@prosopo/user-access-policy 3.14.14 → 3.14.15

package/src/api/rulesApiClient.ts

@@ -1,154 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { ApiClient } from "@prosopo/api";
-import type { ApiEndpointResponse } from "@prosopo/api-route";
-import {
-	type FetchRulesEndpointResponse,
-	type FetchRulesOptions,
-	fetchRulesResponse,
-} from "#policy/api/read/fetchRules.js";
-import {
-	type RuleIdsEndpointResponse,
-	ruleIdsResponse,
-} from "#policy/api/read/findRuleIds.js";
-import {
-	type MissingIds,
-	type MissingIdsEndpointResponse,
-	missingIdsResponse,
-} from "#policy/api/read/getMissingIds.js";
-import type { AccessRulesFilterInput } from "#policy/ruleInput/ruleInput.js";
-import type { DeleteSiteGroups } from "./delete/deleteRuleGroups.js";
-import { accessRuleApiPaths } from "./ruleApiRoutes.js";
-import type { InsertRulesGroup } from "./write/insertRules.js";
-
-export class AccessRulesApiClient extends ApiClient {
-	//// delete
-
-	public deleteMany(
-		filters: AccessRulesFilterInput[],
-		jwt: string,
-	): Promise<ApiEndpointResponse> {
-		return this.post(
-			accessRuleApiPaths.DELETE_MANY,
-			filters,
-			this.getAuthHeaders(jwt),
-		);
-	}
-
-	public deleteGroups(
-		siteGroups: DeleteSiteGroups,
-		jwt: string,
-	): Promise<ApiEndpointResponse> {
-		return this.post(
-			accessRuleApiPaths.DELETE_GROUPS,
-			siteGroups,
-			this.getAuthHeaders(jwt),
-		);
-	}
-
-	public deleteAll(jwt: string): Promise<ApiEndpointResponse> {
-		return this.post(
-			accessRuleApiPaths.DELETE_ALL,
-			{},
-			this.getAuthHeaders(jwt),
-		);
-	}
-
-	//// read
-
-	public async getMissingIds(
-		idsToCheck: MissingIds,
-		jwt: string,
-	): Promise<MissingIdsEndpointResponse> {
-		const endpointResponse: ApiEndpointResponse = await this.post(
-			accessRuleApiPaths.GET_MISSING_IDS,
-			idsToCheck,
-			this.getAuthHeaders(jwt),
-		);
-
-		const parsedData = missingIdsResponse.safeParse(endpointResponse.data);
-
-		return {
-			...endpointResponse,
-			data: parsedData.success ? parsedData.data : undefined,
-		};
-	}
-
-	public async fetchMany(
-		fetchOptions: FetchRulesOptions,
-		jwt: string,
-	): Promise<FetchRulesEndpointResponse> {
-		const endpointResponse: ApiEndpointResponse = await this.post(
-			accessRuleApiPaths.FETCH_MANY,
-			fetchOptions,
-			this.getAuthHeaders(jwt),
-		);
-
-		const parsedData = fetchRulesResponse.safeParse(endpointResponse.data);
-
-		return {
-			...endpointResponse,
-			data: parsedData.success ? parsedData.data : undefined,
-		};
-	}
-
-	public async findIds(
-		filters: AccessRulesFilterInput[],
-		jwt: string,
-	): Promise<RuleIdsEndpointResponse> {
-		const endpointResponse: ApiEndpointResponse = await this.post(
-			accessRuleApiPaths.FIND_IDS,
-			filters,
-			this.getAuthHeaders(jwt),
-		);
-
-		const parsedData = ruleIdsResponse.safeParse(endpointResponse.data);
-
-		return {
-			...endpointResponse,
-			data: parsedData.success ? parsedData.data : undefined,
-		};
-	}
-
-	//// write
-
-	public async rehashAll(jwt: string): Promise<ApiEndpointResponse> {
-		return this.post(
-			accessRuleApiPaths.REHASH_ALL,
-			{},
-			this.getAuthHeaders(jwt),
-		);
-	}
-
-	public insertMany(
-		ruleGroups: InsertRulesGroup[],
-		jwt: string,
-	): Promise<ApiEndpointResponse> {
-		return this.post(
-			accessRuleApiPaths.INSERT_MANY,
-			ruleGroups,
-			this.getAuthHeaders(jwt),
-		);
-	}
-
-	protected getAuthHeaders(jwt: string): RequestInit {
-		return {
-			headers: {
-				"Prosopo-Site-Key": this.account,
-				Authorization: `Bearer ${jwt}`,
-			},
-		};
-	}
-}

