@mathrunet/masamune_cloudflare 3.1.6 → 3.1.7

package/CHANGELOG.md

@@ -1,4 +1,4 @@
-## 3.1.6 (2026-06-30)
+## 3.1.7 (2026-07-01)
 
 
 ### chore

package/dist/index.d.ts

@@ -14,10 +14,16 @@ export * from "@mathrunet/masamune";
 export * from "./lib/api";
 export * from "./lib/src/workers_base";
 export * from "./lib/src/workers_auth_adapter_base";
+export * from "./lib/src/workers_rule_adapter_base";
 export * from "./lib/src/workers_data";
 export * from "./lib/src/request_process_workders_base";
+export * from "./lib/src/rules/rules_loader";
+export * from "./lib/src/rules/path_matcher";
+export * from "./lib/src/rules/rules_engine";
 export * from "./lib/adapters/firebase_auth_adapter";
 export * from "./lib/adapters/none_auth_adapter";
+export * from "./lib/adapters/rules_middleware";
+export * from "./lib/middlewares";
 /**
  * Methods for deploying to Cloudflare Workers.
  *

package/dist/index.js

@@ -52,10 +52,16 @@ __exportStar(require("@mathrunet/masamune"), exports);
 __exportStar(require("./lib/api"), exports);
 __exportStar(require("./lib/src/workers_base"), exports);
 __exportStar(require("./lib/src/workers_auth_adapter_base"), exports);
+__exportStar(require("./lib/src/workers_rule_adapter_base"), exports);
 __exportStar(require("./lib/src/workers_data"), exports);
 __exportStar(require("./lib/src/request_process_workders_base"), exports);
+__exportStar(require("./lib/src/rules/rules_loader"), exports);
+__exportStar(require("./lib/src/rules/path_matcher"), exports);
+__exportStar(require("./lib/src/rules/rules_engine"), exports);
 __exportStar(require("./lib/adapters/firebase_auth_adapter"), exports);
 __exportStar(require("./lib/adapters/none_auth_adapter"), exports);
+__exportStar(require("./lib/adapters/rules_middleware"), exports);
+__exportStar(require("./lib/middlewares"), exports);
 /**
  * Methods for deploying to Cloudflare Workers.
  *

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,wBAMC;AA3CD;;;;;;;;;GASG;AACH,2CAA6B;AAG7B,sDAAoC;AACpC,4CAA0B;AAC1B,yDAAuC;AACvC,sEAAoD;AACpD,yDAAuC;AACvC,0EAAwD;AACxD,uEAAqD;AACrD,mEAAiD;AAEjD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,MAAM,CAAC,cAA6B,EAAE,UAA0B,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,wBAMC;AAjDD;;;;;;;;;GASG;AACH,2CAA6B;AAG7B,sDAAoC;AACpC,4CAA0B;AAC1B,yDAAuC;AACvC,sEAAoD;AACpD,sEAAoD;AACpD,yDAAuC;AACvC,0EAAwD;AACxD,+DAA6C;AAC7C,+DAA6C;AAC7C,+DAA6C;AAC7C,uEAAqD;AACrD,mEAAiD;AACjD,kEAAgD;AAChD,oDAAkC;AAElC;;;;;;;;;;;;;;GAcG;AACH,SAAgB,MAAM,CAAC,cAA6B,EAAE,UAA0B,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/lib/adapters/rules_middleware.d.ts

@@ -0,0 +1,45 @@
+import { Context, MiddlewareHandler } from "hono";
+import { RulesEngine, RulesEvaluationInput, RulesEvaluationResult } from "../src/rules/rules_engine";
+import { WorkersRuleAdapterBase } from "../src/workers_rule_adapter_base";
+/**
+ * Input builder for rules adapter.
+ *
+ * rulesアダプター用の入力生成関数。
+ */
+export type RulesEvaluationInputBuilder = (context: Context) => RulesEvaluationInput | Promise<RulesEvaluationInput>;
+/**
+ * Options for RulesEngineRuleAdapter.
+ *
+ * RulesEngineRuleAdapterのオプション。
+ */
+export interface RulesEngineRuleOptions {
+    /**
+     * Rules engine to evaluate access rules.
+     *
+     * アクセスルールを評価するrulesエンジン。
+     */
+    engine: RulesEngine;
+    /**
+     * Builder that produces rules evaluation input from the request context.
+     *
+     * リクエストコンテキストからrules評価入力を生成するビルダー。
+     */
+    getEvaluationInput: RulesEvaluationInputBuilder;
+    /**
+     * Response returned when access is denied.
+     *
+     * アクセスが拒否された場合に返すレスポンス。
+     */
+    deniedResponse?: (context: Context, result: RulesEvaluationResult) => Response | Promise<Response>;
+}
+/**
+ * Middleware adapter that evaluates rules using a RulesEngine.
+ *
+ * RulesEngineを用いてrulesを評価するミドルウェアアダプター。
+ */
+export declare class RulesEngineRuleAdapter extends WorkersRuleAdapterBase {
+    constructor(options: RulesEngineRuleOptions);
+    private readonly options;
+    build(): MiddlewareHandler;
+    private denied;
+}

