@nmnmcc/ability 2.0.6 → 2.1.1

package/src/internal/analysis.ts

@@ -22,11 +22,13 @@ import { decideNode, fitsKind } from "./decide.ts"
 import * as DomainData from "./domain.ts"
 import * as Limits from "./limits.ts"
 import * as Nodes from "./nodes.ts"
+import * as Place from "./place.ts"
 import * as PolicyNodes from "./policy-nodes.ts"
 import { nodeOf } from "./policy.ts"
 import * as ResourceData from "./resource.ts"
 import * as RuleData from "./rule.ts"
 import * as Search from "./search.ts"
+import * as Trampoline from "./trampoline.ts"
 
 type Any = Policy.Any
 
@@ -50,23 +52,28 @@ interface Build {
 	readonly not: (value: Ast) => Ast
 }
 
-const limit = (node: Nodes.Node): Ast => {
-	if (node.size > Limits.residualNodes) {
-		throw Limits.exceeded(
-			"A residual condition",
-			"residualNodes",
-			"nodes",
-			node.size,
-			Limits.residualNodes,
-		)
+/** The steps of a residual for a domain with these limits. */
+const buildFor = (limits: Limits.Limits): Build => {
+	const most = limits.residualNodes
+	const limit = (node: Nodes.Node): Ast => {
+		// A residual grows by its nodes, as the conditions of the rules come
+		// together. Its values come from the policy, which has a limit of them.
+		if (node.size > most) {
+			throw Limits.exceeded(
+				"A residual condition",
+				"residualNodes",
+				"nodes",
+				node.size,
+				most,
+			)
+		}
+		return node
+	}
+	return {
+		and: (values) => limit(Algebra.and(values as ReadonlyArray<Nodes.Node>)),
+		or: (values) => limit(Algebra.or(values as ReadonlyArray<Nodes.Node>)),
+		not: (value) => (value as Nodes.Node).pipe(Algebra.not, limit),
 	}
-	return node
-}
-
-const build: Build = {
-	and: (values) => limit(Algebra.and(values as ReadonlyArray<Nodes.Node>)),
-	or: (values) => limit(Algebra.or(values as ReadonlyArray<Nodes.Node>)),
-	not: (value) => (value as Nodes.Node).pipe(Algebra.not, limit),
 }
 
