isc-transforms-mcp 1.0.14 → 1.0.15

package/JSONS/sailpoint.isc.transforms.identityAttribute.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "sailpoint.isc.transforms.identityAttribute.schema.json",
   "title": "SailPoint ISC Transform Schema - identityAttribute",
-  "description": "Strict schema derived from SailPoint official Identity Attribute operation documentation. Retrieves the value of a user's identity attribute by its system (camel-cased) name.",
+  "description": "Strict schema for the SailPoint ISC identityAttribute transform. Retrieves the value of an identity attribute by its camelCase system name. IMPORTANT LIMITATION: This transform is NOT intended for use within another identity profile attribute's calculation. Due to multi-threaded identity processing, the referenced attribute may not yet exist or may hold stale data at evaluation time. Intended use cases are provisioning policies and entitlement request forms. For identity profile attribute mappings that need source account data, use accountAttribute instead.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -12,16 +12,18 @@
   ],
   "properties": {
     "type": {
-      "const": "identityAttribute"
+      "const": "identityAttribute",
+      "description": "Transform operation type. Must be exactly 'identityAttribute'."
     },
     "name": {
       "type": "string",
-      "minLength": 1
+      "minLength": 1,
+      "description": "Display name for this transform, shown in UI dropdowns and provisioning policy mappings."
     },
     "requiresPeriodicRefresh": {
       "type": "boolean",
       "default": false,
-      "description": "Whether the transform logic should be reevaluated every evening as part of identity refresh. Default false."
+      "description": "If true, re-evaluates this transform during the nightly identity refresh cycle. Default is false."
     },
     "attributes": {
       "type": "object",
@@ -29,15 +31,20 @@
       "required": [
         "name"
       ],
+      "description": "Required container for identityAttribute operation attributes.",
       "properties": {
         "name": {
           "type": "string",
           "minLength": 1,
-          "description": "System (camel-cased) name of the identity attribute to retrieve (e.g., 'email', 'uid')."
+          "description": "The camelCase system name of the identity attribute to retrieve. This is the internal attribute name, not the display label. Examples: 'uid' (SailPoint User Name), 'email', 'identificationNumber' (Employee Number), 'manager', 'department', 'displayName'. Find the system name in Admin UI → Identity Profiles → Identity Attributes."
         },
         "input": {
-          "description": "Optional explicit input data. If omitted, the transform uses input from the source+attribute combination configured in the UI. Modeled as a nested transform object.",
-          "oneOf": [
+          "description": "Optional explicit input data for this transform. If omitted, the transform uses the source and attribute combination configured in the identity profile UI. When provided, must be a nested transform object or a static string value.",
+          "anyOf": [
+            {
+              "type": "string",
+              "description": "Static string input value."
+            },
             {
               "$ref": "#/$defs/NestedTransform"
             }
@@ -49,7 +56,7 @@
   "$defs": {
     "NestedTransform": {
       "type": "object",
-      "description": "Nested transform object used as explicit input (name optional in docs).",
+      "description": "A nested transform object used as explicit input to this transform. Provides the input data that feeds the identityAttribute lookup. The 'name' field is optional in nested transforms per SailPoint docs.",
       "additionalProperties": false,
       "required": [
         "type",
@@ -57,18 +64,22 @@
       ],
       "properties": {
         "id": {
-          "type": "string"
+          "type": "string",
+          "description": "Optional ID when referencing an existing saved transform."
         },
         "name": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "Optional display name for the nested transform."
         },
         "type": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "The operation type of the nested transform (e.g., 'accountAttribute', 'static')."
         },
         "requiresPeriodicRefresh": {
-          "type": "boolean"
+          "type": "boolean",
+          "description": "Whether this nested transform re-evaluates during nightly refresh."
         },
         "attributes": {
           "type": "object",
@@ -80,25 +91,39 @@
   },
   "examples": [
     {
-      "attributes": {
-        "name": "email"
-      },
+      "name": "Get SailPoint User Name",
       "type": "identityAttribute",
-      "name": "Identity Attribute Transform"
-    },
-    {
       "attributes": {
         "name": "uid"
-      },
-      "type": "identityAttribute",
-      "name": "Identity Attribute Transform"
+      }
     },
     {
+      "name": "Get Employee Number",
+      "type": "identityAttribute",
       "attributes": {
         "name": "identificationNumber"
-      },
+      }
+    },
+    {
+      "name": "Get Manager",
       "type": "identityAttribute",
-      "name": "Identity Attribute Transform"
+      "attributes": {
+        "name": "manager"
+      }
+    },
+    {
+      "name": "Get Email with Explicit Input",
+      "type": "identityAttribute",
+      "attributes": {
+        "name": "email",
+        "input": {
+          "type": "accountAttribute",
+          "attributes": {
+            "sourceName": "HR Source",
+            "attributeName": "workEmail"
+          }
+        }
+      }
     }
   ]
 }

