zuplo 6.72.3 → 6.72.7

package/docs/policies/open-id-jwt-auth-inbound/schema.json

@@ -54,7 +54,7 @@
             "jwkUrl": {
               "type": "string",
               "examples": [
-                "https://zuplo-demo.us.auth0.com/.well-known/jwks.json"
+                "https://my-tenant.us.auth0.com/.well-known/jwks.json"
               ],
               "description": "the url of the JSON Web Key Set (JWKS) - this is used to validate the JWT token signature (either this or `secret` must be set)."
             },
@@ -90,7 +90,7 @@
             {
               "issuer": "$env(AUTH_ISSUER)",
               "audience": "$env(AUTH_AUDIENCE)",
-              "jwkUrl": "https://zuplo-demo.us.auth0.com/.well-known/jwks.json"
+              "jwkUrl": "https://my-tenant.us.auth0.com/.well-known/jwks.json"
             },
             {
               "issuer": "$env(AUTH_ISSUER)",
@@ -107,7 +107,7 @@
           "options": {
             "issuer": "$env(AUTH_ISSUER)",
             "audience": "$env(AUTH_AUDIENCE)",
-            "jwkUrl": "https://zuplo-demo.us.auth0.com/.well-known/jwks.json"
+            "jwkUrl": "https://my-tenant.us.auth0.com/.well-known/jwks.json"
           }
         },
         {

package/docs/policies/propel-auth-jwt-inbound/schema.json

@@ -42,8 +42,8 @@
             },
             "authUrl": {
               "type": "string",
-              "examples": ["https://6587563.propelauthtest.com"],
-              "description": "Your PropelAuth authUrl. For example, `https://6587563.propelauthtest.com`."
+              "examples": ["https://12345678.propelauthtest.com"],
+              "description": "Your PropelAuth authUrl. For example, `https://12345678.propelauthtest.com`."
             },
             "verifierKey": {
               "type": "string",
@@ -64,7 +64,7 @@
           "module": "$import(@zuplo/runtime)",
           "options": {
             "allowUnauthenticatedRequests": false,
-            "authUrl": "https://6587563.propelauthtest.com",
+            "authUrl": "https://12345678.propelauthtest.com",
             "oAuthResourceMetadataEnabled": false,
             "verifierKey": "$env(PROPEL_VERIFIER_KEY)"
           }

package/docs/policies/upstream-aws-federated-auth-inbound/doc.md

@@ -0,0 +1,78 @@
+## Overview
+
+The Upstream AWS Federated Auth policy obtains AWS credentials **without storing
+any AWS keys**. It exchanges Zuplo's ambient OIDC identity token for an IAM
+role's short-lived temporary credentials using STS
+`AssumeRoleWithWebIdentity`, then registers those credentials on the request
+context.
+
+Like the `upstream-aws-service-auth` policy, it does **not** add an
+`Authorization` header itself — AWS Signature Version 4 signs the exact final
+request, which is only known inside the handler. The AWS Lambda handler and your
+own code read the resolved credentials and sign the requests they build.
+
+## AWS setup
+
+1. Create an **IAM OIDC identity provider** that trusts the Zuplo issuer. Set
+   the audience (client ID) to the value you use for the `audience` option
+   (default `sts.amazonaws.com`).
+2. Create an **IAM role** whose trust policy allows
+   `sts:AssumeRoleWithWebIdentity` for that provider, with a condition on the
+   token's audience.
+3. Grant the role only the permissions the gateway needs (for example
+   `execute-api:Invoke` or `lambda:InvokeFunction`).
+
+## Using the credentials
+
+### With the AWS Lambda handler
+
+```json
+{
+  "paths": {
+    "/lambda/{path}*": {
+      "x-zuplo-route": {
+        "handler": {
+          "export": "awsLambdaHandler",
+          "module": "$import(@zuplo/runtime)",
+          "options": { "region": "us-east-1", "functionName": "my-function" }
+        },
+        "policies": { "inbound": ["upstream-aws-federated-auth"] }
+      }
+    }
+  }
+}
+```
+
+### With custom code
+
+```typescript
+import { AwsClient } from "@zuplo/runtime/aws";
+import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
+
+export default async function (request: ZuploRequest, context: ZuploContext) {
+  const aws = AwsClient.fromContext(context, {
+    service: "execute-api",
+    region: "us-east-1",
+  });
+  return aws.fetch(
+    "https://abc123.execute-api.us-east-1.amazonaws.com/prod/orders"
+  );
+}
+```
+
+## Configuration
+
+```json
+{
+  "name": "upstream-aws-federated-auth",
+  "policyType": "upstream-aws-federated-auth",
+  "handler": {
+    "export": "UpstreamAwsFederatedAuthInboundPolicy",
+    "module": "$import(@zuplo/runtime)",
+    "options": {
+      "roleArn": "arn:aws:iam::123456789012:role/zuplo-gateway",
+      "region": "us-east-1"
+    }
+  }
+}
+```

