@nmnmcc/ability 2.0.7 → 2.1.1

package/src/internal/bind.ts

@@ -17,6 +17,7 @@ import * as Nodes from "./nodes.ts"
 import * as Patterns from "./patterns.ts"
 import * as Place from "./place.ts"
 import { withSuggestion } from "./suggest.ts"
+import * as Trampoline from "./trampoline.ts"
 
 /** One problem of a rule or a policy, with its path. */
 export interface Issue {
@@ -54,13 +55,16 @@ interface Memo {
 	readonly issues: { count: number; noted: boolean }
 	/** The steps of the checks of patterns so far. It belongs to one binding. */
 	readonly work: { steps: number; noted: boolean }
+	/** The limits of the domain. */
+	readonly limits: Limits.Limits
 }
 
-const makeMemo = (): Memo => ({
+const makeMemo = (limits: Limits.Limits): Memo => ({
 	suggestions: new Map(),
 	fits: new Map(),
 	issues: { count: 0, noted: false },
 	work: { steps: 0, noted: false },
+	limits,
 })
 
 /**
@@ -164,13 +168,23 @@ const fieldIssue = (
 	field: string,
 	at: ReadonlyArray<PropertyKey>,
 ): ReadonlyArray<Issue> => {
+	const parts = context.memo.limits.fieldPathParts
+	if (field.split(".", parts + 1).length > parts) {
+		return [
+			{
+				path: at,
+				issue: `The field path "${field}" has more than ${String(parts)} parts. The most is ${String(parts)}.`,
+			},
+		]
+	}
 	const message = `The field "${field}" is not a field of every resource of the rule`
 	if (context.all || context.named.length === 0) {
 		return [{ path: at, issue: message }]
 	}
 	const without = Arr.filter(
 		context.named,
-		(descriptor) => Catalog.lookup(descriptor.catalog, field) === undefined,
+		(descriptor) =>
+			Catalog.lookup(descriptor.catalog, field, parts) === undefined,
 	)
 	return without.length === 0
 		? []
@@ -203,7 +217,14 @@ const readIssues = (
 	}
 	return Arr.some(
 		context.named,
-		(descriptor) => !(Catalog.lookup(descriptor.catalog, field)?.plain ?? true),
+		(descriptor) =>
+			!(
+				Catalog.lookup(
+					descriptor.catalog,
+					field,
+					context.memo.limits.fieldPathParts,
+				)?.plain ?? true
+			),
 	)
 		? [
 				{
@@ -225,7 +246,7 @@ const patternIssues = (
 	pattern: string,
 	at: ReadonlyArray<PropertyKey>,
 ): ReadonlyArray<Issue> =>
-	Result.match(Patterns.parse(pattern), {
+	Result.match(Patterns.parse(pattern, memo.limits.patternParts), {
 		onFailure: (issue) => [{ path: at, issue }],
 		onSuccess: (parsed) => {
 			// A rule with no known resource has an issue for that already. The
@@ -238,22 +259,27 @@ const patternIssues = (
 					const key = `${descriptor.kind}\u0000${pattern}`
 					return (
 						Option.getOrElse(Option.fromUndefinedOr(memo.fits.get(key)), () => {
-							// Each check of a pattern reads the fields of a catalog. The
+							// Each check of a pattern reads the steps of a catalog. The
 							// work of one binding has a limit, so very many patterns stop
 							// with one issue, and the policy does not load.
 							memo.work.steps +=
-								descriptor.catalog.fields.length * Math.max(parsed.length, 1)
-							if (memo.work.steps > Limits.searchSteps) {
+								Math.max(descriptor.catalog.edges, 1) *
+								Math.max(parsed.length, 1)
+							if (memo.work.steps > memo.limits.searchSteps) {
 								return true
 							}
-							const found = Patterns.fitsCatalog(parsed, descriptor.catalog)
+							const found = Patterns.fitsCatalog(
+								parsed,
+								descriptor.catalog,
+								memo.limits.fieldPathParts,
+							)
 							memo.fits.set(key, found)
 							return found
 						}) || before
 					)
 				})
 			// Past the limit of the work, `ruleIssues` gives one issue for it.
-			return fits || memo.work.steps > Limits.searchSteps
+			return fits || memo.work.steps > memo.limits.searchSteps
 				? []
 				: [
 						{
@@ -270,7 +296,11 @@ const fieldsAt = (
 	field: string,
 ): ReadonlyArray<Catalog.Field> =>
 	Arr.flatMap(context.applicable, (descriptor) => {
-		const found = Catalog.lookup(descriptor.catalog, field)
+		const found = Catalog.lookup(
+			descriptor.catalog,
+			field,
+			context.memo.limits.fieldPathParts,
+		)
 		return found === undefined ? [] : [found]
 	})
 
