@nmnmcc/ability 2.0.4 → 2.0.6

package/src/internal/bind.ts

@@ -7,7 +7,6 @@
  */
 import * as Arr from "effect/Array"
 import * as HashMap from "effect/HashMap"
-import * as MutableHashMap from "effect/MutableHashMap"
 import * as Option from "effect/Option"
 import * as Result from "effect/Result"
 import type * as Domain from "../Domain.ts"
@@ -39,10 +38,18 @@ export interface RuleData {
  * time. It goes away when the binding ends.
  */
 interface Memo {
-	/** The suggestion for each name, by the place where it was looked for. */
-	readonly suggestions: MutableHashMap.MutableHashMap<string, string>
-	/** If a pattern matches a field of a kind, by the kind and the pattern. */
-	readonly fits: MutableHashMap.MutableHashMap<string, boolean>
+	/**
+	 * The suggestion for each name, by the place where it was looked for. The
+	 * names come from a policy, so the map is native, as `fits` is.
+	 */
+	readonly suggestions: Map<string, string>
+	/**
+	 * If a pattern matches a field of a kind, by the kind and the pattern. The
+	 * patterns come from a policy, so the map is native: the hash of a string
+	 * in Effect has no random seed, and a policy could hold very many
+	 * patterns with one hash. The engine hashes a string with a random seed.
+	 */
+	readonly fits: Map<string, boolean>
 	/** The count of the issues of conditions so far. It belongs to one binding. */
 	readonly issues: { count: number; noted: boolean }
 	/** The steps of the checks of patterns so far. It belongs to one binding. */
@@ -50,8 +57,8 @@ interface Memo {
 }
 
 const makeMemo = (): Memo => ({
-	suggestions: MutableHashMap.empty(),
-	fits: MutableHashMap.empty(),
+	suggestions: new Map(),
+	fits: new Map(),
 	issues: { count: 0, noted: false },
 	work: { steps: 0, noted: false },
 })
@@ -72,15 +79,15 @@ const suggestIn = (
 	names: () => ReadonlyArray<string>,
 ): string => {
 	const key = `${scope}\u0000${name}`
-	const known = MutableHashMap.get(memo.suggestions, key)
-	if (Option.isSome(known)) {
-		return known.value
+	const known = memo.suggestions.get(key)
+	if (known !== undefined) {
+		return known
 	}
-	if (MutableHashMap.size(memo.suggestions) >= maxSuggestions) {
+	if (memo.suggestions.size >= maxSuggestions) {
 		return message
 	}
 	const made = withSuggestion(message, name, names())
-	MutableHashMap.set(memo.suggestions, key, made)
+	memo.suggestions.set(key, made)
 	return made
 }
 
@@ -230,7 +237,7 @@ const patternIssues = (
 				Arr.reduce(known, false, (before, descriptor) => {
 					const key = `${descriptor.kind}\u0000${pattern}`
 					return (
-						Option.getOrElse(MutableHashMap.get(memo.fits, key), () => {
+						Option.getOrElse(Option.fromUndefinedOr(memo.fits.get(key)), () => {
 							// Each check of a pattern reads the fields of a catalog. The
 							// work of one binding has a limit, so very many patterns stop
 							// with one issue, and the policy does not load.
@@ -240,7 +247,7 @@ const patternIssues = (
 								return true
 							}
 							const found = Patterns.fitsCatalog(parsed, descriptor.catalog)
-							MutableHashMap.set(memo.fits, key, found)
+							memo.fits.set(key, found)
 							return found
 						}) || before
 					)
@@ -282,6 +289,14 @@ const principalField = (
 	at: ReadonlyArray<PropertyKey>,
 ): Catalog.Field | Issue => {
 	const found = Catalog.lookup(context.domain.principalCatalog, ref)
+	// A read of the principal that is not plain data is a defect, as a read
+	// of a resource is: see `readIssues`.
+	if (found !== undefined && !found.plain) {
+		return {
+			path: at,
+			issue: `A condition may not read the field "${ref}" of the principal. A value above it may be an object that does not have it as a data field, as a class with a getter, a date or a list. Use a predicate for it.`,
+		}
+	}
 	return found !== undefined
 		? found
 		: {
@@ -577,8 +592,13 @@ export const ruleIssues = (
 	memo: Memo = makeMemo(),
 ): ReadonlyArray<Issue> => {
 	const all = rule.resources.includes("*")
-	// Each kind is checked one time, also when the list names it again.
-	const names = Arr.dedupe(Arr.filter(rule.resources, (kind) => kind !== "*"))
+	// Each kind is checked one time, also when the list names it again. The
+	// names come from a policy, so a native `Set` finds the copies:
+	// `Arr.dedupe` puts the names in groups by the hash of Effect, which has
+	// no random seed, and very many names with one hash make one long group.
+	const names = Array.from(
+		new Set(Arr.filter(rule.resources, (kind) => kind !== "*")),
+	)
 	const kinds = Array.from(HashMap.keys(domain.resources))
 	const named = Arr.flatMap(names, (kind) =>
 		Option.toArray(HashMap.get(domain.resources, kind)),
@@ -599,8 +619,9 @@ export const ruleIssues = (
 			? Arr.filter(known, (descriptor) => hasAction(descriptor, rule.actions))
 			: applicable,
 	}
-	const actions = Arr.dedupe(
-		Arr.flatMap(known, (descriptor) => descriptor.actions),
+	// A native `Set` finds copies about ten times as fast as `Arr.dedupe`.
+	const actions = Array.from(
+		new Set(Arr.flatMap(known, (descriptor) => descriptor.actions)),
 	)
 	return [
 		...Arr.map(

