@nmnmcc/ability 2.0.7 → 2.1.2

package/src/Condition.ts

@@ -49,6 +49,7 @@ import * as Catalog from "./internal/catalog.ts"
 import * as Json from "./internal/json.ts"
 import * as Nodes from "./internal/nodes.ts"
 import * as Search from "./internal/search.ts"
+import * as Trampoline from "./internal/trampoline.ts"
 import * as Resource from "./Resource.ts"
 
 /**
@@ -412,8 +413,7 @@ type ObjectPaths<
 > = [O] extends [never]
 	? never
 	: // A record is one field to a rule or a request, as `permittedFields`
-		// lists it. So is a struct at the last part that a path may have, since
-		// a path does not go below it.
+		// lists it.
 		| (Parents extends true
 				? K
 				: Arrays extends true
@@ -421,9 +421,7 @@ type ObjectPaths<
 						? K
 						: number extends keyof O
 							? K
-							: [Depth] extends [0]
-								? K
-								: never
+							: never
 					: never)
 		| `${K}.${FieldPathInternal<O, PreviousDepth[Depth], Arrays, Parents>}`
 
@@ -503,16 +501,31 @@ type Normalize<A> = Exclude<A, undefined> | (undefined extends A ? null : never)
  * @category utility types
  * @since 0.3.0
  */
-export type PathValue<T, Path extends string> = T extends unknown
-	? PathValueIn<T, Path>
+export type PathValue<T, Path extends string> = ValueWalk<T, Path>
+
+/**
+ * The values of the part `Name` of each type of `U`. A part below a value
+ * that is not an object, as below a string or `null`, is `null`.
+ */
+type StepValue<U, Name extends string> = U extends unknown
+	? U extends object
+		? ChildOf<U, Name>
+		: null
 	: never
 
-/** The type of the field at `Path` of `T`, which is not a union. */
-type PathValueIn<T, Path extends string> = T extends object
-	? Path extends `${infer Head}.${infer Rest}`
-		? PathValue<ChildOf<T, Head>, Rest>
-		: Normalize<ChildOf<T, Path>>
-	: null
+/**
+ * Walks a path two parts at a time, with the values of each step. The type
+ * checker takes at most about 1000 steps of a type that calls itself, so a
+ * walk of one part at a time would stop before a path of 1000 parts.
+ */
+type ValueWalk<
+	U,
+	Path extends string,
+> = Path extends `${infer A}.${infer B}.${infer Rest}`
+	? ValueWalk<StepValue<StepValue<U, A>, B>, Rest>
+	: Path extends `${infer A}.${infer B}`
+		? Normalize<StepValue<StepValue<U, A>, B>>
+		: Normalize<StepValue<U, Path>>
 
 /**
  * The type of the part `Name` of `T`. A part of a path is text, so the part
@@ -528,6 +541,215 @@ type ChildOf<T, Name extends string> = Name extends keyof T
 				: never
 		: never
 
