@prosopo/user-access-policy 3.15.7 → 3.15.8

package/dist/types/redis/redisRuleIndex.d.ts

@@ -0,0 +1,14 @@
+import type { RedisIndex } from "@prosopo/redis-client";
+import { type RediSearchSchema } from "@redis/search";
+import type { AccessRule } from "#policy/rule.js";
+export declare const userIpRedisSchema: RediSearchSchema;
+export declare const userAttributesRedisSchema: RediSearchSchema;
+export declare const userScopeRedisSchema: RediSearchSchema;
+export declare const policyScopeRedisSchema: RediSearchSchema;
+export declare const accessRuleRedisSchema: RediSearchSchema;
+export declare const ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
+export declare const ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
+export { GLOBAL_CLIENT_SCOPE_SENTINEL } from "#policy/rule.js";
+export declare const accessRulesRedisIndex: RedisIndex;
+export declare const getAccessRuleRedisKey: (rule: AccessRule) => string;
+//# sourceMappingURL=redisRuleIndex.d.ts.map

package/dist/types/redis/redisRuleIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRuleIndex.d.ts","sourceRoot":"","sources":["../../../src/redis/redisRuleIndex.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,KAAK,gBAAgB,EAAqB,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EACX,UAAU,EAKV,MAAM,iBAAiB,CAAC;AAGzB,eAAO,MAAM,iBAAiB,EAAE,gBAIL,CAAC;AAE5B,eAAO,MAAM,yBAAyB,EAAE,gBA0BL,CAAC;AAEpC,eAAO,MAAM,oBAAoB,EAAE,gBAGR,CAAC;AAE5B,eAAO,MAAM,sBAAsB,EAAE,gBAKL,CAAC;AAUjC,eAAO,MAAM,qBAAqB,EAAE,gBAiBR,CAAC;AAE7B,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAGvE,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAMnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE/D,eAAO,MAAM,qBAAqB,EAAE,UAOnC,CAAC;AAEF,eAAO,MAAM,qBAAqB,SAAU,UAAU,KAAG,MACD,CAAC"}

package/dist/types/redis/redisRulesStorage.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from "@prosopo/logger";
+import type { RedisConnection } from "@prosopo/redis-client";
+import type { AccessRulesStorage } from "#policy/rulesStorage.js";
+export declare const createRedisAccessRulesStorage: (connection: RedisConnection, logger: Logger) => AccessRulesStorage;
+//# sourceMappingURL=redisRulesStorage.d.ts.map

package/dist/types/redis/redisRulesStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesStorage.d.ts","sourceRoot":"","sources":["../../../src/redis/redisRulesStorage.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAEX,kBAAkB,EAElB,MAAM,yBAAyB,CAAC;AAOjC,eAAO,MAAM,6BAA6B,eAC7B,eAAe,UACnB,MAAM,KACZ,kBAqBF,CAAC"}

package/dist/types/redis/redisRulesWriter.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from "@prosopo/logger";
+import type { RedisClientType } from "redis";
+import { type AccessRule } from "#policy/rule.js";
+import type { AccessRuleEntry, AccessRulesWriter } from "#policy/rulesStorage.js";
+export declare class RedisRulesWriter implements AccessRulesWriter {
+    private readonly client;
+    private readonly logger;
+    constructor(client: RedisClientType, logger: Logger);
+    insertRules(ruleEntries: AccessRuleEntry[]): Promise<string[]>;
+    deleteRules(ruleIds: string[]): Promise<void>;
+    deleteAllRules(): Promise<number>;
+    protected insertRuleEntries(ruleEntries: AccessRuleEntry[]): Promise<string[]>;
+}
+export declare const getRedisRuleValue: (rule: AccessRule) => Record<string, string>;
+export declare class DummyRedisRulesWriter implements AccessRulesWriter {
+    private readonly logger;
+    constructor(logger: Logger);
+    insertRules(ruleEntries: AccessRuleEntry[]): Promise<string[]>;
+    deleteRules(ruleIds: string[]): Promise<void>;
+    deleteAllRules(): Promise<number>;
+}
+//# sourceMappingURL=redisRulesWriter.d.ts.map

