@mathrunet/masamune_cloudflare 3.1.6 → 3.1.8

package/CHANGELOG.md

@@ -1,4 +1,4 @@
-## 3.1.6 (2026-06-30)
+## 3.1.8 (2026-07-01)
 
 
 ### chore

package/README.md

@@ -60,8 +60,52 @@ export default m.deploy(
 );
 ```
 
+# Rules
+
+`WorkersOptions.rules` accepts a `rules.json` configuration. Import the JSON
+file and pass it to `deploy` when multiple Cloudflare packages should share the
+same rules.
+
+```typescript
+import * as m from "@mathrunet/masamune_cloudflare";
+import rulesJson from "../rules.json";
+
+export default m.deploy(
+    [
+        m.TestWorkers.test,
+    ],
+    {
+        rules: rulesJson,
+    },
+);
+```
+
+`rules.json` paths use the same normalized format across Turso, TiDB, and KV
+workers.
+
+```json
+{
+  "version": "1",
+  "rules": {
+    "database/main": {
+      "read": "allow",
+      "write": "server"
+    },
+    "database/{uid}/table/users/{uid}": {
+      "read": { "type": "path", "param": "uid" },
+      "write": { "type": "field", "field": "ownerId", "server": true }
+    }
+  }
+}
+```
+
+Supported access values are `deny`, `allow`, `authenticated`, `server`,
+`{ "type": "field", "field": "..." }`, and
+`{ "type": "path", "param": "..." }`. `{ "type": "fieldMatch" }` is still
+accepted for compatibility.
+
 # GitHub Sponsors
 
 Sponsors are always welcome. Thank you for your support!
 
-[https://github.com/sponsors/mathrunet](https://github.com/sponsors/mathrunet)
+[https://github.com/sponsors/mathrunet](https://github.com/sponsors/mathrunet)

package/dist/index.d.ts

@@ -14,10 +14,16 @@ export * from "@mathrunet/masamune";
 export * from "./lib/api";
 export * from "./lib/src/workers_base";
 export * from "./lib/src/workers_auth_adapter_base";
+export * from "./lib/src/workers_rule_adapter_base";
 export * from "./lib/src/workers_data";
 export * from "./lib/src/request_process_workders_base";
+export * from "./lib/src/rules/rules_loader";
+export * from "./lib/src/rules/path_matcher";
+export * from "./lib/src/rules/rules_engine";
 export * from "./lib/adapters/firebase_auth_adapter";
 export * from "./lib/adapters/none_auth_adapter";
+export * from "./lib/adapters/rules_middleware";
+export * from "./lib/middlewares";
 /**
  * Methods for deploying to Cloudflare Workers.
  *

package/dist/index.js

@@ -52,10 +52,16 @@ __exportStar(require("@mathrunet/masamune"), exports);
 __exportStar(require("./lib/api"), exports);
 __exportStar(require("./lib/src/workers_base"), exports);
 __exportStar(require("./lib/src/workers_auth_adapter_base"), exports);
+__exportStar(require("./lib/src/workers_rule_adapter_base"), exports);
 __exportStar(require("./lib/src/workers_data"), exports);
 __exportStar(require("./lib/src/request_process_workders_base"), exports);
+__exportStar(require("./lib/src/rules/rules_loader"), exports);
+__exportStar(require("./lib/src/rules/path_matcher"), exports);
+__exportStar(require("./lib/src/rules/rules_engine"), exports);
 __exportStar(require("./lib/adapters/firebase_auth_adapter"), exports);
 __exportStar(require("./lib/adapters/none_auth_adapter"), exports);
+__exportStar(require("./lib/adapters/rules_middleware"), exports);
+__exportStar(require("./lib/middlewares"), exports);
 /**
  * Methods for deploying to Cloudflare Workers.