 /** The two residual conditions of a node, with no types. */
@@ -87,6 +94,10 @@ interface ResidualContext {
 	readonly descriptor: Resource.Descriptor
 	/** The test of `RuleData.fitsOf` for the catalog, for this request. */
 	readonly fits: (pattern: string) => boolean
+	/** The most parts of a field path in the domain. */
+	readonly parts: number
+	/** The steps of a residual, with the limits of the domain. */
+	readonly build: Build
 	/**
 	 * The condition of each rule, with the principal in it. They are made
 	 * first, from a flat list of the rules, so the walk does not go down the
@@ -118,7 +129,7 @@ const firstApplicableResidual = (
 	values: ReadonlyArray<RuleData.Rule>,
 	context: ResidualContext,
 ): Pair => {
-	const { and, not, or } = build
+	const { and, not, or } = context.build
 	// The rules go in runs of one tag, from the last run to the first. The
 	// conditions of a run go into one node at once. With one node for each
 	// rule, each step would flatten the whole condition again.
@@ -147,90 +158,104 @@ const firstApplicableResidual = (
  * Gives the residual pair of a node. A shared child is worked again for each
  * place. The limits of the nodes and of a residual keep this work small.
  */
-const residualNode = (
-	node: PolicyNodes.Node,
-	context: ResidualContext,
-): Pair => {
-	const { and, not, or } = build
-	switch (node._tag) {
-		case "Rules": {
-			switch (node.algorithm) {
-				case "denyOverrides": {
-					const deny = or(
-						node.rules
-							.filter((value) => value._tag === "Deny")
-							.map((value) => ruleCondition(value, context)),
-					)
-					const allow = and([
-						not(deny),
-						or(
-							node.rules
-								.filter((value) => value._tag === "Allow")
-								.map((value) => ruleCondition(value, context)),
+const residualNode = (root: PolicyNodes.Node, context: ResidualContext): Pair =>
+	// The walk of the tree takes the steps of a trampoline, so a deep tree
+	// does not fill the stack.
+	Trampoline.run(root.depth, (R) => {
+		const { and, not, or } = context.build
+		const children = (nodes: ReadonlyArray<PolicyNodes.Node>) =>
+			R.forEach(nodes, (child) => R.suspend(() => go(child)))
+		const go = (node: PolicyNodes.Node): Trampoline.Step<Pair> => {
+			switch (node._tag) {
+				case "Rules":
+					return R.succeed(rulesResidual(node, context))
+				case "All":
+					if (node.policies.length === 0) {
+						return R.succeed({ allow: never, deny: never })
+					}
+					return R.map(children(node.policies), (pairs) => {
+						const deny = or(pairs.map((pair) => pair.deny))
+						const allow = and([...pairs.map((pair) => pair.allow), not(deny)])
+						return { allow, deny }
+					})
+				case "Any":
+					return R.map(children(node.policies), (pairs) => {
+						const allow = or(pairs.map((pair) => pair.allow))
+						const deny = and([not(allow), or(pairs.map((pair) => pair.deny))])
+						return { allow, deny }
+					})
+				case "FirstOf":
+					// The first child that gives an answer wins.
+					return R.map(children(node.policies), (pairs) =>
+						Arr.reduceRight(
+							pairs,
+							{ allow: never, deny: never },
+							(rest: Pair, pair): Pair => ({
+								allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
+								deny: or([pair.deny, and([not(pair.allow), rest.deny])]),
+							}),
 						),
-					])
-					return { allow, deny }
-				}
-				case "permitOverrides": {
-					const allow = or(
-						node.rules
-							.filter((value) => value._tag === "Allow")
-							.map((value) => ruleCondition(value, context)),
 					)
-					const deny = and([
-						not(allow),
-						or(
-							node.rules
-								.filter((value) => value._tag === "Deny")
-								.map((value) => ruleCondition(value, context)),
-						),
-					])
-					return { allow, deny }
-				}
-				case "firstApplicable":
-					return firstApplicableResidual(node.rules, context)
-				case "lastApplicable":
-					return firstApplicableResidual(node.rules.slice().reverse(), context)
-			}
-		}
-		// falls through: every algorithm returns above
-		case "All": {
-			if (node.policies.length === 0) {
-				return { allow: never, deny: never }
+				case "Ceiling":
+					return R.flatMap(
+						R.suspend(() => go(node.cap)),
+						(cap) =>
+							R.map(
+								R.suspend(() => go(node.policy)),
+								(inner) => ({
+									allow: and([not(cap.deny), inner.allow]),
+									deny: or([cap.deny, inner.deny]),
+								}),
+							),
+					)
 			}
-			const pairs = node.policies.map((child) => residualNode(child, context))
-			const deny = or(pairs.map((pair) => pair.deny))
-			const allow = and([...pairs.map((pair) => pair.allow), not(deny)])
-			return { allow, deny }
 		}
-		case "Any": {
-			const pairs = node.policies.map((child) => residualNode(child, context))
-			const allow = or(pairs.map((pair) => pair.allow))
-			const deny = and([not(allow), or(pairs.map((pair) => pair.deny))])
+		return go(root)
+	})
+
+/** The residual of a list of rules, by its combining algorithm. */
+const rulesResidual = (
+	node: PolicyNodes.Rules,
+	context: ResidualContext,
+): Pair => {
+	const { and, not, or } = context.build
+	switch (node.algorithm) {
+		case "denyOverrides": {
+			const deny = or(
+				node.rules
+					.filter((value) => value._tag === "Deny")
+					.map((value) => ruleCondition(value, context)),
+			)
+			const allow = and([
+				not(deny),
+				or(
+					node.rules
+						.filter((value) => value._tag === "Allow")
+						.map((value) => ruleCondition(value, context)),
+				),
+			])
 			return { allow, deny }
 		}
-		case "FirstOf": {
-			// The first child that gives an answer wins.
-			return Arr.reduceRight(
-				node.policies,
-				{ allow: never, deny: never },
-				(rest: Pair, child): Pair => {
-					const pair = residualNode(child, context)
-					return {
-						allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
-						deny: or([pair.deny, and([not(pair.allow), rest.deny])]),
-					}
-				},
+		case "permitOverrides": {
+			const allow = or(
+				node.rules
+					.filter((value) => value._tag === "Allow")
+					.map((value) => ruleCondition(value, context)),
 			)
+			const deny = and([
+				not(allow),
+				or(
+					node.rules
+						.filter((value) => value._tag === "Deny")
+						.map((value) => ruleCondition(value, context)),
+				),
+			])
+			return { allow, deny }
 		}
-		case "Ceiling": {
-			const cap = residualNode(node.cap, context)
-			const inner = residualNode(node.policy, context)
-			return {
-				allow: and([not(cap.deny), inner.allow]),
-				deny: or([cap.deny, inner.deny]),
-			}
-		}
+		case "firstApplicable":
+			return firstApplicableResidual(node.rules, context)
+		case "lastApplicable":
+			return firstApplicableResidual(node.rules.slice().reverse(), context)
 	}
 }
 
