@prosopo/user-access-policy 3.11.3 → 3.12.0

package/dist/ruleInput/ruleInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAOJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,iBAAiB,CAAC,KAAK;IAC1B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAOvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAA2C,CAAC;AAEvF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAOJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,iBAAiB,CAAC,KAAK;IAC1B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}

package/dist/tests/redis/reader/redisRulesSplitQuery.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redisRulesSplitQuery.unit.test.d.ts.map

package/dist/tests/redis/reader/redisRulesSplitQuery.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesSplitQuery.unit.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/redis/reader/redisRulesSplitQuery.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/redis/reader/redisRulesSplitQuery.unit.test.js

@@ -0,0 +1,79 @@
+import { describe, expect, it } from "vitest";
+import { buildScopedBlockSubQueries } from "#policy/redis/reader/redisRulesSplitQuery.js";
+describe("buildScopedBlockSubQueries", () => {
+    it("emits one sub-query per populated user-scope field", () => {
+        const subs = buildScopedBlockSubQueries({
+            ja4Hash: "abc",
+            userAgentHash: "def",
+        }, "client-A");
+        const kinds = subs.map((s) => s.kind).sort();
+        expect(kinds).toEqual([
+            "field:ja4Hash",
+            "field:userAgentHash",
+            "no-user-scope",
+        ]);
+    });
+    it("emits both ip-exact and ip-mask sub-queries when request has an IP", () => {
+        const subs = buildScopedBlockSubQueries({
+            numericIp: 3232235777n,
+        }, "client-A");
+        const kinds = subs.map((s) => s.kind);
+        expect(kinds).toContain("ip:exact");
+        expect(kinds).toContain("ip:mask");
+        const ipExact = subs.find((s) => s.kind === "ip:exact");
+        expect(ipExact?.query).toContain("@numericIp:[3232235777 3232235777]");
+        const ipMask = subs.find((s) => s.kind === "ip:mask");
+        expect(ipMask?.query).toContain("@numericIpMaskMin:[-inf 3232235777]");
+        expect(ipMask?.query).toContain("@numericIpMaskMax:[3232235777 +inf]");
+    });
+    it("scopes every sub-query with @type:{block} and @clientId probe", () => {
+        const subs = buildScopedBlockSubQueries({ ja4Hash: "abc" }, "client-A");
+        for (const sub of subs) {
+            expect(sub.query).toContain("@type:{block}");
+            expect(sub.query).toMatch(/@clientId:\{client-A\}/);
+            expect(sub.query).toMatch(/@clientId:\{global\}/);
+            expect(sub.query).toMatch(/ismissing\(@clientId\)/);
+        }
+    });
+    it("skips the client-specific probe when no clientId is passed", () => {
+        const subs = buildScopedBlockSubQueries({ ja4Hash: "abc" }, undefined);
+        for (const sub of subs) {
+            expect(sub.query).toMatch(/@clientId:\{global\}/);
+            expect(sub.query).toMatch(/ismissing\(@clientId\)/);
+        }
+    });
+    it("emits a no-user-scope fall-through query with ismissing() over every user-scope field", () => {
+        const subs = buildScopedBlockSubQueries({ ja4Hash: "abc" }, "client-A");
+        const fallThrough = subs.find((s) => s.kind === "no-user-scope");
+        expect(fallThrough).toBeDefined();
+        for (const field of [
+            "userId",
+            "ja4Hash",
+            "headersHash",
+            "userAgentHash",
+            "headHash",
+            "coords",
+            "countryCode",
+            "asn",
+            "numericIp",
+            "numericIpMaskMin",
+            "numericIpMaskMax",
+        ]) {
+            expect(fallThrough?.query).toContain(`ismissing(@${field})`);
+        }
+    });
+    it("uses NUMERIC range syntax for asn, not TAG syntax", () => {
+        const subs = buildScopedBlockSubQueries({ asn: 205016 }, "client-A");
+        const asnSub = subs.find((s) => s.kind === "field:asn");
+        expect(asnSub).toBeDefined();
+        expect(asnSub?.query).toContain("@asn:[205016 205016]");
+        expect(asnSub?.query).not.toContain("@asn:{");
+    });
+    it("escapes JSON special characters in coords tag queries", () => {
+        const subs = buildScopedBlockSubQueries({ coords: "[[[100,200]]]" }, "client-A");
+        const coordsSub = subs.find((s) => s.kind === "field:coords");
+        expect(coordsSub).toBeDefined();
+        expect(coordsSub?.query).toContain("@coords:{\\[\\[\\[100\\,200\\]\\]\\]}");
+    });
+});
+//# sourceMappingURL=redisRulesSplitQuery.unit.test.js.map

