@zapier/policy-schema 0.7.1 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +7 -1
- package/dist/index.d.cts +58 -2
- package/dist/index.d.ts +58 -2
- package/dist/index.mjs +7 -1
- package/package.json +1 -1
package/dist/index.cjs
CHANGED
|
@@ -141,12 +141,14 @@ var OperatorSchema = zod.z.enum([
|
|
|
141
141
|
]);
|
|
142
142
|
var ConditionValueSchema = JsonValueSchema;
|
|
143
143
|
var V1StatementSchema = zod.z.object({
|
|
144
|
+
id: zod.z.string().optional(),
|
|
144
145
|
effect: zod.z.enum(["allow", "deny"]),
|
|
145
146
|
permissions: zod.z.array(zod.z.string()).min(1),
|
|
146
147
|
resources: zod.z.array(zod.z.string()).min(1),
|
|
147
148
|
conditions: zod.z.array(ConditionSchema).optional()
|
|
148
149
|
}).strict();
|
|
149
150
|
var V2StatementSchema = zod.z.object({
|
|
151
|
+
id: zod.z.string().optional(),
|
|
150
152
|
effect: zod.z.enum(["allow", "ask", "deny"]),
|
|
151
153
|
permissions: zod.z.array(zod.z.string()).min(1),
|
|
152
154
|
resources: zod.z.array(zod.z.string()).min(1),
|
|
@@ -179,6 +181,10 @@ function getOpenApiSchema() {
|
|
|
179
181
|
type: "object",
|
|
180
182
|
required: ["effect", "permissions", "resources"],
|
|
181
183
|
properties: {
|
|
184
|
+
id: {
|
|
185
|
+
type: "string",
|
|
186
|
+
description: "Optional identifier for debugging and provenance. Included in canonical hash."
|
|
187
|
+
},
|
|
182
188
|
effect: {
|
|
183
189
|
type: "string",
|
|
184
190
|
enum: [...VALID_EFFECTS].sort(),
|
|
@@ -208,7 +214,7 @@ function getOpenApiSchema() {
|
|
|
208
214
|
minItems: 1,
|
|
209
215
|
description: "Path to the value to evaluate in the request context.",
|
|
210
216
|
items: {
|
|
211
|
-
|
|
217
|
+
anyOf: [{ type: "string" }, { type: "integer" }]
|
|
212
218
|
}
|
|
213
219
|
},
|
|
214
220
|
operator: {
|
package/dist/index.d.cts
CHANGED
|
@@ -21,6 +21,7 @@ interface Condition {
|
|
|
21
21
|
}
|
|
22
22
|
type Effect = "allow" | "ask" | "deny";
|
|
23
23
|
interface Statement {
|
|
24
|
+
id?: string;
|
|
24
25
|
effect: Effect;
|
|
25
26
|
permissions: string[];
|
|
26
27
|
resources: string[];
|
|
@@ -35,9 +36,52 @@ interface PolicyRequest {
|
|
|
35
36
|
resource: string;
|
|
36
37
|
context?: Record<string, unknown>;
|
|
37
38
|
}
|
|
39
|
+
/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
|
|
40
|
+
type CanonicalHash = string & {
|
|
41
|
+
readonly __brand: "CanonicalHash";
|
|
42
|
+
};
|
|
43
|
+
interface OverrideBase {
|
|
44
|
+
id?: string;
|
|
45
|
+
statementHash: CanonicalHash;
|
|
46
|
+
effect: "allow";
|
|
47
|
+
}
|
|
48
|
+
type Override = (OverrideBase & {
|
|
49
|
+
match: "any";
|
|
50
|
+
}) | (OverrideBase & {
|
|
51
|
+
contextHash: CanonicalHash;
|
|
52
|
+
}) | (OverrideBase & {
|
|
53
|
+
conditionals: Condition[];
|
|
54
|
+
});
|
|
55
|
+
interface ConditionTrace {
|
|
56
|
+
condition: Condition;
|
|
57
|
+
resolved: unknown;
|
|
58
|
+
passed: boolean;
|
|
59
|
+
}
|
|
60
|
+
interface OverrideTrace {
|
|
61
|
+
override: Override;
