zuplo 6.72.3 → 6.72.8

package/docs/policies/open-id-jwt-auth-inbound/schema.json

@@ -35,12 +35,6 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "authHeader": {
-              "type": "string",
-              "default": "Authorization",
-              "x-show-example": false,
-              "description": "The name of the header with the key."
-            },
             "issuer": {
               "type": "string",
               "examples": ["$env(AUTH_ISSUER)"],
@@ -54,7 +48,7 @@
             "jwkUrl": {
               "type": "string",
               "examples": [
-                "https://zuplo-demo.us.auth0.com/.well-known/jwks.json"
+                "https://my-tenant.us.auth0.com/.well-known/jwks.json"
               ],
               "description": "the url of the JSON Web Key Set (JWKS) - this is used to validate the JWT token signature (either this or `secret` must be set)."
             },
@@ -63,18 +57,28 @@
               "examples": ["$env(AUTH_JWT_SIGNING_KEY)"],
               "description": "The key used to verify the signature of the JWT token (either this or `jwkUrl` must be set)."
             },
+            "authHeader": {
+              "type": "string",
+              "default": "Authorization",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The name of the header with the key."
+            },
             "allowUnauthenticatedRequests": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "indicates whether the request should continue if authentication fails. Defaults is `false` which means unauthenticated users will automatically receive a 401 response."
             },
             "subPropertyName": {
               "type": "string",
               "examples": ["sub"],
+              "x-advanced": true,
               "description": "The name of the property in the JWT token that contains the user's unique identifier."
             },
             "headers": {
               "type": "object",
+              "x-advanced": true,
               "description": "Additional headers to send with the JWK request.",
               "additionalProperties": {
                 "type": "string"
@@ -83,6 +87,7 @@
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           },
@@ -90,7 +95,7 @@
             {
               "issuer": "$env(AUTH_ISSUER)",
               "audience": "$env(AUTH_AUDIENCE)",
-              "jwkUrl": "https://zuplo-demo.us.auth0.com/.well-known/jwks.json"
+              "jwkUrl": "https://my-tenant.us.auth0.com/.well-known/jwks.json"
             },
             {
               "issuer": "$env(AUTH_ISSUER)",
@@ -107,7 +112,7 @@
           "options": {
             "issuer": "$env(AUTH_ISSUER)",
             "audience": "$env(AUTH_AUDIENCE)",
-            "jwkUrl": "https://zuplo-demo.us.auth0.com/.well-known/jwks.json"
+            "jwkUrl": "https://my-tenant.us.auth0.com/.well-known/jwks.json"
           }
         },
         {

package/docs/policies/openfga-authz-inbound/schema.json

@@ -55,12 +55,6 @@
               "description": "The ID of the authorization model.",
               "examples": ["$env(FGA_MODEL_ID)"]
             },
-            "allowUnauthorizedRequests": {
-              "type": "boolean",
-              "default": false,
-              "x-show-example": false,
-              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
-            },
             "credentials": {
               "oneOf": [
                 {
@@ -165,6 +159,13 @@
                   "oauthTokenEndpointUrl": "https://fga.us.auth0.com/oauth/token"
                 }
               ]
+            },
+            "allowUnauthorizedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
             }
           }
         }

package/docs/policies/openmeter-inbound/schema.json

@@ -33,17 +33,6 @@
           "description": "Send usage metrics to OpenMeter.",
           "type": "object",
           "properties": {
-            "apiUrl": {
-              "type": "string",
-              "x-show-example": false,
-              "description": "The URL of the OpenMeter API endpoint.",
-              "examples": [
-                "https://openmeter.cloud",
-                "http://localhost:8888",
-                "http://openmeter.example.com"
-              ],
-              "default": "https://openmeter.cloud"
-            },
             "apiKey": {
               "type": "string",
               "description": "The API key to use when sending metering calls to OpenMeter.",
@@ -119,6 +108,26 @@
                 }
               ]
             },
+            "requiredEntitlements": {
+              "type": "array",
+              "description": "A list of entitlements (feature keys) required in order for the call to be allowed.",
+              "items": {
+                "type": "string"
+              },
+              "examples": [["api-request"], ["llm_tokens", "api-request"]]
+            },
+            "apiUrl": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The URL of the OpenMeter API endpoint.",
+              "examples": [
+                "https://openmeter.cloud",
+                "http://localhost:8888",
+                "http://openmeter.example.com"
+              ],
+              "default": "https://openmeter.cloud"
+            },
             "meterOnStatusCodes": {
               "oneOf": [
                 {
@@ -132,6 +141,7 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a metering event.",
               "default": "200-299",
               "examples": ["200-399"]
@@ -139,21 +149,15 @@
             "eventSource": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The event's source (e.g. the service name).",
               "examples": ["api-gateway", "payment-service"],
               "default": "api-gateway"
             },
-            "requiredEntitlements": {
-              "type": "array",
-              "description": "A list of entitlements (feature keys) required in order for the call to be allowed.",
-              "items": {
-                "type": "string"
-              },
-              "examples": [["api-request"], ["llm_tokens", "api-request"]]
-            },
             "subjectPath": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The path to the property on `request.user` that contains the subject used for meters and entitlements. For example `.data.accountId` would read the `request.user.data.accountId` property.",
               "examples": [".sub", ".data.customerId"],
               "default": ".sub"

