@nmnmcc/ability 2.0.5 → 2.0.7

package/src/internal/authorizer.ts

@@ -7,11 +7,14 @@
 // language service check for `unknown` in an Effect is off here.
 // @effect-diagnostics anyUnknownInErrorContext:off
 import * as Cache from "effect/Cache"
+import * as Chunk from "effect/Chunk"
 import * as Context from "effect/Context"
 import type * as Duration from "effect/Duration"
 import * as Effect from "effect/Effect"
 import * as Equal from "effect/Equal"
 import * as Hash from "effect/Hash"
+import * as HashMap from "effect/HashMap"
+import * as HashSet from "effect/HashSet"
 import * as Layer from "effect/Layer"
 import * as Result from "effect/Result"
 import * as Schema from "effect/Schema"
@@ -103,18 +106,24 @@ type AnyTarget = {
 class PrincipalKey implements Equal.Equal {
 	readonly principal: object
 	readonly text: string
-	/** The key is the JSON form, so the decoded principals must be equal too. */
-	readonly exact: boolean
-	constructor(principal: object, text: string, exact: boolean) {
+	/**
+	 * The order of the parts of the decoded principal, from {@link orderOf},
+	 * when the key is the JSON form. The decoded principals must be equal
+	 * too, with their parts in the same order. `undefined` for a key from
+	 * `cache.key`.
+	 */
+	readonly order: string | undefined
+	constructor(principal: object, text: string, order: string | undefined) {
 		this.principal = principal
 		this.text = text
-		this.exact = exact
+		this.order = order
 	}
 	[Equal.symbol](that: unknown): boolean {
 		return (
 			that instanceof PrincipalKey &&
 			that.text === this.text &&
-			(!this.exact || Equal.equals(that.principal, this.principal))
+			that.order === this.order &&
+			(this.order === undefined || Equal.equals(that.principal, this.principal))
 		)
 	}
 	[Hash.symbol](): number {
@@ -123,14 +132,39 @@ class PrincipalKey implements Equal.Equal {
 }
 
 /**
- * Makes the cache key of a principal from its JSON form. The key keeps the
- * principal that the Schema decodes from that form, so the loader sees only
- * the data that the key shows. A principal gets no key when it does not
- * encode, or when the decoded value is not `Equal` to it. Two classes, or a
- * string and a number, may have one JSON form, as in a union, and `Equal`
- * tells them apart. So two principals with one key are equal, and the cache
- * can not give one the policy of the other.
+ * The text of the order of the parts of a value: the names of the fields of
+ * each object, and the items of each list, set and map, with each scalar, in
+ * the order that a loop sees them. `Equal` does not see the order of the
+ * fields of an object or of the items of a map, but a loader may read it, as
+ * `Object.values` does. So two keys need the same order too. A scalar is in
+ * the text with its type, so the items of a set or a map show their order.
  */
+const orderOf = (value: unknown): string => {
+	if (typeof value !== "object" || value === null) {
+		return typeof value === "string"
+			? JSON.stringify(value)
+			: `${typeof value}:${String(value)}`
+	}
+	if (Array.isArray(value)) {
+		return `[${value.map(orderOf).join(",")}]`
+	}
+	if (
+		value instanceof Map ||
+		value instanceof Set ||
+		HashMap.isHashMap(value) ||
+		HashSet.isHashSet(value) ||
+		Chunk.isChunk(value)
+	) {
+		return `<${Array.from(value as Iterable<unknown>, orderOf).join(",")}>`
+	}
+	return `{${Object.keys(value)
+		.map(
+			(name) =>
+				`${JSON.stringify(name)}:${orderOf((value as Record<string, unknown>)[name])}`,
+		)
+		.join(",")}}`
+}
+
 /**
  * Gives the JSON codec of a Schema, or `undefined` when the Schema has no JSON
  * form, as a struct with a symbol key has none.
@@ -148,6 +182,17 @@ const jsonCodecOf = (
 	}
 }
 
