@prosopo/user-access-policy 3.14.14 → 3.14.16

package/src/.export.ts

@@ -1,65 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export * from "./ruleInput/.export.js";
-
-export {
-	makeAccessRuleHash,
-	transformAccessRuleRecordIntoRule,
-	transformAccessRuleIntoRecord,
-} from "./transformRule.js";
-
-export {
-	type AccessRule,
-	type AccessPolicy,
-	type PolicyScope,
-	type UserScope,
-	AccessPolicyType,
-} from "./rule.js";
-
-export { describeMatchedRule } from "./matchedRule.js";
-
-export { classifyOs, OS_NAMES, type OsName } from "./classifyOs.js";
-
-export {
-	classifyBrowser,
-	BROWSER_NAMES,
-	type BrowserName,
-} from "./classifyBrowser.js";
-
-export {
-	HEADER_OPERATORS,
-	type HeaderOperator,
-	HEADER_RULE_MARKER,
-	isHeaderOperator,
-	evaluateHeaderCondition,
-	accessRuleHeaderMatches,
-	encodeHeaderValueList,
-	decodeHeaderValueList,
-} from "./headerMatch.js";
-
-export {
-	type AccessRulesFilter,
-	type AccessRulesStorage,
-	type AccessRuleEntry,
-	FilterScopeMatch,
-} from "./rulesStorage.js";
-
-export {
-	type AccessRuleRecord,
-	type UserScopeRecord,
-	type UserScopeRecordField,
-	userScopeRecordFields,
-	getUserScopeRecordFromAccessRuleRecord,
-} from "./ruleRecord.js";

package/src/api/.export.ts

@@ -1,25 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export * from "./delete/.export.js";
-export * from "./read/.export.js";
-export * from "./write/.export.js";
-
-export {
-	accessRuleApiPaths,
-	getExpressApiRuleRateLimits,
-} from "./ruleApiRoutes.js";
-
-export { AccessRulesApiClient } from "./rulesApiClient.js";
-export { AccessRuleApiRoutes } from "./ruleApiRoutes.js";

package/src/api/accessRulesApiClient.ts

@@ -1,13 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.

package/src/api/delete/.export.ts

@@ -1,18 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export type {
-	DeleteSiteGroup,
-	DeleteSiteGroups,
-} from "./deleteRuleGroups.js";

package/src/api/delete/deleteAllRules.ts

@@ -1,47 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { Logger } from "@prosopo/logger";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-export class DeleteAllRulesEndpoint implements ApiEndpoint<undefined> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): undefined {}
-
-	async processRequest(logger?: Logger): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		const deletedCount = await this.accessRulesStorage.deleteAllRules();
-
-		log.info(() => ({
-			msg: "Endpoint deleted all access rules",
-			data: { deletedCount },
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				deleted_count: deletedCount,
-			},
-		};
-	}
-}

package/src/api/delete/deleteRuleGroups.ts

@@ -1,96 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import {
-	type AccessRulesStorage,
-	FilterScopeMatch,
-} from "#policy/rulesStorage.js";
-
-export type DeleteSiteGroup = {
-	clientIds: string[];
-	groupId: string;
-};
-
-export type DeleteSiteGroups = DeleteSiteGroup[];
-
-type DeleteRuleGroupsSchema = ZodType<DeleteSiteGroups>;
-
-export class DeleteRuleGroupsEndpoint
-	implements ApiEndpoint<DeleteRuleGroupsSchema>
-{
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): DeleteRuleGroupsSchema {
-		return z.array(
-			z.object({
-				clientIds: z.string().array(),
-				groupId: z.string(),
-			} satisfies AllKeys<DeleteSiteGroup>),
-		);
-	}
-
-	async processRequest(
-		args: DeleteSiteGroups,
-		logger?: Logger,
-	): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		const foundRuleIdPromises = args.flatMap((ruleToDelete) =>
-			ruleToDelete.clientIds.map((clientId) =>
-				this.accessRulesStorage.findRuleIds({
-					policyScope: {
-						clientId: clientId,
-					},
-					policyScopeMatch: FilterScopeMatch.Exact,
-					groupId: ruleToDelete.groupId,
-				}),
-			),
-		);
-
-		const foundRuleIds = await Promise.all(foundRuleIdPromises);
-		const ruleIds = foundRuleIds.flat();
-
-		// Set() automatically removes duplicates
-		const uniqueRuleIds = [...new Set(ruleIds)];
-
-		if (uniqueRuleIds.length > 0) {
-			await this.accessRulesStorage.deleteRules(uniqueRuleIds);
-		}
-
-		log.info(() => ({
-			msg: "Endpoint deleted rule groups",
-			data: {
-				args,
-				uniqueRuleIds,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				deleted_count: uniqueRuleIds.length,
-			},
-		};
-	}
-}