+/**
+ * What a path may do, for one use of it: go below a list or a whole value,
+ * as a rule or a request may, and end at a struct, as the fields of a rule
+ * may. See {@link FieldPath}, {@link FieldSelector} and {@link FieldName},
+ * which list the short paths with the same rules.
+ */
+interface PathRules {
+	readonly arrays: boolean
+	readonly parents: boolean
+}
+
+/** The rules of a path that a condition reads. */
+interface ReadRules {
+	readonly arrays: false
+	readonly parents: false
+}
+
+/** The rules of the field of a request. */
+interface SelectRules {
+	readonly arrays: true
+	readonly parents: false
+}
+
+/** The rules of a field of a rule, which may name a struct. */
+interface NameRules {
+	readonly arrays: true
+	readonly parents: true
+}
+
+/** The objects below a field with the values `V`: see `PathsOf`. */
+type ObjectsBelow<V, Arrays extends boolean> = Arrays extends true
+	? Exclude<V, Leaf | Whole | Function | ReadonlyArray<unknown>>
+	: [Extract<V, Whole | Function | ReadonlyArray<unknown>>] extends [never]
+		? Exclude<V, Leaf>
+		: never
+
+/** Tests if `Name` names a field of every object of `O`, as `keyof` does. */
+type HasPart<O, Name extends string> = Name extends keyof O
+	? true
+	: Name extends `${infer N extends number}`
+		? N extends keyof O
+			? true
+			: number extends keyof O
+				? true
+				: false
+		: false
+
+/**
+ * The objects below the part `Name` of the objects `O`, for a path that goes
+ * on, or `never` when it can not go on.
+ */
+type PathStep<O, Name extends string, R extends PathRules> =
+	HasPart<O, Name> extends true
+		? ObjectsBelow<NonNullable<ChildOf<O, Name>>, R["arrays"]>
+		: never
+
+/** Tests if a path may end at a field with the values `V`: see `PathsOf`. */
+type EndsAt<V, R extends PathRules, Last extends boolean> = [V] extends [never]
+	? true
+	: {} extends V
+		? true
+		: [Extract<V, Leaf | Whole>] extends [never]
+			? R["arrays"] extends true
+				? [Extract<V, ReadonlyArray<unknown>>] extends [never]
+					? EndsAtObjects<ObjectsBelow<V, true>, R, Last>
+					: true
+				: false
+			: true
+
+/**
+ * Tests if a path may end at a field that holds the objects `O`: a field of a
+ * rule may name a struct, and a request may name a record, or a struct at
+ * the last part that a path may have.
+ */
+type EndsAtObjects<O, R extends PathRules, Last extends boolean> = [O] extends [
+	never,
+]
+	? false
+	: R["parents"] extends true
+		? true
+		: string extends keyof O
+			? true
+			: number extends keyof O
+				? true
+				: Last
+
+/** The paths one part below `Done`, as the names that may come next. */
+type NextNames<O, Done extends string> = `${Done}${keyof O & (string | number)}`
+
+/**
+ * Walks a path two parts at a time, from the objects `O`. It gives `true`
+ * for a path that the rules `R` take, or the names that may come next after
+ * the last good part. `Count` counts the parts before `F`, so the walk knows
+ * the last part that a path may have: part 1000, the default of
+ * `Limits.fieldPathParts`.
+ */
+type PathWalk<
+	O,
+	F extends string,
+	Done extends string,
+	R extends PathRules,
+	Count extends ReadonlyArray<0>,
+> = F extends `${infer A}.${infer B}.${infer Rest}`
+	? PathStep<O, A, R> extends infer O1
+		? [O1] extends [never]
+			? NextNames<O, Done>
+			: PathStep<O1, B, R> extends infer O2
+				? [O2] extends [never]
+					? NextNames<O1, `${Done}${A}.`>
+					: PathWalk<O2, Rest, `${Done}${A}.${B}.`, R, [...Count, 0, 0]>
+				: never
+		: never
+	: F extends `${infer A}.${infer B}`
+		? PathStep<O, A, R> extends infer O1
+			? [O1] extends [never]
+				? NextNames<O, Done>
+				: PathEnd<O1, B, `${Done}${A}.`, R, [...Count, 0]>
+			: never
+		: PathEnd<O, F, Done, R, Count>
+
+type PathEnd<
+	O,
+	Name extends string,
+	Done extends string,
+	R extends PathRules,
+	Count extends ReadonlyArray<0>,
+> =
+	HasPart<O, Name> extends true
+		? EndsAt<
+				NonNullable<ChildOf<O, Name>>,
+				R,
+				Count["length"] extends 999 ? true : false
+			> extends true
+			? true
+			: // The name is a field, but a path may not end at it, as at a struct
+				// for a condition: the paths below it may come next. The names of
+				// this place would hold the name itself.
+				NextNames<
+					ObjectsBelow<NonNullable<ChildOf<O, Name>>, R["arrays"]>,
+					`${Done}${Name}.`
+				>
+		: NextNames<O, Done>
+
+/**
+ * Checks one field path `F` of `T`, of any length up to about 1000 parts.
+ * It gives `F` for a path that the rules `R` take. For another path, it gives
+ * the paths that may come next after its last good part, so a type error
+ * names them. For a union of types, a part must be in each of them.
+ */
+type PathCheck<T, F extends string, R extends PathRules> = [T] extends [object]
+	? // Each path of a union of paths, as of a field typed `FieldSelector`,
+		// is checked by itself.
+		F extends unknown
+		? PathWalk<T, F, "", R, []> extends true
+			? F
+			: // The names come from parts of `F`. Inference must not find `F`
+				// in them, so a call gets its `F` from the path that it gives.
+				NoInfer<PathWalk<T, F, "", R, []>>
+		: never
+	: never
+
+/**
+ * A path of `T` that a condition may read, as one of {@link FieldPath}, of
+ * any length up to about 1000 parts. It is `F` when `F` is such a path, and
+ * the names that may come next when it is not.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 2.1.0
+ */
+export type ReadPath<T, F extends string> = PathCheck<T, F, ReadRules>
+
+/**
+ * A path of `T` that a request may name, as one of {@link FieldSelector}, of
+ * any length up to about 1000 parts. See {@link ReadPath}.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 2.1.0
+ */
+export type SelectPath<T, F extends string> = PathCheck<T, F, SelectRules>
+
+/**
+ * A path of `T` that a field of a rule may name, as one of
+ * {@link FieldName}, of any length up to about 1000 parts. See
+ * {@link ReadPath}.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 2.1.0
+ */
+export type NamePath<T, F extends string> = PathCheck<T, F, NameRules>
+
+/** A path that a condition may read, with an ordered value. */
+type OrderedReadPath<T, F extends string> =
+	ReadPath<T, F> extends F
+		? Exclude<PathValue<T, F>, null> extends number | string
+			? F
+			: never
+		: ReadPath<T, F>
+
+/** A path that a condition may read, with a scalar value. */
+type ScalarReadPath<T, F extends string> =
+	ReadPath<T, F> extends F
+		? PathValue<T, F> extends Scalar
+			? F
+			: never
+		: ReadPath<T, F>
+
 /**
  * A value for a field of type `A`: a fixed value, or a field of the principal
  * with the same type.
@@ -538,16 +760,6 @@ type ChildOf<T, Name extends string> = Name extends keyof T
  */
 export type OperandOf<A, P = never> = Extract<A, Scalar> | Ref<A, P>
 
