@prosopo/user-access-policy 3.12.8 → 3.12.10

package/dist/redis/reader/redisRulesSplitQuery.js

@@ -1,80 +1,101 @@
-import { GLOBAL_CLIENT_SCOPE_SENTINEL, AccessPolicyType } from "../../rule.js";
-const escapeTagValue = (value) => value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
-const FIELDS_REQUIRING_ESCAPE = /* @__PURE__ */ new Set([
-  "coords"
-]);
-const NUMERIC_FIELDS = /* @__PURE__ */ new Set(["asn"]);
-const SCALAR_USER_SCOPE_FIELDS = [
-  "userId",
-  "ja4Hash",
-  "headersHash",
-  "userAgentHash",
-  "headHash",
-  "coords",
-  "countryCode",
-  "asn"
+import "../../_virtual/_rolldown/runtime.js";
+import { AccessPolicyType, GLOBAL_CLIENT_SCOPE_SENTINEL } from "../../rule.js";
+//#region src/redis/reader/redisRulesSplitQuery.ts
+var escapeTagValue = (value) => value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
+var FIELDS_REQUIRING_ESCAPE = /* @__PURE__ */ new Set(["coords"]);
+var NUMERIC_FIELDS = /* @__PURE__ */ new Set(["asn"]);
+var SCALAR_USER_SCOPE_FIELDS = [
+	"userId",
+	"ja4Hash",
+	"headersHash",
+	"userAgentHash",
+	"headHash",
+	"coords",
+	"countryCode",
+	"asn"
 ];
-const ALL_USER_SCOPE_FIELDS = [
-  ...SCALAR_USER_SCOPE_FIELDS,
-  "numericIp",
-  "numericIpMaskMin",
-  "numericIpMaskMax"
+var ALL_USER_SCOPE_FIELDS = [
+	...SCALAR_USER_SCOPE_FIELDS,
+	"numericIp",
+	"numericIpMaskMin",
+	"numericIpMaskMax"
 ];
-const GLOBAL_SCOPE_INNER = `@clientId:{${GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
-const buildScopeClause = (clientId) => {
-  if (clientId === void 0) {
-    return `( ${GLOBAL_SCOPE_INNER} )`;
-  }
-  return `( @clientId:{${clientId}} | ${GLOBAL_SCOPE_INNER} )`;
+var GLOBAL_SCOPE_INNER = `@clientId:{${GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
+var buildScopeClause = (clientId) => {
+	if (clientId === void 0) return `( ${GLOBAL_SCOPE_INNER} )`;
+	return `( @clientId:{${clientId}} | ${GLOBAL_SCOPE_INNER} )`;
 };
-const buildFieldClause = (field, value) => {
-  if (value === void 0) {
-    return null;
-  }
-  const stringValue = String(value);
-  if (NUMERIC_FIELDS.has(field)) {
-    return `@${field}:[${stringValue} ${stringValue}]`;
-  }
-  const queryValue = FIELDS_REQUIRING_ESCAPE.has(field) ? escapeTagValue(stringValue) : stringValue;
-  return `@${field}:{${queryValue}}`;
+var buildFieldClause = (field, value) => {
+	if (value === void 0) return null;
+	const stringValue = String(value);
+	if (NUMERIC_FIELDS.has(field)) return `@${field}:[${stringValue} ${stringValue}]`;
+	return `@${field}:{${FIELDS_REQUIRING_ESCAPE.has(field) ? escapeTagValue(stringValue) : stringValue}}`;
 };
-const buildScopedRulesSubQueries = (userScope, clientId, options = {}) => {
-  const typeClause = options.blockOnly ? `@type:{${AccessPolicyType.Block}} ` : "";
-  const scopeClause = buildScopeClause(clientId);
-  const prefix = `${typeClause}${scopeClause}`;
-  const subQueries = [];
-  for (const field of SCALAR_USER_SCOPE_FIELDS) {
-    const clause = buildFieldClause(field, userScope[field]);
-    if (clause === null) {
-      continue;
-    }
-    subQueries.push({
-      kind: `field:${field}`,
-      query: `${prefix} ${clause}`
-    });
-  }
-  const requestIp = userScope.numericIp;
-  if (requestIp !== void 0) {
-    subQueries.push({
-      kind: "ip:exact",
-      query: `${prefix} @numericIp:[${requestIp} ${requestIp}]`
-    });
-    subQueries.push({
-      kind: "ip:mask",
-      query: `${prefix} @numericIpMaskMin:[-inf ${requestIp}] @numericIpMaskMax:[${requestIp} +inf]`
-    });
-  }
-  const noScopeIsmissing = ALL_USER_SCOPE_FIELDS.map(
-    (field) => `ismissing(@${field})`
-  ).join(" ");
-  subQueries.push({
-    kind: "no-user-scope",
-    query: `${prefix} ${noScopeIsmissing}`
-  });
-  return subQueries;
-};
-const buildScopedBlockSubQueries = (userScope, clientId) => buildScopedRulesSubQueries(userScope, clientId, { blockOnly: true });
-export {
-  buildScopedBlockSubQueries,
-  buildScopedRulesSubQueries
+/**
+* Build the set of FT sub-queries that together cover every rule that
+* could apply to a request.
