@o3co/auth.policy-verifier.builtins 0.3.1 → 0.5.0

package/dist/__tests__/rules/HasPermission.test.mjs

@@ -1,86 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { HasPermission } from "#/rules/HasPermission.mjs";
-describe("HasPermission", () => {
-    it("passes on exact match", () => {
-        const rule = new HasPermission("project:1.perm:read");
-        const attrs = new Map([["permissions", ["project:1.perm:read"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("fails when permission is missing", () => {
-        const rule = new HasPermission("project:1.perm:write");
-        const attrs = new Map([["permissions", ["project:1.perm:read"]]]);
-        expect(rule.verify(attrs)).toBe(false);
-    });
-    it("matches wildcard * (permit all)", () => {
-        const rule = new HasPermission("project:1.perm:read");
-        const attrs = new Map([["permissions", ["*"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("matches prefix wildcard: project:*.perm:read", () => {
-        const rule = new HasPermission("project:123.perm:read");
-        const attrs = new Map([["permissions", ["project:*.perm:read"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("matches suffix wildcard: project:1.perm:*", () => {
-        const rule = new HasPermission("project:1.perm:read");
-        const attrs = new Map([["permissions", ["project:1.perm:*"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("is case insensitive", () => {
-        const rule = new HasPermission("Project:1.Perm:Read");
-        const attrs = new Map([["permissions", ["project:1.perm:read"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("checks permissions from roles", () => {
-        const rule = new HasPermission("project:1.perm:read");
-        const attrs = new Map([
-            ["permissions", []],
-            ["roles", [{ name: "admin", permissions: ["project:1.perm:read"] }]],
-        ]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("fails when neither permissions nor roles match", () => {
-        const rule = new HasPermission("project:1.perm:write");
-        const attrs = new Map([
-            ["permissions", ["project:1.perm:read"]],
-            ["roles", [{ name: "viewer", permissions: ["project:1.perm:read"] }]],
-        ]);
-        expect(rule.verify(attrs)).toBe(false);
-    });
-    it("has ruleType 'permission'", () => {
-        const rule = new HasPermission("project:1.perm:read");
-        expect(rule.ruleType).toBe("permission");
-    });
-    it("has code 'no_permission'", () => {
-        const rule = new HasPermission("project:1.perm:read");
-        expect(rule.code).toBe("no_permission");
-    });
-    describe("multi-star wildcard rejection", () => {
-        it("does NOT match when granted permission has 2+ wildcards — over-granting via dropped suffix", () => {
-            // Bug: "resource*action*required" split("*") → ["resource","action","required"]
-            // Destructuring const [prefix, suffix] = ... takes only "resource" and "action",
-            // silently dropping "required". The check becomes endsWith("action") instead of
-            // endsWith("required"), so "resourceXaction" incorrectly matches even though
-            // the granted permission requires a "required" segment after the second wildcard.
-            // Fix: reject any granted permission containing 2+ wildcards (return false).
-            const rule = new HasPermission("resourceXaction");
-            const attrs = new Map([["permissions", ["resource*action*required"]]]);
-            // "resourceXaction" does NOT satisfy "resource*action*required" (missing "required")
-            // but the buggy code returns true because "required" is dropped from suffix
-            expect(rule.verify(attrs)).toBe(false);
-        });
-        it("does NOT match when granted permission has 2+ wildcards (posts.*.write.* vs posts.123.read.all)", () => {
-            // Additional case: wildcard in the middle — cross-action access must not be granted
-            const rule = new HasPermission("posts.123.read.all");
-            const attrs = new Map([["permissions", ["posts.*.write.*"]]]);
-            expect(rule.verify(attrs)).toBe(false);
-        });
-        it("does NOT match when granted permission has 3 wildcards", () => {
-            // "a*b*c*d" split → ["a","b","c","d"]; prefix="a", suffix="b"; "c","d" dropped.
-            // "aXb" incorrectly matches when "a*b*c*d" should require segments c and d.
-            const rule = new HasPermission("aXb");
-            const attrs = new Map([["permissions", ["a*b*c*d"]]]);
-            expect(rule.verify(attrs)).toBe(false);
-        });
-    });
-});

package/dist/__tests__/rules/HasScope.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=HasScope.test.d.mts.map

package/dist/__tests__/rules/HasScope.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"HasScope.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/HasScope.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/HasScope.test.mjs

