@o3co/auth.policy-verifier.builtins 0.2.0 → 0.3.0

package/dist/__tests__/rules/AttrPairCompare.test.mjs

@@ -0,0 +1,319 @@
+import { describe, expect, it } from "vitest";
+import { AttrPairCompare } from "#/rules/AttrPairCompare.mjs";
+describe("AttrPairCompare", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: each op at boundary values
+    // ---------------------------------------------------------------------------
+    it("op=lt: returns true when attr(a) < attr(b) (5 < 10)", () => {
+        const rule = new AttrPairCompare({ a: "low", op: "lt", b: "high" });
+        const attrs = new Map([
+            ["low", 5],
+            ["high", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=lt: returns false when attr(a) === attr(b) (10 < 10 is false)", () => {
+        const rule = new AttrPairCompare({ a: "low", op: "lt", b: "high" });
+        const attrs = new Map([
+            ["low", 10],
+            ["high", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=lt: returns false when attr(a) > attr(b) (15 < 10 is false)", () => {
+        const rule = new AttrPairCompare({ a: "low", op: "lt", b: "high" });
+        const attrs = new Map([
+            ["low", 15],
+            ["high", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=le: returns true when attr(a) === attr(b) (10 <= 10)", () => {
+        const rule = new AttrPairCompare({ a: "low", op: "le", b: "high" });
+        const attrs = new Map([
+            ["low", 10],
+            ["high", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=le: returns true when attr(a) < attr(b) (5 <= 10)", () => {
+        const rule = new AttrPairCompare({ a: "low", op: "le", b: "high" });
+        const attrs = new Map([
+            ["low", 5],
+            ["high", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=le: returns false when attr(a) > attr(b) (15 <= 10 is false)", () => {
+        const rule = new AttrPairCompare({ a: "low", op: "le", b: "high" });
+        const attrs = new Map([
+            ["low", 15],
+            ["high", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=gt: returns true when attr(a) > attr(b) (15 > 10)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", 15],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=gt: returns false when attr(a) === attr(b) (10 > 10 is false)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", 10],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=gt: returns false when attr(a) < attr(b) (5 > 10 is false)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", 5],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=ge: returns true when attr(a) === attr(b) (10 >= 10)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const attrs = new Map([
+            ["score", 10],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=ge: returns true when attr(a) > attr(b) (15 >= 10)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const attrs = new Map([
+            ["score", 15],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=ge: returns false when attr(a) < attr(b) (5 >= 10 is false)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const attrs = new Map([
+            ["score", 5],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time safe-deny: attr is not a number
+    // ---------------------------------------------------------------------------
+    it("returns false when attr(a) is a string (not a number)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", "10"],
+            ["threshold", 5],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr(b) is a string (not a number)", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", 10],
+            ["threshold", "5"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time safe-deny: missing attr
+    // ---------------------------------------------------------------------------
+    it("returns false when attr(a) is missing", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([["threshold", 5]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr(b) is missing", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([["score", 10]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time: NaN attribute → false for all ops
+    // ---------------------------------------------------------------------------
+    it("op=lt: returns false when attr(a) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "lt", b: "threshold" });
+        const attrs = new Map([
+            ["score", NaN],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=le: returns false when attr(a) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "le", b: "threshold" });
+        const attrs = new Map([
+            ["score", NaN],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=gt: returns false when attr(a) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", NaN],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=ge: returns false when attr(a) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const attrs = new Map([
+            ["score", NaN],
+            ["threshold", 10],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=lt: returns false when attr(b) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "lt", b: "threshold" });
+        const attrs = new Map([
+            ["score", 5],
+            ["threshold", NaN],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=le: returns false when attr(b) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "le", b: "threshold" });
+        const attrs = new Map([
+            ["score", 5],
+            ["threshold", NaN],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=gt: returns false when attr(b) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", 15],
+            ["threshold", NaN],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("op=ge: returns false when attr(b) is NaN", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const attrs = new Map([
+            ["score", 15],
+            ["threshold", NaN],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Evaluation-time: Infinity / -Infinity attributes
+    // ---------------------------------------------------------------------------
+    it("op=gt: Infinity > 100 returns true", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const attrs = new Map([
+            ["score", Infinity],
+            ["threshold", 100],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=lt: -Infinity < 0 returns true", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "lt", b: "threshold" });
+        const attrs = new Map([
+            ["score", -Infinity],
+            ["threshold", 0],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    it("op=ge: Infinity >= Infinity returns true", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const attrs = new Map([
+            ["score", Infinity],
+            ["threshold", Infinity],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrPairCompare({ a: undefined, op: "gt", b: "threshold" })).toThrow(/AttrPairCompare.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrPairCompare({ a: 42, op: "gt", b: "threshold" })).toThrow(/AttrPairCompare.*'a'.*got number/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrPairCompare({ a: "", op: "gt", b: "threshold" })).toThrow(/AttrPairCompare.*'a'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'b'
+    // ---------------------------------------------------------------------------
+    it("throws when 'b' is undefined", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: "gt", b: undefined })).toThrow(/AttrPairCompare.*'b'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'b' is a non-string (number 42)", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: "gt", b: 42 })).toThrow(/AttrPairCompare.*'b'.*got number/);
+    });
+    it("throws when 'b' is an empty string", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: "gt", b: "" })).toThrow(/AttrPairCompare.*'b'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'op'
+    // ---------------------------------------------------------------------------
+    it("throws when 'op' is missing (undefined)", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: undefined, b: "threshold" })).toThrow(/AttrPairCompare.*'op'/);
+    });
+    it("throws when 'op' is not a string (number 42)", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: 42, b: "threshold" })).toThrow(/AttrPairCompare.*'op'/);
+    });
+    it("throws when 'op' is an invalid string ('eq')", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: "eq", b: "threshold" })).toThrow(/AttrPairCompare.*'op'/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrPairCompare({
+            a: "score",
+            op: "gt",
+            b: "threshold",
+            group: 42,
+        })).toThrow(/AttrPairCompare.*'group'.*got number/);
+    });
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrPairCompare({ a: "score", op: "gt", b: "threshold", group: "" })).toThrow(/AttrPairCompare.*'group'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default derived from a, op, b
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType from a, op, and b", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        expect(rule.ruleType).toBe("attr_pair_compare:score:gt:threshold");
+    });
+    it("distinct op or b produce distinct ruleTypes (AND semantics)", () => {
+        const r1 = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        const r2 = new AttrPairCompare({ a: "score", op: "ge", b: "threshold" });
+        const r3 = new AttrPairCompare({ a: "score", op: "gt", b: "limit" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+        expect(r1.ruleType).not.toBe(r3.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the default", () => {
+        const r1 = new AttrPairCompare({ a: "score", op: "gt", b: "threshold", group: "score-check" });
+        const r2 = new AttrPairCompare({ a: "score", op: "ge", b: "limit", group: "score-check" });
+        expect(r1.ruleType).toBe("score-check");
+        expect(r2.ruleType).toBe("score-check");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_compare_violated'", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        expect(rule.code).toBe("attr_compare_violated");
+    });
+    it("message contains a name, op, and b name", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        expect(rule.message).toContain("score");
+        expect(rule.message).toContain("gt");
+        expect(rule.message).toContain("threshold");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrPairCompare({ a: "score", op: "gt", b: "threshold" });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/AttrPairEqual.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrPairEqual.test.d.mts.map