package/dist/lib/adapters/rules_middleware.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RulesEngineRuleAdapter = void 0;
+const workers_rule_adapter_base_1 = require("../src/workers_rule_adapter_base");
+/**
+ * Middleware adapter that evaluates rules using a RulesEngine.
+ *
+ * RulesEngineを用いてrulesを評価するミドルウェアアダプター。
+ */
+class RulesEngineRuleAdapter extends workers_rule_adapter_base_1.WorkersRuleAdapterBase {
+    constructor(options) {
+        super();
+        this.options = options;
+    }
+    options;
+    build() {
+        return async (context, next) => {
+            const authentication = context.get("authentication");
+            const input = await this.options.getEvaluationInput(context);
+            const result = await this.options.engine.evaluate({
+                ...input,
+                authentication: input.authentication ?? authentication,
+            });
+            if (!result.allowed) {
+                return await this.denied(context, result);
+            }
+            this.setRulesContext(context, result);
+            await next();
+        };
+    }
+    async denied(context, result) {
+        if (this.options.deniedResponse) {
+            return await this.options.deniedResponse(context, result);
+        }
+        return context.json({
+            error: "denied",
+            rule: result.rulePath,
+        }, 403);
+    }
+}
+exports.RulesEngineRuleAdapter = RulesEngineRuleAdapter;
+//# sourceMappingURL=rules_middleware.js.map

package/dist/lib/adapters/rules_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules_middleware.js","sourceRoot":"","sources":["../../../src/lib/adapters/rules_middleware.ts"],"names":[],"mappings":";;;AAOA,gFAA0E;AA0C1E;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,kDAAsB;IAC9D,YAAY,OAA+B;QACvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAEgB,OAAO,CAAyB;IAEjD,KAAK;QACD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAmC,CAAC;YACvF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC9C,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc;aACzD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,MAAM,CAChB,OAAgB,EAChB,MAA6B;QAE7B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC9B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,MAAM,CAAC,QAAQ;SACxB,EAAE,GAAG,CAAC,CAAC;IACZ,CAAC;CACJ;AApCD,wDAoCC"}

package/dist/lib/middlewares/index.d.ts

@@ -1,2 +1,3 @@
-export * from "./firebase_authentication_middleware";
-export * from "./no_authentication_middleware";
+export * from "../adapters/rules_middleware";
+export { FirebaseAuthAdapter as FirebaseAuthenticationMiddleware, FirebaseAuthOptions as FirebaseAuthenticationMiddlewareOptions, FirebaseCacheApiKeyStorer, } from "../adapters/firebase_auth_adapter";
+export { NoneAuthAdapter as NoAuthenticationMiddleware, } from "../adapters/none_auth_adapter";

package/dist/lib/middlewares/index.js

@@ -14,6 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./firebase_authentication_middleware"), exports);
-__exportStar(require("./no_authentication_middleware"), exports);
+exports.NoAuthenticationMiddleware = exports.FirebaseCacheApiKeyStorer = exports.FirebaseAuthenticationMiddleware = void 0;
+__exportStar(require("../adapters/rules_middleware"), exports);
+var firebase_auth_adapter_1 = require("../adapters/firebase_auth_adapter");
+Object.defineProperty(exports, "FirebaseAuthenticationMiddleware", { enumerable: true, get: function () { return firebase_auth_adapter_1.FirebaseAuthAdapter; } });
+Object.defineProperty(exports, "FirebaseCacheApiKeyStorer", { enumerable: true, get: function () { return firebase_auth_adapter_1.FirebaseCacheApiKeyStorer; } });
+var none_auth_adapter_1 = require("../adapters/none_auth_adapter");
+Object.defineProperty(exports, "NoAuthenticationMiddleware", { enumerable: true, get: function () { return none_auth_adapter_1.NoneAuthAdapter; } });
 //# sourceMappingURL=index.js.map

package/dist/lib/middlewares/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uEAAqD;AACrD,iEAA+C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6C;AAC7C,2EAI2C;AAHvC,yIAAA,mBAAmB,OAAoC;AAEvD,kIAAA,yBAAyB,OAAA;AAE7B,mEAEuC;AADnC,+HAAA,eAAe,OAA8B"}

package/dist/lib/middlewares/rules_middleware.d.ts

@@ -0,0 +1,29 @@
+import { Context, MiddlewareHandler } from "hono";
+import { RulesEngine, RulesEvaluationInput, RulesEvaluationResult } from "../src/rules/rules_engine";
+/**
+ * Input builder for rules middleware.
+ *
+ * rulesミドルウェア用の入力生成関数。
+ */
+export type RulesMiddlewareInputBuilder = (context: Context) => RulesEvaluationInput | Promise<RulesEvaluationInput>;
+/**
+ * Options for rules middleware.
+ *
+ * rulesミドルウェアのオプション。
+ */
+export interface RulesMiddlewareOptions {
+    engine: RulesEngine;
+    getEvaluationInput: RulesMiddlewareInputBuilder;
+}
+/**
+ * Create rules middleware.
+ *
+ * rulesミドルウェアを作成します。
+ */
+export declare function rulesMiddleware(options: RulesMiddlewareOptions): MiddlewareHandler;
+/**
+ * Get rules evaluation result from Hono context.
+ *
+ * Hono contextからrules評価結果を取得します。
+ */
+export declare function getRulesEvaluationResult(context: Context): RulesEvaluationResult | undefined;

package/dist/lib/middlewares/rules_middleware.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rulesMiddleware = rulesMiddleware;
+exports.getRulesEvaluationResult = getRulesEvaluationResult;
+/**
+ * Create rules middleware.
+ *
+ * rulesミドルウェアを作成します。
+ */
+function rulesMiddleware(options) {
+    return async (context, next) => {
+        const authentication = context.get("authentication");
+        const input = await options.getEvaluationInput(context);
+        const result = await options.engine.evaluate({
+            ...input,
+            authentication: input.authentication ?? authentication,
+        });
+        if (!result.allowed) {
+            return context.json({
+                error: "denied",
+                rule: result.rulePath,
+            }, 403);
+        }
+        context.set("rules", result);
+        await next();
+    };
+}
+/**
+ * Get rules evaluation result from Hono context.
+ *
+ * Hono contextからrules評価結果を取得します。
+ */
+function getRulesEvaluationResult(context) {
+    return context.get("rules");
+}
+//# sourceMappingURL=rules_middleware.js.map