@@ -250,28 +275,15 @@ interface PredicateContext {
 const usesPredicate = (
 	node: PolicyNodes.Node,
 	context: PredicateContext,
-): boolean => {
-	if (!node.opaque) {
-		return false
-	}
-	switch (node._tag) {
-		case "Rules":
-			return node.rules.some(
-				(value) =>
-					value.when !== undefined &&
-					Nodes.toNode(value.when).opaque &&
-					RuleData.matchesTarget(value, context),
-			)
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return node.policies.some((child) => usesPredicate(child, context))
-		case "Ceiling":
-			return (
-				usesPredicate(node.cap, context) || usesPredicate(node.policy, context)
-			)
-	}
-}
+): boolean =>
+	node.opaque &&
+	Arr.some(
+		PolicyNodes.rulesOf(node),
+		(value) =>
+			value.when !== undefined &&
+			Nodes.toNode(value.when).opaque &&
+			RuleData.matchesTarget(value, context),
+	)
 
 /**
  * Makes the scope of a request, with the principal in it. A scope comes from
@@ -296,7 +308,7 @@ const scopeOf = (
 	const issues = Bind.ruleIssues(
 		domain,
 		{ actions: [request.action], resources: [request.kind], when: ast },
-		["within"],
+		Place.at(undefined, "within"),
 	)
 	if (issues.length > 0) {
 		throw new globalThis.Error(
@@ -320,24 +332,36 @@ interface Scoped extends Pair {
 	readonly scope: Ast
 	/** The catalog of the kind, when the request fits the kind. */
 	readonly catalog: Catalog.Catalog | undefined
+	/** The limits of the domain. */
+	readonly limits: Limits.Limits
 }
 
 export const residualsAny = (policy: Any, request: ScopedRequest): Pair =>
 	scopedResiduals(policy, request)
 
 const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
+	const limits = policy.domain.limits
+	const parts = limits.fieldPathParts
 	const descriptor = DomainData.descriptorOf(policy.domain, request.kind)
-	if (descriptor === undefined || !fitsKind(descriptor, request)) {
-		return { scope: never, allow: never, deny: never, catalog: undefined }
+	if (descriptor === undefined || !fitsKind(descriptor, request, parts)) {
+		return {
+			scope: never,
+			allow: never,
+			deny: never,
+			catalog: undefined,
+			limits,
+		}
 	}
 	const input = { principal: request.principal, path: descriptor.path }
 	const scope = scopeOf(request, policy.domain, input)
+	const build = buildFor(limits)
 	const and = build.and
 	const inScope = (pair: Pair): Scoped => ({
 		scope,
 		allow: and([scope, pair.allow]),
 		deny: and([scope, pair.deny]),
 		catalog: descriptor.catalog,
+		limits,
 	})
 	if (scope._tag === "False") {
 		return inScope({ allow: never, deny: never })
@@ -348,7 +372,9 @@ const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
 		field: request.field,
 		input,
 		descriptor,
-		fits: RuleData.fitsOf(descriptor.catalog),
+		fits: RuleData.fitsOf(descriptor.catalog, parts),
+		parts,
+		build,
 	}
 	const context: ResidualContext = {
 		...target,
@@ -382,10 +408,11 @@ const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
 					path: descriptor.path,
 				},
 				descriptor,
-				fits: RuleData.fitsOf(descriptor.catalog),
+				fits: RuleData.fitsOf(descriptor.catalog, parts),
+				parts,
 				trace: undefined,
 			},
-			[],
+			undefined,
 		)
 	// A value of another kind is not a value that the residual is about, so
 	// the rules of this kind must not run on it.
@@ -423,7 +450,12 @@ const coverages = Data.taggedEnum<AnyCoverage>()
 