|
|
62
|
+
matched: boolean;
|
|
63
|
+
conditionResults?: ConditionTrace[];
|
|
64
|
+
}
|
|
65
|
+
interface StatementTrace {
|
|
66
|
+
statement: Statement;
|
|
67
|
+
permissionMatched: boolean;
|
|
68
|
+
resourceMatched: boolean;
|
|
69
|
+
conditionResults?: ConditionTrace[];
|
|
70
|
+
passed: boolean;
|
|
71
|
+
overrides?: OverrideTrace[];
|
|
72
|
+
}
|
|
73
|
+
interface EvaluatePolicyOptions {
|
|
74
|
+
policy: Policy;
|
|
75
|
+
request: PolicyRequest;
|
|
76
|
+
overrides?: Override[];
|
|
77
|
+
trace?: boolean;
|
|
78
|
+
}
|
|
79
|
+
type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
|
|
38
80
|
interface PolicyResult {
|
|
39
81
|
effect: Effect;
|
|
40
|
-
|
|
82
|
+
explicit: boolean;
|
|
83
|
+
reason: PolicyReason;
|
|
84
|
+
statements: StatementTrace[];
|
|
41
85
|
}
|
|
42
86
|
interface ParsedUrl {
|
|
43
87
|
scheme: string;
|
|
@@ -52,6 +96,14 @@ interface PolicyHttpRequest {
|
|
|
52
96
|
headers: Record<string, string | string[]>;
|
|
53
97
|
body: string | null;
|
|
54
98
|
body_json: unknown;
|
|
99
|
+
connection_id?: string;
|
|
100
|
+
}
|
|
101
|
+
interface PolicyActionRequest {
|
|
102
|
+
connection_id?: string;
|
|
103
|
+
selected_api?: string;
|
|
104
|
+
action_type?: string;
|
|
105
|
+
action_key?: string;
|
|
106
|
+
inputs?: Record<string, unknown>;
|
|
55
107
|
}
|
|
56
108
|
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
109
|
interface OpenApiSchema {
|
|
@@ -63,6 +115,7 @@ interface OpenApiSchema {
|
|
|
63
115
|
description?: string;
|
|
64
116
|
minItems?: number;
|
|
65
117
|
oneOf?: OpenApiSchema[];
|
|
118
|
+
anyOf?: OpenApiSchema[];
|
|
66
119
|
}
|
|
67
120
|
|
|
68
121
|
/** Current policy document version. */
|
|
@@ -164,6 +217,7 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
164
217
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
218
|
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
166
219
|
declare const StatementSchema: z.ZodObject<{
|
|
220
|
+
id: z.ZodOptional<z.ZodString>;
|
|
167
221
|
effect: z.ZodEnum<{
|
|
168
222
|
allow: "allow";
|
|
169
223
|
ask: "ask";
|
|
@@ -225,6 +279,7 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
225
279
|
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
226
280
|
version: z.ZodLiteral<1>;
|
|
227
281
|
statements: z.ZodArray<z.ZodObject<{
|
|
282
|
+
id: z.ZodOptional<z.ZodString>;
|
|
228
283
|
effect: z.ZodEnum<{
|
|
229
284
|
allow: "allow";
|
|
230
285
|
deny: "deny";
|
|
@@ -285,6 +340,7 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
285
340
|
}, z.core.$strict>, z.ZodObject<{
|
|
286
341
|
version: z.ZodLiteral<2>;
|
|
287
342
|
statements: z.ZodArray<z.ZodObject<{
|
|
343
|
+
id: z.ZodOptional<z.ZodString>;
|
|
288
344
|
effect: z.ZodEnum<{
|
|
289
345
|
allow: "allow";
|
|
290
346
|
ask: "ask";
|
|
@@ -352,4 +408,4 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
352
408
|
*/
|
|
353
409
|
declare function getOpenApiSchema(): OpenApiSchema;
|
|
354
410
|
|
|
