okta-mcp-server/dist/tools/policies/schemas.js

Model Context Protocol (MCP) server for Okta API operations with support for bulk operations and caching

import { z } from 'zod';
// Policy types supported by Okta
export const PolicyTypeSchema = z.enum([
    'PASSWORD',
    'OKTA_SIGN_ON',
    'MFA_ENROLL',
    'IDP_DISCOVERY',
    'PROFILE_ENROLLMENT',
]);
// Policy status
export const PolicyStatusSchema = z.enum(['ACTIVE', 'INACTIVE']);
// Policy rule status
export const PolicyRuleStatusSchema = z.enum(['ACTIVE', 'INACTIVE']);
// Factor types for MFA policies
export const FactorTypeSchema = z.enum([
    'okta_verify',
    'okta_sms',
    'okta_voice',
    'okta_email',
    'google_otp',
    'fido_webauthn',
    'fido_u2f',
    'rsa_token',
    'symantec_vip',
    'duo',
    'hotp',
    'question',
]);
// Base policy schema
export const BasePolicySchema = z.object({
    name: z.string(),
    description: z.string().optional(),
    priority: z.number().min(1).optional(),
    status: PolicyStatusSchema.default('ACTIVE'),
    system: z.boolean().optional(),
});
// Password policy complexity settings
export const PasswordComplexitySchema = z.object({
    minLength: z.number().min(4).max(100).optional(),
    minLowerCase: z.number().min(0).max(10).optional(),
    minUpperCase: z.number().min(0).max(10).optional(),
    minNumber: z.number().min(0).max(10).optional(),
    minSymbol: z.number().min(0).max(10).optional(),
    excludeUsername: z.boolean().optional(),
    excludeFirstName: z.boolean().optional(),
    excludeLastName: z.boolean().optional(),
    excludeAttributes: z.array(z.string()).optional(),
    dictionary: z
        .object({
        common: z
            .object({
            exclude: z.boolean().optional(),
        })
            .optional(),
    })
        .optional(),
});
// Password policy age settings
export const PasswordAgeSchema = z.object({
    maxAgeDays: z.number().min(0).max(999).optional(),
    expireWarnDays: z.number().min(0).max(999).optional(),
    minAgeMinutes: z.number().min(0).optional(),
    historyCount: z.number().min(0).max(24).optional(),
});
// Password policy lockout settings
export const PasswordLockoutSchema = z.object({
    maxAttempts: z.number().min(0).max(100).optional(),
    autoUnlockMinutes: z.number().min(0).max(99999).optional(),
    showLockoutFailures: z.boolean().optional(),
    userLockoutNotificationChannels: z.array(z.enum(['EMAIL', 'SMS'])).optional(),
});
// Password policy settings
export const PasswordPolicySettingsSchema = z.object({
    password: z
        .object({
        complexity: PasswordComplexitySchema.optional(),
        age: PasswordAgeSchema.optional(),
        lockout: PasswordLockoutSchema.optional(),
    })
        .optional(),
    recovery: z
        .object({
        factors: z
            .object({
            recovery_question: z
                .object({
                status: z.enum(['ACTIVE', 'INACTIVE']).optional(),
                properties: z
                    .object({
                    complexity: z
                        .object({
                        minLength: z.number().min(1).max(100).optional(),
                    })
                        .optional(),
                })
                    .optional(),
            })
                .optional(),
            okta_email: z
                .object({
                status: z.enum(['ACTIVE', 'INACTIVE']).optional(),
                properties: z
                    .object({
                    recoveryToken: z
                        .object({
                        tokenLifetimeMinutes: z.number().min(5).max(10080).optional(),
                    })
                        .optional(),
                })
                    .optional(),
            })
                .optional(),
            okta_sms: z
                .object({
                status: z.enum(['ACTIVE', 'INACTIVE']).optional(),
            })
                .optional(),
            okta_call: z
