@prosopo/user-access-policy 3.12.8 → 3.12.10

package/dist/redis/reader/redisRulesReader.js

@@ -1,494 +1,319 @@
-import * as util from "node:util";
-import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
-import { getRulesRedisQuery, REDIS_QUERY_DIALECT } from "./redisRulesQuery.js";
-import { buildScopedRulesSubQueries } from "./redisRulesSplitQuery.js";
-import { REDIS_BATCH_SIZE, getMissingRedisKeys, fetchRedisHashRecords, parseRedisRecords } from "../redisClient.js";
-import { ACCESS_RULE_REDIS_KEY_PREFIX, ACCESS_RULES_REDIS_INDEX_NAME } from "../redisRuleIndex.js";
+import "../../_virtual/_rolldown/runtime.js";
 import { AccessPolicyType } from "../../rule.js";
 import { accessRuleInput } from "../../ruleInput/ruleInput.js";
-import { searchRedisKeysBounded, aggregateRedisKeys } from "./redisAggregate.js";
-const SERVER_SIDE_RANK_TOP_N = 20;
-const GREEDY_MAX_CANDIDATES = REDIS_BATCH_SIZE * 10;
-const SPLIT_MAX_CANDIDATES_PER_SUB = 500;
-const SPECIFICITY_EXPR = [
-  "exists(@clientId)",
-  "exists(@userId)",
-  "exists(@ja4Hash)",
-  "exists(@headersHash)",
-  "exists(@userAgentHash)",
-  "exists(@headHash)",
-  "exists(@coords)",
-  "exists(@countryCode)",
-  "exists(@asn)",
-  "exists(@os)",
-  "exists(@numericIp)",
-  "exists(@numericIpMaskMin)"
+import { getRulesRedisQuery } from "./redisRulesQuery.js";
+import { buildScopedRulesSubQueries } from "./redisRulesSplitQuery.js";
+import { REDIS_BATCH_SIZE, fetchRedisHashRecords, getMissingRedisKeys, parseRedisRecords } from "../redisClient.js";
+import { ACCESS_RULES_REDIS_INDEX_NAME, ACCESS_RULE_REDIS_KEY_PREFIX } from "../redisRuleIndex.js";
+import { aggregateRedisKeys, searchRedisKeysBounded } from "./redisAggregate.js";
+import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
+import * as util from "node:util";
+//#region src/redis/reader/redisRulesReader.ts
+var SERVER_SIDE_RANK_TOP_N = 20;
+var GREEDY_MAX_CANDIDATES = REDIS_BATCH_SIZE * 10;
+var SPLIT_MAX_CANDIDATES_PER_SUB = 500;
+var SPECIFICITY_EXPR = [
+	"exists(@clientId)",
+	"exists(@userId)",
+	"exists(@ja4Hash)",
+	"exists(@headersHash)",
+	"exists(@userAgentHash)",
+	"exists(@headHash)",
+	"exists(@coords)",
+	"exists(@countryCode)",
+	"exists(@asn)",
+	"exists(@os)",
+	"exists(@numericIp)",
+	"exists(@numericIpMaskMin)"
 ].join(" + ");
-const SEVERITY_EXPR = `(@type == "${AccessPolicyType.Block}")`;
-const RANK_EXPR = "(@_spec * 2) + @_sev";
-const RULE_LOAD_FIELDS = [
-  "@__key",
-  "@type",
-  "@captchaType",
-  "@description",
-  "@solvedImagesCount",
-  "@imageThreshold",
-  "@powDifficulty",
-  "@unsolvedImagesCount",
-  "@frictionlessScore",
-  "@deferToVerify",
-  "@clientId",
-  "@groupId",
-  "@userId",
-  "@ja4Hash",
-  "@headersHash",
-  "@userAgentHash",
-  "@headHash",
-  "@coords",
-  "@countryCode",
-  "@asn",
-  "@os",
-  "@numericIp",
-  "@numericIpMaskMin",
-  "@numericIpMaskMax"
+var SEVERITY_EXPR = `(@type == "${AccessPolicyType.Block}")`;
+var RANK_EXPR = "(@_spec * 2) + @_sev";
+var RULE_LOAD_FIELDS = [
+	"@__key",
+	"@type",
+	"@captchaType",
+	"@description",
+	"@solvedImagesCount",
+	"@imageThreshold",
+	"@powDifficulty",
+	"@unsolvedImagesCount",
+	"@frictionlessScore",
+	"@deferToVerify",
+	"@clientId",
+	"@groupId",
+	"@userId",
+	"@ja4Hash",
+	"@headersHash",
+	"@userAgentHash",
