@prosopo/user-access-policy 3.12.7 → 3.12.9

package/src/ruleInput/policyInput.ts

@@ -27,7 +27,24 @@ import {
 // (preprocess accepts anything), which fails the
 // `ZodType<T, ZodTypeDef, T>` identity check. The `AllKeys<AccessPolicy>`
 // constraint still catches missing-field regressions.
-export const accessPolicyInput = z.object({
+//
+// The `superRefine` rejects Block+captchaType and Block+solvedImagesCount
+// at write time. Those fields are meaningless on a Block policy — the
+// sanitizer used to silently strip them, which meant operators writing
+// e.g. "block image captchas for this IP" got a rule that actually
+// blocked EVERY captcha type. The bug in #2885 (Block+deferToVerify 400
+// on every /captcha/*) was a knock-on of the same silent-strip: the
+// captchaType-equality check on the read side compared `undefined` to the
+// request's captchaType and rejected. Rejecting at input surfaces the
+// mismatch loudly so operators can adjust their intent (they usually
+// wanted a Restrict) rather than persisting a rule that doesn't match
+// what they typed.
+// Base ZodObject shape — reused via `.shape` by `ruleInput` and
+// `transformRule` (both compose accessPolicyInput's fields with policy /
+// user scope fields via object spread). Split from `accessPolicyInput`
+// below because that one applies a `.superRefine` and returns a
+// `ZodEffects`, which loses `.shape`.
+export const accessPolicyInputShape = z.object({
 	type: z.nativeEnum(AccessPolicyType),
 	captchaType: CaptchaTypeSchema.optional(),
 	description: z.coerce.string().optional(),
@@ -49,7 +66,33 @@ export const accessPolicyInput = z.object({
 		.optional(),
 } satisfies AllKeys<AccessPolicy>);
 
-// Sanitize block policies by removing captchaType and solvedImagesCount
+export const accessPolicyInput = accessPolicyInputShape.superRefine(
+	(policy, ctx) => {
+		if (policy.type !== AccessPolicyType.Block) return;
+		if (policy.captchaType !== undefined) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["captchaType"],
+				message:
+					"Block policies cannot pin a captchaType — Block always applies to every captcha type. Use a Restrict policy if you want to narrow the effect to one captcha type.",
+			});
+		}
+		if (policy.solvedImagesCount !== undefined) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["solvedImagesCount"],
+				message:
+					"Block policies cannot set solvedImagesCount — the field only applies to Restrict policies that adjust image-captcha rounds.",
+			});
+		}
+	},
+);
+
+// Historical helper: strip fields the sanitizer used to remove silently.
+// Kept as a no-op-in-practice safety net because Redis records written
+// before the superRefine on `accessPolicyInput` (above) may still carry
+// the stripped fields — reading them back should still normalize to the
+// canonical shape. New writes are rejected at input.
 export const sanitizeAccessPolicy = (policy: AccessPolicy): AccessPolicy => {
 	if (policy.type === AccessPolicyType.Block) {
 		const { captchaType, solvedImagesCount, ...blockPolicy } = policy;

package/src/ruleInput/ruleInput.ts

@@ -20,7 +20,7 @@ import {
 	type AccessRulesFilter,
 	FilterScopeMatch,
 } from "#policy/rulesStorage.js";
-import { accessPolicyInput, policyScopeInput } from "./policyInput.js";
+import { accessPolicyInputShape, policyScopeInput } from "./policyInput.js";
 import { type UserScopeInput, userScopeInput } from "./userScopeInput.js";
 
 type RuleGroupInput = {
@@ -49,13 +49,20 @@ const ruleGroupInput = z
 	});
 
 // Explicit `ZodType<…, ZodTypeDef, unknown>` annotation rather than the
-// strict-identity form because `accessPolicyInput.shape.deferToVerify`
+// strict-identity form because `accessPolicyInputShape.shape.deferToVerify`
 // uses `z.preprocess` which widens the input position to `unknown`. The
 // relaxed annotation is portable for declaration emit; the `transform`
 // pins the OUTPUT to AccessRule.
+//
+// Uses the unrefined `accessPolicyInputShape` (not `accessPolicyInput`)
+// because the API-write refinement rejecting Block+captchaType is a
+// write-time input guard — the READ path (Redis reader → accessRuleInput
+// parse) must still accept the legacy shapes for records written before
+// the refinement landed. Otherwise the reader would throw on every
+// pre-existing Block rule that carried a stripped captchaType field.
 export const accessRuleInput: ZodType<AccessRule, z.ZodTypeDef, unknown> = z
 	.object({
-		...accessPolicyInput.shape,
+		...accessPolicyInputShape.shape,
 		...policyScopeInput.shape,
 	})
 	.and(userScopeInput)

