@prosopo/user-access-policy 3.12.6 → 3.12.8

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/user-access-policy@3.12.6 build:cjs
+> @prosopo/user-access-policy@3.12.8 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -58,11 +58,11 @@ rendering chunks...
 dist/cjs/api/read/findRuleIds.cjs                1.65 kB
 dist/cjs/redis/redisClient.cjs                   2.09 kB
 dist/cjs/ruleInput/ruleInput.cjs                 2.11 kB
-dist/cjs/ruleInput/policyInput.cjs               2.14 kB
 dist/cjs/api/rulesApiClient.cjs                  2.60 kB
 dist/cjs/redis/reader/redisRulesSplitQuery.cjs   2.66 kB
 dist/cjs/ruleInput/userScopeInput.cjs            2.67 kB
 dist/cjs/redis/reader/redisAggregate.cjs         2.98 kB
+dist/cjs/ruleInput/policyInput.cjs               2.99 kB
 dist/cjs/transformRule.cjs                       3.05 kB
 dist/cjs/redis/redisRuleIndex.cjs                3.07 kB
 dist/cjs/api/write/insertRules.cjs               3.38 kB
@@ -70,4 +70,4 @@ rendering chunks...
 dist/cjs/api/ruleApiRoutes.cjs                   4.55 kB
 dist/cjs/redis/reader/redisRulesQuery.cjs        4.60 kB
 dist/cjs/redis/reader/redisRulesReader.cjs      17.15 kB
-✓ built in 576ms
+✓ built in 529ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/user-access-policy@3.12.6 build:tsc
+> @prosopo/user-access-policy@3.12.8 build:tsc
 > tsc --build --verbose
 
-12:17:14 PM - Projects in this build: 
+9:05:22 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -15,27 +15,27 @@
     * ../api/tsconfig.json
     * tsconfig.json
 
-12:17:14 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/index.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/procaptcha/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/utils/batches.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+9:05:23 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-12:17:14 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+9:05:23 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:17:14 PM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
+9:05:23 AM - Building project '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/user-access-policy@3.12.6 build
+> @prosopo/user-access-policy@3.12.8 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/user-access-policy@3.12.6 build:cross-env
+> @prosopo/user-access-policy@3.12.8 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -60,18 +60,18 @@ rendering chunks...
 dist/api/delete/deleteRuleGroups.js         1.44 kB
 dist/api/read/findRuleIds.js                1.54 kB
 dist/api/write/rehashRules.js               1.54 kB
-dist/ruleInput/ruleInput.js                 1.76 kB
+dist/ruleInput/ruleInput.js                 1.77 kB
 dist/redis/redisClient.js                   1.90 kB
-dist/ruleInput/policyInput.js               1.96 kB
 dist/api/rulesApiClient.js                  2.36 kB
 dist/ruleInput/userScopeInput.js            2.44 kB
 dist/redis/reader/redisRulesSplitQuery.js   2.55 kB
 dist/redis/redisRuleIndex.js                2.58 kB
-dist/transformRule.js                       2.76 kB
+dist/ruleInput/policyInput.js               2.77 kB
+dist/transformRule.js                       2.77 kB
 dist/redis/reader/redisAggregate.js         2.77 kB
 dist/api/write/insertRules.js               3.22 kB
 dist/redis/redisRulesWriter.js              3.47 kB
 dist/api/ruleApiRoutes.js                   4.33 kB
 dist/redis/reader/redisRulesQuery.js        4.45 kB
 dist/redis/reader/redisRulesReader.js      16.17 kB
-✓ built in 585ms
+✓ built in 532ms

