@nmnmcc/ability 2.0.0 → 2.0.2

package/dist/internal/rule.js

@@ -1,3 +1,4 @@
+import { isNode } from "./nodes.js";
 import { lookup } from "./catalog.js";
 import { descriptor, isResource } from "./resource.js";
 import { builder as builder$1 } from "../Condition.js";
@@ -31,6 +32,15 @@ const make = (data) => new Rule({
 	...data.meta === void 0 ? {} : { meta: data.meta },
 	...data.domain === void 0 ? {} : { domain: data.domain }
 });
+/**
+* Makes a rule from its data, as `Policy.rule` does. A condition with a
+* predicate is a defect: the types of the predicate tie it to the kinds of
+* the rule of a builder, and the binding can not check it.
+*/
+const makePlain = (data) => {
+	if (data.when !== void 0 && isNode(data.when) && data.when.opaque) throw new Error("Policy.rule takes no condition with a predicate. Make the rule with Policy.builder.");
+	return make(data);
+};
 /** Tests if a value is a rule. */
 const isRule = (u) => u instanceof Rule;
 const toArray = (value) => Array.isArray(value) ? value : [value];
@@ -88,6 +98,6 @@ const matchesTarget = (rule, target) => {
 	const open = rule._tag === "Deny" && target.descriptor !== void 0 && (lookup(target.descriptor.catalog, field)?.open ?? false);
 	return rule.fields.some((pattern) => matchesField(pattern, field) || open && matchesInside(pattern, field));
 };
-export { Rule, builder, isRule, make, matchesField, matchesInside, matchesTarget };
+export { Rule, builder, isRule, make, makePlain, matchesField, matchesInside, matchesTarget };
 