package/docs/policies/upstream-aws-federated-auth-inbound/intro.md

@@ -0,0 +1,20 @@
+Authenticate to AWS upstreams with **no stored AWS keys** using Workload
+Identity Federation. This policy exchanges Zuplo's ambient OIDC identity for an
+IAM role's short-lived temporary credentials via STS AssumeRoleWithWebIdentity,
+and makes them available to the AWS Lambda handler and to custom code, which
+sign upstream requests with AWS Signature Version 4.
+
+With this policy, you'll benefit from:
+
+- **No Long-Lived Secrets**: No AWS access keys are stored anywhere — the
+  gateway proves its identity with a short-lived, audience-bound OIDC token
+- **Least Privilege**: Assume a specific IAM role whose trust policy trusts only
+  the Zuplo OIDC identity provider
+- **Automatic Token Management**: Temporary credentials are cached in memory and
+  refreshed before they expire
+- **Reusable Credentials**: Resolve credentials once and use them from the AWS
+  Lambda handler or your own code via `AwsClient.fromContext(context)`
+
+To set this up you configure an IAM OIDC identity provider that trusts Zuplo's
+issuer, and an IAM role whose trust policy permits AssumeRoleWithWebIdentity for
+that provider.

package/docs/policies/upstream-aws-federated-auth-inbound/schema.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-aws-federated-auth-inbound.json",
+  "type": "object",
+  "title": "Upstream AWS Federated Auth",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": true,
+  "isInternal": false,
+  "isBeta": true,
+  "isHidden": false,
+  "requiresAI": false,
+  "products": ["api-gateway"],
+  "description": "Resolves AWS credentials with STS AssumeRoleWithWebIdentity using Zuplo's ambient OIDC identity — no AWS keys are stored anywhere. The role's trust policy must trust the Zuplo OIDC identity provider. Resolved credentials are registered on the request context for the AWS Lambda handler and custom code to sign upstream requests with `AwsClient.fromContext`. This policy does not itself sign or forward the request.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "UpstreamAwsFederatedAuthInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "UpstreamAwsFederatedAuthInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["roleArn", "region"],
+          "properties": {
+            "roleArn": {
+              "type": "string",
+              "examples": ["arn:aws:iam::123456789012:role/zuplo-gateway"],
+              "description": "The IAM role to assume with STS AssumeRoleWithWebIdentity. The role's trust policy must trust the Zuplo OIDC identity provider."
+            },
+            "region": {
+              "type": "string",
+              "examples": ["us-east-1"],
+              "description": "The AWS region used for the STS endpoint and as the default signing region for consumers of the resolved credentials."
+            },
+            "audience": {
+              "type": "string",
+              "default": "sts.amazonaws.com",
+              "x-show-example": false,
+              "description": "The audience ('aud' claim) of the Zuplo-issued OIDC token. Must match a client ID configured on the IAM OIDC identity provider."
+            },
+            "roleSessionName": {
+              "type": "string",
+              "default": "zuplo-gateway",
+              "x-show-example": false,
+              "description": "The STS role session name recorded in AWS CloudTrail. Must match the pattern \\[\\\\w+=,.@-\\]{2,64}."
+            },
+            "durationSeconds": {
+              "type": "number",
+              "default": 3600,
+              "x-show-example": false,
+              "description": "The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value."
+            },
+            "stsEndpoint": {
+              "type": "string",
+              "x-show-example": false,
+              "description": "Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China."
+            },
+            "tokenRetries": {
+              "type": "number",
+              "default": 3,
+              "x-show-example": false,
+              "description": "The number of times to retry fetching temporary credentials in the event of a failure."
+            },
+            "expirationOffsetSeconds": {
+              "type": "number",
+              "default": 300,
+              "x-show-example": false,
+              "description": "The number of seconds before credential expiration at which cached credentials are discarded and refreshed."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "UpstreamAwsFederatedAuthInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "region": "us-east-1",
+            "roleArn": "arn:aws:iam::123456789012:role/zuplo-gateway"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/upstream-aws-service-auth-inbound/doc.md

