zuplo 6.72.7 → 6.72.8

package/docs/policies/upstream-firebase-user-auth-inbound/schema.json

@@ -49,6 +49,11 @@
               "type": "string",
               "description": "The property on the incoming request.user object to retrieve the value of the userId."
             },
+            "webApiKey": {
+              "type": "string",
+              "examples": ["$env(WEB_API_KEY)"],
+              "description": "The Firebase Web API Key (found in project settings)"
+            },
             "developerClaims": {
               "type": "object",
               "tsType": "Record<string, string | number | boolean | null>",
@@ -73,21 +78,19 @@
                   "premium": true
                 }
               ],
+              "x-advanced": true,
               "description": "Additional claims to include in the custom token's payload."
             },
-            "webApiKey": {
-              "type": "string",
-              "examples": ["$env(WEB_API_KEY)"],
-              "description": "The Firebase Web API Key (found in project settings)"
-            },
             "tokenRetries": {
               "type": "number",
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             }
           }

package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json

@@ -59,23 +59,27 @@
               "type": "number",
               "x-show-example": false,
               "default": 3600,
+              "x-advanced": true,
               "description": "The lifetime in seconds of the issued token."
             },
             "tokenRetries": {
               "type": "number",
               "x-show-example": false,
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "x-show-example": false,
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             },
             "useMemoryCacheOnly": {
               "type": "boolean",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "This is an advanced option that should only be used if you do not want to persist information in ZoneCache."
             }
           }

package/docs/policies/upstream-gcp-service-auth-inbound/schema.json

@@ -57,17 +57,20 @@
               "type": "number",
               "x-show-example": false,
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "x-show-example": false,
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             },
             "useMemoryCacheOnly": {
               "type": "boolean",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "This is an advanced option that should only be used if you do not want to persist information in ZoneCache."
             },
             "version": {
@@ -75,12 +78,14 @@
               "default": 1,
               "enum": [1, 2],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The version of the policy."
             },
             "enableSuspiciousHeaderWarning": {
               "type": "boolean",
               "default": true,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "When `true` (the default), emits a warning if the inbound request carries headers like `X-Serverless-Authorization` or `X-Goog-IAP-JWT-Assertion`. Forwarding those to a downstream Cloud Run typically causes a `the access token could not be verified` 401 because Cloud Run prefers `X-Serverless-Authorization` over `Authorization` for IAM checks. Set this to `false` only if you have intentionally chosen to forward those headers (e.g. the upstream service is also IAP-fronted and expects them) — the warning is otherwise a useful diagnostic signal."
             }
           }

package/docs/policies/upstream-zuplo-jwt-auth-inbound/schema.json

@@ -40,10 +40,26 @@
               "examples": ["https://api.example.com", "my-service"],
               "description": "The audience claim for the JWT."
             },
+            "expiresIn": {
+              "oneOf": [
+                {
+                  "type": "number",
+                  "description": "Expiration time in seconds."
+                },
+                {
+                  "type": "string",
+                  "description": "Expiration time as a string."
+                }
+              ],
+              "default": 300,
+              "examples": [300, "5m", "1h", "7d"],
+              "description": "JWT expiration time. Can be a number (seconds) or a string with units (e.g., '5m' for 5 minutes, '1h' for 1 hour, '7d' for 7 days). Defaults to 300 seconds (5 minutes)."
+            },
             "subject": {
               "type": "string",
               "examples": ["zuplo-gateway"],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The subject ('sub') claim for the minted JWT. Identifies the acting subject of the token (typically the gateway itself)."
             },
             "claimsFromUser": {
@@ -57,18 +73,21 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Maps claims in the minted JWT to values from the authenticated user (request.user). Each key is the claim name to set; each value is a light JSON-path selector into request.user using dot or bracket notation (e.g. 'sub', 'data.role', or 'data\\[\"https://example.com/claim\"\\]' for keys containing dots or slashes). When set, the policy requires an authenticated user and returns 401 if request.user is absent — it never mints a token with missing identity."
             },
             "headerName": {
               "type": "string",
               "default": "Authorization",
               "examples": ["Authorization", "X-API-Token"],
+              "x-advanced": true,
               "description": "The header name where the JWT will be attached. Defaults to 'Authorization'."
             },
             "tokenPrefix": {
               "type": "string",
               "default": "Bearer",
               "examples": ["Bearer", "Token"],
+              "x-advanced": true,
               "description": "The prefix to use before the JWT token. Defaults to 'Bearer'. Set to an empty string to send the token without a prefix."
             },
             "additionalClaims": {
@@ -79,23 +98,9 @@
                   "custom": "value"
                 }
               ],
+              "x-advanced": true,
               "description": "Additional claims to include in the JWT. These will be merged with the default claims.",
               "additionalProperties": true
-            },
-            "expiresIn": {
-              "oneOf": [
-                {
-                  "type": "number",
-                  "description": "Expiration time in seconds."
-                },
-                {
-                  "type": "string",
-                  "description": "Expiration time as a string."
-                }
-              ],
-              "default": 300,
-              "examples": [300, "5m", "1h", "7d"],
-              "description": "JWT expiration time. Can be a number (seconds) or a string with units (e.g., '5m' for 5 minutes, '1h' for 1 hour, '7d' for 7 days). Defaults to 300 seconds (5 minutes)."
             }
           }
         }

