
resources: zod.z.array(zod.z.string()).min(1),
|
|
@@ -179,6 +183,14 @@ function getOpenApiSchema() {
|
|
|
179
183
|
type: "object",
|
|
180
184
|
required: ["effect", "permissions", "resources"],
|
|
181
185
|
properties: {
|
|
186
|
+
id: {
|
|
187
|
+
type: "string",
|
|
188
|
+
description: "Optional identifier for debugging and provenance. Included in statementHash for override targeting."
|
|
189
|
+
},
|
|
190
|
+
label: {
|
|
191
|
+
type: "string",
|
|
192
|
+
description: "Optional human-readable description of the statement. Excluded from statementHash for override targeting."
|
|
193
|
+
},
|
|
182
194
|
effect: {
|
|
183
195
|
type: "string",
|
|
184
196
|
enum: [...VALID_EFFECTS].sort(),
|
|
@@ -208,7 +220,7 @@ function getOpenApiSchema() {
|
|
|
208
220
|
minItems: 1,
|
|
209
221
|
description: "Path to the value to evaluate in the request context.",
|
|
210
222
|
items: {
|
|
211
|
-
|
|
223
|
+
anyOf: [{ type: "string" }, { type: "integer" }]
|
|
212
224
|
}
|
|
213
225
|
},
|
|
214
226
|
operator: {
|
package/dist/index.d.cts
CHANGED
|
@@ -21,6 +21,8 @@ interface Condition {
|
|
|
21
21
|
}
|
|
22
22
|
type Effect = "allow" | "ask" | "deny";
|
|
23
23
|
interface Statement {
|
|
24
|
+
id?: string;
|
|
25
|
+
label?: string;
|
|
24
26
|
effect: Effect;
|
|
25
27
|
permissions: string[];
|
|
26
28
|
resources: string[];
|
|
@@ -35,9 +37,52 @@ interface PolicyRequest {
|
|
|
35
37
|
resource: string;
|
|
36
38
|
context?: Record<string, unknown>;
|
|
37
39
|
}
|
|
40
|
+
/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
|
|
41
|
+
type CanonicalHash = string & {
|
|
42
|
+
readonly __brand: "CanonicalHash";
|
|
43
|
+
};
|
|
44
|
+
interface OverrideBase {
|
|
45
|
+
id?: string;
|
|
46
|
+
statementHash: CanonicalHash;
|
|
47
|
+
effect: "allow";
|
|
48
|
+
}
|
|
49
|
+
type Override = (OverrideBase & {
|
|
50
|
+
match: "any";
|
|
51
|
+
}) | (OverrideBase & {
|
|
52
|
+
contextHash: CanonicalHash;
|
|
53
|
+
}) | (OverrideBase & {
|
|
54
|
+
conditionals: Condition[];
|
|
55
|
+
});
|
|
56
|
+
interface ConditionTrace {
|
|
57
|
+
condition: Condition;
|
|
58
|
+
resolved: unknown;
|
|
59
|
+
passed: boolean;
|
|
60
|
+
}
|
|
61
|
+
interface OverrideTrace {
|
|
62
|
+
override: Override;
|
|
63
|
+
matched: boolean;
|
|
64
|
+
conditionResults?: ConditionTrace[];
|
|
65
|
+
}
|
|
66
|
+
interface StatementTrace {
|
|
67
|
+
statement: Statement;
|
|
68
|
+
permissionMatched: boolean;
|
|
69
|
+
resourceMatched: boolean;
|
|
70
|
+
conditionResults?: ConditionTrace[];
|
|
71
|
+
passed: boolean;
|
|
72
|
+
overrides?: OverrideTrace[];
|
|
73
|
+
}
|
|
74
|
+
interface EvaluatePolicyOptions {
|
|
75
|
+
policy: Policy;
|
|
76
|
+
request: PolicyRequest;
|
|
77
|
+
overrides?: Override[];
|
|
78
|
+
trace?: boolean;
|
|
79
|
+
}
|
|
80
|
+
type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
|
|
38
81
|
interface PolicyResult {
|
|
39
82
|
effect: Effect;
