@prosopo/user-access-policy 3.12.28 → 3.12.29

package/dist/ruleInput/ruleInput.js

@@ -27,7 +27,8 @@ var accessRulesFilterInput = z.object({
 	userScope: userScopeInput.optional(),
 	userScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
 	groupId: z.string().optional(),
-	blockOnly: z.boolean().optional()
+	blockOnly: z.boolean().optional(),
+	includeDeferred: z.boolean().optional()
 });
 var getAccessRuleFiltersFromInput = (filterInput) => {
 	const { policyScopes, policyScope, ...filterBase } = filterInput;

package/dist/ruleInput/ruleInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAcJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,sBAAsB,CAAC,KAAK;IAC/B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAcJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,sBAAsB,CAAC,KAAK;IAC/B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACG,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}

package/dist/rulesStorage.d.ts

@@ -10,6 +10,7 @@ export type AccessRulesFilter = {
     userScopeMatch?: FilterScopeMatch;
     groupId?: string;
     blockOnly?: boolean;
+    includeDeferred?: boolean;
 };
 export type AccessRuleEntry = {
     rule: AccessRule;

package/dist/rulesStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rulesStorage.d.ts","sourceRoot":"","sources":["../src/rulesStorage.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE1E,oBAAY,gBAAgB;IAC3B,KAAK,UAAU;IACf,MAAM,WAAW;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAK1B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,SAAS,CAAC,EAAE,SAAS,CAAC;IAKtB,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE1D,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,SAAS,CACR,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,CAAC,EAAE,OAAO,EAC5B,mBAAmB,CAAC,EAAE,OAAO,GAC3B,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB,WAAW,CACV,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB,eAAe,CACd,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"rulesStorage.d.ts","sourceRoot":"","sources":["../src/rulesStorage.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE1E,oBAAY,gBAAgB;IAC3B,KAAK,UAAU;IACf,MAAM,WAAW;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAK1B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,SAAS,CAAC,EAAE,SAAS,CAAC;IAKtB,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,SAAS,CAAC,EAAE,OAAO,CAAC;IASpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE1D,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,SAAS,CACR,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,CAAC,EAAE,OAAO,EAC5B,mBAAmB,CAAC,EAAE,OAAO,GAC3B,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB,WAAW,CACV,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB,eAAe,CACd,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC"}

package/dist/tests/blockingRuleShapes.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=blockingRuleShapes.unit.test.d.ts.map

package/dist/tests/blockingRuleShapes.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blockingRuleShapes.unit.test.d.ts","sourceRoot":"","sources":["../../src/tests/blockingRuleShapes.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/blockingRuleShapes.unit.test.js

