@prosopo/user-access-policy 3.12.8 → 3.12.9

package/dist/cjs/transformRule.cjs

@@ -1,77 +1,43 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const crypto = require("node:crypto");
-const cidrCalc = require("cidr-calc");
-const ipAddress = require("ip-address");
-const zod = require("zod");
-const policyInput = require("./ruleInput/policyInput.cjs");
-const ruleInput = require("./ruleInput/ruleInput.cjs");
-const userScopeInput = require("./ruleInput/userScopeInput.cjs");
-const RULE_HASH_ALGORITHM = "md5";
-const MAX_IPV4_NUMERIC = (1n << 32n) - 1n;
-const makeAccessRuleHash = (rule) => {
-  const valueProperties = Object.entries(rule).filter(
-    ([key, value]) => "undefined" !== typeof value
-  );
-  const orderedProperties = valueProperties.sort();
-  const objectToHash = Object.fromEntries(orderedProperties);
-  return hashObject(objectToHash, RULE_HASH_ALGORITHM);
+const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
+const require_ruleInput_policyInput = require("./ruleInput/policyInput.cjs");
+const require_ruleInput_userScopeInput = require("./ruleInput/userScopeInput.cjs");
+const require_ruleInput_ruleInput = require("./ruleInput/ruleInput.cjs");
+let zod = require("zod");
+let node_crypto = require("node:crypto");
+node_crypto = require_runtime.__toESM(node_crypto, 1);
+let ip_address = require("ip-address");
+let cidr_calc = require("cidr-calc");
+//#region src/transformRule.ts
+var RULE_HASH_ALGORITHM = "md5";
+var MAX_IPV4_NUMERIC = (1n << 32n) - 1n;
+var makeAccessRuleHash = (rule) => {
+	const orderedProperties = Object.entries(rule).filter(([key, value]) => "undefined" !== typeof value).sort();
+	return hashObject(Object.fromEntries(orderedProperties), RULE_HASH_ALGORITHM);
 };
-const transformAccessRuleRecordIntoRule = (ruleRecord) => (
-  // accessRuleInput does all the record field transformations
-  ruleInput.accessRuleInput.parse(ruleRecord)
-);
-const transformAccessRuleIntoRecord = (rule) => accessRuleToRecordScheme.parse(rule);
-const accessRuleToRecordScheme = zod.z.object({
-  ...policyInput.accessPolicyInputShape.shape,
-  ...policyInput.policyScopeInput.shape,
-  ...userScopeInput.userScopeSchema.shape,
-  groupId: zod.z.coerce.string().optional()
-}).transform((ruleInput2) => {
-  const {
-    groupId,
-    numericIp,
-    numericIpMaskMin,
-    numericIpMaskMax,
-    userAgentHash,
-    ...rule
-  } = ruleInput2;
-  const record = rule;
-  if ("string" === typeof groupId) {
-    record.ruleGroupId = groupId;
-  }
-  if ("string" === typeof userAgentHash) {
-    record.userAgent = userAgentHash;
-  }
-  if ("bigint" === typeof numericIp) {
-    record.ip = getStringIpFromNumeric(numericIp);
-  }
-  if ("bigint" === typeof numericIpMaskMin && "bigint" === typeof numericIpMaskMax) {
-    record.ipMask = getCidrFromNumericIpRange(
-      numericIpMaskMin,
