@prosopo/user-access-policy 3.15.7 → 3.15.8

package/dist/tsc/redis/reader/redisRulesSplitQuery.js

@@ -0,0 +1,95 @@
+import { getBlockPoolClause } from "#policy/redis/reader/redisRulesQuery.js";
+import { GLOBAL_CLIENT_SCOPE_SENTINEL } from "#policy/rule.js";
+const escapeTagValue = (value) => value.replace(/([,.<>{}\[\]"':;!@#$%^&*()\-+=~|/\\])/g, "\\$1");
+const FIELDS_REQUIRING_ESCAPE = new Set([
+    "coords",
+]);
+const NUMERIC_FIELDS = new Set(["asn"]);
+const SCALAR_USER_SCOPE_FIELDS = [
+    "userId",
+    "ja4Hash",
+    "headersHash",
+    "userAgentHash",
+    "headHash",
+    "coords",
+    "countryCode",
+    "asn",
+    "os",
+    "browser",
+];
+const ALL_USER_SCOPE_FIELDS = [
+    ...SCALAR_USER_SCOPE_FIELDS,
+    "numericIp",
+    "numericIpMaskMin",
+    "numericIpMaskMax",
+];
+const GLOBAL_SCOPE_INNER = `@clientId:{${GLOBAL_CLIENT_SCOPE_SENTINEL}} | ismissing(@clientId)`;
+const buildScopeClause = (clientId) => {
+    if (clientId === undefined) {
+        return `( ${GLOBAL_SCOPE_INNER} )`;
+    }
+    return `( @clientId:{${clientId}} | ${GLOBAL_SCOPE_INNER} )`;
+};
+const buildFieldClause = (field, value) => {
+    if (value === undefined) {
+        return null;
+    }
+    const stringValue = String(value);
+    if (NUMERIC_FIELDS.has(field)) {
+        return `@${field}:[${stringValue} ${stringValue}]`;
+    }
+    const queryValue = FIELDS_REQUIRING_ESCAPE.has(field)
+        ? escapeTagValue(stringValue)
+        : stringValue;
+    return `@${field}:{${queryValue}}`;
+};
+export const buildScopedRulesSubQueries = (userScope, clientId, options = {}) => {
+    const scopeClause = buildScopeClause(clientId);
+    const typePools = options.blockOnly
+        ? options.includeDeferred === true
+            ? [
+                { tag: "block", clause: `${getBlockPoolClause(false)} ` },
+                { tag: "deferred", clause: "@deferToVerify:{true} " },
+            ]
+            : [{ tag: "", clause: `${getBlockPoolClause(false)} ` }]
+        : [{ tag: "", clause: "" }];
+    const subQueries = [];
+    for (const pool of typePools) {
+        const prefix = `${pool.clause}${scopeClause}`;
+        const label = pool.tag === "" ? "" : `${pool.tag}:`;
+        subQueries.push(...buildProbes(userScope, prefix, label));
+    }
+    return subQueries;
+};
+const buildProbes = (userScope, prefix, label) => {
+    const subQueries = [];
+    for (const field of SCALAR_USER_SCOPE_FIELDS) {
+        const clause = buildFieldClause(field, userScope[field]);
+        if (clause === null) {
+            continue;
+        }
+        subQueries.push({
+            kind: `${label}field:${field}`,
+            query: `${prefix} ${clause}`,
+        });
+    }
+    const requestIp = userScope.numericIp;
+    if (requestIp !== undefined) {
+        subQueries.push({
+            kind: `${label}ip:exact`,
+            query: `${prefix} @numericIp:[${requestIp} ${requestIp}]`,
+        });
+        subQueries.push({
+            kind: `${label}ip:mask`,
+            query: `${prefix} @numericIpMaskMin:[-inf ${requestIp}] @numericIpMaskMax:[${requestIp} +inf]`,
+        });
+    }
+    const noScopeIsmissing = ALL_USER_SCOPE_FIELDS.map((field) => `ismissing(@${field})`).join(" ");
+    subQueries.push({
+        kind: `${label}no-user-scope`,
+        query: `${prefix} ${noScopeIsmissing}`,
+    });
+    return subQueries;
+};
+export const buildScopedBlockSubQueries = (userScope, clientId) => buildScopedRulesSubQueries(userScope, clientId, { blockOnly: true });
+//# sourceMappingURL=redisRulesSplitQuery.js.map