-type ScalarPath<T> = {
-	[F in FieldPath<T>]: PathValue<T, F> extends Scalar ? F : never
-}[FieldPath<T>]
-
-type OrderedPath<T> = {
-	[F in FieldPath<T>]: Exclude<PathValue<T, F>, null> extends number | string
-		? F
-		: never
-}[FieldPath<T>]
-
 /**
  * A test made by a {@link Builder}. It runs no code, but it keeps the value
  * type of its resource, so a test on the fields of one resource can not go
@@ -584,58 +796,60 @@ type PrincipalOf<V, _P> = [Extract<V, PrincipalRef>] extends [never]
 export interface Builder<Data, Value, P> {
 	/** The field is equal to the value. */
 	readonly eq: <
-		const F extends FieldPath<Data>,
+		const F extends string,
 		const V extends OperandOf<FieldValue<Data, F>, any>,
 	>(
-		field: F,
+		field: ReadPath<Data, F>,
 		value: V,
 	) => Test<Value, PrincipalOf<V, P>>
 	/** The field is not equal to the value. */
 	readonly ne: <
-		const F extends FieldPath<Data>,
+		const F extends string,
 		const V extends OperandOf<FieldValue<Data, F>, any>,
 	>(
-		field: F,
+		field: ReadPath<Data, F>,
 		value: V,
 	) => Test<Value, PrincipalOf<V, P>>
 	readonly lt: <
-		const F extends OrderedPath<Data>,
+		const F extends string,
 		const V extends OperandOf<Exclude<FieldValue<Data, F>, null>, any>,
 	>(
-		field: F,
+		field: OrderedReadPath<Data, F>,
 		value: V,
 	) => Test<Value, PrincipalOf<V, P>>
 	readonly lte: <
-		const F extends OrderedPath<Data>,
+		const F extends string,
 		const V extends OperandOf<Exclude<FieldValue<Data, F>, null>, any>,
 	>(
-		field: F,
+		field: OrderedReadPath<Data, F>,
 		value: V,
 	) => Test<Value, PrincipalOf<V, P>>
 	readonly gt: <
-		const F extends OrderedPath<Data>,
+		const F extends string,
 		const V extends OperandOf<Exclude<FieldValue<Data, F>, null>, any>,
 	>(
-		field: F,
+		field: OrderedReadPath<Data, F>,
 		value: V,
 	) => Test<Value, PrincipalOf<V, P>>
 	readonly gte: <
-		const F extends OrderedPath<Data>,
+		const F extends string,
 		const V extends OperandOf<Exclude<FieldValue<Data, F>, null>, any>,
 	>(
-		field: F,
+		field: OrderedReadPath<Data, F>,
 		value: V,
 	) => Test<Value, PrincipalOf<V, P>>
 	/** The field is equal to one of the values. */
 	readonly in: <
-		const F extends FieldPath<Data>,
+		const F extends string,
 		const Vs extends ReadonlyArray<OperandOf<FieldValue<Data, F>, any>>,
 	>(
-		field: F,
+		field: ReadPath<Data, F>,
 		values: Vs,
 	) => Test<Value, PrincipalOf<Vs[number], P>>
 	/** The field has a value that is not `null`. */
-	readonly exists: <const F extends FieldPath<Data>>(field: F) => Test<Value>
+	readonly exists: <const F extends string>(
+		field: ReadPath<Data, F>,
+	) => Test<Value>
 	/** The path of the resource starts with these parts. */
 	readonly under: <
 		const Ps extends ReadonlyArray<string | null | Ref<string | null, any>>,
@@ -646,8 +860,8 @@ export interface Builder<Data, Value, P> {
 	 * A field of the principal, to use as a value. The field must have a
 	 * {@link Scalar} type.
 	 */
-	readonly principal: <const F extends ScalarPath<P>>(
-		field: F,
+	readonly principal: <const F extends string>(
+		field: ScalarReadPath<P, F>,
 	) => Ref<PathValue<P, F>, P>
 	readonly and: <const Cs extends ReadonlyArray<Any>>(
 		...conditions: Cs
@@ -992,50 +1206,65 @@ const literalValue = (operand: Operand, field: string): Scalar => {
 	return operand.value
 }
 