  *

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,wBAMC;AA3CD;;;;;;;;;GASG;AACH,2CAA6B;AAG7B,sDAAoC;AACpC,4CAA0B;AAC1B,yDAAuC;AACvC,sEAAoD;AACpD,yDAAuC;AACvC,0EAAwD;AACxD,uEAAqD;AACrD,mEAAiD;AAEjD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,MAAM,CAAC,cAA6B,EAAE,UAA0B,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,wBAMC;AAjDD;;;;;;;;;GASG;AACH,2CAA6B;AAG7B,sDAAoC;AACpC,4CAA0B;AAC1B,yDAAuC;AACvC,sEAAoD;AACpD,sEAAoD;AACpD,yDAAuC;AACvC,0EAAwD;AACxD,+DAA6C;AAC7C,+DAA6C;AAC7C,+DAA6C;AAC7C,uEAAqD;AACrD,mEAAiD;AACjD,kEAAgD;AAChD,oDAAkC;AAElC;;;;;;;;;;;;;;GAcG;AACH,SAAgB,MAAM,CAAC,cAA6B,EAAE,UAA0B,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/lib/adapters/rules_middleware.d.ts

@@ -0,0 +1,45 @@
+import { Context, MiddlewareHandler } from "hono";
+import { RulesEngine, RulesEvaluationInput, RulesEvaluationResult } from "../src/rules/rules_engine";
+import { WorkersRuleAdapterBase } from "../src/workers_rule_adapter_base";
+/**
+ * Input builder for rules adapter.
+ *
+ * rulesアダプター用の入力生成関数。
+ */
+export type RulesEvaluationInputBuilder = (context: Context) => RulesEvaluationInput | Promise<RulesEvaluationInput>;
+/**
+ * Options for RulesEngineRuleAdapter.
+ *
+ * RulesEngineRuleAdapterのオプション。
+ */
+export interface RulesEngineRuleOptions {
+    /**
+     * Rules engine to evaluate access rules.
+     *
+     * アクセスルールを評価するrulesエンジン。
+     */
+    engine: RulesEngine;
+    /**
+     * Builder that produces rules evaluation input from the request context.
+     *
+     * リクエストコンテキストからrules評価入力を生成するビルダー。
+     */
+    getEvaluationInput: RulesEvaluationInputBuilder;
+    /**
+     * Response returned when access is denied.
+     *
+     * アクセスが拒否された場合に返すレスポンス。
+     */
+    deniedResponse?: (context: Context, result: RulesEvaluationResult) => Response | Promise<Response>;
+}
+/**
+ * Middleware adapter that evaluates rules using a RulesEngine.
+ *
+ * RulesEngineを用いてrulesを評価するミドルウェアアダプター。
+ */
+export declare class RulesEngineRuleAdapter extends WorkersRuleAdapterBase {
+    constructor(options: RulesEngineRuleOptions);
+    private readonly options;
+    build(): MiddlewareHandler;
+    private denied;
+}

package/dist/lib/adapters/rules_middleware.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RulesEngineRuleAdapter = void 0;
+const workers_rule_adapter_base_1 = require("../src/workers_rule_adapter_base");
+/**
+ * Middleware adapter that evaluates rules using a RulesEngine.