 //# sourceMappingURL=rule.js.map

package/dist/internal/rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule.js","names":["ResourceData.isResource","ResourceData.descriptor","Condition.builder","Patterns.matches","Patterns.parseBound","Patterns.matchesBelow","Patterns.fitsCatalog","Catalog.lookup"],"sources":["../../src/internal/rule.ts"],"sourcesContent":["/**\n * The values of rules, with no types. The types are in `Policy.ts`.\n *\n * Rules do not change, and two rules with the same data are equal. A rule\n * works in a generator: it gives itself, so `yield* _.allow(...)` gives the\n * rule to `Policy.define`.\n */\nimport * as Arr from \"effect/Array\"\nimport * as Data from \"effect/Data\"\nimport * as Condition from \"../Condition.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Resource from \"../Resource.ts\"\nimport * as Catalog from \"./catalog.ts\"\nimport * as ResourceData from \"./resource.ts\"\nimport * as Patterns from \"./patterns.ts\"\n\n/** The data of a rule. */\nexport interface Shape {\n\treadonly _tag: \"Allow\" | \"Deny\"\n\treadonly actions: ReadonlyArray<string>\n\treadonly resources: ReadonlyArray<string>\n\treadonly when?: Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n\t/**\n\t * The domain of the builder that made the rule. Two domains may have the\n\t * same types but other paths, so the types can not tell them apart. It is\n\t * not in the JSON form of a rule.\n\t */\n\treadonly domain?: Domain.Any\n}\n\n/** The class of every rule value. */\nexport class Rule extends Data.Class<Shape> {\n\t*[Symbol.iterator](): Generator<this, this, unknown> {\n\t\tyield this\n\t\treturn this\n\t}\n}\n\n/** Makes a rule from its data. It does not check the data against a domain. */\nexport const make = (data: Shape): Rule =>\n\t// A missing option is left out, so two rules with the same data are equal.\n\tnew Rule({\n\t\t_tag: data._tag,\n\t\tactions: [...data.actions],\n\t\tresources: [...data.resources],\n\t\t...(data.when === undefined ? {} : { when: data.when }),\n\t\t...(data.fields === undefined ? {} : { fields: [...data.fields] }),\n\t\t...(data.reason === undefined ? {} : { reason: data.reason }),\n\t\t...(data.id === undefined ? {} : { id: data.id }),\n\t\t...(data.meta === undefined ? {} : { meta: data.meta }),\n\t\t...(data.domain === undefined ? {} : { domain: data.domain }),\n\t})\n\n/** Tests if a value is a rule. */\nexport const isRule = (u: unknown): u is Rule => u instanceof Rule\n\nconst toArray = <A>(value: A | ReadonlyArray<A>): ReadonlyArray<A> =>\n\tArray.isArray(value) ? value : [value as A]\n\nconst kindName = (target: unknown): string =>\n\tResourceData.isResource(target)\n\t\t? ResourceData.descriptor(target).kind\n\t\t: (target as string)\n\n/** The options of a rule from a builder, with no types. */\ninterface Options {\n\treadonly when?: (builder: never) => Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n}\n\nconst fromOptions =\n\t(tag: \"Allow\" | \"Deny\", domain: Domain.Any) =>\n\t(\n\t\taction: string | ReadonlyArray<string>,\n\t\tresource: unknown,\n\t\toptions?: Options,\n\t): Rule =>\n\t\tmake({\n\t\t\t_tag: tag,\n\t\t\tactions: toArray(action),\n\t\t\tresources: Arr.map(toArray(resource), kindName),\n\t\t\t...(options?.when === undefined\n\t\t\t\t? {}\n\t\t\t\t: { when: options.when(Condition.builder() as never) }),\n\t\t\t...(options?.fields === undefined ? {} : { fields: options.fields }),\n\t\t\t...(options?.reason === undefined ? {} : { reason: options.reason }),\n\t\t\t...(options?.id === undefined ? {} : { id: options.id }),\n\t\t\t...(options?.meta === undefined ? {} : { meta: options.meta }),\n\t\t\tdomain,\n\t\t})\n\n/** Makes the rule builder of a domain. */\nexport const builder = (domain: Domain.Any) => ({\n\tallow: fromOptions(\"Allow\", domain),\n\tdeny: fromOptions(\"Deny\", domain),\n})\n\n/**\n * Tests if a field name matches a field name or a field pattern of a rule. A\n * pattern matches the fields below a field that it matches too, so `settings`\n * matches `settings.model`.\n */\nexport const matchesField = (pattern: string, field: string): boolean =>\n\tPatterns.matches(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests if a field pattern may match a field inside `field`, such as\n * `settings.secret` inside `settings`.\n */\nexport const matchesInside = (pattern: string, field: string): boolean =>\n\tPatterns.matchesBelow(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests the parts of a rule that do not need the resource value: the action,\n * the kind and the field.\n *\n * A rule with an empty list of fields covers no request. A rule with fields\n * covers a request with no field only when it is an allow rule. So \"may\n * update some fields\" is a yes. A deny rule for some fields does not stop a\n * request for the whole value. With the `descriptor` of the kind, such an\n * allow rule covers the request only when one of its patterns matches a field\n * of the kind, and a deny rule for a part of a field that holds parts covers\n * a request for the whole field. A grant of fields that the kind does not have is not a grant of\n * some fields.\n */\nexport const matchesTarget = (\n\trule: Shape,\n\ttarget: {\n\t\treadonly action: string\n\t\treadonly kind: string\n\t\treadonly field?: string | undefined\n\t\treadonly descriptor?: Resource.Descriptor | undefined\n\t},\n): boolean => {\n\tif (!rule.actions.includes(\"*\") && !rule.actions.includes(target.action)) {\n\t\treturn false\n\t}\n\tif (!rule.resources.includes(\"*\") && !rule.resources.includes(target.kind)) {\n\t\treturn false\n\t}\n\tif (rule.fields === undefined) {\n\t\treturn true\n\t}\n\t// A rule for no fields is a rule for nothing. A grant with its last field\n\t// taken away must not cover the whole value.