package/dist/lib/middlewares/rules_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules_middleware.js","sourceRoot":"","sources":["../../../src/lib/middlewares/rules_middleware.ts"],"names":[],"mappings":";;AAgCA,0CAiBC;AAOD,4DAEC;AA/BD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAA+B;IAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAmC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACzC,GAAG,KAAK;YACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,MAAM,CAAC,QAAQ;aACxB,EAAE,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;IACjB,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,OAAgB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAsC,CAAC;AACrE,CAAC"}

package/dist/lib/src/rules/path_matcher.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Result of matching a rule path against a request path.
+ *
+ * ルールパスとリクエストパスのマッチ結果。
+ */
+export interface RulePathMatch {
+    matched: boolean;
+    rulePath: string;
+    literalSegments: number;
+    wildcardSegments: number;
+    deepWildcardSegments: number;
+    matchedSegments: number;
+}
+/**
+ * Match rule path to request path.
+ *
+ * ルールパスをリクエストパスに照合します。
+ */
+export declare function matchRulePath(rulePath: string, requestPath: string): RulePathMatch;
+/**
+ * Compare matches by specificity.
+ *
+ * マッチ結果を具体度で比較します。
+ */
+export declare function compareRulePathMatch(a: RulePathMatch, b: RulePathMatch): number;
+/**
+ * Sort matches from the most specific to the least specific.
+ *
+ * マッチ結果を具体度の高い順に並べます。
+ */
+export declare function sortRulePathMatches(matches: RulePathMatch[]): RulePathMatch[];

package/dist/lib/src/rules/path_matcher.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchRulePath = matchRulePath;
+exports.compareRulePathMatch = compareRulePathMatch;
+exports.sortRulePathMatches = sortRulePathMatches;
+const rules_loader_1 = require("./rules_loader");
+/**
+ * Match rule path to request path.
+ *
+ * ルールパスをリクエストパスに照合します。
+ */
+function matchRulePath(rulePath, requestPath) {
+    (0, rules_loader_1.validateRulePath)(rulePath);
+    const ruleSegments = splitPath(rulePath);
+    const requestSegments = splitPath(requestPath);
+    let literalSegments = 0;
+    let wildcardSegments = 0;
+    let deepWildcardSegments = 0;
+    for (let i = 0; i < ruleSegments.length; i++) {
+        const ruleSegment = ruleSegments[i];
+        if (ruleSegment === "**") {
+            deepWildcardSegments = 1;
+            return {
+                matched: true,
+                rulePath,
+                literalSegments,
+                wildcardSegments,
+                deepWildcardSegments,
+                matchedSegments: requestSegments.length,
+            };
+        }
+        const requestSegment = requestSegments[i];
+        if (requestSegment === undefined) {
+            return createUnmatched(rulePath);
+        }
+        if (ruleSegment === "*") {
+            wildcardSegments++;
+            continue;
+        }
+        if (ruleSegment !== requestSegment) {
+            return createUnmatched(rulePath);
+        }
+        literalSegments++;
+    }
+    if (ruleSegments.length !== requestSegments.length) {
+        return createUnmatched(rulePath);
+    }
+    return {
+        matched: true,
+        rulePath,
+        literalSegments,
+        wildcardSegments,
+        deepWildcardSegments,
+        matchedSegments: requestSegments.length,
+    };
+}
+/**
+ * Compare matches by specificity.
+ *
+ * マッチ結果を具体度で比較します。
+ */
+function compareRulePathMatch(a, b) {
+    if (a.literalSegments !== b.literalSegments) {
+        return b.literalSegments - a.literalSegments;
+    }
+    if (a.deepWildcardSegments !== b.deepWildcardSegments) {
+        return a.deepWildcardSegments - b.deepWildcardSegments;
+    }
+    if (a.wildcardSegments !== b.wildcardSegments) {
+        return a.wildcardSegments - b.wildcardSegments;
+    }
+    if (a.matchedSegments !== b.matchedSegments) {
+        return b.matchedSegments - a.matchedSegments;
+    }
+    return a.rulePath.localeCompare(b.rulePath);
+}
+/**
+ * Sort matches from the most specific to the least specific.
+ *
+ * マッチ結果を具体度の高い順に並べます。
+ */
+function sortRulePathMatches(matches) {
+    return [...matches].sort(compareRulePathMatch);
+}
+function splitPath(path) {
+    if (path.length === 0 || path.startsWith("/") || path.endsWith("/")) {
+        return [];
+    }
+    const segments = path.split("/");
+    if (segments.some((segment) => segment.length === 0)) {
+        return [];
+    }
+    return segments;
+}
+function createUnmatched(rulePath) {
+    return {
+        matched: false,
+        rulePath,
+        literalSegments: 0,
+        wildcardSegments: 0,
+        deepWildcardSegments: 0,
+        matchedSegments: 0,
+    };
+}
+//# sourceMappingURL=path_matcher.js.map

package/dist/lib/src/rules/path_matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path_matcher.js","sourceRoot":"","sources":["../../../../src/lib/src/rules/path_matcher.ts"],"names":[],"mappings":";;AAqBA,sCA6CC;AAOD,oDAcC;AAOD,kDAEC;AAhGD,iDAAkD;AAgBlD;;;;GAIG;AACH,SAAgB,aAAa,CAAC,QAAgB,EAAE,WAAmB;IAC/D,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,oBAAoB,GAAG,CAAC,CAAC;YACzB,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,eAAe;gBACf,gBAAgB;gBAChB,oBAAoB;gBACpB,eAAe,EAAE,eAAe,CAAC,MAAM;aAC1C,CAAC;QACN,CAAC;QACD,MAAM,cAAc,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACtB,gBAAgB,EAAE,CAAC;YACnB,SAAS;QACb,CAAC;QACD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,eAAe,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO;QACH,OAAO,EAAE,IAAI;QACb,QAAQ;QACR,eAAe;QACf,gBAAgB;QAChB,oBAAoB;QACpB,eAAe,EAAE,eAAe,CAAC,MAAM;KAC1C,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,CAAgB,EAAE,CAAgB;IACnE,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,CAAC,oBAAoB,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,oBAAoB,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,OAAwB;IACxD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACrC,OAAO;QACH,OAAO,EAAE,KAAK;QACd,QAAQ;QACR,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,CAAC;QACnB,oBAAoB,EAAE,CAAC;QACvB,eAAe,EAAE,CAAC;KACrB,CAAC;AACN,CAAC"}