+/**
+ * Makes the cache key of a principal from its JSON form. The key keeps the
+ * principal that the Schema decodes from that form, so the loader sees only
+ * the data that the key shows. A principal gets no key when it does not
+ * encode, or when the decoded value is not `Equal` to it. Two classes, or a
+ * string and a number, may have one JSON form, as in a union, and `Equal`
+ * tells them apart. A Schema may make data when it decodes, as the order of
+ * the fields of a record, so the key keeps that order too. So two
+ * principals with one key are equal, and the cache can not give one the
+ * policy of the other.
+ */
 const jsonKey = (
 	schema: Schema.Top,
 ): ((principal: object) => PrincipalKey | undefined) => {
@@ -170,7 +215,7 @@ const jsonKey = (
 					onFailure: () => undefined,
 					onSuccess: (decoded) =>
 						Equal.equals(decoded, principal)
-							? new PrincipalKey(decoded as object, text, true)
+							? new PrincipalKey(decoded as object, text, orderOf(decoded))
 							: undefined,
 				})
 			},
@@ -236,7 +281,7 @@ export const makeLayer = (
 		const text = custom(principal)
 		return text === undefined
 			? undefined
-			: new PrincipalKey(canonical?.principal ?? principal, text, false)
+			: new PrincipalKey(canonical?.principal ?? principal, text, undefined)
 	}
 	return Layer.effect(
 		service,

package/src/internal/bind.ts

@@ -7,7 +7,6 @@
  */
 import * as Arr from "effect/Array"
 import * as HashMap from "effect/HashMap"
-import * as MutableHashMap from "effect/MutableHashMap"
 import * as Option from "effect/Option"
 import * as Result from "effect/Result"
 import type * as Domain from "../Domain.ts"
@@ -39,8 +38,11 @@ export interface RuleData {
  * time. It goes away when the binding ends.
  */
 interface Memo {
-	/** The suggestion for each name, by the place where it was looked for. */
-	readonly suggestions: MutableHashMap.MutableHashMap<string, string>
+	/**
+	 * The suggestion for each name, by the place where it was looked for. The
+	 * names come from a policy, so the map is native, as `fits` is.
+	 */
+	readonly suggestions: Map<string, string>
 	/**
 	 * If a pattern matches a field of a kind, by the kind and the pattern. The
 	 * patterns come from a policy, so the map is native: the hash of a string
@@ -55,7 +57,7 @@ interface Memo {
 }
 
 const makeMemo = (): Memo => ({
-	suggestions: MutableHashMap.empty(),
+	suggestions: new Map(),
 	fits: new Map(),
 	issues: { count: 0, noted: false },
 	work: { steps: 0, noted: false },
@@ -77,15 +79,15 @@ const suggestIn = (
 	names: () => ReadonlyArray<string>,
 ): string => {
 	const key = `${scope}\u0000${name}`
-	const known = MutableHashMap.get(memo.suggestions, key)
-	if (Option.isSome(known)) {
-		return known.value
+	const known = memo.suggestions.get(key)
+	if (known !== undefined) {
+		return known
 	}
-	if (MutableHashMap.size(memo.suggestions) >= maxSuggestions) {
+	if (memo.suggestions.size >= maxSuggestions) {
 		return message
 	}
 	const made = withSuggestion(message, name, names())
-	MutableHashMap.set(memo.suggestions, key, made)
+	memo.suggestions.set(key, made)
 	return made
 }
 
@@ -250,16 +252,8 @@ const patternIssues = (
 						}) || before
 					)
 				})
-			if (memo.work.steps > Limits.searchSteps && !memo.work.noted) {
-				memo.work.noted = true
-				return [
-					{
-						path: at,
-						issue: `The field patterns of the policy take more than ${String(Limits.searchSteps)} steps to check. The most is ${String(Limits.searchSteps)}.`,
-					},
-				]
-			}
-			return fits
+			// Past the limit of the work, `ruleIssues` gives one issue for it.
+			return fits || memo.work.steps > Limits.searchSteps
 				? []
 				: [
 						{
@@ -312,15 +306,45 @@ const principalField = (
 const isIssue = (value: Catalog.Field | Issue): value is Issue =>
 	"issue" in value
 