package/dist/tsc/redis/reader/redisRulesSplitQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesSplitQuery.js","sourceRoot":"","sources":["../../../../src/redis/reader/redisRulesSplitQuery.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAkB,MAAM,iBAAiB,CAAC;AAK/E,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAChD,KAAK,CAAC,OAAO,CAAC,wCAAwC,EAAE,MAAM,CAAC,CAAC;AAGjE,MAAM,uBAAuB,GAAiC,IAAI,GAAG,CAAC;IACrE,QAAQ;CACR,CAAC,CAAC;AAGH,MAAM,cAAc,GAAiC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAKtE,MAAM,wBAAwB,GAAmC;IAChE,QAAQ;IACR,SAAS;IACT,aAAa;IACb,eAAe;IACf,UAAU;IACV,QAAQ;IACR,aAAa;IACb,KAAK;IACL,IAAI;IACJ,SAAS;CACT,CAAC;AAEF,MAAM,qBAAqB,GAAmC;IAC7D,GAAG,wBAAwB;IAC3B,WAAW;IACX,kBAAkB;IAClB,kBAAkB;CAClB,CAAC;AAOF,MAAM,kBAAkB,GAAG,cAAc,4BAA4B,0BAA0B,CAAC;AAMhG,MAAM,gBAAgB,GAAG,CAAC,QAA4B,EAAU,EAAE;IACjE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,kBAAkB,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,gBAAgB,QAAQ,OAAO,kBAAkB,IAAI,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACxB,KAAsB,EACtB,KAAc,EACE,EAAE;IAClB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,KAAK,KAAK,WAAW,IAAI,WAAW,GAAG,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC;QACpD,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC;QAC7B,CAAC,CAAC,WAAW,CAAC;IACf,OAAO,IAAI,KAAK,KAAK,UAAU,GAAG,CAAC;AACpC,CAAC,CAAC;AA0CF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,SAAoB,EACpB,QAA4B,EAC5B,UAA8D,EAAE,EACnD,EAAE;IACf,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAoB/C,MAAM,SAAS,GAA2C,OAAO,CAAC,SAAS;QAC1E,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;YACjC,CAAC,CAAC;gBACA,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzD,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE;aACrD;YACF,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAE7B,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CACnB,SAAoB,EACpB,MAAc,EACd,KAAa,EACA,EAAE;IACf,MAAM,UAAU,GAAe,EAAE,CAAC;IAKlC,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS;QACV,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,GAAG,KAAK,SAAS,KAAK,EAAE;YAC9B,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,EAAE;SAC5B,CAAC,CAAC;IACJ,CAAC;IASD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,GAAG,KAAK,UAAU;YACxB,KAAK,EAAE,GAAG,MAAM,gBAAgB,SAAS,IAAI,SAAS,GAAG;SACzD,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,GAAG,KAAK,SAAS;YACvB,KAAK,EAAE,GAAG,MAAM,4BAA4B,SAAS,wBAAwB,SAAS,QAAQ;SAC9F,CAAC,CAAC;IACJ,CAAC;IAMD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,GAAG,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,KAAK,GAAG,CACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,UAAU,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,GAAG,KAAK,eAAe;QAC7B,KAAK,EAAE,GAAG,MAAM,IAAI,gBAAgB,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACnB,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,SAAoB,EACpB,QAA4B,EACf,EAAE,CACf,0BAA0B,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/tsc/redis/redisClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisClient.d.ts","sourceRoot":"","sources":["../../../src/redis/redisClient.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,UAAU,EAAK,MAAM,KAAK,CAAC;AAEvD,eAAO,MAAM,gBAAgB,OAAQ,CAAC;AAEtC,eAAO,MAAM,mBAAmB,WACvB,eAAe,QACjB,MAAM,EAAE,KACZ,OAAO,CAAC,MAAM,EAAE,CAsBlB,CAAC;AAEF,eAAO,MAAM,qBAAqB,WACzB,eAAe,QACjB,MAAM,EAAE,UACN,MAAM,KACZ,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAA;CAAE,CAgBpE,CAAC;AAOF,eAAO,MAAM,iBAAiB,GAAI,CAAC,WACzB,OAAO,EAAE,gBACJ,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UACrC,MAAM,KACZ,CAAC,EAcD,CAAC"}

