isc-transforms-mcp 1.0.8 → 1.0.9

package/JSONS/sailpoint.isc.transforms.conditional.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "sailpoint.isc.transforms.conditional.schema.json",
   "title": "SailPoint ISC Transform Schema - conditional",
-  "description": "Strict schema derived from SailPoint official Conditional operation documentation. Allows dynamic variables within attributes as additional properties (per docs). Runtime considerations (not fully enforceable by JSON Schema): operands in expression cannot be null; string comparisons are case-sensitive; expression operator must be 'eq'.",
+  "description": "Strict schema for the SailPoint ISC Conditional transform. Evaluates a 'ValueA eq ValueB' expression and returns positiveCondition (true) or negativeCondition (false). Only 'eq' is supported — other operators throw IllegalArgumentException at runtime. Comparisons are case-sensitive. Operands cannot be null at runtime.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -12,31 +12,22 @@
   ],
   "properties": {
     "type": {
-      "const": "conditional"
+      "const": "conditional",
+      "description": "Transform operation type. Must be exactly 'conditional'."
     },
     "name": {
       "type": "string",
-      "minLength": 1
+      "minLength": 1,
+      "description": "Display name for this transform, shown in UI dropdowns and identity profile mappings."
     },
     "requiresPeriodicRefresh": {
       "type": "boolean",
       "default": false,
-      "description": "Whether the transform logic should be reevaluated every evening as part of identity refresh. Default false."
+      "description": "If true, re-evaluates this transform during the nightly identity refresh cycle. Default is false."
     },
     "attributes": {
       "type": "object",
-      "description": "Conditional logic configuration, plus optional dynamic variables (per docs).",
-      "additionalProperties": {
-        "description": "Dynamic variables referenced via $variableName. Can be string literals or nested transforms.",
-        "anyOf": [
-          {
-            "type": "string"
-          },
-          {
-            "$ref": "#/$defs/NestedTransform"
-          }
-        ]
-      },
+      "description": "Conditional logic configuration. Required: expression, positiveCondition, negativeCondition. Optional: dynamic variable keys (any additional key) whose values are static strings or nested transforms, referenced via $variableName in the expression and conditions.",
       "required": [
         "expression",
         "positiveCondition",
@@ -46,26 +37,36 @@
         "expression": {
           "type": "string",
           "minLength": 1,
-          "description": "Comparison statement of the form 'ValueA eq ValueB'. Only 'eq' is valid.",
-          "pattern": "^.*\\beq\\b.*$"
+          "pattern": "^.+\\s+eq\\s+.+$",
+          "description": "Equality expression of the form '<ValueA> eq <ValueB>'. RULES: (1) Only 'eq' operator is supported — !=, ==, >, <, ne, gt, lt etc. throw IllegalArgumentException. (2) Comparisons are case-sensitive: 'Engineering' != 'engineering'. (3) Operands cannot be null at runtime. (4) Variables are referenced with $variableName syntax and must be declared as keys in attributes."
         },
         "positiveCondition": {
           "type": "string",
-          "minLength": 0,
-          "description": "Output when expression evaluates to true. May reference a dynamic variable via $var."
+          "description": "Value returned when expression evaluates to true. Can be a static string (e.g., 'Active') or a $variableName reference to a declared variable in attributes. Can be empty string to return a blank value."
         },
         "negativeCondition": {
           "type": "string",
-          "minLength": 0,
-          "description": "Output when expression evaluates to false. May reference a dynamic variable via $var."
+          "description": "Value returned when expression evaluates to false. Can be a static string (e.g., 'Inactive') or a $variableName reference to a declared variable in attributes. Can be empty string to return a blank value."
         }
+      },
+      "additionalProperties": {
+        "description": "Dynamic variable declaration. Key becomes the variable name, referenced as $keyName in expression, positiveCondition, or negativeCondition. Value must be a static string or a nested transform object.",
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Static string value for this variable."