@@ -280,7 +310,11 @@ const principalField = (
 	ref: string,
 	at: ReadonlyArray<PropertyKey>,
 ): Catalog.Field | Issue => {
-	const found = Catalog.lookup(context.domain.principalCatalog, ref)
+	const found = Catalog.lookup(
+		context.domain.principalCatalog,
+		ref,
+		context.memo.limits.fieldPathParts,
+	)
 	// A read of the principal that is not plain data is a defect, as a read
 	// of a resource is: see `readIssues`.
 	if (found !== undefined && !found.plain) {
@@ -333,7 +367,7 @@ const distinctFields = (
  */
 const spendChecks = (memo: Memo, values: number, fields: number): boolean => {
 	memo.work.steps += values * Math.max(fields, 1)
-	return memo.work.steps <= Limits.searchSteps
+	return memo.work.steps <= memo.limits.searchSteps
 }
 
 /** The issues of one operand of a test of a field, with its distinct fields. */
@@ -490,8 +524,11 @@ const notWhole = (at: ReadonlyArray<PropertyKey>): Issue => ({
  */
 const maxIssues = 100
 
-/** A path that the walk makes only when it needs it, for an issue. */
-type LazyPath = () => ReadonlyArray<PropertyKey>
+/**
+ * The place of a part of a policy, which a walk turns into a full path only
+ * for an issue: see `Place`.
+ */
+type At = Place.Place | undefined
 
