@o3co/auth.policy-verifier.builtins 0.1.1 → 0.3.0

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -0,0 +1,36 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralNotEqualConfig {
+    a: string;
+    v: LiteralValue;
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the type of the
+ * configured literal value, and is strictly NOT equal to it. No type coercion
+ * is performed. If the attribute is missing, null, or of the wrong type the
+ * rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)`:
+ *   `attr_literal_not_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment prevents silent `ruleType` collisions between
+ * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
+ * which would otherwise be OR-combined by the evaluator against the intent
+ * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrLiteralNotEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_equal";
+    readonly message: string;
+    constructor(config: AttrLiteralNotEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralNotEqual.d.mts.map

package/dist/rules/AttrLiteralNotEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAKnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,yBAAyB;IAU9D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralNotEqual.mjs

@@ -0,0 +1,42 @@
+import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, matches the type of the
+ * configured literal value, and is strictly NOT equal to it. No type coercion
+ * is performed. If the attribute is missing, null, or of the wrong type the
+ * rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `typeof v`, and
+ * `String(v)`:
+ *   `attr_literal_not_equal:{a}:{typeof v}:{String(v)}`
+ *
+ * The `typeof v` segment prevents silent `ruleType` collisions between
+ * different-type literals that stringify the same way (e.g. `1` vs `"1"`),
+ * which would otherwise be OR-combined by the evaluator against the intent
+ * of two independent constraints. See AttrLiteralEqual for the same rationale.
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export class AttrLiteralNotEqual {
+    config;
+    ruleType;
+    code = "attr_equal";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralNotEqual", "a", config.a);
+        requireLiteralValue("AttrLiteralNotEqual", "v", config.v);
+        const group = requireOptionalGroup("AttrLiteralNotEqual", config.group);
+        this.ruleType =
+            group ?? `attr_literal_not_equal:${config.a}:${typeof config.v}:${String(config.v)}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must not equal ${String(config.v)}.`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== typeof this.config.v)
+            return false;
+        return x !== this.config.v;
+    }
+}

package/dist/rules/AttrLiteralNotIn.d.mts

@@ -0,0 +1,33 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type LiteralValue } from "./_sharedValidation.mjs";
+export interface AttrLiteralNotInConfig {
+    a: string;
+    values: LiteralValue[];
+    group?: string;
+}
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is NOT included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_not_in:{a}:{valuesKey}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrLiteralNotIn implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_in_set";
+    readonly message: string;
+    private readonly elementType;
+    private readonly valuesSet;
+    constructor(config: AttrLiteralNotInConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrLiteralNotIn.d.mts.map

package/dist/rules/AttrLiteralNotIn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAQhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAEjB,MAAM,EAAE,sBAAsB;IAa3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAKlC"}

package/dist/rules/AttrLiteralNotIn.mjs

@@ -0,0 +1,41 @@
+import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when a named attribute is present, matches the element type
+ * of the configured values array, and is NOT included in that array. No type
+ * coercion is performed. If the attribute is missing, null, or of the wrong
+ * type the rule returns false (safe-deny).
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and a stable
+ * content-hash key over the values array:
+ *   `attr_literal_not_in:{a}:{valuesKey}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrLiteralNotIn {
+    config;
+    ruleType;
+    code = "attr_in_set";
+    message;
+    elementType;
+    valuesSet;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrLiteralNotIn", "a", config.a);
+        const values = requireHomogeneousLiteralArray("AttrLiteralNotIn", config.values);
+        const group = requireOptionalGroup("AttrLiteralNotIn", config.group);
+        this.elementType = typeof values[0];
+        this.valuesSet = new Set(values);
+        const valuesKey = computeValuesKey(values);
+        this.ruleType = group ?? `attr_literal_not_in:${config.a}:${valuesKey}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must not be one of [${values.map(String).join(", ")}].`;
+    }
+    verify(attrs) {
+        const x = attrs.get(this.config.a);
+        if (typeof x !== this.elementType)
+            return false;
+        return !this.valuesSet.has(x);
+    }
+}