+ *
+ * RulesEngineを用いてrulesを評価するミドルウェアアダプター。
+ */
+class RulesEngineRuleAdapter extends workers_rule_adapter_base_1.WorkersRuleAdapterBase {
+    constructor(options) {
+        super();
+        this.options = options;
+    }
+    options;
+    build() {
+        return async (context, next) => {
+            const authentication = context.get("authentication");
+            const input = await this.options.getEvaluationInput(context);
+            const result = await this.options.engine.evaluate({
+                ...input,
+                authentication: input.authentication ?? authentication,
+            });
+            if (!result.allowed) {
+                return await this.denied(context, result);
+            }
+            this.setRulesContext(context, result);
+            await next();
+        };
+    }
+    async denied(context, result) {
+        if (this.options.deniedResponse) {
+            return await this.options.deniedResponse(context, result);
+        }
+        return context.json({
+            error: "denied",
+            rule: result.rulePath,
+        }, 403);
+    }
+}
+exports.RulesEngineRuleAdapter = RulesEngineRuleAdapter;
+//# sourceMappingURL=rules_middleware.js.map

package/dist/lib/adapters/rules_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules_middleware.js","sourceRoot":"","sources":["../../../src/lib/adapters/rules_middleware.ts"],"names":[],"mappings":";;;AAOA,gFAA0E;AA0C1E;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,kDAAsB;IAC9D,YAAY,OAA+B;QACvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAEgB,OAAO,CAAyB;IAEjD,KAAK;QACD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAmC,CAAC;YACvF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC9C,GAAG,KAAK;gBACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc;aACzD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,MAAM,CAChB,OAAgB,EAChB,MAA6B;QAE7B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC9B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,MAAM,CAAC,QAAQ;SACxB,EAAE,GAAG,CAAC,CAAC;IACZ,CAAC;CACJ;AApCD,wDAoCC"}

package/dist/lib/middlewares/index.d.ts

@@ -1,2 +1,3 @@
-export * from "./firebase_authentication_middleware";
-export * from "./no_authentication_middleware";
+export * from "../adapters/rules_middleware";
+export { FirebaseAuthAdapter as FirebaseAuthenticationMiddleware, FirebaseAuthOptions as FirebaseAuthenticationMiddlewareOptions, FirebaseCacheApiKeyStorer, } from "../adapters/firebase_auth_adapter";
+export { NoneAuthAdapter as NoAuthenticationMiddleware, } from "../adapters/none_auth_adapter";

package/dist/lib/middlewares/index.js

@@ -14,6 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./firebase_authentication_middleware"), exports);
-__exportStar(require("./no_authentication_middleware"), exports);
+exports.NoAuthenticationMiddleware = exports.FirebaseCacheApiKeyStorer = exports.FirebaseAuthenticationMiddleware = void 0;
+__exportStar(require("../adapters/rules_middleware"), exports);
+var firebase_auth_adapter_1 = require("../adapters/firebase_auth_adapter");
+Object.defineProperty(exports, "FirebaseAuthenticationMiddleware", { enumerable: true, get: function () { return firebase_auth_adapter_1.FirebaseAuthAdapter; } });
+Object.defineProperty(exports, "FirebaseCacheApiKeyStorer", { enumerable: true, get: function () { return firebase_auth_adapter_1.FirebaseCacheApiKeyStorer; } });
+var none_auth_adapter_1 = require("../adapters/none_auth_adapter");
+Object.defineProperty(exports, "NoAuthenticationMiddleware", { enumerable: true, get: function () { return none_auth_adapter_1.NoneAuthAdapter; } });
 //# sourceMappingURL=index.js.map

package/dist/lib/middlewares/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uEAAqD;AACrD,iEAA+C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6C;AAC7C,2EAI2C;AAHvC,yIAAA,mBAAmB,OAAoC;AAEvD,kIAAA,yBAAyB,OAAA;AAE7B,mEAEuC;AADnC,+HAAA,eAAe,OAA8B"}

package/dist/lib/middlewares/rules_middleware.d.ts

@@ -0,0 +1,29 @@
+import { Context, MiddlewareHandler } from "hono";
+import { RulesEngine, RulesEvaluationInput, RulesEvaluationResult } from "../src/rules/rules_engine";
+/**
+ * Input builder for rules middleware.
+ *
+ * rulesミドルウェア用の入力生成関数。
+ */
+export type RulesMiddlewareInputBuilder = (context: Context) => RulesEvaluationInput | Promise<RulesEvaluationInput>;
+/**
+ * Options for rules middleware.
+ *
+ * rulesミドルウェアのオプション。
+ */
+export interface RulesMiddlewareOptions {
+    engine: RulesEngine;
+    getEvaluationInput: RulesMiddlewareInputBuilder;
+}
+/**
+ * Create rules middleware.