|
|
40
|
-
|
|
83
|
+
explicit: boolean;
|
|
84
|
+
reason: PolicyReason;
|
|
85
|
+
statements: StatementTrace[];
|
|
41
86
|
}
|
|
42
87
|
interface ParsedUrl {
|
|
43
88
|
scheme: string;
|
|
@@ -52,6 +97,14 @@ interface PolicyHttpRequest {
|
|
|
52
97
|
headers: Record<string, string | string[]>;
|
|
53
98
|
body: string | null;
|
|
54
99
|
body_json: unknown;
|
|
100
|
+
connection_id?: string;
|
|
101
|
+
}
|
|
102
|
+
interface PolicyActionRequest {
|
|
103
|
+
connection_id?: string;
|
|
104
|
+
selected_api?: string;
|
|
105
|
+
action_type?: string;
|
|
106
|
+
action_key?: string;
|
|
107
|
+
inputs?: Record<string, unknown>;
|
|
55
108
|
}
|
|
56
109
|
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
110
|
interface OpenApiSchema {
|
|
@@ -63,6 +116,7 @@ interface OpenApiSchema {
|
|
|
63
116
|
description?: string;
|
|
64
117
|
minItems?: number;
|
|
65
118
|
oneOf?: OpenApiSchema[];
|
|
119
|
+
anyOf?: OpenApiSchema[];
|
|
66
120
|
}
|
|
67
121
|
|
|
68
122
|
/** Current policy document version. */
|
|
@@ -164,6 +218,8 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
164
218
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
219
|
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
166
220
|
declare const StatementSchema: z.ZodObject<{
|
|
221
|
+
id: z.ZodOptional<z.ZodString>;
|
|
222
|
+
label: z.ZodOptional<z.ZodString>;
|
|
167
223
|
effect: z.ZodEnum<{
|
|
168
224
|
allow: "allow";
|
|
169
225
|
ask: "ask";
|
|
@@ -225,6 +281,8 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
225
281
|
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
226
282
|
version: z.ZodLiteral<1>;
|
|
227
283
|
statements: z.ZodArray<z.ZodObject<{
|
|
284
|
+
id: z.ZodOptional<z.ZodString>;
|
|
285
|
+
label: z.ZodOptional<z.ZodString>;
|
|
228
286
|
effect: z.ZodEnum<{
|
|
229
287
|
allow: "allow";
|
|
230
288
|
deny: "deny";
|
|
@@ -285,6 +343,8 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
285
343
|
}, z.core.$strict>, z.ZodObject<{
|
|
286
344
|
version: z.ZodLiteral<2>;
|
|
287
345
|
statements: z.ZodArray<z.ZodObject<{
|
|
346
|
+
id: z.ZodOptional<z.ZodString>;
|
|
347
|
+
label: z.ZodOptional<z.ZodString>;
|
|
288
348
|
effect: z.ZodEnum<{
|
|
289
349
|
allow: "allow";
|
|
290
350
|
ask: "ask";
|
|
@@ -352,4 +412,4 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
352
412
|
*/
|
|
353
413
|
declare function getOpenApiSchema(): OpenApiSchema;
|
|
354
414
|
|
|
355
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
|
415
|
+
export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.d.ts
CHANGED
|
@@ -21,6 +21,8 @@ interface Condition {
|
|
|
21
21
|
}
|
|
22
22
|
type Effect = "allow" | "ask" | "deny";
|
|
23
23
|
interface Statement {
|
|
24
|
+
id?: string;
|
|
25
|
+
label?: string;
|
|
24
26
|
effect: Effect;
|
|
25
27
|
permissions: string[];
|
|
26
28
|
resources: string[];
|
|
@@ -35,9 +37,52 @@ interface PolicyRequest {
|
|
|
35
37
|
