@prosopo/user-access-policy 3.14.14 → 3.14.15

package/src/ruleInput/userScopeInput.ts

@@ -1,142 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import crypto from "node:crypto";
-import type { AllKeys } from "@prosopo/common";
-import { getIPAddress } from "@prosopo/util";
-import { Address4, Address6 } from "ip-address";
-import { type ZodType, z } from "zod";
-import type { UserAttributes, UserIp, UserScope } from "#policy/rule.js";
-import type { UserAttributesRecord, UserIpRecord } from "#policy/ruleRecord.js";
-
-export type UserAttributesInput = UserAttributes & UserAttributesRecord;
-
-// Cloudflare's Web Bot Auth reference implementation compares Signature-Agent
-// values as URL objects, which are case-insensitive on scheme/host but
-// case-sensitive on path. Store the canonical form so runtime matcher can use
-// plain string equality.
-function normaliseSignatureAgentUrl(raw: string): string {
-	const url = new URL(raw);
-	url.hostname = url.hostname.toLowerCase();
-	url.protocol = url.protocol.toLowerCase();
-	if (url.pathname === "/") url.pathname = "";
-	return url.toString().replace(/\/$/, "");
-}
-
-const userAttributesSchema = z.object({
-	// coerce is used for safety, as e.g., incoming userId can be digital
-	userId: z.coerce.string().optional(),
-	ja4Hash: z.coerce.string().optional(),
-	headersHash: z.coerce.string().optional(),
-	userAgentHash: z.coerce.string().optional(),
-	headHash: z.coerce.string().optional(),
-	coords: z.coerce.string().optional(),
-	countryCode: z.coerce.string().optional(),
-	asn: z.coerce.number().int().nonnegative().optional(),
-	// Plain lowercase OS tag (see `classifyOs`). Loose `string` like
-	// countryCode: a stale/unknown value just never matches a request rather
-	// than failing the whole rule parse.
-	os: z.coerce.string().optional(),
-	browser: z.coerce.string().optional(),
-	// Arbitrary-header matching (see `headerMatch.ts`). `headerMatch` is the
-	// indexed sentinel; name/value/operator are rule data checked in code, not
-	// via the Redis query. Loose `string` like the other tags.
-	headerMatch: z.coerce.string().optional(),
-	headerName: z.coerce.string().optional(),
-	headerValue: z.coerce.string().optional(),
-	headerOperator: z.coerce.string().optional(),
-	// Web Bot Auth Signature-Agent URL. Normalised at parse time
-	// (lowercase scheme+host, no trailing slash) so the runtime matcher can
-	// use exact string equality against the verified `Signature-Agent`
-	// header value.
-	webBotAuthAgent: z.coerce
-		.string()
-		.url()
-		.transform(normaliseSignatureAgentUrl)
-		.optional(),
-} satisfies AllKeys<UserAttributes>) satisfies ZodType<UserAttributes>;
-
-const userAttributesInput = z
-	.object({
-		...userAttributesSchema.shape,
-		userAgent: z.coerce.string().optional(),
-	} satisfies AllKeys<UserAttributesInput>)
-	.transform((userAttributesInput: UserAttributesInput): UserAttributes => {
-		// this line creates a new "userAttributes", without userAgent
-		const { userAgent, ...userScope } = userAttributesInput;
-
-		if ("string" === typeof userAgent) {
-			userScope.userAgentHash = hashUserAgent(userAgent);
-		}
-
-		return userScope;
-	});
-
-const hashUserAgent = (userAgent: string): string =>
-	crypto.createHash("sha256").update(userAgent).digest("hex");
-
-export type UserIpInput = UserIp & UserIpRecord;
-
-const userIpSchema = z.object({
-	numericIp: z.coerce.bigint().optional(),
-	numericIpMaskMin: z.coerce.bigint().optional(),
-	numericIpMaskMax: z.coerce.bigint().optional(),
-} satisfies AllKeys<UserIp>) satisfies ZodType<UserIp>;
-
-const userIpInput = z
-	.object({
-		...userIpSchema.shape,
-		ip: z.string().optional(),
-		ipMask: z.string().optional(),
-	} satisfies AllKeys<UserIpInput>)
-	.transform((userIpInput: UserIpInput): UserIp => {
-		// this line creates a new "userScope", without ip and ipMask
-		const { ip, ipMask, ...numericUserIp } = userIpInput;
-
-		if ("string" === typeof ip) {
-			numericUserIp.numericIp = getIPAddress(ip).bigInt();
-		}
-
-		// Assuming ipMask is already validated to be a string in CIDR format
-		if ("string" === typeof ipMask) {
-			// Try IPv4 CIDR first (e.g., 192.168.1.0/24); fall back to IPv6
-			// CIDR (e.g., 2001:db8::/32). Both Address4 and Address6 understand
-			// CIDR notation and expose start/end addresses for the network.
-			const ipObject = Address4.isValid(ipMask)
-				? new Address4(ipMask)
-				: new Address6(ipMask);
-
-			numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
-			numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
-		}
-
-		return numericUserIp;
-	});
-
-export type UserScopeInput = UserAttributesInput & UserIpInput;
-
-export const userScopeSchema = z.object({
-	...userIpSchema.shape,
-	...userAttributesSchema.shape,
-} satisfies AllKeys<UserScope>) satisfies ZodType<UserScope>;
-
-export const userScopeInput = z
-	.object({})
-	// unlike ...shape(), .and() includes transformations
-	.and(userIpInput)
-	.and(userAttributesInput)
-	.transform(
-		// transform is used for type safety only - plain "satisfies ZodType<x>" doesn't work after ".and()"
-		(userScopeInput): UserScopeInput => userScopeInput,
-	);