+*
+* The single-query design this replaces produced one FT.AGGREGATE whose
+* candidate set was the entire scope's rule pool — the APPLY / SORTBY
+* pipeline then walked every rule per request, which degrades sharply
+* once rule populations reach the 10k+ range. The split approach fires
+* one probe per populated request field. Each probe uses the field's
+* own index posting list, so a 17k IP-ban population collapses to 1
+* result (exact IP) plus a handful (CIDR ranges containing the IP)
+* instead of forcing a full-set scan.
+*
+* A single fall-through probe covers rules with no user-scope constraint
+* (client-wide restriction); those are rare so the ismissing()-heavy
+* query is cheap in practice.
+*
+* Rank + strict-match filtering happens in JS via `rankCandidateRules`
+* after the union — the FT layer is used purely as a candidate fetcher.
+*
+* `blockOnly` narrows the candidate set to rules with `type:{block}` —
+* used by the hard-block middleware which never needs Restrict rules.
+* Every other caller passes false so both Block and Restrict rules are
+* fetched; the JS-side ranker picks the right one via specificity +
+* severity. Merging the block and restrict paths behind one split-query
+* fixed the Twickets IP-rule regression: the previous FT.AGGREGATE ranker
+* used for non-block lookups was truncating specific-IP restrict rules
+* out of the top-N when many higher-specificity irrelevant rules matched
+* the greedy `ismissing()` disjunction.
+*/
+var buildScopedRulesSubQueries = (userScope, clientId, options = {}) => {
+	const prefix = `${options.blockOnly ? `@type:{${AccessPolicyType.Block}} ` : ""}${buildScopeClause(clientId)}`;
+	const subQueries = [];
+	for (const field of SCALAR_USER_SCOPE_FIELDS) {
+		const clause = buildFieldClause(field, userScope[field]);
+		if (clause === null) continue;
+		subQueries.push({
+			kind: `field:${field}`,
+			query: `${prefix} ${clause}`
+		});
+	}
+	const requestIp = userScope.numericIp;
+	if (requestIp !== void 0) {
+		subQueries.push({
+			kind: "ip:exact",
+			query: `${prefix} @numericIp:[${requestIp} ${requestIp}]`
+		});
+		subQueries.push({
+			kind: "ip:mask",
+			query: `${prefix} @numericIpMaskMin:[-inf ${requestIp}] @numericIpMaskMax:[${requestIp} +inf]`
+		});
+	}
+	const noScopeIsmissing = ALL_USER_SCOPE_FIELDS.map((field) => `ismissing(@${field})`).join(" ");
+	subQueries.push({
+		kind: "no-user-scope",
+		query: `${prefix} ${noScopeIsmissing}`
+	});
+	return subQueries;
 };
+/**
+* Backwards-compatible alias for the previous block-only builder. New
+* callers should use `buildScopedRulesSubQueries` directly.
