@authup/access 1.0.0-beta.33 → 1.0.0-beta.34

package/dist/index.mjs

@@ -1,9 +1,7 @@
 import { AuthupError, ErrorCode } from '@authup/errors';
-import { buildPermissionBindingKey, mergePermissionBindings } from '@authup/core-kit';
-export { buildPermissionBindingKey, isPermissionBindingEqual, mergePermissionBindings } from '@authup/core-kit';
-import { defineIssueItem, defineIssueGroup, Container } from 'validup';
-import { isObject, flattenObject, DecisionStrategy, hasOwnProperty } from '@authup/kit';
+import { DecisionStrategy, isObject, flattenObject, hasOwnProperty } from '@authup/kit';
 export { DecisionStrategy } from '@authup/kit';
+import { defineIssueItem, defineIssueGroup, Container } from 'validup';
 import { createValidator } from '@validup/adapter-zod';
 import { z } from 'zod';
 import { guard } from '@ucast/mongo2js';
@@ -54,25 +52,109 @@ class PermissionError extends AuthupError {
     }
 }
 
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function isPermissionPolicyBindingEqual(a, b) {
+    if (a.permission.name !== b.permission.name) {
+        return false;
+    }
+    if ((a.permission.realm_id ?? null) !== (b.permission.realm_id ?? null)) {
+        return false;
+    }
+    if ((a.permission.client_id ?? null) !== (b.permission.client_id ?? null)) {
+        return false;
+    }
+    return true;
+}
+
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function formatKeySegment(value) {
+    return value || '*';
+}
+function buildPermissionKey(input) {
+    return `${formatKeySegment(input.realm_id)}/${formatKeySegment(input.client_id)}/${input.name}`;
+}
+
+function mergePermissionPolicyBindings(input) {
+    const grouped = input.reduce((previous, current)=>{
+        const key = buildPermissionKey(current.permission);
+        if (!previous[key]) {
+            previous[key] = [];
+        }
+        previous[key].push(current);
+        return previous;
+    }, {});
+    const output = [];
+    const keys = Object.keys(grouped);
+    for (const key of keys){
+        const group = grouped[key];
+        const first = group[0];
+        if (group.length === 1) {
+            output.push(first);
+            continue;
+        }
+        const children = [];
+        for (const element of group){
+            if (!element.policies || element.policies.length === 0) {
+                continue;
+            }
+            const policy = {
+                type: 'composite',
+                decision_strategy: element.permission.decision_strategy || DecisionStrategy.UNANIMOUS,
+                children: element.policies
+            };
+            children.push(policy);
+        }
+        let mergedPolicies;
+        if (children.length > 0 && children.length === group.length) {
+            const policy = {
+                type: 'composite',
+                decision_strategy: DecisionStrategy.AFFIRMATIVE,
+                children
+            };
+            mergedPolicies = [
+                policy
+            ];
+        }
+        output.push({
+            permission: {
+                ...first.permission,
+                decision_strategy: DecisionStrategy.AFFIRMATIVE
+            },
+            policies: mergedPolicies
+        });
+    }
+    return output;
+}
+
 class PermissionMemoryProvider {
     items = {};
     constructor(items = []){
         this.setMany(items);
     }
     async findOne(options) {
-        const entry = this.items[buildPermissionBindingKey({
+        const key = buildPermissionKey({
             name: options.name,
             client_id: options.clientId,
             realm_id: options.realmId
-        })];
+        });
+        const entry = this.items[key];
         if (entry) {
             return entry;
         }
         return null;
     }
     setMany(input) {
-        this.items = mergePermissionBindings(input).reduce((prev, current)=>{
-            prev[buildPermissionBindingKey(current.permission)] = current;
+        this.items = mergePermissionPolicyBindings(input).reduce((prev, current)=>{
+            const key = buildPermissionKey(current.permission);
+            prev[key] = current;
             return prev;
         }, {});
     }
@@ -141,6 +223,18 @@ class PolicyError extends AuthupError {
      * @param policy
      * @param ctx
      */ async evaluate(policy, ctx) {
+        if (!policy.type) {
+            return {
+                success: maybeInvertPolicyOutcome(false, policy.invert),
+                issues: [
+                    defineIssueItem({
+                        path: [],
+                        message: 'The policy can not be handled by any evaluator.',
+                        code: ErrorCode.POLICY_EVALUATOR_NOT_FOUND
+                    })
+                ]
+            };
+        }
         if (ctx.exclude && ctx.exclude.length > 0 && ctx.exclude.includes(policy.type)) {
             return {
                 success: maybeInvertPolicyOutcome(true, policy.invert)
@@ -422,8 +516,8 @@ class AttributesPolicyEvaluator {
                 }
                 if (key === '$regex' && typeof value === 'string') {
                     const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
-                    if (fragments) {