package/dist/lib/src/rules/rules_engine.d.ts

@@ -0,0 +1,72 @@
+import { WorkersAuthContext } from "../workers_auth_adapter_base";
+import { RulesAccessRule, RulesConfig, RulesOperation, RulesOperationKey } from "./rules_loader";
+/**
+ * Input for evaluating rules.
+ *
+ * rules評価入力。
+ */
+export interface RulesEvaluationInput {
+    path: string;
+    operation: RulesOperation | RulesOperationKey;
+    authentication?: WorkersAuthContext | undefined;
+    fetchDocument?: (() => Promise<Record<string, unknown> | null | undefined>) | undefined;
+}
+/**
+ * Result of evaluating rules.
+ *
+ * rules評価結果。
+ */
+export interface RulesEvaluationResult {
+    allowed: boolean;
+    rulePath?: string | undefined;
+    access?: RulesAccessRule | undefined;
+}
+/**
+ * Arguments for building a rules path.
+ *
+ * rulesパス生成引数。
+ */
+export interface RulesPathArguments {
+    database: string;
+    table: string;
+    indexKey: string;
+}
+/**
+ * Rules engine.
+ *
+ * rules評価エンジン。
+ */
+export declare class RulesEngine {
+    constructor(config: RulesConfig | unknown);
+    private readonly config;
+    /**
+     * Evaluate rules for the given path and operation.
+     *
+     * 指定したパスと操作に対してrulesを評価します。
+     */
+    evaluate(input: RulesEvaluationInput): Promise<RulesEvaluationResult>;
+}
+/**
+ * Build a normalized rules path.
+ *
+ * 正規化されたrulesパスを生成します。
+ */
+export declare function buildRulesPath({ database, table, indexKey }: RulesPathArguments): string;
+/**
+ * Normalize HTTP method to rules operation.
+ *
+ * HTTPメソッドをrules操作に正規化します。
+ */
+export declare function normalizeHttpMethodToRulesOperation(method: string): RulesOperation;
+/**
+ * Normalize rules operation aliases.
+ *
+ * rules操作エイリアスを正規化します。
+ */
+export declare function normalizeRulesOperation(operation: RulesOperation | RulesOperationKey): RulesOperation;
+/**
+ * Resolve operation lookup order.
+ *
+ * 操作の解決順を取得します。
+ */
+export declare function resolveRulesOperation(operation: RulesOperation | RulesOperationKey): RulesOperationKey[];

package/dist/lib/src/rules/rules_engine.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RulesEngine = void 0;
+exports.buildRulesPath = buildRulesPath;
+exports.normalizeHttpMethodToRulesOperation = normalizeHttpMethodToRulesOperation;
+exports.normalizeRulesOperation = normalizeRulesOperation;
+exports.resolveRulesOperation = resolveRulesOperation;
+const rules_loader_1 = require("./rules_loader");
+const path_matcher_1 = require("./path_matcher");
+/**
+ * Rules engine.
+ *
+ * rules評価エンジン。
+ */
+class RulesEngine {
+    constructor(config) {
+        this.config = (0, rules_loader_1.loadRulesConfig)(config);
+    }
+    config;
+    /**
+     * Evaluate rules for the given path and operation.
+     *
+     * 指定したパスと操作に対してrulesを評価します。
+     */
+    async evaluate(input) {
+        const operation = normalizeRulesOperation(input.operation);
+        const matches = Object.keys(this.config.rules)
+            .map((rulePath) => (0, path_matcher_1.matchRulePath)(rulePath, input.path))
+            .filter((match) => match.matched);
+        if (matches.length === 0) {
+            return { allowed: false };
+        }
+        const sortedMatches = (0, path_matcher_1.sortRulePathMatches)(matches);
+        const resolved = resolveInheritedRule(sortedMatches.map((match) => {
+            return {
+                rulePath: match.rulePath,
+                entry: this.config.rules[match.rulePath],
+            };
+        }));
+        const access = resolveAccessRule(resolved.entry, operation);
+        if (!access) {
+            return {
+                allowed: false,
+                rulePath: resolved.rulePath,
+            };
+        }
+        return {
+            allowed: await evaluateAccessRule(access, input.authentication, input.fetchDocument),
+            rulePath: resolved.rulePath,
+            access,
+        };
+    }
+}
+exports.RulesEngine = RulesEngine;
+/**
+ * Build a normalized rules path.
+ *
+ * 正規化されたrulesパスを生成します。
+ */
+function buildRulesPath({ database, table, indexKey }) {
+    return [
+        "database",
+        encodeRulesPathSegment(database),
+        "table",
+        encodeRulesPathSegment(table),
+        encodeRulesPathSegment(indexKey),
+    ].join("/");
+}
+/**
+ * Normalize HTTP method to rules operation.
+ *
+ * HTTPメソッドをrules操作に正規化します。
+ */
+function normalizeHttpMethodToRulesOperation(method) {
+    switch (method.toUpperCase()) {
+        case "GET":
+            return "get";
+        case "POST":
+            return "create";
+        case "PUT":
+            return "update";
+        case "DELETE":
+            return "delete";
+        default:
+            throw new Error(`Unsupported HTTP method for rules: ${method}`);
+    }
+}
+/**
+ * Normalize rules operation aliases.
+ *
+ * rules操作エイリアスを正規化します。
+ */
+function normalizeRulesOperation(operation) {
+    switch (operation) {
+        case "read":
+            return "get";
+        case "write":
+            return "create";
+        case "get":
+        case "create":
+        case "update":
+        case "delete":
+            return operation;
+    }
+}
+/**
+ * Resolve operation lookup order.
+ *
+ * 操作の解決順を取得します。
+ */
+function resolveRulesOperation(operation) {
+    const normalized = normalizeRulesOperation(operation);
+    switch (normalized) {
+        case "get":
+            return ["get", "read"];
+        case "create":
+            return ["create", "write"];
+        case "update":
+            return ["update", "write"];
+        case "delete":
+            return ["delete", "write"];
+    }
+}
+function resolveInheritedRule(matches) {
+    const inherited = {};
+    let rulePath = matches[0]?.rulePath ?? "";
+    for (const match of [...matches].reverse()) {
+        if (!match.entry) {
+            continue;
+        }
+        rulePath = match.rulePath;
+        for (const [operation, access] of Object.entries(match.entry)) {
+            inherited[operation] = access;
+        }
+    }
+    return {
+        rulePath,
+        entry: inherited,
+    };
+}
+function resolveAccessRule(entry, operation) {
+    for (const operationKey of resolveRulesOperation(operation)) {
+        const access = entry[operationKey];
+        if (access) {
+            return access;
+        }
+    }
+    return undefined;
+}
+async function evaluateAccessRule(access, authentication, fetchDocument) {
+    switch (access) {
+        case "deny":
+            return false;
+        case "allow":
+            return true;
+        case "authenticated":
+            return !!authentication?.uid;
+        default: {
+            const uid = authentication?.uid;
+            if (!uid || !fetchDocument) {
+                return false;
+            }
+            const document = await fetchDocument();
+            return document?.[access.field] === uid;
+        }
+    }
+}
+function encodeRulesPathSegment(segment) {
+    if (segment.length === 0 || segment.includes("/")) {
+        throw new Error(`Invalid rules path segment: ${segment}`);
+    }
+    return segment;
+}
+//# sourceMappingURL=rules_engine.js.map