resource: string;
|
|
36
38
|
context?: Record<string, unknown>;
|
|
37
39
|
}
|
|
40
|
+
/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
|
|
41
|
+
type CanonicalHash = string & {
|
|
42
|
+
readonly __brand: "CanonicalHash";
|
|
43
|
+
};
|
|
44
|
+
interface OverrideBase {
|
|
45
|
+
id?: string;
|
|
46
|
+
statementHash: CanonicalHash;
|
|
47
|
+
effect: "allow";
|
|
48
|
+
}
|
|
49
|
+
type Override = (OverrideBase & {
|
|
50
|
+
match: "any";
|
|
51
|
+
}) | (OverrideBase & {
|
|
52
|
+
contextHash: CanonicalHash;
|
|
53
|
+
}) | (OverrideBase & {
|
|
54
|
+
conditionals: Condition[];
|
|
55
|
+
});
|
|
56
|
+
interface ConditionTrace {
|
|
57
|
+
condition: Condition;
|
|
58
|
+
resolved: unknown;
|
|
59
|
+
passed: boolean;
|
|
60
|
+
}
|
|
61
|
+
interface OverrideTrace {
|
|
62
|
+
override: Override;
|
|
63
|
+
matched: boolean;
|
|
64
|
+
conditionResults?: ConditionTrace[];
|
|
65
|
+
}
|
|
66
|
+
interface StatementTrace {
|
|
67
|
+
statement: Statement;
|
|
68
|
+
permissionMatched: boolean;
|
|
69
|
+
resourceMatched: boolean;
|
|
70
|
+
conditionResults?: ConditionTrace[];
|
|
71
|
+
passed: boolean;
|
|
72
|
+
overrides?: OverrideTrace[];
|
|
73
|
+
}
|
|
74
|
+
interface EvaluatePolicyOptions {
|
|
75
|
+
policy: Policy;
|
|
76
|
+
request: PolicyRequest;
|
|
77
|
+
overrides?: Override[];
|
|
78
|
+
trace?: boolean;
|
|
79
|
+
}
|
|
80
|
+
type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
|
|
38
81
|
interface PolicyResult {
|
|
39
82
|
effect: Effect;
|
|
40
|
-
|
|
83
|
+
explicit: boolean;
|
|
84
|
+
reason: PolicyReason;
|
|
85
|
+
statements: StatementTrace[];
|
|
41
86
|
}
|
|
42
87
|
interface ParsedUrl {
|
|
43
88
|
scheme: string;
|
|
@@ -52,6 +97,14 @@ interface PolicyHttpRequest {
|
|
|
52
97
|
headers: Record<string, string | string[]>;
|
|
53
98
|
body: string | null;
|
|
54
99
|
body_json: unknown;
|
|
100
|
+
connection_id?: string;
|
|
101
|
+
}
|
|
102
|
+
interface PolicyActionRequest {
|
|
103
|
+
connection_id?: string;
|
|
104
|
+
selected_api?: string;
|
|
105
|
+
action_type?: string;
|
|
106
|
+
action_key?: string;
|
|
107
|
+
inputs?: Record<string, unknown>;
|
|
55
108
|
}
|
|
56
109
|
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
110
|
interface OpenApiSchema {
|
|
@@ -63,6 +116,7 @@ interface OpenApiSchema {
|
|
|
63
116
|
description?: string;
|
|
64
117
|
minItems?: number;
|
|
65
118
|
oneOf?: OpenApiSchema[];
|
|
119
|
+
anyOf?: OpenApiSchema[];
|
|
66
120
|
}
|
|
67
121
|
|
|
68
122
|
/** Current policy document version. */
|
|
@@ -164,6 +218,8 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
164
218
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
219
|
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
166
220
|
declare const StatementSchema: z.ZodObject<{
|
|
221
|
+
id: z.ZodOptional<z.ZodString>;
|
|
222
|
+
label: z.ZodOptional<z.ZodString>;
|
|
167
223
|
effect: z.ZodEnum<{
|
|
168
224
|