-/** The issues of one operand of a test of a field. */
+/**
+ * The fields that a test reads, with one field for each distinct kind of
+ * value. A rule for very many kinds may have one field type in all of them,
+ * so each value of the test is checked one time for each distinct kind, not
+ * one time for each resource. The kinds are found by their text in a native
+ * `Map`, which belongs to this call.
+ */
+const distinctFields = (
+	context: Context,
+	field: string,
+): ReadonlyArray<Catalog.Field> =>
+	Array.from(
+		new Map(
+			Arr.map(
+				fieldsAt(context, field),
+				(found) => [JSON.stringify(found.kinds), found] as const,
+			),
+		).values(),
+	)
+
+/**
+ * Counts the work of the checks of the values of a test, as the work of the
+ * field patterns counts. Past the limit, the values are not checked, and
+ * `ruleIssues` gives one issue for the work.
+ */
+const spendChecks = (memo: Memo, values: number, fields: number): boolean => {
+	memo.work.steps += values * Math.max(fields, 1)
+	return memo.work.steps <= Limits.searchSteps
+}
+
+/** The issues of one operand of a test of a field, with its distinct fields. */
 const operandIssues = (
 	context: Context,
 	field: string,
+	fields: ReadonlyArray<Catalog.Field>,
 	ordered: boolean,
 	operand: Operand,
 	at: ReadonlyArray<PropertyKey>,
 ): ReadonlyArray<Issue> => {
-	const fields = fieldsAt(context, field)
 	if (operand._tag === "Literal") {
 		const value = operand.value
 		if (ordered && typeof value !== "string" && typeof value !== "number") {
@@ -518,8 +542,17 @@ const conditionIssues = (
 	}
 	seen.add(node)
 	const here = (issues: ReadonlyArray<Issue>) => under(context.memo, at, issues)
+	// A test looks its field up in each resource of the rule. A rule for very
+	// many kinds with very many tests is very much work, so it counts. Past
+	// the limit, `ruleIssues` gives one issue for it, and the policy does not
+	// load.
+	const room = (values: number) =>
+		spendChecks(context.memo, 1 + values, context.named.length)
 	switch (node._tag) {
 		case "Compare": {
+			if (!room(1)) {
+				return []
+			}
 			const exists = readIssues(context, node.field, ["field"])
 			return here(
 				exists.length > 0
@@ -527,6 +560,7 @@ const conditionIssues = (
 					: operandIssues(
 							context,
 							node.field,
+							distinctFields(context, node.field),
 							node.op !== "eq" && node.op !== "ne",
 							node.value,
 							["value"],
@@ -534,20 +568,28 @@ const conditionIssues = (
 			)
 		}
 		case "In": {
+			if (!room(0)) {
+				return []
+			}
 			const exists = readIssues(context, node.field, ["field"])
+			if (exists.length > 0) {
+				return here(exists)
+			}
+			const fields = distinctFields(context, node.field)
+			if (!spendChecks(context.memo, node.values.length, fields.length)) {
+				return []
+			}
 			return here(
-				exists.length > 0
-					? exists
-					: Arr.flatMap(node.values, (operand, index) =>
-							operandIssues(context, node.field, false, operand, [
-								"values",
-								index,
-							]),
-						),
+				Arr.flatMap(node.values, (operand, index) =>
+					operandIssues(context, node.field, fields, false, operand, [
+						"values",
+						index,
+					]),
+				),
 			)
 		}
 		case "Exists":
-			return here(readIssues(context, node.field, ["field"]))
+			return room(0) ? here(readIssues(context, node.field, ["field"])) : []
 		case "Under":
 			return here(underIssues(context, node.prefix, []))
 		case "And":
@@ -580,19 +622,23 @@ const hasAction = (
 	Arr.some(actions, (action) => descriptor.actions.includes(action))
 
