@prosopo/user-access-policy 3.12.8 → 3.12.10

package/dist/cjs/api/write/insertRules.cjs

@@ -1,105 +1,87 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const apiRoute = require("@prosopo/api-route");
-const logger = require("@prosopo/logger");
-const zod = require("zod");
-const policyInput = require("../../ruleInput/policyInput.cjs");
-const userScopeInput = require("../../ruleInput/userScopeInput.cjs");
-class InsertRulesEndpoint {
-  constructor(accessRulesWriter, logger2) {
-    this.accessRulesWriter = accessRulesWriter;
-    this.logger = logger2;
-  }
-  getRequestArgsSchema() {
-    return zod.z.array(
-      zod.z.object({
-        accessPolicy: policyInput.accessPolicyInput,
-        policyScopes: zod.z.array(policyInput.policyScopeInput).optional(),
-        groupId: zod.z.string().optional(),
-        userScopes: zod.z.array(userScopeInput.userScopeInput),
-        expiresUnixTimestamp: zod.z.number().optional()
-      })
-    );
-  }
-  async processRequest(args, logger$1) {
-    const log = logger$1 ?? this.logger;
-    const timeoutPromise = new Promise((resolve) => {
-      setTimeout(() => {
-        resolve({
-          status: apiRoute.ApiEndpointResponseStatus.PROCESSING
-        });
-      }, 5e3);
-    });
-    const userScopesCount = args.reduce(
-      (userScopesCount2, group) => userScopesCount2 + group.userScopes.length,
-      0
-    );
-    const createRulesPromise = this.createRuleGroups(args).then((insertedIds) => {
-      log.info(() => ({
-        msg: "Endpoint inserted access rules",
-        data: {
-          userScopesCount,
-          insertedCount: insertedIds.length,
-          uniqueIdsCount: new Set(insertedIds).size
-        }
-      }));
-      log.debug(() => ({
-        msg: "Inserted access rules details",
-        data: {
-          insertedIds,
-          input: args
-        }
-      }));
-      return {
-        status: apiRoute.ApiEndpointResponseStatus.SUCCESS
-      };
-    }).catch((error) => {
-      if (logger.LogLevel.enum.debug === log.getLogLevel()) {
-        log.error(() => ({
-          err: error,
-          data: { args },
-          msg: "Failed to insert access rules"
-        }));
-      }
-      return {
-        status: apiRoute.ApiEndpointResponseStatus.FAIL
-      };
-    });
-    return Promise.race([timeoutPromise, createRulesPromise]);
-  }
-  async createRuleGroups(groups) {
-    const ruleIdPromises = groups.map((group) => this.createRulesGroup(group));
-    const ruleIdSets = await Promise.all(ruleIdPromises);
-    return ruleIdSets.flat();
-  }
-  async createRulesGroup(group) {
-    const ruleEntries = [];
-    const policyScopes = group.policyScopes || [];
-    const sanitizedPolicy = policyInput.sanitizeAccessPolicy(group.accessPolicy);
-    for (const userScope of group.userScopes) {
-      const ruleBase = {
-        ...sanitizedPolicy,
-        ...userScope,
-        ...group.groupId ? { groupId: group.groupId } : {}
-      };
-      if (policyScopes.length > 0) {
-        for (const policyScope of policyScopes) {
-          ruleEntries.push({
-            rule: {
-              ...ruleBase,
-              ...policyScope
-            },
-            expiresUnixTimestamp: group.expiresUnixTimestamp
-          });
-        }
-      } else {
-        ruleEntries.push({
-          rule: ruleBase,
-          expiresUnixTimestamp: group.expiresUnixTimestamp
-        });
-      }
-    }
-    return this.accessRulesWriter.insertRules(ruleEntries);
-  }
-}
+const require_ruleInput_policyInput = require("../../ruleInput/policyInput.cjs");
+const require_ruleInput_userScopeInput = require("../../ruleInput/userScopeInput.cjs");
+let zod = require("zod");
+let _prosopo_api_route = require("@prosopo/api-route");
+let _prosopo_logger = require("@prosopo/logger");
+//#region src/api/write/insertRules.ts
+var InsertRulesEndpoint = class {
+	constructor(accessRulesWriter, logger) {
+		this.accessRulesWriter = accessRulesWriter;
+		this.logger = logger;
+	}
+	getRequestArgsSchema() {
+		return zod.z.array(zod.z.object({
+			accessPolicy: require_ruleInput_policyInput.accessPolicyInput,
+			policyScopes: zod.z.array(require_ruleInput_policyInput.policyScopeInput).optional(),
+			groupId: zod.z.string().optional(),
+			userScopes: zod.z.array(require_ruleInput_userScopeInput.userScopeInput),
+			expiresUnixTimestamp: zod.z.number().optional()
+		}));
+	}
+	async processRequest(args, logger) {
+		const log = logger ?? this.logger;
+		const timeoutPromise = new Promise((resolve) => {
+			setTimeout(() => {
+				resolve({ status: _prosopo_api_route.ApiEndpointResponseStatus.PROCESSING });
+			}, 5e3);
+		});
+		const userScopesCount = args.reduce((userScopesCount, group) => userScopesCount + group.userScopes.length, 0);
+		const createRulesPromise = this.createRuleGroups(args).then((insertedIds) => {
+			log.info(() => ({
+				msg: "Endpoint inserted access rules",
+				data: {
+					userScopesCount,
+					insertedCount: insertedIds.length,
+					uniqueIdsCount: new Set(insertedIds).size
+				}
+			}));
+			log.debug(() => ({
+				msg: "Inserted access rules details",
+				data: {
+					insertedIds,
+					input: args
+				}
+			}));
+			return { status: _prosopo_api_route.ApiEndpointResponseStatus.SUCCESS };
+		}).catch((error) => {
+			if (_prosopo_logger.LogLevel.enum.debug === log.getLogLevel()) log.error(() => ({
+				err: error,
+				data: { args },
+				msg: "Failed to insert access rules"
+			}));
+			return { status: _prosopo_api_route.ApiEndpointResponseStatus.FAIL };
+		});
+		return Promise.race([timeoutPromise, createRulesPromise]);
+	}
+	async createRuleGroups(groups) {
+		const ruleIdPromises = groups.map((group) => this.createRulesGroup(group));
+		return (await Promise.all(ruleIdPromises)).flat();
+	}
+	async createRulesGroup(group) {
+		const ruleEntries = [];
+		const policyScopes = group.policyScopes || [];
+		const sanitizedPolicy = require_ruleInput_policyInput.sanitizeAccessPolicy(group.accessPolicy);
+		for (const userScope of group.userScopes) {
+			const ruleBase = {
+				...sanitizedPolicy,
+				...userScope,
+				...group.groupId ? { groupId: group.groupId } : {}
+			};
+			if (policyScopes.length > 0) for (const policyScope of policyScopes) ruleEntries.push({
+				rule: {
+					...ruleBase,
+					...policyScope
+				},
+				expiresUnixTimestamp: group.expiresUnixTimestamp
+			});
+			else ruleEntries.push({
+				rule: ruleBase,
+				expiresUnixTimestamp: group.expiresUnixTimestamp
+			});
+		}
+		return this.accessRulesWriter.insertRules(ruleEntries);
+	}
+};
+//#endregion
 exports.InsertRulesEndpoint = InsertRulesEndpoint;