@@ -0,0 +1,89 @@
+## Overview
+
+The Upstream AWS Service Auth policy resolves AWS credentials and registers them
+on the request context. Unlike the other upstream auth policies, it does **not**
+add an `Authorization` header itself — AWS Signature Version 4 signs the exact
+final request (method, host, path, query and body hash), which is only known
+inside the handler. Instead, the AWS Lambda handler and your own code read the
+resolved credentials and sign the requests they build.
+
+There are two modes:
+
+- **Static credentials** — the configured `accessKeyId` / `secretAccessKey`
+  (and optional `sessionToken`) are used directly.
+- **Assumed role** — when `roleArn` is set, the policy calls STS `AssumeRole`
+  (signed with the configured keys) and uses the role's short-lived temporary
+  credentials. These are cached in memory and refreshed before they expire.
+
+## Using the credentials
+
+### With the AWS Lambda handler
+
+Attach this policy to a route whose handler is `awsLambdaHandler`, and omit the
+handler's own `accessKeyId` / `secretAccessKey`. The handler will use the
+credentials resolved by the policy.
+
+```json
+{
+  "paths": {
+    "/lambda/{path}*": {
+      "x-zuplo-route": {
+        "handler": {
+          "export": "awsLambdaHandler",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "region": "us-east-1",
+            "functionName": "my-function"
+          }
+        },
+        "policies": { "inbound": ["upstream-aws-service-auth"] }
+      }
+    }
+  }
+}
+```
+
+### With custom code (for example, API Gateway with IAM auth, or S3)
+
+Attach the policy, then sign outbound requests with `AwsClient.fromContext`:
+
+```typescript
+import { AwsClient } from "@zuplo/runtime/aws";
+import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
+
+export default async function (request: ZuploRequest, context: ZuploContext) {
+  const aws = AwsClient.fromContext(context, {
+    service: "execute-api",
+    region: "us-east-1",
+  });
+  return aws.fetch(
+    "https://abc123.execute-api.us-east-1.amazonaws.com/prod/orders"
+  );
+}
+```
+
+If a route does not attach the policy, you can run it on demand from custom code
+with `await context.invokeInboundPolicy("upstream-aws-service-auth", request)`
+before calling `AwsClient.fromContext`.
+
+## Configuration
+
+```json
+{
+  "name": "upstream-aws-service-auth",
+  "policyType": "upstream-aws-service-auth",
+  "handler": {
+    "export": "UpstreamAwsServiceAuthInboundPolicy",
+    "module": "$import(@zuplo/runtime)",
+    "options": {
+      "accessKeyId": "$env(AWS_ACCESS_KEY_ID)",
+      "secretAccessKey": "$env(AWS_SECRET_ACCESS_KEY)",
+      "region": "us-east-1",
+      "roleArn": "arn:aws:iam::123456789012:role/my-gateway-role"
+    }
+  }
+}
+```
+
+Store `accessKeyId` and `secretAccessKey` in environment variables using
+`$env(...)` — never commit them to source.

