@prosopo/user-access-policy 3.14.14 → 3.14.15

package/src/redis/reader/redisRulesQuery.ts

@@ -1,268 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	AccessPolicyType,
-	GLOBAL_CLIENT_SCOPE_SENTINEL,
-	type PolicyScope,
-	type UserIp,
-	type UserScope,
-} from "#policy/rule.js";
-import { userScopeSchema } from "#policy/ruleInput/userScopeInput.js";
-import {
-	type AccessRulesFilter,
-	FilterScopeMatch,
-} from "#policy/rulesStorage.js";
-
-type QueryBuilder = (value: unknown, scope: UserIp) => string;
-
-/**
- * Escapes special characters for Redis TAG field queries.
- * Redis TAG fields treat these characters as special and they must be escaped with a backslash.
- */
-const escapeTagValue = (value: string): string => {
-	// Characters that need escaping in Redis TAG queries
-	return value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
-};
-
-// #2 is a required option when the 'ismissing()' function is in the query body
-export const REDIS_QUERY_DIALECT = 2;
-
-const userIpQueries: Record<keyof UserIp, QueryBuilder> = {
-	numericIp: (value, scope) => {
-		if (undefined !== value) {
-			return `( @numericIp:[${value} ${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`;
-		}
-		// Only emit ismissing(@numericIp) if ranges are also not present
-		if (
-			scope.numericIpMaskMin === undefined &&
-			scope.numericIpMaskMax === undefined
-		) {
-			return "ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax)";
-		}
-		// Else, let ranges handle it
-		return "";
-	},
-	numericIpMaskMin: (value, scope) => {
-		if (scope.numericIp !== undefined) {
-			return ""; // handled by numericIp
-		}
-		// When all IP fields are undefined, numericIp handler already emits all ismissing clauses
-		if (value === undefined && scope.numericIpMaskMax === undefined) {
-			return "";
-		}
-		return value !== undefined
-			? `@numericIpMaskMin:[-inf ${value}]`
-			: "ismissing(@numericIpMaskMin)";
-	},
-	numericIpMaskMax: (value, scope) => {
-		if (scope.numericIp !== undefined) {
-			return ""; // handled by numericIp
-		}
-		// When all IP fields are undefined, numericIp handler already emits all ismissing clauses
-		if (value === undefined && scope.numericIpMaskMin === undefined) {
-			return "";
-		}
-		return value !== undefined
-			? `@numericIpMaskMax:[${value} +inf]`
-			: "ismissing(@numericIpMaskMax)";
-	},
-};
-
-const getUserScopeQuery = (
-	userScope: UserScope,
-	FilterScopeMatchType: FilterScopeMatch | undefined,
-	matchingFieldsOnly: boolean,
-): string => {
-	let scopeEntries = Object.entries(userScope) as Array<
-		[keyof UserScope, unknown]
-	>;
-	let scopeJoinType = " ";
-
-	// skip fields with undefined values if in greedy mode and set operator to OR
-	if (FilterScopeMatchType === FilterScopeMatch.Greedy) {
-		scopeEntries = scopeEntries.filter(
-			([_, value]) => value !== undefined,
-		) as Array<[keyof UserScope, unknown]>;
-		scopeJoinType = " | ";
-	}
-
-	if (matchingFieldsOnly) {
-		const scopeMap = new Map<keyof UserScope, unknown>(scopeEntries);
-
-		// If numericIp is explicitly undefined, set both range fields to undefined
-		if (scopeMap.has("numericIp") && scopeMap.get("numericIp") === undefined) {
-			scopeMap.set("numericIpMaskMin", undefined);
-			scopeMap.set("numericIpMaskMax", undefined);
-		}
-
-		// Ensure all expected fields are accounted for
-		for (const name of Object.keys(userScopeSchema.shape) as Array<
-			keyof UserScope
-		>) {
-			if (!scopeMap.has(name)) {
-				scopeMap.set(name, undefined);
-			}
-		}
-
-		scopeEntries = [...scopeMap.entries()];
-	}
-
-	const scopeObj = Object.fromEntries(scopeEntries) as Partial<UserScope>;
-
-	return scopeEntries
-		.map(([scopeFieldName, scopeFieldValue]) =>
-			getUserScopeFieldQuery(
-				scopeFieldName,
-				scopeFieldValue,
-				FilterScopeMatchType,
-				scopeObj,
-			),
-		)
-		.filter(Boolean)
-		.join(scopeJoinType);
-};
-
-// Fields that may contain special characters requiring escaping in Redis TAG queries
-const FIELDS_REQUIRING_ESCAPE: ReadonlySet<keyof UserScope> = new Set([
-	"coords",
-]);
-
-// Fields indexed as NUMERIC in RediSearch — must use range syntax `@x:[N N]`,
-// not the TAG syntax `@x:{N}`, or lookups silently return no results.