\n\tif (rule.fields.length === 0) {\n\t\treturn false\n\t}\n\tif (target.field === undefined) {\n\t\tconst descriptor = target.descriptor\n\t\treturn (\n\t\t\trule._tag === \"Allow\" &&\n\t\t\t(descriptor === undefined ||\n\t\t\t\tArr.some(rule.fields, (pattern) =>\n\t\t\t\t\tPatterns.fitsCatalog(\n\t\t\t\t\t\tPatterns.parseBound(pattern),\n\t\t\t\t\t\tdescriptor.catalog,\n\t\t\t\t\t),\n\t\t\t\t))\n\t\t)\n\t}\n\tconst field = target.field\n\t// A field that holds parts, as a record does, shows its parts too. So a\n\t// deny rule for a part inside it, as `data.secret` inside `data`, also\n\t// covers a request for the whole field.\n\tconst open =\n\t\trule._tag === \"Deny\" &&\n\t\ttarget.descriptor !== undefined &&\n\t\t(Catalog.lookup(target.descriptor.catalog, field)?.open ?? false)\n\treturn rule.fields.some(\n\t\t(pattern) =>\n\t\t\tmatchesField(pattern, field) || (open && matchesInside(pattern, field)),\n\t)\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmCA,IAAa,OAAb,cAA0B,KAAK,MAAa;CAC3C,EAAE,OAAO,YAA4C;EACpD,MAAM;EACN,OAAO;CACR;AACD;;AAGA,MAAa,QAAQ,SAEpB,IAAI,KAAK;CACR,MAAM,KAAK;CACX,SAAS,CAAC,GAAG,KAAK,OAAO;CACzB,WAAW,CAAC,GAAG,KAAK,SAAS;CAC7B,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE;CAChE,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;CAC3D,GAAI,KAAK,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;CAC/C,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAC5D,CAAC;;AAGF,MAAa,UAAU,MAA0B,aAAa;AAE9D,MAAM,WAAc,UACnB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAU;AAE3C,MAAM,YAAY,WACjBA,WAAwB,MAAM,IAC3BC,WAAwB,MAAM,CAAC,CAAC,OAC/B;AAWL,MAAM,eACJ,KAAuB,YAEvB,QACA,UACA,YAEA,KAAK;CACJ,MAAM;CACN,SAAS,QAAQ,MAAM;CACvB,WAAW,IAAI,IAAI,QAAQ,QAAQ,GAAG,QAAQ;CAC9C,GAAI,SAAS,SAAS,KAAA,IACnB,CAAC,IACD,EAAE,MAAM,QAAQ,KAAKC,UAAkB,CAAU,EAAE;CACtD,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;CACtD,GAAI,SAAS,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;CAC5D;AACD,CAAC;;AAGH,MAAa,WAAW,YAAwB;CAC/C,OAAO,YAAY,SAAS,MAAM;CAClC,MAAM,YAAY,QAAQ,MAAM;AACjC;;;;;;AAOA,MAAa,gBAAgB,SAAiB,UAC7CC,QAAiBC,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;AAMhE,MAAa,iBAAiB,SAAiB,UAC9CC,aAAsBD,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;;;;;;;;;;AAerE,MAAa,iBACZ,MACA,WAMa;CACb,IAAI,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC,KAAK,QAAQ,SAAS,OAAO,MAAM,GACtE,OAAO;CAER,IAAI,CAAC,KAAK,UAAU,SAAS,GAAG,KAAK,CAAC,KAAK,UAAU,SAAS,OAAO,IAAI,GACxE,OAAO;CAER,IAAI,KAAK,WAAW,KAAA,GACnB,OAAO;CAIR,IAAI,KAAK,OAAO,WAAW,GAC1B,OAAO;CAER,IAAI,OAAO,UAAU,KAAA,GAAW;EAC/B,MAAM,aAAa,OAAO;EAC1B,OACC,KAAK,SAAS,YACb,eAAe,KAAA,KACf,IAAI,KAAK,KAAK,SAAS,YACtBE,YACCF,WAAoB,OAAO,GAC3B,WAAW,OACZ,CACD;CAEH;CACA,MAAM,QAAQ,OAAO;CAIrB,MAAM,OACL,KAAK,SAAS,UACd,OAAO,eAAe,KAAA,MACrBG,OAAe,OAAO,WAAW,SAAS,KAAK,CAAC,EAAE,QAAQ;CAC5D,OAAO,KAAK,OAAO,MACjB,YACA,aAAa,SAAS,KAAK,KAAM,QAAQ,cAAc,SAAS,KAAK,CACvE;AACD"}
+{"version":3,"file":"rule.js","names":["Nodes.isNode","ResourceData.isResource","ResourceData.descriptor","Condition.builder","Patterns.matches","Patterns.parseBound","Patterns.matchesBelow","Patterns.fitsCatalog","Catalog.lookup"],"sources":["../../src/internal/rule.ts"],"sourcesContent":["/**\n * The values of rules, with no types. The types are in `Policy.ts`.\n *\n * Rules do not change, and two rules with the same data are equal. A rule\n * works in a generator: it gives itself, so `yield* _.allow(...)` gives the\n * rule to `Policy.define`.\n */\nimport * as Arr from \"effect/Array\"\nimport * as Data from \"effect/Data\"\nimport * as Condition from \"../Condition.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Resource from \"../Resource.ts\"\nimport * as Catalog from \"./catalog.ts\"\nimport * as Nodes from \"./nodes.ts\"\nimport * as ResourceData from \"./resource.ts\"\nimport * as Patterns from \"./patterns.ts\"\n\n/** The data of a rule. */\nexport interface Shape {\n\treadonly _tag: \"Allow\" | \"Deny\"\n\treadonly actions: ReadonlyArray<string>\n\treadonly resources: ReadonlyArray<string>\n\treadonly when?: Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n\t/**\n\t * The domain of the builder that made the rule. Two domains may have the\n\t * same types but other paths, so the types can not tell them apart. It is\n\t * not in the JSON form of a rule.\n\t */\n\treadonly domain?: Domain.Any\n}\n\n/** The class of every rule value. */\nexport class Rule extends Data.Class<Shape> {\n\t*[Symbol.iterator](): Generator<this, this, unknown> {\n\t\tyield this\n\t\treturn this\n\t}\n}\n\n/** Makes a rule from its data. It does not check the data against a domain. */\nexport const make = (data: Shape): Rule =>\n\t// A missing option is left out, so two rules with the same data are equal.\n\tnew Rule({\n\t\t_tag: data._tag,\n\t\tactions: [...data.actions],\n\t\tresources: [...data.resources],\n\t\t...(data.when === undefined ? {} : { when: data.when }),\n\t\t...(data.fields === undefined ? {} : { fields: [...data.fields] }),\n\t\t...(data.reason === undefined ? {} : { reason: data.reason }),\n\t\t...(data.id === undefined ? {} : { id: data.id }),\n\t\t...(data.meta === undefined ? {} : { meta: data.meta }),\n\t\t...(data.domain === undefined ? {} : { domain: data.domain }),\n\t})\n\n/**\n * Makes a rule from its data, as `Policy.rule` does. A condition with a\n * predicate is a defect: the types of the predicate tie it to the kinds of\n * the rule of a builder, and the binding can not check it.\n */\nexport const makePlain = (data: Shape): Rule => {\n\tif (data.when !== undefined && Nodes.isNode(data.when) && data.when.opaque) {\n\t\tthrow new Error(\n\t\t\t\"Policy.rule takes no condition with a predicate. Make the rule with Policy.builder.\",\n\t\t)\n\t}\n\treturn make(data)\n}\n\n/** Tests if a value is a rule. */\nexport const isRule = (u: unknown): u is Rule => u instanceof Rule\n\nconst toArray = <A>(value: A | ReadonlyArray<A>): ReadonlyArray<A> =>\n\tArray.isArray(value) ? value : [value as A]\n\nconst kindName = (target: unknown): string =>\n\tResourceData.isResource(target)\n\t\t? ResourceData.descriptor(target).kind\n\t\t: (target as string)\n\n/** The options of a rule from a builder, with no types. */\ninterface Options {\n\treadonly when?: (builder: never) => Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n}\n\nconst fromOptions =\n\t(tag: \"Allow\" | \"Deny\", domain: Domain.Any) =>\n\t(\n\t\taction: string | ReadonlyArray<string>,\n\t\tresource: unknown,\n\t\toptions?: Options,\n\t): Rule =>\n\t\tmake({\n\t\t\t_tag: tag,\n\t\t\tactions: toArray(action),\n\t\t\tresources: Arr.map(toArray(resource), kindName),\n\t\t\t...