@nmnmcc/ability 2.0.5 → 2.0.6

package/src/internal/authorizer.ts

@@ -7,11 +7,14 @@
 // language service check for `unknown` in an Effect is off here.
 // @effect-diagnostics anyUnknownInErrorContext:off
 import * as Cache from "effect/Cache"
+import * as Chunk from "effect/Chunk"
 import * as Context from "effect/Context"
 import type * as Duration from "effect/Duration"
 import * as Effect from "effect/Effect"
 import * as Equal from "effect/Equal"
 import * as Hash from "effect/Hash"
+import * as HashMap from "effect/HashMap"
+import * as HashSet from "effect/HashSet"
 import * as Layer from "effect/Layer"
 import * as Result from "effect/Result"
 import * as Schema from "effect/Schema"
@@ -103,18 +106,24 @@ type AnyTarget = {
 class PrincipalKey implements Equal.Equal {
 	readonly principal: object
 	readonly text: string
-	/** The key is the JSON form, so the decoded principals must be equal too. */
-	readonly exact: boolean
-	constructor(principal: object, text: string, exact: boolean) {
+	/**
+	 * The order of the parts of the decoded principal, from {@link orderOf},
+	 * when the key is the JSON form. The decoded principals must be equal
+	 * too, with their parts in the same order. `undefined` for a key from
+	 * `cache.key`.
+	 */
+	readonly order: string | undefined
+	constructor(principal: object, text: string, order: string | undefined) {
 		this.principal = principal
 		this.text = text
-		this.exact = exact
+		this.order = order
 	}
 	[Equal.symbol](that: unknown): boolean {
 		return (
 			that instanceof PrincipalKey &&
 			that.text === this.text &&
-			(!this.exact || Equal.equals(that.principal, this.principal))
+			that.order === this.order &&
+			(this.order === undefined || Equal.equals(that.principal, this.principal))
 		)
 	}
 	[Hash.symbol](): number {
@@ -123,14 +132,36 @@ class PrincipalKey implements Equal.Equal {
 }
 
 /**
- * Makes the cache key of a principal from its JSON form. The key keeps the
- * principal that the Schema decodes from that form, so the loader sees only
- * the data that the key shows. A principal gets no key when it does not
- * encode, or when the decoded value is not `Equal` to it. Two classes, or a
- * string and a number, may have one JSON form, as in a union, and `Equal`
- * tells them apart. So two principals with one key are equal, and the cache
- * can not give one the policy of the other.
+ * The text of the order of the parts of a value: the names of the fields of
+ * each object, and the items of each list, set and map, in the order that a
+ * loop sees them. `Equal` does not see this order, but a loader may read it,
+ * as `Object.values` does. So two keys need the same order too. A scalar has
+ * no parts, and `Equal` compares it.
  */
+const orderOf = (value: unknown): string => {
+	if (typeof value !== "object" || value === null) {
+		return ""
+	}
+	if (Array.isArray(value)) {
+		return `[${value.map(orderOf).join(",")}]`
+	}
+	if (
+		value instanceof Map ||
+		value instanceof Set ||
+		HashMap.isHashMap(value) ||
+		HashSet.isHashSet(value) ||
+		Chunk.isChunk(value)
+	) {
+		return `<${Array.from(value as Iterable<unknown>, orderOf).join(",")}>`
+	}
+	return `{${Object.keys(value)
+		.map(
+			(name) =>
+				`${JSON.stringify(name)}:${orderOf((value as Record<string, unknown>)[name])}`,
+		)
+		.join(",")}}`
+}
+
 /**
  * Gives the JSON codec of a Schema, or `undefined` when the Schema has no JSON
  * form, as a struct with a symbol key has none.
@@ -148,6 +179,17 @@ const jsonCodecOf = (
 	}
 }
 