+	"@headHash",
+	"@coords",
+	"@countryCode",
+	"@asn",
+	"@os",
+	"@numericIp",
+	"@numericIpMaskMin",
+	"@numericIpMaskMax"
 ];
-const readerSpecificity = (rule) => {
-  let score = 0;
-  if (rule.clientId !== void 0) score++;
-  if (rule.userId !== void 0) score++;
-  if (rule.ja4Hash !== void 0) score++;
-  if (rule.headersHash !== void 0) score++;
-  if (rule.userAgentHash !== void 0) score++;
-  if (rule.headHash !== void 0) score++;
-  if (rule.coords !== void 0) score++;
-  if (rule.countryCode !== void 0) score++;
-  if (rule.asn !== void 0) score++;
-  if (rule.os !== void 0) score++;
-  if (rule.numericIp !== void 0) score++;
-  if (rule.numericIpMaskMin !== void 0) score++;
-  return score;
+var readerSpecificity = (rule) => {
+	let score = 0;
+	if (rule.clientId !== void 0) score++;
+	if (rule.userId !== void 0) score++;
+	if (rule.ja4Hash !== void 0) score++;
+	if (rule.headersHash !== void 0) score++;
+	if (rule.userAgentHash !== void 0) score++;
+	if (rule.headHash !== void 0) score++;
+	if (rule.coords !== void 0) score++;
+	if (rule.countryCode !== void 0) score++;
+	if (rule.asn !== void 0) score++;
+	if (rule.os !== void 0) score++;
+	if (rule.numericIp !== void 0) score++;
+	if (rule.numericIpMaskMin !== void 0) score++;
+	return score;
 };
-const sortByReaderRank = (rules) => [...rules].sort((a, b) => {
-  const specDelta = readerSpecificity(b) - readerSpecificity(a);
-  if (specDelta !== 0) return specDelta;
-  const aBlock = a.type === AccessPolicyType.Block ? 1 : 0;
-  const bBlock = b.type === AccessPolicyType.Block ? 1 : 0;
-  return bBlock - aBlock;
+var sortByReaderRank = (rules) => [...rules].sort((a, b) => {
+	const specDelta = readerSpecificity(b) - readerSpecificity(a);
+	if (specDelta !== 0) return specDelta;
+	const aBlock = a.type === AccessPolicyType.Block ? 1 : 0;
+	return (b.type === AccessPolicyType.Block ? 1 : 0) - aBlock;
 });
-class RedisRulesReader {
-  constructor(client, logger) {
-    this.client = client;
-    this.logger = logger;
-  }
-  async getMissingRuleIds(ruleIds) {
-    const ruleKeys = this.getRuleKeys(ruleIds);
-    const keyBatches = chunkIntoBatches(ruleKeys, REDIS_BATCH_SIZE);
-    const missingKeyBatches = await executeBatchesSequentially(
-      keyBatches,
-      async (keysBatch) => getMissingRedisKeys(this.client, keysBatch)
-    );
-    return missingKeyBatches.flat().map((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
-  }
-  async fetchRules(ruleIds) {
-    const ruleKeys = this.getRuleKeys(ruleIds);
-    const keyBatches = chunkIntoBatches(ruleKeys, REDIS_BATCH_SIZE);
-    const entryBatches = await executeBatchesSequentially(
-      keyBatches,
-      (keysBatch) => this.fetchRuleEntries(keysBatch)
-    );
-    return entryBatches.flat();
-  }
-  async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
-    const query = getRulesRedisQuery(filter, matchingFieldsOnly);
-    if (skipEmptyUserScopes && // Sentinel query shape emitted by getPolicyScopeQuery when the
-    // caller passed neither a userScope nor a clientId — i.e. an
-    // empty filter that would otherwise resolve to "all global
-    // rules". Guard so an accidentally-empty filter can't return
-    // the full global rule set. The exact literal must stay in
-    // sync with GLOBAL_MATCH_CLAUSE_INNER over there.