package/src/internal/catalog.ts

@@ -69,7 +69,9 @@ export const joinKinds = (left: Kinds, right: Kinds): Kinds => ({
 			? left.number
 			: right.number,
 	object: left.object || right.object,
-	literals: Arr.dedupe([...left.literals, ...right.literals]),
+	// A native `Set` finds copies about ten times as fast as `Arr.dedupe`. It
+	// takes `0` and `-0` as one, as `includes` does when a test reads them.
+	literals: Array.from(new Set([...left.literals, ...right.literals])),
 })
 
 /** Tests if a number fits the numbers of a field. */
@@ -146,6 +148,12 @@ export interface Branch {
 	readonly field: Field | undefined
 	/** The places below, by name, in the order of the Schema. */
 	readonly children: ReadonlyArray<readonly [string, Branch]>
+	/**
+	 * The places below, by name. A lookup gets each name from `split`, as a
+	 * new string, and a `HashMap` finds a new string about 20% faster than a
+	 * native `Map`. The names come from the Schema, so a name from a policy
+	 * can not make a long list of names with one hash here.
+	 */
 	readonly names: HashMap.HashMap<string, Branch>
 	/** The place for the keys of a record, when the value may be a record. */
 	readonly key: Key | undefined
@@ -361,12 +369,12 @@ const nameOf = (signature: SchemaAST.PropertySignature): string | undefined =>
 /**
  * The properties of a struct by name. A walk makes it one time for each
  * struct of a place, so a struct with very many fields does not take a
- * search for each name.
+ * search for each name. It is a native `Map`, as `Branch.names` is.
  */
 const propertiesOf = (
 	struct: SchemaAST.Objects,
-): HashMap.HashMap<string, SchemaAST.PropertySignature> =>
-	HashMap.fromIterable(
+): ReadonlyMap<string, SchemaAST.PropertySignature> =>
+	new Map(
 		Arr.flatMap(struct.propertySignatures, (signature) => {
 			const name = nameOf(signature)
 			return name === undefined ? [] : [[name, signature] as const]
@@ -377,25 +385,29 @@ const propertiesOf = (
 const namesOf = (
 	structs: ReadonlyArray<SchemaAST.Objects>,
 ): ReadonlyArray<string> =>
-	Arr.dedupe(
-		Arr.flatMap(structs, (struct) =>
-			Arr.flatMap(struct.propertySignatures, (signature) => {
-				const name = nameOf(signature)
-				if (name === undefined) {
-					return []
-				}
-				// A dot in a path is the step into a nested field. A field name with
-				// a dot would make two fields have one path, so it is a defect.
-				if (name.includes(".")) {
-					throw new Error(`A field name may not have a dot: "${name}"`)
-				}
-				// An empty name would make an empty part in a path, such as
-				// `.secret`.
-				if (name === "") {
-					throw new Error("A field name may not be empty")
-				}
-				return [name]
-			}),
+	// A native `Set` keeps the first copy of each name, in order, about ten
+	// times as fast as `Arr.dedupe`.
+	Array.from(
+		new Set(
+			Arr.flatMap(structs, (struct) =>
+				Arr.flatMap(struct.propertySignatures, (signature) => {
+					const name = nameOf(signature)
+					if (name === undefined) {
+						return []
+					}
+					// A dot in a path is the step into a nested field. A field name with
+					// a dot would make two fields have one path, so it is a defect.
+					if (name.includes(".")) {
+						throw new Error(`A field name may not have a dot: "${name}"`)
+					}
+					// An empty name would make an empty part in a path, such as
+					// `.secret`.
+					if (name === "") {
+						throw new Error("A field name may not be empty")
+					}
+					return [name]
+				}),
+			),
 		),
 	)
 