 /**
  * Puts the path of a node before the paths of its issues. A walk keeps no
@@ -499,7 +536,7 @@ type LazyPath = () => ReadonlyArray<PropertyKey>
  */
 const under = (
 	memo: Memo,
-	at: LazyPath,
+	at: At,
 	issues: ReadonlyArray<Issue>,
 ): ReadonlyArray<Issue> => {
 	if (issues.length === 0) {
@@ -508,7 +545,7 @@ const under = (
 	const room = maxIssues - memo.issues.count
 	memo.issues.count += issues.length
 	const kept = Arr.map(Arr.take(issues, Math.max(room, 0)), (issue) => ({
-		path: [...at(), ...issue.path],
+		path: [...Place.pathOf(at), ...issue.path],
 		issue: issue.issue,
 	}))
 	const first = memo.issues.count > maxIssues && !memo.issues.noted
@@ -533,86 +570,95 @@ const under = (
  */
 const conditionIssues = (
 	context: Context,
-	node: Nodes.Node,
-	at: LazyPath,
+	root: Nodes.Node,
+	rootAt: At,
 	seen: Set<Nodes.Node>,
-): ReadonlyArray<Issue> => {
-	if (seen.has(node)) {
-		return []
-	}
-	seen.add(node)
-	const here = (issues: ReadonlyArray<Issue>) => under(context.memo, at, issues)
-	// A test looks its field up in each resource of the rule. A rule for very
-	// many kinds with very many tests is very much work, so it counts. Past
-	// the limit, `ruleIssues` gives one issue for it, and the policy does not
-	// load.
-	const room = (values: number) =>
-		spendChecks(context.memo, 1 + values, context.named.length)
-	switch (node._tag) {
-		case "Compare": {
-			if (!room(1)) {
-				return []
-			}
-			const exists = readIssues(context, node.field, ["field"])
-			return here(
-				exists.length > 0
-					? exists
-					: operandIssues(
-							context,
-							node.field,
-							distinctFields(context, node.field),
-							node.op !== "eq" && node.op !== "ne",
-							node.value,
-							["value"],
+): ReadonlyArray<Issue> =>
+	// The walk takes the steps of a trampoline, so a deep condition does not
+	// fill the stack.
+	Trampoline.run(root.depth, (R) => {
+		// A test looks its field up in each resource of the rule. A rule for
+		// very many kinds with very many tests is very much work, so it counts.
+		// Past the limit, `ruleIssues` gives one issue for it, and the policy
+		// does not load.
+		const room = (values: number) =>
+			spendChecks(context.memo, 1 + values, context.named.length)
+		const leaf = (node: Nodes.Node, at: At): ReadonlyArray<Issue> => {
+			const here = (issues: ReadonlyArray<Issue>) =>
+				under(context.memo, at, issues)
+			switch (node._tag) {
+				case "Compare": {
+					if (!room(1)) {
+						return []
+					}
+					const exists = readIssues(context, node.field, ["field"])
+					return here(
+						exists.length > 0
+							? exists
+							: operandIssues(
+									context,
+									node.field,
+									distinctFields(context, node.field),
+									node.op !== "eq" && node.op !== "ne",
+									node.value,
+									["value"],
+								),
+					)
+				}
+				case "In": {
+					if (!room(0)) {
+						return []
+					}
+					const exists = readIssues(context, node.field, ["field"])
+					if (exists.length > 0) {
+						return here(exists)
+					}
+					const fields = distinctFields(context, node.field)
+					if (!spendChecks(context.memo, node.values.length, fields.length)) {
+						return []
+					}
+					return here(
+						Arr.flatMap(node.values, (operand, index) =>
+							operandIssues(context, node.field, fields, false, operand, [
+								"values",
+								index,
+							]),
 						),
-			)
-		}
-		case "In": {
-			if (!room(0)) {
-				return []
+					)
+				}
+				case "Exists":
+					return room(0) ? here(readIssues(context, node.field, ["field"])) : []
+				case "Under":
+					return here(underIssues(context, node.prefix, []))
+				default:
+					return []
 			}
-			const exists = readIssues(context, node.field, ["field"])
-			if (exists.length > 0) {
-				return here(exists)
+		}
+		const go = (
+			node: Nodes.Node,
+			at: At,
+		): Trampoline.Step<ReadonlyArray<Issue>> => {
+			if (seen.has(node)) {
+				return R.succeed([])
 			}
-			const fields = distinctFields(context, node.field)
-			if (!spendChecks(context.memo, node.values.length, fields.length)) {
-				return []
+			seen.add(node)
+			switch (node._tag) {
+				case "And":
+				case "Or":
+					return R.map(
+						R.forEach(node.conditions, (child, index) =>
+							R.suspend(() => go(child, Place.at(at, "conditions", index))),
+						),
+						Arr.flatten,
+					)
+				case "Not":
+					return R.suspend(() => go(node.condition, Place.at(at, "condition")))
+				default:
+					return R.succeed(leaf(node, at))
 			}
-			return here(
-				Arr.flatMap(node.values, (operand, index) =>
-					operandIssues(context, node.field, fields, false, operand, [
-						"values",
-						index,
-					]),
-				),
-			)
 		}
-		case "Exists":
-			return room(0) ? here(readIssues(context, node.field, ["field"])) : []
-		case "Under":
-			return here(underIssues(context, node.prefix, []))
-		case "And":
-		case "Or":
-			return Arr.flatMap(node.conditions, (child, index) =>
-				conditionIssues(
-					context,
-					child,
-					() => [...at(), "conditions", index],
-					seen,
-				),
-			)
-		case "Not":
-			return conditionIssues(
-				context,
-				node.condition,
-				() => [...at(), "condition"],
-				seen,
-			)
-		default:
-			return []
-	}
-}
+		return go(root, rootAt)
+	})
 
 const hasAction = (
 	descriptor: Resource.Descriptor,
@@ -623,15 +669,15 @@ const hasAction = (
 