-      numericIpMaskMax
-    );
-  }
-  return record;
+var transformAccessRuleRecordIntoRule = (ruleRecord) => require_ruleInput_ruleInput.accessRuleInput.parse(ruleRecord);
+var transformAccessRuleIntoRecord = (rule) => accessRuleToRecordScheme.parse(rule);
+var accessRuleToRecordScheme = zod.z.object({
+	...require_ruleInput_policyInput.accessPolicyInputShape.shape,
+	...require_ruleInput_policyInput.policyScopeInput.shape,
+	...require_ruleInput_userScopeInput.userScopeSchema.shape,
+	groupId: zod.z.coerce.string().optional()
+}).transform((ruleInput) => {
+	const { groupId, numericIp, numericIpMaskMin, numericIpMaskMax, userAgentHash, ...rule } = ruleInput;
+	const record = rule;
+	if ("string" === typeof groupId) record.ruleGroupId = groupId;
+	if ("string" === typeof userAgentHash) record.userAgent = userAgentHash;
+	if ("bigint" === typeof numericIp) record.ip = getStringIpFromNumeric(numericIp);
+	if ("bigint" === typeof numericIpMaskMin && "bigint" === typeof numericIpMaskMax) record.ipMask = getCidrFromNumericIpRange(numericIpMaskMin, numericIpMaskMax);
+	return record;
 });
-const hashObject = (object, algorithm) => crypto.createHash(algorithm).update(
-  JSON.stringify(
-    object,
-    (key, value) => (
-      // JSON.stringify can't handle BigInt itself: throws "Do not know how to serialize a BigInt"
-      "bigint" === typeof value ? value.toString() : value
-    )
-  )
-).digest("hex");
-const getStringIpFromNumeric = (numericIp) => numericIp > MAX_IPV4_NUMERIC ? ipAddress.Address6.fromBigInt(numericIp).correctForm() : ipAddress.Address4.fromInteger(Number(numericIp)).address;
-const getCidrFromNumericIpRange = (startIp, endIp) => {
-  const ipRange = new cidrCalc.IpRange(
-    cidrCalc.IpAddress.of(getStringIpFromNumeric(startIp)),
-    cidrCalc.IpAddress.of(getStringIpFromNumeric(endIp))
-  );
-  const cidr = ipRange.toCidrs()[0];
-  return cidr ? `${cidr.prefix.toString()}/${cidr.prefixLen}` : void 0;
+var hashObject = (object, algorithm) => node_crypto.default.createHash(algorithm).update(JSON.stringify(object, (key, value) => "bigint" === typeof value ? value.toString() : value)).digest("hex");
+var getStringIpFromNumeric = (numericIp) => numericIp > MAX_IPV4_NUMERIC ? ip_address.Address6.fromBigInt(numericIp).correctForm() : ip_address.Address4.fromInteger(Number(numericIp)).address;
+var getCidrFromNumericIpRange = (startIp, endIp) => {
+	const cidr = new cidr_calc.IpRange(cidr_calc.IpAddress.of(getStringIpFromNumeric(startIp)), cidr_calc.IpAddress.of(getStringIpFromNumeric(endIp))).toCidrs()[0];
+	return cidr ? `${cidr.prefix.toString()}/${cidr.prefixLen}` : void 0;
 };
+//#endregion
 exports.getCidrFromNumericIpRange = getCidrFromNumericIpRange;
 exports.makeAccessRuleHash = makeAccessRuleHash;
 exports.transformAccessRuleIntoRecord = transformAccessRuleIntoRecord;