package/dist/rules/AttrMatchRule.d.mts

@@ -0,0 +1,15 @@
+import { AttrPairEqual, type AttrPairEqualConfig } from "./AttrPairEqual.mjs";
+export type AttrMatchRuleConfig = AttrPairEqualConfig;
+/**
+ * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.
+ *
+ * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
+ * and legacy `message` wording. `verify()` semantics are inherited unchanged from
+ * `AttrPairEqual`: both named attributes must be non-empty strings and equal.
+ */
+export declare class AttrMatchRule extends AttrPairEqual {
+    readonly ruleType: string;
+    readonly message: string;
+    constructor(config: AttrMatchRuleConfig);
+}
+//# sourceMappingURL=AttrMatchRule.d.mts.map

package/dist/rules/AttrMatchRule.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrMatchRule.d.mts","sourceRoot":"","sources":["../../src/rules/AttrMatchRule.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAC/C,SAAkB,QAAQ,EAAE,MAAM,CAAC;IACnC,SAAkB,OAAO,EAAE,MAAM,CAAC;gBAEtB,MAAM,EAAE,mBAAmB;CAKvC"}

package/dist/rules/AttrMatchRule.mjs

@@ -0,0 +1,17 @@
+import { AttrPairEqual } from "./AttrPairEqual.mjs";
+/**
+ * @deprecated Use {@link AttrPairEqual}. Scheduled for removal in a future major version.
+ *
+ * Kept as a thin wrapper that preserves the legacy `ruleType` (`attr_match:{a}:{b}`)
+ * and legacy `message` wording. `verify()` semantics are inherited unchanged from
+ * `AttrPairEqual`: both named attributes must be non-empty strings and equal.
+ */
+export class AttrMatchRule extends AttrPairEqual {
+    ruleType;
+    message;
+    constructor(config) {
+        super(config);
+        this.ruleType = config.group ?? `attr_match:${config.a}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} and ${config.b} must both be non-empty strings and equal.`;
+    }
+}

package/dist/rules/AttrPairCompare.d.mts

@@ -0,0 +1,35 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+import { type CompareOp } from "./_sharedValidation.mjs";
+export interface AttrPairCompareConfig {
+    a: string;
+    op: CompareOp;
+    b: string;
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are both numbers,
+ * and satisfy the configured comparison operator. NaN on either side always
+ * returns false (JS native comparison semantics). Missing, null, or non-number
+ * attributes return false (safe-deny).
+ *
+ * Unlike AttrLiteralCompare, the right-hand side comes from the attributes map
+ * at evaluation time rather than from a static config value — so NaN is not
+ * rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `b`:
+ *   `attr_pair_compare:{a}:{op}:{b}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export declare class AttrPairCompare implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_compare_violated";
+    readonly message: string;
+    constructor(config: AttrPairCompareConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrPairCompare.d.mts.map

package/dist/rules/AttrPairCompare.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairCompare.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairCompare.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAEN,KAAK,SAAS,EAId,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACrC,CAAC,EAAE,MAAM,CAAC;IACV,EAAE,EAAE,SAAS,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAgB,YAAW,IAAI;IAK/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,qBAAqB;IAU1D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrPairCompare.mjs

@@ -0,0 +1,43 @@
+import { applyCompare, requireAttrName, requireCompareOp, requireOptionalGroup, } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when two named attributes are present, are both numbers,
+ * and satisfy the configured comparison operator. NaN on either side always
+ * returns false (JS native comparison semantics). Missing, null, or non-number
+ * attributes return false (safe-deny).
+ *
+ * Unlike AttrLiteralCompare, the right-hand side comes from the attributes map
+ * at evaluation time rather than from a static config value — so NaN is not
+ * rejected at construction time.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a`, `op`, and `b`:
+ *   `attr_pair_compare:{a}:{op}:{b}`
+ *
+ * Pass an explicit `group` string to override the default ruleType entirely.
+ */
+export class AttrPairCompare {
+    config;
+    ruleType;
+    code = "attr_compare_violated";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrPairCompare", "a", config.a);
+        requireAttrName("AttrPairCompare", "b", config.b);
+        requireCompareOp("AttrPairCompare", config.op);
+        const group = requireOptionalGroup("AttrPairCompare", config.group);
+        this.ruleType = group ?? `attr_pair_compare:${config.a}:${config.op}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must be ${config.op} ${config.b}.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "number")
+            return false;
+        if (typeof b !== "number")
+            return false;
+        return applyCompare(this.config.op, a, b);
+    }
+}