package/dist/types/redis/redisRulesWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesWriter.d.ts","sourceRoot":"","sources":["../../../src/redis/redisRulesWriter.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,iBAAiB,CAAC;AAChF,OAAO,KAAK,EACX,eAAe,EACf,iBAAiB,EACjB,MAAM,yBAAyB,CAAC;AASjC,qBAAa,gBAAiB,YAAW,iBAAiB;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM;IAG1B,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAa9D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;cAsBvB,iBAAiB,CAChC,WAAW,EAAE,eAAe,EAAE,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC;CAqCpB;AAED,eAAO,MAAM,iBAAiB,SAAU,UAAU,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAyBzE,CAAC;AAEF,qBAAa,qBAAsB,YAAW,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAErC,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAW9D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAOvC"}

package/dist/types/rule.d.ts

@@ -0,0 +1,52 @@
+import type { CaptchaType, ResultReason } from "@prosopo/types";
+export declare enum AccessPolicyType {
+    Block = "block",
+    Restrict = "restrict",
+    Allow = "allow"
+}
+export declare const GLOBAL_CLIENT_SCOPE_SENTINEL = "global";
+export type AccessPolicy = {
+    type: AccessPolicyType;
+    captchaType?: CaptchaType;
+    description?: string;
+    solvedImagesCount?: number;
+    imageThreshold?: number;
+    powDifficulty?: number;
+    unsolvedImagesCount?: number;
+    frictionlessScore?: number;
+    deferToVerify?: boolean;
+    messageKey?: ResultReason;
+};
+export type PolicyScope = {
+    clientId?: string;
+};
+export type PolicyScopeExclusions = {
+    excludedClientIds?: string[];
+};
+export type UserIp = {
+    numericIp?: bigint;
+    numericIpMaskMin?: bigint;
+    numericIpMaskMax?: bigint;
+};
+export type UserAttributes = {
+    userId?: string;
+    ja4Hash?: string;
+    headersHash?: string;
+    userAgentHash?: string;
+    headHash?: string;
+    coords?: string;
+    countryCode?: string;
+    asn?: number;
+    os?: string;
+    browser?: string;
+    headerMatch?: string;
+    headerName?: string;
+    headerValue?: string;
+    headerOperator?: string;
+    webBotAuthAgent?: string;
+};
+export type UserScope = UserAttributes & UserIp;
+export type AccessRule = AccessPolicy & PolicyScope & PolicyScopeExclusions & UserScope & {
+    groupId?: string;
+};
+//# sourceMappingURL=rule.d.ts.map

package/dist/types/rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../src/rule.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhE,oBAAY,gBAAgB;IAC3B,KAAK,UAAU;IACf,QAAQ,aAAa;IASrB,KAAK,UAAU;CACf;AAYD,eAAO,MAAM,4BAA4B,WAAW,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAY3B,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,UAAU,CAAC,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAInC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IAUjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAOxB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;AAGhD,MAAM,MAAM,UAAU,GAAG,YAAY,GACpC,WAAW,GACX,qBAAqB,GACrB,SAAS,GAAG;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC"}

package/dist/types/ruleInput/.export.d.ts

@@ -0,0 +1,4 @@
+export { accessRuleInput, type AccessRulesFilterInput } from "./ruleInput.js";
+export { accessPolicyInput, policyScopeInput } from "./policyInput.js";
+export { userScopeInput } from "./userScopeInput.js";
+//# sourceMappingURL=.export.d.ts.map

package/dist/types/ruleInput/.export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/types/ruleInput/policyInput.d.ts