(options?.when === undefined\n\t\t\t\t? {}\n\t\t\t\t: { when: options.when(Condition.builder() as never) }),\n\t\t\t...(options?.fields === undefined ? {} : { fields: options.fields }),\n\t\t\t...(options?.reason === undefined ? {} : { reason: options.reason }),\n\t\t\t...(options?.id === undefined ? {} : { id: options.id }),\n\t\t\t...(options?.meta === undefined ? {} : { meta: options.meta }),\n\t\t\tdomain,\n\t\t})\n\n/** Makes the rule builder of a domain. */\nexport const builder = (domain: Domain.Any) => ({\n\tallow: fromOptions(\"Allow\", domain),\n\tdeny: fromOptions(\"Deny\", domain),\n})\n\n/**\n * Tests if a field name matches a field name or a field pattern of a rule. A\n * pattern matches the fields below a field that it matches too, so `settings`\n * matches `settings.model`.\n */\nexport const matchesField = (pattern: string, field: string): boolean =>\n\tPatterns.matches(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests if a field pattern may match a field inside `field`, such as\n * `settings.secret` inside `settings`.\n */\nexport const matchesInside = (pattern: string, field: string): boolean =>\n\tPatterns.matchesBelow(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests the parts of a rule that do not need the resource value: the action,\n * the kind and the field.\n *\n * A rule with an empty list of fields covers no request. A rule with fields\n * covers a request with no field only when it is an allow rule. So \"may\n * update some fields\" is a yes. A deny rule for some fields does not stop a\n * request for the whole value. With the `descriptor` of the kind, such an\n * allow rule covers the request only when one of its patterns matches a field\n * of the kind, and a deny rule for a part of a field that holds parts covers\n * a request for the whole field. A grant of fields that the kind does not have is not a grant of\n * some fields.\n */\nexport const matchesTarget = (\n\trule: Shape,\n\ttarget: {\n\t\treadonly action: string\n\t\treadonly kind: string\n\t\treadonly field?: string | undefined\n\t\treadonly descriptor?: Resource.Descriptor | undefined\n\t},\n): boolean => {\n\tif (!rule.actions.includes(\"*\") && !rule.actions.includes(target.action)) {\n\t\treturn false\n\t}\n\tif (!rule.resources.includes(\"*\") && !rule.resources.includes(target.kind)) {\n\t\treturn false\n\t}\n\tif (rule.fields === undefined) {\n\t\treturn true\n\t}\n\t// A rule for no fields is a rule for nothing. A grant with its last field\n\t// taken away must not cover the whole value.\n\tif (rule.fields.length === 0) {\n\t\treturn false\n\t}\n\tif (target.field === undefined) {\n\t\tconst descriptor = target.descriptor\n\t\treturn (\n\t\t\trule._tag === \"Allow\" &&\n\t\t\t(descriptor === undefined ||\n\t\t\t\tArr.some(rule.fields, (pattern) =>\n\t\t\t\t\tPatterns.fitsCatalog(\n\t\t\t\t\t\tPatterns.parseBound(pattern),\n\t\t\t\t\t\tdescriptor.catalog,\n\t\t\t\t\t),\n\t\t\t\t))\n\t\t)\n\t}\n\tconst field = target.field\n\t// A field that holds parts, as a record does, shows its parts too. So a\n\t// deny rule for a part inside it, as `data.secret` inside `data`, also\n\t// covers a request for the whole field.\n\tconst open =\n\t\trule._tag === \"Deny\" &&\n\t\ttarget.descriptor !== undefined &&\n\t\t(Catalog.lookup(target.descriptor.catalog, field)?.open ?? false)\n\treturn rule.fields.some(\n\t\t(pattern) =>\n\t\t\tmatchesField(pattern, field) || (open && matchesInside(pattern, field)),\n\t)\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,IAAa,OAAb,cAA0B,KAAK,MAAa;CAC3C,EAAE,OAAO,YAA4C;EACpD,MAAM;EACN,OAAO;CACR;AACD;;AAGA,MAAa,QAAQ,SAEpB,IAAI,KAAK;CACR,MAAM,KAAK;CACX,SAAS,CAAC,GAAG,KAAK,OAAO;CACzB,WAAW,CAAC,GAAG,KAAK,SAAS;CAC7B,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE;CAChE,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;CAC3D,GAAI,KAAK,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;CAC/C,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAC5D,CAAC;;;;;;AAOF,MAAa,aAAa,SAAsB;CAC/C,IAAI,KAAK,SAAS,KAAA,KAAaA,OAAa,KAAK,IAAI,KAAK,KAAK,KAAK,QACnE,MAAM,IAAI,MACT,qFACD;CAED,OAAO,KAAK,IAAI;AACjB;;AAGA,MAAa,UAAU,MAA0B,aAAa;AAE9D,MAAM,WAAc,UACnB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAU;AAE3C,MAAM,YAAY,WACjBC,WAAwB,MAAM,IAC3BC,WAAwB,MAAM,CAAC,CAAC,OAC/B;AAWL,MAAM,eACJ,KAAuB,YAEvB,QACA,UACA,YAEA,KAAK;CACJ,MAAM;CACN,SAAS,QAAQ,MAAM;CACvB,WAAW,IAAI,IAAI,QAAQ,QAAQ,GAAG,QAAQ;CAC9C,GAAI,SAAS,SAAS,KAAA,IACnB,CAAC,IACD,EAAE,MAAM,QAAQ,KAAKC,UAAkB,CAAU,EAAE;CACtD,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;CACtD,GAAI,SAAS,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;CAC5D;AACD,CAAC;;AAGH,MAAa,WAAW,YAAwB;CAC/C,OAAO,YAAY,SAAS,MAAM;CAClC,MAAM,YAAY,QAAQ,MAAM;AACjC;;;;;;AAOA,MAAa,gBAAgB,SAAiB,UAC7CC,QAAiBC,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;AAMhE,MAAa,iBAAiB,SAAiB,UAC9CC,aAAsBD,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;;;;;;;;;;AAerE,MAAa,iBACZ,MACA,WAMa;CACb,IAAI,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC,KAAK,QAAQ,SAAS,OAAO,MAAM,GACtE,OAAO;CAER,IAAI,CAAC,KAAK,UAAU,SAAS,GAAG,KAAK,CAAC,KAAK,UAAU,SAAS,OAAO,IAAI,GACxE,OAAO;CAER,IAAI,KAAK,WAAW,KAAA,GACnB,OAAO;CAIR,IAAI,KAAK,OAAO,WAAW,GAC1B,OAAO;CAER,IAAI,OAAO,UAAU,KAAA,GAAW;EAC/B,MAAM,aAAa,OAAO;EAC1B,OACC,KAAK,SAAS,YACb,eAAe,KAAA,KACf,IAAI,KAAK,KAAK,SAAS,YACtBE,YACCF,WAAoB,OAAO,GAC3B,WAAW,OACZ,CACD;CAEH;CACA,MAAM,QAAQ,OAAO;CAIrB,MAAM,OACL,KAAK,SAAS,UACd,OAAO,eAAe,KAAA,MACrBG,OAAe,OAAO,WAAW,SAAS,KAAK,CAAC,EAAE,QAAQ;CAC5D,OAAO,KAAK,OAAO,MACjB,YACA,aAAa,SAAS,KAAK,KAAM,QAAQ,cAAc,SAAS,KAAK,CACvE;AACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nmnmcc/ability",
-	"version": "2.0.0",
+	"version": "2.0.2",
 	"description": "Typed, composable authorization policies for Effect programs.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/Condition.ts

