@o3co/auth.policy-verifier.builtins 0.2.0 → 0.3.0

package/dist/__tests__/rules/AttrLiteralIn.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralIn.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrLiteralIn.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrLiteralIn.test.mjs

@@ -0,0 +1,160 @@
+import { describe, expect, it } from "vitest";
+import { AttrLiteralIn } from "#/rules/AttrLiteralIn.mjs";
+describe("AttrLiteralIn", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: attr in set → true
+    // ---------------------------------------------------------------------------
+    it("returns true when attr is a string in the configured values set", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin", "editor", "viewer"] });
+        const attrs = new Map([["role", "editor"]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns true when attr is a number in the configured values set", () => {
+        const rule = new AttrLiteralIn({ a: "level", values: [1, 2, 3] });
+        const attrs = new Map([["level", 2]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns true when attr is a boolean in the configured values set", () => {
+        const rule = new AttrLiteralIn({ a: "active", values: [true] });
+        const attrs = new Map([["active", true]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // Happy path: attr not in set → false
+    // ---------------------------------------------------------------------------
+    it("returns false when attr is a string not in the configured values set", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin", "editor"] });
+        const attrs = new Map([["role", "viewer"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr is a number not in the configured values set", () => {
+        const rule = new AttrLiteralIn({ a: "level", values: [1, 2, 3] });
+        const attrs = new Map([["level", 5]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Type mismatch: values type != attr type → safe-deny (no throw)
+    // ---------------------------------------------------------------------------
+    it("returns false when values are strings but attr is a number (type mismatch)", () => {
+        const rule = new AttrLiteralIn({ a: "x", values: ["a", "b"] });
+        const attrs = new Map([["x", 42]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when values are numbers but attr is a string (type mismatch)", () => {
+        const rule = new AttrLiteralIn({ a: "x", values: [1, 2, 3] });
+        const attrs = new Map([["x", "1"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time safe-deny: missing / null attr
+    // ---------------------------------------------------------------------------
+    it("returns false when the target attribute is missing", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin"] });
+        const attrs = new Map();
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when the target attribute is null", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin"] });
+        const attrs = new Map([["role", null]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrLiteralIn({ a: undefined, values: ["x"] })).toThrow(/AttrLiteralIn.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrLiteralIn({ a: "", values: ["x"] })).toThrow(/AttrLiteralIn.*'a'.*empty string/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrLiteralIn({ a: 42, values: ["x"] })).toThrow(/AttrLiteralIn.*'a'.*got number/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'values'
+    // ---------------------------------------------------------------------------
+    it("throws when 'values' is missing (undefined)", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: undefined })).toThrow(/AttrLiteralIn.*'values'/);
+    });
+    it("throws when 'values' is not an array (a string)", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: "admin" })).toThrow(/AttrLiteralIn.*'values'/);
+    });
+    it("throws when 'values' is an empty array", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: [] })).toThrow(/AttrLiteralIn.*'values'/);
+    });
+    it("throws when 'values' contains null", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: [null] })).toThrow(/AttrLiteralIn.*'values'/);
+    });
+    it("throws when 'values' contains undefined", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: [undefined] })).toThrow(/AttrLiteralIn.*'values'/);
+    });
+    it("throws when 'values' contains mixed types (string and number)", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: ["a", 1] })).toThrow(/AttrLiteralIn.*'values'.*mixed/);
+    });
+    it("throws when 'values' contains an object element", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: [{}] })).toThrow(/AttrLiteralIn.*'values'/);
+    });
+    it("throws when 'values' contains NaN", () => {
+        // A NaN element could never match any numeric attribute (NaN !== NaN)
+        // and would silently be a dead element in the set. Must fail-fast.
+        expect(() => new AttrLiteralIn({ a: "score", values: [1, Number.NaN, 3] })).toThrow(/AttrLiteralIn.*must not contain NaN/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: ["admin"], group: "" })).toThrow(/AttrLiteralIn.*'group'.*empty string/);
+    });
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrLiteralIn({ a: "role", values: ["admin"], group: 42 })).toThrow(/AttrLiteralIn.*'group'.*got number/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default includes valuesKey
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType containing the attribute name and valuesKey", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin", "editor"] });
+        expect(rule.ruleType).toMatch(/^attr_literal_in:role:string:2:[0-9a-f]{8}$/);
+    });
+    it("two instances with same 'a' but different values produce different ruleTypes", () => {
+        const r1 = new AttrLiteralIn({ a: "role", values: ["admin"] });
+        const r2 = new AttrLiteralIn({ a: "role", values: ["editor"] });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    it("two instances with same 'a' and identical values (same order) produce same ruleType", () => {
+        const r1 = new AttrLiteralIn({ a: "role", values: ["admin", "editor"] });
+        const r2 = new AttrLiteralIn({ a: "role", values: ["admin", "editor"] });
+        expect(r1.ruleType).toBe(r2.ruleType);
+    });
+    it("two instances with same 'a' and same values in different order produce same ruleType (content-based sort)", () => {
+        const r1 = new AttrLiteralIn({ a: "role", values: ["admin", "editor"] });
+        const r2 = new AttrLiteralIn({ a: "role", values: ["editor", "admin"] });
+        expect(r1.ruleType).toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the valuesKey-based default", () => {
+        const r1 = new AttrLiteralIn({ a: "role", values: ["admin"], group: "any-role" });
+        const r2 = new AttrLiteralIn({ a: "role", values: ["editor"], group: "any-role" });
+        expect(r1.ruleType).toBe("any-role");
+        expect(r2.ruleType).toBe("any-role");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_not_in_set'", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin"] });
+        expect(rule.code).toBe("attr_not_in_set");
+    });
+    it("message contains the attribute name, the 'must be one of' phrase, and lists all values", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin", "editor"] });
+        expect(rule.message).toContain("role");
+        expect(rule.message).toContain("must be one of");
+        expect(rule.message).toContain("admin");
+        expect(rule.message).toContain("editor");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrLiteralIn({ a: "role", values: ["admin"] });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/AttrLiteralNotEqual.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrLiteralNotEqual.test.d.mts.map