@@ -1,42 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { HasScope } from "#/rules/HasScope.mjs";
-describe("HasScope", () => {
-    it("passes when scope matches exactly", () => {
-        const rule = new HasScope("read:user");
-        const attrs = new Map([["scopes", ["read:user"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("fails when scope does not match", () => {
-        const rule = new HasScope("write:user");
-        const attrs = new Map([["scopes", ["read:user"]]]);
-        expect(rule.verify(attrs)).toBe(false);
-    });
-    it("normalizes scope without action to read:{resource}", () => {
-        const rule = new HasScope("read:user");
-        const attrs = new Map([["scopes", ["user"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("is case insensitive", () => {
-        const rule = new HasScope("READ:User");
-        const attrs = new Map([["scopes", ["read:user"]]]);
-        expect(rule.verify(attrs)).toBe(true);
-    });
-    it("fails when scopes are empty", () => {
-        const rule = new HasScope("read:user");
-        const attrs = new Map([["scopes", []]]);
-        expect(rule.verify(attrs)).toBe(false);
-    });
-    it("fails when scopes key is missing", () => {
-        const rule = new HasScope("read:user");
-        const attrs = new Map();
-        expect(rule.verify(attrs)).toBe(false);
-    });
-    it("has ruleType 'scope'", () => {
-        const rule = new HasScope("read:user");
-        expect(rule.ruleType).toBe("scope");
-    });
-    it("has code 'invalid_scope'", () => {
-        const rule = new HasScope("read:user");
-        expect(rule.code).toBe("invalid_scope");
-    });
-});

package/dist/__tests__/rules/_sharedValidation.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=_sharedValidation.test.d.mts.map

package/dist/__tests__/rules/_sharedValidation.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"_sharedValidation.test.d.mts","sourceRoot":"","sources":["../../../src/__tests__/rules/_sharedValidation.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/_sharedValidation.test.mjs

