@aooth/arbac-core 0.1.76 → 0.1.78

package/dist/index.cjs

@@ -9,6 +9,8 @@ function arbacPatternToRegex(input) {
 }
 //#endregion
 //#region src/arbac.ts
+/** Most memoized action matches per compiled (role, resource); past it, matched per call. */
+const MAX_MEMOIZED_ACTIONS = 512;
 /**
 * Implements Advanced Role-Based Access Control (ARBAC) system.
 * This class allows registering roles and resources, and evaluating access permissions based on user attributes and roles.
@@ -20,6 +22,7 @@ var Arbac = class {
 	roles = {};
 	resources = {};
 	warnedRoles = /* @__PURE__ */ new Set();
+	actionMatches = /* @__PURE__ */ new WeakMap();
 	/**
 	* Registers a new role with the ARBAC system.
 	*
@@ -119,28 +122,60 @@ var Arbac = class {
 	* runs it once (no attenuation) or twice (ceiling + narrowed credential view).
 	*/
 	async evaluateForRoles(res, roleIds, getAttrs, id) {
-		const roles = roleIds.map((r) => {
-			const role = this.resources[res.resource][r];
-			if (!role && !this.roles[r] && !this.warnedRoles.has(r)) {
+		const perResource = this.resources[res.resource];
+		const roles = [];
+		for (const r of roleIds) {
+			const role = perResource[r];
+			if (role) roles.push(role);
+			else if (!this.roles[r] && !this.warnedRoles.has(r)) {
 				this.warnedRoles.add(r);
 				console.warn(`Role "${r}" assigned to user "${id}" does not exist.`);
 			}
-			return role;
-		}).filter(Boolean);
+		}
 		if (roles.length === 0) return { allowed: false };
-		for (const role of roles) for (const rule of role.deny) if (rule._actionRegex.test(res.action)) return { allowed: false };
+		const matches = roles.map((role) => this.matchAction(role, res.action));
+		for (const match of matches) if (match.deny) return { allowed: false };
 		const scopes = [];
 		let allowed = false;
-		for (const role of roles) for (const rule of role.allow) if (rule._actionRegex.test(res.action)) {
+		let attrs;
+		let haveAttrs = false;
+		for (const match of matches) for (const rule of match.allow) {
 			allowed = true;
-			if (rule.scope) scopes.push(rule.scope(await getAttrs(), String(id)));
-			else scopes.push({});
+			if (rule.scope) {
+				if (!haveAttrs) {
+					attrs = await getAttrs();
+					haveAttrs = true;
+				}
+				scopes.push(rule.scope(attrs, String(id)));
+			} else scopes.push({});
 		}
 		return allowed ? {
 			allowed,
 			scopes
 		} : { allowed };
 	}
+	/**
+	* The rules of one compiled (role, resource) that match `action`: whether
+	* any deny rule does, and the matching allow rules in declaration order.
+	* Memoized per compiled object (a re-registered role or resource compiles
+	* a fresh one, so the memo resets with it), bounded per object.
+	*/
+	matchAction(role, action) {
+		let perAction = this.actionMatches.get(role);
+		if (!perAction) {
+			perAction = /* @__PURE__ */ new Map();
+			this.actionMatches.set(role, perAction);
+		}
+		let match = perAction.get(action);
+		if (!match) {
+			match = {
+				deny: role.deny.some((rule) => rule._actionRegex.test(action)),
+				allow: role.allow.filter((rule) => rule._actionRegex.test(action))
+			};
+			if (perAction.size < MAX_MEMOIZED_ACTIONS) perAction.set(action, match);
+		}
+		return match;
+	}
 };
 //#endregion
 exports.Arbac = Arbac;

package/dist/index.d.cts

@@ -51,6 +51,7 @@ declare class Arbac<TUserAttrs extends object, TScope extends object> {
   protected roles: Record<string, TArbacRole<TUserAttrs, TScope> | undefined>;
   protected resources: Record<string, Record<string, TArbacRoleForResource<TUserAttrs, TScope> | undefined> | undefined>;
   private warnedRoles;
+  private actionMatches;
   /**
    * Registers a new role with the ARBAC system.
    *
@@ -123,6 +124,13 @@ declare class Arbac<TUserAttrs extends object, TScope extends object> {
     resource: string;
     action: string;
   }, roleIds: string[], getAttrs: () => Promise<TUserAttrs>, id: string | undefined): Promise<TArbacEvalResult<TScope>>;
+  /**
+   * The rules of one compiled (role, resource) that match `action`: whether
+   * any deny rule does, and the matching allow rules in declaration order.
+   * Memoized per compiled object (a re-registered role or resource compiles
+   * a fresh one, so the memo resets with it), bounded per object.
+   */
+  private matchAction;
 }
 //#endregion
 //#region src/utils.d.ts