package/docs/policies/prompt-injection-outbound/schema.json

@@ -45,15 +45,16 @@
               "description": "Model to use for classification.",
               "default": "gpt-3.5-turbo"
             },
-            "baseUrl": {
-              "type": "string",
-              "description": "Base URL for the OpenAI compatible API.",
-              "default": "https://api.openai.com/v1"
-            },
             "strict": {
               "type": "boolean",
               "description": "Whether to block traffic if the classifier fails. When disabled, allows traffic flow if the classifier or inference API is unavailable.",
               "default": false
+            },
+            "baseUrl": {
+              "type": "string",
+              "x-advanced": true,
+              "description": "Base URL for the OpenAI compatible API.",
+              "default": "https://api.openai.com/v1"
             }
           }
         }

package/docs/policies/propel-auth-jwt-inbound/schema.json

@@ -35,24 +35,26 @@
           "additionalProperties": false,
           "required": ["authUrl", "verifierKey"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "authUrl": {
               "type": "string",
-              "examples": ["https://6587563.propelauthtest.com"],
-              "description": "Your PropelAuth authUrl. For example, `https://6587563.propelauthtest.com`."
+              "examples": ["https://12345678.propelauthtest.com"],
+              "description": "Your PropelAuth authUrl. For example, `https://12345678.propelauthtest.com`."
             },
             "verifierKey": {
               "type": "string",
               "examples": ["$env(PROPEL_VERIFIER_KEY)"],
               "description": "Your public (verifier) key that is used to verify access tokens. This key has a value that begins with '\\-\\-\\---BEGIN PUBLIC KEY\\-\\-\\---'. Make sure to remove all line breaks from the key before saving the variable."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }
@@ -64,7 +66,7 @@
           "module": "$import(@zuplo/runtime)",
           "options": {
             "allowUnauthenticatedRequests": false,
-            "authUrl": "https://6587563.propelauthtest.com",
+            "authUrl": "https://12345678.propelauthtest.com",
             "oAuthResourceMetadataEnabled": false,
             "verifierKey": "$env(PROPEL_VERIFIER_KEY)"
           }

package/docs/policies/query-param-to-header-inbound/schema.json

@@ -53,6 +53,7 @@
             "removeFromUrl": {
               "type": "boolean",
               "default": true,
+              "x-advanced": true,
               "description": "Whether to remove the query parameter from the URL after extracting it."
             }
           }

package/docs/policies/quota-inbound/schema.json

@@ -46,12 +46,6 @@
               "enum": ["user", "function"],
               "default": "user"
             },
-            "quotaAnchorMode": {
-              "type": "string",
-              "description": "How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.",
-              "enum": ["first-api-call", "function"],
-              "default": "first-api-call"
-            },
             "allowances": {
               "type": "object",
               "description": "The allowances for the quota.",
@@ -59,6 +53,13 @@
                 "type": "number"
               }
             },
+            "quotaAnchorMode": {
+              "type": "string",
+              "x-advanced": true,
+              "description": "How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.",
+              "enum": ["first-api-call", "function"],
+              "default": "first-api-call"
+            },
             "quotaOnStatusCodes": {
               "oneOf": [
                 {
@@ -72,6 +73,7 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a quota increment.",
               "default": "200-299",
               "examples": ["200-399"]
@@ -79,6 +81,7 @@
             "identifier": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The module and functions to dynamically set the anchor date and/or the key/allowances for this request.",
               "required": ["module"],
               "properties": {

package/docs/policies/rate-limit-inbound/schema.json

@@ -55,6 +55,7 @@
             "identifier": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The function that returns dynamic configuration data. Used only with `rateLimitBy=function`.",
               "required": ["export", "module"],
               "properties": {
@@ -77,11 +78,13 @@
               "default": "retry-after",
               "title": "RateLimitHeaderMode",
               "enum": ["none", "retry-after"],
+              "x-advanced": true,
               "description": "Adds the retry-after header."
             },
             "throwOnFailure": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "If true, the policy will throw an error in the event there is a problem connecting to the rate limit service."
             },
             "mode": {
@@ -89,6 +92,7 @@
               "default": "strict",
               "title": "RateLimitMode",
               "enum": ["strict", "async"],
+              "x-advanced": true,
               "description": "The mode of the policy. If set to `async`, the policy will check if the request is over the rate limit without blocking. This can result in some requests allowed over the rate limit."
             }
           },