 /**
  * Checks one rule against a domain. It gives one issue for each problem, up
- * to the most issues of the binding. `at` gives the path of the rule, and it
- * is made only for an issue that the binding keeps: a rule with very many
- * problems deep in a tree does not make a full path for each one.
+ * to the most issues of the binding. `at` is the place of the rule, and its
+ * full path is made only for an issue that the binding keeps: a rule with
+ * very many problems deep in a tree does not make a full path for each one.
  */
 export const ruleIssues = (
 	domain: Domain.Any,
 	rule: RuleData,
-	at: LazyPath,
-	memo: Memo = makeMemo(),
+	at: At,
+	memo: Memo = makeMemo(domain.limits),
 ): ReadonlyArray<Issue> => {
 	const here = (issues: ReadonlyArray<Issue>) => under(memo, at, issues)
 	const all = rule.resources.includes("*")
@@ -673,21 +719,26 @@ export const ruleIssues = (
 				: fieldIssue(context, field, ["fields", index]),
 		),
 	)
+	const conditionNodes = memo.limits.conditionNodes
 	const whenIssues =
 		rule.when === undefined
 			? []
-			: Nodes.isNode(rule.when)
-				? conditionIssues(
-						context,
-						rule.when,
-						() => [...at(), "when"],
-						new Set(),
-					)
-				: here([notWhole(["when"])])
+			: !Nodes.isNode(rule.when)
+				? here([notWhole(["when"])])
+				: // The constructors of the nodes check the ceiling, so the binding
+					// checks the limit of the domain.
+					rule.when.weight > conditionNodes
+					? here([
+							{
+								path: ["when"],
+								issue: `A condition has ${String(rule.when.weight)} nodes and values. The most is ${String(conditionNodes)}.`,
+							},
+						])
+					: conditionIssues(context, rule.when, Place.at(at, "when"), new Set())
 	// The work is known only after every check of the rule. Past the limit, a
 	// check gives no issue, so this issue must come, or the policy would load
 	// with checks left out.
-	const work = memo.work.steps > Limits.searchSteps && !memo.work.noted
+	const work = memo.work.steps > memo.limits.searchSteps && !memo.work.noted
 	memo.work.noted ||= work
 	return [
 		...Arr.flatMap(
@@ -732,8 +783,8 @@ export const ruleIssues = (
 		...(work
 			? [
 					{
-						path: at(),
-						issue: `The policy takes more than ${String(Limits.searchSteps)} steps to check: its field patterns, and the fields and values of its tests on each resource. The most is ${String(Limits.searchSteps)}.`,
+						path: Place.pathOf(at),
+						issue: `The policy takes more than ${String(memo.limits.searchSteps)} steps to check: its field patterns, and the fields and values of its tests on each resource. The most is ${String(memo.limits.searchSteps)}.`,
 					},
 				]
 			: []),
@@ -760,46 +811,52 @@ export const treeIssues = (
 ): ReadonlyArray<Issue> => {
 	// The rules come out of the tree first, and each one is checked after.
 	// A check of a condition goes down its levels, so a check inside the walk
-	// of the tree would go down the levels of both.
-	// The place of each rule shares the path of its parent, and the full path
-	// is made only when its rule is checked. A deep tree with very many rules
-	// would need very much memory for a full copy of the path of each rule.
-	const rulesOf = (
-		node: TreeNode,
-		place: Place.Place | undefined,
-		level: number,
-	): ReadonlyArray<Issue | readonly [RuleData, Place.Place]> => {
-		if (level > Limits.policyDepth) {
-			return [
-				{
-					path: Place.pathOf(place),
-					issue: `A policy tree has more than ${String(Limits.policyDepth)} levels. The most is ${String(Limits.policyDepth)}.`,
-				},
-			]
-		}
+	// of the tree would go down the levels of both. The place of each rule
+	// shares the path of its parent. The tree may be the JSON form, with no
+	// depth that a node knows, so the walk is a walk of the trampoline for an
+	// input of an unknown depth.
+	type Found = Issue | readonly [RuleData, Place.Place]
+	const rulesOf = Trampoline.adaptive<
+		{ readonly node: TreeNode; readonly at: At },
+		ReadonlyArray<Found>
+	>((R, child) => ({ node, at }, level) => {
 		switch (node._tag) {
 			case "Rules":
-				return Arr.map(
-					node.rules,
-					(rule, index) => [rule, Place.at(place, "rules", index)] as const,
+				return R.succeed(
+					Arr.map(
+						node.rules,
+						(rule, index) => [rule, Place.at(at, "rules", index)] as const,
+					),
 				)
 			case "All":
 			case "Any":
 			case "FirstOf":
-				return Arr.flatMap(node.policies, (child, index) =>
-					rulesOf(child, Place.at(place, "policies", index), level + 1),
+				return R.map(
+					R.forEach(node.policies, (inner, index) =>
+						child(
+							{ node: inner, at: Place.at(at, "policies", index) },
+							level + 1,
+						),
+					),
+					Arr.flatten,
 				)
 			case "Ceiling":
-				return [
-					...rulesOf(node.cap, Place.at(place, "cap"), level + 1),
-					...rulesOf(node.policy, Place.at(place, "policy"), level + 1),
-				]
+				return R.map(
+					R.forEach(
+						[
+							{ node: node.cap, at: Place.at(at, "cap") },
+							{ node: node.policy, at: Place.at(at, "policy") },
+						],
+						(part) => child(part, level + 1),
+					),
+					Arr.flatten,
+				)
 		}
-	}
-	const memo = makeMemo()
-	return Arr.flatMap(rulesOf(root, undefined, 1), (found) =>
+	})
+	const memo = makeMemo(domain.limits)
+	return Arr.flatMap(rulesOf({ node: root, at: undefined }), (found) =>
 		Array.isArray(found)
-			? ruleIssues(domain, found[0], () => Place.pathOf(found[1]), memo)
+			? ruleIssues(domain, found[0], found[1], memo)
 			: [found as Issue],
 	)
 }