 /**
- * Checks one rule against a domain. It gives one issue for each problem. `at`
- * is the path of the rule, for the paths of the issues.
+ * Checks one rule against a domain. It gives one issue for each problem, up
+ * to the most issues of the binding. `at` gives the path of the rule, and it
+ * is made only for an issue that the binding keeps: a rule with very many
+ * problems deep in a tree does not make a full path for each one.
  */
 export const ruleIssues = (
 	domain: Domain.Any,
 	rule: RuleData,
-	at: ReadonlyArray<PropertyKey>,
+	at: LazyPath,
 	memo: Memo = makeMemo(),
 ): ReadonlyArray<Issue> => {
+	const here = (issues: ReadonlyArray<Issue>) => under(memo, at, issues)
 	const all = rule.resources.includes("*")
-	// Each kind is checked one time, also when the list names it again. A
-	// native `Set` finds the copies in one pass: `Arr.dedupe` compares each
-	// name with each name before it, and a stored rule may name very many.
+	// Each kind is checked one time, also when the list names it again. The
+	// names come from a policy, so a native `Set` finds the copies:
+	// `Arr.dedupe` puts the names in groups by the hash of Effect, which has
+	// no random seed, and very many names with one hash make one long group.
 	const names = Array.from(
 		new Set(Arr.filter(rule.resources, (kind) => kind !== "*")),
 	)
@@ -616,49 +662,81 @@ export const ruleIssues = (
 			? Arr.filter(known, (descriptor) => hasAction(descriptor, rule.actions))
 			: applicable,
 	}
-	const actions = Arr.dedupe(
-		Arr.flatMap(known, (descriptor) => descriptor.actions),
+	// A native `Set` finds copies about ten times as fast as `Arr.dedupe`.
+	const actions = Array.from(
+		new Set(Arr.flatMap(known, (descriptor) => descriptor.actions)),
 	)
+	const fieldIssues = Arr.flatMap(rule.fields ?? [], (field, index) =>
+		here(
+			field.includes("*")
+				? patternIssues(memo, known, field, ["fields", index])
+				: fieldIssue(context, field, ["fields", index]),
+		),
+	)
+	const whenIssues =
+		rule.when === undefined
+			? []
+			: Nodes.isNode(rule.when)
+				? conditionIssues(
+						context,
+						rule.when,
+						() => [...at(), "when"],
+						new Set(),
+					)
+				: here([notWhole(["when"])])
+	// The work is known only after every check of the rule. Past the limit, a
+	// check gives no issue, so this issue must come, or the policy would load
+	// with checks left out.
+	const work = memo.work.steps > Limits.searchSteps && !memo.work.noted
+	memo.work.noted ||= work
 	return [
-		...Arr.map(
+		...Arr.flatMap(
 			Arr.filter(names, (kind) => !HashMap.has(domain.resources, kind)),
-			(kind): Issue => ({
-				path: [...at, "resources"],
-				issue: suggestIn(
-					memo,
-					`There is no resource with the kind "${kind}"`,
-					kind,
-					"~kinds",
-					() => kinds,
-				),
-			}),
+			(kind: string) =>
+				here([
+					{
+						path: ["resources"],
+						issue: suggestIn(
+							memo,
+							`There is no resource with the kind "${kind}"`,
+							kind,
+							"~kinds",
+							() => kinds,
+						),
+					},
+				]),
 		),
-		...Arr.map(
+		...Arr.flatMap(
 			Arr.filter(
 				rule.actions,
 				(action) => action !== "*" && !actions.includes(action),
 			),
-			(action): Issue => ({
-				path: [...at, "actions"],
-				issue: suggestIn(
-					memo,
-					`The action "${action}" is not an action of these resources`,
-					action,
-					`~actions\u0000${names.join(",")}`,
-					() => actions,
-				),
-			}),
-		),
-		...Arr.flatMap(rule.fields ?? [], (field, index) =>
-			field.includes("*")
-				? patternIssues(memo, known, field, [...at, "fields", index])
-				: fieldIssue(context, field, [...at, "fields", index]),
+			(action: string) =>
+				here([
+					{
+						path: ["actions"],
+						issue: suggestIn(
+							memo,
+							`The action "${action}" is not an action of these resources`,
+							action,
+							`~actions\u0000${names.join(",")}`,
+							() => actions,
+						),
+					},
+				]),
 		),
-		...(rule.when === undefined
-			? []
-			: Nodes.isNode(rule.when)
-				? conditionIssues(context, rule.when, () => [...at, "when"], new Set())
-				: [notWhole([...at, "when"])]),
+		...fieldIssues,
+		...whenIssues,
+		// The issue of the work is not one of the most issues of the binding,
+		// so a policy past the limit always says why.
+		...(work
+			? [
+					{
+						path: at(),
+						issue: `The policy takes more than ${String(Limits.searchSteps)} steps to check: its field patterns, and the fields and values of its tests on each resource. The most is ${String(Limits.searchSteps)}.`,
+					},
+				]
+			: []),
 	]
 }
 