@@ -1,325 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { applyCompare, COMPARE_OPS, computeValuesKey, requireAttrName, requireCompareOp, requireHomogeneousLiteralArray, requireLiteralValue, requireNumber, requireOptionalGroup, } from "#/rules/_sharedValidation.mjs";
-// ---------------------------------------------------------------------------
-// requireAttrName
-// ---------------------------------------------------------------------------
-describe("requireAttrName", () => {
-    it("returns the input string when value is a valid non-empty string", () => {
-        expect(requireAttrName("MyClass", "a", "role")).toBe("role");
-    });
-    it("returns the input string for fieldName 'b'", () => {
-        expect(requireAttrName("MyClass", "b", "score")).toBe("score");
-    });
-    it("throws with className and fieldName 'a' in message when value is undefined", () => {
-        expect(() => requireAttrName("MyClass", "a", undefined)).toThrow(/MyClass.*'a'.*non-empty string.*got undefined/);
-    });
-    it("throws with className and fieldName 'b' in message when value is undefined", () => {
-        expect(() => requireAttrName("MyClass", "b", undefined)).toThrow(/MyClass.*'b'.*non-empty string.*got undefined/);
-    });
-    it("throws with 'empty string' in message when value is ''", () => {
-        expect(() => requireAttrName("MyClass", "a", "")).toThrow(/MyClass.*'a'.*got empty string/);
-    });
-    it("throws with 'got number' in message when value is 42", () => {
-        expect(() => requireAttrName("MyClass", "a", 42)).toThrow(/MyClass.*'a'.*got number/);
-    });
-    it("throws with 'null' in message when value is null", () => {
-        expect(() => requireAttrName("MyClass", "a", null)).toThrow(/null/);
-    });
-    it("throws when value contains ':' (reserved as ruleType separator)", () => {
-        // Regression guard for an authorization-weakening bug: with ':' allowed,
-        // (a="x:y", b="z") and (a="x", b="y:z") would both produce the same
-        // `attr_pair_equal:x:y:z` default ruleType and be silently OR-combined
-        // by the evaluator. Fail-fast at construction instead.
-        expect(() => requireAttrName("MyClass", "a", "name:space")).toThrow(/must not contain ':'.*got 'name:space'/);
-    });
-});
-// ---------------------------------------------------------------------------
-// requireLiteralValue
-// ---------------------------------------------------------------------------
-describe("requireLiteralValue", () => {
-    it("returns the value when it is a string", () => {
-        expect(requireLiteralValue("MyClass", "v", "hello")).toBe("hello");
-    });
-    it("returns the value when it is a number", () => {
-        expect(requireLiteralValue("MyClass", "v", 42)).toBe(42);
-    });
-    it("returns the value when it is a boolean", () => {
-        expect(requireLiteralValue("MyClass", "v", false)).toBe(false);
-    });
-    it("throws with 'null' in message when value is null", () => {
-        expect(() => requireLiteralValue("MyClass", "v", null)).toThrow(/null/);
-    });
-    it("throws with 'undefined' in message when value is undefined", () => {
-        expect(() => requireLiteralValue("MyClass", "v", undefined)).toThrow(/undefined/);
-    });
-    it("throws with 'object' in message when value is a plain object", () => {
-        expect(() => requireLiteralValue("MyClass", "v", {})).toThrow(/object/);
-    });
-    it("throws with 'object' in message when value is an array (typeof [] === 'object')", () => {
-        expect(() => requireLiteralValue("MyClass", "v", [])).toThrow(/object/);
-    });
-    it("throws on NaN (NaN === NaN is false; would invert Equal/NotEqual rules)", () => {
-        // Regression guard for an authorization-weakening bug: with NaN accepted,
-        // AttrLiteralNotEqual({ v: NaN }) would always pass for any numeric
-        // attribute because `x !== NaN` is always true. Must fail-fast in
-        // construction instead.
-        expect(() => requireLiteralValue("MyClass", "v", Number.NaN)).toThrow(/must not be NaN/);
-    });
-});
-// ---------------------------------------------------------------------------
-// requireNumber
-// ---------------------------------------------------------------------------
-describe("requireNumber", () => {
-    it("returns 0 (zero)", () => {
-        expect(requireNumber("MyClass", "v", 0)).toBe(0);
-    });
-    it("returns -0 (negative zero)", () => {
-        expect(requireNumber("MyClass", "v", -0)).toBe(-0);
-    });
-    it("returns a large finite number", () => {
-        expect(requireNumber("MyClass", "v", 1e308)).toBe(1e308);
-    });
-    it("returns Infinity without throwing (Infinity is a valid number per spec)", () => {
-        expect(requireNumber("MyClass", "v", Infinity)).toBe(Infinity);
-    });
-    it("returns -Infinity without throwing", () => {
-        expect(requireNumber("MyClass", "v", -Infinity)).toBe(-Infinity);
-    });
-    it("throws on NaN with message matching /must not be NaN/", () => {
-        expect(() => requireNumber("MyClass", "v", NaN)).toThrow(/must not be NaN/);
-    });
-    it("throws on a string '42' with message containing 'got string'", () => {
-        expect(() => requireNumber("MyClass", "v", "42")).toThrow(/got string/);
-    });
-    it("throws on null with message containing 'null'", () => {
-        expect(() => requireNumber("MyClass", "v", null)).toThrow(/null/);
-    });
-    it("throws on undefined with message containing 'undefined'", () => {
-        expect(() => requireNumber("MyClass", "v", undefined)).toThrow(/undefined/);
-    });
-});
-// ---------------------------------------------------------------------------