-    query === "( @clientId:{global} | ismissing(@clientId) )") {
-      return [];
-    }
-    if (matchingFieldsOnly && filter.userScope !== void 0) {
-      return this.findRulesSplit(filter);
-    }
-    return this.findRulesGreedy(filter, query);
-  }
-  // Union candidate keys from each split sub-query, de-dupe, HGETALL,
-  // parse, hand back to `getPrioritisedAccessRule` for JS-side ranking.
-  // Ranking stays in JS because rankCandidateRules already encodes the
-  // strict "every populated rule field matches request" semantics —
-  // FT can't express that shape cheaply and the previous server-side
-  // APPLY / SORTBY imposed the linear-per-rule cost we're eliminating.
-  //
-  // Handles both blockOnly (hard-block middleware) and non-blockOnly
-  // (frictionless access-policy lookup) callers via the `blockOnly`
-  // flag on the sub-query builder.
-  async findRulesSplit(filter) {
-    const userScope = filter.userScope;
-    if (userScope === void 0) {
-      return [];
-    }
-    const clientId = filter.policyScope?.clientId;
-    const subQueries = buildScopedRulesSubQueries(userScope, clientId, {
-      ...filter.blockOnly === true && { blockOnly: true }
-    });
-    try {
-      const keyLists = await Promise.all(
-        subQueries.map(
-          (sub) => (
-            // FT.SEARCH NOCONTENT (via searchRedisKeysBounded) rather
-            // than FT.AGGREGATE with LOAD @__key. The aggregate reply
-            // path in `@redis/client` 5.x calls transformTuplesReply
-            // on every result row; when the RediSearch coordinator
-            // returns a null tuple (observed continuously on
-            // field:ja4Hash probes in prod), that throws
-            // `Cannot read properties of null (reading 'length')` and
-            // the whole sub-query resolves empty via the .catch below.
-            // NOCONTENT returns a flat `[total, key1, key2, ...]`
-            // array so there is no nested tuple that can be null.
-            searchRedisKeysBounded(
-              this.client,
-              sub.query,
-              // Per-sub-query cap. Each probe hits a discriminating
-              // index (e.g. numericIp posting list), so the natural
-              // cardinality is tiny — this cap only fires on
-              // pathological rule-set shapes and mirrors
-              // SPLIT_MAX_CANDIDATES_PER_SUB below.
-              SPLIT_MAX_CANDIDATES_PER_SUB
-            ).catch((err) => {
-              this.logger.error(() => ({
-                err,
-                data: {
-                  inspect: util.inspect(
-                    { subKind: sub.kind, query: sub.query },
-                    { depth: null }
-                  )
-                },
-                msg: "failed to execute split rule sub-query"
-              }));
-              return [];
-            })
-          )
-        )
-      );
-      const uniqueKeys = /* @__PURE__ */ new Set();
-      for (const list of keyLists) {
-        for (const key of list) {
-          uniqueKeys.add(key);
-        }
-      }
-      if (uniqueKeys.size === 0) {
-        return [];
-      }
-      const ruleKeys = [...uniqueKeys];
-      this.logger.debug(() => ({
-        msg: "Executed split rule sub-queries",
-        data: {
-          inspect: util.inspect(
-            {
-              subQueryCount: subQueries.length,
-              uniqueCandidates: ruleKeys.length,
-              perSubQueryCounts: keyLists.map((l, i) => ({
-                kind: subQueries[i]?.kind,
-                found: l.length
-              })),
-              filter
-            },
-            { depth: null }
-          )
-        }
-      }));
-      const { records } = await fetchRedisHashRecords(
-        this.client,
-        ruleKeys,
-        this.logger
-      );
-      const nonEmptyRecords = records.filter(
-        (record) => Object.keys(record).length > 0
-      );
-      const parsedRules = parseRedisRecords(
-        nonEmptyRecords,
-        accessRuleInput,
-        this.logger
-      );
-      return sortByReaderRank(parsedRules);
-    } catch (e) {
-      this.logger.error(() => ({
-        err: e,
-        data: {
-          inspect: util.inspect({ filter }, { depth: null })
-        },
-        msg: "failed to execute split rule query set"
-      }));
-      return [];
-    }
-  }
-  async findRulesRanked(filter, query) {
-    try {
-      const reply = await this.client.ft.aggregate(
-        ACCESS_RULES_REDIS_INDEX_NAME,
-        query,
-        {
-          DIALECT: REDIS_QUERY_DIALECT,
-          LOAD: [...RULE_LOAD_FIELDS],
-          STEPS: [
-            // Drop candidates whose hash is missing `type` before
-            // any APPLY runs. SEVERITY_EXPR dereferences `@type`
-            // directly, and RediSearch throws
-            //   "Could not find the value for a parameter name,
-            //    consider using EXISTS if applicable for type"
-            // when the LOAD pulls an undefined @type, aborting
-            // the whole aggregate. The undefined @type can come
-            // from a partial-write race in the writer or a
-            // stale RediSearch index entry pointing at a hash
-            // whose `type` field has been removed; in both
-            // cases the doc is malformed and not a valid
-            // AccessRule, so dropping it is correct.