@@ -0,0 +1,176 @@
+import { CaptchaType } from "@prosopo/types";
+import { describe, expect, it, vi } from "vitest";
+import { InsertRulesEndpoint } from "#policy/api/write/insertRules.js";
+import { AccessPolicyType } from "#policy/rule.js";
+import { accessPolicyInput, sanitizeAccessPolicy, } from "#policy/ruleInput/policyInput.js";
+const makeMockLogger = () => ({
+    trace: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    fatal: vi.fn(),
+    log: vi.fn(),
+    setLogLevel: vi.fn(),
+    getLogLevel: vi.fn().mockReturnValue("info"),
+    with: vi.fn().mockReturnThis(),
+    getScope: vi.fn().mockReturnValue("test"),
+    getPretty: vi.fn().mockReturnValue(false),
+    setPretty: vi.fn(),
+    getPrintStack: vi.fn().mockReturnValue(false),
+    setPrintStack: vi.fn(),
+    getFormat: vi.fn().mockReturnValue("json"),
+    setFormat: vi.fn(),
+});
+const makeMockWriter = () => ({
+    insertRules: vi.fn().mockResolvedValue(["id1"]),
+});
+const getInsertSchema = () => new InsertRulesEndpoint(makeMockWriter(), makeMockLogger()).getRequestArgsSchema();
+describe("blocking rule shapes: plain Block", () => {
+    it("accepts a bare Block", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            description: "bare block",
+        });
+        expect(result.success).toBe(true);
+    });
+    it("rejects captchaType and solvedImagesCount together", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.issues.map((i) => i.path.at(-1)).sort()).toEqual([
+                "captchaType",
+                "solvedImagesCount",
+            ]);
+        }
+    });
+    it("strips both fields on the way into storage", () => {
+        expect(sanitizeAccessPolicy({
+            type: AccessPolicyType.Block,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+            description: "legacy block",
+        })).toEqual({
+            type: AccessPolicyType.Block,
+            description: "legacy block",
+        });
+    });
+});
+describe("blocking rule shapes: Block + deferToVerify", () => {
+    it("accepts the flag on its own, and preserves it", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+            description: "deferred block",
+        });
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.data.deferToVerify).toBe(true);
+        }
+    });
+    it("rejects captchaType and solvedImagesCount despite the flag", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.issues.map((i) => i.path.at(-1)).sort()).toEqual([
+                "captchaType",
+                "solvedImagesCount",
+            ]);
+        }
+    });
+    it("strips both fields on the way into storage", () => {
+        expect(sanitizeAccessPolicy({
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+            description: "deferred block",
+        })).toEqual({
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+            description: "deferred block",
+        });
+    });
+    it("round-trips the flag from its stored string form", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            deferToVerify: "true",
+        });
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.data.deferToVerify).toBe(true);
+        }
+    });
+});
+describe("blocking rule shapes: Restrict keeps its tuning fields", () => {
+    it("accepts captchaType and solvedImagesCount, with or without the flag", () => {
+        for (const deferToVerify of [undefined, true]) {
+            const result = accessPolicyInput.safeParse({
+                type: AccessPolicyType.Restrict,
+                captchaType: CaptchaType.image,
+                solvedImagesCount: 2,
+                ...(deferToVerify === undefined ? {} : { deferToVerify }),
+            });
+            expect(result.success).toBe(true);
+        }
+    });
+    it("survives the sanitiser intact", () => {
+        expect(sanitizeAccessPolicy({
+            type: AccessPolicyType.Restrict,
+            deferToVerify: true,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+        })).toEqual({
+            type: AccessPolicyType.Restrict,
+            deferToVerify: true,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+        });
+    });
+});
+describe("blocking rule shapes: batch validation", () => {
+    const validGroup = {
+        accessPolicy: {
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+            description: "deferred block",
+        },
+        userScopes: [{ ip: "1.1.1.1" }],
+    };
+    const invalidGroup = {
+        accessPolicy: {
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 2,
+            description: "deferred block with tuning fields",
+        },
+        userScopes: [{ ip: "2.2.2.2" }],
+    };
+    it("accepts a batch of well-formed groups", () => {
+        const result = getInsertSchema().safeParse([validGroup, validGroup]);
+        expect(result.success).toBe(true);
+    });
+    it("rejects the entire batch when a single group is malformed", () => {
+        const batch = [
+            ...Array.from({ length: 20 }, () => validGroup),
+            invalidGroup,
+            ...Array.from({ length: 20 }, () => validGroup),
+        ];
+        const result = getInsertSchema().safeParse(batch);
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.issues.map((i) => i.path[0])).toEqual([20, 20]);
+        }
+    });
+});
+//# sourceMappingURL=blockingRuleShapes.unit.test.js.map

