zuplo 6.72.13 → 6.72.15

package/docs/policies/hmac-auth-inbound/policy.ts

@@ -1,70 +0,0 @@
-import { HttpProblems, ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-interface PolicyOptions {
-  secret: string;
-  headerName: string;
-}
-
-export default async function (
-  request: ZuploRequest,
-  context: ZuploContext,
-  options: PolicyOptions,
-  policyName: string,
-) {
-  // Validate the policy options
-  if (typeof options.secret !== "string") {
-    throw new Error(
-      `The option 'secret' on policy '${policyName}' must be a string. Received ${typeof options.secret}.`,
-    );
-  }
-  if (typeof options.headerName !== "string") {
-    throw new Error(
-      `The option 'headerName' on policy '${policyName}' must be a string. Received ${typeof options.headerName}.`,
-    );
-  }
-
-  // Get the authorization header
-  const token = request.headers.get(options.headerName);
-
-  // No auth header, unauthorized
-  if (!token) {
-    return HttpProblems.unauthorized(request, context);
-  }
-
-  // Convert the hex encoded token to an Uint8Array
-  const tokenData = new Uint8Array(
-    token.match(/../g)!.map((h) => parseInt(h, 16)),
-  );
-
-  // Get the data to verify
-  // This could be anything (headers, query parameter, etc.)
-  // For this example, we will just verify the entire body value
-  const data = await request.text();
-
-  // Create a crypto key from a secret stored as an environment variable
-  const encoder = new TextEncoder();
-  const encodedSecret = encoder.encode(options.secret);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encodedSecret,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"],
-  );
-
-  // Verify that the data
-  const verified = await crypto.subtle.verify(
-    "HMAC",
-    key,
-    tokenData,
-    encoder.encode(data),
-  );
-
-  // Check if the data is verified, if not return unauthorized
-  if (!verified) {
-    return HttpProblems.unauthorized(request, context);
-  }
-
-  // Request is authorized, continue
-  return request;
-}

package/docs/policies/hmac-auth-inbound/schema.json

@@ -1,53 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/hmac-auth-inbound.json",
-  "type": "object",
-  "title": "HMAC Auth",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "Authenticate requests using the HMAC-SHA256 authentication scheme.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module", "options"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The export from the custom policy"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        },
-        "options": {
-          "type": "object",
-          "description": "The options for this policy",
-          "required": ["secret", "headerName"],
-          "properties": {
-            "secret": {
-              "type": "string",
-              "description": "The secret to use for HMAC authentication"
-            },
-            "headerName": {
-              "type": "string",
-              "description": "The header where the HMAC signature is send"
-            }
-          }
-        }
-      },
-      "examples": [
-        {
-          "_name": "basic",
-          "export": "default",
-          "module": "$import(./modules/YOUR_MODULE)",
-          "options": {
-            "secret": "$env(MY_SECRET)",
-            "headerName": "signed-request"
-          }
-        }
-      ]
-    }
-  }
-}

package/docs/policies/ip-restriction-inbound/intro.md

@@ -1,8 +0,0 @@
-This custom policy allows you to specify a set of IP addresses that are allowed
-or blocked from making requests on your API. This can be useful for adding
-light-weight security to your API in non-critical scenarios. For example, if you
-want to ensure only employees on your corporate VPN can't access development
-environments.
-
-Generally, this policy shouldn't be relied upon as the only security for
-protecting sensitive workloads.

package/docs/policies/ip-restriction-inbound/policy.ts

@@ -1,40 +0,0 @@
-import { HttpProblems, ZuploContext, ZuploRequest } from "@zuplo/runtime";
-import ipRangeCheck from "ip-range-check";
-
-interface PolicyOptions {
-  allowedIpAddresses?: string[];
-  blockedIpAddresses?: string[];
-}
-
-export default async function (
-  request: ZuploRequest,
-  context: ZuploContext,
-  options: PolicyOptions,
-  policyName: string,
-) {
-  // TODO: Validate the policy options. Skipping in the example for brevity
-
-  // Get the incoming IP address
-  const ip = request.headers.get("true-client-ip");
-
-  // If the allowed IP addresses are set, then the incoming IP
-  // must be in that list
-  if (options.allowedIpAddresses) {
-    const allowed = ipRangeCheck(ip, options.allowedIpAddresses);
-    if (!allowed) {
-      return HttpProblems.unauthorized(request, context);
-    }
-  }
-
-  // If the blocked IP addresses are set, then the incoming IP
-  // can't be in that list
-  if (options.blockedIpAddresses) {
-    const blocked = ipRangeCheck(ip, options.blockedIpAddresses);
-    if (blocked) {
-      return HttpProblems.unauthorized(request, context);
-    }
-  }
-
-  // If we made it this far, the IP address is allowed, continue
-  return request;
-}

package/docs/policies/ip-restriction-inbound/schema.json

@@ -1,58 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/ip-restriction-inbound.json",
-  "type": "object",
-  "title": "IP Restriction",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "Block or allow requests based on their IP address.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module", "options"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The name of the exported type"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        },
-        "options": {
-          "type": "object",
-          "description": "The options for this policy",
-          "required": [],
-          "properties": {
-            "allowedIpAddresses": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "The IP addresses or CIDR ranges to allow"
-            },
-            "blockedIpAddresses": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "description": "The IP addresses or CIDR ranges to allow"
-            }
-          }
-        }
-      },
-      "examples": [
-        {
-          "_name": "basic",
-          "export": "default",
-          "module": "$import(./modules/YOUR_MODULE)",
-          "options": {
-            "allowedIpAddresses": ["184.42.1.4", "102.1.5.2/24"]
-          }
-        }
-      ]
-    }
-  }
-}

package/docs/policies/rbac-policy-inbound/intro.md

@@ -1,3 +0,0 @@
-RBAC policies can be built many ways depending on your requirements. This
-example shows how to perform a simple check of whether or not the current user
-is a member of a set of allowed roles.