package/dist/__tests__/rules/AttrLiteralNotEqual.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralNotEqual.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrLiteralNotEqual.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrLiteralNotEqual.test.mjs

@@ -0,0 +1,157 @@
+import { describe, expect, it } from "vitest";
+import { AttrLiteralNotEqual } from "#/rules/AttrLiteralNotEqual.mjs";
+describe("AttrLiteralNotEqual", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: verify() returns true (attr present, type matches, not equal)
+    // ---------------------------------------------------------------------------
+    it("returns true when attr is a different string than the configured literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        const attrs = new Map([["role", "editor"]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns true when attr is a different number than the configured literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "age", v: 30 });
+        const attrs = new Map([["age", 25]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns true when attr is a different boolean than the configured literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "verified", v: true });
+        const attrs = new Map([["verified", false]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // verify() returns false when attr equals the literal
+    // ---------------------------------------------------------------------------
+    it("returns false when attr equals the configured string literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        const attrs = new Map([["role", "admin"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr equals the configured number literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "age", v: 30 });
+        const attrs = new Map([["age", 30]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr equals the configured boolean literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "verified", v: false });
+        const attrs = new Map([["verified", false]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Type mismatch: safe-deny (no coercion)
+    // ---------------------------------------------------------------------------
+    it("returns false when number literal v=30 but attr is the string '30' (no coercion)", () => {
+        const rule = new AttrLiteralNotEqual({ a: "age", v: 30 });
+        const attrs = new Map([["age", "30"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when string literal v='true' but attr is the boolean true (no coercion)", () => {
+        const rule = new AttrLiteralNotEqual({ a: "verified", v: "true" });
+        const attrs = new Map([["verified", true]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time safe-deny: missing / null attr
+    // ---------------------------------------------------------------------------
+    it("returns false when the target attribute is missing", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        const attrs = new Map();
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when the target attribute is null", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        const attrs = new Map([["role", null]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrLiteralNotEqual({ a: undefined, v: "x" })).toThrow(/AttrLiteralNotEqual.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrLiteralNotEqual({ a: "", v: "x" })).toThrow(/AttrLiteralNotEqual.*'a'.*empty string/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrLiteralNotEqual({ a: 42, v: "x" })).toThrow(/AttrLiteralNotEqual.*'a'.*got number/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'v'
+    // ---------------------------------------------------------------------------
+    it("throws when 'v' is null", () => {
+        expect(() => new AttrLiteralNotEqual({ a: "role", v: null })).toThrow(/AttrLiteralNotEqual.*'v'.*got null/);
+    });
+    it("throws when 'v' is undefined", () => {
+        expect(() => new AttrLiteralNotEqual({ a: "role", v: undefined })).toThrow(/AttrLiteralNotEqual.*'v'.*got undefined/);
+    });
+    it("throws when 'v' is a plain object ({})", () => {
+        expect(() => new AttrLiteralNotEqual({ a: "role", v: {} })).toThrow(/AttrLiteralNotEqual.*'v'.*got object/);
+    });
+    it("throws when 'v' is NaN", () => {
+        // x !== NaN is always true, so AttrLiteralNotEqual({ v: NaN }) would be
+        // an always-allow rule against any numeric attribute — silently
+        // weakening authorization. Must fail-fast at construction.
+        expect(() => new AttrLiteralNotEqual({ a: "score", v: Number.NaN })).toThrow(/must not be NaN/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrLiteralNotEqual({ a: "role", v: "admin", group: "" })).toThrow(/AttrLiteralNotEqual.*'group'.*empty string/);
+    });
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrLiteralNotEqual({ a: "role", v: "admin", group: 42 })).toThrow(/AttrLiteralNotEqual.*'group'.*got number/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default derived from 'a', 'typeof v', and 'String(v)'
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType including the type segment for a string literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        expect(rule.ruleType).toBe("attr_literal_not_equal:role:string:admin");
+    });
+    it("derives default ruleType including the type segment for a number literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "age", v: 30 });
+        expect(rule.ruleType).toBe("attr_literal_not_equal:age:number:30");
+    });
+    it("derives default ruleType including the type segment for a boolean literal", () => {
+        const rule = new AttrLiteralNotEqual({ a: "verified", v: true });
+        expect(rule.ruleType).toBe("attr_literal_not_equal:verified:boolean:true");
+    });
+    it("distinct configs produce distinct default ruleTypes (AND semantics)", () => {
+        const r1 = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        const r2 = new AttrLiteralNotEqual({ a: "role", v: "editor" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    it("distinguishes literals by type in ruleType (e.g. number 1 vs string '1')", () => {
+        // Regression guard: see AttrLiteralEqual test for the same rationale.
+        const r1 = new AttrLiteralNotEqual({ a: "flag", v: 1 });
+        const r2 = new AttrLiteralNotEqual({ a: "flag", v: "1" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the default", () => {
+        const r1 = new AttrLiteralNotEqual({ a: "role", v: "banned", group: "not-banned" });
+        const r2 = new AttrLiteralNotEqual({ a: "role", v: "blocked", group: "not-banned" });
+        expect(r1.ruleType).toBe("not-banned");
+        expect(r2.ruleType).toBe("not-banned");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_equal'", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        expect(rule.code).toBe("attr_equal");
+    });
+    it("message contains the attribute name and literal value, and starts with a capital letter", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        expect(rule.message).toContain("role");
+        expect(rule.message).toContain("admin");
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+    it("message contains 'must not equal'", () => {
+        const rule = new AttrLiteralNotEqual({ a: "role", v: "admin" });
+        expect(rule.message).toContain("must not equal");
+    });
+});