package/dist/tsc/redis/redisClient.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+export const REDIS_BATCH_SIZE = 1_000;
+export const getMissingRedisKeys = async (client, keys) => {
+    const queries = client.multi();
+    keys.map((key) => {
+        queries.exists(key);
+    });
+    const records = await queries.exec();
+    const missingKeys = [];
+    records.map((exists, recordIndex) => {
+        if ("0" === String(exists)) {
+            const key = keys[recordIndex];
+            if (key) {
+                missingKeys.push(key);
+            }
+        }
+    });
+    return missingKeys;
+};
+export const fetchRedisHashRecords = async (client, keys, logger) => {
+    const rulesPipe = client.multi();
+    const expirationPipe = client.multi();
+    for (const key of keys) {
+        rulesPipe.hGetAll(key);
+        expirationPipe.expireTime(key);
+    }
+    const records = (await rulesPipe.exec());
+    const expirationRecords = (await expirationPipe.exec());
+    return {
+        records: records,
+        expirations: parseExpirationRecords(expirationRecords, logger),
+    };
+};
+export const parseRedisRecords = (records, recordSchema, logger) => records.flatMap((record) => {
+    const parseResult = recordSchema.safeParse(record);
+    if (parseResult.success) {
+        return [parseResult.data];
+    }
+    logger.error(() => ({
+        msg: "Failed to parse Redis record",
+        data: { record, error: parseResult.error },
+    }));
+    return [];
+});
+const expirationRecordSchema = z.coerce.number();
+const UNSET_EXPIRATION_VALUE = -1;
+const parseExpirationRecords = (records, logger) => records.flatMap((record) => {
+    const parseResult = expirationRecordSchema.safeParse(record);
+    if (parseResult.success) {
+        const expiration = UNSET_EXPIRATION_VALUE === parseResult.data
+            ? undefined
+            : parseResult.data;
+        return [expiration];
+    }
+    logger.error(() => ({
+        msg: "Failed to parse Redis expiration record",
+        data: {
+            record,
+            error: parseResult.error,
+        },
+    }));
+    return [undefined];
+});
+//# sourceMappingURL=redisClient.js.map

package/dist/tsc/redis/redisClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisClient.js","sourceRoot":"","sources":["../../../src/redis/redisClient.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAiC,CAAC,EAAE,MAAM,KAAK,CAAC;AAEvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACvC,MAAuB,EACvB,IAAc,EACM,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAE/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAc,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QACnC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;YAE9B,IAAI,GAAG,EAAE,CAAC;gBACT,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACzC,MAAuB,EACvB,IAAc,EACd,MAAc,EACwD,EAAE;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAa,CAAC;IACrD,MAAM,iBAAiB,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAc,CAAC;IAErE,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,CAAC;KAC9D,CAAC;AACH,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAChC,OAAkB,EAClB,YAA6C,EAC7C,MAAc,EACR,EAAE,CACR,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IAC1B,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACnB,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE;KAC1C,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,CAAC;AACX,CAAC,CAAC,CAAC;AAEJ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AAEjD,MAAM,sBAAsB,GAAG,CAAC,CAAC,CAAC;AAElC,MAAM,sBAAsB,GAAG,CAC9B,OAAkB,EAClB,MAAc,EACW,EAAE,CAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IAC1B,MAAM,WAAW,GAAG,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE7D,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GACf,sBAAsB,KAAK,WAAW,CAAC,IAAI;YAC1C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;QAErB,OAAO,CAAC,UAAU,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACnB,GAAG,EAAE,yCAAyC;QAC9C,IAAI,EAAE;YACL,MAAM;YACN,KAAK,EAAE,WAAW,CAAC,KAAK;SACxB;KACD,CAAC,CAAC,CAAC;IAGJ,OAAO,CAAC,SAAS,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/tsc/redis/redisRuleIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRuleIndex.d.ts","sourceRoot":"","sources":["../../../src/redis/redisRuleIndex.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,KAAK,gBAAgB,EAAqB,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EACX,UAAU,EAKV,MAAM,iBAAiB,CAAC;AAGzB,eAAO,MAAM,iBAAiB,EAAE,gBAIL,CAAC;AAE5B,eAAO,MAAM,yBAAyB,EAAE,gBA0BL,CAAC;AAEpC,eAAO,MAAM,oBAAoB,EAAE,gBAGR,CAAC;AAE5B,eAAO,MAAM,sBAAsB,EAAE,gBAKL,CAAC;AAUjC,eAAO,MAAM,qBAAqB,EAAE,gBAiBR,CAAC;AAE7B,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAGvE,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAMnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE/D,eAAO,MAAM,qBAAqB,EAAE,UAOnC,CAAC;AAEF,eAAO,MAAM,qBAAqB,SAAU,UAAU,KAAG,MACD,CAAC"}