package/dist/lib/src/rules/rules_engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules_engine.js","sourceRoot":"","sources":["../../../../src/lib/src/rules/rules_engine.ts"],"names":[],"mappings":";;;AAkGA,wCAQC;AAOD,kFAaC;AAOD,0DAYC;AAOD,sDAYC;AAnKD,iDAOwB;AACxB,iDAAoE;AAoCpE;;;;GAIG;AACH,MAAa,WAAW;IACpB,YAAY,MAA6B;QACrC,IAAI,CAAC,MAAM,GAAG,IAAA,8BAAe,EAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEgB,MAAM,CAAc;IAErC;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,KAA2B;QACtC,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;aACzC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAA,4BAAa,EAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,aAAa,GAAG,IAAA,kCAAmB,EAAC,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,OAAO;gBACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC3C,CAAC;QACN,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC9B,CAAC;QACN,CAAC;QACD,OAAO;YACH,OAAO,EAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC;YACpF,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM;SACT,CAAC;IACN,CAAC;CACJ;AAzCD,kCAyCC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAsB;IAC5E,OAAO;QACH,UAAU;QACV,sBAAsB,CAAC,QAAQ,CAAC;QAChC,OAAO;QACP,sBAAsB,CAAC,KAAK,CAAC;QAC7B,sBAAsB,CAAC,QAAQ,CAAC;KACnC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAgB,mCAAmC,CAAC,MAAc;IAC9D,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,KAAK,KAAK;YACN,OAAO,KAAK,CAAC;QACjB,KAAK,MAAM;YACP,OAAO,QAAQ,CAAC;QACpB,KAAK,KAAK;YACN,OAAO,QAAQ,CAAC;QACpB,KAAK,QAAQ;YACT,OAAO,QAAQ,CAAC;QACpB;YACI,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,SAA6C;IACjF,QAAQ,SAAS,EAAE,CAAC;QAChB,KAAK,MAAM;YACP,OAAO,KAAK,CAAC;QACjB,KAAK,OAAO;YACR,OAAO,QAAQ,CAAC;QACpB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACT,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,SAA6C;IAC/E,MAAM,UAAU,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACtD,QAAQ,UAAU,EAAE,CAAC;QACjB,KAAK,KAAK;YACN,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3B,KAAK,QAAQ;YACT,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACT,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACT,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CACzB,OAA8D;IAE9D,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACf,SAAS;QACb,CAAC;QACD,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,SAAS,CAAC,SAA8B,CAAC,GAAG,MAAM,CAAC;QACvD,CAAC;IACL,CAAC;IACD,OAAO;QACH,QAAQ;QACR,KAAK,EAAE,SAAS;KACnB,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAE,SAAyB;IACnE,KAAK,MAAM,YAAY,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC7B,MAAuB,EACvB,cAA+C,EAC/C,aAAuF;IAEvF,QAAQ,MAAM,EAAE,CAAC;QACb,KAAK,MAAM;YACP,OAAO,KAAK,CAAC;QACjB,KAAK,OAAO;YACR,OAAO,IAAI,CAAC;QAChB,KAAK,eAAe;YAChB,OAAO,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC;YACN,MAAM,GAAG,GAAG,cAAc,EAAE,GAAG,CAAC;YAChC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;YACvC,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC5C,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/lib/src/rules/rules_loader.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Operation names supported by rules.json.
+ *
+ * rules.jsonでサポートする操作名。
+ */
+export type RulesOperation = "get" | "create" | "update" | "delete";
+/**
+ * Operation aliases supported by rules.json.
+ *
+ * rules.jsonでサポートする操作エイリアス。
+ */
+export type RulesOperationAlias = "read" | "write";
+/**
+ * Operation keys accepted in a rule entry.
+ *
+ * ルール内で指定可能な操作キー。
+ */
+export type RulesOperationKey = RulesOperation | RulesOperationAlias;
+/**
+ * Access rule for an operation.
+ *
+ * 操作に対するアクセスルール。
+ */
+export type RulesAccessRule = "deny" | "allow" | "authenticated" | RulesFieldMatchAccessRule;
+/**
+ * Field match access rule.
+ *
+ * フィールド一致アクセスルール。
+ */
+export interface RulesFieldMatchAccessRule {
+    type: "fieldMatch";
+    field: string;
+}
+/**
+ * Rule entry for a matched path.
+ *
+ * パスに対応するルール定義。
+ */
+export type RulesEntry = Partial<Record<RulesOperationKey, RulesAccessRule>>;
+/**
+ * Rule map keyed by path pattern.
+ *
+ * パスパターンをキーにしたルールマップ。
+ */
+export type RulesMap = Record<string, RulesEntry>;
+/**
+ * rules.json configuration.
+ *
+ * rules.json設定。
+ */
+export interface RulesConfig {
+    version: string;
+    rules: RulesMap;
+}
+/**
+ * Result of loading and validating rules.
+ *
+ * rulesの読み込み・検証結果。
+ */
+export interface LoadedRulesConfig extends RulesConfig {
+}
+/**
+ * Load and validate rules configuration.
+ *
+ * rules設定を読み込み、検証します。
+ */
+export declare function loadRulesConfig(input: unknown): LoadedRulesConfig;
+/**
+ * Validate a rule path.
+ *
+ * ルールパスを検証します。
+ */
+export declare function validateRulePath(path: string): void;