+          },
+          {
+            "$ref": "#/$defs/NestedTransform"
+          }
+        ]
       }
     }
   },
   "$defs": {
     "NestedTransform": {
       "type": "object",
-      "description": "Nested transform object used as a dynamic variable. Docs examples commonly omit 'name' in nested transforms.",
+      "description": "Nested transform object used as a dynamic variable. The 'name' field is optional in nested transforms per SailPoint docs examples.",
       "additionalProperties": false,
       "required": [
         "type",
@@ -73,18 +74,22 @@
       ],
       "properties": {
         "id": {
-          "type": "string"
+          "type": "string",
+          "description": "Optional transform ID when referencing an existing saved transform."
         },
         "name": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "Optional display name for the nested transform."
         },
         "type": {
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "The transform operation type (e.g., 'accountAttribute', 'static', 'dateFormat')."
         },
         "requiresPeriodicRefresh": {
-          "type": "boolean"
+          "type": "boolean",
+          "description": "Whether this nested transform re-evaluates during nightly refresh."
         },
         "attributes": {
           "type": "object",
@@ -97,7 +102,7 @@
   "examples": [
     {
       "type": "conditional",
-      "name": "Test Conditional Transform",
+      "name": "Department Science Check",
       "attributes": {
         "expression": "$department eq Science",
         "positiveCondition": "true",
@@ -113,7 +118,7 @@
     },
     {
       "type": "conditional",
-      "name": "Test Conditional Transform (dynamic result)",
+      "name": "Assign Building by Department",
       "attributes": {
         "expression": "$department eq Science",
         "positiveCondition": "$scienceBuilding",
@@ -138,6 +143,25 @@
           }
         }
       }
+    },
+    {
+      "type": "conditional",
+      "name": "Active Employee Flag",
+      "requiresPeriodicRefresh": true,
+      "attributes": {
+        "expression": "$workerStatus eq active",
+        "positiveCondition": "true",
+        "negativeCondition": "false",
+        "workerStatus": {
+          "type": "accountAttribute",
+          "attributes": {
+            "applicationName": "corp-hr-system",
+            "attributeName": "WORKER_STATUS__c",
+            "accountSortAttribute": "created",
+            "accountSortDescending": true
+          }
+        }
+      }
     }
   ]
 }

package/dist/transforms/lint.js

@@ -263,28 +263,88 @@ function lintAccountAttribute(attrs) {
 // ---------------------------------------------------------------------------
 function lintConditional(attrs) {
     const msgs = [];
+    const RESERVED = new Set(["expression", "positiveCondition", "negativeCondition"]);
+    // Helper: extract all $varName references from a string
+    const extractVars = (s) => (s.match(/\$([A-Za-z_][A-Za-z0-9_]*)/g) ?? []).map((v) => v.slice(1));
+    // All non-reserved keys in attributes are declared dynamic variables
+    const declaredVars = new Set(Object.keys(attrs ?? {}).filter((k) => !RESERVED.has(k)));
+    // --- 1. expression: required, non-empty ---
     const exprRaw = attrs?.expression;
     const expr = String(exprRaw ?? "").trim();
     if (!expr) {
         push(msgs, "error", "Missing required attribute: expression.", "attributes.expression");
         return msgs;
     }
+    // --- 2. Forbidden operators (using any of these throws IllegalArgumentException at runtime) ---
     const forbidden = /(!=|==|>=|<=|>|<|\bne\b|\bgt\b|\blt\b|\bge\b|\ble\b)/i;
     if (forbidden.test(expr)) {
-        push(msgs, "error", `Unsupported operator in expression: '${expr}'. Only 'eq' comparator is supported (e.g., '$var eq value').`, "attributes.expression");
+        push(msgs, "error", `Unsupported operator in expression '${expr}'. ` +
+            "Only 'eq' is supported — using !=, ==, >, <, ne, gt, lt, ge, le throws IllegalArgumentException at runtime.", "attributes.expression");
     }
-    if (!/\beq\b/i.test(expr)) {
-        push(msgs, "error", `Conditional expression must use 'eq' comparator only. Got: '${expr}'.`, "attributes.expression");
+    // --- 3. Must contain exactly one 'eq' ---
+    const eqMatches = expr.match(/\beq\b/gi) ?? [];
+    if (eqMatches.length === 0) {