package/src/api/delete/deleteRules.ts

@@ -1,87 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import { executeBatchesSequentially } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import {
-	type AccessRulesFilterInput,
-	accessRulesFilterInput,
-	getAccessRuleFiltersFromInput,
-} from "#policy/ruleInput/ruleInput.js";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-// `unknown` input position — see accessRulesFilterInput's block comment
-// for why the strict-identity form doesn't fit here.
-type DeleteRulesSchema = ZodType<
-	AccessRulesFilterInput[],
-	z.ZodTypeDef,
-	unknown
->;
-
-export class DeleteRulesEndpoint implements ApiEndpoint<DeleteRulesSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): DeleteRulesSchema {
-		return z.array(accessRulesFilterInput);
-	}
-
-	async processRequest(
-		args: AccessRulesFilterInput[],
-		logger?: Logger,
-	): Promise<ApiEndpointResponse> {
-		const log = logger ?? this.logger;
-		let deletedCount = 0;
-
-		for (const rulesFilterInput of args) {
-			const ruleFilters = getAccessRuleFiltersFromInput(rulesFilterInput);
-
-			await executeBatchesSequentially(ruleFilters, async (ruleFilter) => {
-				const ruleIds = await this.accessRulesStorage.findRuleIds(ruleFilter);
-
-				// Set() automatically removes duplicates
-				const uniqueRuleIds = [...new Set(ruleIds)];
-
-				if (uniqueRuleIds.length > 0) {
-					await this.accessRulesStorage.deleteRules(uniqueRuleIds);
-
-					deletedCount += uniqueRuleIds.length;
-
-					log.info(() => ({
-						msg: "Endpoint deleted rules",
-						data: {
-							rulesFilterInput,
-							uniqueRuleIds,
-						},
-					}));
-				}
-			});
-		}
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				deleted_count: deletedCount,
-			},
-		};
-	}
-}

package/src/api/read/.export.ts

@@ -1,25 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export type {
-	RuleIdsResponse,
-	RuleIdsEndpointResponse,
-} from "./findRuleIds.js";
-
-export type {
-	FetchRulesOptions,
-	FetchRulesResponse,
-} from "./fetchRules.js";
-
-export type { MissingIds } from "./getMissingIds.js";

package/src/api/read/fetchRules.ts

@@ -1,96 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import { ruleEntryInput } from "#policy/ruleInput/ruleInput.js";
-import type {
-	AccessRuleEntry,
-	AccessRulesStorage,
-} from "#policy/rulesStorage.js";
-
-export type FetchRulesOptions = {
-	ids: string[];
-};
-
-type FetchRulesSchema = ZodType<FetchRulesOptions>;
-
-export type FetchRulesResponse = {
-	ruleEntries: AccessRuleEntry[];
-};
-
-// Explicit annotation with `unknown` input position rather than the
-// strict identity form because `ruleEntryInput.rule` transitively uses
-// `z.preprocess` on `deferToVerify`. Required for portable declaration
-// emit; the `AllKeys<...>` constraint still catches missing fields.
-export const fetchRulesResponse: ZodType<
-	FetchRulesResponse,
-	z.ZodTypeDef,
-	unknown
-> = z.object({
-	ruleEntries: ruleEntryInput.array(),
-} satisfies AllKeys<FetchRulesResponse>);
-
-export type FetchRulesEndpointResponse = ApiEndpointResponse & {
-	data?: FetchRulesResponse;
-};
-
-export class FetchRulesEndpoint implements ApiEndpoint<FetchRulesSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): FetchRulesSchema {
-		return z.object({
-			ids: z.string().array(),
-		} satisfies AllKeys<FetchRulesOptions>);
-	}
-
-	async processRequest(
-		args: FetchRulesOptions,
-		logger?: Logger,
-	): Promise<FetchRulesEndpointResponse> {
-		const log = logger ?? this.logger;
-		const ruleEntries = await this.accessRulesStorage.fetchRules(args.ids);
-
-		log.info(() => ({
-			msg: "Endpoint fetched rules",
-			data: {
-				requestedCount: args.ids.length,
-				foundCount: ruleEntries.length,
-			},
-		}));
-
-		log.debug(() => ({
-			msg: "Fetched rule details",
-			data: {
-				ruleEntries: ruleEntries,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				ruleEntries: ruleEntries,
-			},
-		};
-	}
-}