package/dist/classifyOs.js

@@ -1,31 +1,50 @@
-const OS_NAMES = [
-  "windows",
-  "macos",
-  "ios",
-  "android",
-  "linux",
-  "unknown"
+import "./_virtual/_rolldown/runtime.js";
+//#region src/classifyOs.ts
+/**
+* The operating systems the classifier can resolve a request to. Kept
+* deliberately in step with the OS vocabulary in
+* `@prosopo/decision-machines`' `uaClassify` (so a routing-rule `osNameIn` and
+* an access-rule `os` agree on the same names), but defined here because the
+* provider / user-access-policy request path cannot depend on the
+* decision-machines package.
+*
+* `unknown` is the catch-all when no signature matches. It is a first-class
+* value so an allow-list ("only let Windows through") can block unrecognised
+* User-Agents instead of silently passing them.
+*/
+var OS_NAMES = [
+	"windows",
+	"macos",
+	"ios",
+	"android",
+	"linux",
+	"unknown"
 ];
-const classifyOs = (userAgent) => {
-  const ua = (userAgent || "").toLowerCase();
-  if (/iphone|ipad|ipod/.test(ua)) {
-    return "ios";
-  }
-  if (/android/.test(ua)) {
-    return "android";
-  }
-  if (/windows/.test(ua)) {
-    return "windows";
-  }
-  if (/macintosh|mac os/.test(ua)) {
-    return "macos";
-  }
-  if (/linux/.test(ua)) {
-    return "linux";
-  }
-  return "unknown";
-};
-export {
-  OS_NAMES,
-  classifyOs
+/**
+* Classify the operating system from a raw User-Agent string. Pure — no
+* navigator/window/DOM dependence — so it is safe to call on the provider's
+* server-side request path.
+*
+* Detection order matches `uaClassify.classifyUserAgent`: iOS (iphone/ipad/
+* ipod) is tested before the generic mac signature, and Android before Linux,
+* because those User-Agents contain the more general token too. Detection is
+* conservative — anything unrecognised returns `unknown` rather than guessing,
+* so an `os === "ios"` rule never fires on a UA we don't understand.
+*
+* The classification is driven off the full User-Agent rather than the
+* `sec-ch-ua-platform` client hint on purpose: a client can simply omit client
+* hints, but stripping the User-Agent breaks far more, so the UA is the more
+* reliable signal for an OS-restriction rule that is meant to be hard to
+* bypass.
+*/
+var classifyOs = (userAgent) => {
+	const ua = (userAgent || "").toLowerCase();
+	if (/iphone|ipad|ipod/.test(ua)) return "ios";
+	if (/android/.test(ua)) return "android";
+	if (/windows/.test(ua)) return "windows";
+	if (/macintosh|mac os/.test(ua)) return "macos";
+	if (/linux/.test(ua)) return "linux";
+	return "unknown";
 };
+//#endregion
+export { OS_NAMES, classifyOs };

package/dist/mongoose/.export.js

@@ -1,4 +1,3 @@
+import "../_virtual/_rolldown/runtime.js";
 import { accessRuleMongooseSchema } from "./mongooseRuleSchema.js";
-export {
-  accessRuleMongooseSchema
-};
+export { accessRuleMongooseSchema };

package/dist/mongoose/mongooseRuleSchema.js

@@ -1,42 +1,103 @@
-const userAttributesSchema = {
-  userId: { type: String, required: false },
-  ja4Hash: { type: String, required: false },
-  userAgent: { type: String, required: false },
-  headersHash: { type: String, required: false },
-  headHash: { type: String, required: false },
-  coords: { type: String, required: false },
-  countryCode: { type: String, required: false },
-  asn: { type: Number, required: false },
-  os: { type: String, required: false }
+import "../_virtual/_rolldown/runtime.js";
+//#region src/mongoose/mongooseRuleSchema.ts
+var userAttributesSchema = {
+	userId: {
+		type: String,
+		required: false
+	},
+	ja4Hash: {
+		type: String,
+		required: false
+	},
+	userAgent: {
+		type: String,
+		required: false
+	},
+	headersHash: {
+		type: String,
+		required: false
+	},
+	headHash: {
+		type: String,
+		required: false
+	},
+	coords: {
+		type: String,
+		required: false
+	},
+	countryCode: {
+		type: String,
+		required: false
+	},
+	asn: {
+		type: Number,
+		required: false
+	},
+	os: {
+		type: String,
+		required: false
+	}
 };
-const userIpSchema = {
-  ip: { type: String, required: false },
-  ipMask: { type: String, required: false }
+var userIpSchema = {
+	ip: {
+		type: String,
+		required: false
+	},
+	ipMask: {
+		type: String,
+		required: false
+	}
 };
-const userScopeSchema = {
-  ...userAttributesSchema,
-  ...userIpSchema
+var userScopeSchema = {
+	...userAttributesSchema,
+	...userIpSchema
 };
-const policyScopeSchema = {
-  clientId: { type: String, required: false }
-};
-const accessPolicySchema = {
-  type: { type: String, required: true },
-  captchaType: { type: String, required: false },
-  description: { type: String, required: false },
-  solvedImagesCount: { type: Number, required: false },
-  imageThreshold: { type: Number, required: false },
-  powDifficulty: { type: Number, required: false },
-  unsolvedImagesCount: { type: Number, required: false },
-  frictionlessScore: { type: Number, required: false },
-  deferToVerify: { type: Boolean, required: false }
-};
-const accessRuleMongooseSchema = {
-  ...accessPolicySchema,
-  ...policyScopeSchema,
-  ...userScopeSchema,
-  ruleGroupId: { type: String, required: false }
-};
-export {
-  accessRuleMongooseSchema
+var accessRuleMongooseSchema = {
+	type: {
+		type: String,
+		required: true
+	},
+	captchaType: {
+		type: String,
+		required: false
+	},
+	description: {
+		type: String,
+		required: false
+	},
+	solvedImagesCount: {
+		type: Number,
+		required: false
+	},
+	imageThreshold: {
+		type: Number,
+		required: false
+	},
+	powDifficulty: {
+		type: Number,
+		required: false
+	},
+	unsolvedImagesCount: {
+		type: Number,
+		required: false
+	},
+	frictionlessScore: {
+		type: Number,
+		required: false
+	},
+	deferToVerify: {
+		type: Boolean,
+		required: false
+	},
+	clientId: {
+		type: String,
+		required: false
+	},
+	...userScopeSchema,
+	ruleGroupId: {
+		type: String,
+		required: false
+	}
 };
+//#endregion
+export { accessRuleMongooseSchema };