package/src/tests/policyInput.unit.test.ts

@@ -15,7 +15,10 @@
 import { CaptchaType } from "@prosopo/types";
 import { describe, expect, it } from "vitest";
 import { AccessPolicyType } from "#policy/rule.js";
-import { sanitizeAccessPolicy } from "#policy/ruleInput/policyInput.js";
+import {
+	accessPolicyInput,
+	sanitizeAccessPolicy,
+} from "#policy/ruleInput/policyInput.js";
 
 describe("sanitizeAccessPolicy", () => {
 	describe("block policies", () => {
@@ -148,3 +151,68 @@ describe("sanitizeAccessPolicy", () => {
 		});
 	});
 });
+
+// Write-time input schema — reject the fields the sanitiser used to
+// silently strip. The prior "silently strip" behaviour meant operators
+// writing `--block --captchaType image` got a rule that blocked EVERY
+// captcha type (not just image); rejecting at input surfaces the
+// mismatch so they can switch to a Restrict policy instead.
+describe("accessPolicyInput refinement", () => {
+	it("rejects Block + captchaType with a clear message pointing at Restrict", () => {
+		const result = accessPolicyInput.safeParse({
+			type: AccessPolicyType.Block,
+			captchaType: CaptchaType.image,
+		});
+		expect(result.success).toBe(false);
+		if (!result.success) {
+			const issue = result.error.issues.find((i) =>
+				i.path.includes("captchaType"),
+			);
+			expect(issue).toBeDefined();
+			expect(issue?.message).toMatch(/Block policies cannot pin a captchaType/);
+			expect(issue?.message).toMatch(/Restrict policy/);
+		}
+	});
+
+	it("rejects Block + solvedImagesCount", () => {
+		const result = accessPolicyInput.safeParse({
+			type: AccessPolicyType.Block,
+			solvedImagesCount: 3,
+		});
+		expect(result.success).toBe(false);
+		if (!result.success) {
+			const issue = result.error.issues.find((i) =>
+				i.path.includes("solvedImagesCount"),
+			);
+			expect(issue).toBeDefined();
+			expect(issue?.message).toMatch(
+				/Block policies cannot set solvedImagesCount/,
+			);
+		}
+	});
+
+	it("accepts Block without the disallowed fields", () => {
+		const result = accessPolicyInput.safeParse({
+			type: AccessPolicyType.Block,
+			description: "clean block",
+		});
+		expect(result.success).toBe(true);
+	});
+
+	it("accepts Block + deferToVerify (deferToVerify is orthogonal to the type-pin restriction)", () => {
+		const result = accessPolicyInput.safeParse({
+			type: AccessPolicyType.Block,
+			deferToVerify: true,
+		});
+		expect(result.success).toBe(true);
+	});
+
+	it("accepts Restrict + captchaType + solvedImagesCount (these are Restrict's whole point)", () => {
+		const result = accessPolicyInput.safeParse({
+			type: AccessPolicyType.Restrict,
+			captchaType: CaptchaType.image,
+			solvedImagesCount: 5,
+		});
+		expect(result.success).toBe(true);
+	});
+});

package/src/tests/redis/redisRulesStorage.integration.test.ts

@@ -113,176 +113,219 @@ describe("redisAccessRulesStorage", () => {
 		redisClient = await result.getClient();
 	});
 
-	describe(
-		"writer",
-		() => {
-			let accessRulesWriter: AccessRulesWriter;
+	describe("writer", () => {
+		let accessRulesWriter: AccessRulesWriter;
 
-			beforeAll(() => {
-				accessRulesWriter = new RedisRulesWriter(redisClient, mockLogger);
-			});
+		beforeAll(() => {
+			accessRulesWriter = new RedisRulesWriter(redisClient, mockLogger);
+		});
 