-// requireHomogeneousLiteralArray
-// ---------------------------------------------------------------------------
-describe("requireHomogeneousLiteralArray", () => {
-    it("returns a non-empty all-string array", () => {
-        const arr = ["a", "b", "c"];
-        expect(requireHomogeneousLiteralArray("MyClass", arr)).toEqual(arr);
-    });
-    it("returns a non-empty all-number array", () => {
-        const arr = [1, 2, 3];
-        expect(requireHomogeneousLiteralArray("MyClass", arr)).toEqual(arr);
-    });
-    it("returns a non-empty all-boolean array", () => {
-        const arr = [true, false];
-        expect(requireHomogeneousLiteralArray("MyClass", arr)).toEqual(arr);
-    });
-    it("throws with 'got string' when value is not an array", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", "abc")).toThrow(/got string/);
-    });
-    it("throws with 'undefined' when value is undefined", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", undefined)).toThrow(/undefined/);
-    });
-    it("throws with 'null' when value is null", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", null)).toThrow(/null/);
-    });
-    it("throws with 'non-empty array' on empty array", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", [])).toThrow(/non-empty array/);
-    });
-    it("throws with 'null' when an element is null", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", [null])).toThrow(/null/);
-    });
-    it("throws with 'undefined' when an element is undefined", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", [undefined])).toThrow(/undefined/);
-    });
-    it("throws with 'object' when an element is an object", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", [{}])).toThrow(/object/);
-    });
-    it("throws with mixed types message for ['a', 1] (left-to-right Set insertion order)", () => {
-        expect(() => requireHomogeneousLiteralArray("MyClass", ["a", 1])).toThrow(/mixed types \[string, number\]/);
-    });
-    it("throws when an element is NaN (would silently mismatch AttrLiteralIn/NotIn)", () => {
-        // Regression guard: AttrLiteralIn uses strict equality against each element;
-        // a NaN element could never match any attribute value because NaN !== NaN.
-        // Must fail-fast at construction rather than ship an always-false element.
-        expect(() => requireHomogeneousLiteralArray("MyClass", [1, Number.NaN, 3])).toThrow(/must not contain NaN/);
-    });
-});
-// ---------------------------------------------------------------------------
-// requireCompareOp
-// ---------------------------------------------------------------------------
-describe("requireCompareOp", () => {
-    it("returns 'lt' for valid op 'lt'", () => {
-        expect(requireCompareOp("MyClass", "lt")).toBe("lt");
-    });
-    it("returns 'le' for valid op 'le'", () => {
-        expect(requireCompareOp("MyClass", "le")).toBe("le");
-    });
-    it("returns 'gt' for valid op 'gt'", () => {
-        expect(requireCompareOp("MyClass", "gt")).toBe("gt");
-    });
-    it("returns 'ge' for valid op 'ge'", () => {
-        expect(requireCompareOp("MyClass", "ge")).toBe("ge");
-    });
-    it("throws on invalid string 'eq' with message listing valid ops joined by ' | '", () => {
-        expect(() => requireCompareOp("MyClass", "eq")).toThrow(/lt \| le \| gt \| ge/);
-    });
-    it("throws on empty string '' with message listing valid ops", () => {
-        expect(() => requireCompareOp("MyClass", "")).toThrow(/lt \| le \| gt \| ge/);
-    });
-    it("throws on symbolic string '<' with message listing valid ops", () => {
-        expect(() => requireCompareOp("MyClass", "<")).toThrow(/lt \| le \| gt \| ge/);
-    });
-    it("throws on number 42 with message containing the type label", () => {
-        expect(() => requireCompareOp("MyClass", 42)).toThrow(/got number/);
-    });
-    it("throws on null with message containing the type label", () => {
-        expect(() => requireCompareOp("MyClass", null)).toThrow(/null/);
-    });
-    it("throws on undefined with message containing the type label", () => {
-        expect(() => requireCompareOp("MyClass", undefined)).toThrow(/undefined/);
-    });
-});
-// ---------------------------------------------------------------------------
-// requireOptionalGroup
-// ---------------------------------------------------------------------------
-describe("requireOptionalGroup", () => {
-    it("returns undefined when value is undefined", () => {
-        expect(requireOptionalGroup("MyClass", undefined)).toBeUndefined();
-    });
-    it("returns the input string when value is a non-empty string", () => {
-        expect(requireOptionalGroup("MyClass", "my-group")).toBe("my-group");
-    });
-    it("throws with 'empty string' message on ''", () => {
-        expect(() => requireOptionalGroup("MyClass", "")).toThrow(/empty string/);
-    });
-    it("throws with 'got number' message on 42", () => {
-        expect(() => requireOptionalGroup("MyClass", 42)).toThrow(/got number/);
-    });
-    it("throws with 'null' in message on null", () => {
-        expect(() => requireOptionalGroup("MyClass", null)).toThrow(/null/);
-    });
-});
-// ---------------------------------------------------------------------------
-// computeValuesKey
-// ---------------------------------------------------------------------------
-describe("computeValuesKey", () => {
-    it("returns a string matching /{type}:{count}:{8-hex-chars}/ format", () => {
-        expect(computeValuesKey(["admin"])).toMatch(/^(string|number|boolean):[0-9]+:[0-9a-f]{8}$/);
-    });
-    it("sort determinism: same content in different order produces the same key", () => {