allow: "allow";
|
|
169
225
|
ask: "ask";
|
|
@@ -225,6 +281,8 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
225
281
|
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
226
282
|
version: z.ZodLiteral<1>;
|
|
227
283
|
statements: z.ZodArray<z.ZodObject<{
|
|
284
|
+
id: z.ZodOptional<z.ZodString>;
|
|
285
|
+
label: z.ZodOptional<z.ZodString>;
|
|
228
286
|
effect: z.ZodEnum<{
|
|
229
287
|
allow: "allow";
|
|
230
288
|
deny: "deny";
|
|
@@ -285,6 +343,8 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
285
343
|
}, z.core.$strict>, z.ZodObject<{
|
|
286
344
|
version: z.ZodLiteral<2>;
|
|
287
345
|
statements: z.ZodArray<z.ZodObject<{
|
|
346
|
+
id: z.ZodOptional<z.ZodString>;
|
|
347
|
+
label: z.ZodOptional<z.ZodString>;
|
|
288
348
|
effect: z.ZodEnum<{
|
|
289
349
|
allow: "allow";
|
|
290
350
|
ask: "ask";
|
|
@@ -352,4 +412,4 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
352
412
|
*/
|
|
353
413
|
declare function getOpenApiSchema(): OpenApiSchema;
|
|
354
414
|
|
|
355
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
|
415
|
+
export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.mjs
CHANGED
|
@@ -139,12 +139,16 @@ var OperatorSchema = z.enum([
|
|
|
139
139
|
]);
|
|
140
140
|
var ConditionValueSchema = JsonValueSchema;
|
|
141
141
|
var V1StatementSchema = z.object({
|
|
142
|
+
id: z.string().optional(),
|
|
143
|
+
label: z.string().optional(),
|
|
142
144
|
effect: z.enum(["allow", "deny"]),
|
|
143
145
|
permissions: z.array(z.string()).min(1),
|
|
144
146
|
resources: z.array(z.string()).min(1),
|
|
145
147
|
conditions: z.array(ConditionSchema).optional()
|
|
146
148
|
}).strict();
|
|
147
149
|
var V2StatementSchema = z.object({
|
|
150
|
+
id: z.string().optional(),
|
|
151
|
+
label: z.string().optional(),
|
|
148
152
|
effect: z.enum(["allow", "ask", "deny"]),
|
|
149
153
|
permissions: z.array(z.string()).min(1),
|
|
150
154
|
resources: z.array(z.string()).min(1),
|
|
@@ -177,6 +181,14 @@ function getOpenApiSchema() {
|
|
|
177
181
|
type: "object",
|
|
178
182
|
required: ["effect", "permissions", "resources"],
|
|
179
183
|
properties: {
|
|
184
|
+
id: {
|
|
185
|
+
type: "string",
|
|
186
|
+
description: "Optional identifier for debugging and provenance. Included in statementHash for override targeting."
|
|
187
|
+
},
|
|
188
|
+
label: {
|
|
189
|
+
type: "string",
|
|
190
|
+
description: "Optional human-readable description of the statement. Excluded from statementHash for override targeting."
|
|
191
|
+
},
|
|
180
192
|
effect: {
|
|
181
193
|
type: "string",
|
|
182
194
|
enum: [...VALID_EFFECTS].sort(),
|
|
@@ -206,7 +218,7 @@ function getOpenApiSchema() {
|
|
|
206
218
|
minItems: 1,
|
|
207
219
|
description: "Path to the value to evaluate in the request context.",
|
|
208
220
|
items: {
|
|
209
|
-
|
|
221
|
+
anyOf: [{ type: "string" }, { type: "integer" }]
|
|
210
222
|
}
|
|
211
223
|
},
|
|
212
224
|
operator: {
|