+/**
+ * Makes the cache key of a principal from its JSON form. The key keeps the
+ * principal that the Schema decodes from that form, so the loader sees only
+ * the data that the key shows. A principal gets no key when it does not
+ * encode, or when the decoded value is not `Equal` to it. Two classes, or a
+ * string and a number, may have one JSON form, as in a union, and `Equal`
+ * tells them apart. A Schema may make data when it decodes, as the order of
+ * the fields of a record, so the key keeps that order too. So two
+ * principals with one key are equal, and the cache can not give one the
+ * policy of the other.
+ */
 const jsonKey = (
 	schema: Schema.Top,
 ): ((principal: object) => PrincipalKey | undefined) => {
@@ -170,7 +212,7 @@ const jsonKey = (
 					onFailure: () => undefined,
 					onSuccess: (decoded) =>
 						Equal.equals(decoded, principal)
-							? new PrincipalKey(decoded as object, text, true)
+							? new PrincipalKey(decoded as object, text, orderOf(decoded))
 							: undefined,
 				})
 			},
@@ -236,7 +278,7 @@ export const makeLayer = (
 		const text = custom(principal)
 		return text === undefined
 			? undefined
-			: new PrincipalKey(canonical?.principal ?? principal, text, false)
+			: new PrincipalKey(canonical?.principal ?? principal, text, undefined)
 	}
 	return Layer.effect(
 		service,

package/src/internal/bind.ts

@@ -7,7 +7,6 @@
  */
 import * as Arr from "effect/Array"
 import * as HashMap from "effect/HashMap"
-import * as MutableHashMap from "effect/MutableHashMap"
 import * as Option from "effect/Option"
 import * as Result from "effect/Result"
 import type * as Domain from "../Domain.ts"
@@ -39,8 +38,11 @@ export interface RuleData {
  * time. It goes away when the binding ends.
  */
 interface Memo {
-	/** The suggestion for each name, by the place where it was looked for. */
-	readonly suggestions: MutableHashMap.MutableHashMap<string, string>
+	/**
+	 * The suggestion for each name, by the place where it was looked for. The
+	 * names come from a policy, so the map is native, as `fits` is.
+	 */
+	readonly suggestions: Map<string, string>
 	/**
 	 * If a pattern matches a field of a kind, by the kind and the pattern. The
 	 * patterns come from a policy, so the map is native: the hash of a string
@@ -55,7 +57,7 @@ interface Memo {
 }
 
 const makeMemo = (): Memo => ({
-	suggestions: MutableHashMap.empty(),
+	suggestions: new Map(),
 	fits: new Map(),
 	issues: { count: 0, noted: false },
 	work: { steps: 0, noted: false },
@@ -77,15 +79,15 @@ const suggestIn = (
 	names: () => ReadonlyArray<string>,
 ): string => {
 	const key = `${scope}\u0000${name}`
-	const known = MutableHashMap.get(memo.suggestions, key)
-	if (Option.isSome(known)) {
-		return known.value
+	const known = memo.suggestions.get(key)
+	if (known !== undefined) {
+		return known
 	}
-	if (MutableHashMap.size(memo.suggestions) >= maxSuggestions) {
+	if (memo.suggestions.size >= maxSuggestions) {
 		return message
 	}
 	const made = withSuggestion(message, name, names())
-	MutableHashMap.set(memo.suggestions, key, made)
+	memo.suggestions.set(key, made)
 	return made
 }
 
@@ -590,9 +592,10 @@ export const ruleIssues = (
 	memo: Memo = makeMemo(),
 ): ReadonlyArray<Issue> => {
 	const all = rule.resources.includes("*")
-	// Each kind is checked one time, also when the list names it again. A
-	// native `Set` finds the copies in one pass: `Arr.dedupe` compares each
-	// name with each name before it, and a stored rule may name very many.
+	// Each kind is checked one time, also when the list names it again. The
+	// names come from a policy, so a native `Set` finds the copies:
+	// `Arr.dedupe` puts the names in groups by the hash of Effect, which has
+	// no random seed, and very many names with one hash make one long group.
 	const names = Array.from(
 		new Set(Arr.filter(rule.resources, (kind) => kind !== "*")),
 	)
@@ -616,8 +619,9 @@ export const ruleIssues = (
 			? Arr.filter(known, (descriptor) => hasAction(descriptor, rule.actions))
 			: applicable,
 	}
-	const actions = Arr.dedupe(
-		Arr.flatMap(known, (descriptor) => descriptor.actions),
+	// A native `Set` finds copies about ten times as fast as `Arr.dedupe`.
+	const actions = Array.from(
+		new Set(Arr.flatMap(known, (descriptor) => descriptor.actions)),
 	)
 	return [
 		...Arr.map(

package/src/internal/catalog.ts

@@ -69,7 +69,9 @@ export const joinKinds = (left: Kinds, right: Kinds): Kinds => ({
 			? left.number
 			: right.number,
 	object: left.object || right.object,
-	literals: Arr.dedupe([...left.literals, ...right.literals]),
+	// A native `Set` finds copies about ten times as fast as `Arr.dedupe`. It
+	// takes `0` and `-0` as one, as `includes` does when a test reads them.
+	literals: Array.from(new Set([...left.literals, ...right.literals])),
 })
 
