@nmnmcc/ability 2.0.6 → 2.1.1

package/src/internal/bind.ts

@@ -17,6 +17,7 @@ import * as Nodes from "./nodes.ts"
 import * as Patterns from "./patterns.ts"
 import * as Place from "./place.ts"
 import { withSuggestion } from "./suggest.ts"
+import * as Trampoline from "./trampoline.ts"
 
 /** One problem of a rule or a policy, with its path. */
 export interface Issue {
@@ -54,13 +55,16 @@ interface Memo {
 	readonly issues: { count: number; noted: boolean }
 	/** The steps of the checks of patterns so far. It belongs to one binding. */
 	readonly work: { steps: number; noted: boolean }
+	/** The limits of the domain. */
+	readonly limits: Limits.Limits
 }
 
-const makeMemo = (): Memo => ({
+const makeMemo = (limits: Limits.Limits): Memo => ({
 	suggestions: new Map(),
 	fits: new Map(),
 	issues: { count: 0, noted: false },
 	work: { steps: 0, noted: false },
+	limits,
 })
 
 /**
@@ -164,13 +168,23 @@ const fieldIssue = (
 	field: string,
 	at: ReadonlyArray<PropertyKey>,
 ): ReadonlyArray<Issue> => {
+	const parts = context.memo.limits.fieldPathParts
+	if (field.split(".", parts + 1).length > parts) {
+		return [
+			{
+				path: at,
+				issue: `The field path "${field}" has more than ${String(parts)} parts. The most is ${String(parts)}.`,
+			},
+		]
+	}
 	const message = `The field "${field}" is not a field of every resource of the rule`
 	if (context.all || context.named.length === 0) {
 		return [{ path: at, issue: message }]
 	}
 	const without = Arr.filter(
 		context.named,
-		(descriptor) => Catalog.lookup(descriptor.catalog, field) === undefined,
+		(descriptor) =>
+			Catalog.lookup(descriptor.catalog, field, parts) === undefined,
 	)
 	return without.length === 0
 		? []
@@ -203,7 +217,14 @@ const readIssues = (
 	}
 	return Arr.some(
 		context.named,
-		(descriptor) => !(Catalog.lookup(descriptor.catalog, field)?.plain ?? true),
+		(descriptor) =>
+			!(
+				Catalog.lookup(
+					descriptor.catalog,
+					field,
+					context.memo.limits.fieldPathParts,
+				)?.plain ?? true
+			),
 	)
 		? [
 				{
@@ -225,7 +246,7 @@ const patternIssues = (
 	pattern: string,
 	at: ReadonlyArray<PropertyKey>,
 ): ReadonlyArray<Issue> =>
-	Result.match(Patterns.parse(pattern), {
+	Result.match(Patterns.parse(pattern, memo.limits.patternParts), {
 		onFailure: (issue) => [{ path: at, issue }],
 		onSuccess: (parsed) => {
 			// A rule with no known resource has an issue for that already. The
@@ -238,30 +259,27 @@ const patternIssues = (
 					const key = `${descriptor.kind}\u0000${pattern}`
 					return (
 						Option.getOrElse(Option.fromUndefinedOr(memo.fits.get(key)), () => {
-							// Each check of a pattern reads the fields of a catalog. The
+							// Each check of a pattern reads the steps of a catalog. The
 							// work of one binding has a limit, so very many patterns stop
 							// with one issue, and the policy does not load.
 							memo.work.steps +=
-								descriptor.catalog.fields.length * Math.max(parsed.length, 1)
-							if (memo.work.steps > Limits.searchSteps) {
+								Math.max(descriptor.catalog.edges, 1) *
+								Math.max(parsed.length, 1)
+							if (memo.work.steps > memo.limits.searchSteps) {
 								return true
 							}
-							const found = Patterns.fitsCatalog(parsed, descriptor.catalog)
+							const found = Patterns.fitsCatalog(
+								parsed,
+								descriptor.catalog,
+								memo.limits.fieldPathParts,
+							)
 							memo.fits.set(key, found)
 							return found
 						}) || before
 					)
 				})
-			if (memo.work.steps > Limits.searchSteps && !memo.work.noted) {
-				memo.work.noted = true
-				return [
-					{
-						path: at,
-						issue: `The field patterns of the policy take more than ${String(Limits.searchSteps)} steps to check. The most is ${String(Limits.searchSteps)}.`,
-					},
-				]
-			}
-			return fits
+			// Past the limit of the work, `ruleIssues` gives one issue for it.
+			return fits || memo.work.steps > memo.limits.searchSteps
 				? []
 				: [
 						{
@@ -278,7 +296,11 @@ const fieldsAt = (
 	field: string,
 ): ReadonlyArray<Catalog.Field> =>
 	Arr.flatMap(context.applicable, (descriptor) => {
-		const found = Catalog.lookup(descriptor.catalog, field)
+		const found = Catalog.lookup(
+			descriptor.catalog,
+			field,
+			context.memo.limits.fieldPathParts,
+		)
 		return found === undefined ? [] : [found]
 	})
 