package/dist/tests/redis/reader/redisRulesSplitQuery.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesSplitQuery.unit.test.js","sourceRoot":"","sources":["../../../../src/tests/redis/reader/redisRulesSplitQuery.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAE1F,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,0BAA0B,CACtC;YACC,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,KAAK;SACpB,EACD,UAAU,CACV,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAG7C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACrB,eAAe;YACf,qBAAqB;YACrB,eAAe;SACf,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,0BAA0B,CACtC;YACC,SAAS,EAAE,WAAW;SACtB,EACD,UAAU,CACV,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAK7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAGxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAChG,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAIlC,KAAK,MAAM,KAAK,IAAI;YACnB,QAAQ;YACR,SAAS;YACT,aAAa;YACb,eAAe;YACf,UAAU;YACV,QAAQ;YACR,aAAa;YACb,KAAK;YACL,WAAW;YACX,kBAAkB;YAClB,kBAAkB;SAClB,EAAE,CAAC;YACH,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAG7B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,MAAM,EAAE,eAAe,EAAE,EAC3B,UAAU,CACV,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAC9D,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAGhC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/redis/redisRulesReaderLoad.benchmark.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redisRulesReaderLoad.benchmark.integration.test.d.ts.map

package/dist/tests/redis/redisRulesReaderLoad.benchmark.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesReaderLoad.benchmark.integration.test.d.ts","sourceRoot":"","sources":["../../../src/tests/redis/redisRulesReaderLoad.benchmark.integration.test.ts"],"names":[],"mappings":""}

