@nmnmcc/ability 2.0.7 → 2.1.2

package/src/internal/decide.ts

@@ -19,7 +19,8 @@ import type * as Policy from "../Policy.ts"
 import type * as Resource from "../Resource.ts"
 import * as Catalog from "./catalog.ts"
 import * as DomainData from "./domain.ts"
-import type * as PolicyNodes from "./policy-nodes.ts"
+import * as Place from "./place.ts"
+import * as PolicyNodes from "./policy-nodes.ts"
 import { nodeOf } from "./policy.ts"
 import * as ResourceData from "./resource.ts"
 import * as RuleData from "./rule.ts"
@@ -39,14 +40,23 @@ interface DecideContext {
 	readonly descriptor: Resource.Descriptor
 	/** The test of `RuleData.fitsOf` for the catalog, for this decision. */
 	readonly fits: (pattern: string) => boolean
+	/** The most parts of a field path in the domain. */
+	readonly parts: number
 	/** The rules that were tested, for {@link explain}. */
 	readonly trace: Ref.Ref<Chunk.Chunk<Step>> | undefined
 }
 
+/**
+ * The place of a node or a rule in a tree: the index of each child, then
+ * the index of the rule. It shares the path of its parent, and a decision
+ * makes the full path only for a step of `explain`: see `Place`.
+ */
+type At = Place.Place | undefined
+
 const ruleApplies = (
 	value: RuleData.Rule,
 	context: DecideContext,
-	path: ReadonlyArray<number>,
+	at: Place.Place,
 ): Effect.Effect<boolean, unknown, unknown> => {
 	if (!RuleData.matchesTarget(value, context)) {
 		return Effect.succeed(false)
@@ -62,7 +72,14 @@ const ruleApplies = (
 		? test
 		: Effect.tap(test, (applies) =>
 				// A chunk adds a step with no copy of the steps before.
-				Ref.update(trace, Chunk.append({ path, rule: typed(value), applies })),
+				Ref.update(
+					trace,
+					Chunk.append({
+						path: Place.pathOf(at) as ReadonlyArray<number>,
+						rule: typed(value),
+						applies,
+					}),
+				),
 			)
 }
 
@@ -80,11 +97,11 @@ const fromRule = (value: RuleData.Rule): Decision.Decision =>
 const firstApplying = (
 	candidates: ReadonlyArray<readonly [RuleData.Rule, number]>,
 	context: DecideContext,
-	path: ReadonlyArray<number>,
+	at: At,
 ): Effect.Effect<Option.Option<RuleData.Rule>, unknown, unknown> =>
 	Effect.map(
 		Effect.findFirst(candidates, ([value, index]) =>
-			ruleApplies(value, context, [...path, index]),
+			ruleApplies(value, context, Place.at(at, index)),
 		),
 		Option.map(([value]) => value),
 	)
@@ -99,13 +116,13 @@ const orElse = <A, E, R>(
 const decideRules = (
 	node: PolicyNodes.Rules,
 	context: DecideContext,
-	path: ReadonlyArray<number>,
+	at: At,
 ): Effect.Effect<Decision.Decision, unknown, unknown> => {
 	const indexed = Arr.map(node.rules, (value, index) => [value, index] as const)
 	const denies = Arr.filter(indexed, ([value]) => value._tag === "Deny")
 	const allows = Arr.filter(indexed, ([value]) => value._tag === "Allow")
 	const first = (candidates: ReadonlyArray<readonly [RuleData.Rule, number]>) =>
-		firstApplying(candidates, context, path)
+		firstApplying(candidates, context, at)
 	const found = (() => {
 		switch (node.algorithm) {
 			case "denyOverrides":
@@ -138,7 +155,7 @@ type WalkStep<S> =
 const walkChildren = <S>(
 	children: ReadonlyArray<PolicyNodes.Node>,
 	context: DecideContext,
-	path: ReadonlyArray<number>,
+	at: At,
 	start: S,
 	step: (state: S, decision: Decision.Decision) => WalkStep<S>,
 	end: (state: S) => Decision.Decision,
@@ -150,7 +167,11 @@ const walkChildren = <S>(
 		index === children.length
 			? Effect.succeed(end(state))
 			: Effect.flatMap(
-					decideNode(children[index]!, context, [...path, index]),
+					// Each call for a child is a step of the Effect, so a deep tree
+					// does not fill the stack.
+					Effect.suspend(() =>
+						decideNode(children[index]!, context, Place.at(at, index)),
+					),
 					(decision) => {
 						const next = step(state, decision)
 						return next._tag === "Stop"
@@ -176,17 +197,17 @@ const next = <S>(state: S): WalkStep<S> => ({ _tag: "Next", state })
 export const decideNode = (
 	node: PolicyNodes.Node,
 	context: DecideContext,
-	path: ReadonlyArray<number>,
+	at: At,
 ): Effect.Effect<Decision.Decision, unknown, unknown> => {
 	switch (node._tag) {
 		case "Rules":
-			return decideRules(node, context, path)
+			return decideRules(node, context, at)
 		case "All":
 			// One deny is enough to deny. Every child must allow.
 			return walkChildren(
 				node.policies,
 				context,
-				path,
+				at,
 				{
 					firstAllow: Option.none<Decision.Decision>(),
 					allAllow: node.policies.length > 0,
@@ -212,7 +233,7 @@ export const decideNode = (
 			return walkChildren(
 				node.policies,
 				context,
-				path,
+				at,
 				Option.none<Decision.Decision>(),
 				(firstDeny, decision) =>
 					decision._tag === "Allow"
@@ -231,7 +252,7 @@ export const decideNode = (
 			return walkChildren(
 				node.policies,
 				context,
-				path,
+				at,
 				undefined,
 				(_, decision) =>
 					decision._tag === "NotApplicable" ? next(undefined) : stop(decision),
@@ -240,9 +261,9 @@ export const decideNode = (
 		case "Ceiling":
 			// A deny of the cap wins. Else the policy decides.
 			return Effect.filterOrElse(
-				decideNode(node.cap, context, [...path, 0]),
+				Effect.suspend(() => decideNode(node.cap, context, Place.at(at, 0))),
 				(capped) => capped._tag === "Deny",
-				() => decideNode(node.policy, context, [...path, 1]),
+				() => decideNode(node.policy, context, Place.at(at, 1)),
 			)
 	}
 }
@@ -254,10 +275,11 @@ export const decideNode = (
 export const fitsKind = (
 	descriptor: Resource.Descriptor,
 	request: { readonly action: string; readonly field?: string | undefined },
+	parts: number,
 ): boolean =>
 	descriptor.actions.includes(request.action) &&
 	(request.field === undefined ||
-		(Catalog.lookup(descriptor.catalog, request.field)?.listed ?? false))
+		(Catalog.lookup(descriptor.catalog, request.field, parts)?.listed ?? false))
 