-        expect(computeValuesKey(["b", "a"])).toBe(computeValuesKey(["a", "b"]));
-    });
-    it("count discrimination: ['a'] !== ['a', 'b'] (distinct content → distinct key)", () => {
-        expect(computeValuesKey(["a"])).not.toBe(computeValuesKey(["a", "b"]));
-    });
-    it("dedup parity: ['a'] === ['a', 'a'] (duplicates do not affect the Set-based rule behavior, so they must not affect ruleType either)", () => {
-        // AttrLiteralIn / AttrLiteralNotIn use `new Set(values)` for verify(),
-        // so duplicate elements have no semantic effect. The ruleType must
-        // mirror that — otherwise two logically-equivalent rules would be
-        // placed in different evaluator groups and be AND-combined, when
-        // the caller intended them to be OR-combined (shared ruleType).
-        expect(computeValuesKey(["a"])).toBe(computeValuesKey(["a", "a"]));
-    });
-    it("content discrimination: ['a', 'b'] !== ['a', 'c'] (hash differs)", () => {
-        expect(computeValuesKey(["a", "b"])).not.toBe(computeValuesKey(["a", "c"]));
-    });
-    it("type segment correctness: string array starts with 'string:'", () => {
-        expect(computeValuesKey(["admin"])).toMatch(/^string:/);
-    });
-    it("type segment correctness: number array starts with 'number:'", () => {
-        expect(computeValuesKey([1])).toMatch(/^number:/);
-    });
-    it("type segment correctness: boolean array starts with 'boolean:'", () => {
-        expect(computeValuesKey([true])).toMatch(/^boolean:/);
-    });
-    it("type divergence: computeValuesKey(['1']) !== computeValuesKey([1]) (type segment differs)", () => {
-        expect(computeValuesKey(["1"])).not.toBe(computeValuesKey([1]));
-    });
-    it("separator collision guard: ['a,b', 'c'] !== ['a', 'b,c'] (values containing commas do not collide)", () => {
-        // Regression guard: a naive implementation of the form
-        //   values.map(String).sort().join(",")
-        // would produce the same string "a,b,c" for both inputs and thus the
-        // same ruleType. That would cause the evaluator to OR what the caller
-        // meant as two independent set constraints, weakening authorization.
-        // The canonical form JSON.stringify-es each element before joining,
-        // so quotes/escapes disambiguate the element boundary.
-        expect(computeValuesKey(["a,b", "c"])).not.toBe(computeValuesKey(["a", "b,c"]));
-    });
-    it("pure / referentially transparent: two calls with the same input return the same string", () => {
-        const input = ["x", "y", "z"];
-        expect(computeValuesKey(input)).toBe(computeValuesKey(input));
-    });
-});
-// ---------------------------------------------------------------------------
-// applyCompare
-// ---------------------------------------------------------------------------
-describe("applyCompare", () => {
-    describe("op=lt", () => {
-        it("returns true when left < right (1 < 2)", () => {
-            expect(applyCompare("lt", 1, 2)).toBe(true);
-        });
-        it("returns false when left === right (2 < 2 is false)", () => {
-            expect(applyCompare("lt", 2, 2)).toBe(false);
-        });
-        it("returns false when left > right (3 < 2 is false)", () => {
-            expect(applyCompare("lt", 3, 2)).toBe(false);
-        });
-        it("edge: -Infinity < 0 returns true", () => {
-            expect(applyCompare("lt", -Infinity, 0)).toBe(true);
-        });
-    });
-    describe("op=le", () => {
-        it("returns true when left < right (1 <= 2)", () => {
-            expect(applyCompare("le", 1, 2)).toBe(true);
-        });
-        it("returns true when left === right (2 <= 2)", () => {
-            expect(applyCompare("le", 2, 2)).toBe(true);
-        });
-        it("returns false when left > right (3 <= 2 is false)", () => {
-            expect(applyCompare("le", 3, 2)).toBe(false);
-        });
-        it("edge: 0 >= -0 returns true (ge symmetry check; 0 <= -0 also true)", () => {
-            expect(applyCompare("le", 0, -0)).toBe(true);
-        });
-    });
-    describe("op=gt", () => {
-        it("returns true when left > right (3 > 2)", () => {
-            expect(applyCompare("gt", 3, 2)).toBe(true);
-        });
-        it("returns false when left === right (2 > 2 is false)", () => {
-            expect(applyCompare("gt", 2, 2)).toBe(false);
-        });
-        it("returns false when left < right (1 > 2 is false)", () => {
-            expect(applyCompare("gt", 1, 2)).toBe(false);
-        });
-        it("edge: Infinity > 1e308 returns true", () => {
-            expect(applyCompare("gt", Infinity, 1e308)).toBe(true);
-        });
-    });
-    describe("op=ge", () => {
-        it("returns true when left > right (3 >= 2)", () => {
-            expect(applyCompare("ge", 3, 2)).toBe(true);
-        });
-        it("returns true when left === right (2 >= 2)", () => {
-            expect(applyCompare("ge", 2, 2)).toBe(true);
-        });
-        it("returns false when left < right (1 >= 2 is false)", () => {
-            expect(applyCompare("ge", 1, 2)).toBe(false);
-        });
-        it("edge: 0 >= -0 returns true", () => {
-            expect(applyCompare("ge", 0, -0)).toBe(true);
-        });
-    });
-});
-// ---------------------------------------------------------------------------
-// COMPARE_OPS
-// ---------------------------------------------------------------------------
-describe("COMPARE_OPS", () => {
-    it("exposes exactly 4 values", () => {
-        expect(COMPARE_OPS).toHaveLength(4);
-    });
-    it("contains 'lt', 'le', 'gt', 'ge' in order", () => {
-        expect(COMPARE_OPS).toEqual(["lt", "le", "gt", "ge"]);
-    });
-});