package/dist/tsc/redis/redisRuleIndex.js

@@ -0,0 +1,54 @@
+import { SCHEMA_FIELD_TYPE } from "@redis/search";
+import { makeAccessRuleHash } from "#policy/transformRule.js";
+export const userIpRedisSchema = {
+    numericIpMaskMin: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+    numericIpMaskMax: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+    numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+};
+export const userAttributesRedisSchema = {
+    userId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    ja4Hash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headersHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    userAgentHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    coords: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true, SEPARATOR: "|" },
+    countryCode: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    asn: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+    os: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    browser: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headerMatch: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headerName: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headerValue: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headerOperator: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    webBotAuthAgent: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+};
+export const userScopeRedisSchema = {
+    ...userAttributesRedisSchema,
+    ...userIpRedisSchema,
+};
+export const policyScopeRedisSchema = {
+    clientId: {
+        type: SCHEMA_FIELD_TYPE.TAG,
+        INDEXMISSING: true,
+    },
+};
+export const accessRuleRedisSchema = {
+    ...policyScopeRedisSchema,
+    ...userScopeRedisSchema,
+    groupId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    type: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    deferToVerify: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+};
+export const ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
+export const ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
+export { GLOBAL_CLIENT_SCOPE_SENTINEL } from "#policy/rule.js";
+export const accessRulesRedisIndex = {
+    name: ACCESS_RULES_REDIS_INDEX_NAME,
+    schema: accessRuleRedisSchema,
+    options: {
+        ON: "HASH",
+        PREFIX: [ACCESS_RULE_REDIS_KEY_PREFIX],
+    },
+};
+export const getAccessRuleRedisKey = (rule) => ACCESS_RULE_REDIS_KEY_PREFIX + makeAccessRuleHash(rule);
+//# sourceMappingURL=redisRuleIndex.js.map

package/dist/tsc/redis/redisRuleIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRuleIndex.js","sourceRoot":"","sources":["../../../src/redis/redisRuleIndex.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAyB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAQzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IAClD,gBAAgB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;IACzE,gBAAgB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;IACzE,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;CACxC,CAAC;AAE5B,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAC3D,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAChE,aAAa,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAClE,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAE7D,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;IAC3E,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAChE,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;IAC5D,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IACvD,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAU5D,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAChE,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAC/D,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAChE,cAAc,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IACnE,eAAe,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;CAClC,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAqB;IACrD,GAAG,yBAAyB;IAC5B,GAAG,iBAAiB;CACM,CAAC;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAqB;IACvD,QAAQ,EAAE;QACT,IAAI,EAAE,iBAAiB,CAAC,GAAG;QAC3B,YAAY,EAAE,IAAI;KAClB;CAC8B,CAAC;AAUjC,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACtD,GAAG,sBAAsB;IACzB,GAAG,oBAAoB;IACvB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAM5D,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAOzD,aAAa,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;CACvC,CAAC;AAE7B,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAGvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAMnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAe;IAChD,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE;QACR,EAAE,EAAE,MAAe;QACnB,MAAM,EAAE,CAAC,4BAA4B,CAAC;KACtC;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAgB,EAAU,EAAE,CACjE,4BAA4B,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC"}

package/dist/tsc/redis/redisRulesStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesStorage.d.ts","sourceRoot":"","sources":["../../../src/redis/redisRulesStorage.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAEX,kBAAkB,EAElB,MAAM,yBAAyB,CAAC;AAOjC,eAAO,MAAM,6BAA6B,eAC7B,eAAe,UACnB,MAAM,KACZ,kBAqBF,CAAC"}

package/dist/tsc/redis/redisRulesStorage.js

@@ -0,0 +1,24 @@
+import { DummyRedisRulesReader, RedisRulesReader, } from "./reader/redisRulesReader.js";
+import { DummyRedisRulesWriter, RedisRulesWriter } from "./redisRulesWriter.js";
+export const createRedisAccessRulesStorage = (connection, logger) => {
+    const storage = composeStorage(new DummyRedisRulesReader(logger), new DummyRedisRulesWriter(logger));
+    connection.getClient().then((client) => {
+        const realStorage = composeStorage(new RedisRulesReader(client, logger), new RedisRulesWriter(client, logger));
+        Object.assign(storage, realStorage);
+        logger.info(() => ({
+            msg: "RedisAccessRules storage got a ready Redis client",
+        }));
+    });
+    return storage;
+};
+const composeStorage = (reader, writer) => ({
+    fetchRules: reader.fetchRules.bind(reader),
+    getMissingRuleIds: reader.getMissingRuleIds.bind(reader),
+    findRules: reader.findRules.bind(reader),
+    findRuleIds: reader.findRuleIds.bind(reader),
+    fetchAllRuleIds: reader.fetchAllRuleIds.bind(reader),
+    insertRules: writer.insertRules.bind(writer),
+    deleteRules: writer.deleteRules.bind(writer),
+    deleteAllRules: writer.deleteAllRules.bind(writer),
+});
+//# sourceMappingURL=redisRulesStorage.js.map

