canva-policy-guardrails

# Canva Policy & Guardrails ## Overview Automated policy enforcement for Canva Connect API integrations — prevent token leaks, enforce rate limit handling, require error handling, and validate OAuth configuration. ## ESLint Rules ### No Hardcoded Credentials ```javascript // eslint-rules/no-canva-credentials.js module.exports = { meta: { type: 'problem', docs: { description: 'Disallow hardcoded Canva OAuth credentials' }, }, create(context) { return { Literal(node) { if (typeof node.value !== 'string') return; const val = node.value; // Canva client IDs start with "OCA" if (/^OCA[A-Za-z0-9]{10,}/.test(val)) { context.report({ node, message: 'Hardcoded Canva client ID detected. Use environment variable.' }); } // Canva access tokens start with "cnvat_" if (/^cnvat_[A-Za-z0-9]{20,}/.test(val)) { context.report({ node, message: 'Hardcoded Canva access token detected. Use environment variable.' }); } }, }; }, }; ``` ### Require Rate Limit Handling ```javascript // eslint-rules/require-canva-retry.js module.exports = { meta: { type: 'suggestion', docs: { description: 'Canva API calls should handle 429 responses' }, }, create(context) { return { CallExpression(node) { // Check for fetch calls to api.canva.com if (node.callee.name === 'fetch' && node.arguments[0]?.value?.includes('api.canva.com')) { ...