package/src/api/write/.export.ts

@@ -1,15 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export type { InsertRulesGroup } from "./insertRules.js";

package/src/api/write/insertRules.ts

@@ -1,185 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import { LogLevel, type Logger } from "@prosopo/logger";
-import { type ZodType, type ZodTypeDef, z } from "zod";
-import type {
-	AccessPolicy,
-	AccessRule,
-	PolicyScope,
-	UserScope,
-} from "#policy/rule.js";
-import {
-	accessPolicyInput,
-	policyScopeInput,
-	sanitizeAccessPolicy,
-} from "#policy/ruleInput/policyInput.js";
-import {
-	type UserScopeInput,
-	userScopeInput,
-} from "#policy/ruleInput/userScopeInput.js";
-import type {
-	AccessRuleEntry,
-	AccessRulesWriter,
-} from "#policy/rulesStorage.js";
-
-export type InsertRulesGroup = {
-	accessPolicy: AccessPolicy;
-	userScopes: UserScopeInput[];
-	// a single client may have multiple siteKeys,
-	// so for batch requests we take multiple policyScopes as apply all the rules to every scope
-	policyScopes?: PolicyScope[];
-	groupId?: string;
-	expiresUnixTimestamp?: number;
-};
-
-type ParsedInsertRulesGroup = InsertRulesGroup & {
-	userScopes: UserScope[];
-};
-
-type ParsedInsertRuleGroups = ParsedInsertRulesGroup[];
-
-// Input position widened to `unknown` because `accessPolicyInput` uses
-// `z.preprocess` on `deferToVerify` for Redis string round-tripping.
-type InsertRulesSchema = ZodType<InsertRulesGroup[], ZodTypeDef, unknown>;
-
-export class InsertRulesEndpoint implements ApiEndpoint<InsertRulesSchema> {
-	public constructor(
-		private readonly accessRulesWriter: AccessRulesWriter,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): InsertRulesSchema {
-		return z.array(
-			z.object({
-				accessPolicy: accessPolicyInput,
-				policyScopes: z.array(policyScopeInput).optional(),
-				groupId: z.string().optional(),
-				userScopes: z.array(userScopeInput),
-				expiresUnixTimestamp: z.number().optional(),
-			} satisfies AllKeys<InsertRulesGroup>),
-		);
-	}
-
-	async processRequest(
-		args: ParsedInsertRuleGroups,
-		logger?: Logger,
-	): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-
-		const timeoutPromise = new Promise<ApiEndpointResponse>((resolve) => {
-			setTimeout(() => {
-				resolve({
-					status: ApiEndpointResponseStatus.PROCESSING,
-				});
-			}, 5000);
-		});
-
-		const userScopesCount = args.reduce(
-			(userScopesCount, group) => userScopesCount + group.userScopes.length,
-			0,
-		);
-
-		const createRulesPromise = this.createRuleGroups(args)
-			.then((insertedIds) => {
-				log.info(() => ({
-					msg: "Endpoint inserted access rules",
-					data: {
-						userScopesCount: userScopesCount,
-						insertedCount: insertedIds.length,
-						uniqueIdsCount: new Set(insertedIds).size,
-					},
-				}));
-
-				log.debug(() => ({
-					msg: "Inserted access rules details",
-					data: {
-						insertedIds,
-						input: args,
-					},
-				}));
-
-				return {
-					status: ApiEndpointResponseStatus.SUCCESS,
-				};
-			})
-			.catch((error) => {
-				if (LogLevel.enum.debug === log.getLogLevel()) {
-					log.error(() => ({
-						err: error,
-						data: { args },
-						msg: "Failed to insert access rules",
-					}));
-				}
-				return {
-					status: ApiEndpointResponseStatus.FAIL,
-				};
-			});
-
-		// Whichever finishes first: timeout or actual rule creation
-		return Promise.race([timeoutPromise, createRulesPromise]);
-	}
-
-	protected async createRuleGroups(
-		groups: ParsedInsertRuleGroups,
-	): Promise<string[]> {
-		const ruleIdPromises = groups.map((group) => this.createRulesGroup(group));
-
-		const ruleIdSets = await Promise.all(ruleIdPromises);
-
-		return ruleIdSets.flat();
-	}
-
-	protected async createRulesGroup(
-		group: ParsedInsertRulesGroup,
-	): Promise<string[]> {
-		const ruleEntries: AccessRuleEntry[] = [];
-		const policyScopes = group.policyScopes || [];
-		// Sanitize the access policy to remove unnecessary fields from block policies
-		const sanitizedPolicy = sanitizeAccessPolicy(group.accessPolicy);
-
-		for (const userScope of group.userScopes) {
-			const ruleBase: AccessRule = {
-				...sanitizedPolicy,
-				...userScope,
-				...(group.groupId ? { groupId: group.groupId } : {}),
-			};
-
-			if (policyScopes.length > 0) {
-				for (const policyScope of policyScopes) {
-					ruleEntries.push({
-						rule: {
-							...ruleBase,
-							...policyScope,
-						},
-						expiresUnixTimestamp: group.expiresUnixTimestamp,
-					});
-				}
-			} else {
-				ruleEntries.push({
-					rule: ruleBase,
-					expiresUnixTimestamp: group.expiresUnixTimestamp,
-				});
-			}
-		}
-
-		return this.accessRulesWriter.insertRules(ruleEntries);
-	}
-}