package/dist/rules/AttrPairEqual.d.mts

@@ -0,0 +1,35 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+export interface AttrPairEqualConfig {
+    a: string;
+    b: string;
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly equal. No type coercion is performed: both
+ * attribute values must be non-empty strings.
+ *
+ * ## Backward compatibility
+ *
+ * AttrPairEqual deliberately retains the string-only semantic of the legacy
+ * AttrMatchRule. Do not widen verify() to accept numbers or booleans — the
+ * Phase 4 AttrMatchRule alias depends on this invariant.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b` so that
+ * distinct pair requirements are AND-combined by default:
+ *   `attr_pair_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrPairEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_mismatch";
+    readonly message: string;
+    constructor(config: AttrPairEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrPairEqual.d.mts.map

package/dist/rules/AttrPairEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,mBAAmB;IACnC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,mBAAmB;IASxD,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrPairEqual.mjs

@@ -0,0 +1,44 @@
+import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly equal. No type coercion is performed: both
+ * attribute values must be non-empty strings.
+ *
+ * ## Backward compatibility
+ *
+ * AttrPairEqual deliberately retains the string-only semantic of the legacy
+ * AttrMatchRule. Do not widen verify() to accept numbers or booleans — the
+ * Phase 4 AttrMatchRule alias depends on this invariant.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b` so that
+ * distinct pair requirements are AND-combined by default:
+ *   `attr_pair_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export class AttrPairEqual {
+    config;
+    ruleType;
+    code = "attr_mismatch";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrPairEqual", "a", config.a);
+        requireAttrName("AttrPairEqual", "b", config.b);
+        const group = requireOptionalGroup("AttrPairEqual", config.group);
+        this.ruleType = group ?? `attr_pair_equal:${config.a}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must equal ${config.b}.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "string" || a.length === 0)
+            return false;
+        if (typeof b !== "string" || b.length === 0)
+            return false;
+        return a === b;
+    }
+}

package/dist/rules/AttrPairNotEqual.d.mts

@@ -0,0 +1,34 @@
+import type { Attributes, Rule } from "@o3co/auth.policy-verifier.core";
+export interface AttrPairNotEqualConfig {
+    a: string;
+    b: string;
+    group?: string;
+}
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly NOT equal. No type coercion is performed: both
+ * attribute values must be non-empty strings. Missing, null, empty, or
+ * non-string attributes return false (safe-deny).
+ *
+ * ## Denial code
+ *
+ * The denial code is "attr_match": the rule failed because the pair matched
+ * when it was required to differ.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b`:
+ *   `attr_pair_not_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export declare class AttrPairNotEqual implements Rule {
+    private readonly config;
+    readonly ruleType: string;
+    readonly code = "attr_match";
+    readonly message: string;
+    constructor(config: AttrPairNotEqualConfig);
+    verify(attrs: Attributes): boolean;
+}
+//# sourceMappingURL=AttrPairNotEqual.d.mts.map

package/dist/rules/AttrPairNotEqual.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrPairNotEqual.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGxE,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAKhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEI,MAAM,EAAE,sBAAsB;IAS3D,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;CAOlC"}

