@o3co/auth.policy-verifier.builtins 0.13.0 → 0.15.0

package/README.ja.md

@@ -172,7 +172,7 @@ new AttrLiteralNotEqual({ a: string, v: string | number | boolean, group?: strin
 
 - `code`: `"attr_equal"`。
 - 既定の `ruleType`: `` `attr_literal_not_equal:${a}:${typeof v}:${String(v)}` ``。`typeof v` セグメントは異型リテラル間の衝突を防ぎます（`AttrLiteralEqual` と同じ理由）。
-- `attrs.get(a)` が `v` と同じ型で厳密等価でないときに通過します。欠落または型不一致は `false`（safe-deny）を返します。
+- `attrs.get(a)` が `v` と同じ型で厳密等価でないときに通過します。欠落・型不一致・`NaN` は `false`（safe-deny）を返します。`NaN` はどの数値とも等しくないため、数値でない値で制限が通過しないよう明示的に拒否します（#254）。
 
 ### AttrLiteralIn
 
@@ -192,7 +192,7 @@ new AttrLiteralNotIn({ a: string, values: (string | number | boolean)[], group?:
 
 - `code`: `"attr_in_set"`。
 - 既定の `ruleType`: `` `attr_literal_not_in:${a}:${type}:${count}:${hashPrefix}` `` — `AttrLiteralIn` と同じ、重複除去済みの安定ハッシュ方式。
-- `values` は非空かつ同種の配列。`attrs.get(a)` が集合に含まれないときに通過します。`values` 内の重複要素は Rule の挙動に影響しません。
+- `values` は非空かつ同種の配列。`attrs.get(a)` が `values` と同じ型で、集合に含まれないときに通過します。欠落・型不一致・`NaN` は `false`（safe-deny）を返します — `NaN` はどの集合にも含まれませんが、同様に拒否します（#254）。`values` 内の重複要素は Rule の挙動に影響しません。
 
 ### AttrLiteralCompare
 

package/README.md

@@ -187,7 +187,7 @@ new AttrLiteralNotEqual({ a: string, v: string | number | boolean, group?: strin
 
 - `code`: `"attr_equal"`.
 - Default `ruleType`: `` `attr_literal_not_equal:${a}:${typeof v}:${String(v)}` ``. The `typeof v` segment prevents silent collisions between distinct-type literals (same rationale as `AttrLiteralEqual`).
-- Passes when `attrs.get(a)` is the same type as `v` and strictly not equal to it. Missing or wrong-type attributes return `false` (safe-deny); a `NaN` attribute is a number and passes, as any other unequal number does (#254).
+- Passes when `attrs.get(a)` is the same type as `v` and strictly not equal to it. Missing, wrong-type or `NaN` attributes return `false` (safe-deny): `NaN` is unequal to every number, and a restriction must not pass on a value that is not a number at all (#254).
 
 ### AttrLiteralIn
 
@@ -207,7 +207,7 @@ new AttrLiteralNotIn({ a: string, values: (string | number | boolean)[], group?:
 
 - `code`: `"attr_in_set"`.
 - Default `ruleType`: `` `attr_literal_not_in:${a}:${type}:${count}:${hashPrefix}` `` — same stable, deduplication-aware hash scheme as `AttrLiteralIn`.
-- `values` must be a non-empty, homogeneous array. Passes when `attrs.get(a)` is NOT in the set — a `NaN` attribute of a numeric set included, since it is in no set (#254). Duplicate elements in `values` are ignored.
+- `values` must be a non-empty, homogeneous array. Passes when `attrs.get(a)` is the same type as the values and NOT in the set. Missing, wrong-type or `NaN` attributes return `false` (safe-deny); `NaN` is in no set, so it would otherwise pass (#254). Duplicate elements in `values` are ignored.
 