package/docs/policies/upstream-aws-service-auth-inbound/intro.md

@@ -0,0 +1,19 @@
+Authenticate to AWS upstreams using an IAM access key pair, optionally exchanged
+for an IAM role's temporary credentials via STS AssumeRole. This policy resolves
+AWS credentials and makes them available to the AWS Lambda handler and to custom
+code, which sign upstream requests with AWS Signature Version 4.
+
+With this policy, you'll benefit from:
+
+- **Reusable Credentials**: Resolve AWS credentials once and use them from the
+  AWS Lambda handler or your own code via `AwsClient.fromContext(context)`
+- **Role Assumption**: Optionally assume an IAM role (STS AssumeRole) to obtain
+  short-lived, least-privilege temporary credentials
+- **Automatic Token Management**: Temporary credentials are cached in memory and
+  refreshed before they expire
+- **Credential Security**: Store access keys securely in your Zuplo environment
+  and keep them out of source control
+
+To avoid storing any long-lived AWS keys at all, use the
+`upstream-aws-federated-auth` policy instead, which uses Workload Identity
+Federation.

package/docs/policies/upstream-aws-service-auth-inbound/schema.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-aws-service-auth-inbound.json",
+  "type": "object",
+  "title": "Upstream AWS Service Auth",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": true,
+  "isInternal": false,
+  "isBeta": true,
+  "isHidden": false,
+  "requiresAI": false,
+  "products": ["api-gateway"],
+  "description": "Resolves AWS credentials from static access keys (optionally exchanged for an IAM role's temporary credentials via STS AssumeRole) and registers them on the request context. The AWS Lambda handler and custom code read them with `AwsClient.fromContext` to sign upstream requests. This policy does not itself sign or forward the request.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "UpstreamAwsServiceAuthInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "UpstreamAwsServiceAuthInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["accessKeyId", "secretAccessKey", "region"],
+          "properties": {
+            "accessKeyId": {
+              "type": "string",
+              "examples": ["$env(AWS_ACCESS_KEY_ID)"],
+              "description": "The AWS access key ID. Store the value in an environment variable rather than in source."
+            },
+            "secretAccessKey": {
+              "type": "string",
+              "examples": ["$env(AWS_SECRET_ACCESS_KEY)"],
+              "description": "The AWS secret access key. Always store this in an environment variable."
+            },
+            "region": {
+              "type": "string",
+              "examples": ["us-east-1"],
+              "description": "The AWS region. Used for the STS endpoint when 'roleArn' is set, and as the default signing region for consumers of the resolved credentials."
+            },
+            "sessionToken": {
+              "type": "string",
+              "x-show-example": false,
+              "description": "The AWS session token, required only when the configured access key pair is itself a temporary credential."
+            },
+            "roleArn": {
+              "type": "string",
+              "x-show-example": false,
+              "description": "An IAM role to assume using STS AssumeRole with the configured access keys. When set, the resolved credentials are the role's temporary credentials instead of the static keys."
+            },
+            "externalId": {
+              "type": "string",
+              "x-show-example": false,
+              "description": "The external ID to pass to STS AssumeRole when the role's trust policy requires one."
+            },
+            "roleSessionName": {
+              "type": "string",
+              "default": "zuplo-gateway",
+              "x-show-example": false,
+              "description": "The STS role session name recorded in AWS CloudTrail. Must match the pattern \\[\\\\w+=,.@-\\]{2,64}."
+            },
+            "durationSeconds": {
+              "type": "number",
+              "default": 3600,
+              "x-show-example": false,
+              "description": "The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value."
+            },
+            "stsEndpoint": {
+              "type": "string",
+              "x-show-example": false,
+              "description": "Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China."
+            },
+            "tokenRetries": {
+              "type": "number",
+              "default": 3,
+              "x-show-example": false,
+              "description": "The number of times to retry fetching temporary credentials in the event of a failure."
+            },
+            "expirationOffsetSeconds": {
+              "type": "number",
+              "default": 300,
+              "x-show-example": false,
+              "description": "The number of seconds before credential expiration at which cached credentials are discarded and refreshed."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "UpstreamAwsServiceAuthInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "accessKeyId": "$env(AWS_ACCESS_KEY_ID)",
+            "region": "us-east-1",
+            "secretAccessKey": "$env(AWS_SECRET_ACCESS_KEY)"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/upstream-azure-ad-service-auth-inbound/schema.json