package/dist/rules/AttrPairNotEqual.mjs

@@ -0,0 +1,43 @@
+import { requireAttrName, requireOptionalGroup } from "./_sharedValidation.mjs";
+/**
+ * Rule that passes when two named attributes are present, are non-empty
+ * strings, and are strictly NOT equal. No type coercion is performed: both
+ * attribute values must be non-empty strings. Missing, null, empty, or
+ * non-string attributes return false (safe-deny).
+ *
+ * ## Denial code
+ *
+ * The denial code is "attr_match": the rule failed because the pair matched
+ * when it was required to differ.
+ *
+ * ## Grouping and the default ruleType
+ *
+ * The evaluator groups rules by `ruleType`, ORs within a group, and ANDs
+ * across groups. The default `ruleType` is derived from `a` and `b`:
+ *   `attr_pair_not_equal:{a}:{b}`
+ *
+ * Pass a shared `group` string to two instances to opt into OR semantics.
+ */
+export class AttrPairNotEqual {
+    config;
+    ruleType;
+    code = "attr_match";
+    message;
+    constructor(config) {
+        this.config = config;
+        requireAttrName("AttrPairNotEqual", "a", config.a);
+        requireAttrName("AttrPairNotEqual", "b", config.b);
+        const group = requireOptionalGroup("AttrPairNotEqual", config.group);
+        this.ruleType = group ?? `attr_pair_not_equal:${config.a}:${config.b}`;
+        this.message = `Attribute constraint not satisfied: ${config.a} must not equal ${config.b}.`;
+    }
+    verify(attrs) {
+        const a = attrs.get(this.config.a);
+        const b = attrs.get(this.config.b);
+        if (typeof a !== "string" || a.length === 0)
+            return false;
+        if (typeof b !== "string" || b.length === 0)
+            return false;
+        return a !== b;
+    }
+}

package/dist/rules/ResourceActionScopeRuleCollector.d.mts

@@ -1,4 +1,13 @@
 import type { CollectorContext, Rule, RuleCollector } from "@o3co/auth.policy-verifier.core";
+/**
+ * Generates a HasScope rule derived from the request action and resource type.
+ *
+ * When the JWT payload has no `scope` claim (e.g. DID-grant tokens), no rules
+ * are generated. The scope rule group is therefore absent from AND-evaluation,
+ * allowing other rule groups to decide independently.
+ *
+ * OAuth JWTs that carry a `scope` claim are validated as before.
+ */
 export declare class ResourceActionScopeRuleCollector implements RuleCollector {
     collect(context: CollectorContext): Promise<Rule[]>;
 }

package/dist/rules/ResourceActionScopeRuleCollector.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../src/rules/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F,qBAAa,gCAAiC,YAAW,aAAa;IAC/D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAIzD"}
+{"version":3,"file":"ResourceActionScopeRuleCollector.d.mts","sourceRoot":"","sources":["../../src/rules/ResourceActionScopeRuleCollector.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,YAAW,aAAa;IAC/D,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAOzD"}

package/dist/rules/ResourceActionScopeRuleCollector.mjs

@@ -1,6 +1,18 @@
 import { HasScope } from "./HasScope.mjs";
+/**
+ * Generates a HasScope rule derived from the request action and resource type.
+ *
+ * When the JWT payload has no `scope` claim (e.g. DID-grant tokens), no rules
+ * are generated. The scope rule group is therefore absent from AND-evaluation,
+ * allowing other rule groups to decide independently.
+ *
+ * OAuth JWTs that carry a `scope` claim are validated as before.
+ */
 export class ResourceActionScopeRuleCollector {
     async collect(context) {
+        if (context.payload.scope === undefined) {
+            return [];
+        }
         const scope = `${context.action}:${context.resource.resourceType}`;
         return [new HasScope(scope)];
     }