-                        query[key] = new RegExp(fragments[1], fragments[2]);
+                    if (fragments && fragments[1] !== undefined) {
+                        query[key] = new RegExp(fragments[1], fragments[2] || '');
                     }
                 }
             }
@@ -500,11 +594,12 @@ class CompositePolicyEvaluator {
         const decision_strategy = policy.decision_strategy ?? DecisionStrategy.UNANIMOUS;
         const engine = new PolicyEngine(ctx.evaluators);
         const issues = [];
-        for(let i = 0; i < policy.children.length; i++){
-            const childPolicy = policy.children[i];
+        for (const childPolicy of policy.children){
             const path = [
                 ...ctx.path || [],
-                childPolicy.type
+                ...childPolicy.type ? [
+                    childPolicy.type
+                ] : []
             ];
             const outcome = await engine.evaluate(childPolicy, {
                 ...ctx,
@@ -902,10 +997,15 @@ function normalizeDate(input, dateRef) {
 function toDate(input, dateRef) {
     if (typeof input === 'string') {
         if (timeRegex.test(input)) {
-            const [startHours, startMinutes] = input.split(':').map(Number);
-            const date = dateRef ? new Date(dateRef) : new Date();
-            date.setHours(startHours, startMinutes);
-            return date;
+            const parts = input.split(':');
+            const startHours = Number(parts[0]);
+            const startMinutes = Number(parts[1]);
+            const startSeconds = parts[2] !== undefined ? Number(parts[2]) : 0;
+            if (Number.isFinite(startHours) && Number.isFinite(startMinutes) && Number.isFinite(startSeconds)) {
+                const date = dateRef ? new Date(dateRef) : new Date();
+                date.setHours(startHours, startMinutes, startSeconds, 0);
+                return date;
+            }
         }
         return new Date(input);
     }
@@ -1013,18 +1113,10 @@ class PermissionEvaluator {
     clientId;
     realmId;
     // ----------------------------------------------
-    constructor(options = {}){
-        if (options.provider) {
-            this.provider = options.provider;
-        } else {
-            this.provider = new PermissionMemoryProvider();
-        }
-        if (typeof options.clientId !== 'undefined') {
-            this.clientId = options.clientId;
-        }
-        if (typeof options.realmId !== 'undefined') {
-            this.realmId = options.realmId;
-        }
+    constructor(options){
+        this.provider = options.provider;
+        this.clientId = options.clientId || null;
+        this.realmId = options.realmId || null;
         if (options.policyEngine) {
             this.policyEngine = options.policyEngine;
         } else {
@@ -1032,21 +1124,12 @@ class PermissionEvaluator {
         }
     }
     // ----------------------------------------------
-    async findOne(input, overrides) {
-        const options = {
-            name: input
-        };
-        if (typeof overrides?.clientId !== 'undefined') {
-            options.clientId = overrides.clientId;
-        } else if (typeof this.clientId !== 'undefined') {
-            options.clientId = this.clientId;
-        }
-        if (typeof overrides?.realmId !== 'undefined') {
-            options.realmId = overrides.realmId;
-        } else if (typeof this.realmId !== 'undefined') {
-            options.realmId = this.realmId;
-        }
-        return this.provider.findOne(options);
+    async findOne(input, overrides = {}) {
+        return this.provider.findOne({
+            name: input,
+            clientId: overrides.clientId ?? this.clientId,
+            realmId: overrides.realmId ?? this.realmId
+        });
     }
     // ----------------------------------------------
     async evaluate(ctx) {
@@ -1064,17 +1147,17 @@ class PermissionEvaluator {
         const issues = [];
         let count = 0;
         const dataBase = ctx.input || new PolicyData();
-        for(let i = 0; i < ctx.name.length; i++){
-            const binding = await this.findOne(ctx.name[i], {
+        for (const name of ctx.name){
+            const binding = await this.findOne(name, {
                 realmId: ctx.realmId,
                 clientId: ctx.clientId
             });
             if (!binding) {
                 issues.push(defineIssueItem({
                     code: ErrorCode.PERMISSION_NOT_FOUND,
-                    message: `The ${ctx.name[i]} permission could not be resolved`,
+                    message: `The ${name} permission could not be resolved`,
                     path: [
-                        ctx.name[i]
+                        name
                     ]
                 }));
                 if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
@@ -1172,5 +1255,5 @@ class PermissionEvaluator {
     }
 }
 
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, maybeInvertPolicyOutcome };
+export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionKey, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionPolicyBindingEqual, maybeInvertPolicyOutcome, mergePermissionPolicyBindings };
 //# sourceMappingURL=index.mjs.map