-			test("inserts rule", async () => {
-				const testIndexName = indexName;
-				// given
-				const accessRule: AccessRule = {
-					type: AccessPolicyType.Block,
-					clientId: "clientId",
-				};
-				const accessRuleKey = getAccessRuleRedisKey(accessRule);
+		test("inserts rule", async () => {
+			const testIndexName = indexName;
+			// given
+			const accessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: "clientId",
+			};
+			const accessRuleKey = getAccessRuleRedisKey(accessRule);
 
-				// when
-				await accessRulesWriter.insertRules([
-					{
-						rule: accessRule,
-					},
-				]);
+			// when
+			await accessRulesWriter.insertRules([
+				{
+					rule: accessRule,
+				},
+			]);
 
-				// then
-				const insertedAccessRule = await redisClient.hGetAll(accessRuleKey);
-				const indexRecordsCount = await getIndexRecordsCount(testIndexName);
+			// then
+			const insertedAccessRule = await redisClient.hGetAll(accessRuleKey);
+			const indexRecordsCount = await getIndexRecordsCount(testIndexName);
 
-				expect(insertedAccessRule).toEqual(accessRule);
-				expect(indexRecordsCount).toEqual(1);
-			});
+			expect(insertedAccessRule).toEqual(accessRule);
+			expect(indexRecordsCount).toEqual(1);
+		});
 
-			test("inserts time limited rule", async () => {
-				// given
-				const accessRule: AccessRule = {
-					type: AccessPolicyType.Block,
-					clientId: "clientId",
-				};
-				const accessRuleKey = getAccessRuleRedisKey(accessRule);
-				// 1 hour from now.
-				const expireIn = 60 * 60; // seconds
-				const expirationTimestamp = new Date(
-					Date.now() + expireIn * 1000,
-				).getTime();
-				const expirationTimestampInSeconds = Math.floor(
-					expirationTimestamp / 1000,
-				);
+		test("inserts time limited rule", async () => {
+			// given
+			const accessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: "clientId",
+			};
+			const accessRuleKey = getAccessRuleRedisKey(accessRule);
+			// 1 hour from now.
+			const expireIn = 60 * 60; // seconds
+			const expirationTimestamp = new Date(
+				Date.now() + expireIn * 1000,
+			).getTime();
+			const expirationTimestampInSeconds = Math.floor(
+				expirationTimestamp / 1000,
+			);
 
-				// when
-				await accessRulesWriter.insertRules([
-					{
-						rule: accessRule,
-						expiresUnixTimestamp: expirationTimestampInSeconds,
-					},
-				]);
-				const ruleKey = getAccessRuleRedisKey(accessRule);
-				// then
-				const insertedAccessRule = await redisClient.hGetAll(accessRuleKey);
-				const insertedExpirationResult = await redisClient.expireAt(
-					ruleKey,
-					expirationTimestampInSeconds,
-				);
-				const indexRecordsCount = await getIndexRecordsCount(indexName);
+			// when
+			await accessRulesWriter.insertRules([
+				{
+					rule: accessRule,
+					expiresUnixTimestamp: expirationTimestampInSeconds,
+				},
+			]);
+			const ruleKey = getAccessRuleRedisKey(accessRule);
+			// then
+			const insertedAccessRule = await redisClient.hGetAll(accessRuleKey);
+			const insertedExpirationResult = await redisClient.expireAt(
+				ruleKey,
+				expirationTimestampInSeconds,
+			);
+			const indexRecordsCount = await getIndexRecordsCount(indexName);
 
-				const recordExpirySeconds = await redisClient.ttl(ruleKey);
+			const recordExpirySeconds = await redisClient.ttl(ruleKey);
 
-				expect(insertedAccessRule).toEqual(accessRule);
-				expect(insertedExpirationResult).toBe(1);
-				expect(recordExpirySeconds).toBeLessThanOrEqual(
-					expirationTimestampInSeconds,
-				);
+			expect(insertedAccessRule).toEqual(accessRule);
+			expect(insertedExpirationResult).toBe(1);
+			expect(recordExpirySeconds).toBeLessThanOrEqual(
+				expirationTimestampInSeconds,
+			);
 
-				expect(indexRecordsCount).toBe(1);
-			});
+			expect(indexRecordsCount).toBe(1);
+		});
 