package/dist/tests/redis/redisRulesReaderLoad.benchmark.integration.test.js

@@ -0,0 +1,288 @@
+import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
+import { createTestRedisConnection, setupRedisIndex, } from "@prosopo/redis-client";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { RedisRulesReader } from "#policy/redis/reader/redisRulesReader.js";
+import { ACCESS_RULES_REDIS_INDEX_NAME, accessRulesRedisIndex, getAccessRuleRedisKey, } from "#policy/redis/redisRuleIndex.js";
+import { getRedisRuleValue } from "#policy/redis/redisRulesWriter.js";
+import { AccessPolicyType } from "#policy/rule.js";
+import { FilterScopeMatch } from "#policy/rulesStorage.js";
+const IP_RULE_COUNT = 17_000;
+const CIDR_RULE_COUNT = 1_300;
+const MIXED_RULE_COUNT = 1_000;
+const QUERY_COUNT = 300;
+const STORM_CONCURRENCY = 100;
+const STORM_WAVE_COUNT = 10;
+const P50_LATENCY_MS = 120;
+const P99_LATENCY_MS = 400;
+const STORM_P50_LATENCY_MS = 200;
+const STORM_P99_LATENCY_MS = 800;
+const ipv4 = (i) => {
+    const base = 10n << 24n;
+    return base + BigInt(i);
+};
+const ipv4CidrRange = (i) => {
+    const octet = i % 256;
+    const base = (192n << 24n) + (168n << 16n) + (BigInt(octet) << 8n);
+    return { min: base, max: base + 255n };
+};
+const buildIpBlockRule = (i) => ({
+    type: AccessPolicyType.Block,
+    description: `bulk-ban-ip-${i}`,
+    numericIp: ipv4(i),
+});
+const buildCidrBlockRule = (i) => {
+    const { min, max } = ipv4CidrRange(i);
+    return {
+        type: AccessPolicyType.Block,
+        description: `bulk-ban-cidr-${i}`,
+        numericIpMaskMin: min,
+        numericIpMaskMax: max,
+    };
+};
+const buildMixedRule = (i) => {
+    const variant = i % 4;
+    if (variant === 0) {
+        return {
+            type: AccessPolicyType.Block,
+            description: `mixed-${i}`,
+            clientId: `client${i % 30}`,
+            ja4Hash: `t13d_load_${i % 50}`,
+        };
+    }
+    if (variant === 1) {
+        return {
+            type: AccessPolicyType.Restrict,
+            description: `mixed-${i}`,
+            countryCode: `C${i % 30}`,
+        };
+    }
+    if (variant === 2) {
+        return {
+            type: AccessPolicyType.Block,
+            description: `mixed-${i}`,
+            asn: 1000 + (i % 500),
+        };
+    }
+    return {
+        type: AccessPolicyType.Block,
+        description: `mixed-${i}`,
+        clientId: `client${i % 30}`,
+        userAgentHash: `ua${i % 100}`,
+    };
+};
+const percentile = (sortedMs, q) => {
+    if (sortedMs.length === 0)
+        return 0;
+    const idx = Math.min(sortedMs.length - 1, Math.floor((sortedMs.length - 1) * q));
+    return sortedMs[idx] ?? 0;
+};
+describe("redisRulesReader load-shape benchmark (17k IP-only rules)", () => {
+    let redisConnection;
+    let redisClient;
+    let reader;
+    const mockLogger = new Proxy({}, {
+        get: () => () => { },
+    });
+    const seededKeys = [];
+    beforeAll(async () => {
+        redisConnection = createTestRedisConnection();
+        redisClient = await setupRedisIndex(redisConnection, accessRulesRedisIndex, mockLogger).getClient();
+        reader = new RedisRulesReader(redisClient, mockLogger);
+        const rules = [];
+        for (let i = 0; i < IP_RULE_COUNT; i++)
+            rules.push(buildIpBlockRule(i));
+        for (let i = 0; i < CIDR_RULE_COUNT; i++)
+            rules.push(buildCidrBlockRule(i));
+        for (let i = 0; i < MIXED_RULE_COUNT; i++)
+            rules.push(buildMixedRule(i));
+        await executeBatchesSequentially(chunkIntoBatches(rules, 1000), async (batch) => {
+            const multi = redisClient.multi();
+            for (const rule of batch) {
+                const key = getAccessRuleRedisKey(rule);
+                seededKeys.push(key);
+                multi.hSet(key, getRedisRuleValue(rule));
+            }
+            await multi.exec();
+        });
+        const indexInfo = await redisClient.ft.info(ACCESS_RULES_REDIS_INDEX_NAME);
+        const expectedRules = IP_RULE_COUNT + CIDR_RULE_COUNT + MIXED_RULE_COUNT;
+        expect(indexInfo.num_docs).toBeGreaterThan(expectedRules * 0.9);
+    }, 300_000);