-const NUMERIC_FIELDS: ReadonlySet<keyof UserScope> = new Set(["asn"]);
-
-const getUserScopeFieldQuery = (
-	fieldName: keyof UserScope,
-	fieldValue: unknown,
-	scopeMatch: FilterScopeMatch | undefined,
-	fullScope: Partial<UserScope>,
-): string => {
-	if (fieldName in userIpQueries) {
-		const queryBuilder = userIpQueries[fieldName as keyof UserIp];
-
-		return queryBuilder(fieldValue, fullScope);
-	}
-
-	if (undefined === fieldValue) {
-		return `ismissing(@${fieldName})`;
-	}
-
-	const stringValue = String(fieldValue);
-
-	if (NUMERIC_FIELDS.has(fieldName)) {
-		return `@${fieldName}:[${stringValue} ${stringValue}]`;
-	}
-
-	// Only escape fields that may contain special characters (like coords with JSON)
-	const queryValue = FIELDS_REQUIRING_ESCAPE.has(fieldName)
-		? escapeTagValue(stringValue)
-		: stringValue;
-
-	return `@${fieldName}:{${queryValue}}`;
-};
-
-// Global rules are stamped with `@clientId:{global}` at write time so the
-// scope query can hit the clientId posting list instead of walking the
-// index for ismissing(). The `| ismissing(@clientId)` branch is a
-// transition safety net for rules written before the sentinel shipped —
-// rehash-all migrates them, but we don't gate on that ordering.
-const GLOBAL_MATCH_CLAUSE_INNER = `@clientId:{${GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
-
-const getPolicyScopeQuery = (
-	policyScope: PolicyScope | undefined,
-	scopeMatch: FilterScopeMatch | undefined,
-): string => {
-	const clientId = policyScope?.clientId;
-
-	if ("string" === typeof clientId) {
-		return FilterScopeMatch.Exact === scopeMatch
-			? `@clientId:{${clientId}}`
-			: `( @clientId:{${clientId}} | ${GLOBAL_MATCH_CLAUSE_INNER} )`;
-	}
-
-	return FilterScopeMatch.Exact === scopeMatch
-		? `( ${GLOBAL_MATCH_CLAUSE_INNER} )`
-		: "";
-};
-
-// Candidate-pool clause for the two hard-block callers.
-//
-// Verify (`includeDeferred`): a deferToVerify rule is skipped at request
-// time and enforced at verify, so it is a valid hard block whatever its
-// type — the pool must admit deferred Restrict rules too.
-//
-// Request time (middleware): deferred rules are never enforceable there,
-// so exclude them server-side rather than fetching and discarding them.
-// Rules with no `deferToVerify` field survive the negation (the field is
-// indexed INDEXMISSING).
-//
-// The union must be wrapped as a single group. `|` binds looser than the
-// implicit intersection, so an unwrapped `(@a:{x})|(@b:{y}) @ip:[…]`
-// parses as `@a:{x} OR (@b:{y} AND @ip:[…])` — the left side escapes the
-// scope and IP filters and matches every Block rule in the index. Both
-// `(@a:{x} | @b:{y})` and `((@a:{x})|(@b:{y}))` group correctly; this
-// form is the shorter one. Requires DIALECT 2, which every caller uses
-// (see REDIS_QUERY_DIALECT).
-export const getBlockPoolClause = (includeDeferred: boolean): string =>
-	includeDeferred
-		? `(@type:{${AccessPolicyType.Block}} | @deferToVerify:{true})`
-		: `@type:{${AccessPolicyType.Block}} -@deferToVerify:{true}`;
-
-/*
- * Search command example:
- *
- * ft.search index:test "( @clientId:{value} | ismissing(@clientId) )
- * (
- * ( @ip:[value] | ( @ipRangeMin:[-inf value] @ipRangeMax:[value +inf] ) ) |
- * @id:{value} | @ja4Fingerprint:{value} | headersFingerprint:{value}"
- * )
- * DIALECT 2 # must have when the ismissing() function in use
- * */
-export const getRulesRedisQuery = (
-	filter: AccessRulesFilter,
-	matchingFieldsOnly: boolean,
-): string => {
-	const { policyScope, userScope } = filter;
-	const queryParts = [];
-
-	if (filter.groupId) {
-		queryParts.push(`@groupId:{${filter.groupId}}`);
-	}
-
-	if (filter.blockOnly) {
-		queryParts.push(getBlockPoolClause(filter.includeDeferred === true));
-	}
-
-	const policyScopeQuery = getPolicyScopeQuery(
-		policyScope,
-		filter.policyScopeMatch,
-	);
-
-	if (policyScopeQuery) {
-		queryParts.push(policyScopeQuery);
-	}
-
-	if (userScope && Object.keys(userScope).length > 0) {
-		const userScopeFilter = getUserScopeQuery(
-			userScope,
-			filter.userScopeMatch,
-			matchingFieldsOnly,
-		);
-
-		queryParts.push(`( ${userScopeFilter} )`);
-	}
-
-	return queryParts.length > 0 ? queryParts.join(" ") : "*";
-};