Enforce strict schema validation for PAM config creation/edit

Author: ukumar-ks

KeeperSdk/src/index.ts

@@ -936,6 +936,7 @@ export {
     mergeRecordFields,
     adjustPamConfigurationFields,
     seedPamConfigurationFieldsFromRecordTypeSoft,
+    seedPamConfigurationFieldsFromRecordTypeStrict,
     readTypedRecordPayload,
     upsertPamResourcesField,
     resolveGatewayUidSoft,

KeeperSdk/src/pam/config/configMutationHelpers.ts

@@ -76,6 +76,39 @@ async function seedPamConfigurationFieldsFromRecordType(
     return getFallbackSchemaFields(configType)
 }
 
+export async function seedPamConfigurationFieldsFromRecordTypeStrict(
+    auth: Auth,
+    configType: string
+): Promise<PamConfigurationRecordFieldInput[]> {
+    const schemaFields = await getNsfRecordTypeFields(auth, configType)
+    if (!schemaFields?.length) {
+        throw new KeeperSdkError(
+            `Record type "${configType}" not found on the server. Ensure the record type is properly configured. Cannot create or edit PAM Configuration without server-defined schema.`,
+            ResultCodes.PAM_CONFIG_TYPE_INVALID
+        )
+    }
+
+    const seeded: PamConfigurationRecordFieldInput[] = []
+    for (const entry of schemaFields) {
+        if (!entry || typeof entry !== 'object') continue
+        const field = entry as { $ref?: unknown; label?: unknown; required?: unknown }
+        const type = typeof field.$ref === 'string' ? field.$ref.trim() : ''
+        if (!type) continue
+        const label = typeof field.label === 'string' && field.label.trim() ? field.label.trim() : undefined
+        const required = field.required === true ? true : undefined
+        seeded.push({ type, label, required, value: [] })
+    }
+
+    if (!seeded.length) {
+        throw new KeeperSdkError(
+            `Record type "${configType}" exists but has no valid fields in its schema. Check server configuration.`,
+            ResultCodes.PAM_CONFIG_TYPE_INVALID
+        )
+    }
+
+    return seeded
+}
+
 export async function seedPamConfigurationFieldsFromRecordTypeSoft(
     auth: Auth,
     configType: string,

KeeperSdk/src/pam/config/createConfig.ts

@@ -18,7 +18,7 @@ import {
     linkConfigurationController,
     normalizeFields,
     resolveGatewayUidSoft,
-    seedPamConfigurationFieldsFromRecordTypeSoft,
+    seedPamConfigurationFieldsFromRecordTypeStrict,
     upsertPamResourcesField,
 } from './configMutationHelpers'
 import {
@@ -67,9 +67,7 @@ export async function createPamConfiguration(
             `Failed to resolve gateway "${gateway}": ${error}. Configuration will be created without a gateway controller link.`,
     })
 
-    const seededFields = await seedPamConfigurationFieldsFromRecordTypeSoft(auth, configType, (warning) =>
-        warnings.push(warning)
-    )
+    const seededFields = await seedPamConfigurationFieldsFromRecordTypeStrict(auth, configType)
     const adjusted = adjustPamConfigurationFields(
         seededFields,
         normalizeFields(input.fields),

KeeperSdk/src/pam/config/editConfig.ts

@@ -11,7 +11,7 @@ import {
     readTypedRecordPayload,
     resolveGatewayUidSoft,
     resolveResourceRecordUidsToRemove,
-    seedPamConfigurationFieldsFromRecordTypeSoft,
+    seedPamConfigurationFieldsFromRecordTypeStrict,
     upsertPamResourcesField,
 } from './configMutationHelpers'
 import {
@@ -148,12 +148,10 @@ export async function editPamConfiguration(
             adminCredentialUid = trimmed || undefined
         }
 
-        const seededFields = await seedPamConfigurationFieldsFromRecordTypeSoft(auth, configType, (warning) =>
-            warnings.push(warning)
-        )
+        const seededFields = await seedPamConfigurationFieldsFromRecordTypeStrict(auth, configType)
         const valueUpdates = mergeRecordFields(existing.fields, input.fields)
         const adjusted = adjustPamConfigurationFields(
-            seededFields.length ? seededFields : valueUpdates,
+            seededFields,
             valueUpdates,
             mergeRecordFields(existing.custom, input.custom)
         )

KeeperSdk/src/pam/config/index.ts

@@ -97,6 +97,7 @@ export {
     mergeRecordFields,
     adjustPamConfigurationFields,
     seedPamConfigurationFieldsFromRecordTypeSoft,
+    seedPamConfigurationFieldsFromRecordTypeStrict,
     readTypedRecordPayload,
     upsertPamResourcesField,
     resolveGatewayUidSoft,

KeeperSdk/src/pam/index.ts

@@ -116,6 +116,7 @@ export {
     mergeRecordFields,
     adjustPamConfigurationFields,
     seedPamConfigurationFieldsFromRecordTypeSoft,
+    seedPamConfigurationFieldsFromRecordTypeStrict,
     readTypedRecordPayload,
     upsertPamResourcesField,
     resolveGatewayUidSoft,