+    afterAll(async () => {
+        await executeBatchesSequentially(chunkIntoBatches(seededKeys, 1000), async (batch) => {
+            const multi = redisClient.multi();
+            for (const key of batch) {
+                multi.del(key);
+            }
+            await multi.exec();
+        });
+    }, 60_000);
+    test(`split-query hot path stays flat under ${IP_RULE_COUNT + CIDR_RULE_COUNT + MIXED_RULE_COUNT} rules`, async () => {
+        await reader.findRules({
+            policyScope: { clientId: "warmup" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: { numericIp: ipv4(999_999) },
+            userScopeMatch: FilterScopeMatch.Greedy,
+            blockOnly: true,
+        }, true);
+        const samples = [];
+        for (let i = 0; i < QUERY_COUNT; i++) {
+            const isHit = i % 2 === 0;
+            const numericIp = isHit
+                ? ipv4(i % IP_RULE_COUNT)
+                : ipv4(IP_RULE_COUNT + i + 1_000_000);
+            const start = performance.now();
+            await reader.findRules({
+                policyScope: { clientId: `client${i % 30}` },
+                policyScopeMatch: FilterScopeMatch.Greedy,
+                userScope: {
+                    numericIp,
+                    ja4Hash: `t13d_load_${i % 50}`,
+                    userAgentHash: `ua${i % 100}`,
+                    countryCode: `C${i % 30}`,
+                    asn: 1000 + (i % 500),
+                },
+                userScopeMatch: FilterScopeMatch.Greedy,
+                blockOnly: true,
+            }, true);
+            samples.push(performance.now() - start);
+        }
+        samples.sort((a, b) => a - b);
+        const p50 = percentile(samples, 0.5);
+        const p99 = percentile(samples, 0.99);
+        const avg = samples.reduce((a, b) => a + b, 0) / samples.length;
+        console.log(`split-query load: avg=${avg.toFixed(2)}ms  p50=${p50.toFixed(2)}ms  p99=${p99.toFixed(2)}ms  n=${samples.length}  (${IP_RULE_COUNT} IPs + ${CIDR_RULE_COUNT} CIDRs + ${MIXED_RULE_COUNT} mixed)`);
+        expect(p50).toBeLessThan(P50_LATENCY_MS);
+        expect(p99).toBeLessThan(P99_LATENCY_MS);
+    }, 300_000);
+    test("finds exact-IP bulk-ban rule for matching request", async () => {
+        const targetIp = ipv4(42);
+        const results = await reader.findRules({
+            policyScope: { clientId: "client1" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: {
+                numericIp: targetIp,
+                ja4Hash: "t13d_load_1",
+            },
+            userScopeMatch: FilterScopeMatch.Greedy,
+            blockOnly: true,
+        }, true);
+        const found = results.find((r) => r.numericIp === targetIp);
+        expect(found).toBeDefined();
+        expect(found?.type).toBe(AccessPolicyType.Block);
+    }, 60_000);
+    test("finds CIDR-range bulk-ban rule for request IP inside the range", async () => {
+        const { min, max } = ipv4CidrRange(7);
+        const requestIp = min + 42n;
+        expect(requestIp).toBeLessThanOrEqual(max);
+        const results = await reader.findRules({
+            policyScope: { clientId: "client1" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: { numericIp: requestIp },
+            userScopeMatch: FilterScopeMatch.Greedy,
+            blockOnly: true,
+        }, true);
+        const found = results.find((r) => r.numericIpMaskMin === min &&
+            r.numericIpMaskMax === max &&
+            r.type === AccessPolicyType.Block);
+        expect(found).toBeDefined();
+    }, 60_000);
+    test("finds ja4-scoped rule via the split-query ja4 probe", async () => {
+        const results = await reader.findRules({
+            policyScope: { clientId: "client0" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: {
+                numericIp: ipv4(999_998),
+                ja4Hash: "t13d_load_0",
+            },
+            userScopeMatch: FilterScopeMatch.Greedy,
+            blockOnly: true,
+        }, true);
+        const ja4Rule = results.find((r) => r.ja4Hash === "t13d_load_0" && r.clientId === "client0");
+        expect(ja4Rule).toBeDefined();
+    }, 60_000);