                .object({
                status: z.enum(['ACTIVE', 'INACTIVE']).optional(),
            })
                .optional(),
        })
            .optional(),
    })
        .optional(),
    delegation: z
        .object({
        options: z
            .object({
            skipUnlock: z.boolean().optional(),
        })
            .optional(),
    })
        .optional(),
});
// Sign-on policy settings
export const SignOnPolicySettingsSchema = z.object({
    signon: z
        .object({
        access: z.enum(['ALLOW', 'DENY']).optional(),
        requireFactor: z.boolean().optional(),
        factorMode: z.enum(['1FA', '2FA']).optional(),
        factorPromptMode: z.enum(['ALWAYS', 'DEVICE', 'SESSION']).optional(),
        rememberDeviceByDefault: z.boolean().optional(),
        factorLifetime: z.number().min(0).optional(),
        session: z
            .object({
            usePersistentCookie: z.boolean().optional(),
            maxSessionIdleMinutes: z.number().min(5).max(2628000).optional(),
            maxSessionLifetimeMinutes: z.number().min(5).max(2628000).optional(),
        })
            .optional(),
    })
        .optional(),
});
// MFA policy settings - supports both factors (legacy) and authenticators (modern) format
export const MfaPolicySettingsSchema = z.object({
    factors: z
        .record(FactorTypeSchema, z.object({
        status: z.enum(['REQUIRED', 'OPTIONAL', 'NOT_SETUP', 'INACTIVE']).optional(),
        enroll: z.enum(['REQUIRED', 'OPTIONAL', 'NOT_SETUP']).optional(),
    }))
        .optional(),
    authenticators: z
        .array(z.object({
        key: z.string(),
        enroll: z
            .object({
            self: z.enum(['REQUIRED', 'OPTIONAL', 'NOT_SETUP']).optional(),
        })
            .optional(),
        status: z.enum(['REQUIRED', 'OPTIONAL', 'NOT_SETUP', 'INACTIVE']).optional(),
    }))
        .optional(),
});
// Policy conditions
export const PolicyConditionsSchema = z.object({
    people: z
        .object({
        users: z
            .object({
            include: z.array(z.string()).optional(),
            exclude: z.array(z.string()).optional(),
        })
            .optional(),
        groups: z
            .object({
            include: z.array(z.string()).optional(),
            exclude: z.array(z.string()).optional(),
        })
            .optional(),
    })
        .optional(),
    network: z
        .object({
        connection: z.enum(['ANYWHERE', 'ZONE']).optional(),
        include: z.array(z.string()).optional(),
        exclude: z.array(z.string()).optional(),
    })
        .optional(),
    authContext: z
        .object({
        authType: z.enum(['ANY', 'RADIUS']).optional(),
    })
        .optional(),
    app: z
        .object({
        include: z
            .array(z.object({
            type: z.enum(['APP', 'APP_TYPE']),
            id: z.string().optional(),
            name: z.string().optional(),
        }))
            .optional(),
        exclude: z
            .array(z.object({
            type: z.enum(['APP', 'APP_TYPE']),
            id: z.string().optional(),
            name: z.string().optional(),
        }))
            .optional(),
    })
        .optional(),
    platform: z
        .object({
        include: z
            .array(z.object({
            type: z.enum(['ANY', 'MOBILE', 'DESKTOP']),
            os: z
                .object({
                type: z
                    .enum([
                    'ANY',
                    'IOS',
                    'ANDROID',
                    'OSX',
                    'WINDOWS',
                    'MOBILE_OTHER',
                    'DESKTOP_OTHER',
                ])
                    .optional(),
                version: z
                    .object({
                    minimum: z.string().optional(),
                })
                    .optional(),
            })
                .optional(),
        }))
            .optional(),
    })
        .optional(),
    userIdentifier: z
