@prosopo/user-access-policy 3.14.14 → 3.14.15

package/src/api/delete/deleteAllRules.ts

@@ -1,47 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { Logger } from "@prosopo/logger";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-export class DeleteAllRulesEndpoint implements ApiEndpoint<undefined> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): undefined {}
-
-	async processRequest(logger?: Logger): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		const deletedCount = await this.accessRulesStorage.deleteAllRules();
-
-		log.info(() => ({
-			msg: "Endpoint deleted all access rules",
-			data: { deletedCount },
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				deleted_count: deletedCount,
-			},
-		};
-	}
-}

package/src/api/delete/deleteRuleGroups.ts

@@ -1,96 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import {
-	type AccessRulesStorage,
-	FilterScopeMatch,
-} from "#policy/rulesStorage.js";
-
-export type DeleteSiteGroup = {
-	clientIds: string[];
-	groupId: string;
-};
-
-export type DeleteSiteGroups = DeleteSiteGroup[];
-
-type DeleteRuleGroupsSchema = ZodType<DeleteSiteGroups>;
-
-export class DeleteRuleGroupsEndpoint
-	implements ApiEndpoint<DeleteRuleGroupsSchema>
-{
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): DeleteRuleGroupsSchema {
-		return z.array(
-			z.object({
-				clientIds: z.string().array(),
-				groupId: z.string(),
-			} satisfies AllKeys<DeleteSiteGroup>),
-		);
-	}
-
-	async processRequest(
-		args: DeleteSiteGroups,
-		logger?: Logger,
-	): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		const foundRuleIdPromises = args.flatMap((ruleToDelete) =>
-			ruleToDelete.clientIds.map((clientId) =>
-				this.accessRulesStorage.findRuleIds({
-					policyScope: {
-						clientId: clientId,
-					},
-					policyScopeMatch: FilterScopeMatch.Exact,
-					groupId: ruleToDelete.groupId,
-				}),
-			),
-		);
-
-		const foundRuleIds = await Promise.all(foundRuleIdPromises);
-		const ruleIds = foundRuleIds.flat();
-
-		// Set() automatically removes duplicates
-		const uniqueRuleIds = [...new Set(ruleIds)];
-
-		if (uniqueRuleIds.length > 0) {
-			await this.accessRulesStorage.deleteRules(uniqueRuleIds);
-		}
-
-		log.info(() => ({
-			msg: "Endpoint deleted rule groups",
-			data: {
-				args,
-				uniqueRuleIds,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				deleted_count: uniqueRuleIds.length,
-			},
-		};
-	}
-}

package/src/api/delete/deleteRules.ts

@@ -1,87 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import { executeBatchesSequentially } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import {
-	type AccessRulesFilterInput,
-	accessRulesFilterInput,
-	getAccessRuleFiltersFromInput,
-} from "#policy/ruleInput/ruleInput.js";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-// `unknown` input position — see accessRulesFilterInput's block comment
-// for why the strict-identity form doesn't fit here.
-type DeleteRulesSchema = ZodType<
-	AccessRulesFilterInput[],
-	z.ZodTypeDef,
-	unknown
->;
-
-export class DeleteRulesEndpoint implements ApiEndpoint<DeleteRulesSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): DeleteRulesSchema {
-		return z.array(accessRulesFilterInput);
-	}
-
-	async processRequest(
-		args: AccessRulesFilterInput[],
-		logger?: Logger,
-	): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		let deletedCount = 0;
-
-		for (const rulesFilterInput of args) {
-			const ruleFilters = getAccessRuleFiltersFromInput(rulesFilterInput);
-
-			await executeBatchesSequentially(ruleFilters, async (ruleFilter) => {
-				const ruleIds = await this.accessRulesStorage.findRuleIds(ruleFilter);
-
-				// Set() automatically removes duplicates
-				const uniqueRuleIds = [...new Set(ruleIds)];
-
-				if (uniqueRuleIds.length > 0) {
-					await this.accessRulesStorage.deleteRules(uniqueRuleIds);
-
-					deletedCount += uniqueRuleIds.length;
-
-					log.info(() => ({
-						msg: "Endpoint deleted rules",
-						data: {
-							rulesFilterInput,
-							uniqueRuleIds,
-						},
-					}));
-				}
-			});
-		}
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				deleted_count: deletedCount,
-			},
-		};
-	}
-}

package/src/api/read/.export.ts

@@ -1,25 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export type {
-	RuleIdsResponse,
-	RuleIdsEndpointResponse,
-} from "./findRuleIds.js";
-
-export type {
-	FetchRulesOptions,
-	FetchRulesResponse,
-} from "./fetchRules.js";
-
-export type { MissingIds } from "./getMissingIds.js";