@@ -41,12 +41,12 @@
           "properties": {
             "activeDirectoryTenantId": {
               "type": "string",
-              "examples": ["b8e4141e-31f4-43e3-9a96-f97f3eba1eea"],
+              "examples": ["11111111-1111-1111-1111-111111111111"],
               "description": "Azure Active Directory Tenant ID."
             },
             "activeDirectoryClientId": {
               "type": "string",
-              "examples": ["20edbb34-13e9-42d0-a63c-1b6a0a20d02d"],
+              "examples": ["22222222-2222-2222-2222-222222222222"],
               "description": "The Application (client) ID of the Azure AD App Registration."
             },
             "activeDirectoryClientSecret": {
@@ -72,9 +72,9 @@
           "export": "UpstreamAzureAdServiceAuthInboundPolicy",
           "module": "$import(@zuplo/runtime)",
           "options": {
-            "activeDirectoryClientId": "20edbb34-13e9-42d0-a63c-1b6a0a20d02d",
+            "activeDirectoryClientId": "22222222-2222-2222-2222-222222222222",
             "activeDirectoryClientSecret": "$env(ACTIVE_DIRECTORY_CLIENT_SECRET)",
-            "activeDirectoryTenantId": "b8e4141e-31f4-43e3-9a96-f97f3eba1eea",
+            "activeDirectoryTenantId": "11111111-1111-1111-1111-111111111111",
             "expirationOffsetSeconds": 300,
             "tokenRetries": 3
           }

package/docs/policies/upstream-gcp-federated-auth-inbound/doc.md

@@ -130,9 +130,9 @@ With GCP Workload Federation setup, you can add the policy to your Zuplo API.
     "module": "$import(@zuplo/runtime)",
     "export": "UpstreamGcpFederatedAuthInboundPolicy",
     "options": {
-      "audience": "https://test-basic-vhpkl3cvtq-uc.a.run.app",
+      "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
       "serviceAccountEmail": "zup-api@my-project.iam.gserviceaccount.com",
-      "workloadIdentityProvider": "projects/932049231233/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
+      "workloadIdentityProvider": "projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
     }
   }
 }

package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json

@@ -41,7 +41,7 @@
           "properties": {
             "audience": {
               "type": "string",
-              "examples": ["https://hello-k7meruiynq-uc.a.run.app"],
+              "examples": ["https://my-backend-api-a1b2c3d4e5-uc.a.run.app"],
               "description": "The audience for the minted JWT. This is typically the URL of your service. See the document [AuthRequirement](https://cloud.google.com/endpoints/docs/grpc-service-config/reference/rpc/google.api#google.api.AuthRequirement) for details."
             },
             "serviceAccountEmail": {
@@ -52,7 +52,7 @@
             "workloadIdentityProvider": {
               "type": "string",
               "examples": [
-                "projects/932049231233/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
+                "projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
               ]
             },
             "tokenLifetime": {
@@ -86,9 +86,9 @@
           "export": "UpstreamGcpFederatedAuthInboundPolicy",
           "module": "$import(@zuplo/runtime)",
           "options": {
-            "audience": "https://hello-k7meruiynq-uc.a.run.app",
+            "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
             "serviceAccountEmail": "zup-api@my-project.iam.gserviceaccount.com",
-            "workloadIdentityProvider": "projects/932049231233/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
+            "workloadIdentityProvider": "projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
           }
         }
       ]