package/dist/tsc/redis/redisRulesStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesStorage.js","sourceRoot":"","sources":["../../../src/redis/redisRulesStorage.ts"],"names":[],"mappings":"AAqBA,OAAO,EACN,qBAAqB,EACrB,gBAAgB,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEhF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,UAA2B,EAC3B,MAAc,EACO,EAAE;IACvB,MAAM,OAAO,GAAuB,cAAc,CACjD,IAAI,qBAAqB,CAAC,MAAM,CAAC,EACjC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CACjC,CAAC;IAEF,UAAU,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,MAAM,WAAW,GAAG,cAAc,CACjC,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CACpC,CAAC;QAGF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,GAAG,EAAE,mDAAmD;SACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACtB,MAAyB,EACzB,MAAyB,EACJ,EAAE,CAAC,CAAC;IAEzB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;IAEpD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;IAC5C,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;CAClD,CAAC,CAAC"}

package/dist/tsc/redis/redisRulesWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesWriter.d.ts","sourceRoot":"","sources":["../../../src/redis/redisRulesWriter.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,iBAAiB,CAAC;AAChF,OAAO,KAAK,EACX,eAAe,EACf,iBAAiB,EACjB,MAAM,yBAAyB,CAAC;AASjC,qBAAa,gBAAiB,YAAW,iBAAiB;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM;IAG1B,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAa9D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;cAsBvB,iBAAiB,CAChC,WAAW,EAAE,eAAe,EAAE,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC;CAqCpB;AAED,eAAO,MAAM,iBAAiB,SAAU,UAAU,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAyBzE,CAAC;AAEF,qBAAa,qBAAsB,YAAW,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAErC,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAW9D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAOvC"}

package/dist/tsc/redis/redisRulesWriter.js

@@ -0,0 +1,112 @@
+import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
+import { REDIS_BATCH_SIZE } from "#policy/redis/redisClient.js";
+import { GLOBAL_CLIENT_SCOPE_SENTINEL } from "#policy/rule.js";
+import { ACCESS_RULE_REDIS_KEY_PREFIX, getAccessRuleRedisKey, } from "./redisRuleIndex.js";
+const EXCLUDED_CLIENT_IDS_FIELD = "excludedClientIds";
+export class RedisRulesWriter {
+    constructor(client, logger) {
+        this.client = client;
+        this.logger = logger;
+    }
+    async insertRules(ruleEntries) {
+        const entryBatches = chunkIntoBatches(ruleEntries, REDIS_BATCH_SIZE);
+        const keyBatches = await executeBatchesSequentially(entryBatches, async (entriesBatch) => this.insertRuleEntries(entriesBatch));
+        return keyBatches.flatMap((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+    }
+    async deleteRules(ruleIds) {
+        const ruleKeys = ruleIds.map((ruleId) => ACCESS_RULE_REDIS_KEY_PREFIX + ruleId);
+        const keyBatches = chunkIntoBatches(ruleKeys, REDIS_BATCH_SIZE);
+        await executeBatchesSequentially(keyBatches, async (keysBatch) => {
+            const queries = this.client.multi();
+            for (const ruleKey of keysBatch) {
+                queries.del(ruleKey);
+            }
+            await queries.exec();
+        });
+    }
+    async deleteAllRules() {
+        let cursor = "0";
+        let total = 0;
+        do {
+            const reply = await this.client.scan(cursor, {
+                MATCH: `${ACCESS_RULE_REDIS_KEY_PREFIX}*`,
+                COUNT: REDIS_BATCH_SIZE,
+            });
+            const ids = reply.keys.map((key) => key.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+            await this.deleteRules(ids);
+            total += ids.length;
+            cursor = reply.cursor;
+        } while ("0" !== cursor);
+        return total;
+    }
+    async insertRuleEntries(ruleEntries) {
+        const queries = this.client.multi();
+        const ruleKeys = ruleEntries.map((ruleEntry) => {
+            const { rule, expiresUnixTimestamp } = ruleEntry;
+            const ruleKey = getAccessRuleRedisKey(rule);
+            const ruleValue = getRedisRuleValue(rule);
+            queries.hSet(ruleKey, ruleValue);
+            if (ruleValue.excludedClientIds === undefined) {
+                queries.hDel(ruleKey, EXCLUDED_CLIENT_IDS_FIELD);
+            }
+            if (expiresUnixTimestamp) {
+                const MILLISECOND_THRESHOLD = 10_000_000_000;
+                if (expiresUnixTimestamp > MILLISECOND_THRESHOLD) {
+                    throw new Error(`Invalid expiry timestamp: ${expiresUnixTimestamp}. Timestamp must be in seconds, not milliseconds.`);
+                }
+                queries.expireAt(ruleKey, expiresUnixTimestamp);
+            }
+            return ruleKey;
+        });
+        await queries.exec();
+        return ruleKeys;
+    }
+}
+export const getRedisRuleValue = (rule) => {
+    const record = {};
+    for (const [key, value] of Object.entries(rule)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (Array.isArray(value)) {
+            if (value.length > 0) {
+                record[key] = value.join(",");
+            }
+            continue;
+        }
+        record[key] = String(value);
+    }
+    if (record.clientId === undefined) {
+        record.clientId = GLOBAL_CLIENT_SCOPE_SENTINEL;
+    }
+    return record;
+};
+export class DummyRedisRulesWriter {
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async insertRules(ruleEntries) {
+        this.logger.info(() => ({
+            msg: "Dummy insertRules() has no effect (redis is not ready)",
+            data: {
+                ruleEntries,
+            },
+        }));
+        return [];
+    }
+    async deleteRules(ruleIds) {
+        this.logger.info(() => ({
+            msg: "Dummy deleteRules() has no effect (redis is not ready)",
+            data: {
+                ruleIds,
+            },
+        }));
+    }
+    async deleteAllRules() {
+        this.logger.info(() => ({
+            msg: "Dummy deleteAllRules() has no effect (redis is not ready)",
+        }));
+        return 0;
+    }
+}
+//# sourceMappingURL=redisRulesWriter.js.map

