@o3co/auth.policy-verifier.builtins 0.4.0 → 0.5.0

package/dist/rules/HasPermission.d.mts

@@ -26,6 +26,12 @@ import type { ReadonlyAttributes, Rule } from "@o3co/auth.policy-verifier.core";
  * literal halves around the `*` still compare exactly and case-sensitively.
  * Multiple wildcards are rejected outright because the two-part split would
  * silently drop segments and over-grant.
+ *
+ * The two halves must not overlap in the required permission (#180): a grant
+ * of `"posts.*.read"` does not match `"posts.read"`, where the single `.`
+ * would satisfy `startsWith` and `endsWith` at once. The wildcard may match
+ * the empty string, but each character of the required permission counts
+ * toward at most one half.
  */
 export declare class HasPermission implements Rule {
     private permission;

package/dist/rules/HasPermission.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAU1C,OAAO,CAAC,KAAK;CAoBb"}
+{"version":3,"file":"HasPermission.d.mts","sourceRoot":"","sources":["../../src/rules/HasPermission.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAQ,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,aAAc,YAAW,IAAI;IAK7B,OAAO,CAAC,UAAU;IAJ9B,QAAQ,CAAC,QAAQ,gBAAgB;IACjC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEL,UAAU,EAAE,MAAM;IAItC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO;IAoB1C,OAAO,CAAC,KAAK;CA0Bb"}

package/dist/rules/HasPermission.mjs

@@ -28,6 +28,12 @@ import { ATTR_PERMISSIONS, ATTR_ROLES } from "@o3co/auth.policy-verifier.core";
  * literal halves around the `*` still compare exactly and case-sensitively.
  * Multiple wildcards are rejected outright because the two-part split would
  * silently drop segments and over-grant.
+ *
+ * The two halves must not overlap in the required permission (#180): a grant
+ * of `"posts.*.read"` does not match `"posts.read"`, where the single `.`
+ * would satisfy `startsWith` and `endsWith` at once. The wildcard may match
+ * the empty string, but each character of the required permission counts
+ * toward at most one half.
  */
 export class HasPermission {
     permission;
@@ -39,10 +45,20 @@ export class HasPermission {
         this.message = `User does not have required permission: ${permission}`;
     }
     verify(attrs) {
-        const direct = attrs.get(ATTR_PERMISSIONS) ?? [];
-        const fromRoles = (attrs.get(ATTR_ROLES) ?? []).flatMap((role) => role.permissions);
-        const all = [...direct, ...fromRoles];
-        return all.some((p) => this.match(p, this.permission));
+        // Nothing about these values is taken on the cast's word (#180): both
+        // arrive from collectors, and a store-backed one can hand back anything
+        // — a non-array under either key, a role whose `permissions` is missing
+        // or not an array, non-string entries. Every malformed shape is ignored
+        // rather than half-honoured: an entry-level guard alone still throws on
+        // a non-array container, and spreading a bare string under
+        // `permissions` would splay it into characters, letting a
+        // one-character requirement match a value that was never a grant.
+        const direct = attrs.get(ATTR_PERMISSIONS);
+        const roles = attrs.get(ATTR_ROLES);
+        const fromRoles = (Array.isArray(roles) ? roles : []).flatMap((role) => Array.isArray(role?.permissions) ? role.permissions : []);
+        const all = [...(Array.isArray(direct) ? direct : []), ...fromRoles];
+        // Non-string entries never match and never throw, as in HasScope (#116).
+        return all.some((p) => typeof p === "string" && this.match(p, this.permission));
     }
     match(permission, required) {
         if (permission === "*")
@@ -60,6 +76,13 @@ export class HasPermission {
             if ((permission.match(/\*/g) ?? []).length > 1)
                 return false;
             const [prefix, suffix] = permission.split("*");
+            // The halves must not overlap in `required` (#180): "posts.*.read"
+            // must not match "posts.read", where the single "." satisfies both
+            // startsWith and endsWith. Length is the whole check — the wildcard
+            // may match the empty string, but a character may only count toward
+            // one half.
+            if (required.length < prefix.length + suffix.length)
+                return false;
             return (!prefix || required.startsWith(prefix)) && (!suffix || required.endsWith(suffix));
         }
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.builtins",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -31,12 +31,12 @@
     }
   },
   "dependencies": {
-    "@o3co/auth.policy-verifier.core": "0.4.0"
+    "@o3co/auth.policy-verifier.core": "0.5.0"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
-    "@vitest/coverage-v8": "^4.1.10",
-    "vitest": "^4.1.10"
+    "@types/node": "^26.4.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    "vitest": "^4.1.11"
   },
   "scripts": {
     "prebuild": "rimraf dist",