+*
+* @deprecated use `buildScopedRulesSubQueries(..., { blockOnly: true })`
+*/
+var buildScopedBlockSubQueries = (userScope, clientId) => buildScopedRulesSubQueries(userScope, clientId, { blockOnly: true });
+//#endregion
+export { buildScopedBlockSubQueries, buildScopedRulesSubQueries };

package/dist/redis/redisClient.js

@@ -1,67 +1,59 @@
+import "../_virtual/_rolldown/runtime.js";
 import { z } from "zod";
-const REDIS_BATCH_SIZE = 1e3;
-const getMissingRedisKeys = async (client, keys) => {
-  const queries = client.multi();
-  keys.map((key) => {
-    queries.exists(key);
-  });
-  const records = await queries.exec();
-  const missingKeys = [];
-  records.map((exists, recordIndex) => {
-    if ("0" === String(exists)) {
-      const key = keys[recordIndex];
-      if (key) {
-        missingKeys.push(key);
-      }
-    }
-  });
-  return missingKeys;
+//#region src/redis/redisClient.ts
+var REDIS_BATCH_SIZE = 1e3;
+var getMissingRedisKeys = async (client, keys) => {
+	const queries = client.multi();
+	keys.map((key) => {
+		queries.exists(key);
+	});
+	const records = await queries.exec();
+	const missingKeys = [];
+	records.map((exists, recordIndex) => {
+		if ("0" === String(exists)) {
+			const key = keys[recordIndex];
+			if (key) missingKeys.push(key);
+		}
+	});
+	return missingKeys;
 };
-const fetchRedisHashRecords = async (client, keys, logger) => {
-  const rulesPipe = client.multi();
-  const expirationPipe = client.multi();
-  for (const key of keys) {
-    rulesPipe.hGetAll(key);
-    expirationPipe.expireTime(key);
-  }
-  const records = await rulesPipe.exec();
-  const expirationRecords = await expirationPipe.exec();
-  return {
-    records,
-    expirations: parseExpirationRecords(expirationRecords, logger)
-  };
+var fetchRedisHashRecords = async (client, keys, logger) => {
+	const rulesPipe = client.multi();
+	const expirationPipe = client.multi();
+	for (const key of keys) {
+		rulesPipe.hGetAll(key);
+		expirationPipe.expireTime(key);
+	}
+	return {
+		records: await rulesPipe.exec(),
+		expirations: parseExpirationRecords(await expirationPipe.exec(), logger)
+	};
 };
-const parseRedisRecords = (records, recordSchema, logger) => records.flatMap((record) => {
-  const parseResult = recordSchema.safeParse(record);
-  if (parseResult.success) {
-    return [parseResult.data];
-  }
-  logger.error(() => ({
-    msg: "Failed to parse Redis record",
-    data: { record, error: parseResult.error }
-  }));
-  return [];
+var parseRedisRecords = (records, recordSchema, logger) => records.flatMap((record) => {
+	const parseResult = recordSchema.safeParse(record);
+	if (parseResult.success) return [parseResult.data];
+	logger.error(() => ({
+		msg: "Failed to parse Redis record",
+		data: {
+			record,
+			error: parseResult.error
+		}
+	}));
+	return [];
 });
-const expirationRecordSchema = z.coerce.number();
-const UNSET_EXPIRATION_VALUE = -1;
-const parseExpirationRecords = (records, logger) => records.flatMap((record) => {
-  const parseResult = expirationRecordSchema.safeParse(record);
-  if (parseResult.success) {
-    const expiration = UNSET_EXPIRATION_VALUE === parseResult.data ? void 0 : parseResult.data;
-    return [expiration];
-  }
-  logger.error(() => ({
-    msg: "Failed to parse Redis expiration record",
-    data: {
-      record,
-      error: parseResult.error
-    }
-  }));
-  return [void 0];
+var expirationRecordSchema = z.coerce.number();
+var UNSET_EXPIRATION_VALUE = -1;
+var parseExpirationRecords = (records, logger) => records.flatMap((record) => {
+	const parseResult = expirationRecordSchema.safeParse(record);
+	if (parseResult.success) return [UNSET_EXPIRATION_VALUE === parseResult.data ? void 0 : parseResult.data];
+	logger.error(() => ({
+		msg: "Failed to parse Redis expiration record",
+		data: {
+			record,
+			error: parseResult.error