@@ -288,7 +310,11 @@ const principalField = (
 	ref: string,
 	at: ReadonlyArray<PropertyKey>,
 ): Catalog.Field | Issue => {
-	const found = Catalog.lookup(context.domain.principalCatalog, ref)
+	const found = Catalog.lookup(
+		context.domain.principalCatalog,
+		ref,
+		context.memo.limits.fieldPathParts,
+	)
 	// A read of the principal that is not plain data is a defect, as a read
 	// of a resource is: see `readIssues`.
 	if (found !== undefined && !found.plain) {
@@ -314,15 +340,45 @@ const principalField = (
 const isIssue = (value: Catalog.Field | Issue): value is Issue =>
 	"issue" in value
 
-/** The issues of one operand of a test of a field. */
+/**
+ * The fields that a test reads, with one field for each distinct kind of
+ * value. A rule for very many kinds may have one field type in all of them,
+ * so each value of the test is checked one time for each distinct kind, not
+ * one time for each resource. The kinds are found by their text in a native
+ * `Map`, which belongs to this call.
+ */
+const distinctFields = (
+	context: Context,
+	field: string,
+): ReadonlyArray<Catalog.Field> =>
+	Array.from(
+		new Map(
+			Arr.map(
+				fieldsAt(context, field),
+				(found) => [JSON.stringify(found.kinds), found] as const,
+			),
+		).values(),
+	)
+
+/**
+ * Counts the work of the checks of the values of a test, as the work of the
+ * field patterns counts. Past the limit, the values are not checked, and
+ * `ruleIssues` gives one issue for the work.
+ */
+const spendChecks = (memo: Memo, values: number, fields: number): boolean => {
+	memo.work.steps += values * Math.max(fields, 1)
+	return memo.work.steps <= memo.limits.searchSteps
+}
+
+/** The issues of one operand of a test of a field, with its distinct fields. */
 const operandIssues = (
 	context: Context,
 	field: string,
+	fields: ReadonlyArray<Catalog.Field>,
 	ordered: boolean,
 	operand: Operand,
 	at: ReadonlyArray<PropertyKey>,
 ): ReadonlyArray<Issue> => {
-	const fields = fieldsAt(context, field)
 	if (operand._tag === "Literal") {
 		const value = operand.value
 		if (ordered && typeof value !== "string" && typeof value !== "number") {
@@ -468,8 +524,11 @@ const notWhole = (at: ReadonlyArray<PropertyKey>): Issue => ({
  */
 const maxIssues = 100
 
-/** A path that the walk makes only when it needs it, for an issue. */
-type LazyPath = () => ReadonlyArray<PropertyKey>
+/**
+ * The place of a part of a policy, which a walk turns into a full path only
+ * for an issue: see `Place`.
+ */
+type At = Place.Place | undefined
 
