@o3co/auth.policy-verifier.builtins 0.1.1 → 0.3.0

package/dist/__tests__/rules/AttrPairEqual.test.mjs

@@ -0,0 +1,155 @@
+import { describe, expect, it } from "vitest";
+import { AttrPairEqual } from "#/rules/AttrPairEqual.mjs";
+describe("AttrPairEqual", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: verify() returns true
+    // ---------------------------------------------------------------------------
+    it("returns true when both attrs are equal non-empty strings", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // verify() returns false
+    // ---------------------------------------------------------------------------
+    it("returns false when the two strings are different", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is an empty string", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", ""],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is an empty string", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", ""],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is a number (non-string)", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", 42],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is a number (non-string)", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", 42],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is missing", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["owner", "alice"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is missing", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["subject", "alice"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is null", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", null],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is null", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", null],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrPairEqual({ a: undefined, b: "owner" })).toThrow(/AttrPairEqual.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrPairEqual({ a: 42, b: "owner" })).toThrow(/AttrPairEqual.*'a'.*got number/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrPairEqual({ a: "", b: "owner" })).toThrow(/AttrPairEqual.*'a'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'b'
+    // ---------------------------------------------------------------------------
+    it("throws when 'b' is undefined", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: undefined })).toThrow(/AttrPairEqual.*'b'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'b' is a non-string (number 42)", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: 42 })).toThrow(/AttrPairEqual.*'b'.*got number/);
+    });
+    it("throws when 'b' is an empty string", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: "" })).toThrow(/AttrPairEqual.*'b'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: "owner", group: 42 })).toThrow(/AttrPairEqual.*'group'.*got number/);
+    });
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: "owner", group: "" })).toThrow(/AttrPairEqual.*'group'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default derived from 'a' and 'b'
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType from a and b", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.ruleType).toBe("attr_pair_equal:subject:owner");
+    });
+    it("distinct a/b produce distinct default ruleTypes (AND semantics)", () => {
+        const r1 = new AttrPairEqual({ a: "subject", b: "owner" });
+        const r2 = new AttrPairEqual({ a: "subject", b: "tenant" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the default", () => {
+        const r1 = new AttrPairEqual({ a: "subject", b: "owner", group: "identity-check" });
+        const r2 = new AttrPairEqual({ a: "subject", b: "creator", group: "identity-check" });
+        expect(r1.ruleType).toBe("identity-check");
+        expect(r2.ruleType).toBe("identity-check");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_mismatch'", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.code).toBe("attr_mismatch");
+    });
+    it("message contains 'a' name, 'b' name, and the phrase 'must equal'", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.message).toContain("subject");
+        expect(rule.message).toContain("owner");
+        expect(rule.message).toContain("must equal");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/AttrPairNotEqual.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrPairNotEqual.test.d.mts.map

package/dist/__tests__/rules/AttrPairNotEqual.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairNotEqual.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrPairNotEqual.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrPairNotEqual.test.mjs