package/src/ruleRecord.ts

@@ -1,77 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type {
-	AccessPolicy,
-	PolicyScope,
-	UserAttributes,
-} from "#policy/rule.js";
-
-export type UserAttributesRecord = Omit<UserAttributes, "userAgentHash"> & {
-	userAgent?: string;
-};
-
-export const userAttributesRecordFields = [
-	"userId",
-	"ja4Hash",
-	"headersHash",
-	"userAgent",
-	"headHash",
-	"coords",
-	"countryCode",
-	"asn",
-	"os",
-	"browser",
-	"headerMatch",
-	"headerName",
-	"headerValue",
-	"headerOperator",
-	"webBotAuthAgent",
-] as const satisfies (keyof UserAttributesRecord)[];
-
-export type UserIpRecord = {
-	// human-friendly ip versions.
-	ip?: string;
-	// 127.0.0.1/24
-	ipMask?: string;
-};
-
-export const userIpRecordFields = [
-	"ip",
-	"ipMask",
-] as const satisfies (keyof UserIpRecord)[];
-
-export type UserScopeRecord = UserAttributesRecord & UserIpRecord;
-
-export const userScopeRecordFields = [
-	...userAttributesRecordFields,
-	...userIpRecordFields,
-] as const satisfies (keyof UserScopeRecord)[];
-
-export type UserScopeRecordField = (typeof userScopeRecordFields)[number];
-
-export type AccessRuleRecord = AccessPolicy &
-	PolicyScope &
-	UserScopeRecord & {
-		ruleGroupId?: string;
-	};
-
-export const getUserScopeRecordFromAccessRuleRecord = (
-	ruleRecord: AccessRuleRecord,
-): UserScopeRecord =>
-	Object.fromEntries(
-		userScopeRecordFields
-			.map((field) => [field, ruleRecord[field]])
-			.filter(([, value]) => value !== undefined),
-	);