+		}
+	}));
+	return [void 0];
 });
-export {
-  REDIS_BATCH_SIZE,
-  fetchRedisHashRecords,
-  getMissingRedisKeys,
-  parseRedisRecords
-};
+//#endregion
+export { REDIS_BATCH_SIZE, fetchRedisHashRecords, getMissingRedisKeys, parseRedisRecords };

package/dist/redis/redisRuleIndex.js

@@ -1,64 +1,99 @@
-import { SCHEMA_FIELD_TYPE } from "@redis/search";
-import { makeAccessRuleHash } from "../transformRule.js";
+import "../_virtual/_rolldown/runtime.js";
 import { GLOBAL_CLIENT_SCOPE_SENTINEL } from "../rule.js";
-const userIpRedisSchema = {
-  numericIpMaskMin: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
-  numericIpMaskMax: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
-  numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true }
-};
-const userAttributesRedisSchema = {
-  userId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  ja4Hash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  headersHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  userAgentHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  headHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  // Use pipe separator for coords since JSON strings contain commas
-  coords: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true, SEPARATOR: "|" },
-  countryCode: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  asn: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
-  os: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
-};
-const userScopeRedisSchema = {
-  ...userAttributesRedisSchema,
-  ...userIpRedisSchema
+import { makeAccessRuleHash } from "../transformRule.js";
+import { SCHEMA_FIELD_TYPE } from "@redis/search";
+//#region src/redis/redisRuleIndex.ts
+var userIpRedisSchema = {
+	numericIpMaskMin: {
+		type: SCHEMA_FIELD_TYPE.NUMERIC,
+		INDEXMISSING: true
+	},
+	numericIpMaskMax: {
+		type: SCHEMA_FIELD_TYPE.NUMERIC,
+		INDEXMISSING: true
+	},
+	numericIp: {
+		type: SCHEMA_FIELD_TYPE.NUMERIC,
+		INDEXMISSING: true
+	}
 };
-const policyScopeRedisSchema = {
-  clientId: {
-    type: SCHEMA_FIELD_TYPE.TAG,
-    INDEXMISSING: true
-  }
+var userAttributesRedisSchema = {
+	userId: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	ja4Hash: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headersHash: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	userAgentHash: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	headHash: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	coords: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true,
+		SEPARATOR: "|"
+	},
+	countryCode: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	asn: {
+		type: SCHEMA_FIELD_TYPE.NUMERIC,
+		INDEXMISSING: true
+	},
+	os: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	}
 };
-const accessRuleRedisSchema = {
-  ...policyScopeRedisSchema,
-  ...userScopeRedisSchema,
-  groupId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-  // Indexed so request-time callers that only care about Block policies
-  // (checkForHardBlock, blockMiddleware) can pre-filter via @type:{block}
-  // before the SERVER_SIDE_RANK_TOP_N cap kicks in. Without this, dense
-  // Restrict / routing-Block populations push the hard-block rules out
-  // of the top-N candidate set and the lookup silently misses them.
-  type: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
+var userScopeRedisSchema = {
+	...userAttributesRedisSchema,
+	...userIpRedisSchema
 };
-const ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
-const ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
-const accessRulesRedisIndex = {
-  name: ACCESS_RULES_REDIS_INDEX_NAME,
-  schema: accessRuleRedisSchema,
-  options: {
-    ON: "HASH",
-    PREFIX: [ACCESS_RULE_REDIS_KEY_PREFIX]
-  }
+var policyScopeRedisSchema = { clientId: {
+	type: SCHEMA_FIELD_TYPE.TAG,
+	INDEXMISSING: true
+} };
+/**