@@ -224,32 +224,24 @@ export interface Opaque<out E = never, out R = never> {
 }
 
 /**
- * The error type of the predicates of a mark `X`. A mark that may be
- * anything, as `unknown`, may have any error.
+ * The error type of the predicates of a mark `X`. A mark that is not an
+ * {@link Opaque}, as `unknown` or `object`, may have any error.
  *
  * @stability stable
  * @category utility types
  * @since 2.0.0
  */
-export type ErrorOf<X> = unknown extends X
-	? unknown
-	: X extends Opaque<infer E, infer _R>
-		? E
-		: never
+export type ErrorOf<X> = X extends Opaque<infer E, infer _R> ? E : unknown
 
 /**
- * The service type of the predicates of a mark `X`. A mark that may be
- * anything, as `unknown`, may need any service.
+ * The service type of the predicates of a mark `X`. A mark that is not an
+ * {@link Opaque}, as `unknown` or `object`, may need any service.
  *
  * @stability stable
  * @category utility types
  * @since 2.0.0
  */
-export type ServicesOf<X> = unknown extends X
-	? unknown
-	: X extends Opaque<infer _E, infer R>
-		? R
-		: never
+export type ServicesOf<X> = X extends Opaque<infer _E, infer R> ? R : unknown
 
 /**
  * The mark `X` with no services.
@@ -258,11 +250,8 @@ export type ServicesOf<X> = unknown extends X
  * @category utility types
  * @since 2.0.0
  */
-export type Provided<X> = unknown extends X
-	? Opaque<unknown>
-	: X extends Opaque<infer E, infer _R>
-		? Opaque<E>
-		: never
+export type Provided<X> =
+	X extends Opaque<infer E, infer _R> ? Opaque<E> : Opaque<unknown>
 
 /**
  * What the predicates of a condition read: a resource value of the type `V`
@@ -366,14 +355,15 @@ type FieldPathInternal<
 > = [Depth] extends [never]
 	? never
 	: {
-			[K in keyof T & string]-?: PathsOf<
-				K,
+			// A record with number keys has number keys, as `counts.1`.
+			[K in keyof T & (string | number)]-?: PathsOf<
+				`${K}`,
 				NonNullable<T[K]>,
 				Depth,
 				Arrays,
 				Parents
 			>
-		}[keyof T & string]
+		}[keyof T & (string | number)]
 