package/dist/__tests__/rules/collectors/ResourceActionPermissionRuleCollector.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ResourceActionPermissionRuleCollector.test.d.mts.map

package/dist/__tests__/rules/collectors/ResourceActionPermissionRuleCollector.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ResourceActionPermissionRuleCollector.test.d.mts","sourceRoot":"","sources":["../../../../src/__tests__/rules/collectors/ResourceActionPermissionRuleCollector.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/collectors/ResourceActionPermissionRuleCollector.test.mjs

@@ -1,27 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { ResourceActionPermissionRuleCollector } from "#/rules/collectors/ResourceActionPermissionRuleCollector.mjs";
-describe("ResourceActionPermissionRuleCollector", () => {
-    const collector = new ResourceActionPermissionRuleCollector();
-    it("creates a HasPermission rule with resource.perm:action", async () => {
-        const ctx = {
-            payload: {},
-            resource: { raw: "document:12345", resourceType: "document", resourceId: "12345" },
-            action: "read",
-        };
-        const rules = await collector.collect(ctx);
-        expect(rules).toHaveLength(1);
-        expect(rules[0].ruleType).toBe("permission");
-        const attrs = new Map([["permissions", ["document:12345.perm:read"]]]);
-        expect(rules[0].verify(attrs)).toBe(true);
-    });
-    it("creates correct permission for nested resources", async () => {
-        const ctx = {
-            payload: {},
-            resource: { raw: "project:1.member", resourceType: "project_member" },
-            action: "update",
-        };
-        const rules = await collector.collect(ctx);
-        const attrs = new Map([["permissions", ["project:1.member.perm:update"]]]);
-        expect(rules[0].verify(attrs)).toBe(true);
-    });
-});