+    test("returns no match when request IP is outside every rule range", async () => {
+        const results = await reader.findRules({
+            policyScope: { clientId: "client99" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: { numericIp: ipv4(9_999_999) },
+            userScopeMatch: FilterScopeMatch.Greedy,
+            blockOnly: true,
+        }, true);
+        const ipMatch = results.find((r) => r.numericIp !== undefined ||
+            (r.numericIpMaskMin !== undefined && r.numericIpMaskMax !== undefined));
+        expect(ipMatch).toBeUndefined();
+    }, 60_000);
+    test(`concurrent retry-storm: ${STORM_CONCURRENCY} in-flight × ${STORM_WAVE_COUNT} waves against ${IP_RULE_COUNT + CIDR_RULE_COUNT + MIXED_RULE_COUNT} rules`, async () => {
+        await reader.findRules({
+            policyScope: { clientId: "client1" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: { numericIp: ipv4(999_997) },
+            userScopeMatch: FilterScopeMatch.Greedy,
+            blockOnly: true,
+        }, true);
+        const stormScope = {
+            numericIp: ipv4(42),
+            ja4Hash: "t13d_load_1",
+            userAgentHash: "ua5",
+            countryCode: "C5",
+            asn: 1005,
+        };
+        const clientId = "client1";
+        const allSamples = [];
+        const perWave = [];
+        for (let wave = 0; wave < STORM_WAVE_COUNT; wave++) {
+            const waveStart = performance.now();
+            const waveSamples = [];
+            await Promise.all(Array.from({ length: STORM_CONCURRENCY }, async () => {
+                const start = performance.now();
+                const results = await reader.findRules({
+                    policyScope: { clientId },
+                    policyScopeMatch: FilterScopeMatch.Greedy,
+                    userScope: stormScope,
+                    userScopeMatch: FilterScopeMatch.Greedy,
+                    blockOnly: true,
+                }, true);
+                const dur = performance.now() - start;
+                waveSamples.push(dur);
+                expect(results.find((r) => r.numericIp === stormScope.numericIp)).toBeDefined();
+            }));
+            const waveElapsed = performance.now() - waveStart;
+            waveSamples.sort((a, b) => a - b);
+            const p50 = percentile(waveSamples, 0.5);
+            const p99 = percentile(waveSamples, 0.99);
+            const min = waveSamples[0] ?? 0;
+            const max = waveSamples[waveSamples.length - 1] ?? 0;
+            perWave.push({
+                wave: wave + 1,
+                p50,
+                p99,
+                min,
+                max,
+                elapsedMs: waveElapsed,
+            });
+            allSamples.push(...waveSamples);
+        }
+        allSamples.sort((a, b) => a - b);
+        const overallP50 = percentile(allSamples, 0.5);
+        const overallP99 = percentile(allSamples, 0.99);
+        const overallAvg = allSamples.reduce((a, b) => a + b, 0) / allSamples.length;
+        const totalRequests = STORM_CONCURRENCY * STORM_WAVE_COUNT;
+        const totalElapsed = perWave.reduce((sum, w) => sum + w.elapsedMs, 0);
+        const throughput = (totalRequests * 1000) / totalElapsed;
+        console.log(`storm ${STORM_CONCURRENCY}×${STORM_WAVE_COUNT}: avg=${overallAvg.toFixed(2)}ms  p50=${overallP50.toFixed(2)}ms  p99=${overallP99.toFixed(2)}ms  ` +
+            `throughput=${throughput.toFixed(0)} req/s  total=${totalElapsed.toFixed(0)}ms`);
+        for (const w of perWave) {
+            console.log(`  wave ${w.wave.toString().padStart(2)}: p50=${w.p50.toFixed(2)}ms  p99=${w.p99.toFixed(2)}ms  ` +
+                `min=${w.min.toFixed(2)}ms  max=${w.max.toFixed(2)}ms  wave-elapsed=${w.elapsedMs.toFixed(0)}ms`);
+        }
+        expect(overallP50).toBeLessThan(STORM_P50_LATENCY_MS);
+        expect(overallP99).toBeLessThan(STORM_P99_LATENCY_MS);
+        const firstWave = perWave[0];
+        expect(firstWave).toBeDefined();
+        if (firstWave) {
+            expect(firstWave.p99).toBeLessThan(STORM_P99_LATENCY_MS);
+        }
+    }, 300_000);
+});
+//# sourceMappingURL=redisRulesReaderLoad.benchmark.integration.test.js.map

