@contractspec/lib.contracts 1.56.1 → 1.58.0

package/dist/policy/validation.js

@@ -1,307 +1,391 @@
-//#region src/policy/validation.ts
-/**
-* Validate a policy spec for internal consistency.
-*
-* @param spec - Policy spec to validate
-* @returns Validation result with any issues found
-*
-* @example
-* ```typescript
-* const result = validatePolicySpec(myPolicy);
-* if (!result.valid) {
-*   console.log('Issues:', result.issues);
-* }
-* ```
-*/
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __moduleCache = /* @__PURE__ */ new WeakMap;
+var __toCommonJS = (from) => {
+  var entry = __moduleCache.get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function")
+    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    }));
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: (newValue) => all[name] = () => newValue
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/policy/validation.ts
 function validatePolicySpec(spec) {
-	const issues = [];
-	validateMeta(spec, issues);
-	validateRules(spec, issues);
-	validateFieldPolicies(spec, issues);
-	validateRateLimits(spec, issues);
-	validateConsents(spec, issues);
-	validateRelationships(spec, issues);
-	return {
-		valid: issues.filter((i) => i.level === "error").length === 0,
-		issues
-	};
+  const issues = [];
+  validateMeta(spec, issues);
+  validateRules(spec, issues);
+  validateFieldPolicies(spec, issues);
+  validateRateLimits(spec, issues);
+  validateConsents(spec, issues);
+  validateRelationships(spec, issues);
+  return {
+    valid: issues.filter((i) => i.level === "error").length === 0,
+    issues
+  };
 }
 function validateMeta(spec, issues) {
-	const { meta } = spec;
-	if (!meta.key?.trim()) issues.push({
-		level: "error",
-		message: "Policy must have a non-empty key",
-		path: "meta.key"
-	});
-	if (!meta.version?.trim()) issues.push({
-		level: "error",
-		message: "Policy must have a non-empty version",
-		path: "meta.version"
-	});
-	if (!meta.owners?.length) issues.push({
-		level: "warning",
-		message: "Policy should specify owners",
-		path: "meta.owners"
-	});
+  const { meta } = spec;
+  if (!meta.key?.trim()) {
+    issues.push({
+      level: "error",
+      message: "Policy must have a non-empty key",
+      path: "meta.key"
+    });
+  }
+  if (!meta.version?.trim()) {
+    issues.push({
+      level: "error",
+      message: "Policy must have a non-empty version",
+      path: "meta.version"
+    });
+  }
+  if (!meta.owners?.length) {
+    issues.push({
+      level: "warning",
+      message: "Policy should specify owners",
+      path: "meta.owners"
+    });
+  }
 }
 function validateRules(spec, issues) {
-	if (!spec.rules?.length) {
-		issues.push({
-			level: "warning",
-			message: "Policy has no rules defined",
-			path: "rules"
-		});
-		return;
-	}
-	const seenRateRefs = /* @__PURE__ */ new Set();
-	spec.rules.forEach((rule, index) => {
-		const path = `rules[${index}]`;
-		if (!rule.actions?.length) issues.push({
-			level: "error",
-			message: "Rule must specify at least one action",
-			path: `${path}.actions`
-		});
-		if (!["allow", "deny"].includes(rule.effect)) issues.push({
-			level: "error",
-			message: `Invalid rule effect: ${rule.effect}`,
-			path: `${path}.effect`
-		});
-		if (typeof rule.rateLimit === "string") {
-			seenRateRefs.add(rule.rateLimit);
-			if (!spec.rateLimits?.some((rl) => rl.id === rule.rateLimit)) issues.push({
-				level: "error",
-				message: `Rate limit "${rule.rateLimit}" referenced but not defined`,
-				path: `${path}.rateLimit`
-			});
-		}
-		if (rule.requiresConsent?.length) {
-			for (const consentId of rule.requiresConsent) if (!spec.consents?.some((c) => c.id === consentId)) issues.push({
-				level: "error",
-				message: `Consent "${consentId}" referenced but not defined`,
-				path: `${path}.requiresConsent`
-			});
-		}
-		validateConditions(rule.conditions, `${path}.conditions`, issues);
-	});
-	if (spec.rateLimits?.length) {
-		for (const rl of spec.rateLimits) if (!seenRateRefs.has(rl.id)) {