 /**
  * Puts the path of a node before the paths of its issues. A walk keeps no
@@ -477,7 +536,7 @@ type LazyPath = () => ReadonlyArray<PropertyKey>
  */
 const under = (
 	memo: Memo,
-	at: LazyPath,
+	at: At,
 	issues: ReadonlyArray<Issue>,
 ): ReadonlyArray<Issue> => {
 	if (issues.length === 0) {
@@ -486,7 +545,7 @@ const under = (
 	const room = maxIssues - memo.issues.count
 	memo.issues.count += issues.length
 	const kept = Arr.map(Arr.take(issues, Math.max(room, 0)), (issue) => ({
-		path: [...at(), ...issue.path],
+		path: [...Place.pathOf(at), ...issue.path],
 		issue: issue.issue,
 	}))
 	const first = memo.issues.count > maxIssues && !memo.issues.noted
@@ -511,68 +570,95 @@ const under = (
  */
 const conditionIssues = (
 	context: Context,
-	node: Nodes.Node,
-	at: LazyPath,
+	root: Nodes.Node,
+	rootAt: At,
 	seen: Set<Nodes.Node>,
-): ReadonlyArray<Issue> => {
-	if (seen.has(node)) {
-		return []
-	}
-	seen.add(node)
-	const here = (issues: ReadonlyArray<Issue>) => under(context.memo, at, issues)
-	switch (node._tag) {
-		case "Compare": {
-			const exists = readIssues(context, node.field, ["field"])
-			return here(
-				exists.length > 0
-					? exists
-					: operandIssues(
-							context,
-							node.field,
-							node.op !== "eq" && node.op !== "ne",
-							node.value,
-							["value"],
-						),
-			)
-		}
-		case "In": {
-			const exists = readIssues(context, node.field, ["field"])
-			return here(
-				exists.length > 0
-					? exists
-					: Arr.flatMap(node.values, (operand, index) =>
-							operandIssues(context, node.field, false, operand, [
+): ReadonlyArray<Issue> =>
+	// The walk takes the steps of a trampoline, so a deep condition does not
+	// fill the stack.
+	Trampoline.run(root.depth, (R) => {
+		// A test looks its field up in each resource of the rule. A rule for
+		// very many kinds with very many tests is very much work, so it counts.
+		// Past the limit, `ruleIssues` gives one issue for it, and the policy
+		// does not load.
+		const room = (values: number) =>
+			spendChecks(context.memo, 1 + values, context.named.length)
+		const leaf = (node: Nodes.Node, at: At): ReadonlyArray<Issue> => {
+			const here = (issues: ReadonlyArray<Issue>) =>
+				under(context.memo, at, issues)
+			switch (node._tag) {
+				case "Compare": {
+					if (!room(1)) {
+						return []
+					}
+					const exists = readIssues(context, node.field, ["field"])
+					return here(
+						exists.length > 0
+							? exists
+							: operandIssues(
+									context,
+									node.field,
+									distinctFields(context, node.field),
+									node.op !== "eq" && node.op !== "ne",
+									node.value,
+									["value"],
+								),
+					)
+				}
+				case "In": {
+					if (!room(0)) {
+						return []
+					}
+					const exists = readIssues(context, node.field, ["field"])
+					if (exists.length > 0) {
+						return here(exists)
+					}
+					const fields = distinctFields(context, node.field)
+					if (!spendChecks(context.memo, node.values.length, fields.length)) {
+						return []
+					}
+					return here(
+						Arr.flatMap(node.values, (operand, index) =>
+							operandIssues(context, node.field, fields, false, operand, [
 								"values",
 								index,
 							]),
 						),
-			)
+					)
+				}
+				case "Exists":
+					return room(0) ? here(readIssues(context, node.field, ["field"])) : []
+				case "Under":
+					return here(underIssues(context, node.prefix, []))
+				default:
+					return []
+			}
 		}
-		case "Exists":
-			return here(readIssues(context, node.field, ["field"]))
-		case "Under":
-			return here(underIssues(context, node.prefix, []))
-		case "And":
-		case "Or":
-			return Arr.flatMap(node.conditions, (child, index) =>
-				conditionIssues(
-					context,
-					child,
-					() => [...at(), "conditions", index],
-					seen,
-				),
-			)
-		case "Not":
-			return conditionIssues(
-				context,
-				node.condition,
-				() => [...at(), "condition"],
-				seen,
-			)
-		default:
-			return []
-	}
-}
+		const go = (
+			node: Nodes.Node,
+			at: At,
+		): Trampoline.Step<ReadonlyArray<Issue>> => {
+			if (seen.has(node)) {
+				return R.succeed([])
+			}
+			seen.add(node)
+			switch (node._tag) {
+				case "And":
+				case "Or":
+					return R.map(
+						R.forEach(node.conditions, (child, index) =>
+							R.suspend(() => go(child, Place.at(at, "conditions", index))),
+						),
+						Arr.flatten,
+					)
+				case "Not":
+					return R.suspend(() => go(node.condition, Place.at(at, "condition")))
+				default:
+					return R.succeed(leaf(node, at))
+			}
+		}
+		return go(root, rootAt)
+	})
 
 const hasAction = (
 	descriptor: Resource.Descriptor,
@@ -582,15 +668,18 @@ const hasAction = (
 	Arr.some(actions, (action) => descriptor.actions.includes(action))
 