package/dist/tests/blockingRuleShapes.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blockingRuleShapes.unit.test.js","sourceRoot":"","sources":["../../src/tests/blockingRuleShapes.unit.test.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACN,iBAAiB,EACjB,oBAAoB,GACpB,MAAM,kCAAkC,CAAC;AAG1C,MAAM,cAAc,GAAG,GAAW,EAAE,CACnC,CAAC;IACA,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;IACZ,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;IAC9B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;IACzC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;IAClB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;CAClB,CAAkB,CAAC;AAErB,MAAM,cAAc,GAAG,GAAsB,EAAE,CAC9C,CAAC;IACA,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC;CAC/C,CAAiC,CAAC;AAEpC,MAAM,eAAe,GAAG,GAAG,EAAE,CAC5B,IAAI,mBAAmB,CACtB,cAAc,EAAE,EAChB,cAAc,EAAE,CAChB,CAAC,oBAAoB,EAAE,CAAC;AAE1B,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBACpE,aAAa;gBACb,mBAAmB;aACnB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,CACL,oBAAoB,CAAC;YACpB,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;YACpB,WAAW,EAAE,cAAc;SAC3B,CAAC,CACF,CAAC,OAAO,CAAC;YACT,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,cAAc;SAC3B,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC,CAAC,CAAC;IAKH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBACpE,aAAa;gBACb,mBAAmB;aACnB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC,CAAC,CAAC;IAIH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,CACL,oBAAoB,CAAC;YACpB,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;YACpB,WAAW,EAAE,gBAAgB;SAC7B,CAAC,CACF,CAAC,OAAO,CAAC;YACT,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,gBAAgB;SAC7B,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,MAAM;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC9E,KAAK,MAAM,aAAa,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;gBAC1C,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACxC,MAAM,CACL,oBAAoB,CAAC;YACpB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;SACpB,CAAC,CACF,CAAC,OAAO,CAAC;YACT,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;SACpB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAIH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACvD,MAAM,UAAU,GAAG;QAClB,YAAY,EAAE;YACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,gBAAgB;SAC7B;QACD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;KAC/B,CAAC;IAEF,MAAM,YAAY,GAAG;QACpB,YAAY,EAAE;YACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;YACpB,WAAW,EAAE,mCAAmC;SAChD;QACD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;KAC/B,CAAC;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG;YACb,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;YAC/C,YAAY;YACZ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;SAC/C,CAAC;QAEF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAGrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/redis/deferredPoolClause.benchmark.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deferredPoolClause.benchmark.d.ts.map

package/dist/tests/redis/deferredPoolClause.benchmark.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferredPoolClause.benchmark.d.ts","sourceRoot":"","sources":["../../../src/tests/redis/deferredPoolClause.benchmark.ts"],"names":[],"mappings":""}