package/src/rulesStorage.ts

@@ -1,90 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { AccessRule, PolicyScope, UserScope } from "#policy/rule.js";
-
-export enum FilterScopeMatch {
-	Exact = "exact",
-	Greedy = "greedy",
-}
-
-export type AccessRulesFilter = {
-	policyScope?: PolicyScope;
-	/**
-	 * Exact: "clientId" => client rules, "undefined" => global rules. Used by the API
-	 * Greedy: "clientId" => client + global rules, "undefined" => any rules. Used by the Express middleware
-	 */
-	policyScopeMatch?: FilterScopeMatch;
-	userScope?: UserScope;
-	/**
-	 * Exact: "clientId" => client rules, "undefined" => global rules. Used by the API
-	 * Greedy: "clientId" => client + global rules, "undefined" => any rules. Used by the Express middleware
-	 */
-	userScopeMatch?: FilterScopeMatch;
-	groupId?: string;
-	/**
-	 * Restrict the result to Block-type rules. Hot-path callers
-	 * (checkForHardBlock, blockMiddleware) set this so the Redis-side
-	 * candidate pool excludes Restrict and routing-Block rules before
-	 * the SERVER_SIDE_RANK_TOP_N cap is applied — without it, dense
-	 * Restrict populations can push the hard-block rules past the cap
-	 * and the lookup misses them.
-	 */
-	blockOnly?: boolean;
-	/**
-	 * Widen a `blockOnly` pool to also admit deferred rules of any type.
-	 * A `deferToVerify` rule is skipped at request time and enforced at
-	 * verify, so it can legitimately be a Restrict — `blockOnly` alone
-	 * would filter it out of the verify-time lookup and the rule would
-	 * never fire. Only `checkForHardBlock` sets this; the request-time
-	 * middleware keeps the narrow Block-only pool.
-	 */
-	includeDeferred?: boolean;
-};
-
-export type AccessRuleEntry = {
-	rule: AccessRule;
-	expiresUnixTimestamp?: number;
-};
-
-export type AccessRulesReader = {
-	fetchRules(ruleIds: string[]): Promise<AccessRuleEntry[]>;
-
-	getMissingRuleIds(ruleIds: string[]): Promise<string[]>;
-
-	findRules(
-		filter: AccessRulesFilter,
-		matchingFieldsOnly?: boolean,
-		skipEmptyUserScopes?: boolean,
-	): Promise<AccessRule[]>;
-
-	findRuleIds(
-		filter: AccessRulesFilter,
-		matchingFieldsOnly?: boolean,
-	): Promise<string[]>;
-
-	fetchAllRuleIds(
-		batchHandler: (ruleIds: string[]) => Promise<void>,
-	): Promise<void>;
-};
-
-export type AccessRulesWriter = {
-	insertRules(ruleEntries: AccessRuleEntry[]): Promise<string[]>;
-
-	deleteRules(ruleIds: string[]): Promise<void>;
-
-	deleteAllRules(): Promise<number>;
-};
-
-export type AccessRulesStorage = AccessRulesReader & AccessRulesWriter;

