@prosopo/user-access-policy 3.12.7 → 3.12.9

package/dist/cjs/redis/reader/redisAggregate.cjs

@@ -1,90 +1,65 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const zod = require("zod");
-const redisRulesQuery = require("./redisRulesQuery.cjs");
-const redisClient = require("../redisClient.cjs");
-const redisRuleIndex = require("../redisRuleIndex.cjs");
-const searchRedisKeysBounded = async (client, query, maxKeys) => {
-  const reply = await client.ft.searchNoContent(
-    redisRuleIndex.ACCESS_RULES_REDIS_INDEX_NAME,
-    query,
-    {
-      DIALECT: redisRulesQuery.REDIS_QUERY_DIALECT,
-      LIMIT: { from: 0, size: maxKeys }
-    }
-  );
-  return reply.documents;
+require("./redisRulesQuery.cjs");
+const require_redis_redisClient = require("../redisClient.cjs");
+const require_redis_redisRuleIndex = require("../redisRuleIndex.cjs");
+let zod = require("zod");
+//#region src/redis/reader/redisAggregate.ts
+var searchRedisKeysBounded = async (client, query, maxKeys) => {
+	return (await client.ft.searchNoContent(require_redis_redisRuleIndex.ACCESS_RULES_REDIS_INDEX_NAME, query, {
+		DIALECT: 2,
+		LIMIT: {
+			from: 0,
+			size: maxKeys
+		}
+	})).documents;
 };
-const aggregateRedisKeys = async (client, query, logger, batchHandler, maxKeys) => {
-  const keyField = "__key";
-  const recordSchema = zod.z.object({
-    // it's a reserved name for the record key
-    [keyField]: zod.z.string()
-  });
-  const foundKeys = [];
-  let stopRequested = false;
-  const addRecordKeys = async (records) => {
-    if (stopRequested) {
-      return;
-    }
-    const parsedRecords = redisClient.parseRedisRecords(records, recordSchema, logger);
-    const recordKeys = parsedRecords.map((record) => record[keyField]);
-    if (batchHandler) {
-      await batchHandler(recordKeys);
-    } else {
-      if (maxKeys !== void 0 && foundKeys.length + recordKeys.length > maxKeys) {
-        const remaining = Math.max(0, maxKeys - foundKeys.length);
-        foundKeys.push(...recordKeys.slice(0, remaining));
-        stopRequested = true;
-        logger.warn(() => ({
-          msg: "Redis aggregation candidate cap hit; truncating result set. This can suppress less-frequent rules and should be investigated.",
-          data: {
-            maxKeys,
-            query
-          }
-        }));
-        return;
-      }
-      foundKeys.push(...recordKeys);
-      logger.debug(() => ({
-        msg: "Processed aggregation batch",
-        data: {
-          size: recordKeys.length
-        }
-      }));
-    }
-  };
-  await executeAggregation(
-    client,
-    query,
-    {
-      // #2 is a required option when the 'ismissing()' function is in the query body
-      DIALECT: redisRulesQuery.REDIS_QUERY_DIALECT,
-      COUNT: redisClient.REDIS_BATCH_SIZE,
-      LOAD: `@${keyField}`
-    },
-    addRecordKeys,
-    () => stopRequested
-  );
-  return foundKeys;
+var aggregateRedisKeys = async (client, query, logger, batchHandler, maxKeys) => {
+	const keyField = "__key";
+	const recordSchema = zod.z.object({ [keyField]: zod.z.string() });
+	const foundKeys = [];
+	let stopRequested = false;
+	const addRecordKeys = async (records) => {
+		if (stopRequested) return;