package/dist/tests/redis/deferredPoolClause.benchmark.js

@@ -0,0 +1,175 @@
+import { createClient } from "redis";
+const IP_RULE_COUNT = 17_000;
+const CIDR_RULE_COUNT = 1_300;
+const MIXED_RULE_COUNT = 1_000;
+const DEFERRED_RULE_COUNT = 2_000;
+const WARMUP = 50;
+const ITERATIONS = 500;
+const INDEX = "bench:idx";
+const PREFIX = "bench:";
+const CLAUSES = [
+    { name: "baseline   @type:{block}", clause: "@type:{block}" },
+    {
+        name: "middleware @type:{block} -@deferToVerify:{true}",
+        clause: "@type:{block} -@deferToVerify:{true}",
+    },
+    {
+        name: "verify  (@type:{block} | @deferToVerify:{true})",
+        clause: "(@type:{block} | @deferToVerify:{true})",
+    },
+    {
+        name: "MISGROUPED (@type:{block})|(@deferToVerify:{true})",
+        clause: "(@type:{block})|(@deferToVerify:{true})",
+    },
+];
+const ipv4 = (i) => (10n << 24n) + BigInt(i);
+const ipv4CidrRange = (i) => {
+    const octet = i % 256;
+    const base = (192n << 24n) + (168n << 16n) + (BigInt(octet) << 8n);
+    return { min: base, max: base + 255n };
+};
+const percentile = (sorted, p) => {
+    const idx = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));
+    return sorted[idx] ?? 0;
+};
+const main = async () => {
+    const client = createClient({
+        url: "redis://localhost:6379",
+        password: "root",
+    });
+    await client.connect();
+    await client.flushAll();
+    await client.sendCommand([
+        "FT.CREATE",
+        INDEX,
+        "ON",
+        "HASH",
+        "PREFIX",
+        "1",
+        PREFIX,
+        "SCHEMA",
+        "type",
+        "TAG",
+        "INDEXMISSING",
+        "deferToVerify",
+        "TAG",
+        "INDEXMISSING",
+        "clientId",
+        "TAG",
+        "INDEXMISSING",
+        "numericIp",
+        "NUMERIC",
+        "INDEXMISSING",
+        "numericIpMaskMin",
+        "NUMERIC",
+        "INDEXMISSING",
+        "numericIpMaskMax",
+        "NUMERIC",
+        "INDEXMISSING",
+    ]);
+    let n = 0;
+    const write = async (fields) => {
+        await client.hSet(`${PREFIX}${n++}`, fields);
+    };
+    for (let i = 0; i < IP_RULE_COUNT; i++) {
+        await write({
+            type: "block",
+            description: `bulk-ban-ip-${i}`,
+            numericIp: ipv4(i).toString(),
+            clientId: "global",
+        });
+    }
+    for (let i = 0; i < CIDR_RULE_COUNT; i++) {
+        const { min, max } = ipv4CidrRange(i);
+        await write({
+            type: "block",
+            description: `bulk-ban-cidr-${i}`,
+            numericIpMaskMin: min.toString(),
+            numericIpMaskMax: max.toString(),
+            clientId: "global",
+        });
+    }
+    for (let i = 0; i < MIXED_RULE_COUNT; i++) {
+        await write({
+            type: i % 2 === 0 ? "restrict" : "block",
+            description: `mixed-${i}`,
+            numericIp: ipv4(IP_RULE_COUNT + i).toString(),
+            clientId: `client-${i % 20}`,
+        });
+    }
+    for (let i = 0; i < DEFERRED_RULE_COUNT; i++) {
+        await write({
+            type: "restrict",
+            description: `deferred-${i}`,
+            deferToVerify: "true",
+            numericIp: ipv4(IP_RULE_COUNT + MIXED_RULE_COUNT + i).toString(),
+            clientId: `client-${i % 20}`,
+        });
+    }
+    const total = n;
+    for (;;) {
+        const info = (await client.sendCommand(["FT.INFO", INDEX]));
+        const idx = info.findIndex((v) => String(v) === "indexing");
+        if (idx === -1 || String(info[idx + 1]) === "0")
+            break;
+        await new Promise((r) => setTimeout(r, 200));
+    }
+    console.log(`population: ${total} rules`);
+    console.log(`  ${IP_RULE_COUNT} ip-block, ${CIDR_RULE_COUNT} cidr-block, ${MIXED_RULE_COUNT} mixed, ${DEFERRED_RULE_COUNT} deferred-restrict\n`);
+    const hitIp = ipv4(1234).toString();
+    const cidrIp = ((192n << 24n) + (168n << 16n) + (7n << 8n) + 9n).toString();
+    const scope = "( @clientId:{client-3} | @clientId:{global} )";
+    const probes = [
+        { label: "ip:exact", suffix: `${scope} @numericIp:[${hitIp} ${hitIp}]` },
+        {
+            label: "ip:mask ",
+            suffix: `${scope} @numericIpMaskMin:[-inf ${cidrIp}] @numericIpMaskMax:[${cidrIp} +inf]`,
+        },
+    ];
+    for (const probe of probes) {
+        console.log(`--- probe: ${probe.label} ---`);
+        for (const { name, clause } of CLAUSES) {
+            const query = `${clause} ${probe.suffix}`;
+            for (let i = 0; i < WARMUP; i++) {
+                await client.sendCommand([
+                    "FT.SEARCH",
+                    INDEX,
+                    query,
+                    "NOCONTENT",
+                    "DIALECT",
+                    "2",
+                ]);
+            }
+            const samples = [];
+            let hits = 0;
+            for (let i = 0; i < ITERATIONS; i++) {
+                const t0 = process.hrtime.bigint();
+                const res = (await client.sendCommand([
+                    "FT.SEARCH",
+                    INDEX,
+                    query,
+                    "NOCONTENT",
+                    "DIALECT",
+                    "2",
+                ]));
+                const t1 = process.hrtime.bigint();
+                samples.push(Number(t1 - t0) / 1e6);
+                hits = Number(res[0]);
+            }
+            samples.sort((a, b) => a - b);
+            const mean = samples.reduce((s, v) => s + v, 0) / samples.length;
+            console.log(`  ${name.padEnd(52)} hits=${String(hits).padStart(5)}  ` +
+                `mean=${mean.toFixed(3)}ms  p50=${percentile(samples, 50).toFixed(3)}ms  ` +
+                `p95=${percentile(samples, 95).toFixed(3)}ms  p99=${percentile(samples, 99).toFixed(3)}ms`);
+        }
+        console.log();
+    }
+    await client.sendCommand(["FT.DROPINDEX", INDEX]);
+    await client.flushAll();
+    await client.quit();
+};
+main().catch((e) => {
+    console.error(e);
+    process.exit(1);
+});
+//# sourceMappingURL=deferredPoolClause.benchmark.js.map