package/docs/policies/web-bot-auth-inbound/schema.json

@@ -47,11 +47,13 @@
             },
             "allowUnauthenticatedRequests": {
               "type": "boolean",
+              "x-advanced": true,
               "description": "Allow requests without bot signatures to proceed. This is useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.",
               "default": false
             },
             "directoryUrl": {
               "type": "string",
+              "x-advanced": true,
               "description": "Optional URL to a directory of known bots (for verification).",
               "default": null
             }

package/docs/policies/xml-to-json-outbound/schema.json

@@ -55,29 +55,32 @@
               "default": true,
               "description": "Ignore tag attributes."
             },
+            "trimValues": {
+              "type": "boolean",
+              "default": true,
+              "description": "Remove surrounding whitespace from tag or attribute value."
+            },
             "stopNodes": {
               "type": "array",
               "items": {
                 "type": "string"
               },
               "examples": [["root.a", "*.accounts"]],
+              "x-advanced": true,
               "description": "At particular point, if you don't want to parse a tag and it's nested tags then you can set their path in stopNodes. You can also set tags which should not be processed irrespective of their path using \\* as the wildcard."
             },
             "attributeNamePrefix": {
               "type": "string",
               "default": "@_",
+              "x-advanced": true,
               "description": "The prefix of attribute names in the resulting JS object."
             },
             "textNodeName": {
               "type": "string",
               "default": "#text",
+              "x-advanced": true,
               "description": "Text value of a tag is parsed to \\#text property by default."
             },
-            "trimValues": {
-              "type": "boolean",
-              "default": true,
-              "description": "Remove surrounding whitespace from tag or attribute value."
-            },
             "parseOnStatusCodes": {
               "oneOf": [
                 {
@@ -90,6 +93,7 @@
                   }
                 }
               ],
+              "x-advanced": true,
               "description": "A list of status codes and ranges \"200-299, 304\" that should the XML parser should run on. If not set, the parser will run on all status codes.",
               "examples": ["200-299"]
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.72.7",
+  "version": "6.72.8",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.72.7",
-    "@zuplo/core": "6.72.7",
-    "@zuplo/runtime": "6.72.7",
+    "@zuplo/cli": "6.72.8",
+    "@zuplo/core": "6.72.8",
+    "@zuplo/runtime": "6.72.8",
     "@zuplo/test": "1.4.0"
   }
 }

