@dszp/netsapiens-lib 0.1.8 → 0.1.9

package/dist/policy.d.ts

@@ -36,13 +36,19 @@ export interface PolicyRule {
     /** Effective identity (`user@domain`) must be one of these. */
     users?: string[];
     /**
-     * Effective identity (`user@domain`) must NOT be one of these — a denial that ANDs with the rest of
-     * the rule, narrowing it.
+     * Accounts this rule EXCLUDES — a denial that ANDs with the rest of the rule, narrowing it.
      *
      * ⚠️ It is NOT a condition on its own. A rule carrying only `notUsers` never matches, deliberately:
      * "everybody except X" as a standalone rule would be an allow-all wearing an exception, and this
      * engine's whole shape is that a rule must say who it admits before it says who it doesn't. Pair it
      * with `scopes`/`domains`/`users` — see `hasCondition` in {@link ruleMatches}.
+     *
+     * ⚠️ **It matches the effective identity OR the operator behind a mask** — the one place this engine
+     * is deliberately asymmetric. Every positive condition sees the EFFECTIVE principal, so a grant
+     * follows the role currently being performed; masquerading is full impersonation and is meant to be.
+     * A denial is not about a role. It names a person, and a denial that evaporates the moment that
+     * person masquerades into someone else is not a denial — it is a suggestion. So this one condition
+     * asks both "who is acting" and "who is behind this", and refuses if either is named.
      */
     notUsers?: string[];
     /** Requires masking, AND the operator's `user@domain` (mask_chain) is one of these. */

package/dist/policy.js

@@ -35,7 +35,9 @@ export function ruleMatches(p, rule) {
         return false;
     if (rule.users && !inList(p.id, rule.users))
         return false;
-    if (rule.notUsers && inList(p.id, rule.notUsers))
+    // Both identities, unlike every positive condition above — see the field's own note. A grant follows
+    // the role being performed; a denial follows the person performing it, through a mask.
+    if (rule.notUsers && (inList(p.id, rule.notUsers) || (p.operator && inList(p.operator.id, rule.notUsers))))
         return false;
     if (rule.operators) {
         if (!p.operator || !inList(p.operator.id, rule.operators))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dszp/netsapiens-lib",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Portable, Node-free NetSapiens toolkit: split read/write API clients, JWT (ns_t) validation, and a snapshot -> FlowGraph -> Mermaid call-flow resolver/renderer. Runs unchanged in a Cloudflare Worker, Node, or the browser.",
   "type": "module",
   "license": "MIT",