@@ -721,7 +799,7 @@ export const treeIssues = (
 	const memo = makeMemo()
 	return Arr.flatMap(rulesOf(root, undefined, 1), (found) =>
 		Array.isArray(found)
-			? ruleIssues(domain, found[0], Place.pathOf(found[1]), memo)
+			? ruleIssues(domain, found[0], () => Place.pathOf(found[1]), memo)
 			: [found as Issue],
 	)
 }

package/src/internal/catalog.ts

@@ -69,7 +69,9 @@ export const joinKinds = (left: Kinds, right: Kinds): Kinds => ({
 			? left.number
 			: right.number,
 	object: left.object || right.object,
-	literals: Arr.dedupe([...left.literals, ...right.literals]),
+	// A native `Set` finds copies about ten times as fast as `Arr.dedupe`. It
+	// takes `0` and `-0` as one, as `includes` does when a test reads them.
+	literals: Array.from(new Set([...left.literals, ...right.literals])),
 })
 
 /** Tests if a number fits the numbers of a field. */
@@ -146,6 +148,12 @@ export interface Branch {
 	readonly field: Field | undefined
 	/** The places below, by name, in the order of the Schema. */
 	readonly children: ReadonlyArray<readonly [string, Branch]>
+	/**
+	 * The places below, by name. A lookup gets each name from `split`, as a
+	 * new string, and a `HashMap` finds a new string about 20% faster than a
+	 * native `Map`. The names come from the Schema, so a name from a policy
+	 * can not make a long list of names with one hash here.
+	 */
 	readonly names: HashMap.HashMap<string, Branch>
 	/** The place for the keys of a record, when the value may be a record. */
 	readonly key: Key | undefined
@@ -361,12 +369,12 @@ const nameOf = (signature: SchemaAST.PropertySignature): string | undefined =>
 /**
  * The properties of a struct by name. A walk makes it one time for each
  * struct of a place, so a struct with very many fields does not take a
- * search for each name.
+ * search for each name. It is a native `Map`, as `Branch.names` is.
  */
 const propertiesOf = (
 	struct: SchemaAST.Objects,
-): HashMap.HashMap<string, SchemaAST.PropertySignature> =>
-	HashMap.fromIterable(
+): ReadonlyMap<string, SchemaAST.PropertySignature> =>
+	new Map(
 		Arr.flatMap(struct.propertySignatures, (signature) => {
 			const name = nameOf(signature)
 			return name === undefined ? [] : [[name, signature] as const]
@@ -377,25 +385,29 @@ const propertiesOf = (
 const namesOf = (
 	structs: ReadonlyArray<SchemaAST.Objects>,
 ): ReadonlyArray<string> =>
-	Arr.dedupe(
-		Arr.flatMap(structs, (struct) =>
-			Arr.flatMap(struct.propertySignatures, (signature) => {
-				const name = nameOf(signature)
-				if (name === undefined) {
-					return []
-				}
-				// A dot in a path is the step into a nested field. A field name with
-				// a dot would make two fields have one path, so it is a defect.
-				if (name.includes(".")) {
-					throw new Error(`A field name may not have a dot: "${name}"`)
-				}
-				// An empty name would make an empty part in a path, such as
-				// `.secret`.
-				if (name === "") {
-					throw new Error("A field name may not be empty")
-				}
-				return [name]
-			}),
+	// A native `Set` keeps the first copy of each name, in order, about ten
+	// times as fast as `Arr.dedupe`.
+	Array.from(
+		new Set(
+			Arr.flatMap(structs, (struct) =>
+				Arr.flatMap(struct.propertySignatures, (signature) => {
+					const name = nameOf(signature)
+					if (name === undefined) {
+						return []
+					}
+					// A dot in a path is the step into a nested field. A field name with
+					// a dot would make two fields have one path, so it is a defect.
+					if (name.includes(".")) {
+						throw new Error(`A field name may not have a dot: "${name}"`)
+					}
+					// An empty name would make an empty part in a path, such as
+					// `.secret`.
+					if (name === "") {
+						throw new Error("A field name may not be empty")
+					}
+					return [name]
+				}),
+			),
 		),
 	)
 