package/dist/rules/_sharedValidation.d.mts

@@ -0,0 +1,87 @@
+/**
+ * Shared validation helpers for attribute-based rule constructors.
+ */
+export type LiteralValue = string | number | boolean;
+export type CompareOp = "lt" | "le" | "gt" | "ge";
+export declare const COMPARE_OPS: readonly CompareOp[];
+/**
+ * Validates that a config field used as an attribute name is a non-empty string
+ * that does not contain the `:` separator character used in derived `ruleType`
+ * strings. Allowing `:` would let distinct configs collide on the same
+ * `ruleType` (e.g. `(a="x:y", b="z")` and `(a="x", b="y:z")` both produce
+ * `attr_pair_equal:x:y:z`), which the evaluator would silently OR together
+ * and weaken authorization.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("a" or "b"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated non-empty string.
+ * @throws {Error} If value is not a non-empty string, or contains `:`.
+ */
+export declare function requireAttrName(className: string, fieldName: "a" | "b", value: unknown): string;
+/**
+ * Validates that a config field used as a literal comparison value is a
+ * string, number, or boolean (i.e. a LiteralValue). NaN is rejected because
+ * its comparison semantics (`NaN !== NaN` is always true, `NaN === NaN` is
+ * always false) would silently invert Equal/NotEqual rules — a NotEqual(v=NaN)
+ * would always pass against any numeric attribute, weakening authorization.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("v"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated LiteralValue.
+ * @throws {Error} If value is null, undefined, of any other type, or NaN.
+ */
+export declare function requireLiteralValue(className: string, fieldName: "v", value: unknown): LiteralValue;
+/**
+ * Validates a numeric comparison value. Rejects NaN; accepts Infinity/-Infinity.
+ * @param className - The rule class name, used in error messages.
+ * @param fieldName - The config field name ("v"), used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated number.
+ * @throws {Error} If value is not a number, or if value is NaN.
+ */
+export declare function requireNumber(className: string, fieldName: "v", value: unknown): number;
+/**
+ * Validates that a value is a non-empty, homogeneous array of LiteralValues
+ * (no null/undefined elements, no NaN elements, all elements the same typeof).
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated LiteralValue array.
+ * @throws {Error} If not an array, empty, contains invalid elements, has mixed types, or contains NaN.
+ */
+export declare function requireHomogeneousLiteralArray(className: string, value: unknown): LiteralValue[];
+/**
+ * Validates that a value is one of the allowed CompareOp strings.
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated CompareOp.
+ * @throws {Error} If value is not a string or not one of the allowed operators.
+ */
+export declare function requireCompareOp(className: string, value: unknown): CompareOp;
+/**
+ * Validates an optional group string. Returns undefined when value is undefined;
+ * throws when value is a non-string or an empty string; otherwise returns the
+ * non-empty string.
+ * @param className - The rule class name, used in error messages.
+ * @param value - The raw value to validate.
+ * @returns The validated non-empty string, or undefined.
+ * @throws {Error} If value is a non-string or an empty string.
+ */
+export declare function requireOptionalGroup(className: string, value: unknown): string | undefined;
+/**
+ * Computes a stable cache/dedup key for an array of LiteralValues.
+ * Format: `{type}:{count}:{hashPrefix}` — SHA-256 over a canonical serialization
+ * of `values`. The canonical form first deduplicates `values` (to mirror the
+ * Set-based semantics of AttrLiteralIn / AttrLiteralNotIn — duplicates do not
+ * change the rule's behavior, so they must not change its `ruleType`), then
+ * applies `JSON.stringify(String(v))` to each remaining element before sorting
+ * and joining with `,`. The per-element quoting prevents separator collisions
+ * across different arrays (e.g. `["a,b", "c"]` vs `["a", "b,c"]`).
+ * The `{count}` segment reflects the post-dedup element count.
+ * Caller must guarantee values is a non-empty homogeneous LiteralValue[].
+ */
+export declare function computeValuesKey(values: LiteralValue[]): string;
+/**
+ * Applies a numeric comparison operator between left and right.
+ */
+export declare function applyCompare<T extends number>(op: CompareOp, left: T, right: T): boolean;
+//# sourceMappingURL=_sharedValidation.d.mts.map

package/dist/rules/_sharedValidation.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_sharedValidation.d.mts","sourceRoot":"","sources":["../../src/rules/_sharedValidation.mts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAarD,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAA6B,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAe/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,GAAG,EACd,KAAK,EAAE,OAAO,GACZ,YAAY,CAad;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAQvF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChG;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAU7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAS/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAWxF"}