 /** Tests if a number fits the numbers of a field. */
@@ -146,6 +148,12 @@ export interface Branch {
 	readonly field: Field | undefined
 	/** The places below, by name, in the order of the Schema. */
 	readonly children: ReadonlyArray<readonly [string, Branch]>
+	/**
+	 * The places below, by name. A lookup gets each name from `split`, as a
+	 * new string, and a `HashMap` finds a new string about 20% faster than a
+	 * native `Map`. The names come from the Schema, so a name from a policy
+	 * can not make a long list of names with one hash here.
+	 */
 	readonly names: HashMap.HashMap<string, Branch>
 	/** The place for the keys of a record, when the value may be a record. */
 	readonly key: Key | undefined
@@ -361,12 +369,12 @@ const nameOf = (signature: SchemaAST.PropertySignature): string | undefined =>
 /**
  * The properties of a struct by name. A walk makes it one time for each
  * struct of a place, so a struct with very many fields does not take a
- * search for each name.
+ * search for each name. It is a native `Map`, as `Branch.names` is.
  */
 const propertiesOf = (
 	struct: SchemaAST.Objects,
-): HashMap.HashMap<string, SchemaAST.PropertySignature> =>
-	HashMap.fromIterable(
+): ReadonlyMap<string, SchemaAST.PropertySignature> =>
+	new Map(
 		Arr.flatMap(struct.propertySignatures, (signature) => {
 			const name = nameOf(signature)
 			return name === undefined ? [] : [[name, signature] as const]
@@ -377,25 +385,29 @@ const propertiesOf = (
 const namesOf = (
 	structs: ReadonlyArray<SchemaAST.Objects>,
 ): ReadonlyArray<string> =>
-	Arr.dedupe(
-		Arr.flatMap(structs, (struct) =>
-			Arr.flatMap(struct.propertySignatures, (signature) => {
-				const name = nameOf(signature)
-				if (name === undefined) {
-					return []
-				}
-				// A dot in a path is the step into a nested field. A field name with
-				// a dot would make two fields have one path, so it is a defect.
-				if (name.includes(".")) {
-					throw new Error(`A field name may not have a dot: "${name}"`)
-				}
-				// An empty name would make an empty part in a path, such as
-				// `.secret`.
-				if (name === "") {
-					throw new Error("A field name may not be empty")
-				}
-				return [name]
-			}),
+	// A native `Set` keeps the first copy of each name, in order, about ten
+	// times as fast as `Arr.dedupe`.
+	Array.from(
+		new Set(
+			Arr.flatMap(structs, (struct) =>
+				Arr.flatMap(struct.propertySignatures, (signature) => {
+					const name = nameOf(signature)
+					if (name === undefined) {
+						return []
+					}
+					// A dot in a path is the step into a nested field. A field name with
+					// a dot would make two fields have one path, so it is a defect.
+					if (name.includes(".")) {
+						throw new Error(`A field name may not have a dot: "${name}"`)
+					}
+					// An empty name would make an empty part in a path, such as
+					// `.secret`.
+					if (name === "") {
+						throw new Error("A field name may not be empty")
+					}
+					return [name]
+				}),
+			),
 		),
 	)
 
@@ -478,9 +490,10 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 	const structProperties = Arr.map(structs, propertiesOf)
 	const classProperties = Arr.map(classes, propertiesOf)
 	const children = Arr.map(namesOf(structs), (name) => {
-		const properties = Arr.flatMap(structProperties, (named) =>
-			Option.toArray(HashMap.get(named, name)),
-		)
+		const properties = Arr.flatMap(structProperties, (named) => {
+			const property = named.get(name)
+			return property === undefined ? [] : [property]
+		})
 		const below: Place = {
 			path: [...place.path, name],
 			schemas: Arr.flatMap(properties, (property) =>
@@ -500,7 +513,7 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 			plain:
 				place.plain &&
 				!valueKinds.object &&
-				Arr.every(classProperties, (named) => HashMap.has(named, name)),
+				Arr.every(classProperties, (named) => named.has(name)),
 		}
 		return [name, branchOf(below, count)] as const
 	})

package/src/internal/json.ts

@@ -143,15 +143,6 @@ const decodeOperands = (
 		decodeOperand(operand, [...path, name, index]),
 	)
 