package/src/api/read/findRuleIds.ts

@@ -1,97 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import { type AllKeys, executeBatchesSequentially } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import {
-	type AccessRulesFilterInput,
-	accessRulesFilterInput,
-	getAccessRuleFiltersFromInput,
-} from "#policy/ruleInput/ruleInput.js";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-// `unknown` input position — see accessRulesFilterInput's block comment
-// for why the strict-identity form doesn't fit here.
-type FindRulesSchema = ZodType<AccessRulesFilterInput[], z.ZodTypeDef, unknown>;
-
-export type RuleIdsResponse = {
-	ruleIds: string[];
-};
-
-export const ruleIdsResponse = z.object({
-	ruleIds: z.string().array(),
-} satisfies AllKeys<RuleIdsResponse>) satisfies ZodType<RuleIdsResponse>;
-
-export type RuleIdsEndpointResponse = ApiEndpointResponse & {
-	data?: RuleIdsResponse;
-};
-
-export class FindRuleIdsEndpoint implements ApiEndpoint<FindRulesSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): FindRulesSchema {
-		return z.array(accessRulesFilterInput);
-	}
-
-	async processRequest(
-		args: AccessRulesFilterInput[],
-		logger?: Logger,
-	): Promise<RuleIdsEndpointResponse> {
-		const log = logger ?? this.logger;
-		const ruleIdBatches = await executeBatchesSequentially(
-			args,
-			async (rulesFilterInput) => {
-				const ruleFilters = getAccessRuleFiltersFromInput(rulesFilterInput);
-
-				const ruleIds = await executeBatchesSequentially(
-					ruleFilters,
-					(ruleFilter) => this.accessRulesStorage.findRuleIds(ruleFilter),
-				);
-
-				return ruleIds.flat();
-			},
-		);
-
-		const ruleIds = ruleIdBatches.flat();
-
-		// Set() automatically removes duplicates
-		const uniqueRuleIds = [...new Set(ruleIds)];
-
-		log.info(() => ({
-			msg: "Endpoint found rules",
-			data: {
-				totalFoundCount: ruleIds.length,
-				uniqueFoundCount: uniqueRuleIds.length,
-				searchFilters: args,
-				foundIds: uniqueRuleIds,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				ruleIds: uniqueRuleIds,
-			},
-		};
-	}
-}

package/src/api/read/getMissingIds.ts

@@ -1,81 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import {
-	type ApiEndpoint,
-	type ApiEndpointResponse,
-	ApiEndpointResponseStatus,
-} from "@prosopo/api-route";
-import type { AllKeys } from "@prosopo/common";
-import type { Logger } from "@prosopo/logger";
-import { type ZodType, z } from "zod";
-import type { AccessRulesStorage } from "#policy/rulesStorage.js";
-
-export type MissingIds = string[];
-
-type MissingIdsSchema = ZodType<MissingIds>;
-
-export type MissingIdsResponse = {
-	ids: string[];
-};
-
-export const missingIdsResponse = z.object({
-	ids: z.string().array(),
-} satisfies AllKeys<MissingIdsResponse>) satisfies ZodType<MissingIdsResponse>;
-
-export type MissingIdsEndpointResponse = ApiEndpointResponse & {
-	data?: MissingIdsResponse;
-};
-
-export class GetMissingIdsEndpoint implements ApiEndpoint<MissingIdsSchema> {
-	public constructor(
-		private readonly accessRulesStorage: AccessRulesStorage,
-		private readonly logger: Logger,
-	) {}
-
-	public getRequestArgsSchema(): MissingIdsSchema {
-		return z.string().array();
-	}
-
-	async processRequest(
-		args: MissingIds,
-		logger?: Logger,
-	): Promise<MissingIdsEndpointResponse> {
-		const log = logger ?? this.logger;
-		const missingIds = await this.accessRulesStorage.getMissingRuleIds(args);
-
-		log.info(() => ({
-			msg: "Endpoint checked missing ids",
-			data: {
-				idsToCheck: args.length,
-				missingIds: missingIds.length,
-			},
-		}));
-
-		log.debug(() => ({
-			msg: "Missing id details",
-			data: {
-				idsToCheck: args,
-				missingIds: missingIds,
-			},
-		}));
-
-		return {
-			status: ApiEndpointResponseStatus.SUCCESS,
-			data: {
-				ids: missingIds,
-			},
-		};
-	}
-}