21 lines
2.5 KiB
JavaScript
21 lines
2.5 KiB
JavaScript
|
'use strict';
|
||
|
|
const {z}=require('zod');
|
||
|
|
const {RequestFactsSchema}=require('./request-transfer-facts.cjs');
|
||
|
|
const BROKER_REASONS=Object.freeze(['broker-approved','broker-policy-block','broker-inspection-fault','broker-authority-expired','broker-audit-failed','broker-connect-denied','broker-auth-denied','broker-framing-block','broker-size-block','broker-request-aborted','broker-request-timeout','broker-upstream-failed','broker-response-invalid']);
|
||
|
|
const BrokerFactsSchema=z.object({requestId:z.string().uuid(),connectionId:z.string().uuid().optional(),phase:z.enum(['connect.block','request.authorized','request.block','request.fault','forward.fault']),reason:z.enum(BROKER_REASONS),authorizedEventId:z.string().uuid().optional()}).strict();
|
||
|
|
const phaseReasons=Object.freeze({
|
||
|
|
'connect.block':['broker-connect-denied','broker-auth-denied','broker-framing-block','broker-authority-expired','broker-audit-failed','broker-request-timeout','broker-size-block','broker-request-aborted'],
|
||
|
|
'request.authorized':['broker-approved'],
|
||
|
|
'request.block':['broker-policy-block','broker-authority-expired','broker-framing-block','broker-size-block','broker-request-aborted','broker-request-timeout'],
|
||
|
|
'request.fault':['broker-inspection-fault','broker-audit-failed'],
|
||
|
|
'forward.fault':['broker-upstream-failed','broker-response-invalid','broker-request-aborted','broker-request-timeout','broker-authority-expired','broker-audit-failed']
|
||
|
|
});
|
||
|
|
function validateBrokerSemantics(event,context){
|
||
|
|
if(!event.broker)return;
|
||
|
|
const value=event.broker;
|
||
|
|
if(!event.request||event.file||event.kind!==(value.phase==='request.authorized'?'upload.authorized':'upload.block')||!phaseReasons[value.phase].includes(value.reason)||value.phase==='forward.fault'&&!value.authorizedEventId||value.phase!=='forward.fault'&&value.authorizedEventId||value.authorizedEventId===event.eventId){
|
||
|
|
context.addIssue({code:'custom',path:['broker'],message:'Broker lifecycle semantics rejected'});
|
||
|
|
}
|
||
|
|
}
|
||
|
|
const BrokerAuditEventSchema=z.object({eventId:z.string().uuid(),kind:z.enum(['upload.authorized','upload.block']),ruleId:z.string().min(1).max(100),policyVersion:z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),host:z.string().max(253).optional(),request:RequestFactsSchema,broker:BrokerFactsSchema.optional(),traceId:z.string().regex(/^[a-f0-9]{32}$/).optional(),spanId:z.string().regex(/^[a-f0-9]{16}$/).optional()}).strict().superRefine(validateBrokerSemantics);
|
||
|
|
module.exports={BrokerAuditEventSchema,BrokerFactsSchema,BROKER_REASONS,validateBrokerSemantics};
|