-			if (!spec.rules.some((r) => typeof r.rateLimit === "object" && r.rateLimit.id === rl.id)) issues.push({
-				level: "info",
-				message: `Rate limit "${rl.id}" is defined but not referenced`,
-				path: `rateLimits`
-			});
-		}
-	}
+  if (!spec.rules?.length) {
+    issues.push({
+      level: "warning",
+      message: "Policy has no rules defined",
+      path: "rules"
+    });
+    return;
+  }
+  const seenRateRefs = new Set;
+  spec.rules.forEach((rule, index) => {
+    const path = `rules[${index}]`;
+    if (!rule.actions?.length) {
+      issues.push({
+        level: "error",
+        message: "Rule must specify at least one action",
+        path: `${path}.actions`
+      });
+    }
+    if (!["allow", "deny"].includes(rule.effect)) {
+      issues.push({
+        level: "error",
+        message: `Invalid rule effect: ${rule.effect}`,
+        path: `${path}.effect`
+      });
+    }
+    if (typeof rule.rateLimit === "string") {
+      seenRateRefs.add(rule.rateLimit);
+      if (!spec.rateLimits?.some((rl) => rl.id === rule.rateLimit)) {
+        issues.push({
+          level: "error",
+          message: `Rate limit "${rule.rateLimit}" referenced but not defined`,
+          path: `${path}.rateLimit`
+        });
+      }
+    }
+    if (rule.requiresConsent?.length) {
+      for (const consentId of rule.requiresConsent) {
+        if (!spec.consents?.some((c) => c.id === consentId)) {
+          issues.push({
+            level: "error",
+            message: `Consent "${consentId}" referenced but not defined`,
+            path: `${path}.requiresConsent`
+          });
+        }
+      }
+    }
+    validateConditions(rule.conditions, `${path}.conditions`, issues);
+  });
+  if (spec.rateLimits?.length) {
+    for (const rl of spec.rateLimits) {
+      if (!seenRateRefs.has(rl.id)) {
+        const hasInline = spec.rules.some((r) => typeof r.rateLimit === "object" && r.rateLimit.id === rl.id);
+        if (!hasInline) {
+          issues.push({
+            level: "info",
+            message: `Rate limit "${rl.id}" is defined but not referenced`,
+            path: `rateLimits`
+          });
+        }
+      }
+    }
+  }
 }
 function validateFieldPolicies(spec, issues) {
-	if (!spec.fieldPolicies?.length) return;
-	const seenFields = /* @__PURE__ */ new Map();
-	spec.fieldPolicies.forEach((rule, index) => {
-		const path = `fieldPolicies[${index}]`;
-		if (!rule.field?.trim()) issues.push({
-			level: "error",
-			message: "Field policy must specify a field",
-			path: `${path}.field`
-		});
-		if (!rule.actions?.length) issues.push({
-			level: "error",
-			message: "Field policy must specify at least one action",
-			path: `${path}.actions`
-		});
-		for (const action of rule.actions) if (!["read", "write"].includes(action)) issues.push({
-			level: "error",
-			message: `Invalid field action: ${action}`,
-			path: `${path}.actions`
-		});
-		const existing = seenFields.get(rule.field) ?? [];
-		existing.push(rule);
-		seenFields.set(rule.field, existing);
-		validateConditions(rule.conditions, `${path}.conditions`, issues);
-	});
-	for (const [field, rules] of seenFields.entries()) if (rules.length > 1) {
-		if (rules.some((r) => r.effect === "allow") && rules.some((r) => r.effect === "deny")) issues.push({
-			level: "warning",
-			message: `Field "${field}" has potentially conflicting allow/deny policies`,
-			path: "fieldPolicies",
-			context: {
-				field,
-				ruleCount: rules.length
-			}
-		});
-	}
+  if (!spec.fieldPolicies?.length)
+    return;
+  const seenFields = new Map;
+  spec.fieldPolicies.forEach((rule, index) => {
+    const path = `fieldPolicies[${index}]`;
+    if (!rule.field?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Field policy must specify a field",
+        path: `${path}.field`
+      });
+    }
+    if (!rule.actions?.length) {
+      issues.push({
+        level: "error",
+        message: "Field policy must specify at least one action",
+        path: `${path}.actions`