package/src/api/write/rehashRules.ts

@@ -1,85 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { Logger } from "@prosopo/logger";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-export class RehashRulesEndpoint implements ApiEndpoint<undefined> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): undefined {}
-
-	async processRequest(logger?: Logger): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		await this.accessRulesStorage.fetchAllRuleIds(async (ruleIds: string[]) => {
-			log.info(() => ({
-				msg: "Fetched rule ids batch",
-				data: {
-					count: ruleIds.length,
-					ruleIds,
-				},
-			}));
-
-			const ruleEntries = await this.accessRulesStorage.fetchRules(ruleIds);
-
-			log.info(() => ({
-				msg: "Fetched rules",
-				data: {
-					count: ruleEntries.length,
-				},
-			}));
-
-			if (ruleEntries.length !== ruleIds.length) {
-				log.warn(() => ({
-					msg: "Fetched rules count is not equal to the requested count",
-					data: {
-						fetchedCount: ruleEntries.length,
-						requestedCount: ruleIds.length,
-					},
-				}));
-			}
-
-			await this.accessRulesStorage.deleteRules(ruleIds);
-
-			log.info(() => ({
-				msg: "Deleted rules",
-				data: {
-					count: ruleIds.length,
-				},
-			}));
-
-			await this.accessRulesStorage.insertRules(ruleEntries);
-
-			log.info(() => ({
-				msg: "Inserted rules",
-				data: {
-					count: ruleEntries.length,
-				},
-			}));
-		});
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {},
-		};
-	}
-}