@@ -0,0 +1,109 @@
+import { ResultReason } from "@prosopo/types";
+import { z } from "zod";
+import { type AccessPolicy, AccessPolicyType } from "#policy/rule.js";
+export declare const accessPolicyInputShape: z.ZodObject<{
+    type: z.ZodNativeEnum<typeof AccessPolicyType>;
+    captchaType: z.ZodOptional<z.ZodEffects<z.ZodNativeEnum<typeof import("@prosopo/types").CaptchaType>, import("@prosopo/types").CaptchaType, import("@prosopo/types").CaptchaType>>;
+    description: z.ZodOptional<z.ZodString>;
+    solvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    imageThreshold: z.ZodOptional<z.ZodNumber>;
+    powDifficulty: z.ZodOptional<z.ZodNumber>;
+    unsolvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    frictionlessScore: z.ZodOptional<z.ZodNumber>;
+    deferToVerify: z.ZodOptional<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
+    messageKey: z.ZodOptional<z.ZodNativeEnum<typeof ResultReason>>;
+}, "strip", z.ZodTypeAny, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+    messageKey?: ResultReason | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+    messageKey?: ResultReason | undefined;
+}>;
+export declare const accessPolicyInput: z.ZodEffects<z.ZodObject<{
+    type: z.ZodNativeEnum<typeof AccessPolicyType>;
+    captchaType: z.ZodOptional<z.ZodEffects<z.ZodNativeEnum<typeof import("@prosopo/types").CaptchaType>, import("@prosopo/types").CaptchaType, import("@prosopo/types").CaptchaType>>;
+    description: z.ZodOptional<z.ZodString>;
+    solvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    imageThreshold: z.ZodOptional<z.ZodNumber>;
+    powDifficulty: z.ZodOptional<z.ZodNumber>;
+    unsolvedImagesCount: z.ZodOptional<z.ZodNumber>;
+    frictionlessScore: z.ZodOptional<z.ZodNumber>;
+    deferToVerify: z.ZodOptional<z.ZodEffects<z.ZodBoolean, boolean, unknown>>;
+    messageKey: z.ZodOptional<z.ZodNativeEnum<typeof ResultReason>>;
+}, "strip", z.ZodTypeAny, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+    messageKey?: ResultReason | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+    messageKey?: ResultReason | undefined;
+}>, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: boolean | undefined;
+    messageKey?: ResultReason | undefined;
+}, {
+    type: AccessPolicyType;
+    captchaType?: import("@prosopo/types").CaptchaType | undefined;
+    description?: string | undefined;
+    solvedImagesCount?: number | undefined;
+    imageThreshold?: number | undefined;
+    powDifficulty?: number | undefined;
+    unsolvedImagesCount?: number | undefined;
+    frictionlessScore?: number | undefined;
+    deferToVerify?: unknown;
+    messageKey?: ResultReason | undefined;
+}>;
+export declare const sanitizeAccessPolicy: (policy: AccessPolicy) => AccessPolicy;
+export declare const policyScopeInput: z.ZodObject<{
+    clientId: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, unknown>;
+}, "strip", z.ZodTypeAny, {
+    clientId?: string | undefined;
+}, {
+    clientId?: unknown;
+}>;
+export declare const policyScopeExclusionsInput: z.ZodObject<{
+    excludedClientIds: z.ZodEffects<z.ZodOptional<z.ZodArray<z.ZodString, "many">>, string[] | undefined, unknown>;
+}, "strip", z.ZodTypeAny, {
+    excludedClientIds?: string[] | undefined;
+}, {
+    excludedClientIds?: unknown;
+}>;
+//# sourceMappingURL=policyInput.d.ts.map

package/dist/types/ruleInput/policyInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyInput.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/policyInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAA+B,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAwBzB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBD,CAAC;AAEnC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB7B,CAAC;AAOF,eAAO,MAAM,oBAAoB,WAAY,YAAY,KAAG,YAM3D,CAAC;AAOF,eAAO,MAAM,gBAAgB;;;;;;EAUI,CAAC;AAalC,eAAO,MAAM,0BAA0B;;;;;;EAYI,CAAC"}