-            { type: "FILTER", expression: "exists(@type)" },
-            { type: "APPLY", expression: SPECIFICITY_EXPR, AS: "_spec" },
-            { type: "APPLY", expression: SEVERITY_EXPR, AS: "_sev" },
-            { type: "APPLY", expression: RANK_EXPR, AS: "_rank" },
-            {
-              type: "SORTBY",
-              BY: [{ BY: "@_rank", DIRECTION: "DESC" }]
-              // SORTBY MAX would let RediSearch keep only the
-              // top-N in a bounded heap rather than fully
-              // sorting, but the @redis/search client
-              // serialises MAX *before* DESC and RediSearch
-              // rejects that order ("MISSING ASC or DESC
-              // after sort field (MAX)"). LIMIT below still
-              // trims; SORTBY does a full sort. Acceptable
-              // because the strict-match filter already
-              // keeps the candidate set small in practice.
-            },
-            { type: "LIMIT", from: 0, size: SERVER_SIDE_RANK_TOP_N }
-          ]
-        }
-      );
-      if (reply.results.length === 0) {
-        return [];
-      }
-      this.logger.debug(() => ({
-        msg: "Executed ranked search query",
-        data: {
-          inspect: util.inspect(
-            {
-              filter,
-              foundCount: reply.results.length,
-              query
-            },
-            { depth: null }
-          )
-        }
-      }));
-      const ruleKeys = [];
-      for (const result of reply.results) {
-        const key = result.__key;
-        if (typeof key === "string") {
-          ruleKeys.push(key);
-        }
-      }
-      if (ruleKeys.length === 0) {
-        return [];
-      }
-      const { records } = await fetchRedisHashRecords(
-        this.client,
-        ruleKeys,
-        this.logger
-      );
-      const nonEmptyRecords = records.filter(
-        (record) => Object.keys(record).length > 0
-      );
-      return parseRedisRecords(nonEmptyRecords, accessRuleInput, this.logger);
-    } catch (e) {
-      this.logger.error(() => ({
-        err: e,
-        data: {
-          inspect: util.inspect({ query, filter }, { depth: null })
-        },
-        msg: "failed to execute ranked search query"
-      }));
-      return [];
-    }
-  }
-  // Used only by admin / internal callers (matchingFieldsOnly=false).
-  // Not on the per-request blockMiddleware path any more, so the CPU
-  // cost of the HGETALL fanout is acceptable. Same shape as #2689's
-  // aggregate-with-cursor: returns every candidate up to
-  // GREEDY_MAX_CANDIDATES so we don't silently drop matches that
-  // admin tools depend on (e.g. ASN-wide rule listings).
