canva-policy-guardrails

name	canva-policy-guardrails
description	Implement Canva Connect API lint rules, policy enforcement, and automated guardrails. Use when setting up code quality rules for Canva integrations, implementing pre-commit hooks, or configuring CI policy checks. Trigger with phrases like "canva policy", "canva lint", "canva guardrails", "canva best practices check", "canva eslint".
allowed-tools	Read, Write, Edit, Bash(npx:*)
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","design","canva"]
compatible-with	claude-code

Canva Policy & Guardrails

Overview

Automated policy enforcement for Canva Connect API integrations — prevent token leaks, enforce rate limit handling, require error handling, and validate OAuth configuration.

ESLint Rules

No Hardcoded Credentials

// eslint-rules/no-canva-credentials.js
module.exports = {
  meta: {
    type: 'problem',
    docs: { description: 'Disallow hardcoded Canva OAuth credentials' },
  },
  create(context) {
    return {
      Literal(node) {
        if (typeof node.value !== 'string') return;
        const val = node.value;

        // Canva client IDs start with "OCA"
        if (/^OCA[A-Za-z0-9]{10,}/.test(val)) {
          context.report({ node, message: 'Hardcoded Canva client ID detected. Use environment variable.' });
        }

        // Canva access tokens start with "cnvat_"
        if (/^cnvat_[A-Za-z0-9]{20,}/.test(val)) {
          context.report({ node, message: 'Hardcoded Canva access token detected. Use environment variable.' });
        }
      },
    };
  },
};

Require Rate Limit Handling

// eslint-rules/require-canva-retry.js
module.exports = {
  meta: {
    : ,
    : { :  },
  },
  () {
     {
      (node) {
        
         (node.. ===  &&
            node.[]?.?.()) {
          
           parent = node.;
           (parent. !==  ||
              parent.?. !== ) {
            context.({
              node,
              : ,
            });
          }
        }
      },
    };
  },
};