+* Note on the field type decision
+*
+* TAG is designed for the exact value matching
+* TEXT is designed for the word-based and pattern matching
+*
+* For our goal TAG fits perfectly and, more performant
+*/
+var accessRuleRedisSchema = {
+	...policyScopeRedisSchema,
+	...userScopeRedisSchema,
+	groupId: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	},
+	type: {
+		type: SCHEMA_FIELD_TYPE.TAG,
+		INDEXMISSING: true
+	}
 };
-const getAccessRuleRedisKey = (rule) => ACCESS_RULE_REDIS_KEY_PREFIX + makeAccessRuleHash(rule);
-export {
-  ACCESS_RULES_REDIS_INDEX_NAME,
-  ACCESS_RULE_REDIS_KEY_PREFIX,
-  GLOBAL_CLIENT_SCOPE_SENTINEL,
-  accessRuleRedisSchema,
-  accessRulesRedisIndex,
-  getAccessRuleRedisKey,
-  policyScopeRedisSchema,
-  userAttributesRedisSchema,
-  userIpRedisSchema,
-  userScopeRedisSchema
+var ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
+var ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
+var accessRulesRedisIndex = {
+	name: ACCESS_RULES_REDIS_INDEX_NAME,
+	schema: accessRuleRedisSchema,
+	options: {
+		ON: "HASH",
+		PREFIX: [ACCESS_RULE_REDIS_KEY_PREFIX]
+	}
 };
+var getAccessRuleRedisKey = (rule) => ACCESS_RULE_REDIS_KEY_PREFIX + makeAccessRuleHash(rule);
+//#endregion
+export { ACCESS_RULES_REDIS_INDEX_NAME, ACCESS_RULE_REDIS_KEY_PREFIX, GLOBAL_CLIENT_SCOPE_SENTINEL, accessRuleRedisSchema, accessRulesRedisIndex, getAccessRuleRedisKey, policyScopeRedisSchema, userAttributesRedisSchema, userIpRedisSchema, userScopeRedisSchema };

package/dist/redis/redisRulesStorage.js

@@ -1,34 +1,25 @@
+import "../_virtual/_rolldown/runtime.js";
 import { DummyRedisRulesReader, RedisRulesReader } from "./reader/redisRulesReader.js";
 import { DummyRedisRulesWriter, RedisRulesWriter } from "./redisRulesWriter.js";
-const createRedisAccessRulesStorage = (connection, logger) => {
-  const storage = composeStorage(
-    new DummyRedisRulesReader(logger),
-    new DummyRedisRulesWriter(logger)
-  );
-  connection.getClient().then((client) => {
-    const realStorage = composeStorage(
-      new RedisRulesReader(client, logger),
-      new RedisRulesWriter(client, logger)
-    );
-    Object.assign(storage, realStorage);
-    logger.info(() => ({
-      msg: "RedisAccessRules storage got a ready Redis client"
-    }));
-  });
-  return storage;
+//#region src/redis/redisRulesStorage.ts
+var createRedisAccessRulesStorage = (connection, logger) => {
+	const storage = composeStorage(new DummyRedisRulesReader(logger), new DummyRedisRulesWriter(logger));
+	connection.getClient().then((client) => {
+		const realStorage = composeStorage(new RedisRulesReader(client, logger), new RedisRulesWriter(client, logger));
+		Object.assign(storage, realStorage);
+		logger.info(() => ({ msg: "RedisAccessRules storage got a ready Redis client" }));
+	});
+	return storage;
 };
-const composeStorage = (reader, writer) => ({
-  // reader
-  fetchRules: reader.fetchRules.bind(reader),
-  getMissingRuleIds: reader.getMissingRuleIds.bind(reader),
-  findRules: reader.findRules.bind(reader),
-  findRuleIds: reader.findRuleIds.bind(reader),
-  fetchAllRuleIds: reader.fetchAllRuleIds.bind(reader),
-  // writer
-  insertRules: writer.insertRules.bind(writer),
-  deleteRules: writer.deleteRules.bind(writer),
-  deleteAllRules: writer.deleteAllRules.bind(writer)
+var composeStorage = (reader, writer) => ({
+	fetchRules: reader.fetchRules.bind(reader),
+	getMissingRuleIds: reader.getMissingRuleIds.bind(reader),
+	findRules: reader.findRules.bind(reader),
+	findRuleIds: reader.findRuleIds.bind(reader),
+	fetchAllRuleIds: reader.fetchAllRuleIds.bind(reader),
+	insertRules: writer.insertRules.bind(writer),
+	deleteRules: writer.deleteRules.bind(writer),
+	deleteAllRules: writer.deleteAllRules.bind(writer)
 });
-export {
-  createRedisAccessRulesStorage
-};
+//#endregion
+export { createRedisAccessRulesStorage };