package/dist/cjs/api/write/rehashRules.cjs

@@ -1,58 +1,50 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const apiRoute = require("@prosopo/api-route");
-class RehashRulesEndpoint {
-  constructor(accessRulesStorage, logger) {
-    this.accessRulesStorage = accessRulesStorage;
-    this.logger = logger;
-  }
-  getRequestArgsSchema() {
-  }
-  async processRequest(logger) {
-    const log = logger ?? this.logger;
-    await this.accessRulesStorage.fetchAllRuleIds(async (ruleIds) => {
-      log.info(() => ({
-        msg: "Fetched rule ids batch",
-        data: {
-          count: ruleIds.length,
-          ruleIds
-        }
-      }));
-      const ruleEntries = await this.accessRulesStorage.fetchRules(ruleIds);
-      log.info(() => ({
-        msg: "Fetched rules",
-        data: {
-          count: ruleEntries.length
-        }
-      }));
-      if (ruleEntries.length !== ruleIds.length) {
-        log.warn(() => ({
-          msg: "Fetched rules count is not equal to the requested count",
-          data: {
-            fetchedCount: ruleEntries.length,
-            requestedCount: ruleIds.length
-          }
-        }));
-      }
-      await this.accessRulesStorage.deleteRules(ruleIds);
-      log.info(() => ({
-        msg: "Deleted rules",
-        data: {
-          count: ruleIds.length
-        }
-      }));
-      await this.accessRulesStorage.insertRules(ruleEntries);
-      log.info(() => ({
-        msg: "Inserted rules",
-        data: {
-          count: ruleEntries.length
-        }
-      }));
-    });
-    return {
-      status: apiRoute.ApiEndpointResponseStatus.SUCCESS,
-      data: {}
-    };
-  }
-}
+let _prosopo_api_route = require("@prosopo/api-route");
+//#region src/api/write/rehashRules.ts
+var RehashRulesEndpoint = class {
+	constructor(accessRulesStorage, logger) {
+		this.accessRulesStorage = accessRulesStorage;
+		this.logger = logger;
+	}
+	getRequestArgsSchema() {}
+	async processRequest(logger) {
+		const log = logger ?? this.logger;
+		await this.accessRulesStorage.fetchAllRuleIds(async (ruleIds) => {
+			log.info(() => ({
+				msg: "Fetched rule ids batch",
+				data: {
+					count: ruleIds.length,
+					ruleIds
+				}
+			}));
+			const ruleEntries = await this.accessRulesStorage.fetchRules(ruleIds);
+			log.info(() => ({
+				msg: "Fetched rules",
+				data: { count: ruleEntries.length }
+			}));
+			if (ruleEntries.length !== ruleIds.length) log.warn(() => ({
+				msg: "Fetched rules count is not equal to the requested count",
+				data: {
+					fetchedCount: ruleEntries.length,
+					requestedCount: ruleIds.length
+				}
+			}));
+			await this.accessRulesStorage.deleteRules(ruleIds);
+			log.info(() => ({
+				msg: "Deleted rules",
+				data: { count: ruleIds.length }
+			}));
+			await this.accessRulesStorage.insertRules(ruleEntries);
+			log.info(() => ({
+				msg: "Inserted rules",
+				data: { count: ruleEntries.length }
+			}));
+		});
+		return {
+			status: _prosopo_api_route.ApiEndpointResponseStatus.SUCCESS,
+			data: {}
+		};
+	}
+};
+//#endregion
 exports.RehashRulesEndpoint = RehashRulesEndpoint;

