@prosopo/user-access-policy 3.14.13 → 3.14.15

package/src/tests/redis/reader/redisAggregate.unit.test.ts

@@ -1,121 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { RedisClientType } from "redis";
-import { describe, expect, it, vi } from "vitest";
-import { searchRedisKeysBounded } from "#policy/redis/reader/redisAggregate.js";
-
-// Match the search-side reply shape produced by
-// `@redis/search`'s `SEARCH_NOCONTENT.transformReply` — a flat
-// `[total, key1, key2, ...]` collapsed into `{ total, documents }`.
-// This shape is the whole point of switching the split-query path to
-// NOCONTENT: unlike the aggregate + LOAD @__key path it can't hit the
-// null-tuple crash in `transformTuplesReply` that fires against
-// field:ja4Hash probes in prod.
-type SearchNoContentReply = { total: number; documents: string[] };
-
-type FakeSearchClient = {
-	ft: {
-		searchNoContent: (
-			index: string,
-			query: string,
-			options: { DIALECT?: number; LIMIT?: { from: number; size: number } },
-		) => Promise<SearchNoContentReply>;
-	};
-};
-
-const makeClient = (reply: SearchNoContentReply): FakeSearchClient => ({
-	ft: {
-		searchNoContent: vi.fn().mockResolvedValue(reply),
-	},
-});
-
-describe("searchRedisKeysBounded", () => {
-	it("returns the flat documents list from FT.SEARCH NOCONTENT", async () => {
-		const client = makeClient({
-			total: 3,
-			documents: ["access_rule:a", "access_rule:b", "access_rule:c"],
-		});
-
-		// The caller uses a bounded max — 500 in production.
-		const keys = await searchRedisKeysBounded(
-			client as unknown as RedisClientType,
-			"@type:{block} @ja4Hash:{t13d_probe}",
-			500,
-		);
-
-		expect(keys).toEqual(["access_rule:a", "access_rule:b", "access_rule:c"]);
-	});
-
-	it("passes the caller's cap through as the FT.SEARCH LIMIT size", async () => {
-		const searchNoContent = vi
-			.fn()
-			.mockResolvedValue({ total: 0, documents: [] });
-		const client = {
-			ft: { searchNoContent },
-		} as unknown as RedisClientType;
-
-		await searchRedisKeysBounded(client, "@ja4Hash:{x}", 500);
-
-		expect(searchNoContent).toHaveBeenCalledTimes(1);
-		const call = searchNoContent.mock.calls[0];
-		expect(call).toBeDefined();
-		const options = call?.[2] as {
-			DIALECT?: number;
-			LIMIT?: { from: number; size: number };
-		};
-		expect(options.LIMIT).toEqual({ from: 0, size: 500 });
-		// DIALECT 2 is required by the ismissing() clauses the split
-		// query builder emits.
-		expect(options.DIALECT).toBe(2);
-	});
-
-	it("returns an empty list when the search matches nothing", async () => {
-		const client = makeClient({ total: 0, documents: [] });
-
-		const keys = await searchRedisKeysBounded(
-			client as unknown as RedisClientType,
-			"@ja4Hash:{never_indexed}",
-			500,
-		);
-
-		expect(keys).toEqual([]);
-	});
-
-	// Regression: the aggregate + LOAD path this helper replaces throws
-	//   TypeError: Cannot read properties of null (reading 'length')
-	// when the RediSearch coordinator returns a `null` result row (seen
-	// continuously on field:ja4Hash probes in prod, thousands per hour).
-	// The NOCONTENT reply carries no nested tuples, so a well-formed
-	// reply — even with an unexpected trailing null in the raw wire array
-	// — cannot reach the tuples decoder at all. Assert we return the
-	// documents list as-is without introspecting individual entries.
-	it("does not iterate individual document tuples (null-safe reply shape)", async () => {
-		// Simulate a bare-string documents array — the shape produced by
-		// SEARCH_NOCONTENT. Every entry is a string key; there are no
-		// per-doc tuples for a `.length` lookup to trip over.