package/dist/lib/src/rules/rules_loader.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadRulesConfig = loadRulesConfig;
+exports.validateRulePath = validateRulePath;
+const allowedAccessValues = new Set(["deny", "allow", "authenticated"]);
+const allowedOperationKeys = new Set([
+    "get",
+    "create",
+    "update",
+    "delete",
+    "read",
+    "write",
+]);
+/**
+ * Load and validate rules configuration.
+ *
+ * rules設定を読み込み、検証します。
+ */
+function loadRulesConfig(input) {
+    if (!isRecord(input)) {
+        throw new Error("Rules config must be an object.");
+    }
+    if (typeof input.version !== "string" || input.version.length === 0) {
+        throw new Error("Rules config version must be a non-empty string.");
+    }
+    if (!isRecord(input.rules) || Array.isArray(input.rules)) {
+        throw new Error("Rules config rules must be an object map.");
+    }
+    const rules = {};
+    for (const [path, entry] of Object.entries(input.rules)) {
+        validateRulePath(path);
+        rules[path] = validateRulesEntry(path, entry);
+    }
+    return {
+        version: input.version,
+        rules,
+    };
+}
+/**
+ * Validate a rule path.
+ *
+ * ルールパスを検証します。
+ */
+function validateRulePath(path) {
+    if (path.length === 0) {
+        throw new Error("Rule path must be a non-empty string.");
+    }
+    if (path.startsWith("/") || path.endsWith("/")) {
+        throw new Error(`Rule path must not start or end with '/': ${path}`);
+    }
+    const segments = path.split("/");
+    if (segments.some((segment) => segment.length === 0)) {
+        throw new Error(`Rule path must not contain empty segments: ${path}`);
+    }
+    const deepWildcardIndex = segments.indexOf("**");
+    if (deepWildcardIndex >= 0 && deepWildcardIndex !== segments.length - 1) {
+        throw new Error(`'**' must be the last segment in rule path: ${path}`);
+    }
+}
+function validateRulesEntry(path, entry) {
+    if (!isRecord(entry) || Array.isArray(entry)) {
+        throw new Error(`Rule entry must be an object: ${path}`);
+    }
+    const result = {};
+    for (const [operation, access] of Object.entries(entry)) {
+        if (!allowedOperationKeys.has(operation)) {
+            throw new Error(`Unsupported rule operation '${operation}' in ${path}.`);
+        }
+        result[operation] = validateAccessRule(path, operation, access);
+    }
+    return result;
+}
+function validateAccessRule(path, operation, access) {
+    if (typeof access === "string") {
+        if (allowedAccessValues.has(access)) {
+            return access;
+        }
+        throw new Error(`Unsupported access rule '${access}' for ${operation} in ${path}.`);
+    }
+    if (isRecord(access)) {
+        if (access.type === "fieldMatch" && typeof access.field === "string" && access.field.length > 0) {
+            return {
+                type: "fieldMatch",
+                field: access.field,
+            };
+        }
+    }
+    throw new Error(`Invalid access rule for ${operation} in ${path}.`);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+//# sourceMappingURL=rules_loader.js.map

package/dist/lib/src/rules/rules_loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules_loader.js","sourceRoot":"","sources":["../../../../src/lib/src/rules/rules_loader.ts"],"names":[],"mappings":";;AAwFA,0CAoBC;AAOD,4CAeC;AAzDD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AACxE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACjC,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO;QACH,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;KACR,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,iBAAiB,IAAI,CAAC,IAAI,iBAAiB,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAc;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,QAAQ,IAAI,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,SAA8B,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAe;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,MAAyB,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,SAAS,SAAS,OAAO,IAAI,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO;gBACH,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC;QACN,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,OAAO,IAAI,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACvD,CAAC"}