package/dist/tsc/redis/redisRulesWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesWriter.js","sourceRoot":"","sources":["../../../src/redis/redisRulesWriter.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAG/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAmB,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAKhF,OAAO,EACN,4BAA4B,EAC5B,qBAAqB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,yBAAyB,GAC9B,mBAA8C,CAAC;AAEhD,MAAM,OAAO,gBAAgB;IAC5B,YACkB,MAAuB,EACvB,MAAc;QADd,WAAM,GAAN,MAAM,CAAiB;QACvB,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,WAA8B;QAC/C,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAErE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAClD,YAAY,EACZ,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAC5D,CAAC;QAEF,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACrC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAiB;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,GAAG,MAAM,CACjD,CAAC;QAEF,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAEhE,MAAM,0BAA0B,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAChE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAEpC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QACnB,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,GAAG,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC5C,KAAK,EAAE,GAAG,4BAA4B,GAAG;gBACzC,KAAK,EAAE,gBAAgB;aACvB,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAC9C,CAAC;YACF,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAE5B,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,CAAC,QAAQ,GAAG,KAAK,MAAM,EAAE;QAEzB,OAAO,KAAK,CAAC;IACd,CAAC;IAES,KAAK,CAAC,iBAAiB,CAChC,WAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,SAAS,CAAC;YAEjD,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAE1C,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAIjC,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,oBAAoB,EAAE,CAAC;gBAI1B,MAAM,qBAAqB,GAAG,cAAc,CAAC;gBAC7C,IAAI,oBAAoB,GAAG,qBAAqB,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CACd,6BAA6B,oBAAoB,mDAAmD,CACpG,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAErB,OAAO,QAAQ,CAAC;IACjB,CAAC;CACD;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAgB,EAA0B,EAAE;IAC7E,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAG1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YACD,SAAS;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAMD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,QAAQ,GAAG,4BAA4B,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,qBAAqB;IACjC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,WAAW,CAAC,WAA8B;QAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,wDAAwD;YAC7D,IAAI,EAAE;gBACL,WAAW;aACX;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAiB;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,wDAAwD;YAC7D,IAAI,EAAE;gBACL,OAAO;aACP;SACD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,2DAA2D;SAChE,CAAC,CAAC,CAAC;QAEJ,OAAO,CAAC,CAAC;IACV,CAAC;CACD"}

package/dist/tsc/rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../src/rule.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhE,oBAAY,gBAAgB;IAC3B,KAAK,UAAU;IACf,QAAQ,aAAa;IASrB,KAAK,UAAU;CACf;AAYD,eAAO,MAAM,4BAA4B,WAAW,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAY3B,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,UAAU,CAAC,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAInC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IAUjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAOxB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;AAGhD,MAAM,MAAM,UAAU,GAAG,YAAY,GACpC,WAAW,GACX,qBAAqB,GACrB,SAAS,GAAG;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC"}