package/src/tests/blockingRuleShapes.unit.test.ts

@@ -1,244 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Characterisation tests for the two blocking rule shapes as they pass
-// through the write-side zod types:
-//
-//   1. plain Block            — rejects at request time
-//   2. Block + deferToVerify  — passes request time, rejects at verify
-//
-// These pin down what each shape may carry, and what survives the write
-// path into storage. Written against the schemas the rule-sync API
-// actually validates with, so a change in either direction fails here
-// first rather than as a 400 in production.
-
-import type { Logger } from "@prosopo/logger";
-import { CaptchaType } from "@prosopo/types";
-import { describe, expect, it, vi } from "vitest";
-import { InsertRulesEndpoint } from "#policy/api/write/insertRules.js";
-import { AccessPolicyType } from "#policy/rule.js";
-import {
-	accessPolicyInput,
-	sanitizeAccessPolicy,
-} from "#policy/ruleInput/policyInput.js";
-import type { AccessRulesWriter } from "#policy/rulesStorage.js";
-
-const makeMockLogger = (): Logger =>
-	({
-		trace: vi.fn(),
-		debug: vi.fn(),
-		info: vi.fn(),
-		warn: vi.fn(),
-		error: vi.fn(),
-		fatal: vi.fn(),
-		log: vi.fn(),
-		setLogLevel: vi.fn(),
-		getLogLevel: vi.fn().mockReturnValue("info"),
-		with: vi.fn().mockReturnThis(),
-		getScope: vi.fn().mockReturnValue("test"),
-		getPretty: vi.fn().mockReturnValue(false),
-		setPretty: vi.fn(),
-		getPrintStack: vi.fn().mockReturnValue(false),
-		setPrintStack: vi.fn(),
-		getFormat: vi.fn().mockReturnValue("json"),
-		setFormat: vi.fn(),
-	}) satisfies Logger;
-
-const makeMockWriter = (): AccessRulesWriter =>
-	({
-		insertRules: vi.fn().mockResolvedValue(["id1"]),
-	}) as unknown as AccessRulesWriter;
-
-const getInsertSchema = () =>
-	new InsertRulesEndpoint(
-		makeMockWriter(),
-		makeMockLogger(),
-	).getRequestArgsSchema();
-
-describe("blocking rule shapes: plain Block", () => {
-	it("accepts a bare Block", () => {
-		const result = accessPolicyInput.safeParse({
-			type: AccessPolicyType.Block,
-			description: "bare block",
-		});
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects captchaType and solvedImagesCount together", () => {
-		const result = accessPolicyInput.safeParse({
-			type: AccessPolicyType.Block,
-			captchaType: CaptchaType.image,
-			solvedImagesCount: 2,
-		});
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			expect(result.error.issues.map((i) => i.path.at(-1)).sort()).toEqual([
-				"captchaType",
-				"solvedImagesCount",
-			]);
-		}
-	});
-
-	it("strips both fields on the way into storage", () => {
-		expect(
-			sanitizeAccessPolicy({
-				type: AccessPolicyType.Block,
-				captchaType: CaptchaType.image,
-				solvedImagesCount: 2,
-				description: "legacy block",
-			}),
-		).toEqual({
-			type: AccessPolicyType.Block,
-			description: "legacy block",
-		});
-	});
-});
-
-describe("blocking rule shapes: Block + deferToVerify", () => {
-	it("accepts the flag on its own, and preserves it", () => {
-		const result = accessPolicyInput.safeParse({
-			type: AccessPolicyType.Block,
-			deferToVerify: true,
-			description: "deferred block",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.deferToVerify).toBe(true);
-		}
-	});
-
-	// The shape that 400s the rule-sync push. The refinement has no
-	// deferToVerify carve-out, so a deferred Block is held to the same
-	// rule as a plain one.
-	it("rejects captchaType and solvedImagesCount despite the flag", () => {
-		const result = accessPolicyInput.safeParse({
-			type: AccessPolicyType.Block,
-			deferToVerify: true,
-			captchaType: CaptchaType.image,
-			solvedImagesCount: 2,
-		});
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			expect(result.error.issues.map((i) => i.path.at(-1)).sort()).toEqual([
-				"captchaType",
-				"solvedImagesCount",
-			]);
-		}
-	});
-
-	// Even were the refinement to admit them, the sanitiser drops them
-	// before storage — the flag does not exempt a Block here either.
-	it("strips both fields on the way into storage", () => {
-		expect(
-			sanitizeAccessPolicy({
-				type: AccessPolicyType.Block,
-				deferToVerify: true,
-				captchaType: CaptchaType.image,
-				solvedImagesCount: 2,
-				description: "deferred block",
-			}),
-		).toEqual({
-			type: AccessPolicyType.Block,
-			deferToVerify: true,
-			description: "deferred block",
-		});
-	});
-
-	it("round-trips the flag from its stored string form", () => {
-		const result = accessPolicyInput.safeParse({
-			type: AccessPolicyType.Block,
-			deferToVerify: "true",
-		});
-		expect(result.success).toBe(true);
-		if (result.success) {
-			expect(result.data.deferToVerify).toBe(true);
-		}
-	});
-});
-
-describe("blocking rule shapes: Restrict keeps its tuning fields", () => {
-	it("accepts captchaType and solvedImagesCount, with or without the flag", () => {
-		for (const deferToVerify of [undefined, true]) {
-			const result = accessPolicyInput.safeParse({
-				type: AccessPolicyType.Restrict,
-				captchaType: CaptchaType.image,
-				solvedImagesCount: 2,
-				...(deferToVerify === undefined ? {} : { deferToVerify }),
-			});
-			expect(result.success).toBe(true);
-		}
-	});
-
-	it("survives the sanitiser intact", () => {
-		expect(
-			sanitizeAccessPolicy({
-				type: AccessPolicyType.Restrict,
-				deferToVerify: true,
-				captchaType: CaptchaType.image,
-				solvedImagesCount: 2,
-			}),
-		).toEqual({
-			type: AccessPolicyType.Restrict,
-			deferToVerify: true,
-			captchaType: CaptchaType.image,
-			solvedImagesCount: 2,
-		});
-	});
-});
-
-// The insert endpoint validates the batch as one `z.array`, so validity
-// is all-or-nothing across the whole push.
-describe("blocking rule shapes: batch validation", () => {
-	const validGroup = {
-		accessPolicy: {
-			type: AccessPolicyType.Block,
-			deferToVerify: true,
-			description: "deferred block",
-		},
-		userScopes: [{ ip: "1.1.1.1" }],
-	};
-
-	const invalidGroup = {
-		accessPolicy: {
-			type: AccessPolicyType.Block,
-			deferToVerify: true,
-			captchaType: CaptchaType.image,
-			solvedImagesCount: 2,
-			description: "deferred block with tuning fields",
-		},
-		userScopes: [{ ip: "2.2.2.2" }],
-	};
-
-	it("accepts a batch of well-formed groups", () => {
-		const result = getInsertSchema().safeParse([validGroup, validGroup]);
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects the entire batch when a single group is malformed", () => {
-		const batch = [
-			...Array.from({ length: 20 }, () => validGroup),
-			invalidGroup,
-			...Array.from({ length: 20 }, () => validGroup),
-		];
-
-		const result = getInsertSchema().safeParse(batch);
-
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			// Every issue points at the one bad group; the other 40 are
-			// well-formed and are still rejected along with it.
-			expect(result.error.issues.map((i) => i.path[0])).toEqual([20, 20]);
-		}
-	});
-});