package/dist/transforms/lint.js

@@ -1073,7 +1073,40 @@ function lintStatic(attrs) {
     return msgs;
 }
 // ---------------------------------------------------------------------------
-// 25. indexOf / lastIndexOf
+// 25. identityAttribute — name format + critical use-case limitation
+// Docs: https://developer.sailpoint.com/docs/extensibility/transforms/operations/identity-attribute
+// ---------------------------------------------------------------------------
+function lintIdentityAttribute(attrs) {
+    const msgs = [];
+    // 1. name: must be a camelCase system name — no spaces, ideally no hyphens
+    const name = attrs?.name;
+    if (typeof name === "string" && name.trim().length > 0) {
+        if (/\s/.test(name)) {
+            push(msgs, "error", `attributes.name '${name}' contains whitespace. Identity attribute system names are camelCase with no spaces ` +
+                "(e.g., 'uid', 'email', 'identificationNumber'). Check the identity profile attribute's system name in the Admin UI.", "attributes.name");
+        }
+        else if (/-/.test(name)) {
+            push(msgs, "warn", `attributes.name '${name}' contains a hyphen. Identity attribute system names are camelCase ` +
+                "(e.g., 'identificationNumber', not 'identification-number'). Verify this is the exact system name shown in the Admin UI.", "attributes.name");
+        }
+    }
+    // 2. Critical use-case limitation — identityAttribute is NOT safe inside identity profile attribute calculations
+    push(msgs, "warn", "identityAttribute is NOT intended for use within another identity profile attribute's calculation. " +
+        "Due to multi-threaded identity processing, the referenced attribute may not yet exist or may hold stale data at evaluation time. " +
+        "Intended use: provisioning policies and entitlement request forms. " +
+        "If you need an account attribute value inside an identity profile mapping, use accountAttribute instead.", "type");
+    // 3. input: must be a nested transform object if provided
+    if (attrs?.input !== undefined) {
+        const inp = attrs.input;
+        if (!(isPlainObject(inp) && typeof inp.type === "string")) {
+            push(msgs, "warn", "input must be a nested transform object {type, attributes} providing explicit input data. " +
+                "If omitted, the transform uses the source+attribute combination configured in the identity profile UI.", "attributes.input");
+        }
+    }
+    return msgs;
+}
+// ---------------------------------------------------------------------------
+// 27. indexOf / lastIndexOf
 // ---------------------------------------------------------------------------
 function lintIndexOf(t, attrs) {
     const msgs = [];
@@ -1086,7 +1119,7 @@ function lintIndexOf(t, attrs) {
     return msgs;
 }
 // ---------------------------------------------------------------------------
-// 26. randomAlphaNumeric / randomNumeric — length
+// 28. randomAlphaNumeric / randomNumeric — length
 // ---------------------------------------------------------------------------
 function lintRandom(t, attrs) {
     const msgs = [];
@@ -1102,7 +1135,7 @@ function lintRandom(t, attrs) {
     return msgs;
 }
 // ---------------------------------------------------------------------------
-// 27. rfc5646 — format type check
+// 29. rfc5646 — format type check
 // ---------------------------------------------------------------------------
 function lintRfc5646(attrs) {
     const msgs = [];
@@ -1194,6 +1227,8 @@ export function lintTransform(input) {
         messages.push(...lintSubstring(attrs));
     if (requestedType === "static")
         messages.push(...lintStatic(attrs));
+    if (requestedType === "identityAttribute")
+        messages.push(...lintIdentityAttribute(attrs));
     if (requestedType === "indexOf" || requestedType === "lastIndexOf")
         messages.push(...lintIndexOf(requestedType, attrs));
     if (requestedType === "randomAlphaNumeric" || requestedType === "randomNumeric")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "isc-transforms-mcp",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "type": "module",
   "description": "MCP server for SailPoint Identity Security Cloud (ISC) Transform authoring — scaffold, strict lint, catalog, and safe upsert to live tenants.",
   "author": {