package/dist/tests/redis/redisRulesReaderLoad.benchmark.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesReaderLoad.benchmark.integration.test.js","sourceRoot":"","sources":["../../../src/tests/redis/redisRulesReaderLoad.benchmark.integration.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAEN,yBAAyB,EACzB,eAAe,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EACN,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAmB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAqB3D,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,WAAW,GAAG,GAAG,CAAC;AAUxB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAQ5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,GAAG,CAAC;AAM3B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE;IAGlC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC;IACxB,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAgC,EAAE;IAIjE,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC;AACxC,CAAC,CAAC;AAGF,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,CAAC;IACpD,IAAI,EAAE,gBAAgB,CAAC,KAAK;IAC5B,WAAW,EAAE,eAAe,CAAC,EAAE;IAC/B,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAc,EAAE;IACpD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO;QACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;QAC5B,WAAW,EAAE,iBAAiB,CAAC,EAAE;QACjC,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,GAAG;KACrB,CAAC;AACH,CAAC,CAAC;AAKF,MAAM,cAAc,GAAG,CAAC,CAAS,EAAc,EAAE;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE;YAC3B,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,EAAE;SAC9B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;SACzB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;SACrB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;QAC5B,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE;QAC3B,aAAa,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE;KAC7B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAE,CAAS,EAAU,EAAE;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CACnB,QAAQ,CAAC,MAAM,GAAG,CAAC,EACnB,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CACrC,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IAC1E,IAAI,eAAgC,CAAC;IACrC,IAAI,WAA4B,CAAC;IACjC,IAAI,MAAwB,CAAC;IAE7B,MAAM,UAAU,GAAG,IAAI,KAAK,CAC3B,EAAE,EACF;QACC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC;KACnB,CACoB,CAAC;IAEvB,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,eAAe,GAAG,yBAAyB,EAAE,CAAC;QAC9C,WAAW,GAAG,MAAM,eAAe,CAClC,eAAe,EACf,qBAAqB,EACrB,UAAU,CACV,CAAC,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAI,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,MAAM,0BAA0B,CAC/B,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,EAC7B,KAAK,EAAE,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CACD,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAG3E,MAAM,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,gBAAgB,CAAC;QACzE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;IACjE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,0BAA0B,CAC/B,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,EAClC,KAAK,EAAE,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CACD,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,yCAAyC,aAAa,GAAG,eAAe,GAAG,gBAAgB,QAAQ,EAAE,KAAK,IAAI,EAAE;QAEpH,MAAM,MAAM,CAAC,SAAS,CACrB;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YACnC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACvC,cAAc,EAAE,gBAAgB,CAAC,MAAM;YACvC,SAAS,EAAE,IAAI;SACf,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YAGtC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,SAAS,GAAG,KAAK;gBACtB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,aAAa,CAAC;gBACzB,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;YAEvC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,SAAS,CACrB;gBACC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE;gBAC5C,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;gBACzC,SAAS,EAAE;oBACV,SAAS;oBACT,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,EAAE;oBAC9B,aAAa,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE;oBAC7B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;oBACzB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;iBACrB;gBACD,cAAc,EAAE,gBAAgB,CAAC,MAAM;gBACvC,SAAS,EAAE,IAAI;aACf,EACD,IAAI,CACJ,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAEhE,OAAO,CAAC,GAAG,CACV,yBAAyB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,MAAM,aAAa,UAAU,eAAe,YAAY,gBAAgB,SAAS,CACjM,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAEpE,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YACpC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE;gBACV,SAAS,EAAE,QAAQ;gBACnB,OAAO,EAAE,aAAa;aACtB;YACD,cAAc,EAAE,gBAAgB,CAAC,MAAM;YACvC,SAAS,EAAE,IAAI;SACf,EACD,IAAI,CACJ,CAAC;QAIF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAEjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YACpC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;YACnC,cAAc,EAAE,gBAAgB,CAAC,MAAM;YACvC,SAAS,EAAE,IAAI;SACf,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,gBAAgB,KAAK,GAAG;YAC1B,CAAC,CAAC,gBAAgB,KAAK,GAAG;YAC1B,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,CAClC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QAItE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YACpC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;gBACxB,OAAO,EAAE,aAAa;aACtB;YACD,cAAc,EAAE,gBAAgB,CAAC,MAAM;YACvC,SAAS,EAAE,IAAI;SACf,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAC9D,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAE/E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE;YACrC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;YACzC,cAAc,EAAE,gBAAgB,CAAC,MAAM;YACvC,SAAS,EAAE,IAAI;SACf,EACD,IAAI,CACJ,CAAC;QAKF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CACvE,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,2BAA2B,iBAAiB,gBAAgB,gBAAgB,kBAAkB,aAAa,GAAG,eAAe,GAAG,gBAAgB,QAAQ,EAAE,KAAK,IAAI,EAAE;QAoBzK,MAAM,MAAM,CAAC,SAAS,CACrB;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YACpC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACvC,cAAc,EAAE,gBAAgB,CAAC,MAAM;YACvC,SAAS,EAAE,IAAI;SACf,EACD,IAAI,CACJ,CAAC;QAKF,MAAM,UAAU,GAAG;YAClB,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,IAAI;SACT,CAAC;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC;QAE3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAOR,EAAE,CAAC;QAER,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,MAAM,WAAW,GAAa,EAAE,CAAC;YAOjC,MAAM,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,KAAK,IAAI,EAAE;gBACpD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;oBACC,WAAW,EAAE,EAAE,QAAQ,EAAE;oBACzB,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;oBACzC,SAAS,EAAE,UAAU;oBACrB,cAAc,EAAE,gBAAgB,CAAC,MAAM;oBACvC,SAAS,EAAE,IAAI;iBACf,EACD,IAAI,CACJ,CAAC;gBACF,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACtC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAMtB,MAAM,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,CACzD,CAAC,WAAW,EAAE,CAAC;YACjB,CAAC,CAAC,CACF,CAAC;YAEF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAClD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,GAAG,CAAC;gBACd,GAAG;gBACH,GAAG;gBACH,GAAG;gBACH,GAAG;gBACH,SAAS,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,UAAU,GACf,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;QAC3D,MAAM,aAAa,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;QAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,YAAY,CAAC;QAEzD,OAAO,CAAC,GAAG,CACV,SAAS,iBAAiB,IAAI,gBAAgB,SAAS,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACjJ,cAAc,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAChF,CAAC;QAIF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CACV,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAChG,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACjG,CAAC;QACH,CAAC;QAED,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;QACtD,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAKtD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC,EAAE,OAAO,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/user-access-policy",
-	"version": "3.11.3",
+	"version": "3.12.0",
 	"type": "module",
 	"engines": {
 		"node": "^24",
@@ -43,12 +43,12 @@
 		"test": "npm run test:unit && npm run test:integration"
 	},
 	"dependencies": {
-		"@prosopo/api": "3.5.12",
+		"@prosopo/api": "3.5.13",
 		"@prosopo/api-route": "2.6.50",
 		"@prosopo/common": "3.1.43",
 		"@prosopo/logger": "2.0.1",
 		"@prosopo/redis-client": "1.0.27",
-		"@prosopo/types": "4.9.5",
+		"@prosopo/types": "4.9.6",
 		"@prosopo/util": "3.3.3",
 		"@redis/search": "5.0.0",
 		"cidr-calc": "1.0.4",