package/dist/tsc/rule.js

@@ -0,0 +1,8 @@
+export var AccessPolicyType;
+(function (AccessPolicyType) {
+    AccessPolicyType["Block"] = "block";
+    AccessPolicyType["Restrict"] = "restrict";
+    AccessPolicyType["Allow"] = "allow";
+})(AccessPolicyType || (AccessPolicyType = {}));
+export const GLOBAL_CLIENT_SCOPE_SENTINEL = "global";
+//# sourceMappingURL=rule.js.map

package/dist/tsc/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../src/rule.ts"],"names":[],"mappings":"AAeA,MAAM,CAAN,IAAY,gBAYX;AAZD,WAAY,gBAAgB;IAC3B,mCAAe,CAAA;IACf,yCAAqB,CAAA;IASrB,mCAAe,CAAA;AAChB,CAAC,EAZW,gBAAgB,KAAhB,gBAAgB,QAY3B;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC"}

package/dist/tsc/ruleInput/.export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/tsc/ruleInput/.export.js

@@ -0,0 +1,4 @@
+export { accessRuleInput } from "./ruleInput.js";
+export { accessPolicyInput, policyScopeInput } from "./policyInput.js";
+export { userScopeInput } from "./userScopeInput.js";
+//# sourceMappingURL=.export.js.map

package/dist/tsc/ruleInput/.export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.js","sourceRoot":"","sources":["../../../src/ruleInput/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,eAAe,EAA+B,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/tsc/ruleInput/policyInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyInput.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAA+B,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAwBzB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBD,CAAC;AAEnC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB7B,CAAC;AAOF,eAAO,MAAM,oBAAoB,WAAY,YAAY,KAAG,YAM3D,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAUI,CAAC;AAalC,eAAO,MAAM,0BAA0B;;;;;;EAYI,CAAC"}

package/dist/tsc/ruleInput/policyInput.js

@@ -0,0 +1,60 @@
+import { ResultReason, SelectableCaptchaTypeSchema } from "@prosopo/types";
+import { z } from "zod";
+import { AccessPolicyType, GLOBAL_CLIENT_SCOPE_SENTINEL, } from "#policy/rule.js";
+export const accessPolicyInputShape = z.object({
+    type: z.nativeEnum(AccessPolicyType),
+    captchaType: SelectableCaptchaTypeSchema.optional(),
+    description: z.coerce.string().optional(),
+    solvedImagesCount: z.coerce.number().optional(),
+    imageThreshold: z.coerce.number().optional(),
+    powDifficulty: z.coerce.number().optional(),
+    unsolvedImagesCount: z.coerce.number().optional(),
+    frictionlessScore: z.coerce.number().optional(),
+    deferToVerify: z
+        .preprocess((v) => (typeof v === "string" ? v === "true" : v), z.boolean())
+        .optional(),
+    messageKey: z.nativeEnum(ResultReason).optional(),
+});
+export const accessPolicyInput = accessPolicyInputShape.superRefine((policy, ctx) => {
+    if (policy.type !== AccessPolicyType.Block)
+        return;
+    if (policy.captchaType !== undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["captchaType"],
+            message: "Block policies cannot pin a captchaType — Block always applies to every captcha type. Use a Restrict policy if you want to narrow the effect to one captcha type.",
+        });
+    }
+    if (policy.solvedImagesCount !== undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["solvedImagesCount"],
+            message: "Block policies cannot set solvedImagesCount — the field only applies to Restrict policies that adjust image-captcha rounds.",
+        });
+    }
+});
+export const sanitizeAccessPolicy = (policy) => {
+    if (policy.type === AccessPolicyType.Block) {
+        const { captchaType, solvedImagesCount, ...blockPolicy } = policy;
+        return blockPolicy;
+    }
+    return policy;
+};
+export const policyScopeInput = z.object({
+    clientId: z.preprocess((v) => (v === GLOBAL_CLIENT_SCOPE_SENTINEL ? undefined : v), z.coerce.string().optional()),
+});
+const toClientIdList = (value) => {
+    const list = typeof value === "string"
+        ? value.split(",").filter((id) => id.length > 0)
+        : value;
+    return Array.isArray(list) && list.length === 0 ? undefined : list;
+};
+export const policyScopeExclusionsInput = z.object({
+    excludedClientIds: z.preprocess(toClientIdList, z
+        .array(z
+        .string()
+        .min(1)
+        .regex(/^[^,]+$/, "Client ids cannot contain a comma."))
+        .optional()),
+});
+//# sourceMappingURL=policyInput.js.map