@@ -0,0 +1,155 @@
+import { describe, expect, it } from "vitest";
+import { AttrPairNotEqual } from "#/rules/AttrPairNotEqual.mjs";
+describe("AttrPairNotEqual", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: verify() returns true
+    // ---------------------------------------------------------------------------
+    it("returns true when both attrs are non-empty strings and not equal", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // verify() returns false
+    // ---------------------------------------------------------------------------
+    it("returns false when the two strings are equal", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is an empty string", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", ""],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is an empty string", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", ""],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is a number (non-string)", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", 42],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is a number (non-string)", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", 42],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is missing", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["owner", "bob"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is missing", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["subject", "alice"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is null", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", null],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is null", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", null],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrPairNotEqual({ a: undefined, b: "owner" })).toThrow(/AttrPairNotEqual.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrPairNotEqual({ a: 42, b: "owner" })).toThrow(/AttrPairNotEqual.*'a'.*got number/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrPairNotEqual({ a: "", b: "owner" })).toThrow(/AttrPairNotEqual.*'a'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'b'
+    // ---------------------------------------------------------------------------
+    it("throws when 'b' is undefined", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: undefined })).toThrow(/AttrPairNotEqual.*'b'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'b' is a non-string (number 42)", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: 42 })).toThrow(/AttrPairNotEqual.*'b'.*got number/);
+    });
+    it("throws when 'b' is an empty string", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: "" })).toThrow(/AttrPairNotEqual.*'b'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: "owner", group: 42 })).toThrow(/AttrPairNotEqual.*'group'.*got number/);
+    });
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: "owner", group: "" })).toThrow(/AttrPairNotEqual.*'group'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default derived from 'a' and 'b'
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType from a and b", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.ruleType).toBe("attr_pair_not_equal:subject:owner");
+    });
+    it("distinct a/b produce distinct default ruleTypes (AND semantics)", () => {
+        const r1 = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const r2 = new AttrPairNotEqual({ a: "subject", b: "tenant" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the default", () => {
+        const r1 = new AttrPairNotEqual({ a: "subject", b: "owner", group: "not-self" });
+        const r2 = new AttrPairNotEqual({ a: "subject", b: "creator", group: "not-self" });
+        expect(r1.ruleType).toBe("not-self");
+        expect(r2.ruleType).toBe("not-self");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_match'", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.code).toBe("attr_match");
+    });
+    it("message contains 'a' name, 'b' name, and the phrase 'must not equal'", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.message).toContain("subject");
+        expect(rule.message).toContain("owner");
+        expect(rule.message).toContain("must not equal");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/ResourceActionScopeRuleCollector.test.mjs

@@ -1,14 +1,14 @@
 import { describe, expect, it } from "vitest";
 import { ResourceActionScopeRuleCollector } from "#/rules/ResourceActionScopeRuleCollector.mjs";
-const makeContext = (resourceType, action) => ({
-    payload: {},
+const makeContext = (resourceType, action, scope) => ({
+    payload: { ...(scope !== undefined ? { scope } : {}) },
     resource: { raw: `${resourceType}:1`, resourceType, resourceId: "1" },
     action,
 });
 describe("ResourceActionScopeRuleCollector", () => {
     const collector = new ResourceActionScopeRuleCollector();
     it("creates a HasScope rule with action:resourceType", async () => {
-        const rules = await collector.collect(makeContext("document", "read"));
+        const rules = await collector.collect(makeContext("document", "read", "read:document"));
         expect(rules).toHaveLength(1);
         expect(rules[0].ruleType).toBe("scope");
         const attrs = new Map([["scopes", ["read:document"]]]);
@@ -16,12 +16,33 @@ describe("ResourceActionScopeRuleCollector", () => {
     });
     it("creates correct scope for nested resource types", async () => {
         const ctx = {
-            payload: {},
+            payload: { scope: "update:project_member" },
             resource: { raw: "project:1.member:2", resourceType: "project_member", resourceId: "2" },
             action: "update",
         };
         const rules = await collector.collect(ctx);
+        expect(rules).toHaveLength(1);
         const attrs = new Map([["scopes", ["update:project_member"]]]);
         expect(rules[0].verify(attrs)).toBe(true);
     });
+    it("returns no rules when payload has no scope claim", async () => {
+        const ctx = makeContext("document", "read");
+        // payload has no scope — simulates DID JWT
+        const rules = await collector.collect(ctx);
+        expect(rules).toHaveLength(0);
+    });
+    it("returns HasScope rule when payload has scope claim", async () => {
+        const ctx = {
+            payload: { scope: "read:document" },
+            resource: { raw: "document:1", resourceType: "document", resourceId: "1" },
+            action: "read",
+        };
+        const rules = await collector.collect(ctx);
+        expect(rules).toHaveLength(1);
+        expect(rules[0].ruleType).toBe("scope");
+    });
+    it("still generates HasScope rule when scope is empty string", async () => {
+        const rules = await collector.collect(makeContext("document", "read", ""));
+        expect(rules).toHaveLength(1);
+    });
 });

package/dist/__tests__/rules/_sharedValidation.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=_sharedValidation.test.d.mts.map

package/dist/__tests__/rules/_sharedValidation.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_sharedValidation.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/_sharedValidation.test.mts"],"names":[],"mappings":""}