-			test("deletes rules", async () => {
-				// given
-				const johnAccessRule: AccessRule = {
-					type: AccessPolicyType.Block,
-					clientId: getUniqueString(),
-				};
-				const johnAccessRuleKey = getAccessRuleRedisKey(johnAccessRule);
+		// The existing "inserts time limited rule" test above only
+		// checks that the TTL is *set* on the Redis key. Neither
+		// side actually verifies the rule stops matching once its
+		// TTL fires — which is the property operators care about
+		// (temporary bans should self-clear). Guard against a
+		// regression that persists rules past their expiry (e.g. a
+		// future writer that swaps `expireAt` for `persist` by
+		// accident, or an index rebuild that resurrects expired
+		// records).
+		test("expired rule is no longer returned by the reader after its TTL fires", async () => {
+			const accessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: `expiring-${getUniqueString()}`,
+			};
+			const ruleKey = getAccessRuleRedisKey(accessRule);
+			// 2 s expiry — long enough that the "before expiry" check
+			// races the write cleanly, short enough that the test
+			// completes in a reasonable timeout. Redis TTL granularity
+			// is 1 s so anything shorter is under-resolution.
+			const expirationTimestampInSeconds = Math.floor(Date.now() / 1000) + 2;
 
-				const doeAccessRule: AccessRule = {
-					type: AccessPolicyType.Block,
-					clientId: getUniqueString(),
-				};
-				const doeAccessRuleKey = getAccessRuleRedisKey(doeAccessRule);
+			await accessRulesWriter.insertRules([
+				{
+					rule: accessRule,
+					expiresUnixTimestamp: expirationTimestampInSeconds,
+				},
+			]);
 
-				await insertRules([johnAccessRule, doeAccessRule]);
+			// Sanity: the rule exists immediately after write.
+			const initialRecord = await redisClient.hGetAll(ruleKey);
+			expect(initialRecord).toEqual(accessRule);
 
-				// when
-				await accessRulesWriter.deleteRules([
-					johnAccessRuleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length),
-				]);
+			// Wait past the TTL. Add ~1s slack for Redis's per-key
+			// expiry sweep — the docs guarantee expired keys stop
+			// answering reads but the actual key deletion is lazy.
+			await new Promise((resolve) => setTimeout(resolve, 3500));
 
-				// then
-				const presentAccessRule = await redisClient.hGetAll(doeAccessRuleKey);
-				const indexRecordsCount = await getIndexRecordsCount(indexName);
+			// After expiry: hGetAll returns {} (Redis treats an
+			// expired key as non-existent for reads).
+			const expiredRecord = await redisClient.hGetAll(ruleKey);
+			expect(expiredRecord).toEqual({});
 
-				expect(presentAccessRule).toEqual(doeAccessRule);
-				expect(indexRecordsCount).toBe(1);
-			});
+			// And the RediSearch index no longer counts it.
+			const indexRecordsCount = await getIndexRecordsCount(indexName);
+			expect(indexRecordsCount).toBe(0);
+		}, 10_000);
 
-			test("deletes all rules", async () => {
-				// given
-				const johnAccessRule: AccessRule = {
-					type: AccessPolicyType.Block,
-					clientId: getUniqueString(),
-				};
-				const doeAccessRule: AccessRule = {
-					type: AccessPolicyType.Block,
-					clientId: getUniqueString(),
-				};
+		test("deletes rules", async () => {
+			// given
+			const johnAccessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: getUniqueString(),
+			};
+			const johnAccessRuleKey = getAccessRuleRedisKey(johnAccessRule);
 
-				await insertRules([johnAccessRule, doeAccessRule]);
+			const doeAccessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: getUniqueString(),
+			};
+			const doeAccessRuleKey = getAccessRuleRedisKey(doeAccessRule);
 
-				// when
-				await accessRulesWriter.deleteAllRules();
+			await insertRules([johnAccessRule, doeAccessRule]);
 
-				// then
-				const indexRecordsCount = await getIndexRecordsCount(indexName);
+			// when
+			await accessRulesWriter.deleteRules([
+				johnAccessRuleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length),
+			]);
 
-				expect(indexRecordsCount).toBe(0);
-			});
+			// then
+			const presentAccessRule = await redisClient.hGetAll(doeAccessRuleKey);
+			const indexRecordsCount = await getIndexRecordsCount(indexName);
 