package/docs/policies/upstream-gcp-service-auth-inbound/doc.md

@@ -50,7 +50,7 @@ protected by Identity Aware Proxy (IAP), use the `audience` property:
   "export": "UpstreamGcpServiceAuthInboundPolicy",
   "module": "$import(@zuplo/runtime)",
   "options": {
-    "audience": "https://my-app-1235.a.run.app",
+    "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
     "serviceAccountJson": "$env(GCP_SERVICE_ACCOUNT)"
   }
 }
@@ -59,7 +59,7 @@ protected by Identity Aware Proxy (IAP), use the `audience` property:
 **Audience Values:**
 
 - For **Cloud Run**: Use the full URL of your Cloud Run service (e.g.,
-  `https://my-service.a.run.app`)
+  `https://my-backend-api-a1b2c3d4e5-uc.a.run.app`)
 - For **Identity Aware Proxy**: Use the Client ID of your OAuth application
 - For **Cloud Functions**: Use the full URL of your function
 
@@ -109,7 +109,7 @@ Apply the policy to routes that need to access your Cloud Run service:
             "export": "forwardToOrigin",
             "module": "$import(@zuplo/runtime)",
             "options": {
-              "baseUrl": "https://my-service-1235.a.run.app"
+              "baseUrl": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app"
             }
           }
         }

package/docs/policies/upstream-gcp-service-auth-inbound/schema.json

@@ -37,8 +37,8 @@
           "properties": {
             "audience": {
               "type": "string",
-              "examples": ["https://my-service-a2ev-uc.a.run.app"],
-              "description": "The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-service-a2ev-uc.a.run.app'. If calling a Google API, leave this empty."
+              "examples": ["https://my-backend-api-a1b2c3d4e5-uc.a.run.app"],
+              "description": "The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-backend-api-a1b2c3d4e5-uc.a.run.app'. If calling a Google API, leave this empty."
             },
             "scopes": {
               "type": "array",
@@ -91,7 +91,7 @@
           "export": "UpstreamGcpServiceAuthInboundPolicy",
           "module": "$import(@zuplo/runtime)",
           "options": {
-            "audience": "https://my-service-a2ev-uc.a.run.app",
+            "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
             "scopes": ["https://www.googleapis.com/auth/cloud-platform"],
             "serviceAccountJson": "$env(SERVICE_ACCOUNT_JSON)"
           }

package/docs/policies/upstream-zuplo-jwt-auth-inbound/schema.json

@@ -40,6 +40,25 @@
               "examples": ["https://api.example.com", "my-service"],
               "description": "The audience claim for the JWT."
             },
+            "subject": {
+              "type": "string",
+              "examples": ["zuplo-gateway"],
+              "x-show-example": false,
+              "description": "The subject ('sub') claim for the minted JWT. Identifies the acting subject of the token (typically the gateway itself)."
+            },
+            "claimsFromUser": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "examples": [
+                {
+                  "caller": "sub"
+                }
+              ],
+              "x-show-example": false,
+              "description": "Maps claims in the minted JWT to values from the authenticated user (request.user). Each key is the claim name to set; each value is a light JSON-path selector into request.user using dot or bracket notation (e.g. 'sub', 'data.role', or 'data\\[\"https://example.com/claim\"\\]' for keys containing dots or slashes). When set, the policy requires an authenticated user and returns 401 if request.user is absent — it never mints a token with missing identity."
+            },
             "headerName": {
               "type": "string",
               "default": "Authorization",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.72.3",
+  "version": "6.72.7",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.72.3",
-    "@zuplo/core": "6.72.3",
-    "@zuplo/runtime": "6.72.3",
+    "@zuplo/cli": "6.72.7",
+    "@zuplo/core": "6.72.7",
+    "@zuplo/runtime": "6.72.7",
     "@zuplo/test": "1.4.0"
   }
 }