 const makeContext = (
 	domain: Domain.Any,
@@ -270,7 +292,7 @@ const makeContext = (
 	if (
 		kind === undefined ||
 		descriptor === undefined ||
-		!fitsKind(descriptor, request)
+		!fitsKind(descriptor, request, domain.limits.fieldPathParts)
 	) {
 		return undefined
 	}
@@ -284,7 +306,8 @@ const makeContext = (
 			path: descriptor.path,
 		},
 		descriptor,
-		fits: RuleData.fitsOf(descriptor.catalog),
+		fits: RuleData.fitsOf(descriptor.catalog, domain.limits.fieldPathParts),
+		parts: domain.limits.fieldPathParts,
 		trace,
 	}
 }
@@ -298,7 +321,7 @@ export const decideAny = (
 		const context = makeContext(policy.domain, request, undefined)
 		return context === undefined
 			? Effect.succeed(Decision.NotApplicable)
-			: decideNode(nodeOf(policy), context, [])
+			: decideNode(nodeOf(policy), context, undefined)
 	})
 
 /** Gives the decision of a policy with no predicates, at once. */
@@ -326,7 +349,7 @@ export const explain = (
 		if (context === undefined) {
 			return { decision: Decision.NotApplicable, steps: [] }
 		}
-		const decision = yield* decideNode(nodeOf(policy), context, [])
+		const decision = yield* decideNode(nodeOf(policy), context, undefined)
 		return { decision, steps: Chunk.toReadonlyArray(yield* Ref.get(trace)) }
 	})
 
@@ -334,35 +357,19 @@ export const explain = (
  * Tests if a deny rule of the request names a part inside `field`.
  */
 const deniesInside = (
-	node: PolicyNodes.Node,
+	rules: ReadonlyArray<RuleData.Rule>,
 	target: { readonly action: string; readonly kind: string },
 	field: string,
-): boolean => {
-	switch (node._tag) {
-		case "Rules":
-			return node.rules.some(
-				(value) =>
-					value._tag === "Deny" &&
-					value.fields !== undefined &&
-					value.fields.some((pattern) =>
-						RuleData.matchesInside(pattern, field),
-					) &&
-					(value.actions.includes("*") ||
-						value.actions.includes(target.action)) &&
-					(value.resources.includes("*") ||
-						value.resources.includes(target.kind)),
-			)
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return node.policies.some((child) => deniesInside(child, target, field))
-		case "Ceiling":
-			return (
-				deniesInside(node.cap, target, field) ||
-				deniesInside(node.policy, target, field)
-			)
-	}
-}
+): boolean =>
+	Arr.some(
+		rules,
+		(value) =>
+			value._tag === "Deny" &&
+			value.fields !== undefined &&
+			value.fields.some((pattern) => RuleData.matchesInside(pattern, field)) &&
+			(value.actions.includes("*") || value.actions.includes(target.action)) &&
+			(value.resources.includes("*") || value.resources.includes(target.kind)),
+	)
 