package/src/api/read/fetchRules.ts

@@ -1,96 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import { ruleEntryInput } from "#policy/ruleInput/ruleInput.js";
-import type {
-	AccessRuleEntry,
-	AccessRulesStorage,
-} from "#policy/rulesStorage.js";
-
-export type FetchRulesOptions = {
-	ids: string[];
-};
-
-type FetchRulesSchema = ZodType<FetchRulesOptions>;
-
-export type FetchRulesResponse = {
-	ruleEntries: AccessRuleEntry[];
-};
-
-// Explicit annotation with `unknown` input position rather than the
-// strict identity form because `ruleEntryInput.rule` transitively uses
-// `z.preprocess` on `deferToVerify`. Required for portable declaration
-// emit; the `AllKeys<...>` constraint still catches missing fields.
-export const fetchRulesResponse: ZodType<
-	FetchRulesResponse,
-	z.ZodTypeDef,
-	unknown
-> = z.object({
-	ruleEntries: ruleEntryInput.array(),
-} satisfies AllKeys<FetchRulesResponse>);
-
-export type FetchRulesEndpointResponse = ApiEndpointResponse & {
-	data?: FetchRulesResponse;
-};
-
-export class FetchRulesEndpoint implements ApiEndpoint<FetchRulesSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): FetchRulesSchema {
-		return z.object({
-			ids: z.string().array(),
-		} satisfies AllKeys<FetchRulesOptions>);
-	}
-
-	async processRequest(
-		args: FetchRulesOptions,
-		logger?: Logger,
-	): Promise<FetchRulesEndpointResponse> {
-		const log = logger ?? this.logger;
-		const ruleEntries = await this.accessRulesStorage.fetchRules(args.ids);
-
-		log.info(() => ({
-			msg: "Endpoint fetched rules",
-			data: {
-				requestedCount: args.ids.length,
-				foundCount: ruleEntries.length,
-			},
-		}));
-
-		log.debug(() => ({
-			msg: "Fetched rule details",
-			data: {
-				ruleEntries: ruleEntries,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				ruleEntries: ruleEntries,
-			},
-		};
-	}
-}

package/src/api/read/findRuleIds.ts

@@ -1,97 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import { type AllKeys, executeBatchesSequentially } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import {
-	type AccessRulesFilterInput,
-	accessRulesFilterInput,
-	getAccessRuleFiltersFromInput,
-} from "#policy/ruleInput/ruleInput.js";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-// `unknown` input position — see accessRulesFilterInput's block comment
-// for why the strict-identity form doesn't fit here.
-type FindRulesSchema = ZodType<AccessRulesFilterInput[], z.ZodTypeDef, unknown>;
-
-export type RuleIdsResponse = {
-	ruleIds: string[];
-};
-
-export const ruleIdsResponse = z.object({
-	ruleIds: z.string().array(),
-} satisfies AllKeys<RuleIdsResponse>) satisfies ZodType<RuleIdsResponse>;
-
-export type RuleIdsEndpointResponse = ApiEndpointResponse & {
-	data?: RuleIdsResponse;
-};
-
-export class FindRuleIdsEndpoint implements ApiEndpoint<FindRulesSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): FindRulesSchema {
-		return z.array(accessRulesFilterInput);
-	}
-
-	async processRequest(
-		args: AccessRulesFilterInput[],
-		logger?: Logger,
-	): Promise<RuleIdsEndpointResponse> {
-		const log = logger ?? this.logger;
-		const ruleIdBatches = await executeBatchesSequentially(
-			args,
-			async (rulesFilterInput) => {
-				const ruleFilters = getAccessRuleFiltersFromInput(rulesFilterInput);
-
-				const ruleIds = await executeBatchesSequentially(
-					ruleFilters,
-					(ruleFilter) => this.accessRulesStorage.findRuleIds(ruleFilter),
-				);
-
-				return ruleIds.flat();
-			},
-		);
-
-		const ruleIds = ruleIdBatches.flat();
-
-		// Set() automatically removes duplicates
-		const uniqueRuleIds = [...new Set(ruleIds)];
-
-		log.info(() => ({
-			msg: "Endpoint found rules",
-			data: {
-				totalFoundCount: ruleIds.length,
-				uniqueFoundCount: uniqueRuleIds.length,
-				searchFilters: args,
-				foundIds: uniqueRuleIds,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				ruleIds: uniqueRuleIds,
-			},
-		};
-	}
-}

package/src/api/read/getMissingIds.ts

@@ -1,81 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-export type MissingIds = string[];
-
-type MissingIdsSchema = ZodType<MissingIds>;
-
-export type MissingIdsResponse = {
-	ids: string[];
-};
-
-export const missingIdsResponse = z.object({
-	ids: z.string().array(),
-} satisfies AllKeys<MissingIdsResponse>) satisfies ZodType<MissingIdsResponse>;
-
-export type MissingIdsEndpointResponse = ApiEndpointResponse & {
-	data?: MissingIdsResponse;
-};
-
-export class GetMissingIdsEndpoint implements ApiEndpoint<MissingIdsSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): MissingIdsSchema {
-		return z.string().array();
-	}
-
-	async processRequest(
-		args: MissingIds,
-		logger?: Logger,
-	): Promise<MissingIdsEndpointResponse> {
-		const log = logger ?? this.logger;
-		const missingIds = await this.accessRulesStorage.getMissingRuleIds(args);
-
-		log.info(() => ({
-			msg: "Endpoint checked missing ids",
-			data: {
-				idsToCheck: args.length,
-				missingIds: missingIds.length,
-			},
-		}));
-
-		log.debug(() => ({
-			msg: "Missing id details",
-			data: {
-				idsToCheck: args,
-				missingIds: missingIds,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				ids: missingIds,
-			},
-		};
-	}
-}