+		const recordKeys = require_redis_redisClient.parseRedisRecords(records, recordSchema, logger).map((record) => record[keyField]);
+		if (batchHandler) await batchHandler(recordKeys);
+		else {
+			if (maxKeys !== void 0 && foundKeys.length + recordKeys.length > maxKeys) {
+				const remaining = Math.max(0, maxKeys - foundKeys.length);
+				foundKeys.push(...recordKeys.slice(0, remaining));
+				stopRequested = true;
+				logger.warn(() => ({
+					msg: "Redis aggregation candidate cap hit; truncating result set. This can suppress less-frequent rules and should be investigated.",
+					data: {
+						maxKeys,
+						query
+					}
+				}));
+				return;
+			}
+			foundKeys.push(...recordKeys);
+			logger.debug(() => ({
+				msg: "Processed aggregation batch",
+				data: { size: recordKeys.length }
+			}));
+		}
+	};
+	await executeAggregation(client, query, {
+		DIALECT: 2,
+		COUNT: require_redis_redisClient.REDIS_BATCH_SIZE,
+		LOAD: `@${keyField}`
+	}, addRecordKeys, () => stopRequested);
+	return foundKeys;
 };
-const executeAggregation = async (client, query, aggregateOptions, handleBatch, shouldStop) => {
-  const initialReply = await client.ft.aggregateWithCursor(
-    redisRuleIndex.ACCESS_RULES_REDIS_INDEX_NAME,
-    query,
-    aggregateOptions
-  );
-  await handleBatch(initialReply.results);
-  let cursor = initialReply.cursor;
-  while (0 !== cursor && !shouldStop?.()) {
-    const batchReply = await client.ft.cursorRead(
-      redisRuleIndex.ACCESS_RULES_REDIS_INDEX_NAME,
-      cursor,
-      { COUNT: aggregateOptions.COUNT }
-    );
-    await handleBatch(batchReply.results);
-    cursor = batchReply.cursor;
-  }
+var executeAggregation = async (client, query, aggregateOptions, handleBatch, shouldStop) => {
+	const initialReply = await client.ft.aggregateWithCursor(require_redis_redisRuleIndex.ACCESS_RULES_REDIS_INDEX_NAME, query, aggregateOptions);
+	await handleBatch(initialReply.results);
+	let cursor = initialReply.cursor;
+	while (0 !== cursor && !shouldStop?.()) {
+		const batchReply = await client.ft.cursorRead(require_redis_redisRuleIndex.ACCESS_RULES_REDIS_INDEX_NAME, cursor, { COUNT: aggregateOptions.COUNT });
+		await handleBatch(batchReply.results);
+		cursor = batchReply.cursor;
+	}
 };
+//#endregion
 exports.aggregateRedisKeys = aggregateRedisKeys;
 exports.searchRedisKeysBounded = searchRedisKeysBounded;

package/dist/cjs/redis/reader/redisRulesQuery.cjs

@@ -1,125 +1,83 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const rule = require("../../rule.cjs");
-const userScopeInput = require("../../ruleInput/userScopeInput.cjs");
-const rulesStorage = require("../../rulesStorage.cjs");
-const escapeTagValue = (value) => {
-  return value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
+const require_rulesStorage = require("../../rulesStorage.cjs");
+const require_rule = require("../../rule.cjs");
+const require_ruleInput_userScopeInput = require("../../ruleInput/userScopeInput.cjs");
+//#region src/redis/reader/redisRulesQuery.ts
+/**
+* Escapes special characters for Redis TAG field queries.
+* Redis TAG fields treat these characters as special and they must be escaped with a backslash.