package/docs/policies/rbac-policy-inbound/policy.ts

@@ -1,42 +0,0 @@
-import { HttpProblems, ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-interface PolicyOptions {
-  allowedRoles: string[];
-}
-
-export default async function (
-  request: ZuploRequest,
-  context: ZuploContext,
-  options: PolicyOptions,
-  policyName: string,
-) {
-  // Check that an authenticated user is set
-  // NOTE: This policy requires an authentication policy to run before
-  if (!request.user) {
-    context.log.error(
-      "User isn't authenticated. A authorization policy must come before the RBAC policy.",
-    );
-    return HttpProblems.unauthorized(request, context);
-  }
-
-  // Check that the user has roles
-  if (!request.user.data.roles) {
-    context.log.error("The user isn't assigned any roles.");
-    return HttpProblems.unauthorized(request, context);
-  }
-
-  // Check that the user has one of the allowed roles
-  if (
-    !options.allowedRoles.some((allowedRole) =>
-      request.user?.data.roles.includes(allowedRole),
-    )
-  ) {
-    context.log.error(
-      `The user '${request.user.sub}' isn't authorized to perform this action.`,
-    );
-    return HttpProblems.forbidden(request, context);
-  }
-
-  // If they made it here, they are authorized
-  return request;
-}

package/docs/policies/rbac-policy-inbound/schema.json

@@ -1,52 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/acl-policy-inbound.json",
-  "type": "object",
-  "title": "RBAC Authorization",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "The RBAC authorization inbound policy limits access to resources based on the roles of the authenticated user.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module", "options"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The name of the exported type"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        },
-        "options": {
-          "type": "object",
-          "description": "The options for this policy",
-          "required": ["policies"],
-          "properties": {
-            "allowedRoles": {
-              "type": "array",
-              "default": [],
-              "description": "The roles allowed to access the resource",
-              "items": {
-                "type": "string"
-              }
-            }
-          }
-        }
-      },
-      "examples": [
-        {
-          "_name": "basic",
-          "export": "default",
-          "module": "$import(./modules/YOUR_MODULE)",
-          "options": {
-            "allowedRoles": ["admin", "editor"]
-          }
-        }
-      ]
-    }
-  }
-}

package/docs/policies/transform-body-inbound/intro.md

@@ -1,8 +0,0 @@
-This example policy shows how to use `request.json()` to read the incoming
-request as a JSON object. The object can then be modified as appropriate. It's
-then converted back to a string and a new `Request` is returned in the policy
-with the new body.
-
-If the incoming request body isn't JSON, you can use `request.text()` or
-`request.blob()` to access the contents as raw text or a
-[blob](https://developer.mozilla.org/en-US/docs/Web/API/Request/blob).

package/docs/policies/transform-body-inbound/policy.ts

@@ -1,16 +0,0 @@
-import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-export default async function (request: ZuploRequest, context: ZuploContext) {
-  // Get the incoming body as an Object
-  const obj = await request.json();
-
-  // Modify the object as required
-  obj.myNewProperty = "Hello World";
-
-  // Stringify the object
-  const body = JSON.stringify(obj);
-
-  // Return a new request based on the
-  // original but with the new body
-  return new ZuploRequest(request, { body });
-}

package/docs/policies/transform-body-inbound/schema.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/transform-body-inbound.json",
-  "type": "object",
-  "title": "Transform Request Body",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "Transform the body of an incoming request.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The export from the custom policy"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        }
-      }
-    }
-  }
-}

package/docs/policies/transform-body-outbound/intro.md

@@ -1,8 +0,0 @@
-This example policy shows how to use `response.json()` to read the outgoing
-response as a JSON object. The object can then be modified as appropriate. It's
-then converted back to a string and a new `Response` is returned in the policy
-with the new body.
-
-If the incoming response body isn't JSON, you can use `response.text()` or
-`response.blob()` to access the contents as raw text or a
-[blob](https://developer.mozilla.org/en-US/docs/Web/API/Response/blob).

package/docs/policies/transform-body-outbound/policy.ts

@@ -1,19 +0,0 @@
-import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-export default async function (
-  response: Response,
-  request: ZuploRequest,
-  context: ZuploContext,
-) {
-  // Get the outgoing body as an Object
-  const obj = await response.json();
-
-  // Modify the object as required
-  obj.myNewProperty = "Hello World";
-
-  // Stringify the object
-  const body = JSON.stringify(obj);
-
-  // Return a new response with the new body
-  return new Response(body, request);
-}

package/docs/policies/transform-body-outbound/schema.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/transform-body-outbound.json",
-  "type": "object",
-  "title": "Transform Response Body",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "Transform the body of an outgoing response.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The export from the custom policy"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        }
-      }
-    }
-  }
-}