package/dist/tests/redis/deferredPoolClause.benchmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferredPoolClause.benchmark.js","sourceRoot":"","sources":["../../../src/tests/redis/deferredPoolClause.benchmark.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAErC,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAI/B,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,KAAK,GAAG,WAAW,CAAC;AAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC;AAIxB,MAAM,OAAO,GAAa;IACzB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,eAAe,EAAE;IAC7D;QACC,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,sCAAsC;KAC9C;IACD;QACC,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,yCAAyC;KACjD;IACD;QACC,IAAI,EAAE,oDAAoD;QAC1D,MAAM,EAAE,yCAAyC;KACjD;CACD,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AAE7D,MAAM,aAAa,GAAG,CAAC,CAAS,EAAgC,EAAE;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,MAAgB,EAAE,CAAS,EAAU,EAAE;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CACnB,MAAM,CAAC,MAAM,GAAG,CAAC,EACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACtC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC3B,GAAG,EAAE,wBAAwB;QAC7B,QAAQ,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAIxB,MAAM,MAAM,CAAC,WAAW,CAAC;QACxB,WAAW;QACX,KAAK;QACL,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,GAAG;QACH,MAAM;QACN,QAAQ;QACR,MAAM;QACN,KAAK;QACL,cAAc;QACd,eAAe;QACf,KAAK;QACL,cAAc;QACd,UAAU;QACV,KAAK;QACL,cAAc;QACd,WAAW;QACX,SAAS;QACT,cAAc;QACd,kBAAkB;QAClB,SAAS;QACT,cAAc;QACd,kBAAkB;QAClB,SAAS;QACT,cAAc;KACd,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,KAAK,GAAG,KAAK,EAAE,MAA8B,EAAiB,EAAE;QACrE,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC;YACX,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,eAAe,CAAC,EAAE;YAC/B,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC7B,QAAQ,EAAE,QAAQ;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC;YACX,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,iBAAiB,CAAC,EAAE;YACjC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;YAChC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;YAChC,QAAQ,EAAE,QAAQ;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,KAAK,CAAC;YACX,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;YACxC,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC7C,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE;SAC5B,CAAC,CAAC;IACJ,CAAC;IAGD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;YACX,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,YAAY,CAAC,EAAE;YAC5B,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,aAAa,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;YAChE,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE;SAC5B,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC;IAEhB,SAAS,CAAC;QACT,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAc,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM;QACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CACV,KAAK,aAAa,cAAc,eAAe,gBAAgB,gBAAgB,WAAW,mBAAmB,sBAAsB,CACnI,CAAC;IAKF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,+CAA+C,CAAC;IAE9D,MAAM,MAAM,GAA6C;QACxD,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,gBAAgB,KAAK,IAAI,KAAK,GAAG,EAAE;QACxE;YACC,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,GAAG,KAAK,4BAA4B,MAAM,wBAAwB,MAAM,QAAQ;SACxF;KACD,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC;QAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACjC,MAAM,MAAM,CAAC,WAAW,CAAC;oBACxB,WAAW;oBACX,KAAK;oBACL,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,GAAG;iBACH,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC;oBACrC,WAAW;oBACX,KAAK;oBACL,KAAK;oBACL,WAAW;oBACX,SAAS;oBACT,GAAG;iBACH,CAAC,CAAc,CAAC;gBACjB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;gBACpC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YACjE,OAAO,CAAC,GAAG,CACV,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBACxD,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAC1E,OAAO,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC3F,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACf,CAAC;IAED,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}