+      });
+    }
+    for (const action of rule.actions) {
+      if (!["read", "write"].includes(action)) {
+        issues.push({
+          level: "error",
+          message: `Invalid field action: ${action}`,
+          path: `${path}.actions`
+        });
+      }
+    }
+    const existing = seenFields.get(rule.field) ?? [];
+    existing.push(rule);
+    seenFields.set(rule.field, existing);
+    validateConditions(rule.conditions, `${path}.conditions`, issues);
+  });
+  for (const [field, rules] of seenFields.entries()) {
+    if (rules.length > 1) {
+      const hasConflict = rules.some((r) => r.effect === "allow") && rules.some((r) => r.effect === "deny");
+      if (hasConflict) {
+        issues.push({
+          level: "warning",
+          message: `Field "${field}" has potentially conflicting allow/deny policies`,
+          path: "fieldPolicies",
+          context: { field, ruleCount: rules.length }
+        });
+      }
+    }
+  }
 }
 function validateRateLimits(spec, issues) {
-	if (!spec.rateLimits?.length) return;
-	const seenIds = /* @__PURE__ */ new Set();
-	spec.rateLimits.forEach((rl, index) => {
-		const path = `rateLimits[${index}]`;
-		if (!rl.id?.trim()) issues.push({
-			level: "error",
-			message: "Rate limit must have an id",
-			path: `${path}.id`
-		});
-		else if (seenIds.has(rl.id)) issues.push({
-			level: "error",
-			message: `Duplicate rate limit id: ${rl.id}`,
-			path: `${path}.id`
-		});
-		else seenIds.add(rl.id);
-		if (typeof rl.rpm !== "number" || rl.rpm <= 0) issues.push({
-			level: "error",
-			message: "Rate limit rpm must be a positive number",
-			path: `${path}.rpm`
-		});
-		if (rl.windowSeconds !== void 0 && rl.windowSeconds <= 0) issues.push({
-			level: "error",
-			message: "Rate limit windowSeconds must be positive if specified",
-			path: `${path}.windowSeconds`
-		});
-		if (rl.burst !== void 0 && rl.burst < 0) issues.push({
-			level: "error",
-			message: "Rate limit burst must be non-negative if specified",
-			path: `${path}.burst`
-		});
-	});
+  if (!spec.rateLimits?.length)
+    return;
+  const seenIds = new Set;
+  spec.rateLimits.forEach((rl, index) => {
+    const path = `rateLimits[${index}]`;
+    if (!rl.id?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Rate limit must have an id",
+        path: `${path}.id`
+      });
+    } else if (seenIds.has(rl.id)) {
+      issues.push({
+        level: "error",
+        message: `Duplicate rate limit id: ${rl.id}`,
+        path: `${path}.id`
+      });
+    } else {
+      seenIds.add(rl.id);
+    }
+    if (typeof rl.rpm !== "number" || rl.rpm <= 0) {
+      issues.push({
+        level: "error",
+        message: "Rate limit rpm must be a positive number",
+        path: `${path}.rpm`
+      });
+    }
+    if (rl.windowSeconds !== undefined && rl.windowSeconds <= 0) {
+      issues.push({
+        level: "error",
+        message: "Rate limit windowSeconds must be positive if specified",
+        path: `${path}.windowSeconds`
+      });
+    }
+    if (rl.burst !== undefined && rl.burst < 0) {
+      issues.push({
+        level: "error",
+        message: "Rate limit burst must be non-negative if specified",
+        path: `${path}.burst`
+      });
+    }
+  });
 }
 function validateConsents(spec, issues) {
-	if (!spec.consents?.length) return;
-	const seenIds = /* @__PURE__ */ new Set();
-	spec.consents.forEach((consent, index) => {
-		const path = `consents[${index}]`;
-		if (!consent.id?.trim()) issues.push({
-			level: "error",
-			message: "Consent must have an id",
-			path: `${path}.id`
-		});
-		else if (seenIds.has(consent.id)) issues.push({
-			level: "error",
-			message: `Duplicate consent id: ${consent.id}`,
-			path: `${path}.id`
-		});
-		else seenIds.add(consent.id);
-		if (!consent.scope?.trim()) issues.push({
-			level: "error",
-			message: "Consent must specify a scope",
-			path: `${path}.scope`
-		});
-		if (!consent.purpose?.trim()) issues.push({
-			level: "error",