package/dist/types/ruleInput/ruleInput.d.ts

@@ -0,0 +1,204 @@
+import { type ZodType, z } from "zod";
+import type { AccessPolicy, AccessRule, PolicyScope, PolicyScopeExclusions } from "#policy/rule.js";
+import { type AccessRuleEntry, type AccessRulesFilter, FilterScopeMatch } from "#policy/rulesStorage.js";
+import { type UserScopeInput } from "./userScopeInput.js";
+type RuleGroupInput = {
+    groupId?: string;
+    ruleGroupId?: string;
+};
+export type AccessRuleInput = AccessPolicy & PolicyScope & PolicyScopeExclusions & UserScopeInput & RuleGroupInput;
+export declare const accessRuleInput: ZodType<AccessRule, z.ZodTypeDef, unknown>;
+export declare const ruleEntryInput: ZodType<AccessRuleEntry, z.ZodTypeDef, unknown>;
+export type AccessRulesFilterInput = AccessRulesFilter & {
+    userScope?: UserScopeInput;
+    policyScopes?: PolicyScope[];
+};
+export declare const accessRulesFilterInput: z.ZodObject<{
+    policyScope: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, unknown>;
+    }, "strip", z.ZodTypeAny, {
+        clientId?: string | undefined;
+    }, {
+        clientId?: unknown;
+    }>>;
+    policyScopes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        clientId: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, unknown>;
+    }, "strip", z.ZodTypeAny, {
+        clientId?: string | undefined;
+    }, {
+        clientId?: unknown;
+    }>, "many">>;
+    policyScopeMatch: z.ZodDefault<z.ZodNativeEnum<typeof FilterScopeMatch>>;
+    userScope: z.ZodOptional<z.ZodEffects<z.ZodIntersection<z.ZodIntersection<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>, z.ZodEffects<z.ZodObject<{
+        ip: z.ZodOptional<z.ZodString>;
+        ipMask: z.ZodOptional<z.ZodString>;
+        numericIp: z.ZodOptional<z.ZodBigInt>;
+        numericIpMaskMin: z.ZodOptional<z.ZodBigInt>;
+        numericIpMaskMax: z.ZodOptional<z.ZodBigInt>;
+    }, "strip", z.ZodTypeAny, {
+        ip?: string | undefined;
+        ipMask?: string | undefined;
+        numericIp?: bigint | undefined;
+        numericIpMaskMin?: bigint | undefined;
+        numericIpMaskMax?: bigint | undefined;
+    }, {
+        ip?: string | undefined;
+        ipMask?: string | undefined;
+        numericIp?: bigint | undefined;
+        numericIpMaskMin?: bigint | undefined;
+        numericIpMaskMax?: bigint | undefined;
+    }>, import("#policy/rule.js").UserIp, {
+        ip?: string | undefined;
+        ipMask?: string | undefined;
+        numericIp?: bigint | undefined;
+        numericIpMaskMin?: bigint | undefined;
+        numericIpMaskMax?: bigint | undefined;
+    }>>, z.ZodEffects<z.ZodObject<{
+        userAgent: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodString>;
+        ja4Hash: z.ZodOptional<z.ZodString>;
+        headersHash: z.ZodOptional<z.ZodString>;
+        userAgentHash: z.ZodOptional<z.ZodString>;
+        headHash: z.ZodOptional<z.ZodString>;
+        coords: z.ZodOptional<z.ZodString>;
+        countryCode: z.ZodOptional<z.ZodString>;
+        asn: z.ZodOptional<z.ZodNumber>;
+        os: z.ZodOptional<z.ZodString>;
+        browser: z.ZodOptional<z.ZodString>;
+        headerMatch: z.ZodOptional<z.ZodString>;
+        headerName: z.ZodOptional<z.ZodString>;
+        headerValue: z.ZodOptional<z.ZodString>;
+        headerOperator: z.ZodOptional<z.ZodString>;
+        webBotAuthAgent: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strip", z.ZodTypeAny, {
+        userAgentHash?: string | undefined;
+        userId?: string | undefined;
+        ja4Hash?: string | undefined;
+        headersHash?: string | undefined;
+        headHash?: string | undefined;
+        coords?: string | undefined;
+        countryCode?: string | undefined;
+        asn?: number | undefined;
+        os?: string | undefined;
+        browser?: string | undefined;
+        headerMatch?: string | undefined;
+        headerName?: string | undefined;
+        headerValue?: string | undefined;
+        headerOperator?: string | undefined;
+        webBotAuthAgent?: string | undefined;
+        userAgent?: string | undefined;
+    }, {
+        userAgentHash?: string | undefined;
+        userId?: string | undefined;
+        ja4Hash?: string | undefined;