+*/
+var escapeTagValue = (value) => {
+	return value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
 };
-const REDIS_QUERY_DIALECT = 2;
-const userIpQueries = {
-  numericIp: (value, scope) => {
-    if (void 0 !== value) {
-      return `( @numericIp:[${value} ${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`;
-    }
-    if (scope.numericIpMaskMin === void 0 && scope.numericIpMaskMax === void 0) {
-      return "ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax)";
-    }
-    return "";
-  },
-  numericIpMaskMin: (value, scope) => {
-    if (scope.numericIp !== void 0) {
-      return "";
-    }
-    if (value === void 0 && scope.numericIpMaskMax === void 0) {
-      return "";
-    }
-    return value !== void 0 ? `@numericIpMaskMin:[-inf ${value}]` : "ismissing(@numericIpMaskMin)";
-  },
-  numericIpMaskMax: (value, scope) => {
-    if (scope.numericIp !== void 0) {
-      return "";
-    }
-    if (value === void 0 && scope.numericIpMaskMin === void 0) {
-      return "";
-    }
-    return value !== void 0 ? `@numericIpMaskMax:[${value} +inf]` : "ismissing(@numericIpMaskMax)";
-  }
+var REDIS_QUERY_DIALECT = 2;
+var userIpQueries = {
+	numericIp: (value, scope) => {
+		if (void 0 !== value) return `( @numericIp:[${value} ${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`;
+		if (scope.numericIpMaskMin === void 0 && scope.numericIpMaskMax === void 0) return "ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax)";
+		return "";
+	},
+	numericIpMaskMin: (value, scope) => {
+		if (scope.numericIp !== void 0) return "";
+		if (value === void 0 && scope.numericIpMaskMax === void 0) return "";
+		return value !== void 0 ? `@numericIpMaskMin:[-inf ${value}]` : "ismissing(@numericIpMaskMin)";
+	},
+	numericIpMaskMax: (value, scope) => {
+		if (scope.numericIp !== void 0) return "";
+		if (value === void 0 && scope.numericIpMaskMin === void 0) return "";
+		return value !== void 0 ? `@numericIpMaskMax:[${value} +inf]` : "ismissing(@numericIpMaskMax)";
+	}
 };
-const getUserScopeQuery = (userScope, FilterScopeMatchType, matchingFieldsOnly) => {
-  let scopeEntries = Object.entries(userScope);
-  let scopeJoinType = " ";
-  if (FilterScopeMatchType === rulesStorage.FilterScopeMatch.Greedy) {
-    scopeEntries = scopeEntries.filter(
-      ([_, value]) => value !== void 0
-    );
-    scopeJoinType = " | ";
-  }
-  if (matchingFieldsOnly) {
-    const scopeMap = new Map(scopeEntries);
-    if (scopeMap.has("numericIp") && scopeMap.get("numericIp") === void 0) {
-      scopeMap.set("numericIpMaskMin", void 0);
-      scopeMap.set("numericIpMaskMax", void 0);
-    }
-    for (const name of Object.keys(userScopeInput.userScopeSchema.shape)) {
-      if (!scopeMap.has(name)) {
-        scopeMap.set(name, void 0);
-      }
-    }
-    scopeEntries = [...scopeMap.entries()];
-  }
-  const scopeObj = Object.fromEntries(scopeEntries);
-  return scopeEntries.map(
-    ([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(
-      scopeFieldName,
-      scopeFieldValue,
-      FilterScopeMatchType,
-      scopeObj
-    )
-  ).filter(Boolean).join(scopeJoinType);
+var getUserScopeQuery = (userScope, FilterScopeMatchType, matchingFieldsOnly) => {
+	let scopeEntries = Object.entries(userScope);
+	let scopeJoinType = " ";
+	if (FilterScopeMatchType === require_rulesStorage.FilterScopeMatch.Greedy) {
+		scopeEntries = scopeEntries.filter(([_, value]) => value !== void 0);
+		scopeJoinType = " | ";
+	}
+	if (matchingFieldsOnly) {
+		const scopeMap = new Map(scopeEntries);
+		if (scopeMap.has("numericIp") && scopeMap.get("numericIp") === void 0) {
+			scopeMap.set("numericIpMaskMin", void 0);
+			scopeMap.set("numericIpMaskMax", void 0);
+		}
+		for (const name of Object.keys(require_ruleInput_userScopeInput.userScopeSchema.shape)) if (!scopeMap.has(name)) scopeMap.set(name, void 0);
+		scopeEntries = [...scopeMap.entries()];
+	}
+	const scopeObj = Object.fromEntries(scopeEntries);