-			message: "Consent must specify a purpose",
-			path: `${path}.purpose`
-		});
-		if (consent.expiresInDays !== void 0 && consent.expiresInDays <= 0) issues.push({
-			level: "error",
-			message: "Consent expiresInDays must be positive if specified",
-			path: `${path}.expiresInDays`
-		});
-	});
+  if (!spec.consents?.length)
+    return;
+  const seenIds = new Set;
+  spec.consents.forEach((consent, index) => {
+    const path = `consents[${index}]`;
+    if (!consent.id?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Consent must have an id",
+        path: `${path}.id`
+      });
+    } else if (seenIds.has(consent.id)) {
+      issues.push({
+        level: "error",
+        message: `Duplicate consent id: ${consent.id}`,
+        path: `${path}.id`
+      });
+    } else {
+      seenIds.add(consent.id);
+    }
+    if (!consent.scope?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Consent must specify a scope",
+        path: `${path}.scope`
+      });
+    }
+    if (!consent.purpose?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Consent must specify a purpose",
+        path: `${path}.purpose`
+      });
+    }
+    if (consent.expiresInDays !== undefined && consent.expiresInDays <= 0) {
+      issues.push({
+        level: "error",
+        message: "Consent expiresInDays must be positive if specified",
+        path: `${path}.expiresInDays`
+      });
+    }
+  });
 }
 function validateRelationships(spec, issues) {
-	if (!spec.relationships?.length) return;
-	const seenRelations = /* @__PURE__ */ new Set();
-	spec.relationships.forEach((rel, index) => {
-		const path = `relationships[${index}]`;
-		const key = `${rel.subjectType}:${rel.relation}:${rel.objectType}`;
-		if (!rel.subjectType?.trim()) issues.push({
-			level: "error",
-			message: "Relationship must specify subjectType",
-			path: `${path}.subjectType`
-		});
-		if (!rel.relation?.trim()) issues.push({
-			level: "error",
-			message: "Relationship must specify relation",
-			path: `${path}.relation`
-		});
-		if (!rel.objectType?.trim()) issues.push({
-			level: "error",
-			message: "Relationship must specify objectType",
-			path: `${path}.objectType`
-		});
-		if (seenRelations.has(key)) issues.push({
-			level: "warning",
-			message: `Duplicate relationship definition: ${key}`,
-			path
-		});
-		else seenRelations.add(key);
-	});
+  if (!spec.relationships?.length)
+    return;
+  const seenRelations = new Set;
+  spec.relationships.forEach((rel, index) => {
+    const path = `relationships[${index}]`;
+    const key = `${rel.subjectType}:${rel.relation}:${rel.objectType}`;
+    if (!rel.subjectType?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Relationship must specify subjectType",
+        path: `${path}.subjectType`
+      });
+    }
+    if (!rel.relation?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Relationship must specify relation",
+        path: `${path}.relation`
+      });
+    }
+    if (!rel.objectType?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Relationship must specify objectType",
+        path: `${path}.objectType`
+      });
+    }
+    if (seenRelations.has(key)) {
+      issues.push({
+        level: "warning",
+        message: `Duplicate relationship definition: ${key}`,
+        path
+      });
+    } else {
+      seenRelations.add(key);
+    }
+  });
 }
 function validateConditions(conditions, path, issues) {
-	if (!conditions?.length) return;
-	conditions.forEach((cond, index) => {
-		if (!cond.expression?.trim()) issues.push({
-			level: "error",
-			message: "Condition must have a non-empty expression",
-			path: `${path}[${index}].expression`
-		});
-	});
+  if (!conditions?.length)
+    return;
+  conditions.forEach((cond, index) => {
+    if (!cond.expression?.trim()) {
+      issues.push({
+        level: "error",
+        message: "Condition must have a non-empty expression",
+        path: `${path}[${index}].expression`
+      });
+    }
+  });
 }
-/**
-* Validate policy consistency across registries.