+ *
+ * rulesミドルウェアを作成します。
+ */
+export declare function rulesMiddleware(options: RulesMiddlewareOptions): MiddlewareHandler;
+/**
+ * Get rules evaluation result from Hono context.
+ *
+ * Hono contextからrules評価結果を取得します。
+ */
+export declare function getRulesEvaluationResult(context: Context): RulesEvaluationResult | undefined;

package/dist/lib/middlewares/rules_middleware.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rulesMiddleware = rulesMiddleware;
+exports.getRulesEvaluationResult = getRulesEvaluationResult;
+/**
+ * Create rules middleware.
+ *
+ * rulesミドルウェアを作成します。
+ */
+function rulesMiddleware(options) {
+    return async (context, next) => {
+        const authentication = context.get("authentication");
+        const input = await options.getEvaluationInput(context);
+        const result = await options.engine.evaluate({
+            ...input,
+            authentication: input.authentication ?? authentication,
+        });
+        if (!result.allowed) {
+            return context.json({
+                error: "denied",
+                rule: result.rulePath,
+            }, 403);
+        }
+        context.set("rules", result);
+        await next();
+    };
+}
+/**
+ * Get rules evaluation result from Hono context.
+ *
+ * Hono contextからrules評価結果を取得します。
+ */
+function getRulesEvaluationResult(context) {
+    return context.get("rules");
+}
+//# sourceMappingURL=rules_middleware.js.map

package/dist/lib/middlewares/rules_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules_middleware.js","sourceRoot":"","sources":["../../../src/lib/middlewares/rules_middleware.ts"],"names":[],"mappings":";;AAgCA,0CAiBC;AAOD,4DAEC;AA/BD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAA+B;IAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAmC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACzC,GAAG,KAAK;YACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,MAAM,CAAC,QAAQ;aACxB,EAAE,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;IACjB,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,OAAgB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAsC,CAAC;AACrE,CAAC"}

package/dist/lib/src/rules/path_matcher.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Result of matching a rule path against a request path.
+ *
+ * ルールパスとリクエストパスのマッチ結果。
+ */
+export interface RulePathMatch {
+    matched: boolean;
+    rulePath: string;
+    params: Record<string, string>;
+    literalSegments: number;
+    namedWildcardSegments: number;
+    wildcardSegments: number;
+    deepWildcardSegments: number;
+    matchedSegments: number;
+}
+/**
+ * Match rule path to request path.
+ *
+ * ルールパスをリクエストパスに照合します。
+ */
+export declare function matchRulePath(rulePath: string, requestPath: string): RulePathMatch;
+/**
+ * Compare matches by specificity.
+ *
+ * マッチ結果を具体度で比較します。
+ */
+export declare function compareRulePathMatch(a: RulePathMatch, b: RulePathMatch): number;
+/**
+ * Sort matches from the most specific to the least specific.
+ *
+ * マッチ結果を具体度の高い順に並べます。
+ */
+export declare function sortRulePathMatches(matches: RulePathMatch[]): RulePathMatch[];

package/dist/lib/src/rules/path_matcher.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchRulePath = matchRulePath;
+exports.compareRulePathMatch = compareRulePathMatch;
+exports.sortRulePathMatches = sortRulePathMatches;
+const rules_loader_1 = require("./rules_loader");
+/**
+ * Match rule path to request path.