 /** Gives the fields of a resource value that the policy lets a request use. */
 export const permittedFields = (
@@ -377,9 +384,13 @@ export const permittedFields = (
 	if (descriptor === undefined) {
 		return Effect.succeed([])
 	}
+	// The rules of the tree, in one flat list for all the fields.
+	const rules = policy.pipe(nodeOf, PolicyNodes.rulesOf)
 	// The fields with names only: a list can not name every key of a record.
 	const listed = Arr.filter(
-		descriptor.catalog.fields,
+		// The list for the limit of the parts of a path of the domain, as the
+		// decision of each field reads it.
+		Catalog.fieldsOf(descriptor.catalog, policy.domain.limits.fieldPathParts),
 		(field) =>
 			field.listed &&
 			Arr.every(field.path, (segment) => typeof segment === "string"),
@@ -393,7 +404,7 @@ export const permittedFields = (
 					!(
 						field.open &&
 						deniesInside(
-							nodeOf(policy),
+							rules,
 							{ ...request, kind: descriptor.kind },
 							field.text,
 						)

package/src/internal/domain.ts

@@ -9,6 +9,7 @@ import type * as Schema from "effect/Schema"
 import type * as Domain from "../Domain.ts"
 import type * as Resource from "../Resource.ts"
 import * as Catalog from "./catalog.ts"
+import * as Limits from "./limits.ts"
 import * as ResourceData from "./resource.ts"
 
 /** The class of every domain value. `isDomain` uses it to know a domain. */
@@ -17,14 +18,38 @@ class DomainData extends Data.Class<{
 	readonly principalCatalog: Catalog.Catalog
 	readonly resources: HashMap.HashMap<string, Resource.Descriptor>
 	readonly meta: Schema.Top | undefined
+	readonly limits: Limits.Limits
 }> {}
 
-/** Makes a domain. Each resource must have its own kind name. */
+/** Stops a catalog with more fields in its list than the domain takes. */
+const checkCatalog = (
+	catalog: Catalog.Catalog,
+	limits: Limits.Limits,
+	name: string,
+): void => {
+	const fields = Catalog.fieldsOf(catalog, limits.fieldPathParts).length
+	if (fields > limits.catalogFields) {
+		throw Limits.exceeded(
+			name,
+			"catalogFields",
+			"fields",
+			fields,
+			limits.catalogFields,
+		)
+	}
+}
+
+/**
+ * Makes a domain. Each resource must have its own kind name. The limits that
+ * the domain does not set have their defaults.
+ */
 export const make = (options: {
 	readonly principal: Schema.Top
 	readonly resources: ReadonlyArray<Resource.Any>
 	readonly meta?: Schema.Top
+	readonly limits?: Partial<Limits.Limits>
 }): DomainData => {
+	const limits = Limits.make(options.limits)
 	const descriptors = Arr.map(options.resources, ResourceData.descriptor)
 	const kinds = Arr.map(descriptors, (descriptor) => descriptor.kind)
 	// Two resources with one kind name is a mistake in the code, not in the
@@ -46,12 +71,23 @@ export const make = (options: {
 		),
 	)
 	// The catalog checks the field names of the principal, so a bad name is a
-	// defect when the domain is made.
+	// defect when the domain is made. A Schema with more fields than the
+	// domain takes is a defect too.
+	const principalCatalog = Catalog.catalogOf(options.principal.ast)
+	checkCatalog(principalCatalog, limits, "The Schema of the principal")
+	Arr.forEach(descriptors, (descriptor) =>
+		checkCatalog(
+			descriptor.catalog,
+			limits,
+			`The Schema of the resource "${descriptor.kind}"`,
+		),
+	)
 	return new DomainData({
 		principal: options.principal,
-		principalCatalog: Catalog.catalogOf(options.principal.ast),
+		principalCatalog,
 		resources,
 		meta: options.meta,
+		limits,
 	})
 }