-		const client = makeClient({
-			total: 2,
-			documents: ["access_rule:one", "access_rule:two"],
-		});
-
-		await expect(
-			searchRedisKeysBounded(
-				client as unknown as RedisClientType,
-				"@ja4Hash:{t13d2013h2_a09f3c656075_7f0f34a4126d}",
-				500,
-			),
-		).resolves.toEqual(["access_rule:one", "access_rule:two"]);
-	});
-});

package/src/tests/redis/reader/redisRulesQuery.unit.test.ts

@@ -1,349 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { describe, expect, it } from "vitest";
-import { getRulesRedisQuery } from "#policy/redis/reader/redisRulesQuery.js";
-import {
-	type AccessRulesFilter,
-	FilterScopeMatch,
-} from "#policy/rulesStorage.js";
-
-describe("getRulesRedisQuery", () => {
-	it("puts ismissing(x) for field x passed in as `undefined` when user scope match is exact", () => {
-		const filter = {
-			userScope: {
-				numericIp: BigInt(100),
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toBe(
-			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) )",
-		);
-	});
-
-	it("puts ismissing(x) for field x passed in as `undefined` when user scope match is exact and for missing fields when matchingFieldsOnly is set", () => {
-		const filter = {
-			userScope: {
-				numericIp: BigInt(100),
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		expect(query).toBe(
-			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@userId) ismissing(@headersHash) ismissing(@headHash) ismissing(@coords) ismissing(@countryCode) ismissing(@asn) ismissing(@os) ismissing(@browser) ismissing(@headerMatch) ismissing(@headerName) ismissing(@headerValue) ismissing(@headerOperator) ismissing(@webBotAuthAgent) )",
-		);
-	});
-
-	it("puts ismissing(x) for multiple fields passed in as `undefined` when user scope match is exact", () => {
-		const filter = {
-			userScope: {
-				numericIp: BigInt(100),
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-				headersHash: undefined,
-				userId: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toBe(
-			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )",
-		);
-	});
-
-	it("does not put ismissing(x) for multiple fields passed in as `undefined` when user scope match is greedy", () => {
-		const filter = {
-			userScope: {
-				numericIp: BigInt(100),
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-				headersHash: undefined,
-				userId: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Greedy,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toBe(
-			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) | @ja4Hash:{ja4Hash} )",
-		);
-	});
-
-	it("puts ismissing(x) for multiple fields passed in as `undefined` when user scope match is exact 2", () => {
-		const filter = {
-			userScope: {
-				numericIp: undefined,
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-				headersHash: undefined,
-				userId: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toBe(
-			"( ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )",
-		);
-	});
-
-	it("does not put ismissing(numericIpMaskMin) and does not put ismissing(numericIpMaskMax) when numericIp is passed in", () => {
-		const filter = {
-			userScope: {
-				numericIp: BigInt(100),
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-				headersHash: undefined,
-				userId: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		expect(query).toBe(
-			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) ismissing(@headHash) ismissing(@coords) ismissing(@countryCode) ismissing(@asn) ismissing(@os) ismissing(@browser) ismissing(@headerMatch) ismissing(@headerName) ismissing(@headerValue) ismissing(@headerOperator) ismissing(@webBotAuthAgent) )",
-		);
-	});
-
-	it("does not put ismissing(numericIp) when numericIpMaskMin and numericIpMaskMax are passed in", () => {
-		const filter = {
-			userScope: {
-				numericIpMaskMin: BigInt(100),
-				numericIpMaskMax: BigInt(200),
-				ja4Hash: "ja4Hash",
-				userAgentHash: undefined,
-				headersHash: undefined,
-				userId: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		expect(query).toBe(
-			"( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[200 +inf] @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) ismissing(@headHash) ismissing(@coords) ismissing(@countryCode) ismissing(@asn) ismissing(@os) ismissing(@browser) ismissing(@headerMatch) ismissing(@headerName) ismissing(@headerValue) ismissing(@headerOperator) ismissing(@webBotAuthAgent) )",
-		);
-	});
-
-	it("emits NUMERIC range syntax for asn, not TAG syntax", () => {
-		const filter = {
-			userScope: {
-				asn: 205016,
-			},
-			userScopeMatch: FilterScopeMatch.Greedy,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		// asn is indexed as NUMERIC; TAG syntax (@asn:{205016}) would silently
-		// fail to match. Must use range syntax.
-		expect(query).toContain("@asn:[205016 205016]");
-		expect(query).not.toContain("@asn:{");
-	});
-
-	it("does not duplicate ismissing for numericIpMaskMin and numericIpMaskMax when matchingFieldsOnly is true and all IP fields are undefined", () => {
-		const filter = {
-			userScope: {
-				userId: "user123",
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		// numericIp handler emits all three ismissing clauses when all IP fields are undefined.
-		// The individual numericIpMaskMin and numericIpMaskMax handlers should not duplicate them.