-/** Folds a condition. A shared child is folded again for each place. */
-const foldNode = <A>(node: Nodes.Node, interpreter: Interpreter<A>): A => {
-	switch (node._tag) {
-		case "True":
-			return interpreter.true()
-		case "False":
-			return interpreter.false()
-		case "Compare":
-			return interpreter.compare(
-				node.op,
-				node.field,
-				literalValue(node.value, node.field),
-			)
-		case "In":
-			return interpreter.in(
-				node.field,
-				Arr.map(node.values, (operand) => literalValue(operand, node.field)),
-			)
-		case "Exists":
-			return interpreter.exists(node.field)
-		case "Under":
-			throw Untranslatable.make({
-				reason:
-					"An Under node needs the resource path. Call Condition.partial first.",
-			})
-		case "And":
-			return interpreter.and(
-				Arr.map(node.conditions, (child) => foldNode(child, interpreter)),
-			)
-		case "Or":
-			return interpreter.or(
-				Arr.map(node.conditions, (child) => foldNode(child, interpreter)),
-			)
-		case "Not":
-			return interpreter.not(foldNode(node.condition, interpreter))
-		case "Predicate":
-			if (interpreter.predicate === undefined) {
-				throw Untranslatable.make({
-					reason: `The predicate "${node.name}" can not become a query`,
-				})
+/**
+ * Folds a condition. A shared child is folded again for each place. The walk
+ * takes the steps of a trampoline, so a deep condition does not fill the
+ * stack.
+ */
+const foldNode = <A>(root: Nodes.Node, interpreter: Interpreter<A>): A =>
+	Trampoline.run(root.depth, (R) => {
+		const go = (node: Nodes.Node): Trampoline.Step<A> => {
+			const children = (nodes: ReadonlyArray<Nodes.Node>) =>
+				R.forEach(nodes, (child) => R.suspend(() => go(child)))
+			switch (node._tag) {
+				case "True":
+					return R.succeed(interpreter.true())
+				case "False":
+					return R.succeed(interpreter.false())
+				case "Compare":
+					return R.succeed(
+						interpreter.compare(
+							node.op,
+							node.field,
+							literalValue(node.value, node.field),
+						),
+					)
+				case "In":
+					return R.succeed(
+						interpreter.in(
+							node.field,
+							Arr.map(node.values, (operand) =>
+								literalValue(operand, node.field),
+							),
+						),
+					)
+				case "Exists":
+					return R.succeed(interpreter.exists(node.field))
+				case "Under":
+					throw Untranslatable.make({
+						reason:
+							"An Under node needs the resource path. Call Condition.partial first.",
+					})
+				case "And":
+					return R.map(children(node.conditions), interpreter.and)
+				case "Or":
+					return R.map(children(node.conditions), interpreter.or)
+				case "Not":
+					return R.map(
+						R.suspend(() => go(node.condition)),
+						interpreter.not,
+					)
+				case "Predicate":
+					if (interpreter.predicate === undefined) {
+						throw Untranslatable.make({
+							reason: `The predicate "${node.name}" can not become a query`,
+						})
+					}
+					return R.succeed(interpreter.predicate(node.name))
 			}
-			return interpreter.predicate(node.name)
-	}
-}
+		}
+		return go(root)
+	})
 
