zuplo 6.67.32 → 6.68.0

package/docs/policies/rate-limit-inbound/schema.json

@@ -0,0 +1,134 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Rate Limiting",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Rate limiting policy to control the number of requests to your API. Supports multiple identification strategies (by user, IP, header, etc.) and can operate in strict or async mode for different performance characteristics.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "RateLimitInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "RateLimitInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["rateLimitBy", "requestsAllowed", "timeWindowMinutes"],
+          "properties": {
+            "rateLimitBy": {
+              "type": "string",
+              "default": "user",
+              "title": "RateLimitByType",
+              "enum": ["user", "ip", "function", "all"],
+              "description": "The identifying element of the request that enforces distinct rate limits. For example, you can limit by `user`, `ip`, `function` or `all` - function allows you to specify a simple function to create a string identifier to create a rate-limit group."
+            },
+            "requestsAllowed": {
+              "type": "integer",
+              "default": 1000,
+              "description": "The max number of requests allowed in the given time window."
+            },
+            "timeWindowMinutes": {
+              "type": "integer",
+              "default": 60,
+              "description": "The time window in which the requests are rate-limited. The count restarts after each window expires."
+            },
+            "identifier": {
+              "type": "object",
+              "additionalProperties": false,
+              "description": "The function that returns dynamic configuration data. Used only with `rateLimitBy=function`.",
+              "required": ["export", "module"],
+              "properties": {
+                "export": {
+                  "type": "string",
+                  "default": "$import(./modules/my-module)",
+                  "description": "used only with rateLimitBy=function. Specifies the export to load your custom bucket function, e.g. `default`, `rateLimitIdentifier`.",
+                  "examples": ["$import(./modules/my-module)"]
+                },
+                "module": {
+                  "type": "string",
+                  "default": "",
+                  "description": "Specifies the module to load your custom bucket function, in the format `$import(./modules/my-module)`.",
+                  "examples": ["default", "rateLimitIdentifier"]
+                }
+              }
+            },
+            "headerMode": {
+              "type": "string",
+              "default": "retry-after",
+              "title": "RateLimitHeaderMode",
+              "enum": ["none", "retry-after"],
+              "description": "Adds the retry-after header."
+            },
+            "throwOnFailure": {
+              "type": "boolean",
+              "default": false,
+              "description": "If true, the policy will throw an error in the event there is a problem connecting to the rate limit service."
+            },
+            "mode": {
+              "type": "string",
+              "default": "strict",
+              "title": "RateLimitMode",
+              "enum": ["strict", "async"],
+              "description": "The mode of the policy. If set to `async`, the policy will check if the request is over the rate limit without blocking. This can result in some requests allowed over the rate limit."
+            }
+          },
+          "examples": [
+            {
+              "rateLimitBy": "ip",
+              "requestsAllowed": 2,
+              "timeWindowMinutes": 1
+            },
+            {
+              "rateLimitBy": "function",
+              "identifier": {
+                "export": "$import(./modules/my-module)",
+                "module": "default"
+              }
+            }
+          ]
+        }
+      },
+      "examples": [
+        {
+          "export": "RateLimitInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "rateLimitBy": "ip",
+            "requestsAllowed": 2,
+            "timeWindowMinutes": 1
+          }
+        },
+        {
+          "export": "RateLimitInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "identifier": {
+              "export": "$import(./modules/my-module)",
+              "module": "default"
+            },
+            "rateLimitBy": "function"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/rbac-policy-inbound/intro.md

@@ -0,0 +1,3 @@
+RBAC policies can be built many ways depending on your requirements. This
+example shows how to perform a simple check of whether or not the current user
+is a member of a set of allowed roles.

package/docs/policies/rbac-policy-inbound/policy.ts

@@ -0,0 +1,42 @@
+import { HttpProblems, ZuploContext, ZuploRequest } from "@zuplo/runtime";
+
+interface PolicyOptions {
+  allowedRoles: string[];
+}
+
+export default async function (
+  request: ZuploRequest,
+  context: ZuploContext,
+  options: PolicyOptions,
+  policyName: string,
+) {
+  // Check that an authenticated user is set
+  // NOTE: This policy requires an authentication policy to run before
+  if (!request.user) {
+    context.log.error(
+      "User isn't authenticated. A authorization policy must come before the RBAC policy.",
+    );
+    return HttpProblems.unauthorized(request, context);
+  }
+
+  // Check that the user has roles
+  if (!request.user.data.roles) {
+    context.log.error("The user isn't assigned any roles.");
+    return HttpProblems.unauthorized(request, context);
+  }
+
+  // Check that the user has one of the allowed roles
+  if (
+    !options.allowedRoles.some((allowedRole) =>
+      request.user?.data.roles.includes(allowedRole),
+    )
+  ) {
+    context.log.error(
+      `The user '${request.user.sub}' isn't authorized to perform this action.`,
+    );
+    return HttpProblems.forbidden(request, context);
+  }
+
+  // If they made it here, they are authorized
+  return request;
+}

package/docs/policies/rbac-policy-inbound/schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/acl-policy-inbound.json",
+  "type": "object",
+  "title": "RBAC Authorization",
+  "isCustom": true,
+  "products": ["api-gateway"],
+  "description": "The RBAC authorization inbound policy limits access to resources based on the roles of the authenticated user.",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "default",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(./modules/YOUR_MODULE)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "type": "object",
+          "description": "The options for this policy",
+          "required": ["policies"],
+          "properties": {
+            "allowedRoles": {
+              "type": "array",
+              "default": [],
+              "description": "The roles allowed to access the resource",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "_name": "basic",
+          "export": "default",
+          "module": "$import(./modules/YOUR_MODULE)",
+          "options": {
+            "allowedRoles": ["admin", "editor"]
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/readme-metrics-inbound/doc.md