package/dist/__tests__/rules/AttrPairEqual.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairEqual.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrPairEqual.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrPairEqual.test.mjs

@@ -0,0 +1,155 @@
+import { describe, expect, it } from "vitest";
+import { AttrPairEqual } from "#/rules/AttrPairEqual.mjs";
+describe("AttrPairEqual", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: verify() returns true
+    // ---------------------------------------------------------------------------
+    it("returns true when both attrs are equal non-empty strings", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // verify() returns false
+    // ---------------------------------------------------------------------------
+    it("returns false when the two strings are different", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is an empty string", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", ""],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is an empty string", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", ""],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is a number (non-string)", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", 42],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is a number (non-string)", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", 42],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is missing", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["owner", "alice"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is missing", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["subject", "alice"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is null", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", null],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is null", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", null],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrPairEqual({ a: undefined, b: "owner" })).toThrow(/AttrPairEqual.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrPairEqual({ a: 42, b: "owner" })).toThrow(/AttrPairEqual.*'a'.*got number/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrPairEqual({ a: "", b: "owner" })).toThrow(/AttrPairEqual.*'a'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'b'
+    // ---------------------------------------------------------------------------
+    it("throws when 'b' is undefined", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: undefined })).toThrow(/AttrPairEqual.*'b'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'b' is a non-string (number 42)", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: 42 })).toThrow(/AttrPairEqual.*'b'.*got number/);
+    });
+    it("throws when 'b' is an empty string", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: "" })).toThrow(/AttrPairEqual.*'b'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: "owner", group: 42 })).toThrow(/AttrPairEqual.*'group'.*got number/);
+    });
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrPairEqual({ a: "subject", b: "owner", group: "" })).toThrow(/AttrPairEqual.*'group'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default derived from 'a' and 'b'
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType from a and b", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.ruleType).toBe("attr_pair_equal:subject:owner");
+    });
+    it("distinct a/b produce distinct default ruleTypes (AND semantics)", () => {
+        const r1 = new AttrPairEqual({ a: "subject", b: "owner" });
+        const r2 = new AttrPairEqual({ a: "subject", b: "tenant" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the default", () => {
+        const r1 = new AttrPairEqual({ a: "subject", b: "owner", group: "identity-check" });
+        const r2 = new AttrPairEqual({ a: "subject", b: "creator", group: "identity-check" });
+        expect(r1.ruleType).toBe("identity-check");
+        expect(r2.ruleType).toBe("identity-check");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_mismatch'", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.code).toBe("attr_mismatch");
+    });
+    it("message contains 'a' name, 'b' name, and the phrase 'must equal'", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.message).toContain("subject");
+        expect(rule.message).toContain("owner");
+        expect(rule.message).toContain("must equal");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrPairEqual({ a: "subject", b: "owner" });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/AttrPairNotEqual.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AttrPairNotEqual.test.d.mts.map

package/dist/__tests__/rules/AttrPairNotEqual.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttrPairNotEqual.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/AttrPairNotEqual.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/AttrPairNotEqual.test.mjs

