From 08ce0c83dd0ff4b0f3a5932f94e22306510ca866 Mon Sep 17 00:00:00 2001
From: Joe Porpeglia <josephp@spotify.com>
Date: Fri, 4 Feb 2022 15:27:51 -0500
Subject: [PATCH] Use strict() validation for permission criteria zod schemas

Signed-off-by: Joe Porpeglia <josephp@spotify.com>
---
 .../permission-common/src/PermissionClient.ts    | 15 ++++++++++++---
 .../createPermissionIntegrationRouter.ts         | 16 +++++++++-------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/plugins/permission-common/src/PermissionClient.ts b/plugins/permission-common/src/PermissionClient.ts
index 45224afc91..9431050690 100644
--- a/plugins/permission-common/src/PermissionClient.ts
+++ b/plugins/permission-common/src/PermissionClient.ts
@@ -43,9 +43,18 @@ const permissionCriteriaSchema: z.ZodSchema<
       rule: z.string(),
       params: z.array(z.unknown()),
     })
-    .or(z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }))
-    .or(z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }))
-    .or(z.object({ not: permissionCriteriaSchema })),
+    .strict()
+    .or(
+      z
+        .object({ anyOf: z.array(permissionCriteriaSchema).nonempty() })
+        .strict(),
+    )
+    .or(
+      z
+        .object({ allOf: z.array(permissionCriteriaSchema).nonempty() })
+        .strict(),
+    )
+    .or(z.object({ not: permissionCriteriaSchema }).strict()),
 );
 
 const responseSchema = z.object({
diff --git a/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts b/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts
index 20c5cee20a..efb5d7c3a6 100644
--- a/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts
+++ b/plugins/permission-node/src/integration/createPermissionIntegrationRouter.ts
@@ -38,13 +38,15 @@ const permissionCriteriaSchema: z.ZodSchema<
   PermissionCriteria<PermissionCondition>
 > = z.lazy(() =>
   z.union([
-    z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }),
-    z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }),
-    z.object({ not: permissionCriteriaSchema }),
-    z.object({
-      rule: z.string(),
-      params: z.array(z.unknown()),
-    }),
+    z.object({ anyOf: z.array(permissionCriteriaSchema).nonempty() }).strict(),
+    z.object({ allOf: z.array(permissionCriteriaSchema).nonempty() }).strict(),
+    z.object({ not: permissionCriteriaSchema }).strict(),
+    z
+      .object({
+        rule: z.string(),
+        params: z.array(z.unknown()),
+      })
+      .strict(),
   ]),
 );