package/dist/redis/.export.js

@@ -1,6 +1,4 @@
-import { createRedisAccessRulesStorage } from "./redisRulesStorage.js";
+import "../_virtual/_rolldown/runtime.js";
 import { accessRulesRedisIndex } from "./redisRuleIndex.js";
-export {
-  accessRulesRedisIndex,
-  createRedisAccessRulesStorage
-};
+import { createRedisAccessRulesStorage } from "./redisRulesStorage.js";
+export { accessRulesRedisIndex, createRedisAccessRulesStorage };

package/dist/redis/reader/redisAggregate.js

@@ -1,90 +1,64 @@
-import { z } from "zod";
-import { REDIS_QUERY_DIALECT } from "./redisRulesQuery.js";
-import { parseRedisRecords, REDIS_BATCH_SIZE } from "../redisClient.js";
+import "../../_virtual/_rolldown/runtime.js";
+import "./redisRulesQuery.js";
+import { REDIS_BATCH_SIZE, parseRedisRecords } from "../redisClient.js";
 import { ACCESS_RULES_REDIS_INDEX_NAME } from "../redisRuleIndex.js";
-const searchRedisKeysBounded = async (client, query, maxKeys) => {
-  const reply = await client.ft.searchNoContent(
-    ACCESS_RULES_REDIS_INDEX_NAME,
-    query,
-    {
-      DIALECT: REDIS_QUERY_DIALECT,
-      LIMIT: { from: 0, size: maxKeys }
-    }
-  );
-  return reply.documents;
-};
-const aggregateRedisKeys = async (client, query, logger, batchHandler, maxKeys) => {
-  const keyField = "__key";
-  const recordSchema = z.object({
-    // it's a reserved name for the record key
-    [keyField]: z.string()
-  });
-  const foundKeys = [];
-  let stopRequested = false;
-  const addRecordKeys = async (records) => {
-    if (stopRequested) {
-      return;
-    }
-    const parsedRecords = parseRedisRecords(records, recordSchema, logger);
-    const recordKeys = parsedRecords.map((record) => record[keyField]);
-    if (batchHandler) {
-      await batchHandler(recordKeys);
-    } else {
-      if (maxKeys !== void 0 && foundKeys.length + recordKeys.length > maxKeys) {
-        const remaining = Math.max(0, maxKeys - foundKeys.length);
-        foundKeys.push(...recordKeys.slice(0, remaining));
-        stopRequested = true;
-        logger.warn(() => ({
-          msg: "Redis aggregation candidate cap hit; truncating result set. This can suppress less-frequent rules and should be investigated.",
-          data: {
-            maxKeys,
-            query
-          }
-        }));
-        return;
-      }
-      foundKeys.push(...recordKeys);
-      logger.debug(() => ({
-        msg: "Processed aggregation batch",
-        data: {
-          size: recordKeys.length
-        }
-      }));
-    }
-  };
-  await executeAggregation(
-    client,
-    query,
-    {
-      // #2 is a required option when the 'ismissing()' function is in the query body
-      DIALECT: REDIS_QUERY_DIALECT,
-      COUNT: REDIS_BATCH_SIZE,
-      LOAD: `@${keyField}`
-    },
-    addRecordKeys,
-    () => stopRequested
-  );
-  return foundKeys;