@@ -0,0 +1 @@
+![Readme API Calls Dashboard](https://cdn.zuplo.com/assets/071b2ead-7769-413b-a66a-133ae6fd755d.png)

package/docs/policies/readme-metrics-inbound/intro.md

@@ -0,0 +1,3 @@
+[Readme](https://readme.com) is a developer Documentation and metrics service.
+This policy pushes the request/response data to their ingestion endpoint so you
+can see your Zuplo API traffic in their API calls dashboard.

package/docs/policies/readme-metrics-inbound/schema.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Readme Metrics",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Readme is a developer documentation and API metrics company. This policy pushes logs to their API calls dashboard.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "ReadmeMetricsInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "ReadmeMeteringInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy. Many of them can be overridden at the code level in a request using the `AmberfloMeteringPolicy.setRequestProperties` method.",
+          "additionalProperties": false,
+          "required": ["apiKey"],
+          "properties": {
+            "apiKey": {
+              "type": "string",
+              "examples": ["$env(README_API_KEY)"],
+              "description": "The API key to use when sending metrics calls to Readme."
+            },
+            "userLabelPropertyPath": {
+              "type": "string",
+              "x-show-example": false,
+              "default": ".sub",
+              "description": "This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property."
+            },
+            "userEmailPropertyPath": {
+              "type": "string",
+              "default": "",
+              "description": "This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property."
+            },
+            "development": {
+              "type": "boolean",
+              "description": "Whether the data should be ingested as 'development' mode or not. Defaults to true for working-copy and false for all other environments."
+            },
+            "useFullRequestPath": {
+              "type": "boolean",
+              "default": false,
+              "description": "When true, Zuplo sends the full request path (which might contain sensitive information). By default, we only send the route path which should not contain sensitive information."
+            },
+            "url": {
+              "type": "string",
+              "default": "https://metrics.readme.io/request",
+              "description": "The URL to send metering events. This is useful for testing purposes."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "ReadmeMetricsInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "apiKey": "$env(README_API_KEY)",
+            "url": "https://metrics.readme.io/request",
+            "useFullRequestPath": false,
+            "userEmailPropertyPath": ""
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/remove-headers-inbound/schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Remove Request Headers",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Remove headers from the incoming request.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "RemoveHeadersInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "RemoveHeadersInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["headers"],
+          "properties": {
+            "headers": {
+              "type": "array",
+              "description": "An array of headers to remove from the incoming request.",
+              "examples": [["x-request-id", "content-type"]],
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "RemoveHeadersInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "headers": ["x-request-id", "content-type"]
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/remove-headers-outbound/schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Remove Response Headers",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Remove configured headers from the outgoing response.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "RemoveHeadersOutboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "RemoveHeadersOutboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["headers"],
+          "properties": {
+            "headers": {
+              "type": "array",
+              "description": "An array of headers to be removed from the outgoing response.",
+              "examples": [["x-amz-content-sha256", "x-amz-date"]],
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "RemoveHeadersOutboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "headers": ["x-amz-content-sha256", "x-amz-date"]
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/remove-query-params-inbound/schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Remove Query Parameters",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Remove query parameters from the incoming request",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "RemoveQueryParamsInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "RemoveQueryParamsInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["params"],
+          "properties": {
+            "params": {
+              "type": "array",
+              "description": "An array of query parameters to be removed from the incoming request.",
+              "examples": [["param1", "param2"]],
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "RemoveQueryParamsInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "params": ["param1", "param2"]
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/replace-string-outbound/schema.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Replace String in Response Body",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Replace a string in the incoming request body",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "ReplaceStringOutboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "ReplaceStringOutboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["mode", "match", "replaceWith"],
+          "properties": {
+            "mode": {
+              "type": "string",
+              "enum": ["regexp", "string"],
+              "examples": ["regexp"],
+              "description": "The type of string replacement to perform."
+            },
+            "match": {
+              "type": "string",
+              "examples": ["/(\\d+)/g"],
+              "description": "The pattern to match."
+            },
+            "replaceWith": {
+              "type": "string",
+              "examples": ["1234"],
+              "description": "The value to each match is replaced with."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "ReplaceStringOutboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "match": "/(\\d+)/g",
+            "mode": "regexp",
+            "replaceWith": "1234"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/request-size-limit-inbound/schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "type": "object",
+  "title": "Request Size Limit",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "products": ["api-gateway"],
+  "description": "Enforces a maximum size in bytes of the incoming request.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "RequestSizeLimitInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "RequestSizeLimitInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["maxSizeInBytes"],
+          "properties": {
+            "maxSizeInBytes": {
+              "type": "number",
+              "examples": [10000],
+              "description": "The maximum size of the request in bytes."
+            },
+            "trustContentLengthHeader": {
+              "type": "boolean",
+              "description": "If true, the policy will reject any request with a `content-length` header in excess of `maxSizeInBytes` bytes value, but will not verify the actual size of the request. This is more efficient and offers slightly better memory usage but should only be used if you trust/control the clients calling the gateway to send an accurate content-length. If false, the gateway will actually verify the request size and reject any request with a size in excess of the stated maximum."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "RequestSizeLimitInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "maxSizeInBytes": 10000
+          }
+        }
+      ]
+    }
+  }
+}