package/dist/lib/src/worker_adapter_base.d.ts

@@ -0,0 +1,14 @@
+import { MiddlewareHandler } from "hono";
+/**
+ * Base class for worker adapter for Cloudflare Workers.
+ *
+ * Cloudflare Workers用のワーカーアダプターのベースクラス。
+ */
+export declare abstract class WorkerAdapterBase {
+    /**
+     * Create Hono middleware.
+     *
+     * Honoミドルウェアを作成します。
+     */
+    abstract build(): MiddlewareHandler;
+}

package/dist/lib/src/worker_adapter_base.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkerAdapterBase = void 0;
+/**
+ * Base class for worker adapter for Cloudflare Workers.
+ *
+ * Cloudflare Workers用のワーカーアダプターのベースクラス。
+ */
+class WorkerAdapterBase {
+}
+exports.WorkerAdapterBase = WorkerAdapterBase;
+//# sourceMappingURL=worker_adapter_base.js.map

package/dist/lib/src/worker_adapter_base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker_adapter_base.js","sourceRoot":"","sources":["../../../src/lib/src/worker_adapter_base.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,MAAsB,iBAAiB;CAOtC;AAPD,8CAOC"}

package/dist/lib/src/workers_auth_adapter_base.d.ts

@@ -1,4 +1,5 @@
-import { Context, MiddlewareHandler } from "hono";
+import { Context } from "hono";
+import { WorkerAdapterBase } from "./worker_adapter_base";
 /**
  * Authentication context for Cloudflare Workers.
  *
@@ -25,13 +26,7 @@ export interface WorkersAuthContext {
  *
  * Cloudflare Workers用の認証アダプターのベースクラス。
  */
-export declare abstract class WorkersAuthAdapterBase {
-    /**
-     * Create Hono middleware.
-     *
-     * Honoミドルウェアを作成します。
-     */
-    abstract build(): MiddlewareHandler;
+export declare abstract class WorkersAuthAdapterBase extends WorkerAdapterBase {
     /**
      * Set authentication context.
      *

package/dist/lib/src/workers_auth_adapter_base.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WorkersAuthAdapterBase = void 0;
+const worker_adapter_base_1 = require("./worker_adapter_base");
 /**
  * Base class for authentication adapter for Cloudflare Workers.
  *
  * Cloudflare Workers用の認証アダプターのベースクラス。
  */
-class WorkersAuthAdapterBase {
+class WorkersAuthAdapterBase extends worker_adapter_base_1.WorkerAdapterBase {
     /**
      * Set authentication context.
      *

package/dist/lib/src/workers_auth_adapter_base.js.map

@@ -1 +1 @@
-{"version":3,"file":"workers_auth_adapter_base.js","sourceRoot":"","sources":["../../../src/lib/src/workers_auth_adapter_base.ts"],"names":[],"mappings":";;;AAuBA;;;;GAIG;AACH,MAAsB,sBAAsB;IAQxC;;;;OAIG;IACO,cAAc,CACpB,OAAgB,EAChB,cAAkC;QAElC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;CACJ;AAnBD,wDAmBC"}
+{"version":3,"file":"workers_auth_adapter_base.js","sourceRoot":"","sources":["../../../src/lib/src/workers_auth_adapter_base.ts"],"names":[],"mappings":";;;AACA,+DAA0D;AAuB1D;;;;GAIG;AACH,MAAsB,sBAAuB,SAAQ,uCAAiB;IAClE;;;;OAIG;IACO,cAAc,CACpB,OAAgB,EAChB,cAAkC;QAElC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;CACJ;AAZD,wDAYC"}

package/dist/lib/src/workers_base.d.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { WorkersAuthAdapterBase } from "./workers_auth_adapter_base";
+import { WorkersRuleAdapterBase } from "./workers_rule_adapter_base";
 /**
  * Define Function data for Cloudflare Workers.
  *
@@ -77,6 +78,12 @@ export declare abstract class WorkersBase {
      * 認証ミドルウェアを適用します。
      */
     protected applyAuthentication(hono: Hono, options: WorkersOptions): Hono;
+    /**
+     * Apply rules middleware.
+     *
+     * rulesミドルウェアを適用します。
+     */
+    protected applyRules(hono: Hono, options: WorkersOptions): Hono;
 }
 /**
  * Specifies the options for the process.
@@ -90,6 +97,12 @@ export interface WorkersOptions {
      * 認証アダプター。
      */
     auth?: WorkersAuthAdapterBase | null | undefined;
+    /**
+     * Rules adapter.
+     *
+     * rulesアダプター。
+     */
+    rules?: WorkersRuleAdapterBase | null | undefined;
 }
 /**
  * Merge Workers options.

package/dist/lib/src/workers_base.js

@@ -72,6 +72,17 @@ class WorkersBase {
         }
         return hono;
     }
+    /**
+     * Apply rules middleware.
+     *
+     * rulesミドルウェアを適用します。
+     */
+    applyRules(hono, options) {
+        if (options.rules) {
+            hono.use("*", options.rules.build());
+        }
+        return hono;
+    }
 }
 exports.WorkersBase = WorkersBase;
 /**
@@ -80,12 +91,19 @@ exports.WorkersBase = WorkersBase;
  * Workersのオプションをマージします。
  */
 function resolveWorkersOptions(defaultOptions = {}, options = {}) {
+    const defaultAuth = defaultOptions.auth;
+    const auth = options.auth;
+    const defaultRules = defaultOptions.rules;
+    const rules = options.rules;
     return {
         ...defaultOptions,
         ...options,
-        auth: options.auth === undefined
-            ? defaultOptions.auth
-            : options.auth,
+        auth: auth === undefined
+            ? defaultAuth
+            : auth,
+        rules: rules === undefined
+            ? defaultRules
+            : rules,
     };
 }
 //# sourceMappingURL=workers_base.js.map