 /**
  * Changes a condition into another form with an interpreter. Call
@@ -1220,9 +1449,11 @@ export type PlainCondition = Condition<any>
  * The Schema of a condition with no predicate. It checks the shape only. Use
  * `Policy.schema` to check the field names against a domain too.
  *
- * The decoder takes at most 500 levels of conditions, and at most 1000000
- * objects and array items, with a shared object counted for each place. It
- * reads only the own data fields of the input.
+ * The decoder takes the default limits: at most `conditionNodes` nodes,
+ * 1000000, and `jsonNodes` objects and array items, 10000000, with a shared
+ * object counted for each place. It stops at the first one past a limit. It
+ * takes any number of levels, and it reads only the own data fields of the
+ * input. Use `Policy.schema` for the limits of a domain.
  *
  * @stability stable
  * @category schemas

package/src/Domain.ts

@@ -18,6 +18,7 @@ import type * as HashMap from "effect/HashMap"
 import type * as Schema from "effect/Schema"
 import type * as Catalog from "./internal/catalog.ts"
 import * as Internal from "./internal/domain.ts"
+import type * as Limits from "./Limits.ts"
 import type * as Resource from "./Resource.ts"
 
 /** The Schema of a principal: a Schema of objects, such as a `Schema.Class`. */
@@ -42,6 +43,8 @@ export interface Domain<
 	/** The descriptor of each resource, by its kind name. */
 	readonly resources: HashMap.HashMap<string, Resource.Descriptor>
 	readonly meta: Schema.Top | undefined
+	/** The limits of the domain: see `Limits`. */
+	readonly limits: Limits.Limits
 	readonly "~Domain"?: {
 		readonly Principal: P
 		readonly Resources: Resources
@@ -174,6 +177,11 @@ export type AnyValue<D> = Resource.Value<Resources<D>>
  * may not need services, because `Policy.schema` gives a Schema that needs
  * none.
  *
+ * Give `limits` to set the limits of the domain, as
+ * `{ limits: { fieldPathParts: 2000 } }`. Each one is a whole number from 1
+ * up to its ceiling in `Limits.ceilings`, and a limit that you leave out has
+ * its default. A wrong value is a defect.
+ *
  * @stability stable
  * @category constructors
  * @since 0.3.0
@@ -186,4 +194,5 @@ export const make: <
 	readonly principal: P
 	readonly resources: Resources
 	readonly meta?: M
+	readonly limits?: Partial<Limits.Limits>
 }) => Domain<P["Type"], Resources[number], M["Type"]> = Internal.make as never