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @prosopo/user-access-policy
 
+## 3.12.8
+### Patch Changes
+
+- c61dfb5: fix(access-policy): reject Block+captchaType at schema level; add follow-up test coverage
+  
+  **Fix.** The `sanitizeAccessPolicy` helper silently strips `captchaType` and `solvedImagesCount` from Block policies at write time, which meant operators writing e.g. `--block --ip X --captchaType image` got a rule that actually blocked EVERY captcha type for that IP — not just image. Same root cause as the Block+deferToVerify request-time 400 bug (see #2885). Rejecting at input surfaces the mismatch loudly with a message that points the operator at Restrict:
+  
+  ```
+  Block policies cannot pin a captchaType — Block always applies to every
+  captcha type. Use a Restrict policy if you want to narrow the effect to
+  one captcha type.
+  ```
+  
+  `accessPolicyInput` now has a `superRefine` that rejects Block+captchaType and Block+solvedImagesCount. The read path still accepts the legacy shape (records written before the refinement landed can still be parsed by the reader). The `addUserAccessPolicy` script was updated to only emit those fields for Restrict, so its `--block` path no longer 400s.
+  
+  **Follow-up tests added** — closing the gaps flagged in the previous session:
+  
+  - **Coord threading lands on the puzzle record** (`puzzleTasks.unit.test.ts`) — extends the verify-puzzle-solution suite to encode a real salt with `(158, 42)`, submit, and assert `coords[0][0] === [158, 42]` on the persisted record. Guards against a regression that drops the salt decode or writes `[0, 0]` — the whole point of the puzzle DM threading PR (#2873).
+  - **DM deny reason lands on the pow commitment** (`powTasks.unit.test.ts`) — pow's existing "should deny when decision machine returns deny" test only asserted `verified:false`; now also asserts the DM's reason string is persisted on the commitment.
+  - **checkForHardBlock wins over DM deny at verify** (`puzzleTasks.unit.test.ts`) — stubs `checkForHardBlock` to match, stubs the DM to also deny with a distinguishable reason, asserts the commitment carries `ACCESS_POLICY_BLOCK` and that the DM was never consulted. Locks in the ordering that the audit trail depends on.
+  - **Rule expiry** (`redisRulesStorage.integration.test.ts`) — inserts a rule with a 2 s TTL, waits past expiry, asserts the Redis hash is gone and the RediSearch index no longer counts it. The existing "inserts time limited rule" test only verified the TTL was set, not that expired rules stop matching.
+
+## 3.12.7
+### Patch Changes
+
+- Updated dependencies [a0cb39e]
+  - @prosopo/types@4.9.12
+  - @prosopo/api@3.5.19
+
 ## 3.12.6
 ### Patch Changes
 

package/dist/cjs/ruleInput/policyInput.cjs

@@ -3,7 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const types = require("@prosopo/types");
 const zod = require("zod");
 const rule = require("../rule.cjs");
-const accessPolicyInput = zod.z.object({
+const accessPolicyInputShape = zod.z.object({
   type: zod.z.nativeEnum(rule.AccessPolicyType),
   captchaType: types.CaptchaTypeSchema.optional(),
   description: zod.z.coerce.string().optional(),
@@ -22,6 +22,25 @@ const accessPolicyInput = zod.z.object({
   // round-trip to the JS boolean the matcher expects.
   deferToVerify: zod.z.preprocess((v) => typeof v === "string" ? v === "true" : v, zod.z.boolean()).optional()
 });
+const accessPolicyInput = accessPolicyInputShape.superRefine(
+  (policy, ctx) => {
+    if (policy.type !== rule.AccessPolicyType.Block) return;
+    if (policy.captchaType !== void 0) {
+      ctx.addIssue({
+        code: zod.z.ZodIssueCode.custom,
+        path: ["captchaType"],
+        message: "Block policies cannot pin a captchaType — Block always applies to every captcha type. Use a Restrict policy if you want to narrow the effect to one captcha type."
+      });
+    }
+    if (policy.solvedImagesCount !== void 0) {
+      ctx.addIssue({
+        code: zod.z.ZodIssueCode.custom,
+        path: ["solvedImagesCount"],
+        message: "Block policies cannot set solvedImagesCount — the field only applies to Restrict policies that adjust image-captcha rounds."
+      });
+    }
+  }
+);
 const sanitizeAccessPolicy = (policy) => {
   if (policy.type === rule.AccessPolicyType.Block) {
     const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
@@ -41,5 +60,6 @@ const policyScopeInput = zod.z.object({
   )
 });
 exports.accessPolicyInput = accessPolicyInput;
+exports.accessPolicyInputShape = accessPolicyInputShape;
 exports.policyScopeInput = policyScopeInput;
 exports.sanitizeAccessPolicy = sanitizeAccessPolicy;

package/dist/cjs/ruleInput/ruleInput.cjs

@@ -15,7 +15,7 @@ const ruleGroupInput = zod.z.object({
   return ruleGroup;
 });
 const accessRuleInput = zod.z.object({
-  ...policyInput.accessPolicyInput.shape,
+  ...policyInput.accessPolicyInputShape.shape,
   ...policyInput.policyScopeInput.shape
 }).and(userScopeInput.userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
 const ruleEntryInput = zod.z.object({