package/dist/__tests__/rules/collectors/ResourceActionScopeRuleCollector.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ResourceActionScopeRuleCollector.test.d.mts.map

package/dist/__tests__/rules/collectors/ResourceActionScopeRuleCollector.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ResourceActionScopeRuleCollector.test.d.mts","sourceRoot":"","sources":["../../../../src/__tests__/rules/collectors/ResourceActionScopeRuleCollector.test.mts"],"names":[],"mappings":""}

package/dist/__tests__/rules/collectors/ResourceActionScopeRuleCollector.test.mjs

@@ -1,48 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { ResourceActionScopeRuleCollector } from "#/rules/collectors/ResourceActionScopeRuleCollector.mjs";
-const makeContext = (resourceType, action, scope) => ({
-    payload: { ...(scope !== undefined ? { scope } : {}) },
-    resource: { raw: `${resourceType}:1`, resourceType, resourceId: "1" },
-    action,
-});
-describe("ResourceActionScopeRuleCollector", () => {
-    const collector = new ResourceActionScopeRuleCollector();
-    it("creates a HasScope rule with action:resourceType", async () => {
-        const rules = await collector.collect(makeContext("document", "read", "read:document"));
-        expect(rules).toHaveLength(1);
-        expect(rules[0].ruleType).toBe("scope");
-        const attrs = new Map([["scopes", ["read:document"]]]);
-        expect(rules[0].verify(attrs)).toBe(true);
-    });
-    it("creates correct scope for nested resource types", async () => {
-        const ctx = {
-            payload: { scope: "update:project_member" },
-            resource: { raw: "project:1.member:2", resourceType: "project_member", resourceId: "2" },
-            action: "update",
-        };
-        const rules = await collector.collect(ctx);
-        expect(rules).toHaveLength(1);
-        const attrs = new Map([["scopes", ["update:project_member"]]]);
-        expect(rules[0].verify(attrs)).toBe(true);
-    });
-    it("returns no rules when payload has no scope claim", async () => {
-        const ctx = makeContext("document", "read");
-        // payload has no scope — simulates DID JWT
-        const rules = await collector.collect(ctx);
-        expect(rules).toHaveLength(0);
-    });
-    it("returns HasScope rule when payload has scope claim", async () => {
-        const ctx = {
-            payload: { scope: "read:document" },
-            resource: { raw: "document:1", resourceType: "document", resourceId: "1" },
-            action: "read",
-        };
-        const rules = await collector.collect(ctx);
-        expect(rules).toHaveLength(1);
-        expect(rules[0].ruleType).toBe("scope");
-    });
-    it("still generates HasScope rule when scope is empty string", async () => {
-        const rules = await collector.collect(makeContext("document", "read", ""));
-        expect(rules).toHaveLength(1);
-    });
-});