@@ -406,15 +418,6 @@ const namesOf = (
  */
 const branchOf = (place: Place, count: { size: number }): Branch => {
 	const structs = Arr.filter(Arr.map(place.schemas, structOf), isStruct)
-	// The structs of classes. A value of a class is not copied into a plain
-	// object, so it keeps its getters and methods.
-	const classes = Arr.filter(
-		Arr.map(
-			Arr.filter(place.schemas, (schema) => schema._tag === "Declaration"),
-			structOf,
-		),
-		isStruct,
-	)
 	const values = Arr.filter(
 		place.schemas,
 		(schema) => !isStruct(structOf(schema)),
@@ -476,11 +479,18 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 		}
 	}
 	const structProperties = Arr.map(structs, propertiesOf)
-	const classProperties = Arr.map(classes, propertiesOf)
 	const children = Arr.map(namesOf(structs), (name) => {
-		const properties = Arr.flatMap(structProperties, (named) =>
-			Option.toArray(HashMap.get(named, name)),
-		)
+		const properties = Arr.flatMap(structProperties, (named) => {
+			const property = named.get(name)
+			return property === undefined ? [] : [property]
+		})
+		// A struct without the name may still have it as an extra field, with
+		// any value: only a decode or a `make` takes extra fields away, and a
+		// decision may get a value made by hand. A value that may be any
+		// object, as one of `Schema.Unknown` may, may have the name with any
+		// value too.
+		const top =
+			place.top || valueKinds.object || properties.length < structs.length
 		const below: Place = {
 			path: [...place.path, name],
 			schemas: Arr.flatMap(properties, (property) =>
@@ -492,15 +502,10 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 				place.missing ||
 				values.length > 0 ||
 				Arr.some(properties, (property) => SchemaAST.isOptional(property.type)),
-			// A struct without the name may still have it as an extra field,
-			// with any value: only a decode takes extra fields away. A value
-			// that may be any object, as one of `Schema.Unknown` may, may have
-			// the name with any value too.
-			top: place.top || valueKinds.object || properties.length < structs.length,
-			plain:
-				place.plain &&
-				!valueKinds.object &&
-				Arr.every(classProperties, (named) => HashMap.has(named, name)),
+			top,
+			// A value that may be anything may be a list, or have a getter, so
+			// a read below it may not find plain data.
+			plain: place.plain && !top,
 		}
 		return [name, branchOf(below, count)] as const
 	})
@@ -509,6 +514,8 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 	if (signatures.length === 0) {
 		return { field, children, names, key: undefined, keyBranch: undefined }
 	}
+	const keyTop =
+		place.top || valueKinds.object || records.length < structs.length
 	const key: Key = {
 		_tag: "Key",
 		parameters: Arr.map(signatures, (signature) => signature.parameter),
@@ -521,11 +528,8 @@ const branchOf = (place: Place, count: { size: number }): Branch => {
 			),
 			// A record may not have a given key.
 			missing: true,
-			top: place.top || valueKinds.object || records.length < structs.length,
-			plain:
-				place.plain &&
-				!valueKinds.object &&
-				Arr.every(classes, (struct) => struct.indexSignatures.length > 0),
+			top: keyTop,
+			plain: place.plain && !keyTop,
 		},
 		count,
 	)

package/src/internal/json.ts

@@ -143,15 +143,6 @@ const decodeOperands = (
 		decodeOperand(operand, [...path, name, index]),
 	)
 
-const compareOperators: ReadonlyArray<string> = [
-	"eq",
-	"ne",
-	"lt",
-	"lte",
-	"gt",
-	"gte",
-]
-
 const decodeNode = (
 	input: unknown,
 	path: ReadonlyArray<PropertyKey>,
@@ -199,11 +190,11 @@ const makeNode = (
 			return Nodes.never
 		case "Compare": {
 			const op = readString(input, "op", path)
-			if (!compareOperators.includes(op)) {
+			if (!Nodes.isCompareOperator(op)) {
 				throw problem([...path, "op"], `"${op}" is not a compare operator`)
 			}
 			return new Nodes.Compare({
-				op: op as Nodes.CompareOperator,
+				op,
 				field: readString(input, "field", path),
 				value: decodeOperand(read(input, "value", path), [...path, "value"]),
 			})