-		const numericIpMaskMinMatches = query.match(
-			/ismissing\(@numericIpMaskMin\)/g,
-		);
-		const numericIpMaskMaxMatches = query.match(
-			/ismissing\(@numericIpMaskMax\)/g,
-		);
-
-		expect(numericIpMaskMinMatches).toHaveLength(1);
-		expect(numericIpMaskMaxMatches).toHaveLength(1);
-		expect(query).toContain("ismissing(@numericIp)");
-		expect(query).toContain("@userId:{user123}");
-	});
-
-	it("emits ismissing for numericIpMaskMin when numericIpMaskMax is defined but numericIpMaskMin is not", () => {
-		const filter = {
-			userScope: {
-				numericIpMaskMax: BigInt(200),
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		// numericIp handler returns "" because numericIpMaskMax is defined.
-		// numericIpMaskMin handler should still emit ismissing since the numericIp handler didn't cover it.
-		expect(query).toContain("ismissing(@numericIpMaskMin)");
-		expect(query).toContain("@numericIpMaskMax:[200 +inf]");
-		expect(query).not.toContain("ismissing(@numericIpMaskMax)");
-	});
-
-	it("emits ismissing for numericIpMaskMax when numericIpMaskMin is defined but numericIpMaskMax is not", () => {
-		const filter = {
-			userScope: {
-				numericIpMaskMin: BigInt(100),
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		expect(query).toContain("@numericIpMaskMin:[-inf 100]");
-		expect(query).toContain("ismissing(@numericIpMaskMax)");
-		expect(query).not.toContain("ismissing(@numericIpMaskMin)");
-	});
-
-	it("includes headHash in query when provided", () => {
-		const filter = {
-			userScope: {
-				headHash: "abc123def456",
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toBe("( @headHash:{abc123def456} )");
-	});
-
-	it("includes coords in query when provided with escaped special characters", () => {
-		const filter = {
-			userScope: {
-				coords: "[[[100,200]]]",
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		// Special characters like [, ], and , should be escaped
-		expect(query).toContain("@coords:{\\[\\[\\[100\\,200\\]\\]\\]}");
-	});
-
-	it("includes both headHash and coords when both provided", () => {
-		const filter = {
-			userScope: {
-				headHash: "abc123def456",
-				coords: "[[[100,200]]]",
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toContain("@headHash:{abc123def456}");
-		expect(query).toContain("@coords:{\\[\\[\\[100\\,200\\]\\]\\]}");
-	});
-
-	it("puts ismissing(headHash) and ismissing(coords) when not provided and matchingFieldsOnly is true", () => {
-		const filter = {
-			userScope: {
-				ja4Hash: "ja4Hash",
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, true);
-
-		expect(query).toContain("ismissing(@headHash)");
-		expect(query).toContain("ismissing(@coords)");
-	});
-
-	it("combines headHash with other fields correctly in exact match", () => {
-		const filter = {
-			userScope: {
-				numericIp: BigInt(100),
-				ja4Hash: "ja4Hash",
-				headHash: "abc123def456",
-				userAgentHash: undefined,
-			},
-			userScopeMatch: FilterScopeMatch.Exact,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toContain("@numericIp:[100 100]");
-		expect(query).toContain("@ja4Hash:{ja4Hash}");
-		expect(query).toContain("@headHash:{abc123def456}");
-		expect(query).toContain("ismissing(@userAgentHash)");
-	});
-
-	it("prepends @type:{block} when blockOnly is set on the filter", () => {
-		const filter = {
-			userScope: {
-				ja4Hash: "ja4Hash",
-			},
-			userScopeMatch: FilterScopeMatch.Greedy,
-			blockOnly: true,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toContain("@type:{block}");
-		// blockOnly precedes the userScope clause so callers get the
-		// pre-filter benefit on a single Redis pass.
-		const typeIdx = query.indexOf("@type:{block}");
-		const userScopeIdx = query.indexOf("@ja4Hash");
-		expect(typeIdx).toBeGreaterThanOrEqual(0);
-		expect(typeIdx).toBeLessThan(userScopeIdx);
-	});
-
-	it("omits @type:{block} when blockOnly is not set", () => {
-		const filter = {
-			userScope: {
-				ja4Hash: "ja4Hash",
-			},
-			userScopeMatch: FilterScopeMatch.Greedy,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).not.toContain("@type:");
-	});
-
-	it("composes blockOnly with clientId policy scope", () => {
-		const filter = {
-			policyScope: { clientId: "site-A" },
-			policyScopeMatch: FilterScopeMatch.Greedy,
-			userScope: { ja4Hash: "ja4Hash" },
-			userScopeMatch: FilterScopeMatch.Greedy,
-			blockOnly: true,
-		} as AccessRulesFilter;
-
-		const query = getRulesRedisQuery(filter, false);
-
-		expect(query).toContain("@type:{block}");
-		expect(query).toContain("@clientId:{site-A}");
-		expect(query).toContain("@ja4Hash:{ja4Hash}");
-	});
-});