 /**
- * Checks one rule against a domain. It gives one issue for each problem. `at`
- * is the path of the rule, for the paths of the issues.
+ * Checks one rule against a domain. It gives one issue for each problem, up
+ * to the most issues of the binding. `at` is the place of the rule, and its
+ * full path is made only for an issue that the binding keeps: a rule with
+ * very many problems deep in a tree does not make a full path for each one.
  */
 export const ruleIssues = (
 	domain: Domain.Any,
 	rule: RuleData,
-	at: ReadonlyArray<PropertyKey>,
-	memo: Memo = makeMemo(),
+	at: At,
+	memo: Memo = makeMemo(domain.limits),
 ): ReadonlyArray<Issue> => {
+	const here = (issues: ReadonlyArray<Issue>) => under(memo, at, issues)
 	const all = rule.resources.includes("*")
 	// Each kind is checked one time, also when the list names it again. The
 	// names come from a policy, so a native `Set` finds the copies:
@@ -623,46 +712,82 @@ export const ruleIssues = (
 	const actions = Array.from(
 		new Set(Arr.flatMap(known, (descriptor) => descriptor.actions)),
 	)
+	const fieldIssues = Arr.flatMap(rule.fields ?? [], (field, index) =>
+		here(
+			field.includes("*")
+				? patternIssues(memo, known, field, ["fields", index])
+				: fieldIssue(context, field, ["fields", index]),
+		),
+	)
+	const conditionNodes = memo.limits.conditionNodes
+	const whenIssues =
+		rule.when === undefined
+			? []
+			: !Nodes.isNode(rule.when)
+				? here([notWhole(["when"])])
+				: // The constructors of the nodes check the ceiling, so the binding
+					// checks the limit of the domain.
+					rule.when.weight > conditionNodes
+					? here([
+							{
+								path: ["when"],
+								issue: `A condition has ${String(rule.when.weight)} nodes and values. The most is ${String(conditionNodes)}.`,
+							},
+						])
+					: conditionIssues(context, rule.when, Place.at(at, "when"), new Set())
+	// The work is known only after every check of the rule. Past the limit, a
+	// check gives no issue, so this issue must come, or the policy would load
+	// with checks left out.
+	const work = memo.work.steps > memo.limits.searchSteps && !memo.work.noted
+	memo.work.noted ||= work
 	return [
-		...Arr.map(
+		...Arr.flatMap(
 			Arr.filter(names, (kind) => !HashMap.has(domain.resources, kind)),
-			(kind): Issue => ({
-				path: [...at, "resources"],
-				issue: suggestIn(
-					memo,
-					`There is no resource with the kind "${kind}"`,
-					kind,
-					"~kinds",
-					() => kinds,
-				),
-			}),
+			(kind: string) =>
+				here([
+					{
+						path: ["resources"],
+						issue: suggestIn(
+							memo,
+							`There is no resource with the kind "${kind}"`,
+							kind,
+							"~kinds",
+							() => kinds,
+						),
+					},
+				]),
 		),
-		...Arr.map(
+		...Arr.flatMap(
 			Arr.filter(
 				rule.actions,
 				(action) => action !== "*" && !actions.includes(action),
 			),
-			(action): Issue => ({
-				path: [...at, "actions"],
-				issue: suggestIn(
-					memo,
-					`The action "${action}" is not an action of these resources`,
-					action,
-					`~actions\u0000${names.join(",")}`,
-					() => actions,
-				),
-			}),
-		),
-		...Arr.flatMap(rule.fields ?? [], (field, index) =>
-			field.includes("*")
-				? patternIssues(memo, known, field, [...at, "fields", index])
-				: fieldIssue(context, field, [...at, "fields", index]),
+			(action: string) =>
+				here([
+					{
+						path: ["actions"],
+						issue: suggestIn(
+							memo,
+							`The action "${action}" is not an action of these resources`,
+							action,
+							`~actions\u0000${names.join(",")}`,
+							() => actions,
+						),
+					},
+				]),
 		),
-		...(rule.when === undefined
-			? []
-			: Nodes.isNode(rule.when)
-				? conditionIssues(context, rule.when, () => [...at, "when"], new Set())
-				: [notWhole([...at, "when"])]),
+		...fieldIssues,
+		...whenIssues,
+		// The issue of the work is not one of the most issues of the binding,
+		// so a policy past the limit always says why.
+		...(work
+			? [
+					{
+						path: Place.pathOf(at),
+						issue: `The policy takes more than ${String(memo.limits.searchSteps)} steps to check: its field patterns, and the fields and values of its tests on each resource. The most is ${String(memo.limits.searchSteps)}.`,
+					},
+				]
+			: []),
 	]
 }
 