-  async findRulesGreedy(filter, query) {
-    try {
-      const ruleKeys = await aggregateRedisKeys(
-        this.client,
-        query,
-        this.logger,
-        void 0,
-        GREEDY_MAX_CANDIDATES
-      );
-      if (ruleKeys.length === 0) {
-        return [];
-      }
-      this.logger.debug(() => ({
-        msg: "Executed greedy search query",
-        data: {
-          inspect: util.inspect(
-            {
-              filter,
-              foundCount: ruleKeys.length,
-              query
-            },
-            { depth: null }
-          )
-        }
-      }));
-      const { records } = await fetchRedisHashRecords(
-        this.client,
-        ruleKeys,
-        this.logger
-      );
-      const nonEmptyRecords = records.filter(
-        (record) => Object.keys(record).length > 0
-      );
-      return parseRedisRecords(nonEmptyRecords, accessRuleInput, this.logger);
-    } catch (e) {
-      this.logger.error(() => ({
-        err: e,
-        data: {
-          inspect: util.inspect({ query, filter }, { depth: null })
-        },
-        msg: "failed to execute greedy search query"
-      }));
-      return [];
-    }
-  }
-  async findRuleIds(filter, matchingFieldsOnly = false) {
-    const query = getRulesRedisQuery(filter, matchingFieldsOnly);
-    let ruleIds = [];
-    try {
-      const ruleKeys = await aggregateRedisKeys(
-        this.client,
-        query,
-        this.logger
-      );
-      ruleIds = ruleKeys.map(
-        (ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)
-      );
-    } catch (e) {
-      this.logger.error(() => ({
-        err: e,
-        data: {
-          inspect: util.inspect(
-            {
-              query,
-              filter
-            },
-            {
-              depth: null
-            }
-          )
-        },
-        msg: "Failed to execute search query for rule IDs"
-      }));
-      return [];
-    }
-    this.logger.debug(() => ({
-      msg: "Executed search query for rule IDs",
-      data: {
-        query,
-        foundCount: ruleIds.length,
-        foundIds: ruleIds
-      }
-    }));
-    return ruleIds;
-  }
-  async fetchAllRuleIds(batchHandler) {
-    const keysBatchHandler = async (keys) => {
-      const ids = keys.map(
-        (ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)
-      );
-      await batchHandler(ids);
-    };
-    await aggregateRedisKeys(this.client, "*", this.logger, keysBatchHandler);
-  }
-  async fetchRuleEntries(keys) {
-    const { records, expirations } = await fetchRedisHashRecords(
-      this.client,
-      keys,
-      this.logger
-    );
-    const entries = [];
-    for (const [index, ruleData] of records.entries()) {
-      const isRulePresent = Object.keys(ruleData).length > 0;
-      if (isRulePresent) {
-        const rule = parseRedisRecords(
-          [ruleData],
-          accessRuleInput,
-          this.logger
-        )[0];
-        if (rule) {
-          entries.push({
-            rule,
-            expiresUnixTimestamp: expirations[index]
-          });
-        }
-      }
-    }
-    return entries;
-  }
-  getRuleKeys(ruleIds) {
-    return ruleIds.map((id) => `${ACCESS_RULE_REDIS_KEY_PREFIX}${id}`);
-  }
-}
-class DummyRedisRulesReader {
-  constructor(logger) {
-    this.logger = logger;
-  }
-  async getMissingRuleIds(ruleIds) {
-    this.logger.info(() => ({
-      msg: "Dummy getMissingRuleIds() has no effect (redis is not ready)",
-      data: {
-        ruleIds
-      }
-    }));
-    return [];
-  }
-  async fetchRules(ruleIds) {
-    this.logger.info(() => ({
-      msg: "Dummy fetchRule() has no effect (redis is not ready)",
-      data: {
-        ruleIds
-      }
-    }));
-    return [];
-  }
-  async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
-    this.logger.info(() => ({
-      msg: "Dummy findRules() has no effect (redis is not ready)",
-      data: {
-        filter
-      }
-    }));
-    return [];
-  }
-  async findRuleIds(filter, matchingFieldsOnly = false) {
-    this.logger.info(() => ({