package/docs/articles/zuplo-waf.mdx

@@ -1,156 +0,0 @@
----
-title: Zuplo Managed WAF
----
-
-Zuplo's Managed WAF provides enterprise customers using our **managed edge
-deployment** with comprehensive security protection purpose-built for API
-Gateways. This service offers multiple layers of protection against common
-threats, attacks, and malicious traffic without requiring you to manage complex
-security configurations.
-
-<EnterpriseFeature name="Zuplo Managed WAF" />
-
-:::note
-
-Zuplo Managed WAF is only available for customers using Zuplo's managed edge
-deployment model. Customers using managed dedicated deployments should refer to
-the [Managed Dedicated WAF Options](#managed-dedicated-waf-options) section
-below.
-
-:::
-
-## Available Protection Rules
-
-### OWASP Core Ruleset
-
-Zuplo's Managed WAF includes protection based on the
-[OWASP Core Ruleset](https://owasp.org/www-project-top-ten/), which defends
-against the most critical web application security risks. This includes
-protection against:
-
-- **SQL Injection** - Prevents attackers from inserting malicious SQL code
-- **Cross-Site Scripting (XSS)** - Blocks malicious scripts from being injected
-  into your API responses
-- **Remote Code Execution** - Prevents attackers from executing arbitrary code
-- **Local File Inclusion** - Blocks attempts to access local server files
-- **Remote File Inclusion** - Prevents loading of remote malicious files
-- **PHP Code Injection** - Blocks malicious PHP code execution attempts
-- **HTTP Protocol Violations** - Detects and blocks malformed HTTP requests
-- **Session Fixation** - Prevents session hijacking attempts
-- **Scanner Detection** - Identifies and blocks automated vulnerability scanners
-- **Metadata/Error Leakages** - Prevents exposure of sensitive system
-  information
-
-### OFAC Sanctioned Country Blocking
-
-Zuplo's Managed WAF includes automatic blocking of traffic from countries on the
-[OFAC Sanctions Programs list](https://ofac.treasury.gov/sanctions-programs-and-country-information).
-This helps ensure compliance with U.S. Treasury regulations by preventing API
-access from sanctioned regions.
-
-The blocked country list is automatically updated as OFAC sanctions change,
-ensuring your API remains compliant without manual intervention.
-
-### DDoS Protection
-
-All Zuplo API Gateways include automatic DDoS protection that defends against:
-
-- **Layer 3/4 Attacks** - Network and transport layer flood attacks
-- **Layer 7 Attacks** - Application layer attacks targeting your API endpoints
-- **Amplification Attacks** - DNS, NTP, and other amplification-based attacks
-- **SYN Floods** - TCP connection exhaustion attempts
-- **HTTP Floods** - High-volume HTTP request attacks
-
-DDoS protection is always-on and automatically scales to handle attacks of any
-size without impacting legitimate traffic.
-
-### Zero-Day Vulnerability Protection
-
-Zuplo's Managed WAF includes rapid response protection against emerging threats
-and zero-day vulnerabilities. When critical vulnerabilities are discovered,
-protection rules are automatically deployed across all protected gateways
-without requiring any action from your team.
-
-## Custom WAF Rules
-
-Enterprise customers can work with Zuplo to create and enable custom WAF rules
-tailored to their specific security requirements. Custom rules can be configured
-to:
-
-- Block or allow traffic based on specific patterns
-- Create IP allowlists or blocklists
-- Implement rate limiting for specific endpoints
-- Add custom request validation
-- Create geography-based access controls beyond OFAC requirements
-- Implement custom bot detection and mitigation
-
-To discuss custom WAF rule requirements, contact your Zuplo account team.
-
-## Enabling Zuplo Managed WAF
-
-Zuplo's Managed WAF is available to enterprise customers. The service can be
-enabled with different protection levels based on your security requirements:
-
-- **Standard Protection** - OWASP Core Rules and DDoS protection
-- **Enhanced Protection** - Includes OFAC blocking and zero-day protection
-- **Custom Protection** - All features plus custom rules tailored to your needs
-
-To enable Zuplo's Managed WAF on your API Gateway, contact our
-[sales team](mailto:sales@zuplo.com).
-
-## Benefits
-
-- **Edge-deployed protection** - Security rules run at the same edge locations
-  as your API, ensuring no additional latency
-- **Automatic updates** - Protection rules are continuously updated without
-  requiring deployments
-- **No configuration complexity** - Pre-configured rulesets based on security
-  best practices
-- **Compliance support** - Automatic OFAC sanctions compliance
-- **24/7 protection** - Always-on security monitoring and threat mitigation
-
-## Complementary Zuplo Policies
-
-In addition to Zuplo Managed WAF, you can implement many security features
-directly using Zuplo's built-in policies:
-
-- **IP Restriction** - Block or allow specific IP addresses with the
-  [IP Restriction policy](../policies/ip-restriction-inbound)
-- **Geolocation Controls** - Route or block requests based on geographic
-  location using [custom policies](../guides/geolocation-backend-routing)
-- **Rate Limiting** - Implement granular rate limits with
-  [rate limiting policies](../policies/rate-limit-inbound)
-- **Custom Security Rules** - Create any custom security logic with
-  [custom code policies](../policies/custom-code-inbound)
-
-These policies can be used alongside Zuplo Managed WAF for defense-in-depth
-security or independently for specific security requirements.
-
-## Managed Dedicated WAF Options
-
-For customers using Zuplo's managed dedicated deployment model, WAF and DDoS
-protection options depend on your chosen cloud provider. Unlike the standardized
-Zuplo Managed WAF available for edge deployments, managed dedicated customers
-can leverage the full range of security services offered by their cloud
-platform.
-
-For managed dedicated deployments, our team will:
-
-1. Assess your security requirements during the deployment planning phase
-2. Configure the appropriate WAF and DDoS services based on your cloud provider
-3. Implement custom rules and policies specific to your use case
-4. Provide ongoing support for security configuration updates
-
-Contact our [sales team](mailto:sales@zuplo.com) to discuss security options for
-your managed dedicated deployment.
-
-## Next Steps
-
-If you're interested in Zuplo's Managed WAF services for edge deployments or
-need custom security configurations for managed dedicated deployments, contact
-our [sales team](mailto:sales@zuplo.com) to discuss your requirements.
-
-For customers requiring full control over WAF configurations, see our guides for
-integrating with [Cloudflare WAF](./waf-ddos.mdx#cloudflare-waf--ddos),
-[Fastly Next-Gen WAF](./waf-ddos-fastly.mdx), or
-[AWS WAF + Shield](./waf-ddos-aws-waf-shield.mdx).