-const compareOperators: ReadonlyArray<string> = [
-	"eq",
-	"ne",
-	"lt",
-	"lte",
-	"gt",
-	"gte",
-]
-
 const decodeNode = (
 	input: unknown,
 	path: ReadonlyArray<PropertyKey>,
@@ -199,11 +190,11 @@ const makeNode = (
 			return Nodes.never
 		case "Compare": {
 			const op = readString(input, "op", path)
-			if (!compareOperators.includes(op)) {
+			if (!Nodes.isCompareOperator(op)) {
 				throw problem([...path, "op"], `"${op}" is not a compare operator`)
 			}
 			return new Nodes.Compare({
-				op: op as Nodes.CompareOperator,
+				op,
 				field: readString(input, "field", path),
 				value: decodeOperand(read(input, "value", path), [...path, "value"]),
 			})

package/src/internal/nodes.ts

@@ -21,12 +21,31 @@ import * as Arr from "effect/Array"
 import * as Data from "effect/Data"
 import type * as Effect from "effect/Effect"
 import { hasProperty } from "effect/Predicate"
+import * as Schema from "effect/Schema"
 import * as Limits from "./limits.ts"
 
 /** A value that a condition can compare. */
 export type Scalar = string | number | boolean | null
 
-export type CompareOperator = "eq" | "ne" | "lt" | "lte" | "gt" | "gte"
+/** The operators of a `Compare` test. The decoders read this list too. */
+export const CompareOperator = Schema.Literals([
+	"eq",
+	"ne",
+	"lt",
+	"lte",
+	"gt",
+	"gte",
+])
+
+export type CompareOperator = typeof CompareOperator.Type
+
+/**
+ * Tests if a value is an operator. It reads the list of the Schema with
+ * `includes`: for a short list, this is about twice as fast as
+ * `Schema.is`, and a decoder tests each node of a large input.
+ */
+export const isCompareOperator = (u: unknown): u is CompareOperator =>
+	(CompareOperator.literals as ReadonlyArray<unknown>).includes(u)
 
 /** A fixed value. */
 export interface Literal {
@@ -49,15 +68,6 @@ export const literal = (value: Scalar): Literal => operands.Literal({ value })
 export const principalRef = (path: string): PrincipalRef =>
 	operands.Principal({ path })
 
-const compareOperators: ReadonlyArray<string> = [
-	"eq",
-	"ne",
-	"lt",
-	"lte",
-	"gt",
-	"gte",
-]
-
 /** Tests if a value is a scalar. Any number is one, also `NaN`. */
 export const isScalar = (value: unknown): value is Scalar =>
 	value === null ||
@@ -211,7 +221,7 @@ export class Compare extends Base {
 		readonly field: string
 		readonly value: Operand
 	}) {
-		if (!compareOperators.includes(props.op)) {
+		if (!isCompareOperator(props.op)) {
 			throw new Error(`"${String(props.op)}" is not a compare operator`)
 		}
 		super(

package/src/internal/patterns.ts

@@ -117,9 +117,13 @@ type States = ReadonlyArray<number>
 
 /** Adds the place after each `**`, since a `**` may match no names. */
 const close = (pattern: Pattern, states: States): States =>
-	Arr.dedupe(
-		Arr.flatMap(states, (state) =>
-			pattern[state]?._tag === "Globstar" ? [state, state + 1] : [state],
+	// A native `Set` keeps the first copy of each place, in order. It is
+	// faster than `Arr.dedupe`, and this is on the path of each match.
+	Array.from(
+		new Set(
+			Arr.flatMap(states, (state) =>
+				pattern[state]?._tag === "Globstar" ? [state, state + 1] : [state],
+			),
 		),
 	)
 

package/src/internal/policy-json.ts

@@ -136,13 +136,6 @@ export const encode = (
 		return toJson(node, (rule) => forms.get(rule))
 	})
 