package/dist/cjs/transformRule.cjs

@@ -23,7 +23,7 @@ const transformAccessRuleRecordIntoRule = (ruleRecord) => (
 );
 const transformAccessRuleIntoRecord = (rule) => accessRuleToRecordScheme.parse(rule);
 const accessRuleToRecordScheme = zod.z.object({
-  ...policyInput.accessPolicyInput.shape,
+  ...policyInput.accessPolicyInputShape.shape,
   ...policyInput.policyScopeInput.shape,
   ...userScopeInput.userScopeSchema.shape,
   groupId: zod.z.coerce.string().optional()

package/dist/ruleInput/policyInput.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { type AccessPolicy, AccessPolicyType } from "#policy/rule.js";
-export declare const accessPolicyInput: z.ZodObject<{
+export declare const accessPolicyInputShape: z.ZodObject<{
     type: z.ZodNativeEnum<typeof AccessPolicyType>;
     captchaType: z.ZodOptional<z.ZodNativeEnum<typeof import("@prosopo/types").CaptchaType>>;
     description: z.ZodOptional<z.ZodString>;
@@ -31,6 +31,57 @@ export declare const accessPolicyInput: z.ZodObject<{
     frictionlessScore?: number | undefined;
     deferToVerify?: unknown;
 }>;
+export declare const accessPolicyInput: z.ZodEffects<z.ZodObject<{
+    type: z.ZodNativeEnum<typeof AccessPolicyType>;
+    captchaType: z.ZodOptional<z.ZodNativeEnum<typeof import("@prosopo/types").CaptchaType>>;
+    description: z.ZodOptional<z.ZodString>;
+    solvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    imageThreshold: z.ZodOptional<z.ZodNumber>;
+    powDifficulty: z.ZodOptional<z.ZodNumber>;
+    unsolvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    frictionlessScore: z.ZodOptional<z.ZodNumber>;
+    deferToVerify: z.ZodOptional<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+}>, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+}>;
 export declare const sanitizeAccessPolicy: (policy: AccessPolicy) => AccessPolicy;
 export declare const policyScopeInput: z.ZodObject<{
     clientId: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, unknown>;

package/dist/ruleInput/policyInput.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policyInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAGhB,MAAM,iBAAiB,CAAC;AAOzB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBI,CAAC;AAGnC,eAAO,MAAM,oBAAoB,WAAY,YAAY,KAAG,YAM3D,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAUI,CAAC"}
+{"version":3,"file":"policyInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAGhB,MAAM,iBAAiB,CAAC;AAwBzB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBD,CAAC;AAEnC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB7B,CAAC;AAOF,eAAO,MAAM,oBAAoB,WAAY,YAAY,KAAG,YAM3D,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAUI,CAAC"}

package/dist/ruleInput/policyInput.js

@@ -1,7 +1,7 @@
 import { CaptchaTypeSchema } from "@prosopo/types";
 import { z } from "zod";
 import { AccessPolicyType, GLOBAL_CLIENT_SCOPE_SENTINEL } from "../rule.js";
-const accessPolicyInput = z.object({
+const accessPolicyInputShape = z.object({
   type: z.nativeEnum(AccessPolicyType),
   captchaType: CaptchaTypeSchema.optional(),
   description: z.coerce.string().optional(),
@@ -20,6 +20,25 @@ const accessPolicyInput = z.object({
   // round-trip to the JS boolean the matcher expects.
   deferToVerify: z.preprocess((v) => typeof v === "string" ? v === "true" : v, z.boolean()).optional()
 });
+const accessPolicyInput = accessPolicyInputShape.superRefine(
+  (policy, ctx) => {
+    if (policy.type !== AccessPolicyType.Block) return;
+    if (policy.captchaType !== void 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["captchaType"],
+        message: "Block policies cannot pin a captchaType — Block always applies to every captcha type. Use a Restrict policy if you want to narrow the effect to one captcha type."
+      });
+    }
+    if (policy.solvedImagesCount !== void 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["solvedImagesCount"],
+        message: "Block policies cannot set solvedImagesCount — the field only applies to Restrict policies that adjust image-captcha rounds."
+      });
+    }
+  }
+);
 const sanitizeAccessPolicy = (policy) => {
   if (policy.type === AccessPolicyType.Block) {
     const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
@@ -40,6 +59,7 @@ const policyScopeInput = z.object({
 });
 export {
   accessPolicyInput,
+  accessPolicyInputShape,
   policyScopeInput,
   sanitizeAccessPolicy
 };