 ### AttrLiteralCompare
 

package/dist/rules/AttrLiteralNotEqual.d.mts

@@ -8,9 +8,11 @@ export interface AttrLiteralNotEqualConfig {
 /**
  * Rule that passes when a named attribute is present, matches the type of the
  * configured literal value, and is strictly NOT equal to it. No type coercion
- * is performed. If the attribute is missing, null, or of the wrong type the
- * rule returns false (safe-deny). A `NaN` attribute against a number literal
- * is an unequal number and passes; whether it should deny is #254.
+ * is performed. If the attribute is missing, null, of the wrong type, or
+ * `NaN` the rule returns false (safe-deny). `NaN` is unequal to every number,
+ * so `!==` alone would pass it: a restriction that allows on an attribute
+ * that is not a number at all (#254). Construction refuses a `NaN` literal
+ * for the mirror reason.
  *
  * ## Grouping and the default ruleType
  *

package/dist/rules/AttrLiteralNotEqual.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,yBAAyB;IAW7C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralNotEqual.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotEqual.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACzC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,YAAY,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,mBAAoB,YAAW,IAAI;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAe;gBAErB,MAAM,EAAE,yBAAyB;IAW7C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAM1C"}

package/dist/rules/AttrLiteralNotEqual.mjs

@@ -4,9 +4,11 @@ import { requireAttrName, requireLiteralValue, requireOptionalGroup, } from "./_
 /**
  * Rule that passes when a named attribute is present, matches the type of the
  * configured literal value, and is strictly NOT equal to it. No type coercion
- * is performed. If the attribute is missing, null, or of the wrong type the
- * rule returns false (safe-deny). A `NaN` attribute against a number literal
- * is an unequal number and passes; whether it should deny is #254.
+ * is performed. If the attribute is missing, null, of the wrong type, or
+ * `NaN` the rule returns false (safe-deny). `NaN` is unequal to every number,
+ * so `!==` alone would pass it: a restriction that allows on an attribute
+ * that is not a number at all (#254). Construction refuses a `NaN` literal
+ * for the mirror reason.
  *
  * ## Grouping and the default ruleType
  *
@@ -49,6 +51,8 @@ export class AttrLiteralNotEqual {
         const x = attrs.get(this.a);
         if (typeof x !== typeof this.v)
             return false;
+        if (Number.isNaN(x))
+            return false;
         return x !== this.v;
     }
 }

package/dist/rules/AttrLiteralNotIn.d.mts

@@ -8,9 +8,11 @@ export interface AttrLiteralNotInConfig {
 /**
  * Rule that passes when a named attribute is present, matches the element type
  * of the configured values array, and is NOT included in that array. No type
- * coercion is performed. If the attribute is missing, null, or of the wrong
- * type the rule returns false (safe-deny). A `NaN` attribute against number
- * values is in none of them and passes; whether it should deny is #254.
+ * coercion is performed. If the attribute is missing, null, of the wrong
+ * type, or `NaN` the rule returns false (safe-deny). `NaN` is in no set of
+ * numbers — construction refuses one that holds it — so the membership test
+ * alone would pass it: a restriction that allows on an attribute that is not
+ * a number at all (#254).
  *
  * ## Grouping and the default ruleType
  *

package/dist/rules/AttrLiteralNotIn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,sBAAsB;IAc1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAK1C"}
+{"version":3,"file":"AttrLiteralNotIn.d.mts","sourceRoot":"","sources":["../../src/rules/AttrLiteralNotIn.mts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAEN,KAAK,YAAY,EAIjB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gBAAiB,YAAW,IAAI;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;gBAElC,MAAM,EAAE,sBAAsB;IAc1C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;CAM1C"}

package/dist/rules/AttrLiteralNotIn.mjs

@@ -4,9 +4,11 @@ import { computeValuesKey, requireAttrName, requireHomogeneousLiteralArray, requ
 /**
  * Rule that passes when a named attribute is present, matches the element type
  * of the configured values array, and is NOT included in that array. No type
- * coercion is performed. If the attribute is missing, null, or of the wrong
- * type the rule returns false (safe-deny). A `NaN` attribute against number
- * values is in none of them and passes; whether it should deny is #254.
+ * coercion is performed. If the attribute is missing, null, of the wrong
+ * type, or `NaN` the rule returns false (safe-deny). `NaN` is in no set of
+ * numbers — construction refuses one that holds it — so the membership test
+ * alone would pass it: a restriction that allows on an attribute that is not
+ * a number at all (#254).
  *
  * ## Grouping and the default ruleType
  *
@@ -47,6 +49,8 @@ export class AttrLiteralNotIn {
         const x = attrs.get(this.a);
         if (typeof x !== this.elementType)
             return false;
+        if (Number.isNaN(x))
+            return false;
         return !this.valuesSet.has(x);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.builtins",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -31,7 +31,7 @@
     }
   },
   "dependencies": {
-    "@o3co/auth.policy-verifier.core": "0.13.0"
+    "@o3co/auth.policy-verifier.core": "0.15.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.2",