package/dist/index.d.mts

@@ -51,6 +51,7 @@ declare class Arbac<TUserAttrs extends object, TScope extends object> {
   protected roles: Record<string, TArbacRole<TUserAttrs, TScope> | undefined>;
   protected resources: Record<string, Record<string, TArbacRoleForResource<TUserAttrs, TScope> | undefined> | undefined>;
   private warnedRoles;
+  private actionMatches;
   /**
    * Registers a new role with the ARBAC system.
    *
@@ -123,6 +124,13 @@ declare class Arbac<TUserAttrs extends object, TScope extends object> {
     resource: string;
     action: string;
   }, roleIds: string[], getAttrs: () => Promise<TUserAttrs>, id: string | undefined): Promise<TArbacEvalResult<TScope>>;
+  /**
+   * The rules of one compiled (role, resource) that match `action`: whether
+   * any deny rule does, and the matching allow rules in declaration order.
+   * Memoized per compiled object (a re-registered role or resource compiles
+   * a fresh one, so the memo resets with it), bounded per object.
+   */
+  private matchAction;
 }
 //#endregion
 //#region src/utils.d.ts

package/dist/index.mjs

@@ -8,6 +8,8 @@ function arbacPatternToRegex(input) {
 }
 //#endregion
 //#region src/arbac.ts
+/** Most memoized action matches per compiled (role, resource); past it, matched per call. */
+const MAX_MEMOIZED_ACTIONS = 512;
 /**
 * Implements Advanced Role-Based Access Control (ARBAC) system.
 * This class allows registering roles and resources, and evaluating access permissions based on user attributes and roles.
@@ -19,6 +21,7 @@ var Arbac = class {
 	roles = {};
 	resources = {};
 	warnedRoles = /* @__PURE__ */ new Set();
+	actionMatches = /* @__PURE__ */ new WeakMap();
 	/**
 	* Registers a new role with the ARBAC system.
 	*
@@ -118,28 +121,60 @@ var Arbac = class {
 	* runs it once (no attenuation) or twice (ceiling + narrowed credential view).
 	*/
 	async evaluateForRoles(res, roleIds, getAttrs, id) {
-		const roles = roleIds.map((r) => {
-			const role = this.resources[res.resource][r];
-			if (!role && !this.roles[r] && !this.warnedRoles.has(r)) {
+		const perResource = this.resources[res.resource];
+		const roles = [];
+		for (const r of roleIds) {
+			const role = perResource[r];
+			if (role) roles.push(role);
+			else if (!this.roles[r] && !this.warnedRoles.has(r)) {
 				this.warnedRoles.add(r);
 				console.warn(`Role "${r}" assigned to user "${id}" does not exist.`);
 			}
-			return role;
-		}).filter(Boolean);
+		}
 		if (roles.length === 0) return { allowed: false };
-		for (const role of roles) for (const rule of role.deny) if (rule._actionRegex.test(res.action)) return { allowed: false };
+		const matches = roles.map((role) => this.matchAction(role, res.action));
+		for (const match of matches) if (match.deny) return { allowed: false };
 		const scopes = [];
 		let allowed = false;
-		for (const role of roles) for (const rule of role.allow) if (rule._actionRegex.test(res.action)) {
+		let attrs;
+		let haveAttrs = false;
+		for (const match of matches) for (const rule of match.allow) {
 			allowed = true;
-			if (rule.scope) scopes.push(rule.scope(await getAttrs(), String(id)));
-			else scopes.push({});
+			if (rule.scope) {
+				if (!haveAttrs) {
+					attrs = await getAttrs();
+					haveAttrs = true;
+				}
+				scopes.push(rule.scope(attrs, String(id)));
+			} else scopes.push({});
 		}
 		return allowed ? {
 			allowed,
 			scopes
 		} : { allowed };
 	}
+	/**
+	* The rules of one compiled (role, resource) that match `action`: whether
+	* any deny rule does, and the matching allow rules in declaration order.
+	* Memoized per compiled object (a re-registered role or resource compiles
+	* a fresh one, so the memo resets with it), bounded per object.
+	*/
+	matchAction(role, action) {
+		let perAction = this.actionMatches.get(role);
+		if (!perAction) {
+			perAction = /* @__PURE__ */ new Map();
+			this.actionMatches.set(role, perAction);
+		}
+		let match = perAction.get(action);
+		if (!match) {
+			match = {
+				deny: role.deny.some((rule) => rule._actionRegex.test(action)),
+				allow: role.allow.filter((rule) => rule._actionRegex.test(action))
+			};
+			if (perAction.size < MAX_MEMOIZED_ACTIONS) perAction.set(action, match);
+		}
+		return match;
+	}
 };
 //#endregion
 export { Arbac, arbacPatternToRegex };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-core",
-  "version": "0.1.76",
+  "version": "0.1.78",
   "description": "Advanced Role-Based Access Control (ARBAC) engine",
   "keywords": [
     "access-control",