package/dist/cjs/classifyOs.cjs

@@ -1,31 +1,51 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const OS_NAMES = [
-  "windows",
-  "macos",
-  "ios",
-  "android",
-  "linux",
-  "unknown"
+//#region src/classifyOs.ts
+/**
+* The operating systems the classifier can resolve a request to. Kept
+* deliberately in step with the OS vocabulary in
+* `@prosopo/decision-machines`' `uaClassify` (so a routing-rule `osNameIn` and
+* an access-rule `os` agree on the same names), but defined here because the
+* provider / user-access-policy request path cannot depend on the
+* decision-machines package.
+*
+* `unknown` is the catch-all when no signature matches. It is a first-class
+* value so an allow-list ("only let Windows through") can block unrecognised
+* User-Agents instead of silently passing them.
+*/
+var OS_NAMES = [
+	"windows",
+	"macos",
+	"ios",
+	"android",
+	"linux",
+	"unknown"
 ];
-const classifyOs = (userAgent) => {
-  const ua = (userAgent || "").toLowerCase();
-  if (/iphone|ipad|ipod/.test(ua)) {
-    return "ios";
-  }
-  if (/android/.test(ua)) {
-    return "android";
-  }
-  if (/windows/.test(ua)) {
-    return "windows";
-  }
-  if (/macintosh|mac os/.test(ua)) {
-    return "macos";
-  }
-  if (/linux/.test(ua)) {
-    return "linux";
-  }
-  return "unknown";
+/**
+* Classify the operating system from a raw User-Agent string. Pure — no
+* navigator/window/DOM dependence — so it is safe to call on the provider's
+* server-side request path.
+*
+* Detection order matches `uaClassify.classifyUserAgent`: iOS (iphone/ipad/
+* ipod) is tested before the generic mac signature, and Android before Linux,
+* because those User-Agents contain the more general token too. Detection is
+* conservative — anything unrecognised returns `unknown` rather than guessing,
+* so an `os === "ios"` rule never fires on a UA we don't understand.
+*
+* The classification is driven off the full User-Agent rather than the
+* `sec-ch-ua-platform` client hint on purpose: a client can simply omit client
+* hints, but stripping the User-Agent breaks far more, so the UA is the more
+* reliable signal for an OS-restriction rule that is meant to be hard to
+* bypass.
+*/
+var classifyOs = (userAgent) => {
+	const ua = (userAgent || "").toLowerCase();
+	if (/iphone|ipad|ipod/.test(ua)) return "ios";
+	if (/android/.test(ua)) return "android";
+	if (/windows/.test(ua)) return "windows";
+	if (/macintosh|mac os/.test(ua)) return "macos";
+	if (/linux/.test(ua)) return "linux";
+	return "unknown";
 };
+//#endregion
 exports.OS_NAMES = OS_NAMES;
 exports.classifyOs = classifyOs;