+ *
+ * ルールパスをリクエストパスに照合します。
+ */
+function matchRulePath(rulePath, requestPath) {
+    (0, rules_loader_1.validateRulePath)(rulePath);
+    const ruleSegments = splitPath(rulePath);
+    const requestSegments = splitPath(requestPath);
+    const params = {};
+    let literalSegments = 0;
+    let namedWildcardSegments = 0;
+    let wildcardSegments = 0;
+    let deepWildcardSegments = 0;
+    for (let i = 0; i < ruleSegments.length; i++) {
+        const ruleSegment = ruleSegments[i];
+        if (ruleSegment === "**") {
+            deepWildcardSegments = 1;
+            return {
+                matched: true,
+                rulePath,
+                params,
+                literalSegments,
+                namedWildcardSegments,
+                wildcardSegments,
+                deepWildcardSegments,
+                matchedSegments: requestSegments.length,
+            };
+        }
+        const requestSegment = requestSegments[i];
+        if (requestSegment === undefined) {
+            return createUnmatched(rulePath);
+        }
+        if (ruleSegment === "*") {
+            wildcardSegments++;
+            continue;
+        }
+        const paramName = parseNamedPathParam(ruleSegment);
+        if (paramName) {
+            params[paramName] = requestSegment;
+            namedWildcardSegments++;
+            wildcardSegments++;
+            continue;
+        }
+        if (ruleSegment !== requestSegment) {
+            return createUnmatched(rulePath);
+        }
+        literalSegments++;
+    }
+    if (ruleSegments.length !== requestSegments.length) {
+        return createUnmatched(rulePath);
+    }
+    return {
+        matched: true,
+        rulePath,
+        params,
+        literalSegments,
+        namedWildcardSegments,
+        wildcardSegments,
+        deepWildcardSegments,
+        matchedSegments: requestSegments.length,
+    };
+}
+/**
+ * Compare matches by specificity.
+ *
+ * マッチ結果を具体度で比較します。
+ */
+function compareRulePathMatch(a, b) {
+    if (a.literalSegments !== b.literalSegments) {
+        return b.literalSegments - a.literalSegments;
+    }
+    if (a.deepWildcardSegments !== b.deepWildcardSegments) {
+        return a.deepWildcardSegments - b.deepWildcardSegments;
+    }
+    if (a.namedWildcardSegments !== b.namedWildcardSegments) {
+        return b.namedWildcardSegments - a.namedWildcardSegments;
+    }
+    if (a.wildcardSegments !== b.wildcardSegments) {
+        return a.wildcardSegments - b.wildcardSegments;
+    }
+    if (a.matchedSegments !== b.matchedSegments) {
+        return b.matchedSegments - a.matchedSegments;
+    }
+    return a.rulePath.localeCompare(b.rulePath);
+}
+/**
+ * Sort matches from the most specific to the least specific.
+ *
+ * マッチ結果を具体度の高い順に並べます。
+ */
+function sortRulePathMatches(matches) {
+    return [...matches].sort(compareRulePathMatch);
+}
+function splitPath(path) {
+    if (path.length === 0 || path.startsWith("/") || path.endsWith("/")) {
+        return [];
+    }
+    const segments = path.split("/");
+    if (segments.some((segment) => segment.length === 0)) {
+        return [];
+    }
+    return segments;
+}
+function createUnmatched(rulePath) {
+    return {
+        matched: false,
+        rulePath,
+        params: {},
+        literalSegments: 0,
+        namedWildcardSegments: 0,
+        wildcardSegments: 0,
+        deepWildcardSegments: 0,
+        matchedSegments: 0,
+    };
+}
+function parseNamedPathParam(segment) {
+    const match = /^\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(segment);
+    return match?.[1];
+}
+//# sourceMappingURL=path_matcher.js.map