        .object({
        patterns: z
            .array(z.object({
            matchType: z.enum(['EQUALS', 'CONTAINS', 'STARTS_WITH', 'SUFFIX']).optional(),
            value: z.string(),
        }))
            .optional(),
        type: z.enum(['ATTRIBUTE', 'IDENTIFIER']).optional(),
        attribute: z.string().optional(),
    })
        .optional(),
    grantTypes: z
        .object({
        include: z
            .array(z.enum([
            'authorization_code',
            'implicit',
            'password',
            'refresh_token',
            'client_credentials',
            'urn:ietf:params:oauth:grant-type:device_code',
            'urn:ietf:params:oauth:grant-type:token-exchange',
        ]))
            .optional(),
    })
        .optional(),
    scopes: z
        .object({
        include: z.array(z.string()).optional(),
    })
        .optional(),
});
// Policy rule actions
export const PolicyRuleActionsSchema = z.object({
    signon: z
        .object({
        access: z.enum(['ALLOW', 'DENY']).optional(),
        requireFactor: z.boolean().optional(),
        factorMode: z.enum(['1FA', '2FA']).optional(),
        factorPromptMode: z.enum(['ALWAYS', 'DEVICE', 'SESSION']).optional(),
        factorLifetime: z.number().min(0).optional(),
        session: z
            .object({
            usePersistentCookie: z.boolean().optional(),
            maxSessionIdleMinutes: z.number().min(5).max(2628000).optional(),
            maxSessionLifetimeMinutes: z.number().min(5).max(2628000).optional(),
        })
            .optional(),
    })
        .optional(),
    password: z
        .object({
        change: z.enum(['ALLOW', 'DENY']).optional(),
        reset: z.enum(['ALLOW', 'DENY']).optional(),
        unlock: z.enum(['ALLOW', 'DENY']).optional(),
    })
        .optional(),
    enroll: z
        .object({
        self: z.enum(['CHALLENGE', 'LOGIN', 'NEVER']).optional(),
    })
        .optional(),
    token: z
        .object({
        accessTokenLifetimeMinutes: z.number().min(5).max(1440).optional(),
        refreshTokenLifetimeMinutes: z.number().min(10).max(2628000).optional(),
        refreshTokenWindowMinutes: z.number().min(10).max(2628000).optional(),
        inlineHook: z
            .object({
            id: z.string().optional(),
        })
            .optional(),
    })
        .optional(),
});
// List policies schema
export const ListPoliciesSchema = z.object({
    type: PolicyTypeSchema,
    status: PolicyStatusSchema.optional(),
    limit: z.number().min(1).max(200).default(20),
    after: z.string().optional(),
    sortBy: z.enum(['name', 'priority', 'created', 'lastUpdated']).optional(),
    sortOrder: z.enum(['asc', 'desc']).default('asc'),
    filter: z.string().optional(),
});
// Get policy schema
export const GetPolicySchema = z.object({
    policyId: z.string(),
    expand: z.enum(['rules']).optional(),
});
// Create password policy schema
export const CreatePasswordPolicySchema = z.object({
    name: z.string(),
    description: z.string().optional(),
    priority: z.number().min(1).optional(),
    status: PolicyStatusSchema.default('ACTIVE'),
    conditions: PolicyConditionsSchema.optional(),
    settings: PasswordPolicySettingsSchema.optional(),
});
// Create sign-on policy schema
export const CreateSignOnPolicySchema = z.object({
    name: z.string(),
    description: z.string().optional(),
    priority: z.number().min(1).optional(),
    status: PolicyStatusSchema.default('ACTIVE'),
    conditions: PolicyConditionsSchema.optional(),
    settings: SignOnPolicySettingsSchema.optional(),
});
// Create MFA policy schema
export const CreateMfaPolicySchema = z.object({
    name: z.string(),
    description: z.string().optional(),
    priority: z.number().min(1).optional(),
    status: PolicyStatusSchema.default('ACTIVE'),
    conditions: PolicyConditionsSchema.optional(),
    settings: MfaPolicySettingsSchema.optional(),
});
// Update policy schema
export const UpdatePolicySchema = z.object({