package/dist/tests/redis/reader/redisRulesSplitQuery.unit.test.js

@@ -89,6 +89,39 @@ describe("buildScopedRulesSubQueries", () => {
             expect(sub.query).toContain("@type:{block}");
         }
     });
+    it("emits a separate probe set for deferred rules at verify", () => {
+        const subs = buildScopedRulesSubQueries({ numericIp: 1376899398n }, "clientA", { blockOnly: true, includeDeferred: true });
+        const block = subs.filter((s) => s.kind.startsWith("block:"));
+        const deferred = subs.filter((s) => s.kind.startsWith("deferred:"));
+        expect(block.length).toBeGreaterThan(0);
+        expect(deferred.length).toBe(block.length);
+        for (const sub of block) {
+            expect(sub.query).toContain("@type:{block} -@deferToVerify:{true}");
+        }
+        for (const sub of deferred) {
+            expect(sub.query).toContain("@deferToVerify:{true}");
+            expect(sub.query).not.toContain("@type:{block}");
+        }
+    });
+    it("never merges the two pools into one probe", () => {
+        const subs = buildScopedRulesSubQueries({ numericIp: 1376899398n }, "clientA", { blockOnly: true, includeDeferred: true });
+        for (const sub of subs) {
+            expect(sub.query).not.toContain("| @deferToVerify:{true}");
+        }
+    });
+    it("excludes deferred rules from the request-time pool", () => {
+        const subs = buildScopedRulesSubQueries({ numericIp: 1376899398n }, "clientA", { blockOnly: true });
+        for (const sub of subs) {
+            expect(sub.query).toContain("-@deferToVerify:{true}");
+        }
+    });
+    it("ignores includeDeferred when blockOnly is not set", () => {
+        const subs = buildScopedRulesSubQueries({ numericIp: 1376899398n }, "clientA", { includeDeferred: true });
+        for (const sub of subs) {
+            expect(sub.query).not.toContain("@deferToVerify");
+            expect(sub.query).not.toContain("@type:{block}");
+        }
+    });
     it("emits the same probe kinds regardless of blockOnly", () => {
         const withoutBlock = buildScopedRulesSubQueries({ numericIp: 1376899398n, ja4Hash: "abc" }, "client-A");
         const withBlock = buildScopedRulesSubQueries({ numericIp: 1376899398n, ja4Hash: "abc" }, "client-A", { blockOnly: true });

package/dist/tests/redis/reader/redisRulesSplitQuery.unit.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"redisRulesSplitQuery.unit.test.js","sourceRoot":"","sources":["../../../../src/tests/redis/reader/redisRulesSplitQuery.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACN,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,8CAA8C,CAAC;AAEtD,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,0BAA0B,CACtC;YACC,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,KAAK;SACpB,EACD,UAAU,CACV,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAG7C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACrB,eAAe;YACf,qBAAqB;YACrB,eAAe;SACf,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,0BAA0B,CACtC;YACC,SAAS,EAAE,WAAW;SACtB,EACD,UAAU,CACV,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAK7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAGxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAChG,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAIlC,KAAK,MAAM,KAAK,IAAI;YACnB,QAAQ;YACR,SAAS;YACT,aAAa;YACb,eAAe;YACf,UAAU;YACV,QAAQ;YACR,aAAa;YACb,KAAK;YACL,WAAW;YACX,kBAAkB;YAClB,kBAAkB;SAClB,EAAE,CAAC;YACH,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAG7B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,MAAM,EAAE,eAAe,EAAE,EAC3B,UAAU,CACV,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAC9D,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAGhC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAKxD,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,UAAU,CACV,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,UAAU,EACV,EAAE,SAAS,EAAE,IAAI,EAAE,CACnB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAI7D,MAAM,YAAY,GAAG,0BAA0B,CAC9C,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAC1C,UAAU,CACV,CAAC;QACF,MAAM,SAAS,GAAG,0BAA0B,CAC3C,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAC1C,UAAU,EACV,EAAE,SAAS,EAAE,IAAI,EAAE,CACnB,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CACrD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAW1E,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,kDAAkD,CAClD,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAC/B,8DAA8D,CAC9D,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"redisRulesSplitQuery.unit.test.js","sourceRoot":"","sources":["../../../../src/tests/redis/reader/redisRulesSplitQuery.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACN,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,8CAA8C,CAAC;AAEtD,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,0BAA0B,CACtC;YACC,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,KAAK;SACpB,EACD,UAAU,CACV,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAG7C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACrB,eAAe;YACf,qBAAqB;YACrB,eAAe;SACf,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,0BAA0B,CACtC;YACC,SAAS,EAAE,WAAW;SACtB,EACD,UAAU,CACV,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAK7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAGxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACrD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAChG,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAIlC,KAAK,MAAM,KAAK,IAAI;YACnB,QAAQ;YACR,SAAS;YACT,aAAa;YACb,eAAe;YACf,UAAU;YACV,QAAQ;YACR,aAAa;YACb,KAAK;YACL,WAAW;YACX,kBAAkB;YAClB,kBAAkB;SAClB,EAAE,CAAC;YACH,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAG7B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,MAAM,EAAE,eAAe,EAAE,EAC3B,UAAU,CACV,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAC9D,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAGhC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAKxD,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,UAAU,CACV,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,UAAU,EACV,EAAE,SAAS,EAAE,IAAI,EAAE,CACnB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAIlE,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1C,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAEpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAG3C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QACrE,CAAC;QAGD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QAIpD,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1C,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAI7D,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,CACnB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAG5D,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CACzB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAI7D,MAAM,YAAY,GAAG,0BAA0B,CAC9C,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAC1C,UAAU,CACV,CAAC;QACF,MAAM,SAAS,GAAG,0BAA0B,CAC3C,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,EAC1C,UAAU,EACV,EAAE,SAAS,EAAE,IAAI,EAAE,CACnB,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CACrD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAW1E,MAAM,IAAI,GAAG,0BAA0B,CACtC,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,kDAAkD,CAClD,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS,CAC/B,8DAA8D,CAC9D,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/user-access-policy",
-	"version": "3.12.28",
+	"version": "3.12.29",
 	"type": "module",
 	"engines": {
 		"node": "^24",