package/docs/policies/readme-metrics-inbound/schema.json

@@ -40,29 +40,33 @@
               "examples": ["$env(README_API_KEY)"],
               "description": "The API key to use when sending metrics calls to Readme."
             },
+            "userEmailPropertyPath": {
+              "type": "string",
+              "default": "",
+              "description": "This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property."
+            },
             "userLabelPropertyPath": {
               "type": "string",
               "x-show-example": false,
               "default": ".sub",
+              "x-advanced": true,
               "description": "This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property."
             },
-            "userEmailPropertyPath": {
-              "type": "string",
-              "default": "",
-              "description": "This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property."
-            },
             "development": {
               "type": "boolean",
+              "x-advanced": true,
               "description": "Whether the data should be ingested as 'development' mode or not. Defaults to true for working-copy and false for all other environments."
             },
             "useFullRequestPath": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "When true, Zuplo sends the full request path (which might contain sensitive information). By default, we only send the route path which should not contain sensitive information."
             },
             "url": {
               "type": "string",
               "default": "https://metrics.readme.io/request",
+              "x-advanced": true,
               "description": "The URL to send metering events. This is useful for testing purposes."
             }
           }

package/docs/policies/request-size-limit-inbound/schema.json

@@ -42,6 +42,7 @@
             },
             "trustContentLengthHeader": {
               "type": "boolean",
+              "x-advanced": true,
               "description": "If true, the policy will reject any request with a `content-length` header in excess of `maxSizeInBytes` bytes value, but will not verify the actual size of the request. This is more efficient and offers slightly better memory usage but should only be used if you trust/control the clients calling the gateway to send an accurate content-length. If false, the gateway will actually verify the request size and reject any request with a size in excess of the stated maximum."
             }
           }

package/docs/policies/request-validation-inbound/schema.json

@@ -35,12 +35,6 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "logLevel": {
-              "type": "string",
-              "default": "info",
-              "description": "The log level to use when logging validation errors.",
-              "enum": ["error", "warn", "info", "debug"]
-            },
             "validateBody": {
               "examples": ["reject-and-log"],
               "type": "string",
@@ -72,9 +66,17 @@
               "description": "The action to perform when validation fails.",
               "enum": ["none", "log-only", "reject-and-log", "reject-only"]
             },
+            "logLevel": {
+              "type": "string",
+              "default": "info",
+              "x-advanced": true,
+              "description": "The log level to use when logging validation errors.",
+              "enum": ["error", "warn", "info", "debug"]
+            },
             "includeRequestInLogs": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Whether to include the request in the logs."
             }
           }

package/docs/policies/require-origin-inbound/schema.json

@@ -46,6 +46,7 @@
               "examples": [
                 "Your origin is not authorized to make this request."
               ],
+              "x-advanced": true,
               "description": "The `detail` of the HTTP Problem response, if the origin is missing or disallowed."
             }
           }

package/docs/policies/semantic-cache-inbound/schema.json

@@ -58,9 +58,15 @@
               "enum": ["function", "propertyPath"],
               "description": "Determines how the cache key is generated. Use 'function' for custom logic or 'propertyPath' to extract from JSON body."
             },
+            "cacheByPropertyPath": {
+              "type": "string",
+              "description": "The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.",
+              "examples": [".userId", ".data.customerId"]
+            },
             "cacheByFunction": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The function that returns dynamic cache key data. Used only with `cacheBy=function`.",
               "required": ["export", "module"],
               "properties": {
@@ -76,11 +82,6 @@
                 }
               }
             },
-            "cacheByPropertyPath": {
-              "type": "string",
-              "description": "The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.",
-              "examples": [".userId", ".data.customerId"]
-            },
             "statusCodes": {
               "type": "array",
               "items": {
@@ -88,16 +89,19 @@
               },
               "examples": [[200, 201]],
               "default": [200, 206, 301, 302, 303, 410],
+              "x-advanced": true,
               "description": "Response status codes to be cached."
             },
             "returnCacheStatusHeader": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "If true, the policy will return a custom header with the cache status. The default header name is `zp-semantic-cache`."
             },
             "cacheStatusHeaderName": {
               "type": "string",
               "default": "zp-semantic-cache",
+              "x-advanced": true,
               "description": "The name of the header to return the cache status. Only used if `returnCacheStatusHeader` is true."
             }
           },

package/docs/policies/set-status-outbound/schema.json

@@ -43,6 +43,7 @@
             "statusText": {
               "type": "string",
               "examples": ["OK", "Not Found"],
+              "x-advanced": true,
               "description": "The statusText to be used in the response."
             }
           }