-      msg: "Dummy findRuleIds() has no effect (redis is not ready)",
-      data: {
-        filter
-      }
-    }));
-    return [];
-  }
-  async fetchAllRuleIds(batchHandler) {
-    this.logger.info(() => ({
-      msg: "Dummy fetchAllRuleIds() has no effect (redis is not ready)"
-    }));
-  }
-}
-export {
-  DummyRedisRulesReader,
-  RedisRulesReader,
-  SERVER_SIDE_RANK_TOP_N
+var RedisRulesReader = class {
+	constructor(client, logger) {
+		this.client = client;
+		this.logger = logger;
+	}
+	async getMissingRuleIds(ruleIds) {
+		return (await executeBatchesSequentially(chunkIntoBatches(this.getRuleKeys(ruleIds), REDIS_BATCH_SIZE), async (keysBatch) => getMissingRedisKeys(this.client, keysBatch))).flat().map((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+	}
+	async fetchRules(ruleIds) {
+		return (await executeBatchesSequentially(chunkIntoBatches(this.getRuleKeys(ruleIds), REDIS_BATCH_SIZE), (keysBatch) => this.fetchRuleEntries(keysBatch))).flat();
+	}
+	async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
+		const query = getRulesRedisQuery(filter, matchingFieldsOnly);
+		if (skipEmptyUserScopes && query === "( @clientId:{global} | ismissing(@clientId) )") return [];
+		if (matchingFieldsOnly && filter.userScope !== void 0) return this.findRulesSplit(filter);
+		return this.findRulesGreedy(filter, query);
+	}
+	async findRulesSplit(filter) {
+		const userScope = filter.userScope;
+		if (userScope === void 0) return [];
+		const clientId = filter.policyScope?.clientId;
+		const subQueries = buildScopedRulesSubQueries(userScope, clientId, { ...filter.blockOnly === true && { blockOnly: true } });
+		try {
+			const keyLists = await Promise.all(subQueries.map((sub) => searchRedisKeysBounded(this.client, sub.query, SPLIT_MAX_CANDIDATES_PER_SUB).catch((err) => {
+				this.logger.error(() => ({
+					err,
+					data: { inspect: util.inspect({
+						subKind: sub.kind,
+						query: sub.query
+					}, { depth: null }) },
+					msg: "failed to execute split rule sub-query"
+				}));
+				return [];
+			})));
+			const uniqueKeys = /* @__PURE__ */ new Set();
+			for (const list of keyLists) for (const key of list) uniqueKeys.add(key);
+			if (uniqueKeys.size === 0) return [];
+			const ruleKeys = [...uniqueKeys];
+			this.logger.debug(() => ({
+				msg: "Executed split rule sub-queries",
+				data: { inspect: util.inspect({
+					subQueryCount: subQueries.length,
+					uniqueCandidates: ruleKeys.length,
+					perSubQueryCounts: keyLists.map((l, i) => ({
+						kind: subQueries[i]?.kind,
+						found: l.length
+					})),
+					filter
+				}, { depth: null }) }
+			}));
+			const { records } = await fetchRedisHashRecords(this.client, ruleKeys, this.logger);
+			return sortByReaderRank(parseRedisRecords(records.filter((record) => Object.keys(record).length > 0), accessRuleInput, this.logger));
+		} catch (e) {
+			this.logger.error(() => ({
+				err: e,
+				data: { inspect: util.inspect({ filter }, { depth: null }) },
+				msg: "failed to execute split rule query set"
+			}));
+			return [];
+		}
+	}
+	async findRulesRanked(filter, query) {
+		try {
+			const reply = await this.client.ft.aggregate(ACCESS_RULES_REDIS_INDEX_NAME, query, {
+				DIALECT: 2,
+				LOAD: [...RULE_LOAD_FIELDS],
+				STEPS: [
+					{
+						type: "FILTER",
+						expression: "exists(@type)"
+					},
+					{
+						type: "APPLY",
+						expression: SPECIFICITY_EXPR,
+						AS: "_spec"
+					},
+					{
+						type: "APPLY",
+						expression: SEVERITY_EXPR,
+						AS: "_sev"
+					},
+					{
+						type: "APPLY",
+						expression: RANK_EXPR,
+						AS: "_rank"
+					},
+					{
+						type: "SORTBY",
+						BY: [{
+							BY: "@_rank",
+							DIRECTION: "DESC"
+						}]
+					},
+					{
+						type: "LIMIT",
+						from: 0,
+						size: 20
+					}
+				]
+			});
+			if (reply.results.length === 0) return [];
+			this.logger.debug(() => ({
+				msg: "Executed ranked search query",
+				data: { inspect: util.inspect({
+					filter,
+					foundCount: reply.results.length,
+					query
+				}, { depth: null }) }
+			}));
+			const ruleKeys = [];