package/dist/lib/src/workers_base.js.map

@@ -1 +1 @@
-{"version":3,"file":"workers_base.js","sourceRoot":"","sources":["../../../src/lib/src/workers_base.ts"],"names":[],"mappings":";;;AA6HA,sDAWC;AArID;;;;;;;;GAQG;AACH,MAAsB,WAAW;IAC7B;;;;;;;;OAQG;IACH,YAAY,EACR,IAAI,EACJ,IAAI,EACJ,IAAI,GAAG,EAAE,EACT,OAAO,GAUV;QACG,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACM,IAAI,CAAS;IAEtB;;;;;OAKG;IACM,IAAI,CAIiB;IAE9B;;;;OAIG;IACM,IAAI,CAAyB;IAEtC;;;;OAIG;IACM,OAAO,CAAiB;IASjC;;;;OAIG;IACO,cAAc,CAAC,iBAAiC,EAAE;QACxD,OAAO,qBAAqB,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACO,mBAAmB,CAAC,IAAU,EAAE,OAAuB;QAC7D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ;AA5FD,kCA4FC;AAgBD;;;;GAIG;AACH,SAAgB,qBAAqB,CACjC,iBAAiC,EAAE,EACnC,UAA0B,EAAE;IAE5B,OAAO;QACH,GAAG,cAAc;QACjB,GAAG,OAAO;QACV,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS;YAC5B,CAAC,CAAC,cAAc,CAAC,IAAI;YACrB,CAAC,CAAC,OAAO,CAAC,IAAI;KACrB,CAAC;AACN,CAAC"}
+{"version":3,"file":"workers_base.js","sourceRoot":"","sources":["../../../src/lib/src/workers_base.ts"],"names":[],"mappings":";;;AAiJA,sDAkBC;AA/JD;;;;;;;;GAQG;AACH,MAAsB,WAAW;IAC7B;;;;;;;;OAQG;IACH,YAAY,EACR,IAAI,EACJ,IAAI,EACJ,IAAI,GAAG,EAAE,EACT,OAAO,GAUV;QACG,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACM,IAAI,CAAS;IAEtB;;;;;OAKG;IACM,IAAI,CAIiB;IAE9B;;;;OAIG;IACM,IAAI,CAAyB;IAEtC;;;;OAIG;IACM,OAAO,CAAiB;IASjC;;;;OAIG;IACO,cAAc,CAAC,iBAAiC,EAAE;QACxD,OAAO,qBAAqB,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACO,mBAAmB,CAAC,IAAU,EAAE,OAAuB;QAC7D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACO,UAAU,CAAC,IAAU,EAAE,OAAuB;QACpD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ;AAxGD,kCAwGC;AAuBD;;;;GAIG;AACH,SAAgB,qBAAqB,CACjC,iBAAiC,EAAE,EACnC,UAA0B,EAAE;IAE5B,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO;QACH,GAAG,cAAc;QACjB,GAAG,OAAO;QACV,IAAI,EAAE,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI;QACV,KAAK,EAAE,KAAK,KAAK,SAAS;YACtB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,KAAK;KACd,CAAC;AACN,CAAC"}

package/dist/lib/src/workers_rule_adapter_base.d.ts

@@ -0,0 +1,27 @@
+import { Context, MiddlewareHandler } from "hono";
+import { RulesEvaluationResult } from "./rules/rules_engine";
+/**
+ * Base class for rules adapter for Cloudflare Workers.
+ *
+ * Cloudflare Workers用のrulesアダプターのベースクラス。
+ */
+export declare abstract class WorkersRuleAdapterBase {
+    /**
+     * Create Hono middleware.
+     *
+     * Honoミドルウェアを作成します。
+     */
+    abstract build(): MiddlewareHandler;
+    /**
+     * Set rules evaluation result to context.
+     *
+     * rules評価結果をコンテキストに設定します。
+     */
+    protected setRulesContext(context: Context, result: RulesEvaluationResult): void;
+    /**
+     * Get rules evaluation result from context.
+     *
+     * コンテキストからrules評価結果を取得します。
+     */
+    protected getRulesContext(context: Context): RulesEvaluationResult | undefined;
+}

package/dist/lib/src/workers_rule_adapter_base.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkersRuleAdapterBase = void 0;
+/**
+ * Base class for rules adapter for Cloudflare Workers.
+ *
+ * Cloudflare Workers用のrulesアダプターのベースクラス。
+ */
+class WorkersRuleAdapterBase {
+    /**
+     * Set rules evaluation result to context.
+     *
+     * rules評価結果をコンテキストに設定します。
+     */
+    setRulesContext(context, result) {
+        context.set("rules", result);
+    }
+    /**
+     * Get rules evaluation result from context.
+     *
+     * コンテキストからrules評価結果を取得します。
+     */
+    getRulesContext(context) {
+        return context.get("rules");
+    }
+}
+exports.WorkersRuleAdapterBase = WorkersRuleAdapterBase;
+//# sourceMappingURL=workers_rule_adapter_base.js.map

package/dist/lib/src/workers_rule_adapter_base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers_rule_adapter_base.js","sourceRoot":"","sources":["../../../src/lib/src/workers_rule_adapter_base.ts"],"names":[],"mappings":";;;AAGA;;;;GAIG;AACH,MAAsB,sBAAsB;IAQxC;;;;OAIG;IACO,eAAe,CACrB,OAAgB,EAChB,MAA6B;QAE7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACO,eAAe,CAAC,OAAgB;QACtC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAsC,CAAC;IACrE,CAAC;CACJ;AA5BD,wDA4BC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathrunet/masamune_cloudflare",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "description": "Manages packages on Cloudflare Workers for the server portion of the Masamune framework.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",