 /**
  * The paths of one field `K` with the values `V`. Each kind of value in `V`
@@ -387,8 +377,9 @@ type PathsOf<
 	Arrays extends boolean,
 	Parents extends boolean,
 > =
-	// A field that is only ever `null` or missing is a field too.
-	| ([V] extends [never] ? K : never)
+	// A field that is only ever `null` or missing is a field too, and so is a
+	// field that may hold any value, as one of `Schema.Unknown` may.
+	| ([V] extends [never] ? K : {} extends V ? K : never)
 	| ([Extract<V, Leaf | Whole>] extends [never] ? never : K)
 	| ([Extract<V, ReadonlyArray<unknown>>] extends [never]
 			? never
@@ -419,7 +410,9 @@ type ObjectPaths<
 				: Arrays extends true
 					? string extends keyof O
 						? K
-						: never
+						: number extends keyof O
+							? K
+							: never
 					: never)
 		| `${K}.${FieldPathInternal<O, PreviousDepth[Depth], Arrays, Parents>}`
 

package/src/Policy.ts

@@ -533,14 +533,19 @@ export const builder = <D extends Domain.Any>(domain: D): Builder<D> =>
  * against a domain: a policy does that when the rule goes into it. Use
  * {@link builder} for rules with types, or {@link schema} for rules from JSON.
  *
+ * The condition may not have a predicate. A policy checks the fields of a
+ * condition against the resources of its rule, but it can not check what
+ * the code of a predicate reads. A rule from the builder keeps that in its
+ * types; this one could give a predicate of one kind to another kind.
+ *
  * @stability stable
  * @category constructors
  * @since 2.0.0
  */
-export const rule = <I = unknown, X = never>(
-	data: RuleShape<I, X>,
+export const rule: <I = unknown>(
+	data: RuleShape<I, never>,
 	// The types come from the data only, not from where the rule goes.
-): Rule<any, NoInfer<I>, NoInfer<X>> => RuleData.make(data as never) as never
+) => Rule<any, NoInfer<I>> = RuleData.makePlain as never
 
 /**
  * The options of a list of rules.
@@ -773,8 +778,10 @@ export type ResidualReads<D, K> = Condition.Reads<
 /**
  * Gives the condition on resource values for which the policy allows a
  * request. It has no principal fields and no `Under` nodes, so you can give it
- * to `Condition.fold`. It is `True` when the policy allows every value of the
- * kind, and `False` when it allows none.
+ * to `Condition.fold`. It is made smaller, so it is often `True` or `False`
+ * when the answer does not depend on the value, but it does no search: a
+ * condition that is true for every value may stay a test. To know if the
+ * policy allows every value, or some value, use {@link coverage}.
  *
  * With a scope (`within`), the condition is the scope and the residual
  * together, so it is false for every value outside the scope. Give the policy

package/src/internal/authorizer.ts

@@ -93,19 +93,29 @@ type AnyTarget = {
 
 /**
  * A cache key for a principal. Two keys are equal when they have the same
- * text, so two principals with the same key share one policy. The key also
- * keeps the principal, so the cache can load its policy. A plain `Data` value
- * can not do both, so the key gives its own equality with `Equal.Equal`.
+ * text, so two principals with the same key share one policy. A key from the
+ * JSON form also needs equal decoded principals: a Schema may make data when
+ * it decodes, as `expired` from a time, so one text may give two principals.
+ * The key also keeps the principal, so the cache can load its policy. A plain
+ * `Data` value can not do all this, so the key gives its own equality with
+ * `Equal.Equal`.
  */
 class PrincipalKey implements Equal.Equal {
 	readonly principal: object
 	readonly text: string
-	constructor(principal: object, text: string) {
+	/** The key is the JSON form, so the decoded principals must be equal too. */
+	readonly exact: boolean
+	constructor(principal: object, text: string, exact: boolean) {
 		this.principal = principal
 		this.text = text
+		this.exact = exact
 	}
 	[Equal.symbol](that: unknown): boolean {
-		return that instanceof PrincipalKey && that.text === this.text
+		return (
+			that instanceof PrincipalKey &&
+			that.text === this.text &&
+			(!this.exact || Equal.equals(that.principal, this.principal))
+		)
 	}
 	[Hash.symbol](): number {
 		return Hash.string(this.text)
@@ -160,7 +170,7 @@ const jsonKey = (
 					onFailure: () => undefined,
 					onSuccess: (decoded) =>
 						Equal.equals(decoded, principal)
-							? new PrincipalKey(decoded as object, text)
+							? new PrincipalKey(decoded as object, text, true)
 							: undefined,
 				})
 			},
@@ -226,7 +236,7 @@ export const makeLayer = (
 		const text = custom(principal)
 		return text === undefined
 			? undefined
-			: new PrincipalKey(canonical?.principal ?? principal, text)
+			: new PrincipalKey(canonical?.principal ?? principal, text, false)
 	}
 	return Layer.effect(
 		service,

package/src/internal/bind.ts

@@ -42,11 +42,17 @@ interface Memo {
 	readonly suggestions: MutableHashMap.MutableHashMap<string, string>
 	/** If a pattern matches a field of a kind, by the kind and the pattern. */
 	readonly fits: MutableHashMap.MutableHashMap<string, boolean>
+	/** The count of the issues of conditions so far. It belongs to one binding. */
+	readonly issues: { count: number; noted: boolean }
+	/** The steps of the checks of patterns so far. It belongs to one binding. */
+	readonly work: { steps: number; noted: boolean }
 }
 
 const makeMemo = (): Memo => ({
 	suggestions: MutableHashMap.empty(),
 	fits: MutableHashMap.empty(),
+	issues: { count: 0, noted: false },
+	work: { steps: 0, noted: false },
 })
 