package/dist/lib/src/rules/path_matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path_matcher.js","sourceRoot":"","sources":["../../../../src/lib/src/rules/path_matcher.ts"],"names":[],"mappings":";;AAuBA,sCA0DC;AAOD,oDAiBC;AAOD,kDAEC;AAlHD,iDAAkD;AAkBlD;;;;GAIG;AACH,SAAgB,aAAa,CAAC,QAAgB,EAAE,WAAmB;IAC/D,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,oBAAoB,GAAG,CAAC,CAAC;YACzB,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,MAAM;gBACN,eAAe;gBACf,qBAAqB;gBACrB,gBAAgB;gBAChB,oBAAoB;gBACpB,eAAe,EAAE,eAAe,CAAC,MAAM;aAC1C,CAAC;QACN,CAAC;QACD,MAAM,cAAc,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACtB,gBAAgB,EAAE,CAAC;YACnB,SAAS;QACb,CAAC;QACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,SAAS,EAAE,CAAC;YACZ,MAAM,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC;YACnC,qBAAqB,EAAE,CAAC;YACxB,gBAAgB,EAAE,CAAC;YACnB,SAAS;QACb,CAAC;QACD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,eAAe,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO;QACH,OAAO,EAAE,IAAI;QACb,QAAQ;QACR,MAAM;QACN,eAAe;QACf,qBAAqB;QACrB,gBAAgB;QAChB,oBAAoB;QACpB,eAAe,EAAE,eAAe,CAAC,MAAM;KAC1C,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,CAAgB,EAAE,CAAgB;IACnE,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,CAAC,oBAAoB,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,oBAAoB,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,CAAC,qBAAqB,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,qBAAqB,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,OAAwB;IACxD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACrC,OAAO;QACH,OAAO,EAAE,KAAK;QACd,QAAQ;QACR,MAAM,EAAE,EAAE;QACV,eAAe,EAAE,CAAC;QAClB,qBAAqB,EAAE,CAAC;QACxB,gBAAgB,EAAE,CAAC;QACnB,oBAAoB,EAAE,CAAC;QACvB,eAAe,EAAE,CAAC;KACrB,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/lib/src/rules/rules_engine.d.ts

@@ -0,0 +1,182 @@
+import { WorkersAuthContext } from "../workers_auth_adapter_base";
+import { RulesAccessRule, RulesConfig, RulesOperation, RulesOperationKey } from "./rules_loader";
+/**
+ * Input for evaluating rules.
+ *
+ * rules評価入力。
+ */
+export interface RulesEvaluationInput {
+    path: string;
+    operation: RulesOperation | RulesOperationKey;
+    authentication?: WorkersAuthContext | undefined;
+    fetchDocument?: (() => Promise<Record<string, unknown> | null | undefined>) | undefined;
+    server?: boolean | undefined;
+}
+/**
+ * Result of evaluating rules.
+ *
+ * rules評価結果。
+ */
+export interface RulesEvaluationResult {
+    allowed: boolean;
+    rulePath?: string | undefined;
+    access?: RulesAccessRule | undefined;
+    params?: Record<string, string> | undefined;
+}
+/**
+ * Arguments for building a rules path.
+ *
+ * rulesパス生成引数。
+ */
+export interface RulesPathArguments {
+    database: string;
+    table: string;
+    indexKey: string;
+}
+/**
+ * Access mode resolved from rules.
+ *
+ * rulesから解決されたアクセスモード。
+ */
+export type RulesAccessMode = "none" | "functions" | "direct";
+/**
+ * Database token authorization resolved from rules.
+ *
+ * rulesから解決されたデータベーストークン権限。
+ */
+export type RulesDatabaseTokenAuthorization = "read-only" | "full-access";
+/**
+ * Target input for database token rules evaluation.
+ *
+ * データベーストークンrules評価対象。
+ */
+export interface RulesTokenTargetInput {
+    table: string;
+    operations: RulesOperationKey[];
+}
+/**
+ * Target output for database token rules evaluation.
+ *
+ * データベーストークンrules評価結果。
+ */
+export interface RulesTokenTargetOutput extends RulesTokenTargetInput {
+    readMode?: RulesAccessMode | undefined;
+    writeMode?: RulesAccessMode | undefined;
+}
+/**
+ * Database token access resolved from rules.
+ *
+ * rulesから解決されたデータベーストークンアクセス。
+ */
+export interface RulesDatabaseTokenAccess {
+    authorization?: RulesDatabaseTokenAuthorization | undefined;
+    readMode: RulesAccessMode;
+    writeMode: RulesAccessMode;
+    scopes: RulesTokenTargetOutput[];
+}
+/**
+ * Rules engine.