355
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
|
411
|
+
export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.d.ts
CHANGED
|
@@ -21,6 +21,7 @@ interface Condition {
|
|
|
21
21
|
}
|
|
22
22
|
type Effect = "allow" | "ask" | "deny";
|
|
23
23
|
interface Statement {
|
|
24
|
+
id?: string;
|
|
24
25
|
effect: Effect;
|
|
25
26
|
permissions: string[];
|
|
26
27
|
resources: string[];
|
|
@@ -35,9 +36,52 @@ interface PolicyRequest {
|
|
|
35
36
|
resource: string;
|
|
36
37
|
context?: Record<string, unknown>;
|
|
37
38
|
}
|
|
39
|
+
/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
|
|
40
|
+
type CanonicalHash = string & {
|
|
41
|
+
readonly __brand: "CanonicalHash";
|
|
42
|
+
};
|
|
43
|
+
interface OverrideBase {
|
|
44
|
+
id?: string;
|
|
45
|
+
statementHash: CanonicalHash;
|
|
46
|
+
effect: "allow";
|
|
47
|
+
}
|
|
48
|
+
type Override = (OverrideBase & {
|
|
49
|
+
match: "any";
|
|
50
|
+
}) | (OverrideBase & {
|
|
51
|
+
contextHash: CanonicalHash;
|
|
52
|
+
}) | (OverrideBase & {
|
|
53
|
+
conditionals: Condition[];
|
|
54
|
+
});
|
|
55
|
+
interface ConditionTrace {
|
|
56
|
+
condition: Condition;
|
|
57
|
+
resolved: unknown;
|
|
58
|
+
passed: boolean;
|
|
59
|
+
}
|
|
60
|
+
interface OverrideTrace {
|
|
61
|
+
override: Override;
|
|
62
|
+
matched: boolean;
|
|
63
|
+
conditionResults?: ConditionTrace[];
|
|
64
|
+
}
|
|
65
|
+
interface StatementTrace {
|
|
66
|
+
statement: Statement;
|
|
67
|
+
permissionMatched: boolean;
|
|
68
|
+
resourceMatched: boolean;
|
|
69
|
+
conditionResults?: ConditionTrace[];
|
|
70
|
+
passed: boolean;
|
|
71
|
+
overrides?: OverrideTrace[];
|
|
72
|
+
}
|
|
73
|
+
interface EvaluatePolicyOptions {
|
|
74
|
+
policy: Policy;
|
|
75
|
+
request: PolicyRequest;
|
|
76
|
+
overrides?: Override[];
|
|
77
|
+
trace?: boolean;
|
|
78
|
+
}
|
|
79
|
+
type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
|
|
38
80
|
interface PolicyResult {
|
|
39
81
|
effect: Effect;
|
|
40
|
-
|
|
82
|
+
explicit: boolean;
|
|
83
|
+
reason: PolicyReason;
|
|
84
|
+
statements: StatementTrace[];
|
|
41
85
|
}
|
|
42
86
|
interface ParsedUrl {
|
|
43
87
|
scheme: string;
|
|
@@ -52,6 +96,14 @@ interface PolicyHttpRequest {
|
|
|
52
96
|
headers: Record<string, string | string[]>;
|
|
53
97
|
body: string | null;
|
|
54
98
|
body_json: unknown;
|
|
99
|
+
connection_id?: string;
|
|
100
|
+
}
|
|
101
|
+
interface PolicyActionRequest {
|
|
102
|
+
connection_id?: string;
|
|
103
|
+
selected_api?: string;
|
|
104
|
+
action_type?: string;
|
|
105
|
+
action_key?: string;
|
|
106
|
+
inputs?: Record<string, unknown>;
|
|
55
107
|
}
|
|
56
108
|
/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
|
|
57
109
|
interface OpenApiSchema {
|
|
@@ -63,6 +115,7 @@ interface OpenApiSchema {
|
|
|
63
115
|
description?: string;
|
|
64
116
|
minItems?: number;
|
|
65
117
|
oneOf?: OpenApiSchema[];
|
|
118
|
+
anyOf?: OpenApiSchema[];
|
|
66
119
|
}
|
|
67
120
|
|
|
68
121
|
