@nmnmcc/ability 2.0.1 → 2.0.4

package/src/internal/rule.ts

@@ -7,8 +7,11 @@
  */
 import * as Arr from "effect/Array"
 import * as Data from "effect/Data"
+import * as MutableHashMap from "effect/MutableHashMap"
+import * as Option from "effect/Option"
 import * as Condition from "../Condition.ts"
 import type * as Domain from "../Domain.ts"
+import type * as Policy from "../Policy.ts"
 import type * as Resource from "../Resource.ts"
 import * as Catalog from "./catalog.ts"
 import * as Nodes from "./nodes.ts"
@@ -33,17 +36,42 @@ export interface Shape {
 	readonly domain?: Domain.Any
 }
 
-/** The class of every rule value. */
-export class Rule extends Data.Class<Shape> {
-	*[Symbol.iterator](): Generator<this, this, unknown> {
+/**
+ * The class of every rule value. The types are those of `Policy.Rule`: `D` is
+ * the domain, `I` is what the tests of the condition read, and `X` is the
+ * mark of the condition. With no types, as in the nodes of a policy, a rule
+ * fits no domain, its condition fits no other rule, and it may have a
+ * predicate.
+ */
+export class Rule<D = never, I = never, X = unknown> extends Data.Class<
+	Policy.RuleShape<I, X>
+> {
+	/** Only in the types. */
+	declare readonly "~Opaque": () => X
+	/** Only in the types. */
+	declare readonly "~Domain": (domain: D) => D
+	// A private field makes the type of a rule its own, as for a policy: a
+	// spread of a rule, or an object made by hand, is not a rule. `Equal` does
+	// not read it. It comes last, so its `;` stays: the generator method below
+	// needs one after a field. Node.js takes the `declare` fields out of the
+	// code, and a `;` after one of them would go with it.
+	readonly #rule = true;
+
+	*[Symbol.iterator](): Generator<Rule<D, I, X>, Rule<D, I, X>, unknown> {
 		yield this
 		return this
 	}
+
+	/** Tests if a value is a rule, by its private field. */
+	static is(u: unknown): u is Rule {
+		return typeof u === "object" && u !== null && #rule in u
+	}
 }
 
 /** Makes a rule from its data. It does not check the data against a domain. */
 export const make = (data: Shape): Rule =>
 	// A missing option is left out, so two rules with the same data are equal.
+	// The data has no types here, as the code below works with no types.
 	new Rule({
 		_tag: data._tag,
 		actions: [...data.actions],
@@ -54,7 +82,7 @@ export const make = (data: Shape): Rule =>
 		...(data.id === undefined ? {} : { id: data.id }),
 		...(data.meta === undefined ? {} : { meta: data.meta }),
 		...(data.domain === undefined ? {} : { domain: data.domain }),
-	})
+	} as never)
 
 /**
  * Makes a rule from its data, as `Policy.rule` does. A condition with a
@@ -71,7 +99,7 @@ export const makePlain = (data: Shape): Rule => {
 }
 
 /** Tests if a value is a rule. */
-export const isRule = (u: unknown): u is Rule => u instanceof Rule
+export const isRule = (u: unknown): u is Rule => Rule.is(u)
 
 const toArray = <A>(value: A | ReadonlyArray<A>): ReadonlyArray<A> =>
 	Array.isArray(value) ? value : [value as A]
@@ -132,6 +160,25 @@ export const matchesField = (pattern: string, field: string): boolean =>
 export const matchesInside = (pattern: string, field: string): boolean =>
 	Patterns.matchesBelow(Patterns.parseBound(pattern), field.split("."))
 
+/**
+ * Makes the test "a field pattern matches some field of the catalog" for one
+ * walk, such as one decision. A policy may name one pattern very many times,
+ * so the test keeps each answer by the text of the pattern, and the memo goes
+ * away when the walk ends. The binding puts a limit on the work of the
+ * patterns of a policy on each kind, so one walk does at most that work.
+ */
+export const fitsOf = (
+	catalog: Catalog.Catalog,
+): ((pattern: string) => boolean) => {
+	const memo = MutableHashMap.empty<string, boolean>()
+	return (pattern) =>
+		Option.getOrElse(MutableHashMap.get(memo, pattern), () => {
+			const found = Patterns.fitsCatalog(Patterns.parseBound(pattern), catalog)
+			MutableHashMap.set(memo, pattern, found)
+			return found
+		})
+}
+
 /**
  * Tests the parts of a rule that do not need the resource value: the action,
  * the kind and the field.
@@ -152,6 +199,8 @@ export const matchesTarget = (
 		readonly kind: string
 		readonly field?: string | undefined
 		readonly descriptor?: Resource.Descriptor | undefined
+		/** The test of {@link fitsOf} for the catalog of the descriptor. */
+		readonly fits?: ((pattern: string) => boolean) | undefined
 	},
 ): boolean => {
 	if (!rule.actions.includes("*") && !rule.actions.includes(target.action)) {
@@ -173,12 +222,7 @@ export const matchesTarget = (
 		return (
 			rule._tag === "Allow" &&
 			(descriptor === undefined ||
-				Arr.some(rule.fields, (pattern) =>
-					Patterns.fitsCatalog(
-						Patterns.parseBound(pattern),
-						descriptor.catalog,
-					),
-				))
+				Arr.some(rule.fields, target.fits ?? fitsOf(descriptor.catalog)))
 		)
 	}
 	const field = target.field