package/dist/__tests__/rules/AttrLiteralNotIn.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrLiteralNotIn.test.d.mts.map

package/dist/__tests__/rules/AttrLiteralNotIn.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrLiteralNotIn.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrLiteralNotIn.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrLiteralNotIn.test.mjs

@@ -0,0 +1,168 @@
+import { describe, expect, it } from "vitest";
+import { AttrLiteralNotIn } from "#/rules/AttrLiteralNotIn.mjs";
+describe("AttrLiteralNotIn", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: attr not in set → true
+    // ---------------------------------------------------------------------------
+    it("returns true when attr is a string NOT in the configured values set", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        const attrs = new Map([["role", "viewer"]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns true when attr is a number NOT in the configured values set", () => {
+        const rule = new AttrLiteralNotIn({ a: "level", values: [1, 2, 3] });
+        const attrs = new Map([["level", 5]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("returns true when attr is a boolean NOT in the configured values set", () => {
+        const rule = new AttrLiteralNotIn({ a: "active", values: [false] });
+        const attrs = new Map([["active", true]]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // Happy path: attr in set → false
+    // ---------------------------------------------------------------------------
+    it("returns false when attr is a string IN the configured values set", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        const attrs = new Map([["role", "admin"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr is a number IN the configured values set", () => {
+        const rule = new AttrLiteralNotIn({ a: "level", values: [1, 2, 3] });
+        const attrs = new Map([["level", 2]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr is a boolean IN the configured values set", () => {
+        const rule = new AttrLiteralNotIn({ a: "active", values: [true] });
+        const attrs = new Map([["active", true]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Type mismatch: safe-deny (no coercion)
+    // ---------------------------------------------------------------------------
+    it("returns false when values are strings but attr is a number (type mismatch)", () => {
+        const rule = new AttrLiteralNotIn({ a: "x", values: ["a", "b"] });
+        const attrs = new Map([["x", 42]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when values are numbers but attr is a string (type mismatch)", () => {
+        const rule = new AttrLiteralNotIn({ a: "x", values: [1, 2, 3] });
+        const attrs = new Map([["x", "1"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time safe-deny: missing / null attr
+    // ---------------------------------------------------------------------------
+    it("returns false when the target attribute is missing", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin"] });
+        const attrs = new Map();
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when the target attribute is null", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin"] });
+        const attrs = new Map([["role", null]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrLiteralNotIn({ a: undefined, values: ["x"] })).toThrow(/AttrLiteralNotIn.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrLiteralNotIn({ a: "", values: ["x"] })).toThrow(/AttrLiteralNotIn.*'a'.*empty string/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrLiteralNotIn({ a: 42, values: ["x"] })).toThrow(/AttrLiteralNotIn.*'a'.*got number/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'values'
+    // ---------------------------------------------------------------------------
+    it("throws when 'values' is missing (undefined)", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: undefined })).toThrow(/AttrLiteralNotIn.*'values'/);
+    });
+    it("throws when 'values' is not an array (a string)", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: "admin" })).toThrow(/AttrLiteralNotIn.*'values'/);
+    });
+    it("throws when 'values' is an empty array", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: [] })).toThrow(/AttrLiteralNotIn.*'values'/);
+    });
+    it("throws when 'values' contains null", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: [null] })).toThrow(/AttrLiteralNotIn.*'values'/);
+    });
+    it("throws when 'values' contains undefined", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: [undefined] })).toThrow(/AttrLiteralNotIn.*'values'/);
+    });