package/dist/tsc/ruleInput/policyInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyInput.js","sourceRoot":"","sources":["../../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEN,gBAAgB,EAChB,4BAA4B,GAG5B,MAAM,iBAAiB,CAAC;AAwBzB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAI/C,aAAa,EAAE,CAAC;SACd,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC1E,QAAQ,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CACjB,CAAC,CAAC;AAEnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,WAAW,CAClE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACf,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO;IACnD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACN,mKAAmK;SACpK,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EACN,6HAA6H;SAC9H,CAAC,CAAC;IACJ,CAAC;AACF,CAAC,CACD,CAAC;AAOF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAoB,EAAgB,EAAE;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC;QAClE,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAMxC,QAAQ,EAAE,CAAC,CAAC,UAAU,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAC5B;CAC8B,CAAC,CAAC;AAKlC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE;IAClD,MAAM,IAAI,GACT,OAAO,KAAK,KAAK,QAAQ;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC;IACV,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,CAAC,CAAC,UAAU,CAC9B,cAAc,EACd,CAAC;SACC,KAAK,CACL,CAAC;SACC,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,SAAS,EAAE,oCAAoC,CAAC,CACxD;SACA,QAAQ,EAAE,CACZ;CACwC,CAAC,CAAC"}

package/dist/tsc/ruleInput/ruleInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleInput.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,qBAAqB,EACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,KAAK,cAAc,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,YAAY,GACzC,WAAW,GACX,qBAAqB,GACrB,cAAc,GACd,cAAc,CAAC;AA6BhB,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAQL,CAAC;AAEnE,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAIrC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACxD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAQF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaS,CAAC;AAE7C,eAAO,MAAM,6BAA6B,gBAC5B,sBAAsB,KACjC,iBAAiB,EAiBnB,CAAC"}

package/dist/tsc/ruleInput/ruleInput.js

@@ -0,0 +1,58 @@
+import { z } from "zod";
+import { FilterScopeMatch, } from "#policy/rulesStorage.js";
+import { accessPolicyInputShape, policyScopeExclusionsInput, policyScopeInput, } from "./policyInput.js";
+import { userScopeInput } from "./userScopeInput.js";
+const ruleGroupInput = z
+    .object({
+    groupId: z.coerce.string().optional(),
+    ruleGroupId: z.coerce.string().optional(),
+})
+    .transform((ruleGroupInput) => {
+    const { ruleGroupId, ...ruleGroup } = ruleGroupInput;
+    if ("string" === typeof ruleGroupId) {
+        ruleGroup.groupId = ruleGroupId;
+    }
+    return ruleGroup;
+});
+export const accessRuleInput = z
+    .object({
+    ...accessPolicyInputShape.shape,
+    ...policyScopeInput.shape,
+    ...policyScopeExclusionsInput.shape,
+})
+    .and(userScopeInput)
+    .and(ruleGroupInput)
+    .transform((ruleInput) => ruleInput);
+export const ruleEntryInput = z.object({
+    rule: accessRuleInput,
+    expiresUnixTimestamp: z.coerce.number().optional(),
+});
+export const accessRulesFilterInput = z.object({
+    policyScope: policyScopeInput.optional(),
+    policyScopes: z.array(policyScopeInput).optional(),
+    policyScopeMatch: z
+        .nativeEnum(FilterScopeMatch)
+        .default(FilterScopeMatch.Exact),
+    userScope: userScopeInput.optional(),
+    userScopeMatch: z
+        .nativeEnum(FilterScopeMatch)
+        .default(FilterScopeMatch.Exact),
+    groupId: z.string().optional(),
+    blockOnly: z.boolean().optional(),
+    includeDeferred: z.boolean().optional(),
+});
+export const getAccessRuleFiltersFromInput = (filterInput) => {
+    const { policyScopes, policyScope, ...filterBase } = filterInput;
+    const allPolicyScopes = policyScopes || [];
+    if (policyScope) {
+        allPolicyScopes.push(policyScope);
+    }
+    if (allPolicyScopes.length > 0) {
+        return allPolicyScopes.map((policyScope) => ({
+            ...filterBase,
+            policyScope,
+        }));
+    }
+    return [filterBase];
+};
+//# sourceMappingURL=ruleInput.js.map

package/dist/tsc/ruleInput/ruleInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAOtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAa1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAcJ,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC;KAC1E,MAAM,CAAC;IACP,GAAG,sBAAsB,CAAC,KAAK;IAC/B,GAAG,gBAAgB,CAAC,KAAK;IACzB,GAAG,0BAA0B,CAAC,KAAK;CACnC,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KACnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAC1B,CAAC,CAAC,MAAM,CAAC;IACR,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAavC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACG,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}

package/dist/tsc/ruleInput/userScopeInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userScopeInput.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/userScopeInput.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAkExE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,YAAY,CAAC;AAsChD,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,WAAW,CAAC;AAE/D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AAE7D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC"}