package/src/api/ruleApiRoutes.ts

@@ -1,146 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type {
-	ApiRouteLimits,
-	ApiRoutes,
-	ApiRoutesProvider,
-} from "@prosopo/api-route";
-import type { AllEnumValues } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { FetchRulesEndpoint } from "#policy/api/read/fetchRules.js";
-import { FindRuleIdsEndpoint } from "#policy/api/read/findRuleIds.js";
-import { GetMissingIdsEndpoint } from "#policy/api/read/getMissingIds.js";
-import { RehashRulesEndpoint } from "#policy/api/write/rehashRules.js";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-import { DeleteAllRulesEndpoint } from "./delete/deleteAllRules.js";
-import { DeleteRuleGroupsEndpoint } from "./delete/deleteRuleGroups.js";
-import { DeleteRulesEndpoint } from "./delete/deleteRules.js";
-import { InsertRulesEndpoint } from "./write/insertRules.js";
-
-export enum accessRuleApiPaths {
-	// delete
-	DELETE_ALL = "/v1/prosopo/user-access-policy/rules/delete-all",
-	DELETE_GROUPS = "/v1/prosopo/user-access-policy/rules/delete-groups",
-	DELETE_MANY = "/v1/prosopo/user-access-policy/rules/delete-many",
-	// read
-	FETCH_MANY = "/v1/prosopo/user-access-policy/rules/fetch-many",
-	FIND_IDS = "/v1/prosopo/user-access-policy/rules/find-ids",
-	GET_MISSING_IDS = "/v1/prosopo/user-access-policy/rules/get-missing-ids",
-	// write
-	INSERT_MANY = "/v1/prosopo/user-access-policy/rules/insert-many",
-	REHASH_ALL = "/v1/prosopo/user-access-policy/rules/rehash-all",
-}
-
-export class AccessRuleApiRoutes implements ApiRoutesProvider {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRoutes(): ApiRoutes {
-		return {
-			...this.makeDeleteEndpoints(),
-			...this.makeReadEndpoints(),
-			...this.makeWriteEndpoints(),
-		} satisfies AllEnumValues<accessRuleApiPaths>;
-	}
-
-	protected makeDeleteEndpoints() {
-		return {
-			[accessRuleApiPaths.DELETE_ALL]: new DeleteAllRulesEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-			[accessRuleApiPaths.DELETE_GROUPS]: new DeleteRuleGroupsEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-			[accessRuleApiPaths.DELETE_MANY]: new DeleteRulesEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-		};
-	}
-
-	protected makeReadEndpoints() {
-		return {
-			[accessRuleApiPaths.FETCH_MANY]: new FetchRulesEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-			[accessRuleApiPaths.FIND_IDS]: new FindRuleIdsEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-			[accessRuleApiPaths.GET_MISSING_IDS]: new GetMissingIdsEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-		};
-	}
-
-	protected makeWriteEndpoints() {
-		return {
-			[accessRuleApiPaths.INSERT_MANY]: new InsertRulesEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-			[accessRuleApiPaths.REHASH_ALL]: new RehashRulesEndpoint(
-				this.accessRulesStorage,
-				this.logger,
-			),
-		};
-	}
-}
-
-export const getExpressApiRuleRateLimits =
-	(): ApiRouteLimits<accessRuleApiPaths> => {
-		const defaults = {
-			limit: 5,
-			windowSeconds: 10,
-		};
-
-		const defaultWindowMs = defaults.windowSeconds * 1_000;
-
-		const rateLimitEntries = Object.entries(accessRuleApiPaths).map(
-			([endpointName, endpointPath]) => [
-				endpointPath,
-				{
-					windowMs:
-						getIntEnvironmentVariable(
-							`PROSOPO_USER_ACCESS_POLICY_RULE_${endpointName}_WINDOW`,
-						) || defaultWindowMs,
-					limit:
-						getIntEnvironmentVariable(
-							`PROSOPO_USER_ACCESS_POLICY_RULE_${endpointName}_LIMIT`,
-						) || defaults.limit,
-				},
-			],
-		);
-
-		return Object.fromEntries(rateLimitEntries);
-	};
-
-const getIntEnvironmentVariable = (
-	variableName: string,
-): number | undefined => {
-	const variableValue = process.env[variableName];
-
-	const numericValue = variableValue
-		? Number.parseInt(variableValue)
-		: Number.NaN;
-
-	return Number.isInteger(numericValue) ? numericValue : undefined;
-};