-const algorithms: ReadonlyArray<string> = [
-	"denyOverrides",
-	"permitOverrides",
-	"firstApplicable",
-	"lastApplicable",
-]
-
 /** Reads a list of strings. */
 const readStrings = (
 	input: object,
@@ -374,7 +367,7 @@ const readTree = (
 	switch (tag) {
 		case "Rules": {
 			const algorithm = Json.readString(input, "algorithm", path)
-			if (!algorithms.includes(algorithm)) {
+			if (!PolicyNodes.isAlgorithm(algorithm)) {
 				throw Json.problem(
 					[...path, "algorithm"],
 					`"${algorithm}" is not a combining algorithm`,
@@ -392,7 +385,7 @@ const readTree = (
 				_tag: "Rules",
 				place,
 				size: 1 + found.length,
-				algorithm: algorithm as PolicyNodes.Algorithm,
+				algorithm,
 				rules: found,
 			})
 		}

package/src/internal/policy-nodes.ts

@@ -11,19 +11,27 @@
  */
 import * as Arr from "effect/Array"
 import * as Data from "effect/Data"
+import * as Schema from "effect/Schema"
 import * as Rule from "./rule.ts"
 import * as Limits from "./limits.ts"
 import * as Nodes from "./nodes.ts"
 
-export type Algorithm =
-	"denyOverrides" | "permitOverrides" | "firstApplicable" | "lastApplicable"
-
-const algorithms: ReadonlyArray<string> = [
+/** The combining algorithms of a list of rules. The decoder reads this list too. */
+export const Algorithm = Schema.Literals([
 	"denyOverrides",
 	"permitOverrides",
 	"firstApplicable",
 	"lastApplicable",
-]
+])
+
+export type Algorithm = typeof Algorithm.Type
+
+/**
+ * Tests if a value is a combining algorithm. It reads the list of the Schema
+ * with `includes`, as `Nodes.isCompareOperator` does.
+ */
+export const isAlgorithm = (u: unknown): u is Algorithm =>
+	(Algorithm.literals as ReadonlyArray<unknown>).includes(u)
 
 interface Facts {
 	readonly size: number
@@ -103,7 +111,7 @@ export class Rules extends Base {
 		readonly algorithm: Algorithm
 		readonly rules: ReadonlyArray<Rule.Rule>
 	}) {
-		if (!algorithms.includes(props.algorithm)) {
+		if (!isAlgorithm(props.algorithm)) {
 			throw new Error(
 				`"${String(props.algorithm)}" is not a combining algorithm`,
 			)

package/src/internal/search.ts

@@ -196,12 +196,13 @@ interface Search {
 	 */
 	readonly members: Map<Nodes.In, Set<string>>
 	/**
-	 * The texts of the structure of the conditions that the search found to be
-	 * unsatisfiable. A condition with the same structure has the same free
-	 * fields, so its answer is the same. The set only grows, so the steps of a
-	 * search may share it. It is a native `Set`, as in {@link dedupeCells}.
+	 * The keys of the conditions that the search found to be unsatisfiable:
+	 * see `Algebra.keyOf`. A condition with the same structure has the same
+	 * free fields, so its answer is the same. The set only grows, so the steps
+	 * of a search may share it. It is a native `Set`, as in
+	 * {@link dedupeCells}.
 	 */
-	readonly failed: Set<string>
+	readonly failed: Set<string | Node>
 	readonly budget: number
 }
 
@@ -364,10 +365,12 @@ const searchNode = (
 	if (node._tag === "False") {
 		return { assignment: Option.none(), state }
 	}
-	// The text reads all of the node. The step before counted the size of a
-	// larger node, so the budget counts this work too.
-	const text = Algebra.structureText(node)
-	if (search.failed.has(text)) {
+	// The key reads at most a small part of the node: a node with very many
+	// nodes, or with very many values in its `In` tests, is its own key. A
+	// step reads the nodes but not the values, which `membersOf` keeps, so the
+	// budget counts the size.
+	const key = Algebra.keyOf(node)
+	if (search.failed.has(key)) {
 		return { assignment: Option.none(), state }
 	}
 	if (state.steps + node.size > search.budget) {
@@ -400,7 +403,7 @@ const searchNode = (
 		},
 	)
 	if (Option.isNone(result.assignment)) {
-		search.failed.add(text)
+		search.failed.add(key)
 	}
 	return result
 }