/** Current policy document version. */
|
|
@@ -164,6 +217,7 @@ declare const OperatorSchema: z.ZodEnum<{
|
|
|
164
217
|
declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
|
|
165
218
|
/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
|
|
166
219
|
declare const StatementSchema: z.ZodObject<{
|
|
220
|
+
id: z.ZodOptional<z.ZodString>;
|
|
167
221
|
effect: z.ZodEnum<{
|
|
168
222
|
allow: "allow";
|
|
169
223
|
ask: "ask";
|
|
@@ -225,6 +279,7 @@ declare const StatementSchema: z.ZodObject<{
|
|
|
225
279
|
declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
226
280
|
version: z.ZodLiteral<1>;
|
|
227
281
|
statements: z.ZodArray<z.ZodObject<{
|
|
282
|
+
id: z.ZodOptional<z.ZodString>;
|
|
228
283
|
effect: z.ZodEnum<{
|
|
229
284
|
allow: "allow";
|
|
230
285
|
deny: "deny";
|
|
@@ -285,6 +340,7 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
285
340
|
}, z.core.$strict>, z.ZodObject<{
|
|
286
341
|
version: z.ZodLiteral<2>;
|
|
287
342
|
statements: z.ZodArray<z.ZodObject<{
|
|
343
|
+
id: z.ZodOptional<z.ZodString>;
|
|
288
344
|
effect: z.ZodEnum<{
|
|
289
345
|
allow: "allow";
|
|
290
346
|
ask: "ask";
|
|
@@ -352,4 +408,4 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
|
|
|
352
408
|
*/
|
|
353
409
|
declare function getOpenApiSchema(): OpenApiSchema;
|
|
354
410
|
|
|
355
|
-
export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
|
411
|
+
export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
|
package/dist/index.mjs
CHANGED
|
@@ -139,12 +139,14 @@ var OperatorSchema = z.enum([
|
|
|
139
139
|
]);
|
|
140
140
|
var ConditionValueSchema = JsonValueSchema;
|
|
141
141
|
var V1StatementSchema = z.object({
|
|
142
|
+
id: z.string().optional(),
|
|
142
143
|
effect: z.enum(["allow", "deny"]),
|
|
143
144
|
permissions: z.array(z.string()).min(1),
|
|
144
145
|
resources: z.array(z.string()).min(1),
|
|
145
146
|
conditions: z.array(ConditionSchema).optional()
|
|
146
147
|
}).strict();
|
|
147
148
|
var V2StatementSchema = z.object({
|
|
149
|
+
id: z.string().optional(),
|
|
148
150
|
effect: z.enum(["allow", "ask", "deny"]),
|
|
149
151
|
permissions: z.array(z.string()).min(1),
|
|
150
152
|
resources: z.array(z.string()).min(1),
|
|
@@ -177,6 +179,10 @@ function getOpenApiSchema() {
|
|
|
177
179
|
type: "object",
|
|
178
180
|
required: ["effect", "permissions", "resources"],
|
|
179
181
|
properties: {
|
|
182
|
+
id: {
|
|
183
|
+
type: "string",
|
|
184
|
+
description: "Optional identifier for debugging and provenance. Included in canonical hash."
|
|
185
|
+
},
|
|
180
186
|
effect: {
|
|
181
187
|
type: "string",
|
|
182
188
|
enum: [...VALID_EFFECTS].sort(),
|
|
@@ -206,7 +212,7 @@ function getOpenApiSchema() {
|
|
|
206
212
|
minItems: 1,
|
|
207
213
|
description: "Path to the value to evaluate in the request context.",
|
|
208
214
|
items: {
|
|
209
|
-
|
|
215
|
+
anyOf: [{ type: "string" }, { type: "integer" }]
|
|
210
216
|
}
|
|
211
217
|
},
|
|
212
218
|
operator: {
|