@@ -686,46 +811,52 @@ export const treeIssues = (
 ): ReadonlyArray<Issue> => {
 	// The rules come out of the tree first, and each one is checked after.
 	// A check of a condition goes down its levels, so a check inside the walk
-	// of the tree would go down the levels of both.
-	// The place of each rule shares the path of its parent, and the full path
-	// is made only when its rule is checked. A deep tree with very many rules
-	// would need very much memory for a full copy of the path of each rule.
-	const rulesOf = (
-		node: TreeNode,
-		place: Place.Place | undefined,
-		level: number,
-	): ReadonlyArray<Issue | readonly [RuleData, Place.Place]> => {
-		if (level > Limits.policyDepth) {
-			return [
-				{
-					path: Place.pathOf(place),
-					issue: `A policy tree has more than ${String(Limits.policyDepth)} levels. The most is ${String(Limits.policyDepth)}.`,
-				},
-			]
-		}
+	// of the tree would go down the levels of both. The place of each rule
+	// shares the path of its parent. The tree may be the JSON form, with no
+	// depth that a node knows, so the walk is a walk of the trampoline for an
+	// input of an unknown depth.
+	type Found = Issue | readonly [RuleData, Place.Place]
+	const rulesOf = Trampoline.adaptive<
+		{ readonly node: TreeNode; readonly at: At },
+		ReadonlyArray<Found>
+	>((R, child) => ({ node, at }, level) => {
 		switch (node._tag) {
 			case "Rules":
-				return Arr.map(
-					node.rules,
-					(rule, index) => [rule, Place.at(place, "rules", index)] as const,
+				return R.succeed(
+					Arr.map(
+						node.rules,
+						(rule, index) => [rule, Place.at(at, "rules", index)] as const,
+					),
 				)
 			case "All":
 			case "Any":
 			case "FirstOf":
-				return Arr.flatMap(node.policies, (child, index) =>
-					rulesOf(child, Place.at(place, "policies", index), level + 1),
+				return R.map(
+					R.forEach(node.policies, (inner, index) =>
+						child(
+							{ node: inner, at: Place.at(at, "policies", index) },
+							level + 1,
+						),
+					),
+					Arr.flatten,
 				)
 			case "Ceiling":
-				return [
-					...rulesOf(node.cap, Place.at(place, "cap"), level + 1),
-					...rulesOf(node.policy, Place.at(place, "policy"), level + 1),
-				]
+				return R.map(
+					R.forEach(
+						[
+							{ node: node.cap, at: Place.at(at, "cap") },
+							{ node: node.policy, at: Place.at(at, "policy") },
+						],
+						(part) => child(part, level + 1),
+					),
+					Arr.flatten,
+				)
 		}
-	}
-	const memo = makeMemo()
-	return Arr.flatMap(rulesOf(root, undefined, 1), (found) =>
+	})
+	const memo = makeMemo(domain.limits)
+	return Arr.flatMap(rulesOf({ node: root, at: undefined }), (found) =>
 		Array.isArray(found)
-			? ruleIssues(domain, found[0], Place.pathOf(found[1]), memo)
+			? ruleIssues(domain, found[0], found[1], memo)
 			: [found as Issue],
 	)
 }