+			for (const result of reply.results) {
+				const key = result.__key;
+				if (typeof key === "string") ruleKeys.push(key);
+			}
+			if (ruleKeys.length === 0) return [];
+			const { records } = await fetchRedisHashRecords(this.client, ruleKeys, this.logger);
+			return parseRedisRecords(records.filter((record) => Object.keys(record).length > 0), accessRuleInput, this.logger);
+		} catch (e) {
+			this.logger.error(() => ({
+				err: e,
+				data: { inspect: util.inspect({
+					query,
+					filter
+				}, { depth: null }) },
+				msg: "failed to execute ranked search query"
+			}));
+			return [];
+		}
+	}
+	async findRulesGreedy(filter, query) {
+		try {
+			const ruleKeys = await aggregateRedisKeys(this.client, query, this.logger, void 0, GREEDY_MAX_CANDIDATES);
+			if (ruleKeys.length === 0) return [];
+			this.logger.debug(() => ({
+				msg: "Executed greedy search query",
+				data: { inspect: util.inspect({
+					filter,
+					foundCount: ruleKeys.length,
+					query
+				}, { depth: null }) }
+			}));
+			const { records } = await fetchRedisHashRecords(this.client, ruleKeys, this.logger);
+			return parseRedisRecords(records.filter((record) => Object.keys(record).length > 0), accessRuleInput, this.logger);
+		} catch (e) {
+			this.logger.error(() => ({
+				err: e,
+				data: { inspect: util.inspect({
+					query,
+					filter
+				}, { depth: null }) },
+				msg: "failed to execute greedy search query"
+			}));
+			return [];
+		}
+	}
+	async findRuleIds(filter, matchingFieldsOnly = false) {
+		const query = getRulesRedisQuery(filter, matchingFieldsOnly);
+		let ruleIds = [];
+		try {
+			ruleIds = (await aggregateRedisKeys(this.client, query, this.logger)).map((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+		} catch (e) {
+			this.logger.error(() => ({
+				err: e,
+				data: { inspect: util.inspect({
+					query,
+					filter
+				}, { depth: null }) },
+				msg: "Failed to execute search query for rule IDs"
+			}));
+			return [];
+		}
+		this.logger.debug(() => ({
+			msg: "Executed search query for rule IDs",
+			data: {
+				query,
+				foundCount: ruleIds.length,
+				foundIds: ruleIds
+			}
+		}));
+		return ruleIds;
+	}
+	async fetchAllRuleIds(batchHandler) {
+		const keysBatchHandler = async (keys) => {
+			await batchHandler(keys.map((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)));
+		};
+		await aggregateRedisKeys(this.client, "*", this.logger, keysBatchHandler);
+	}
+	async fetchRuleEntries(keys) {
+		const { records, expirations } = await fetchRedisHashRecords(this.client, keys, this.logger);
+		const entries = [];
+		for (const [index, ruleData] of records.entries()) if (Object.keys(ruleData).length > 0) {
+			const rule = parseRedisRecords([ruleData], accessRuleInput, this.logger)[0];
+			if (rule) entries.push({
+				rule,
+				expiresUnixTimestamp: expirations[index]
+			});
+		}
+		return entries;
+	}
+	getRuleKeys(ruleIds) {
+		return ruleIds.map((id) => `${ACCESS_RULE_REDIS_KEY_PREFIX}${id}`);
+	}
+};
+var DummyRedisRulesReader = class {
+	constructor(logger) {
+		this.logger = logger;
+	}
+	async getMissingRuleIds(ruleIds) {
+		this.logger.info(() => ({
+			msg: "Dummy getMissingRuleIds() has no effect (redis is not ready)",
+			data: { ruleIds }
+		}));
+		return [];
+	}
+	async fetchRules(ruleIds) {
+		this.logger.info(() => ({
+			msg: "Dummy fetchRule() has no effect (redis is not ready)",
+			data: { ruleIds }
+		}));
+		return [];
+	}
+	async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
+		this.logger.info(() => ({
+			msg: "Dummy findRules() has no effect (redis is not ready)",
+			data: { filter }
+		}));
+		return [];
+	}
+	async findRuleIds(filter, matchingFieldsOnly = false) {
+		this.logger.info(() => ({
+			msg: "Dummy findRuleIds() has no effect (redis is not ready)",
+			data: { filter }
+		}));
+		return [];
+	}
+	async fetchAllRuleIds(batchHandler) {
+		this.logger.info(() => ({ msg: "Dummy fetchAllRuleIds() has no effect (redis is not ready)" }));
+	}
 };
+//#endregion
+export { DummyRedisRulesReader, RedisRulesReader, SERVER_SIDE_RANK_TOP_N };