package/src/redis/reader/redisRulesQuery.ts

@@ -197,6 +197,29 @@ const getPolicyScopeQuery = (
 		: "";
 };
 
+// Candidate-pool clause for the two hard-block callers.
+//
+// Verify (`includeDeferred`): a deferToVerify rule is skipped at request
+// time and enforced at verify, so it is a valid hard block whatever its
+// type — the pool must admit deferred Restrict rules too.
+//
+// Request time (middleware): deferred rules are never enforceable there,
+// so exclude them server-side rather than fetching and discarding them.
+// Rules with no `deferToVerify` field survive the negation (the field is
+// indexed INDEXMISSING).
+//
+// The union must be wrapped as a single group. `|` binds looser than the
+// implicit intersection, so an unwrapped `(@a:{x})|(@b:{y}) @ip:[…]`
+// parses as `@a:{x} OR (@b:{y} AND @ip:[…])` — the left side escapes the
+// scope and IP filters and matches every Block rule in the index. Both
+// `(@a:{x} | @b:{y})` and `((@a:{x})|(@b:{y}))` group correctly; this
+// form is the shorter one. Requires DIALECT 2, which every caller uses
+// (see REDIS_QUERY_DIALECT).
+export const getBlockPoolClause = (includeDeferred: boolean): string =>
+	includeDeferred
+		? `(@type:{${AccessPolicyType.Block}} | @deferToVerify:{true})`
+		: `@type:{${AccessPolicyType.Block}} -@deferToVerify:{true}`;
+
 /*
  * Search command example:
  *
@@ -219,7 +242,7 @@ export const getRulesRedisQuery = (
 	}
 
 	if (filter.blockOnly) {
-		queryParts.push(`@type:{${AccessPolicyType.Block}}`);
+		queryParts.push(getBlockPoolClause(filter.includeDeferred === true));
 	}
 
 	const policyScopeQuery = getPolicyScopeQuery(

package/src/redis/reader/redisRulesReader.ts

@@ -273,6 +273,7 @@ export class RedisRulesReader implements AccessRulesReader {
 
 		const subQueries = buildScopedRulesSubQueries(userScope, clientId, {
 			...(filter.blockOnly === true && { blockOnly: true }),
+			...(filter.includeDeferred === true && { includeDeferred: true }),
 		});
 
 		try {