    policyId: z.string(),
    name: z.string().optional(),
    description: z.string().optional(),
    priority: z.number().min(1).optional(),
    status: PolicyStatusSchema.optional(),
    conditions: PolicyConditionsSchema.optional(),
    settings: z
        .union([PasswordPolicySettingsSchema, SignOnPolicySettingsSchema, MfaPolicySettingsSchema])
        .optional(),
});
// Delete policy schema
export const DeletePolicySchema = z.object({
    policyId: z.string(),
});
// Activate/Deactivate policy schema
export const ActivatePolicySchema = z.object({
    policyId: z.string(),
});
export const DeactivatePolicySchema = z.object({
    policyId: z.string(),
});
// List policy rules schema
export const ListPolicyRulesSchema = z.object({
    policyId: z.string(),
    limit: z.number().min(1).max(200).default(20),
    after: z.string().optional(),
});
// Get policy rule schema
export const GetPolicyRuleSchema = z.object({
    policyId: z.string(),
    ruleId: z.string(),
});
// Create policy rule schema
export const CreatePolicyRuleSchema = z.object({
    policyId: z.string(),
    name: z.string(),
    priority: z.number().min(1).optional(),
    status: PolicyRuleStatusSchema.default('ACTIVE'),
    conditions: PolicyConditionsSchema.optional(),
    actions: PolicyRuleActionsSchema,
});
// Update policy rule schema
export const UpdatePolicyRuleSchema = z.object({
    policyId: z.string(),
    ruleId: z.string(),
    name: z.string().optional(),
    priority: z.number().min(1).optional(),
    status: PolicyRuleStatusSchema.optional(),
    conditions: PolicyConditionsSchema.optional(),
    actions: PolicyRuleActionsSchema.optional(),
});
// Delete policy rule schema
export const DeletePolicyRuleSchema = z.object({
    policyId: z.string(),
    ruleId: z.string(),
});
// Activate/Deactivate policy rule schema
export const ActivatePolicyRuleSchema = z.object({
    policyId: z.string(),
    ruleId: z.string(),
});
export const DeactivatePolicyRuleSchema = z.object({
    policyId: z.string(),
    ruleId: z.string(),
});
// Response schemas
export const PolicyResponseSchema = z.object({
    id: z.string(),
    status: PolicyStatusSchema,
    name: z.string(),
    description: z.string().nullable().optional(),
    priority: z.number(),
    system: z.boolean(),
    created: z.string(),
    lastUpdated: z.string(),
    conditions: PolicyConditionsSchema.optional(),
    settings: z.record(z.unknown()).optional(),
    type: PolicyTypeSchema,
    _links: z.record(z.unknown()).optional(),
    _embedded: z
        .object({
        rules: z
            .array(z.object({
            id: z.string(),
            status: PolicyRuleStatusSchema,
            name: z.string(),
            priority: z.number(),
            created: z.string(),
            lastUpdated: z.string(),
            conditions: PolicyConditionsSchema.optional(),
            actions: PolicyRuleActionsSchema.optional(),
        }))
            .optional(),
    })
        .optional(),
});
export const PolicyRuleResponseSchema = z.object({
    id: z.string(),
    status: PolicyRuleStatusSchema,
    name: z.string(),
    priority: z.number(),
    type: z.string().optional(),
    created: z.string(),
    lastUpdated: z.string(),
    system: z.boolean().optional(),
    conditions: PolicyConditionsSchema.optional(),
    actions: PolicyRuleActionsSchema.optional(),
    _links: z.record(z.unknown()).optional(),
});
export const ListPoliciesResponseSchema = z.object({
    policies: z.array(PolicyResponseSchema),
    _links: z
        .object({
        next: z
            .object({
            href: z.string(),
        })
            .optional(),
    })
        .optional(),
});
export const ListPolicyRulesResponseSchema = z.object({
    rules: z.array(PolicyRuleResponseSchema),
    _links: z
        .object({
        next: z
            .object({
            href: z.string(),
        })
            .optional(),
    })
        .optional(),
});
//# sourceMappingURL=schemas.js.map