 /**
@@ -183,24 +189,44 @@ const patternIssues = (
 ): ReadonlyArray<Issue> =>
 	Result.match(Patterns.parse(pattern), {
 		onFailure: (issue) => [{ path: at, issue }],
-		onSuccess: (parsed) =>
+		onSuccess: (parsed) => {
 			// A rule with no known resource has an issue for that already.
-			known.length === 0 ||
-			Arr.some(known, (descriptor) => {
-				const key = `${descriptor.kind}\u0000${pattern}`
-				return Option.getOrElse(MutableHashMap.get(memo.fits, key), () => {
-					const fits = Patterns.fitsCatalog(parsed, descriptor.catalog)
-					MutableHashMap.set(memo.fits, key, fits)
-					return fits
+			const fits =
+				known.length === 0 ||
+				Arr.some(known, (descriptor) => {
+					const key = `${descriptor.kind}\u0000${pattern}`
+					return Option.getOrElse(MutableHashMap.get(memo.fits, key), () => {
+						// Each check of a pattern reads the fields of a catalog. The
+						// work of one binding has a limit, so very many patterns stop
+						// with one issue, and the policy does not load.
+						memo.work.steps +=
+							descriptor.catalog.fields.length * Math.max(parsed.length, 1)
+						if (memo.work.steps > Limits.searchSteps) {
+							return true
+						}
+						const found = Patterns.fitsCatalog(parsed, descriptor.catalog)
+						MutableHashMap.set(memo.fits, key, found)
+						return found
+					})
 				})
-			})
+			if (memo.work.steps > Limits.searchSteps && !memo.work.noted) {
+				memo.work.noted = true
+				return [
+					{
+						path: at,
+						issue: `The field patterns of the policy take more than ${String(Limits.searchSteps)} steps to check. The most is ${String(Limits.searchSteps)}.`,
+					},
+				]
+			}
+			return fits
 				? []
 				: [
 						{
 							path: at,
 							issue: `The field pattern "${pattern}" matches no field of the resources of the rule`,
 						},
-					],
+					]
+		},
 	})
 
 /** The fields of the resources that a test of the rule may read. */
@@ -385,6 +411,46 @@ const notWhole = (at: ReadonlyArray<PropertyKey>): Issue => ({
 	issue: "The condition is not a whole condition tree",
 })
 
+/**
+ * The most issues that the walk of the conditions of one binding gives. A
+ * policy may have very many wrong tests, and each issue keeps its path.
+ */
+const maxIssues = 100
+
+/** A path that the walk makes only when it needs it, for an issue. */
+type LazyPath = () => ReadonlyArray<PropertyKey>
+
+/**
+ * Puts the path of a node before the paths of its issues. A walk keeps no
+ * path for a node with no issue, so a deep and wide condition costs little.
+ */
+const under = (
+	memo: Memo,
+	at: LazyPath,
+	issues: ReadonlyArray<Issue>,
+): ReadonlyArray<Issue> => {
+	if (issues.length === 0) {
+		return issues
+	}
+	const room = maxIssues - memo.issues.count
+	memo.issues.count += issues.length
+	const kept = Arr.map(Arr.take(issues, Math.max(room, 0)), (issue) => ({
+		path: [...at(), ...issue.path],
+		issue: issue.issue,
+	}))
+	const first = memo.issues.count > maxIssues && !memo.issues.noted
+	memo.issues.noted ||= first
+	return first
+		? [
+				...kept,
+				{
+					path: [],
+					issue: `The policy has more problems. The first ${String(maxIssues)} are here.`,
+				},
+			]
+		: kept
+}
+
 /**
  * The issues of a condition. The constructors of the nodes checked the shape
  * of each node, so this checks the names and the types against the domain. A
@@ -395,52 +461,61 @@ const notWhole = (at: ReadonlyArray<PropertyKey>): Issue => ({
 const conditionIssues = (
 	context: Context,
 	node: Nodes.Node,
-	at: ReadonlyArray<PropertyKey>,
+	at: LazyPath,
 	seen: Set<Nodes.Node>,
 ): ReadonlyArray<Issue> => {
 	if (seen.has(node)) {
 		return []
 	}
 	seen.add(node)
+	const here = (issues: ReadonlyArray<Issue>) => under(context.memo, at, issues)
 	switch (node._tag) {
 		case "Compare": {
-			const exists = fieldIssue(context, node.field, [...at, "field"])
-			return exists.length > 0
-				? exists
-				: operandIssues(
-						context,
-						node.field,
-						node.op !== "eq" && node.op !== "ne",
-						node.value,
-						[...at, "value"],
-					)
+			const exists = fieldIssue(context, node.field, ["field"])
+			return here(
+				exists.length > 0
+					? exists
+					: operandIssues(
+							context,
+							node.field,
+							node.op !== "eq" && node.op !== "ne",
+							node.value,
+							["value"],
+						),
+			)
 		}
 		case "In": {
-			const exists = fieldIssue(context, node.field, [...at, "field"])
-			return exists.length > 0
-				? exists
-				: Arr.flatMap(node.values, (operand, index) =>
-						operandIssues(context, node.field, false, operand, [
-							...at,
-							"values",
-							index,
-						]),
-					)
+			const exists = fieldIssue(context, node.field, ["field"])
+			return here(
+				exists.length > 0
+					? exists
+					: Arr.flatMap(node.values, (operand, index) =>
+							operandIssues(context, node.field, false, operand, [
+								"values",
+								index,
+							]),
+						),
+			)
 		}
 		case "Exists":
-			return fieldIssue(context, node.field, [...at, "field"])
+			return here(fieldIssue(context, node.field, ["field"]))
 		case "Under":
-			return underIssues(context, node.prefix, at)
+			return here(underIssues(context, node.prefix, []))
 		case "And":
 		case "Or":
 			return Arr.flatMap(node.conditions, (child, index) =>
-				conditionIssues(context, child, [...at, "conditions", index], seen),
+				conditionIssues(
+					context,
+					child,
+					() => [...at(), "conditions", index],
+					seen,
+				),
 			)
 		case "Not":
 			return conditionIssues(
 				context,
 				node.condition,
-				[...at, "condition"],
+				() => [...at(), "condition"],
 				seen,
 			)
 		default:
@@ -529,7 +604,7 @@ export const ruleIssues = (
 		...(rule.when === undefined
 			? []
 			: Nodes.isNode(rule.when)
-				? conditionIssues(context, rule.when, [...at, "when"], new Set())
+				? conditionIssues(context, rule.when, () => [...at, "when"], new Set())
 				: [notWhole([...at, "when"])]),
 	]
 }