+	return scopeEntries.map(([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(scopeFieldName, scopeFieldValue, FilterScopeMatchType, scopeObj)).filter(Boolean).join(scopeJoinType);
 };
-const FIELDS_REQUIRING_ESCAPE = /* @__PURE__ */ new Set([
-  "coords"
-]);
-const NUMERIC_FIELDS = /* @__PURE__ */ new Set(["asn"]);
-const getUserScopeFieldQuery = (fieldName, fieldValue, scopeMatch, fullScope) => {
-  if (fieldName in userIpQueries) {
-    const queryBuilder = userIpQueries[fieldName];
-    return queryBuilder(fieldValue, fullScope);
-  }
-  if (void 0 === fieldValue) {
-    return `ismissing(@${fieldName})`;
-  }
-  const stringValue = String(fieldValue);
-  if (NUMERIC_FIELDS.has(fieldName)) {
-    return `@${fieldName}:[${stringValue} ${stringValue}]`;
-  }
-  const queryValue = FIELDS_REQUIRING_ESCAPE.has(fieldName) ? escapeTagValue(stringValue) : stringValue;
-  return `@${fieldName}:{${queryValue}}`;
+var FIELDS_REQUIRING_ESCAPE = /* @__PURE__ */ new Set(["coords"]);
+var NUMERIC_FIELDS = /* @__PURE__ */ new Set(["asn"]);
+var getUserScopeFieldQuery = (fieldName, fieldValue, scopeMatch, fullScope) => {
+	if (fieldName in userIpQueries) {
+		const queryBuilder = userIpQueries[fieldName];
+		return queryBuilder(fieldValue, fullScope);
+	}
+	if (void 0 === fieldValue) return `ismissing(@${fieldName})`;
+	const stringValue = String(fieldValue);
+	if (NUMERIC_FIELDS.has(fieldName)) return `@${fieldName}:[${stringValue} ${stringValue}]`;
+	return `@${fieldName}:{${FIELDS_REQUIRING_ESCAPE.has(fieldName) ? escapeTagValue(stringValue) : stringValue}}`;
 };
-const GLOBAL_MATCH_CLAUSE_INNER = `@clientId:{${rule.GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
-const getPolicyScopeQuery = (policyScope, scopeMatch) => {
-  const clientId = policyScope?.clientId;
-  if ("string" === typeof clientId) {
-    return rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ${GLOBAL_MATCH_CLAUSE_INNER} )`;
-  }
-  return rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `( ${GLOBAL_MATCH_CLAUSE_INNER} )` : "";
+var GLOBAL_MATCH_CLAUSE_INNER = `@clientId:{${require_rule.GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
+var getPolicyScopeQuery = (policyScope, scopeMatch) => {
+	const clientId = policyScope?.clientId;
+	if ("string" === typeof clientId) return require_rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ${GLOBAL_MATCH_CLAUSE_INNER} )`;
+	return require_rulesStorage.FilterScopeMatch.Exact === scopeMatch ? `( ${GLOBAL_MATCH_CLAUSE_INNER} )` : "";
 };
-const getRulesRedisQuery = (filter, matchingFieldsOnly) => {
-  const { policyScope, userScope } = filter;
-  const queryParts = [];
-  if (filter.groupId) {
-    queryParts.push(`@groupId:{${filter.groupId}}`);
-  }
-  if (filter.blockOnly) {
-    queryParts.push(`@type:{${rule.AccessPolicyType.Block}}`);
-  }
-  const policyScopeQuery = getPolicyScopeQuery(
-    policyScope,
-    filter.policyScopeMatch
-  );
-  if (policyScopeQuery) {
-    queryParts.push(policyScopeQuery);
-  }
-  if (userScope && Object.keys(userScope).length > 0) {
-    const userScopeFilter = getUserScopeQuery(
-      userScope,
-      filter.userScopeMatch,
-      matchingFieldsOnly
-    );
-    queryParts.push(`( ${userScopeFilter} )`);
-  }
-  return queryParts.length > 0 ? queryParts.join(" ") : "*";
+var getRulesRedisQuery = (filter, matchingFieldsOnly) => {
+	const { policyScope, userScope } = filter;
+	const queryParts = [];
+	if (filter.groupId) queryParts.push(`@groupId:{${filter.groupId}}`);
+	if (filter.blockOnly) queryParts.push(`@type:{${require_rule.AccessPolicyType.Block}}`);
+	const policyScopeQuery = getPolicyScopeQuery(policyScope, filter.policyScopeMatch);
+	if (policyScopeQuery) queryParts.push(policyScopeQuery);
+	if (userScope && Object.keys(userScope).length > 0) {
+		const userScopeFilter = getUserScopeQuery(userScope, filter.userScopeMatch, matchingFieldsOnly);
+		queryParts.push(`( ${userScopeFilter} )`);
+	}
+	return queryParts.length > 0 ? queryParts.join(" ") : "*";
 };
+//#endregion
 exports.REDIS_QUERY_DIALECT = REDIS_QUERY_DIALECT;
 exports.getRulesRedisQuery = getRulesRedisQuery;