@@ -478,9 +490,10 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 	const structProperties = Arr.map(structs, propertiesOf)
 	const classProperties = Arr.map(classes, propertiesOf)
 	const children = Arr.map(namesOf(structs), (name) => {
-		const properties = Arr.flatMap(structProperties, (named) =>
-			Option.toArray(HashMap.get(named, name)),
-		)
+		const properties = Arr.flatMap(structProperties, (named) => {
+			const property = named.get(name)
+			return property === undefined ? [] : [property]
+		})
 		const below: Place = {
 			path: [...place.path, name],
 			schemas: Arr.flatMap(properties, (property) =>
@@ -500,7 +513,7 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 			plain:
 				place.plain &&
 				!valueKinds.object &&
-				Arr.every(classProperties, (named) => HashMap.has(named, name)),
+				Arr.every(classProperties, (named) => named.has(name)),
 		}
 		return [name, branchOf(below, count)] as const
 	})

package/src/internal/json.ts

@@ -143,15 +143,6 @@ const decodeOperands = (
 		decodeOperand(operand, [...path, name, index]),
 	)
 
-const compareOperators: ReadonlyArray<string> = [
-	"eq",
-	"ne",
-	"lt",
-	"lte",
-	"gt",
-	"gte",
-]
-
 const decodeNode = (
 	input: unknown,
 	path: ReadonlyArray<PropertyKey>,
@@ -199,11 +190,11 @@ const makeNode = (
 			return Nodes.never
 		case "Compare": {
 			const op = readString(input, "op", path)
-			if (!compareOperators.includes(op)) {
+			if (!Nodes.isCompareOperator(op)) {
 				throw problem([...path, "op"], `"${op}" is not a compare operator`)
 			}
 			return new Nodes.Compare({
-				op: op as Nodes.CompareOperator,
+				op,
 				field: readString(input, "field", path),
 				value: decodeOperand(read(input, "value", path), [...path, "value"]),
 			})

package/src/internal/nodes.ts

@@ -21,12 +21,31 @@ import * as Arr from "effect/Array"
 import * as Data from "effect/Data"
 import type * as Effect from "effect/Effect"
 import { hasProperty } from "effect/Predicate"
+import * as Schema from "effect/Schema"
 import * as Limits from "./limits.ts"
 
 /** A value that a condition can compare. */
 export type Scalar = string | number | boolean | null
 
-export type CompareOperator = "eq" | "ne" | "lt" | "lte" | "gt" | "gte"
+/** The operators of a `Compare` test. The decoders read this list too. */
+export const CompareOperator = Schema.Literals([
+	"eq",
+	"ne",
+	"lt",
+	"lte",
+	"gt",
+	"gte",
+])
+
+export type CompareOperator = typeof CompareOperator.Type
+
+/**
+ * Tests if a value is an operator. It reads the list of the Schema with
+ * `includes`: for a short list, this is about twice as fast as
+ * `Schema.is`, and a decoder tests each node of a large input.
+ */
+export const isCompareOperator = (u: unknown): u is CompareOperator =>
+	(CompareOperator.literals as ReadonlyArray<unknown>).includes(u)
 
 /** A fixed value. */
 export interface Literal {
@@ -49,15 +68,6 @@ export const literal = (value: Scalar): Literal => operands.Literal({ value })
 export const principalRef = (path: string): PrincipalRef =>
 	operands.Principal({ path })
 
-const compareOperators: ReadonlyArray<string> = [
-	"eq",
-	"ne",
-	"lt",
-	"lte",
-	"gt",
-	"gte",
-]
-
 /** Tests if a value is a scalar. Any number is one, also `NaN`. */
 export const isScalar = (value: unknown): value is Scalar =>
 	value === null ||
@@ -211,7 +221,7 @@ export class Compare extends Base {
 		readonly field: string
 		readonly value: Operand
 	}) {
-		if (!compareOperators.includes(props.op)) {
+		if (!isCompareOperator(props.op)) {
 			throw new Error(`"${String(props.op)}" is not a compare operator`)
 		}
 		super(

package/src/internal/patterns.ts

@@ -117,9 +117,13 @@ type States = ReadonlyArray<number>
 
 /** Adds the place after each `**`, since a `**` may match no names. */
 const close = (pattern: Pattern, states: States): States =>
-	Arr.dedupe(
-		Arr.flatMap(states, (state) =>
-			pattern[state]?._tag === "Globstar" ? [state, state + 1] : [state],
+	// A native `Set` keeps the first copy of each place, in order. It is
+	// faster than `Arr.dedupe`, and this is on the path of each match.
+	Array.from(
+		new Set(
+			Arr.flatMap(states, (state) =>
+				pattern[state]?._tag === "Globstar" ? [state, state + 1] : [state],
+			),
 		),
 	)
 

package/src/internal/policy-json.ts

@@ -136,13 +136,6 @@ export const encode = (
 		return toJson(node, (rule) => forms.get(rule))
 	})
 