+        headersHash?: string | undefined;
+        headHash?: string | undefined;
+        coords?: string | undefined;
+        countryCode?: string | undefined;
+        asn?: number | undefined;
+        os?: string | undefined;
+        browser?: string | undefined;
+        headerMatch?: string | undefined;
+        headerName?: string | undefined;
+        headerValue?: string | undefined;
+        headerOperator?: string | undefined;
+        webBotAuthAgent?: string | undefined;
+        userAgent?: string | undefined;
+    }>, import("#policy/rule.js").UserAttributes, {
+        userAgentHash?: string | undefined;
+        userId?: string | undefined;
+        ja4Hash?: string | undefined;
+        headersHash?: string | undefined;
+        headHash?: string | undefined;
+        coords?: string | undefined;
+        countryCode?: string | undefined;
+        asn?: number | undefined;
+        os?: string | undefined;
+        browser?: string | undefined;
+        headerMatch?: string | undefined;
+        headerName?: string | undefined;
+        headerValue?: string | undefined;
+        headerOperator?: string | undefined;
+        webBotAuthAgent?: string | undefined;
+        userAgent?: string | undefined;
+    }>>, UserScopeInput, {} & {
+        ip?: string | undefined;
+        ipMask?: string | undefined;
+        numericIp?: bigint | undefined;
+        numericIpMaskMin?: bigint | undefined;
+        numericIpMaskMax?: bigint | undefined;
+    } & {
+        userAgentHash?: string | undefined;
+        userId?: string | undefined;
+        ja4Hash?: string | undefined;
+        headersHash?: string | undefined;
+        headHash?: string | undefined;
+        coords?: string | undefined;
+        countryCode?: string | undefined;
+        asn?: number | undefined;
+        os?: string | undefined;
+        browser?: string | undefined;
+        headerMatch?: string | undefined;
+        headerName?: string | undefined;
+        headerValue?: string | undefined;
+        headerOperator?: string | undefined;
+        webBotAuthAgent?: string | undefined;
+        userAgent?: string | undefined;
+    }>>;
+    userScopeMatch: z.ZodDefault<z.ZodNativeEnum<typeof FilterScopeMatch>>;
+    groupId: z.ZodOptional<z.ZodString>;
+    blockOnly: z.ZodOptional<z.ZodBoolean>;
+    includeDeferred: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    policyScopeMatch: FilterScopeMatch;
+    userScopeMatch: FilterScopeMatch;
+    userScope?: UserScopeInput | undefined;
+    groupId?: string | undefined;
+    policyScope?: {
+        clientId?: string | undefined;
+    } | undefined;
+    blockOnly?: boolean | undefined;
+    includeDeferred?: boolean | undefined;
+    policyScopes?: {
+        clientId?: string | undefined;
+    }[] | undefined;
+}, {
+    userScope?: ({} & {
+        ip?: string | undefined;
+        ipMask?: string | undefined;
+        numericIp?: bigint | undefined;
+        numericIpMaskMin?: bigint | undefined;
+        numericIpMaskMax?: bigint | undefined;
+    } & {
+        userAgentHash?: string | undefined;
+        userId?: string | undefined;
+        ja4Hash?: string | undefined;
+        headersHash?: string | undefined;
+        headHash?: string | undefined;
+        coords?: string | undefined;
+        countryCode?: string | undefined;
+        asn?: number | undefined;
+        os?: string | undefined;
+        browser?: string | undefined;
+        headerMatch?: string | undefined;
+        headerName?: string | undefined;
+        headerValue?: string | undefined;
+        headerOperator?: string | undefined;
+        webBotAuthAgent?: string | undefined;
+        userAgent?: string | undefined;
+    }) | undefined;
+    groupId?: string | undefined;
+    policyScope?: {
+        clientId?: unknown;
+    } | undefined;
+    policyScopeMatch?: FilterScopeMatch | undefined;
+    userScopeMatch?: FilterScopeMatch | undefined;
+    blockOnly?: boolean | undefined;
+    includeDeferred?: boolean | undefined;
+    policyScopes?: {
+        clientId?: unknown;
+    }[] | undefined;
+}>;
+export declare const getAccessRuleFiltersFromInput: (filterInput: AccessRulesFilterInput) => AccessRulesFilter[];
+export {};
+//# sourceMappingURL=ruleInput.d.ts.map