package/src/internal/policy-json.ts

@@ -16,6 +16,15 @@ import * as PolicyNodes from "./policy-nodes.ts"
 
 type Node = PolicyNodes.Node
 
+/**
+ * The codec of the `meta` Schema of a domain to and from JSON. The JSON form
+ * of a policy must stay the same through `JSON.stringify` and `JSON.parse`, so
+ * a `Date` in `meta`, for one, becomes a string in it, and a string again
+ * when it is decoded.
+ */
+const metaCodec = (meta: Schema.Top): Schema.Codec<unknown, unknown> =>
+	Schema.toCodecJson(meta) as unknown as Schema.Codec<unknown, unknown>
+
 /** Gives the JSON form of the `meta` of a rule, or `undefined` for none. */
 export type MetaJson = (rule: Rule.Rule) => unknown
 
@@ -29,9 +38,7 @@ export const syncMeta =
 	(rule) =>
 		rule.meta === undefined || meta === undefined
 			? undefined
-			: Schema.encodeUnknownSync(meta as Schema.Codec<unknown, unknown>)(
-					rule.meta,
-				)
+			: Schema.encodeUnknownSync(metaCodec(meta))(rule.meta)
 
 /** The JSON form of the condition of each rule, by the rule. */
 type WhenJson = (rule: Rule.Rule) => unknown
@@ -118,9 +125,7 @@ export const encode = (
 				? []
 				: yield* Effect.forEach(rules, (rule) =>
 						Effect.map(
-							Schema.encodeUnknownEffect(
-								meta as Schema.Codec<unknown, unknown>,
-							)(rule.meta),
+							Schema.encodeUnknownEffect(metaCodec(meta))(rule.meta),
 							(json) => [rule, json] as const,
 						),
 					)
@@ -264,16 +269,14 @@ const decodeMeta = (
 							)
 						}
 						spendValue(value, [...path, "meta"], 1, budget)
-						return { value }
+						return { value, schema: domain.meta }
 					}),
 		),
 		(found) =>
 			found === undefined
 				? Effect.void
 				: Effect.mapError(
-						Schema.decodeUnknownEffect(
-							domain.meta as Schema.Codec<unknown, unknown>,
-						)(found.value),
+						Schema.decodeUnknownEffect(metaCodec(found.schema))(found.value),
 						(error) =>
 							new Json.Problem({
 								path: [...path, "meta"],

package/src/internal/rule.ts

@@ -11,6 +11,7 @@ import * as Condition from "../Condition.ts"
 import type * as Domain from "../Domain.ts"
 import type * as Resource from "../Resource.ts"
 import * as Catalog from "./catalog.ts"
+import * as Nodes from "./nodes.ts"
 import * as ResourceData from "./resource.ts"
 import * as Patterns from "./patterns.ts"
 
@@ -55,6 +56,20 @@ export const make = (data: Shape): Rule =>
 		...(data.domain === undefined ? {} : { domain: data.domain }),
 	})
 
+/**
+ * Makes a rule from its data, as `Policy.rule` does. A condition with a
+ * predicate is a defect: the types of the predicate tie it to the kinds of
+ * the rule of a builder, and the binding can not check it.
+ */
+export const makePlain = (data: Shape): Rule => {
+	if (data.when !== undefined && Nodes.isNode(data.when) && data.when.opaque) {
+		throw new Error(
+			"Policy.rule takes no condition with a predicate. Make the rule with Policy.builder.",
+		)
+	}
+	return make(data)
+}
+
 /** Tests if a value is a rule. */
 export const isRule = (u: unknown): u is Rule => u instanceof Rule