package/src/api/delete/deleteRules.ts

@@ -27,7 +27,13 @@ import {
 } from "#policy/ruleInput/ruleInput.js";
 import type { AccessRulesStorage } from "#policy/rulesStorage.js";
 
-type DeleteRulesSchema = ZodType<AccessRulesFilterInput[]>;
+// `unknown` input position — see accessRulesFilterInput's block comment
+// for why the strict-identity form doesn't fit here.
+type DeleteRulesSchema = ZodType<
+	AccessRulesFilterInput[],
+	z.ZodTypeDef,
+	unknown
+>;
 
 export class DeleteRulesEndpoint implements ApiEndpoint<DeleteRulesSchema> {
 	public constructor(

package/src/api/read/findRuleIds.ts

@@ -27,7 +27,9 @@ import {
 } from "#policy/ruleInput/ruleInput.js";
 import type { AccessRulesStorage } from "#policy/rulesStorage.js";
 
-type FindRulesSchema = ZodType<AccessRulesFilterInput[]>;
+// `unknown` input position — see accessRulesFilterInput's block comment
+// for why the strict-identity form doesn't fit here.
+type FindRulesSchema = ZodType<AccessRulesFilterInput[], z.ZodTypeDef, unknown>;
 
 export type RuleIdsResponse = {
 	ruleIds: string[];

package/src/redis/reader/redisRulesQuery.ts

@@ -14,6 +14,7 @@
 
 import {
 	AccessPolicyType,
+	GLOBAL_CLIENT_SCOPE_SENTINEL,
 	type PolicyScope,
 	type UserIp,
 	type UserScope,
@@ -172,6 +173,13 @@ const getUserScopeFieldQuery = (
 	return `@${fieldName}:{${queryValue}}`;
 };
 
+// Global rules are stamped with `@clientId:{global}` at write time so the
+// scope query can hit the clientId posting list instead of walking the
+// index for ismissing(). The `| ismissing(@clientId)` branch is a
+// transition safety net for rules written before the sentinel shipped —
+// rehash-all migrates them, but we don't gate on that ordering.
+const GLOBAL_MATCH_CLAUSE_INNER = `@clientId:{${GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
+
 const getPolicyScopeQuery = (
 	policyScope: PolicyScope | undefined,
 	scopeMatch: FilterScopeMatch | undefined,
@@ -181,10 +189,12 @@ const getPolicyScopeQuery = (
 	if ("string" === typeof clientId) {
 		return FilterScopeMatch.Exact === scopeMatch
 			? `@clientId:{${clientId}}`
-			: `( @clientId:{${clientId}} | ismissing(@clientId) )`;
+			: `( @clientId:{${clientId}} | ${GLOBAL_MATCH_CLAUSE_INNER} )`;
 	}
 
-	return FilterScopeMatch.Exact === scopeMatch ? "ismissing(@clientId)" : "";
+	return FilterScopeMatch.Exact === scopeMatch
+		? `( ${GLOBAL_MATCH_CLAUSE_INNER} )`
+		: "";
 };
 
 /*