package/dist/types/ruleInput/ruleInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleInput.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,qBAAqB,EACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,KAAK,cAAc,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,YAAY,GACzC,WAAW,GACX,qBAAqB,GACrB,cAAc,GACd,cAAc,CAAC;AA6BhB,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAQL,CAAC;AAEnE,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAIrC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACxD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B,CAAC;AAQF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaS,CAAC;AAE7C,eAAO,MAAM,6BAA6B,gBAC5B,sBAAsB,KACjC,iBAAiB,EAiBnB,CAAC"}

package/dist/types/ruleInput/userScopeInput.d.ts

@@ -0,0 +1,181 @@
+import { z } from "zod";
+import type { UserAttributes, UserIp } from "#policy/rule.js";
+import type { UserAttributesRecord, UserIpRecord } from "#policy/ruleRecord.js";
+export type UserAttributesInput = UserAttributes & UserAttributesRecord;
+export type UserIpInput = UserIp & UserIpRecord;
+export type UserScopeInput = UserAttributesInput & UserIpInput;
+export declare const userScopeSchema: z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    ja4Hash: z.ZodOptional<z.ZodString>;
+    headersHash: z.ZodOptional<z.ZodString>;
+    userAgentHash: z.ZodOptional<z.ZodString>;
+    headHash: z.ZodOptional<z.ZodString>;
+    coords: z.ZodOptional<z.ZodString>;
+    countryCode: z.ZodOptional<z.ZodString>;
+    asn: z.ZodOptional<z.ZodNumber>;
+    os: z.ZodOptional<z.ZodString>;
+    browser: z.ZodOptional<z.ZodString>;
+    headerMatch: z.ZodOptional<z.ZodString>;
+    headerName: z.ZodOptional<z.ZodString>;
+    headerValue: z.ZodOptional<z.ZodString>;
+    headerOperator: z.ZodOptional<z.ZodString>;
+    webBotAuthAgent: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    numericIp: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMin: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMax: z.ZodOptional<z.ZodBigInt>;
+}, "strip", z.ZodTypeAny, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    headHash?: string | undefined;
+    coords?: string | undefined;
+    countryCode?: string | undefined;
+    asn?: number | undefined;
+    os?: string | undefined;
+    browser?: string | undefined;
+    headerMatch?: string | undefined;
+    headerName?: string | undefined;
+    headerValue?: string | undefined;
+    headerOperator?: string | undefined;
+    webBotAuthAgent?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    headHash?: string | undefined;
+    coords?: string | undefined;
+    countryCode?: string | undefined;
+    asn?: number | undefined;
+    os?: string | undefined;
+    browser?: string | undefined;
+    headerMatch?: string | undefined;
+    headerName?: string | undefined;
+    headerValue?: string | undefined;
+    headerOperator?: string | undefined;
+    webBotAuthAgent?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}>;
+export declare const userScopeInput: z.ZodEffects<z.ZodIntersection<z.ZodIntersection<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>, z.ZodEffects<z.ZodObject<{
+    ip: z.ZodOptional<z.ZodString>;
+    ipMask: z.ZodOptional<z.ZodString>;
+    numericIp: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMin: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMax: z.ZodOptional<z.ZodBigInt>;
+}, "strip", z.ZodTypeAny, {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}, {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}>, UserIp, {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}>>, z.ZodEffects<z.ZodObject<{
+    userAgent: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    ja4Hash: z.ZodOptional<z.ZodString>;
+    headersHash: z.ZodOptional<z.ZodString>;
+    userAgentHash: z.ZodOptional<z.ZodString>;
+    headHash: z.ZodOptional<z.ZodString>;
+    coords: z.ZodOptional<z.ZodString>;
+    countryCode: z.ZodOptional<z.ZodString>;
+    asn: z.ZodOptional<z.ZodNumber>;
+    os: z.ZodOptional<z.ZodString>;
+    browser: z.ZodOptional<z.ZodString>;
+    headerMatch: z.ZodOptional<z.ZodString>;
+    headerName: z.ZodOptional<z.ZodString>;
+    headerValue: z.ZodOptional<z.ZodString>;
+    headerOperator: z.ZodOptional<z.ZodString>;
+    webBotAuthAgent: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strip", z.ZodTypeAny, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    headHash?: string | undefined;
+    coords?: string | undefined;
+    countryCode?: string | undefined;
+    asn?: number | undefined;
+    os?: string | undefined;
+    browser?: string | undefined;
+    headerMatch?: string | undefined;
+    headerName?: string | undefined;
+    headerValue?: string | undefined;
+    headerOperator?: string | undefined;
+    webBotAuthAgent?: string | undefined;
+    userAgent?: string | undefined;
+}, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    headHash?: string | undefined;
+    coords?: string | undefined;
+    countryCode?: string | undefined;
+    asn?: number | undefined;
+    os?: string | undefined;
+    browser?: string | undefined;
+    headerMatch?: string | undefined;
+    headerName?: string | undefined;
+    headerValue?: string | undefined;
+    headerOperator?: string | undefined;
+    webBotAuthAgent?: string | undefined;
+    userAgent?: string | undefined;
+}>, UserAttributes, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    headHash?: string | undefined;
+    coords?: string | undefined;
+    countryCode?: string | undefined;
+    asn?: number | undefined;
+    os?: string | undefined;
+    browser?: string | undefined;
+    headerMatch?: string | undefined;
+    headerName?: string | undefined;
+    headerValue?: string | undefined;
+    headerOperator?: string | undefined;
+    webBotAuthAgent?: string | undefined;
+    userAgent?: string | undefined;
+}>>, UserScopeInput, {} & {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+} & {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    headHash?: string | undefined;
+    coords?: string | undefined;
+    countryCode?: string | undefined;
+    asn?: number | undefined;
+    os?: string | undefined;
+    browser?: string | undefined;
+    headerMatch?: string | undefined;
+    headerName?: string | undefined;
+    headerValue?: string | undefined;
+    headerOperator?: string | undefined;
+    webBotAuthAgent?: string | undefined;
+    userAgent?: string | undefined;
+}>;
+//# sourceMappingURL=userScopeInput.d.ts.map