package/dist/ruleInput/policyInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyInput.js","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEN,gBAAgB,EAChB,4BAA4B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAI/C,aAAa,EAAE,CAAC;SACd,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC1E,QAAQ,EAAE;CACoB,CAAC,CAAC;AAGnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAoB,EAAgB,EAAE;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC;QAClE,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAMxC,QAAQ,EAAE,CAAC,CAAC,UAAU,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAC5B;CAC8B,CAAC,CAAC"}
+{"version":3,"file":"policyInput.js","sourceRoot":"","sources":["../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEN,gBAAgB,EAChB,4BAA4B,GAE5B,MAAM,iBAAiB,CAAC;AAwBzB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAI/C,aAAa,EAAE,CAAC;SACd,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC1E,QAAQ,EAAE;CACoB,CAAC,CAAC;AAEnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,CAClE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACf,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO;IACnD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACN,mKAAmK;SACpK,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EACN,6HAA6H;SAC9H,CAAC,CAAC;IACJ,CAAC;AACF,CAAC,CACD,CAAC;AAOF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAoB,EAAgB,EAAE;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC;QAClE,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAMxC,QAAQ,EAAE,CAAC,CAAC,UAAU,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAC5B;CAC8B,CAAC,CAAC"}

package/dist/ruleInput/ruleInput.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,KAAK,cAAc,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,YAAY,GACzC,WAAW,GACX,cAAc,GACd,cAAc,CAAC;AAsBhB,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAOL,CAAC;AAEnE,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAIrC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACxD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAQF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYS,CAAC;AAE7C,eAAO,MAAM,6BAA6B,gBAC5B,sBAAsB,KACjC,iBAAiB,EAiBnB,CAAC"}
+{"version":3,"file":"ruleInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,KAAK,cAAc,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,YAAY,GACzC,WAAW,GACX,cAAc,GACd,cAAc,CAAC;AA6BhB,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAOL,CAAC;AAEnE,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAIrC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACxD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAQF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYS,CAAC;AAE7C,eAAO,MAAM,6BAA6B,gBAC5B,sBAAsB,KACjC,iBAAiB,EAiBnB,CAAC"}

package/dist/ruleInput/ruleInput.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { FilterScopeMatch } from "../rulesStorage.js";
-import { policyScopeInput, accessPolicyInput } from "./policyInput.js";
+import { policyScopeInput, accessPolicyInputShape } from "./policyInput.js";
 import { userScopeInput } from "./userScopeInput.js";
 const ruleGroupInput = z.object({
   groupId: z.coerce.string().optional(),
@@ -13,7 +13,7 @@ const ruleGroupInput = z.object({
   return ruleGroup;
 });
 const accessRuleInput = z.object({
-  ...accessPolicyInput.shape,
+  ...accessPolicyInputShape.shape,
   ...policyScopeInput.shape
 }).and(userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
 const ruleEntryInput = z.object({

package/dist/ruleInput/ruleInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAOJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,iBAAiB,CAAC,KAAK;IAC1B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}
+{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAcJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,sBAAsB,CAAC,KAAK;IAC/B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACS,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}

package/dist/tests/policyInput.unit.test.js

@@ -1,7 +1,7 @@
 import { CaptchaType } from "@prosopo/types";
 import { describe, expect, it } from "vitest";
 import { AccessPolicyType } from "#policy/rule.js";
-import { sanitizeAccessPolicy } from "#policy/ruleInput/policyInput.js";
+import { accessPolicyInput, sanitizeAccessPolicy, } from "#policy/ruleInput/policyInput.js";
 describe("sanitizeAccessPolicy", () => {
     describe("block policies", () => {
         it("should remove captchaType from block policies", () => {
@@ -113,4 +113,53 @@ describe("sanitizeAccessPolicy", () => {
         });
     });
 });
+describe("accessPolicyInput refinement", () => {
+    it("rejects Block + captchaType with a clear message pointing at Restrict", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            captchaType: CaptchaType.image,
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            const issue = result.error.issues.find((i) => i.path.includes("captchaType"));
+            expect(issue).toBeDefined();
+            expect(issue?.message).toMatch(/Block policies cannot pin a captchaType/);
+            expect(issue?.message).toMatch(/Restrict policy/);
+        }
+    });
+    it("rejects Block + solvedImagesCount", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            solvedImagesCount: 3,
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            const issue = result.error.issues.find((i) => i.path.includes("solvedImagesCount"));
+            expect(issue).toBeDefined();
+            expect(issue?.message).toMatch(/Block policies cannot set solvedImagesCount/);
+        }
+    });
+    it("accepts Block without the disallowed fields", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            description: "clean block",
+        });
+        expect(result.success).toBe(true);
+    });
+    it("accepts Block + deferToVerify (deferToVerify is orthogonal to the type-pin restriction)", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Block,
+            deferToVerify: true,
+        });
+        expect(result.success).toBe(true);
+    });
+    it("accepts Restrict + captchaType + solvedImagesCount (these are Restrict's whole point)", () => {
+        const result = accessPolicyInput.safeParse({
+            type: AccessPolicyType.Restrict,
+            captchaType: CaptchaType.image,
+            solvedImagesCount: 5,
+        });
+        expect(result.success).toBe(true);
+    });
+});
 //# sourceMappingURL=policyInput.unit.test.js.map