package/src/classifyBrowser.ts

@@ -1,77 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-/**
- * Kept in step with `@prosopo/decision-machines`' `uaClassify` — as `classifyOs`
- * is — but defined here because the provider request path cannot depend on that
- * package.
- */
-export const BROWSER_NAMES = [
-	"chrome",
-	"safari",
-	"firefox",
-	"edge",
-	"opera",
-	"samsung_internet",
-	"wechat",
-	"facebook",
-	"instagram",
-	"ie",
-	"unknown",
-] as const;
-
-export type BrowserName = (typeof BROWSER_NAMES)[number];
-
-/**
- * Branch order is load-bearing: every browser below Chrome also carries a
- * `chrome/` token, and Safari's signature appears in nearly every WebKit UA.
- *
- * Reads the User-Agent rather than the `sec-ch-ua` client hint because a client
- * can simply omit client hints, but stripping the UA breaks far more.
- */
-export const classifyBrowser = (userAgent: string | undefined): BrowserName => {
-	const ua = (userAgent || "").toLowerCase();
-
-	if (/\bedg(?:e|a|ios)?\//.test(ua)) {
-		return "edge";
-	}
-	if (/samsungbrowser/.test(ua)) {
-		return "samsung_internet";
-	}
-	if (/\bopr\/|opera/.test(ua)) {
-		return "opera";
-	}
-	if (/micromessenger/.test(ua)) {
-		return "wechat";
-	}
-	if (/fban|fbav|fbios/.test(ua)) {
-		return "facebook";
-	}
-	if (/instagram/.test(ua)) {
-		return "instagram";
-	}
-	if (/firefox|fxios/.test(ua)) {
-		return "firefox";
-	}
-	if (/msie|trident/.test(ua)) {
-		return "ie";
-	}
-	if (/\bchrome\/|\bcrios\//.test(ua)) {
-		return "chrome";
-	}
-	if (/safari\//.test(ua)) {
-		return "safari";
-	}
-	return "unknown";
-};

package/src/classifyOs.ts

@@ -1,74 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-/**
- * The operating systems the classifier can resolve a request to. Kept
- * deliberately in step with the OS vocabulary in
- * `@prosopo/decision-machines`' `uaClassify` (so a routing-rule `osNameIn` and
- * an access-rule `os` agree on the same names), but defined here because the
- * provider / user-access-policy request path cannot depend on the
- * decision-machines package.
- *
- * `unknown` is the catch-all when no signature matches. It is a first-class
- * value so an allow-list ("only let Windows through") can block unrecognised
- * User-Agents instead of silently passing them.
- */
-export const OS_NAMES = [
-	"windows",
-	"macos",
-	"ios",
-	"android",
-	"linux",
-	"unknown",
-] as const;
-
-export type OsName = (typeof OS_NAMES)[number];
-
-/**
- * Classify the operating system from a raw User-Agent string. Pure — no
- * navigator/window/DOM dependence — so it is safe to call on the provider's
- * server-side request path.
- *
- * Detection order matches `uaClassify.classifyUserAgent`: iOS (iphone/ipad/
- * ipod) is tested before the generic mac signature, and Android before Linux,
- * because those User-Agents contain the more general token too. Detection is
- * conservative — anything unrecognised returns `unknown` rather than guessing,
- * so an `os === "ios"` rule never fires on a UA we don't understand.
- *
- * The classification is driven off the full User-Agent rather than the
- * `sec-ch-ua-platform` client hint on purpose: a client can simply omit client
- * hints, but stripping the User-Agent breaks far more, so the UA is the more
- * reliable signal for an OS-restriction rule that is meant to be hard to
- * bypass.
- */
-export const classifyOs = (userAgent: string | undefined): OsName => {
-	const ua = (userAgent || "").toLowerCase();
-
-	if (/iphone|ipad|ipod/.test(ua)) {
-		return "ios";
-	}
-	if (/android/.test(ua)) {
-		return "android";
-	}
-	if (/windows/.test(ua)) {
-		return "windows";
-	}
-	if (/macintosh|mac os/.test(ua)) {
-		return "macos";
-	}
-	if (/linux/.test(ua)) {
-		return "linux";
-	}
-	return "unknown";
-};