package/dist/types/ruleInput/userScopeInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userScopeInput.d.ts","sourceRoot":"","sources":["../../../src/ruleInput/userScopeInput.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAkExE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,YAAY,CAAC;AAsChD,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,WAAW,CAAC;AAE/D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AAE7D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC"}

package/dist/types/ruleRecord.d.ts

@@ -0,0 +1,18 @@
+import type { AccessPolicy, PolicyScope, PolicyScopeExclusions, UserAttributes } from "#policy/rule.js";
+export type UserAttributesRecord = Omit<UserAttributes, "userAgentHash"> & {
+    userAgent?: string;
+};
+export declare const userAttributesRecordFields: ["userId", "ja4Hash", "headersHash", "userAgent", "headHash", "coords", "countryCode", "asn", "os", "browser", "headerMatch", "headerName", "headerValue", "headerOperator", "webBotAuthAgent"];
+export type UserIpRecord = {
+    ip?: string;
+    ipMask?: string;
+};
+export declare const userIpRecordFields: ["ip", "ipMask"];
+export type UserScopeRecord = UserAttributesRecord & UserIpRecord;
+export declare const userScopeRecordFields: ["userId", "ja4Hash", "headersHash", "userAgent", "headHash", "coords", "countryCode", "asn", "os", "browser", "headerMatch", "headerName", "headerValue", "headerOperator", "webBotAuthAgent", "ip", "ipMask"];
+export type UserScopeRecordField = (typeof userScopeRecordFields)[number];
+export type AccessRuleRecord = AccessPolicy & PolicyScope & PolicyScopeExclusions & UserScopeRecord & {
+    ruleGroupId?: string;
+};
+export declare const getUserScopeRecordFromAccessRuleRecord: (ruleRecord: AccessRuleRecord) => UserScopeRecord;
+//# sourceMappingURL=ruleRecord.d.ts.map

package/dist/types/ruleRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleRecord.d.ts","sourceRoot":"","sources":["../../src/ruleRecord.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACX,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,0BAA0B,iMAgBY,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAE1B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,kBAAkB,kBAGY,CAAC;AAE5C,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,YAAY,CAAC;AAElE,eAAO,MAAM,qBAAqB,iNAGY,CAAC;AAE/C,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAC1C,WAAW,GACX,qBAAqB,GACrB,eAAe,GAAG;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEH,eAAO,MAAM,sCAAsC,eACtC,gBAAgB,KAC1B,eAKD,CAAC"}