-*
-* Checks that:
-* - Operations reference valid policies
-* - Policy actions align with operation kinds
-*
-* @param deps - Registry dependencies
-* @returns Validation result
-*/
 function validatePolicyConsistency(deps) {
-	const issues = [];
-	for (const policy of deps.policies.list()) {
-		const specResult = validatePolicySpec(policy);
-		issues.push(...specResult.issues.map((i) => ({
-			...i,
-			path: `${policy.meta.key}.v${policy.meta.version}${i.path ? `.${i.path}` : ""}`
-		})));
-	}
-	if (deps.operations) for (const operation of deps.operations.list()) {
-		const policyRefs = operation.policy.policies ?? [];
-		for (const ref of policyRefs) if (!deps.policies.get(ref.key, ref.version)) issues.push({
-			level: "error",
-			message: `Operation "${operation.meta.key}.v${operation.meta.version}" references unknown policy "${ref.key}.v${ref.version}"`,
-			path: `operations.${operation.meta.key}.policy.policies`
-		});
-		const fieldPolicies = operation.policy.fieldPolicies ?? [];
-		for (const fp of fieldPolicies) if (fp.policy) {
-			if (!deps.policies.get(fp.policy.key, fp.policy.version)) issues.push({
-				level: "error",
-				message: `Operation "${operation.meta.key}.v${operation.meta.version}" references unknown field policy "${fp.policy.key}.v${fp.policy.version}"`,
-				path: `operations.${operation.meta.key}.policy.fieldPolicies`
-			});
-		}
-	}
-	return {
-		valid: issues.filter((i) => i.level === "error").length === 0,
-		issues
-	};
+  const issues = [];
+  for (const policy of deps.policies.list()) {
+    const specResult = validatePolicySpec(policy);
+    issues.push(...specResult.issues.map((i) => ({
+      ...i,
+      path: `${policy.meta.key}.v${policy.meta.version}${i.path ? `.${i.path}` : ""}`
+    })));
+  }
+  if (deps.operations) {
+    for (const operation of deps.operations.list()) {
+      const policyRefs = operation.policy.policies ?? [];
+      for (const ref of policyRefs) {
+        const policy = deps.policies.get(ref.key, ref.version);
+        if (!policy) {
+          issues.push({
+            level: "error",
+            message: `Operation "${operation.meta.key}.v${operation.meta.version}" references unknown policy "${ref.key}.v${ref.version}"`,
+            path: `operations.${operation.meta.key}.policy.policies`
+          });
+        }
+      }
+      const fieldPolicies = operation.policy.fieldPolicies ?? [];
+      for (const fp of fieldPolicies) {
+        if (fp.policy) {
+          const policy = deps.policies.get(fp.policy.key, fp.policy.version);
+          if (!policy) {
+            issues.push({
+              level: "error",
+              message: `Operation "${operation.meta.key}.v${operation.meta.version}" references unknown field policy "${fp.policy.key}.v${fp.policy.version}"`,
+              path: `operations.${operation.meta.key}.policy.fieldPolicies`
+            });
+          }
+        }
+      }
+    }
+  }
+  return {
+    valid: issues.filter((i) => i.level === "error").length === 0,
+    issues
+  };
+}
+
+class PolicyValidationError extends Error {
+  issues;
+  constructor(message, issues) {
+    super(message);
+    this.issues = issues;
+    this.name = "PolicyValidationError";
+  }
 }
-var PolicyValidationError = class extends Error {
-	constructor(message, issues) {
-		super(message);
-		this.issues = issues;
-		this.name = "PolicyValidationError";
-	}
-};
-/**
-* Assert that a policy spec is valid, throwing if not.
-*
-* @param spec - Policy spec to validate
-* @throws {PolicyValidationError} If validation fails
-*/
 function assertPolicySpecValid(spec) {
-	const result = validatePolicySpec(spec);
-	if (!result.valid) throw new PolicyValidationError(`Policy ${spec.meta.key}.v${spec.meta.version} is invalid`, result.issues);
+  const result = validatePolicySpec(spec);
+  if (!result.valid) {
+    throw new PolicyValidationError(`Policy ${spec.meta.key}.v${spec.meta.version} is invalid`, result.issues);
+  }
 }
-/**
-* Assert policy consistency across registries.
-*
-* @param deps - Registry dependencies
-* @throws {PolicyValidationError} If validation fails
-*/
 function assertPolicyConsistency(deps) {
-	const result = validatePolicyConsistency(deps);
-	if (!result.valid) throw new PolicyValidationError("Policy consistency check failed", result.issues);
+  const result = validatePolicyConsistency(deps);
+  if (!result.valid) {
+    throw new PolicyValidationError("Policy consistency check failed", result.issues);
+  }
 }
-
-//#endregion
-export { PolicyValidationError, assertPolicyConsistency, assertPolicySpecValid, validatePolicyConsistency, validatePolicySpec };
+export {
+  validatePolicySpec,
+  validatePolicyConsistency,
+  assertPolicySpecValid,
+  assertPolicyConsistency,
+  PolicyValidationError
+};