@@ -0,0 +1,155 @@
+import { describe, expect, it } from "vitest";
+import { AttrPairNotEqual } from "#/rules/AttrPairNotEqual.mjs";
+describe("AttrPairNotEqual", () => {
+    // ---------------------------------------------------------------------------
+    // Happy path: verify() returns true
+    // ---------------------------------------------------------------------------
+    it("returns true when both attrs are non-empty strings and not equal", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(true);
+    });
+    // ---------------------------------------------------------------------------
+    // verify() returns false
+    // ---------------------------------------------------------------------------
+    it("returns false when the two strings are equal", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", "alice"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is an empty string", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", ""],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is an empty string", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", ""],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is a number (non-string)", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", 42],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is a number (non-string)", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", 42],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is missing", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["owner", "bob"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is missing", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([["subject", "alice"]]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'a' is null", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", null],
+            ["owner", "bob"],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    it("returns false when attr 'b' is null", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const attrs = new Map([
+            ["subject", "alice"],
+            ["owner", null],
+        ]);
+        expect(rule.verify(attrs)).toBe(false);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'a'
+    // ---------------------------------------------------------------------------
+    it("throws when 'a' is undefined", () => {
+        expect(() => new AttrPairNotEqual({ a: undefined, b: "owner" })).toThrow(/AttrPairNotEqual.*'a'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'a' is a non-string (number 42)", () => {
+        expect(() => new AttrPairNotEqual({ a: 42, b: "owner" })).toThrow(/AttrPairNotEqual.*'a'.*got number/);
+    });
+    it("throws when 'a' is an empty string", () => {
+        expect(() => new AttrPairNotEqual({ a: "", b: "owner" })).toThrow(/AttrPairNotEqual.*'a'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'b'
+    // ---------------------------------------------------------------------------
+    it("throws when 'b' is undefined", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: undefined })).toThrow(/AttrPairNotEqual.*'b'.*(non-empty string|got undefined)/);
+    });
+    it("throws when 'b' is a non-string (number 42)", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: 42 })).toThrow(/AttrPairNotEqual.*'b'.*got number/);
+    });
+    it("throws when 'b' is an empty string", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: "" })).toThrow(/AttrPairNotEqual.*'b'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // Construction errors: invalid 'group'
+    // ---------------------------------------------------------------------------
+    it("throws when 'group' is present but is a non-string (number 42)", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: "owner", group: 42 })).toThrow(/AttrPairNotEqual.*'group'.*got number/);
+    });
+    it("throws when 'group' is present but is an empty string", () => {
+        expect(() => new AttrPairNotEqual({ a: "subject", b: "owner", group: "" })).toThrow(/AttrPairNotEqual.*'group'.*empty string/);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: default derived from 'a' and 'b'
+    // ---------------------------------------------------------------------------
+    it("derives default ruleType from a and b", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.ruleType).toBe("attr_pair_not_equal:subject:owner");
+    });
+    it("distinct a/b produce distinct default ruleTypes (AND semantics)", () => {
+        const r1 = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        const r2 = new AttrPairNotEqual({ a: "subject", b: "tenant" });
+        expect(r1.ruleType).not.toBe(r2.ruleType);
+    });
+    // ---------------------------------------------------------------------------
+    // ruleType: group override
+    // ---------------------------------------------------------------------------
+    it("uses the provided group string as ruleType, overriding the default", () => {
+        const r1 = new AttrPairNotEqual({ a: "subject", b: "owner", group: "not-self" });
+        const r2 = new AttrPairNotEqual({ a: "subject", b: "creator", group: "not-self" });
+        expect(r1.ruleType).toBe("not-self");
+        expect(r2.ruleType).toBe("not-self");
+    });
+    // ---------------------------------------------------------------------------
+    // code and message fields
+    // ---------------------------------------------------------------------------
+    it("has code 'attr_match'", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.code).toBe("attr_match");
+    });
+    it("message contains 'a' name, 'b' name, and the phrase 'must not equal'", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.message).toContain("subject");
+        expect(rule.message).toContain("owner");
+        expect(rule.message).toContain("must not equal");
+    });
+    it("message starts with a capital letter", () => {
+        const rule = new AttrPairNotEqual({ a: "subject", b: "owner" });
+        expect(rule.message[0]).toBe(rule.message[0]?.toUpperCase());
+    });
+});

package/dist/__tests__/rules/_sharedValidation.test.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=_sharedValidation.test.d.mts.map

package/dist/__tests__/rules/_sharedValidation.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_sharedValidation.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/_sharedValidation.test.mts"],"names":[],"mappings":""}