+import { z } from "zod";
+//#region src/redis/reader/redisAggregate.ts
+var searchRedisKeysBounded = async (client, query, maxKeys) => {
+	return (await client.ft.searchNoContent(ACCESS_RULES_REDIS_INDEX_NAME, query, {
+		DIALECT: 2,
+		LIMIT: {
+			from: 0,
+			size: maxKeys
+		}
+	})).documents;
 };
-const executeAggregation = async (client, query, aggregateOptions, handleBatch, shouldStop) => {
-  const initialReply = await client.ft.aggregateWithCursor(
-    ACCESS_RULES_REDIS_INDEX_NAME,
-    query,
-    aggregateOptions
-  );
-  await handleBatch(initialReply.results);
-  let cursor = initialReply.cursor;
-  while (0 !== cursor && !shouldStop?.()) {
-    const batchReply = await client.ft.cursorRead(
-      ACCESS_RULES_REDIS_INDEX_NAME,
-      cursor,
-      { COUNT: aggregateOptions.COUNT }
-    );
-    await handleBatch(batchReply.results);
-    cursor = batchReply.cursor;
-  }
+var aggregateRedisKeys = async (client, query, logger, batchHandler, maxKeys) => {
+	const keyField = "__key";
+	const recordSchema = z.object({ [keyField]: z.string() });
+	const foundKeys = [];
+	let stopRequested = false;
+	const addRecordKeys = async (records) => {
+		if (stopRequested) return;
+		const recordKeys = parseRedisRecords(records, recordSchema, logger).map((record) => record[keyField]);
+		if (batchHandler) await batchHandler(recordKeys);
+		else {
+			if (maxKeys !== void 0 && foundKeys.length + recordKeys.length > maxKeys) {
+				const remaining = Math.max(0, maxKeys - foundKeys.length);
+				foundKeys.push(...recordKeys.slice(0, remaining));
+				stopRequested = true;
+				logger.warn(() => ({
+					msg: "Redis aggregation candidate cap hit; truncating result set. This can suppress less-frequent rules and should be investigated.",
+					data: {
+						maxKeys,
+						query
+					}
+				}));
+				return;
+			}
+			foundKeys.push(...recordKeys);
+			logger.debug(() => ({
+				msg: "Processed aggregation batch",
+				data: { size: recordKeys.length }
+			}));
+		}
+	};
+	await executeAggregation(client, query, {
+		DIALECT: 2,
+		COUNT: REDIS_BATCH_SIZE,
+		LOAD: `@${keyField}`
+	}, addRecordKeys, () => stopRequested);
+	return foundKeys;
 };
-export {
-  aggregateRedisKeys,
-  searchRedisKeysBounded
+var executeAggregation = async (client, query, aggregateOptions, handleBatch, shouldStop) => {
+	const initialReply = await client.ft.aggregateWithCursor(ACCESS_RULES_REDIS_INDEX_NAME, query, aggregateOptions);
+	await handleBatch(initialReply.results);
+	let cursor = initialReply.cursor;
+	while (0 !== cursor && !shouldStop?.()) {
+		const batchReply = await client.ft.cursorRead(ACCESS_RULES_REDIS_INDEX_NAME, cursor, { COUNT: aggregateOptions.COUNT });
+		await handleBatch(batchReply.results);
+		cursor = batchReply.cursor;
+	}
 };
+//#endregion
+export { aggregateRedisKeys, searchRedisKeysBounded };