+        push(msgs, "error", `Conditional expression must use the 'eq' comparator: '<ValueA> eq <ValueB>'. Got: '${expr}'.`, "attributes.expression");
     }
+    else if (eqMatches.length > 1) {
+        push(msgs, "error", `Expression must contain exactly one 'eq'. Found ${eqMatches.length} occurrences in: '${expr}'. ` +
+            "Nest multiple conditions using separate conditional transforms if needed.", "attributes.expression");
+    }
+    // --- 4. Both sides of 'eq' must be non-empty ---
     const parts = expr.split(/\beq\b/i);
-    if (parts.length !== 2 || parts[0].trim().length === 0 || parts[1].trim().length === 0) {
-        push(msgs, "error", `Conditional expression must follow '<ValueA> eq <ValueB>' format. Got: '${expr}'.`, "attributes.expression");
+    const valueA = parts[0]?.trim() ?? "";
+    const valueB = parts[1]?.trim() ?? "";
+    if (parts.length !== 2 || valueA.length === 0 || valueB.length === 0) {
+        push(msgs, "error", `Expression must follow '<ValueA> eq <ValueB>' with non-empty values on both sides. Got: '${expr}'.`, "attributes.expression");
+    }
+    // --- 5. Case-sensitivity info for literal operands ---
+    if (valueA.length > 0 && valueB.length > 0) {
+        const aIsVar = valueA.startsWith("$");
+        const bIsVar = valueB.startsWith("$");
+        if (!aIsVar || !bIsVar) {
+            push(msgs, "info", "Conditional comparisons are case-sensitive. " +
+                `'${!aIsVar ? valueA : valueB}' must match the source value exactly — ` +
+                "'Engineering' and 'engineering' are treated as different values.", "attributes.expression");
+        }
+    }
+    // --- 6. Cross-check $variable references in expression ---
+    if (valueA.length > 0 && valueB.length > 0) {
+        for (const varName of extractVars(expr)) {
+            if (!declaredVars.has(varName)) {
+                push(msgs, "error", `Expression references '$${varName}' but no matching variable key '${varName}' is declared in attributes. ` +
+                    `Add a '${varName}' key to attributes as a static string or nested transform.`, "attributes.expression");
+            }
+        }
     }
-    if (typeof attrs?.positiveCondition !== "string") {
-        push(msgs, "error", "positiveCondition must be a string.", "attributes.positiveCondition");
+    // --- 7. positiveCondition: type check + $var cross-check ---
+    const posRaw = attrs?.positiveCondition;
+    if (posRaw !== undefined) {
+        if (typeof posRaw !== "string") {
+            push(msgs, "error", "positiveCondition must be a string — either a static value or a $variableName reference.", "attributes.positiveCondition");
+        }
+        else {
+            for (const varName of extractVars(posRaw)) {
+                if (!declaredVars.has(varName)) {
+                    push(msgs, "error", `positiveCondition references '$${varName}' but no matching variable key '${varName}' is declared in attributes. ` +
+                        `Add a '${varName}' key to attributes as a static string or nested transform.`, "attributes.positiveCondition");
+                }
+            }
+        }
     }
-    if (typeof attrs?.negativeCondition !== "string") {
-        push(msgs, "error", "negativeCondition must be a string.", "attributes.negativeCondition");
+    // --- 8. negativeCondition: type check + $var cross-check ---
+    const negRaw = attrs?.negativeCondition;
+    if (negRaw !== undefined) {
+        if (typeof negRaw !== "string") {
+            push(msgs, "error", "negativeCondition must be a string — either a static value or a $variableName reference.", "attributes.negativeCondition");
+        }
+        else {
+            for (const varName of extractVars(negRaw)) {
+                if (!declaredVars.has(varName)) {
+                    push(msgs, "error", `negativeCondition references '$${varName}' but no matching variable key '${varName}' is declared in attributes. ` +
+                        `Add a '${varName}' key to attributes as a static string or nested transform.`, "attributes.negativeCondition");
+                }
+            }
+        }
     }
     return msgs;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "isc-transforms-mcp",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "type": "module",
   "description": "MCP server for SailPoint Identity Security Cloud (ISC) Transform authoring — scaffold, strict lint, catalog, and safe upsert to live tenants.",
   "author": {