package/src/tests/classifyBrowser.unit.test.ts

@@ -1,138 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { describe, expect, it } from "vitest";
-import {
-	BROWSER_NAMES,
-	type BrowserName,
-	classifyBrowser,
-} from "#policy/classifyBrowser.js";
-
-describe("classifyBrowser", () => {
-	const cases: Array<{ name: string; ua: string; expected: BrowserName }> = [
-		{
-			name: "Chrome on Windows",
-			ua: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
-			expected: "chrome",
-		},
-		{
-			name: "Chrome on iOS",
-			ua: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/120.0.0.0 Mobile/15E148 Safari/604.1",
-			expected: "chrome",
-		},
-		{
-			name: "Safari on macOS",
-			ua: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
-			expected: "safari",
-		},
-		{
-			name: "Firefox on Linux",
-			ua: "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0",
-			expected: "firefox",
-		},
-		{
-			name: "Firefox on iOS",
-			ua: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/120.0 Mobile/15E148 Safari/605.1.15",
-			expected: "firefox",
-		},
-		{
-			name: "Edge on Windows",
-			ua: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
-			expected: "edge",
-		},
-		{
-			name: "Opera",
-			ua: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 OPR/106.0.0.0",
-			expected: "opera",
-		},
-		{
-			name: "Samsung Internet",
-			ua: "Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/23.0 Chrome/115.0.0.0 Mobile Safari/537.36",
-			expected: "samsung_internet",
-		},
-		{
-			name: "WeChat in-app browser",
-			ua: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/8.0.42",
-			expected: "wechat",
-		},
-		{
-			name: "Facebook in-app browser",
-			ua: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [FBAN/FBIOS;FBAV/442.0.0]",
-			expected: "facebook",
-		},
-		{
-			name: "Instagram in-app browser",
-			ua: "Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36 Instagram 310.0.0.0 Android",
-			expected: "instagram",
-		},
-		{
-			name: "Internet Explorer 11",
-			ua: "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko",
-			expected: "ie",
-		},
-	];
-
-	for (const { name, ua, expected } of cases) {
-		it(`classifies ${name} as ${expected}`, () => {
-			expect(classifyBrowser(ua)).toBe(expected);
-		});
-	}
-
-	it("returns 'unknown' for an empty User-Agent", () => {
-		expect(classifyBrowser("")).toBe("unknown");
-	});
-
-	it("returns 'unknown' for an undefined User-Agent", () => {
-		expect(classifyBrowser(undefined)).toBe("unknown");
-	});
-
-	it("returns 'unknown' for an unrecognised User-Agent", () => {
-		expect(classifyBrowser("curl/8.4.0")).toBe("unknown");
-	});
-
-	it("does not classify a Chrome UA as Safari", () => {
-		expect(
-			classifyBrowser(
-				"Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36",
-			),
-		).toBe("chrome");
-	});
-
-	it("does not classify an Edge UA as Chrome", () => {
-		expect(
-			classifyBrowser(
-				"Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0",
-			),
-		).toBe("edge");
-	});
-
-	it("does not classify a Samsung Internet UA as Chrome", () => {
-		expect(
-			classifyBrowser(
-				"Mozilla/5.0 (Linux; Android 14) AppleWebKit/537.36 SamsungBrowser/23.0 Chrome/115.0.0.0 Mobile Safari/537.36",
-			),
-		).toBe("samsung_internet");
-	});
-
-	it("is case-insensitive", () => {
-		expect(classifyBrowser("MOZILLA/5.0 FIREFOX/120.0")).toBe("firefox");
-	});
-
-	it("only ever returns a value from BROWSER_NAMES", () => {
-		const uas = [...cases.map((c) => c.ua), "", "curl/8.4.0", "garbage"];
-		for (const ua of uas) {
-			expect(BROWSER_NAMES).toContain(classifyBrowser(ua));
-		}
-	});
-});