+ *
+ * rules評価エンジン。
+ */
+export declare class RulesEngine {
+    constructor(config: RulesConfig | unknown);
+    private readonly config;
+    /**
+     * Evaluate rules for the given path and operation.
+     *
+     * 指定したパスと操作に対してrulesを評価します。
+     */
+    evaluate(input: RulesEvaluationInput): Promise<RulesEvaluationResult>;
+    /**
+     * Returns true when a table scoped rule requires server evaluation.
+     *
+     * テーブル配下ルールにサーバー評価が必要な制約がある場合はtrueを返します。
+     */
+    hasScopedRestriction({ database, table, operation, }: {
+        database: string;
+        table: string;
+        operation: RulesOperation | RulesOperationKey;
+    }): boolean;
+    /**
+     * Returns true when a table scoped rule explicitly denies access.
+     *
+     * テーブル配下ルールに明示的なdenyがある場合はtrueを返します。
+     */
+    hasScopedDeny({ database, table, operation, }: {
+        database: string;
+        table: string;
+        operation: RulesOperation | RulesOperationKey;
+    }): boolean;
+}
+/**
+ * Build a normalized rules path.
+ *
+ * 正規化されたrulesパスを生成します。
+ */
+export declare function buildRulesPath({ database, table, indexKey }: RulesPathArguments): string;
+/**
+ * Build a normalized database rules path.
+ *
+ * 正規化されたデータベースrulesパスを生成します。
+ */
+export declare function buildDatabaseRulesPath({ database }: {
+    database: string;
+}): string;
+/**
+ * Normalize HTTP method to rules operation.
+ *
+ * HTTPメソッドをrules操作に正規化します。
+ */
+export declare function normalizeHttpMethodToRulesOperation(method: string): RulesOperation;
+/**
+ * Normalize rules operation aliases.
+ *
+ * rules操作エイリアスを正規化します。
+ */
+export declare function normalizeRulesOperation(operation: RulesOperation | RulesOperationKey): RulesOperation;
+/**
+ * Expand operation aliases to concrete operations.
+ *
+ * 操作エイリアスを具体的な操作へ展開します。
+ */
+export declare function expandRulesOperation(operation: RulesOperationKey): RulesOperation[];
+/**
+ * Filter token targets by rules.
+ *
+ * rulesによりトークン対象をフィルタします。
+ */
+export declare function filterAllowedScope({ engine, database, scope, authentication, }: {
+    engine: RulesEngine;
+    database: string;
+    scope: RulesTokenTargetInput[];
+    authentication?: WorkersAuthContext | undefined;
+}): Promise<RulesTokenTargetInput[]>;
+/**
+ * Resolve database token access from rules.
+ *
+ * rulesからデータベーストークンアクセスを解決します。
+ */
+export declare function resolveDatabaseTokenAccess({ engine, database, operations, scope, authentication, }: {
+    engine: RulesEngine;
+    database: string;
+    operations?: RulesOperationKey[] | undefined;
+    scope?: RulesTokenTargetInput[] | undefined;
+    authentication?: WorkersAuthContext | undefined;
+}): Promise<RulesDatabaseTokenAccess | undefined>;
+/**
+ * Resolve database token authorization from rules.
+ *
+ * rulesからデータベーストークン権限を解決します。
+ */
+export declare function resolveDatabaseTokenAuthorization({ engine, database, authentication, }: {
+    engine: RulesEngine;
+    database: string;
+    authentication?: WorkersAuthContext | undefined;
+}): Promise<RulesDatabaseTokenAuthorization | undefined>;
+/**
+ * Resolve operation lookup order.
+ *
+ * 操作の解決順を取得します。
+ */
+export declare function resolveRulesOperation(operation: RulesOperation | RulesOperationKey): RulesOperationKey[];