+    it("throws when 'values' contains mixed types (string and number)", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: ["a", 1] })).toThrow(/AttrLiteralNotIn.*'values'.*mixed/);
+    });
+    it("throws when 'values' contains an object element", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: [{}] })).toThrow(/AttrLiteralNotIn.*'values'/);
+    });
+    it("throws when 'values' contains NaN", () => {
+        // A NaN element could never match any numeric attribute (NaN !== NaN),
+        // so including it in a "deny these" list is a silent policy mistake.
+        expect(() => new AttrLiteralNotIn({ a: "score", values: [1, Number.NaN, 3] })).toThrow(/AttrLiteralNotIn.*must not contain NaN/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: ["admin"], group: "" })).toThrow(/AttrLiteralNotIn.*'group'.*empty string/);
+    });
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrLiteralNotIn({ a: "role", values: ["admin"], group: 42 })).toThrow(/AttrLiteralNotIn.*'group'.*got number/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default includes valuesKey
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType containing the attribute name and valuesKey", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        expect(rule.ruleType).toMatch(/^attr_literal_not_in:role:string:2:[0-9a-f]{8}$/);
+    });
+    it("two instances with same 'a' but different values produce different ruleTypes", () => {
+        const r1 = new AttrLiteralNotIn({ a: "role", values: ["admin"] });
+        const r2 = new AttrLiteralNotIn({ a: "role", values: ["editor"] });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    it("two instances with same 'a' and identical values (same order) produce same ruleType", () => {
+        const r1 = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        const r2 = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        expect(r1.ruleType).toBe(r2.ruleType);
+    });
+    it("two instances with same 'a' and same values in different order produce same ruleType (content-based sort)", () => {
+        const r1 = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        const r2 = new AttrLiteralNotIn({ a: "role", values: ["editor", "admin"] });
+        expect(r1.ruleType).toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the valuesKey-based default", () => {
+        const r1 = new AttrLiteralNotIn({ a: "role", values: ["admin"], group: "not-admin-set" });
+        const r2 = new AttrLiteralNotIn({ a: "role", values: ["editor"], group: "not-admin-set" });
+        expect(r1.ruleType).toBe("not-admin-set");
+        expect(r2.ruleType).toBe("not-admin-set");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_in_set'", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin"] });
+        expect(rule.code).toBe("attr_in_set");
+    });
+    it("message contains the attribute name and lists all values", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin", "editor"] });
+        expect(rule.message).toContain("role");
+        expect(rule.message).toContain("admin");
+        expect(rule.message).toContain("editor");
+    });
+    it("message contains 'must not be one of'", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin"] });
+        expect(rule.message).toContain("must not be one of");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrLiteralNotIn({ a: "role", values: ["admin"] });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/AttrMatchRule.test.mjs

@@ -48,6 +48,14 @@ describe("AttrMatchRule", () => {
         expect(r1.ruleType).toContain("userId");
         expect(r1.ruleType).toContain("sub");
     });
+    it("preserves the legacy ruleType prefix 'attr_match:' for backward compatibility", () => {
+        // AttrMatchRule is a deprecated wrapper around AttrPairEqual. To keep
+        // downstream consumers (e.g. dplaas.auth) working without code changes
+        // across this release, the default ruleType must remain `attr_match:{a}:{b}`
+        // rather than adopting AttrPairEqual's `attr_pair_equal:...` form.
+        const r = new AttrMatchRule({ a: "userId", b: "sub" });
+        expect(r.ruleType).toBe("attr_match:userId:sub");
+    });
     it("uses the provided group override when set, to enable explicit grouping", () => {
         // When callers want two comparisons to be OR'd together (e.g. match by
         // either DID or email), they opt in by passing the same `group`.

package/dist/__tests__/rules/AttrPairCompare.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrPairCompare.test.d.mts.map

package/dist/__tests__/rules/AttrPairCompare.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairCompare.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrPairCompare.test.mts"],"names":[],"mappings":""}