-const algorithms: ReadonlyArray<string> = [
-	"denyOverrides",
-	"permitOverrides",
-	"firstApplicable",
-	"lastApplicable",
-]
-
 /** Reads a list of strings. */
 const readStrings = (
 	input: object,
@@ -374,7 +367,7 @@ const readTree = (
 	switch (tag) {
 		case "Rules": {
 			const algorithm = Json.readString(input, "algorithm", path)
-			if (!algorithms.includes(algorithm)) {
+			if (!PolicyNodes.isAlgorithm(algorithm)) {
 				throw Json.problem(
 					[...path, "algorithm"],
 					`"${algorithm}" is not a combining algorithm`,
@@ -392,7 +385,7 @@ const readTree = (
 				_tag: "Rules",
 				place,
 				size: 1 + found.length,
-				algorithm: algorithm as PolicyNodes.Algorithm,
+				algorithm,
 				rules: found,
 			})
 		}

package/src/internal/policy-nodes.ts

@@ -11,19 +11,27 @@
  */
 import * as Arr from "effect/Array"
 import * as Data from "effect/Data"
+import * as Schema from "effect/Schema"
 import * as Rule from "./rule.ts"
 import * as Limits from "./limits.ts"
 import * as Nodes from "./nodes.ts"
 
-export type Algorithm =
-	"denyOverrides" | "permitOverrides" | "firstApplicable" | "lastApplicable"
-
-const algorithms: ReadonlyArray<string> = [
+/** The combining algorithms of a list of rules. The decoder reads this list too. */
+export const Algorithm = Schema.Literals([
 	"denyOverrides",
 	"permitOverrides",
 	"firstApplicable",
 	"lastApplicable",
-]
+])
+
+export type Algorithm = typeof Algorithm.Type
+
+/**
+ * Tests if a value is a combining algorithm. It reads the list of the Schema
+ * with `includes`, as `Nodes.isCompareOperator` does.
+ */
+export const isAlgorithm = (u: unknown): u is Algorithm =>
+	(Algorithm.literals as ReadonlyArray<unknown>).includes(u)
 
 interface Facts {
 	readonly size: number
@@ -103,7 +111,7 @@ export class Rules extends Base {
 		readonly algorithm: Algorithm
 		readonly rules: ReadonlyArray<Rule.Rule>
 	}) {
-		if (!algorithms.includes(props.algorithm)) {
+		if (!isAlgorithm(props.algorithm)) {
 			throw new Error(
 				`"${String(props.algorithm)}" is not a combining algorithm`,
 			)

package/src/internal/rule.ts

@@ -7,8 +7,6 @@
  */
 import * as Arr from "effect/Array"
 import * as Data from "effect/Data"
-import * as MutableHashMap from "effect/MutableHashMap"
-import * as Option from "effect/Option"
 import * as Condition from "../Condition.ts"
 import type * as Domain from "../Domain.ts"
 import type * as Policy from "../Policy.ts"
@@ -170,13 +168,19 @@ export const matchesInside = (pattern: string, field: string): boolean =>
 export const fitsOf = (
 	catalog: Catalog.Catalog,
 ): ((pattern: string) => boolean) => {
-	const memo = MutableHashMap.empty<string, boolean>()
-	return (pattern) =>
-		Option.getOrElse(MutableHashMap.get(memo, pattern), () => {
-			const found = Patterns.fitsCatalog(Patterns.parseBound(pattern), catalog)
-			MutableHashMap.set(memo, pattern, found)
-			return found
-		})
+	// A native `Map`: the hash of a string in Effect has no random seed, and a
+	// policy could hold very many patterns with one hash. The engine hashes a
+	// string with a random seed.
+	const memo = new Map<string, boolean>()
+	return (pattern) => {
+		const known = memo.get(pattern)
+		if (known !== undefined) {
+			return known
+		}
+		const found = Patterns.fitsCatalog(Patterns.parseBound(pattern), catalog)
+		memo.set(pattern, found)
+		return found
+	}
 }
 
 /**