-			test("deletes all rules when there are 1 million rules", async () => {
-				// given
-				const rulesCount = 1_000_000;
-				const batchSize = 10_000;
-				const numBatches = Math.ceil(rulesCount / batchSize);
-
-				// Insert rules in batches to avoid memory exhaustion
-				// Don't create 1M objects in memory at once!
-				for (let i = 0; i < numBatches; i++) {
-					const currentBatchSize = Math.min(
-						batchSize,
-						rulesCount - i * batchSize,
-					);
-					const batchRules: AccessRule[] = Array.from(
-						{ length: currentBatchSize },
-						() => ({
-							type: AccessPolicyType.Block,
-							clientId: getUniqueString(),
-						}),
-					);
-
-					await insertRules(batchRules);
-				}
-
-				// verify that there are 1 million rules in the database
-				const beforeDeleteIndexRecordsCount =
-					await getIndexRecordsCount(indexName);
-				expect(beforeDeleteIndexRecordsCount).toBe(rulesCount);
-
-				// when
-				await accessRulesWriter.deleteAllRules();
-
-				// then
-				const afterDeleteIndexRecordsCount =
-					await getIndexRecordsCount(indexName);
-
-				expect(afterDeleteIndexRecordsCount).toBe(0);
-			});
-		},
-		{
-			timeout: 240_000,
-		},
-	);
+			expect(presentAccessRule).toEqual(doeAccessRule);
+			expect(indexRecordsCount).toBe(1);
+		});
+
+		test("deletes all rules", async () => {
+			// given
+			const johnAccessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: getUniqueString(),
+			};
+			const doeAccessRule: AccessRule = {
+				type: AccessPolicyType.Block,
+				clientId: getUniqueString(),
+			};
+
+			await insertRules([johnAccessRule, doeAccessRule]);
+
+			// when
+			await accessRulesWriter.deleteAllRules();
+
+			// then
+			const indexRecordsCount = await getIndexRecordsCount(indexName);
+
+			expect(indexRecordsCount).toBe(0);
+		});
+
+		test("deletes all rules when there are 1 million rules", async () => {
+			// given
+			const rulesCount = 1_000_000;
+			const batchSize = 10_000;
+			const numBatches = Math.ceil(rulesCount / batchSize);
+
+			// Insert rules in batches to avoid memory exhaustion
+			// Don't create 1M objects in memory at once!
+			for (let i = 0; i < numBatches; i++) {
+				const currentBatchSize = Math.min(
+					batchSize,
+					rulesCount - i * batchSize,
+				);
+				const batchRules: AccessRule[] = Array.from(
+					{ length: currentBatchSize },
+					() => ({
+						type: AccessPolicyType.Block,
+						clientId: getUniqueString(),
+					}),
+				);
+
+				await insertRules(batchRules);
+			}
+
+			// verify that there are 1 million rules in the database
+			const beforeDeleteIndexRecordsCount =
+				await getIndexRecordsCount(indexName);
+			expect(beforeDeleteIndexRecordsCount).toBe(rulesCount);
+
+			// when
+			await accessRulesWriter.deleteAllRules();
+
+			// then
+			const afterDeleteIndexRecordsCount =
+				await getIndexRecordsCount(indexName);
+
+			expect(afterDeleteIndexRecordsCount).toBe(0);
+		});
+		// The trailing 240_000 is the suite timeout. vitest 4 dropped the
+		// options-object overload for describe, so it has to be a plain number.
+	}, 240_000);
 
 	describe("reader", () => {
 		let accessRulesReader: AccessRulesReader;

package/src/transformRule.ts

@@ -18,7 +18,7 @@ import { Address4, Address6 } from "ip-address";
 import { z } from "zod";
 import type { AccessRule } from "./rule.js";
 import {
-	accessPolicyInput,
+	accessPolicyInputShape,
 	policyScopeInput,
 } from "./ruleInput/policyInput.js";
 import { accessRuleInput } from "./ruleInput/ruleInput.js";
@@ -56,7 +56,7 @@ export const transformAccessRuleIntoRecord = (
 
 const accessRuleToRecordScheme = z
 	.object({
-		...accessPolicyInput.shape,
+		...accessPolicyInputShape.shape,
 		...policyScopeInput.shape,
 		...userScopeSchema.shape,
 		groupId: z.coerce.string().optional(),