 /** Searches for a value of the kind of a scope that makes a condition true. */
 const search = (scoped: Scoped, ast: Ast): Condition.Satisfiability =>
-	Search.satisfiable(ast as Nodes.Node, Search.kindsIn(scoped.catalog))
+	Search.satisfiable(
+		ast as Nodes.Node,
+		Search.kindsIn(scoped.catalog, scoped.limits.fieldPathParts),
+		scoped.limits.searchSteps,
+		scoped.limits.searchFields,
+	)
 
 /** The values in the scope that the policy does not allow. */
 const refusedOf = (scoped: Scoped): Ast =>

package/src/internal/authorizer.ts

@@ -6,6 +6,7 @@
 // principals and deciders to `unknown`. The public types keep them, so the
 // language service check for `unknown` in an Effect is off here.
 // @effect-diagnostics anyUnknownInErrorContext:off
+import * as Arr from "effect/Array"
 import * as Cache from "effect/Cache"
 import * as Chunk from "effect/Chunk"
 import * as Context from "effect/Context"
@@ -28,6 +29,7 @@ import * as Decide from "./decide.ts"
 import * as DomainData from "./domain.ts"
 import * as Policies from "./policy.ts"
 import * as ResourceData from "./resource.ts"
+import * as Trampoline from "./trampoline.ts"
 
 type AnyServiceClass = Authorizer.AnyServiceClass
 
@@ -133,17 +135,27 @@ class PrincipalKey implements Equal.Equal {
 
 /**
  * The text of the order of the parts of a value: the names of the fields of
- * each object, and the items of each list, set and map, in the order that a
- * loop sees them. `Equal` does not see this order, but a loader may read it,
- * as `Object.values` does. So two keys need the same order too. A scalar has
- * no parts, and `Equal` compares it.
+ * each object, and the items of each list, set and map, with each scalar, in
+ * the order that a loop sees them. `Equal` does not see the order of the
+ * fields of an object or of the items of a map, but a loader may read it, as
+ * `Object.values` does. So two keys need the same order too. A scalar is in
+ * the text with its type, so the items of a set or a map show their order.
  */
-const orderOf = (value: unknown): string => {
+const orderOf: (value: unknown) => string = Trampoline.adaptive<
+	unknown,
+	string
+>((R, child) => (value, depth) => {
 	if (typeof value !== "object" || value === null) {
-		return ""
+		return R.succeed(
+			typeof value === "string"
+				? JSON.stringify(value)
+				: `${typeof value}:${String(value)}`,
+		)
 	}
+	const items = (list: ReadonlyArray<unknown>) =>
+		R.forEach(list, (item) => child(item, depth + 1))
 	if (Array.isArray(value)) {
-		return `[${value.map(orderOf).join(",")}]`
+		return R.map(items(value), (texts) => `[${texts.join(",")}]`)
 	}
 	if (
 		value instanceof Map ||
@@ -152,15 +164,18 @@ const orderOf = (value: unknown): string => {
 		HashSet.isHashSet(value) ||
 		Chunk.isChunk(value)
 	) {
-		return `<${Array.from(value as Iterable<unknown>, orderOf).join(",")}>`
-	}
-	return `{${Object.keys(value)
-		.map(
-			(name) =>
-				`${JSON.stringify(name)}:${orderOf((value as Record<string, unknown>)[name])}`,
+		return R.map(
+			items(Array.from(value as Iterable<unknown>)),
+			(texts) => `<${texts.join(",")}>`,
 		)
-		.join(",")}}`
-}
+	}
+	const names = Object.keys(value)
+	return R.map(
+		items(Arr.map(names, (name) => (value as Record<string, unknown>)[name])),
+		(texts) =>
+			`{${Arr.map(names, (name, index) => `${JSON.stringify(name)}:${texts[index]!}`).join(",")}}`,
+	)
+})
 
 /**
  * Gives the JSON codec of a Schema, or `undefined` when the Schema has no JSON
@@ -370,7 +385,10 @@ export const makeLayer = (
 				// A request that does not fit its kind gets a "no" at once. The
 				// decider must not say yes to an action that the kind does not have.
 				const descriptor = DomainData.descriptorOf(domain, kind)
-				if (descriptor === undefined || !Decide.fitsKind(descriptor, target)) {
+				if (
+					descriptor === undefined ||
+					!Decide.fitsKind(descriptor, target, domain.limits.fieldPathParts)
+				) {
 					return yield* forbidden(target, kind, undefined)
 				}
 				const fromPolicy: Decision.Decision =