package/dist/tests/policyInput.unit.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyInput.unit.test.js","sourceRoot":"","sources":["../../src/tests/policyInput.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACrC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACxD,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,mBAAmB;aAChC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC9D,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,mBAAmB;aAChC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;YACnF,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,mBAAmB;aAChC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,GAAG;gBACnB,aAAa,EAAE,EAAE;gBACjB,mBAAmB,EAAE,CAAC;gBACtB,iBAAiB,EAAE,GAAG;aACtB,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,GAAG;gBACnB,aAAa,EAAE,EAAE;gBACjB,mBAAmB,EAAE,CAAC;gBACtB,iBAAiB,EAAE,GAAG;aACtB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,sBAAsB;aACnC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,sBAAsB;aACnC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC7D,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;YAClF,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policyInput.unit.test.js","sourceRoot":"","sources":["../../src/tests/policyInput.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACN,iBAAiB,EACjB,oBAAoB,GACpB,MAAM,kCAAkC,CAAC;AAE1C,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACrC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACxD,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,mBAAmB;aAChC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC9D,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,mBAAmB;aAChC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;YACnF,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,mBAAmB;aAChC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,GAAG;gBACnB,aAAa,EAAE,EAAE;gBACjB,mBAAmB,EAAE,CAAC;gBACtB,iBAAiB,EAAE,GAAG;aACtB,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW,EAAE,mBAAmB;gBAChC,cAAc,EAAE,GAAG;gBACnB,aAAa,EAAE,EAAE;gBACjB,mBAAmB,EAAE,CAAC;gBACtB,iBAAiB,EAAE,GAAG;aACtB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,sBAAsB;aACnC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,WAAW,EAAE,sBAAsB;aACnC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC7D,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;YAClF,MAAM,KAAK,GAAG;gBACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACtB,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,sBAAsB;aACnC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAOH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,WAAW,CAAC,KAAK;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC9B,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;YAC1E,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,iBAAiB,EAAE,CAAC;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CACpC,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAC7B,6CAA6C,CAC7C,CAAC;QACH,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW,EAAE,aAAa;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QAClG,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAChG,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,iBAAiB,EAAE,CAAC;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/redis/redisRulesStorage.integration.test.js

@@ -95,6 +95,27 @@ describe("redisAccessRulesStorage", () => {
             expect(recordExpirySeconds).toBeLessThanOrEqual(expirationTimestampInSeconds);
             expect(indexRecordsCount).toBe(1);
         });
+        test("expired rule is no longer returned by the reader after its TTL fires", async () => {
+            const accessRule = {
+                type: AccessPolicyType.Block,
+                clientId: `expiring-${getUniqueString()}`,
+            };
+            const ruleKey = getAccessRuleRedisKey(accessRule);
+            const expirationTimestampInSeconds = Math.floor(Date.now() / 1000) + 2;
+            await accessRulesWriter.insertRules([
+                {
+                    rule: accessRule,
+                    expiresUnixTimestamp: expirationTimestampInSeconds,
+                },
+            ]);
+            const initialRecord = await redisClient.hGetAll(ruleKey);
+            expect(initialRecord).toEqual(accessRule);
+            await new Promise((resolve) => setTimeout(resolve, 3500));
+            const expiredRecord = await redisClient.hGetAll(ruleKey);
+            expect(expiredRecord).toEqual({});
+            const indexRecordsCount = await getIndexRecordsCount(indexName);
+            expect(indexRecordsCount).toBe(0);
+        }, 10_000);
         test("deletes rules", async () => {
             const johnAccessRule = {
                 type: AccessPolicyType.Block,