package/dist/cjs/mongoose/.export.cjs

@@ -1,4 +1,3 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const mongooseRuleSchema = require("./mongooseRuleSchema.cjs");
-exports.accessRuleMongooseSchema = mongooseRuleSchema.accessRuleMongooseSchema;
+const require_mongoose_mongooseRuleSchema = require("./mongooseRuleSchema.cjs");
+exports.accessRuleMongooseSchema = require_mongoose_mongooseRuleSchema.accessRuleMongooseSchema;

package/dist/cjs/mongoose/mongooseRuleSchema.cjs

@@ -1,42 +1,103 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const userAttributesSchema = {
-  userId: { type: String, required: false },
-  ja4Hash: { type: String, required: false },
-  userAgent: { type: String, required: false },
-  headersHash: { type: String, required: false },
-  headHash: { type: String, required: false },
-  coords: { type: String, required: false },
-  countryCode: { type: String, required: false },
-  asn: { type: Number, required: false },
-  os: { type: String, required: false }
+//#region src/mongoose/mongooseRuleSchema.ts
+var userAttributesSchema = {
+	userId: {
+		type: String,
+		required: false
+	},
+	ja4Hash: {
+		type: String,
+		required: false
+	},
+	userAgent: {
+		type: String,
+		required: false
+	},
+	headersHash: {
+		type: String,
+		required: false
+	},
+	headHash: {
+		type: String,
+		required: false
+	},
+	coords: {
+		type: String,
+		required: false
+	},
+	countryCode: {
+		type: String,
+		required: false
+	},
+	asn: {
+		type: Number,
+		required: false
+	},
+	os: {
+		type: String,
+		required: false
+	}
 };
-const userIpSchema = {
-  ip: { type: String, required: false },
-  ipMask: { type: String, required: false }
+var userIpSchema = {
+	ip: {
+		type: String,
+		required: false
+	},
+	ipMask: {
+		type: String,
+		required: false
+	}
 };
-const userScopeSchema = {
-  ...userAttributesSchema,
-  ...userIpSchema
+var userScopeSchema = {
+	...userAttributesSchema,
+	...userIpSchema
 };
-const policyScopeSchema = {
-  clientId: { type: String, required: false }
-};
-const accessPolicySchema = {
-  type: { type: String, required: true },
-  captchaType: { type: String, required: false },
-  description: { type: String, required: false },
-  solvedImagesCount: { type: Number, required: false },
-  imageThreshold: { type: Number, required: false },
-  powDifficulty: { type: Number, required: false },
-  unsolvedImagesCount: { type: Number, required: false },
-  frictionlessScore: { type: Number, required: false },
-  deferToVerify: { type: Boolean, required: false }
-};
-const accessRuleMongooseSchema = {
-  ...accessPolicySchema,
-  ...policyScopeSchema,
-  ...userScopeSchema,
-  ruleGroupId: { type: String, required: false }
+var accessRuleMongooseSchema = {
+	type: {
+		type: String,
+		required: true
+	},
+	captchaType: {
+		type: String,
+		required: false
+	},
+	description: {
+		type: String,
+		required: false
+	},
+	solvedImagesCount: {
+		type: Number,
+		required: false
+	},
+	imageThreshold: {
+		type: Number,
+		required: false
+	},
+	powDifficulty: {
+		type: Number,
+		required: false
+	},
+	unsolvedImagesCount: {
+		type: Number,
+		required: false
+	},
+	frictionlessScore: {
+		type: Number,
+		required: false
+	},
+	deferToVerify: {
+		type: Boolean,
+		required: false
+	},
+	clientId: {
+		type: String,
+		required: false
+	},
+	...userScopeSchema,
+	ruleGroupId: {
+		type: String,
+		required: false
+	}
 };
+//#endregion
 exports.accessRuleMongooseSchema = accessRuleMongooseSchema;

package/dist/cjs/redis/.export.cjs

@@ -1,6 +1,5 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const redisRulesStorage = require("./redisRulesStorage.cjs");
-const redisRuleIndex = require("./redisRuleIndex.cjs");
-exports.createRedisAccessRulesStorage = redisRulesStorage.createRedisAccessRulesStorage;
-exports.accessRulesRedisIndex = redisRuleIndex.accessRulesRedisIndex;
+const require_redis_redisRuleIndex = require("./redisRuleIndex.cjs");
+const require_redis_redisRulesStorage = require("./redisRulesStorage.cjs");
+exports.accessRulesRedisIndex = require_redis_redisRuleIndex.accessRulesRedisIndex;
+exports.createRedisAccessRulesStorage = require_redis_redisRulesStorage.createRedisAccessRulesStorage;