package/docs/policies/set-upstream-api-key-inbound/schema.json

@@ -35,21 +35,23 @@
           "additionalProperties": false,
           "required": ["value"],
           "properties": {
+            "value": {
+              "type": "string",
+              "examples": ["Bearer $env(UPSTREAM_API_KEY)"],
+              "description": "The value of the header. Most commonly an environment variable reference such as `Bearer $env(UPSTREAM_API_KEY)` so the secret is sourced from your environment."
+            },
             "header": {
               "type": "string",
               "default": "Authorization",
               "examples": ["Authorization"],
+              "x-advanced": true,
               "description": "The name of the header to set on the request. Defaults to `Authorization`."
             },
-            "value": {
-              "type": "string",
-              "examples": ["Bearer $env(UPSTREAM_API_KEY)"],
-              "description": "The value of the header. Most commonly an environment variable reference such as `Bearer $env(UPSTREAM_API_KEY)` so the secret is sourced from your environment."
-            },
             "overwrite": {
               "type": "boolean",
               "x-show-example": false,
               "default": true,
+              "x-advanced": true,
               "description": "Overwrite the value if the header is already present in the request."
             }
           }

package/docs/policies/stripe-webhook-verification-inbound/schema.json

@@ -42,7 +42,8 @@
             "tolerance": {
               "type": "number",
               "default": 300,
-              "description": "The allowed clock skew in seconds between the time the webhook signature was crated and the current time."
+              "x-advanced": true,
+              "description": "The allowed clock skew in seconds between the time the webhook signature was created and the current time."
             }
           }
         }

package/docs/policies/supabase-jwt-auth-inbound/schema.json

@@ -40,11 +40,6 @@
               "examples": ["$env(SUPABASE_JWT_SECRET)"],
               "description": "The key used to verify the signature of the JWT token."
             },
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response."
-            },
             "requiredClaims": {
               "type": "object",
               "examples": [
@@ -60,9 +55,16 @@
               },
               "description": "Any claims that must be present for authentication to succeed - multiple valid values can be specified for each claim."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/traffic-splitting-inbound/schema.json

@@ -67,6 +67,7 @@
               "type": "boolean",
               "default": false,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "When `true`, logs which base path was selected for each request. Defaults to `false`."
             }
           },

package/docs/policies/upstream-aws-federated-auth-inbound/doc.md

@@ -0,0 +1,78 @@
+## Overview
+
+The Upstream AWS Federated Auth policy obtains AWS credentials **without storing
+any AWS keys**. It exchanges Zuplo's ambient OIDC identity token for an IAM
+role's short-lived temporary credentials using STS
+`AssumeRoleWithWebIdentity`, then registers those credentials on the request
+context.
+
+Like the `upstream-aws-service-auth` policy, it does **not** add an
+`Authorization` header itself — AWS Signature Version 4 signs the exact final
+request, which is only known inside the handler. The AWS Lambda handler and your
+own code read the resolved credentials and sign the requests they build.
+
+## AWS setup
+
+1. Create an **IAM OIDC identity provider** that trusts the Zuplo issuer. Set
+   the audience (client ID) to the value you use for the `audience` option
+   (default `sts.amazonaws.com`).
+2. Create an **IAM role** whose trust policy allows
+   `sts:AssumeRoleWithWebIdentity` for that provider, with a condition on the
+   token's audience.
+3. Grant the role only the permissions the gateway needs (for example
+   `execute-api:Invoke` or `lambda:InvokeFunction`).
+
+## Using the credentials
+
+### With the AWS Lambda handler
+
+```json
+{
+  "paths": {
+    "/lambda/{path}*": {
+      "x-zuplo-route": {
+        "handler": {
+          "export": "awsLambdaHandler",
+          "module": "$import(@zuplo/runtime)",
+          "options": { "region": "us-east-1", "functionName": "my-function" }
+        },
+        "policies": { "inbound": ["upstream-aws-federated-auth"] }
+      }
+    }
+  }
+}
+```
+
+### With custom code
+
+```typescript
+import { AwsClient } from "@zuplo/runtime/aws";
+import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
+
+export default async function (request: ZuploRequest, context: ZuploContext) {
+  const aws = AwsClient.fromContext(context, {
+    service: "execute-api",
+    region: "us-east-1",
+  });
+  return aws.fetch(
+    "https://abc123.execute-api.us-east-1.amazonaws.com/prod/orders"
+  );
+}
+```
+
+## Configuration
+
+```json
+{
+  "name": "upstream-aws-federated-auth",
+  "policyType": "upstream-aws-federated-auth",
+  "handler": {
+    "export": "UpstreamAwsFederatedAuthInboundPolicy",
+    "module": "$import(@zuplo/runtime)",
+    "options": {
+      "roleArn": "arn:aws:iam::123456789012:role/zuplo-gateway",
+      "region": "us-east-1"
+    }
+  }
+}
+```